A vehicle networking security batch authentication method for a cloud service scenario

Abstract

The application provides a batch authentication method for a cloud service scenario of Internet of Vehicles, and relates to the fields of Internet of Vehicles and post-quantum security; the batch authentication method comprises the following steps: a trusted agency generates public parameters and a public-private key pair of the trusted agency; a vehicle and a road test unit apply for registration to the trusted agency, and the trusted agency generates an identifier and a private key for the vehicle and the road test unit according to an access control strategy of the vehicle and the road test unit; when the vehicle and the road test unit communicate with a cloud server, the vehicle and the road test unit digitally sign a message sent by the vehicle and the road test unit by using the private key of the vehicle and the road test unit; when the cloud server receives a large amount of messages, the cloud server performs batch authentication on the messages with the same attribute to verify the authenticity and integrity of the messages and speed up the authentication process; the batch authentication method can provide a safe and efficient data authentication service for the cloud server, reduce the consumption of storage and computing resources, and reduce the response delay and the average message packet loss rate; and the method can realize fine-grained access control and post-quantum security.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of supporting post-quantum secure vehicle networking data signature, and particularly relates to a vehicle networking security batch authentication method for a cloud service scenario. BACKGROUND

[0002] Vehicle ad hoc networks (vehicle networking) as an important part of intelligent transportation systems (ITSs) not only improves the safety and efficiency of road traffic management systems, but also enhances the driving experience of users. In vehicle networking, there are at least three participants: vehicles with on-board units (OBUs), road test units (RSUs) and cloud servers. Vehicle networking supports multiple types of communication protocols, such as vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), vehicle-to-cloud (V2C), vehicle-to-person (V2P) and infrastructure-to-cloud (I2C). In fact, all wired communications, dedicated short-range communication protocols (DSRC), 5G and even future 6G can be used for vehicle networking communications.

[0003] Due to the real-time generation of a large amount of traffic data in vehicle networking, cloud servers play an important role in processing these massive amounts of data. In practical applications, after receiving traffic data from vehicles and road side units through V2C, I2C and other protocols (for simplicity, X2C is used to represent the communication between the cloud server and X, where X represents vehicles, road side units, etc.), the cloud server processes these massive amounts of traffic data to complete traffic situation awareness and traffic management, which is the basis for improving traffic efficiency and realizing intelligent traffic. How to ensure the security and efficiency of communication with the cloud server is a very necessary requirement. The cloud server wants to ensure the legitimacy of the requirements of vehicles and road test units before providing services. At the same time, vehicles and the like also hope that the cloud server can respond to their requirements as soon as possible, especially when a large number of vehicles and road test units need the services of the cloud server.

[0004] Batch authentication provides an effective solution to guarantee the security and efficiency of communication with the cloud server. In batch authentication, multiple authentications from different parties can be verified at the same time. Obviously, the cloud server of the Internet of Vehicles can use batch authentication to process messages from different vehicles and road test units, etc. In this way, the security and efficiency requirements of the Internet of Vehicles can be met at the same time. Further, there is a need for privacy protection for data sending vehicles during data authentication. Otherwise, the leakage of vehicle privacy information will pose a threat to the safety of the vehicle owner. Attribute-based signature (ABS) provides a feasible solution for the privacy protection requirements of batch authentication. In ABS, the characteristics of vehicles or road test units are regarded as attributes, and an access control policy is used to verify the validity of the attributes. In the case of correct matching of attributes and access control policy, attribute-based signature can be verified and accepted. When the signature is generated by vehicles and road test units with the same attributes, the cloud server can use the same access control policy to check the attributes. Once the attributes match the given access control policy, the signatures from vehicles and road test units can be verified in batches.

[0005] As mentioned above, data authentication, data communication efficiency and privacy protection are important real needs in the data communication of the Internet of Vehicles. However, most of the existing batch authentication schemes for the Internet of Vehicles cannot meet the above needs at the same time. The main performance is as follows: 1) In the known attribute-based signature batch authentication algorithm [1], when multiple signatures need to be verified at the same time, the time of batch authentication will increase rapidly, causing the cloud server to be unable to respond in time; 2) Some schemes [2-4] cannot guarantee the identity privacy of data sending vehicles during the batch authentication process of Internet of Vehicles data, and there is a risk of identity privacy leakage, leading to network attacks; 3) Most of the existing schemes [5, 6] cannot provide long-term security, and most of the existing schemes are designed based on the difficulty of large integer factorization and discrete logarithm problem, and cannot resist quantum attacks.

[0006] Among them, [1] Yu P, Ni W, Yu G, et al. Efficient anonymous data authentication for vehicular ad hoc networks[J]. Security and Communication Networks, 2021, 2021(1): 6638453. [2]Liu F, Wang Q. IBRS: an efficient identity-based batch verification scheme for VANETs based on ring signature[C] / / 2019 IEEE Vehicular Networking Conference (VNC). IEEE, 2019: 1-8. [3]Ali I, Lawrence T, Li F. An efficient identity-based signature scheme without bilinear pairing for vehicle-to-vehicle communication in VANETs[J]. Journal of Systems Architecture, 2020, 103: 101692. [4] Vangujar A K, Umrani A, Palmieri P. Identity-Based Cluster Authentication and Key Exchange (ID-CAKE) Message Broadcasting and Batch Verification in VANETs[C] / / International Conference on Applied Cryptography and Network Security. Cham: Springer Nature Switzerland, 2024: 162-179. [5] Li J, Chen X, Huang X. New attribute–based authentication and its application in anonymous cloud access service[J].International Journal of Web and Grid Services, 2015, 11(1): 125-141.[6] Tao Q, Cui X, Iftekhar A. A novel lightweight decentralized attribute-based signature scheme for social co-governance[J]. Information Sciences, 2024, 654: 119839. SUMMARY

[0007] The application aims to provide a secure batch authentication method for cloud service scenarios of Internet of Vehicles, which provides a safe and efficient solution for data authentication, data communication efficiency and privacy protection in the process of data communication of Internet of Vehicles.

[0008] To achieve the above-mentioned purpose, the application provides a data communication solution for Internet of Vehicles composed of four entities of trusted agency, cloud server, vehicle and road test unit as follows:

[0009] A secure batch authentication method for cloud service scenarios of Internet of Vehicles, comprising the following steps:

[0010] Step A, system establishment stage: the trusted agency generates system public parameters and a public-private key pair of the trusted agency;

[0011] Step B, key extraction stage: the entities such as vehicles and road test units make registration requests to the trusted agency and send access control policies, the trusted agency generates identifiers and private keys according to the access control policies and returns them to the corresponding entities;

[0012] Step C, vehicles and road test units sending messages to the cloud server stage: the vehicles and road test units use their own private keys to digitally sign the sent messages, and then send the messages, signatures, attributes and identifiers to the cloud server;

[0013] Step D, single authentication stage of the cloud server: when the cloud server only receives a single message, it first checks whether the attributes and the access control policies match, if they match, it verifies the authenticity and integrity of the message using a single authentication algorithm;

[0014] Step E, batch authentication stage of the cloud server: when the cloud server receives a large number of messages, it first checks whether the attributes and the access control policies match, if they match, it verifies the authenticity and integrity of the messages in batches using a batch authentication algorithm;

[0015] Further, the step A specifically comprises:

[0016] The trusted authority generates a set of security parameters according to the system parameters . After that, the trusted authority selects three secure hash functions: .

[0017] The secure hash function takes a string of 0 and 1 of specified length as input and outputs a string of fixed range of specified length.

[0018] The trusted authority sets and a unit matrix . The trusted authority generates and trapdoor .The public key of the trusted authority is and the private key is .

[0019] Further, the step B specifically includes:

[0020] The trusted authority generates an identifier for the vehicle or road test unit according to the access control policy . The attribute , , .

[0021] The trusted authority calculates , .

[0022] The trusted authority modifies the access control policy and obtains the function , . , .

[0023] The trusted authority runs algorithm and obtains the private key .The trusted authority sends the identifier and the private key to the vehicle or road test unit. The vehicle or road test unit verifies the correctness of the private key it receives by calculating whether the equation is true.

[0024] Further, the step C specifically includes:

[0025] The vehicle or road test unit digitally signs the message to be sent to the cloud server.

[0026] The vehicle or road test unit calculates , , where is according to a Gaussian distribution selected.

[0027] The vehicle or road testing unit calculates , and .

[0028] The vehicle or road testing unit calculates and .

[0029] The vehicle or road testing unit runs algorithm, obtains signature and then sends to the cloud server.

[0030] Further, the step D specifically includes:

[0031] The cloud server only receives a single message It first calculates If , end verification, if , the following steps are performed.

[0032] The cloud server calculates , and .

[0033] The cloud server calculates and .

[0034] The cloud server calculates , .

[0035] The cloud server decides whether to receive this message by calculating whether the equation is true.

[0036] Further, the step E specifically includes:

[0037] The cloud server receives a large number of messages It first calculates If , end verification, if , the following steps are performed.

[0038] The cloud server calculates , and .

[0039] The cloud server calculates and .

[0040] Cloud server computing , .

[0041] The cloud server decides whether to receive the batch of messages by determining whether the following equation holds true:

[0042] Compared with the prior art, the present application has the following beneficial effects:

[0043] The present application provides a secure batch authentication method for vehicle networking in a cloud service scenario, which has high communication efficiency. In the method, the attributes are defined as the characteristics of the vehicles and the road test units, the signature keys of the vehicles and the road test units are associated with the access control policy, and the signatures of the vehicles and the road test units are associated with their attributes. Once the attributes match the access control policy, the cloud server can simultaneously verify multiple messages from vehicles and road test units with the same attributes, thereby improving the authentication efficiency and reducing the response time of the cloud server. Therefore, the present application realizes high communication efficiency through cloud server batch authentication, thereby effectively improving traffic efficiency, traffic safety and driving experience.

[0044] The present application provides a secure batch authentication method for vehicle networking in a cloud service scenario, which has privacy protection and post-quantum security. In the process of data communication, since only part of the attributes of the vehicles and the road test units are disclosed, no one can know their identities, so the privacy protection of the vehicles and the road test units is effectively realized, which is more in line with the needs of the vehicle networking communication scenario. At the same time, the present application uses a lattice-based cryptographic tool, so the proposed method can realize post-quantum security. Based on this method, security protection under the attacks of selecting attributes and selecting messages is provided in the process of interaction between the vehicles and the road test units and the cloud server.

[0045] ​The application provides a vehicle networking security batch authentication method for a cloud service scenario, which has good space efficiency and computing efficiency. Thanks to the attribute-based signature length being irrelevant to the attribute size, the method realizes shorter single signature length, which can effectively save the system bandwidth of X2C communication. In addition, for multiple signatures from vehicles and road test units with the same attribute, the cloud server can complete batch authentication through multiple vector addition operations and the like. Therefore, as the number of signatures increases, the time of batch authentication grows slowly, which directly leads to shorter response time of the cloud server. Therefore, the method has significant advantages in storage space efficiency and computing efficiency, and compared with existing batch authentication schemes, the method fully saves the system space resources and computing resources, thereby realizing more efficient resource utilization. In addition, network simulation (Network Simulator 3, NS3) is used to test the response time delay and average message loss rate of the method. The simulation results show that the response time of batch authentication is saved by at least 30% compared with single authentication, and the average message loss rate is always less than 15%. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 The model architecture of the application is shown in the figure;

[0047] Figure 2 The scheme flowchart of the application is shown in the figure;

[0048] Figure 3 The comparison of the application and existing achievements in signature length is shown in the figure;

[0049] Figure 4 The comparison of the application and existing achievements in message signature algorithm computing efficiency is shown in the figure;

[0050] Figure 5 The comparison of the application and existing achievements in message batch authentication algorithm computing efficiency is shown in the figure;

[0051] Figure 6 The response time of the cloud server under the influence of vehicle density of the application is shown in the figure;

[0052] Figure 7 The comparison of single authentication and batch authentication response time of the cloud server under the influence of vehicle density of the application is shown in the figure;

[0053] Figure 8 The packet loss rate graph of the application under the influence of vehicle speed and vehicle density is shown in the figure;

[0054] Figure 9 The radar chart of the implementation effect comparison of the application and existing achievements is shown in the figure; DETAILED DESCRIPTION

[0055] The present application will be described in detail below with reference to the accompanying drawings and specific implementation cases in the embodiments of the present application. The present embodiment is implemented based on the technical scheme of the present application, and it should be understood that the specific embodiment is only used to illustrate the present application but not to limit the scope of the present application.

[0056] The present application provides a secure batch authentication method for vehicle networking in a cloud service scenario.

[0057] First, the following terms are explained:

[0058] Attribute-based signature: Attribute-based signature is a special digital signature technology. Its signature is associated with a set of attributes, rather than a specific entity, which has flexible and fine-grained access control capabilities. It is suitable for scenarios that require authorization and authentication based on user attributes, such as access control, cloud computing, etc.

[0059] Batch authentication: Batch authentication is a method of authenticating multiple entities or requests at a time. It is beneficial to improve authentication efficiency and reduce repetitive operations. It is suitable for authentication of large amounts of data in network communication.

[0060] Cloud service: Cloud server stores and manages a large amount of vehicle and road testing unit data, including vehicle driving trajectory, road traffic conditions, etc., providing basis for vehicle traffic planning, etc. Cloud server can analyze real-time and historical data. Cloud server analyzes vehicle position, speed, acceleration, etc. in real time to provide users with more optimized navigation routes. Cloud server provides intelligent services for vehicles, such as emergency rescue services, gas stations, parking lots, charging pile information, etc.

[0061] Ideal lattice: Ideal lattice is a special lattice obtained by improving random lattice. Compared with random lattice, ideal lattice can reduce the space size of matrix or vector in algorithm.

[0062] The required symbols in the present embodiment are explained as shown in Table 1:

[0063] Table 1: Symbol explanation

[0064] Notation Explanation of Notations A (bold capital letter) Matrix b (bold lower case letter) Vector in column form R [Z[X] / [X n +1]]]> [R q ]] Z q [X] / [X n +1]]]> ||.|| Euclidean norm H Secure hash function | id f |]]> Identifier length τ Attribute vector Access control policy function [R g ]]> Private key of access control policy function e Signature <![CDATA[D c,s ]]> Gaussian distribution s, δ Gaussian parameters r←R Randomly extract an element r from set R [TECHNICAL FIELD] mv ]] Matrix and vector multiplication operation time [CAT mm ]] Matrix modular multiplication time [CAT h ]]> Hash operation time [TECHNICAL FIELD] add ]] Vector addition operation time

[0065] The concepts and design tools involved in the present embodiment are explained:

[0066] Lattice: Given a linearly independent basis vector set , define dimension lattice as In this method, we focus on an ideal lattice . For an integer , denotes its ring element coefficient from ring. For , we focus on a q-dimensional lattice and its coset .

[0067] Discrete Gaussian distribution: A discrete Gaussian distribution on a lattice is defined as where , centered at a dimensional Gaussian distribution can be represented as .

[0068] Ring Shortest Integer Solution problem (ring-SIS problem): Given a uniform random vector and a norm bound , the ring-SIS problem is to find a non-zero vector such that , .

[0069] Trapdoor: Given a security parameter set , an original vector , a trapdoor label , and a unit matrix , then the trapdoor can be defined as a matrix and satisfies .

[0070] Trapdoor generation algorithm : For parameters , there is a probabilistic polynomial time algorithm , whose output is a vector close to uniform distribution and its trapdoor .

[0071] Gaussian sampling algorithm : For parameters , there is a probabilistic polynomial time algorithm , input , , trapdoor and a target element , it outputs a vector close to Gaussian distribution and .

[0072] The system architecture model of the embodiment is as shown in Figure 1As shown. This embodiment provides a specific implementation plan that includes four parts: system establishment, key extraction, message signing, and message authentication, as follows. Figure 2 As shown. The system establishment module generates system public parameters and public-private key pairs for trusted institutions. The key extraction module generates user identifiers and private keys and transmits them to the corresponding entities. The message signing module is the process by which vehicles and road test units sign the messages to be sent. The message authentication module is the process by which the cloud server performs batch authentication on massive amounts of messages and signature pairs from vehicles and road test units with the same attributes.

[0073] System establishment phase: The trusted organization generates system public parameters and its own public-private key pair. 1. The trusted organization, based on the system parameters... Generate a set of security parameters 2. The trusted institution selects three secure hash functions: 3. Trusted Organization Setup and an identity matrix Trusted institutions utilize Algorithm generation and Trapdoor Then, the public key of the trusted institution is The private key is Public parameters Public keys of trusted institutions Secretly store the private keys of trusted institutions .

[0074] Key extraction phase: Vehicles and road test units, among other entities, submit registration requests and send access control policies to the trusted authority. The trusted authority then processes these requests according to the access control policies. Generate identifiers and private key And return it to the corresponding entity. 1. Trusted institutions, based on access control policies... Generate identifiers for vehicles or road test units , among which attributes , , 2. Trusted Institution Calculation , 3. Trusted institutions modify access control policies. The function is then obtained. , ,according to calculate , 4. Operation of trusted institutions algorithm, Obtain the private key and the identifier and private key The vehicle or road testing unit sends the message to the cloud server, which verifies the message by computing whether the equation is true or not.

[0075] Message signing phase: the vehicle or road testing unit with attributes , and corresponding access control policy signs the message to be sent. 1. The vehicle or road testing unit computes , , , where is selected according to a Gaussian distribution . 2. The vehicle or road testing unit computes , and . 3. The vehicle or road testing unit computes and . 4. The vehicle or road testing unit runs the algorithm, obtains the signature , and then sends to the cloud server.

[0076] Message authentication phase: the cloud server authenticates the received message to verify the authenticity and integrity of the message.

[0077] The cloud server only receives a single message : 1. The cloud server computes , if , the verification ends, if , the following steps are executed. 2. The cloud server computes , and . 3. The cloud server computes and . 4. The cloud server computes , . 5. The cloud server decides whether to receive this message by computing whether the equation is true or not.

[0078] If the cloud server receives multiple messages with the same attributes , where denotes the total number of messages. 1. The cloud server computes , if , the verification ends, if , the following steps are executed. 2. The cloud server computes , and .3. Cloud server computing and .4. Cloud server computing , .5. Cloud server determines whether to receive the batch of messages by calculating whether the equation is true.

[0079] The scheme given by the embodiment has the following functions:

[0080] 1. The cloud server improves the communication efficiency while realizing the authenticity and integrity of the message through batch authentication. The invention designs an attribute-based signature batch authentication technology to realize the cloud server to simultaneously verify multiple messages from vehicles and road test units with the same attributes, thereby improving the authentication efficiency. With the increase of the number of signatures, the time of batch authentication grows slowly, which directly leads to the shortening of the response time of the cloud server. And because the length of the attribute-based signature is independent of the attribute size, a shorter single signature length is realized, which can effectively save the system bandwidth of X2C communication. The space resources and computing resources of the system are fully saved, thereby realizing more efficient resource utilization.

[0081] 2. The identity privacy of the vehicle and the road test unit is protected. The invention designs an attribute-based signature technology to utilize the process of data communication, because only part of the attributes of the vehicle and the road test unit are disclosed, so anyone cannot know its real identity, therefore the privacy of the vehicle and the road test unit is effectively protected, effectively preventing damage caused by identity privacy leakage.

[0082] 3. The strong unforgeability of the signature is satisfied and effectively resists quantum attacks. The invention designs a lattice-based attribute signature technology to realize the strong unforgeability of the signature under the selected attribute and selected message attack in the process of interaction between the vehicle and the road test unit and the cloud server. The lattice-based cryptographic tool is used, so that the proposed method can realize post-quantum security.

[0083] Security demonstration of the embodiment:

[0084] Under the random oracle model, the algorithm involved in the invention can realize the strong unforgeability of the batch authentication under the selected attribute and the selected message attack. Because the lattice cryptographic tool is used for scheme design, the invention has the characteristics of resisting quantum attacks.

[0085] The strong unforgeability security proof idea of batch authentication is briefly summarized as follows: assuming that there exists an enemy who can perform a forgery attack on the message designed by the invention, and the enemy forgery success rate is , then a challenger can be constructed by using the enemy to solve the ring-SIS problem. During this period, the challenger allows the enemy to adaptively perform times Hash query, Second-rate Hash query, Second-rate Hash query, Subkey extraction query and The challenger solves the ring-SIS problem after the signature query. In fact, if the challenger receives a SIS instance... The challenger will set ,Will The public key of a trusted institution. Assume the challenge property is... An adversary wants to forge a message and its signature on it. Once the adversary successfully forges the message, the forged signature is obtained. satisfy Furthermore, another signature is obtained by recording the adversary's query results. Also satisfies Then the challenger can obtain a ring-SIS solution. and

[0086] Functional demonstration of this embodiment:

[0087] 1. Comparison of the functions of the present invention and related comparative literature: As shown in Table 2, the vehicle network security batch authentication method of the present invention for cloud service scenarios has advantages in terms of security level and resistance to quantum attacks, and is more in line with the data communication needs of vehicle networks.

[0088] Wherein, [7] Cui H, Deng R H, Liu J K, et al. Server-aided attribute-based signature with revocation for resource-constrained industrial-internet-of-things devices[J]. IEEE Transactions on Industrial Informatics, 2018, 14(8): 3724-3732. [8] Xiong H, Bao Y, Nie X, et al. Server-aided attribute-based signature supporting expressive access structures for industrialinternet of things[J]. IEEE Transactions on Industrial Informatics, 2019, 16(2): 1013-1023. [9] Mukherjee S, Gupta D S, Biswas G P. An efficient andbatch verifiable conditional privacy-preserving authentication scheme forVANETs using lattice[J]. Computing, 2019, 101(12): 1763-1788.

[10] Li Q, HeD, Yang Z, et al. Lattice-based conditional privacy-preserving authenticationprotocol for the vehicular ad hoc network[J]. IEEE Transactions on VehicularTechnology, 2022, 71(4): 4336-4347.

[11] Maurya C, Chaurasiya V K. Efficientanonymous batch authentication scheme with conditional privacy in theInternet of Vehicles (IoV) applications[J].IEEE Transactions on Intelligent Transportation Systems, 2023, 24(9): 9670-9683.

[0089] Table 2: Comparison of scheme functions

[0090] Scheme Single authentication Batch authentication Integrity Fine-grained access control Security level Post-quantum security [7] √ × √ √ SU × [8] √ × √ √ EU × [9] √ √ √ × SU √

[10] √ √ √ × EU √

[11] √ √ √ × SU × The present scheme √ √ √ √ SU √

[0091] wherein "SU" represents strong unforgeability, and "EU" represents existence of unforgeability.

[0092] 2. Spatial efficiency analysis of the designed scheme of the present application: As shown in Table 3, the signature length and the like of the method designed by the present application have some advantages.

[0093] wherein, [9] Maurya C, Chaurasiya V K. Efficient anonymous batch authentication scheme with conditional privacy in the Internet of Vehicles (IoV) applications[J]. IEEE Transactions on Intelligent Transportation Systems, 2023, 24(9): 9670-9683.

[12] Liu H, Sun Y, Xu Y, et al. A secure lattice-based anonymous authentication scheme for VANETs[J]. Journal of the Chinese Institute of Engineers, 2019, 42(1): 66-73.

[13] Li Q, He D, Yang Z, et al. Lattice-based conditional privacy-preserving authentication protocol for the vehicular ad hoc network[J]. IEEE Transactions on Vehicular Technology, 2022, 71(4): 4336-4347.

[14] Almazroi A A, Alqarni M A, Al-Shareeda M A, et al. L-CPPA: Lattice-based conditional privacy-preserving authentication scheme for fog computing with 5G-enabled vehicular system[J]. Plos one, 2023, 18(10): e0292690.

[15] Gupta D S, Karati A, Saad W, et al. Quantum-defended blockchain-assisted data authentication protocol for internet of vehicles[J].IEEE Transactions on Vehicular Technology, 2022, 71(3): 3255-3266.

[0094] Table 3: Comparison of space efficiency of schemes

[0095] Scheme Master public key length Master private key length Private key length of vehicle or road test unit Signature length [9] (mn+n)logq mlogq mlogq (m+2n)logq

[12] mnlogq mlogq 2mlogq 2(m+n)logq

[13] mnlogq m 2 logq]]> mlogq (m+2n+nk)logq

[14] m 2 logq]]> mnlogq mklogq (m+2n+nk)logq

[15] mnlogq mlogq mlogq (m+n)logq The present scheme (l+2k)nlogq lknlogq (l+k)knlogq+|id f |]]> (l+2k)nlogq+|τ|

[0096] 4. Comparison of computational efficiency of the designed scheme: As shown in Table 4, with the increase of the number of messages, the cloud server only changes the number of vector addition operations, so the time of batch authentication increases slowly with the increase of the number of messages, resulting in a shorter response time of the cloud server.

[0097] Table 4: Comparison of computational efficiency of schemes

[0098] Scheme Vehicle or road test unit message signature Cloud server single authentication Cloud server batch authentication [9] T mv +T h ]]> [CAT mv +2T h ]] T mv +2dT h +4dT add ]]>

[12] [CAT mv +3T h ]]> T mv +T h ]]> [CAT mv +dT h +3dT add ]]>

[13] [CAT mm +T mv +T h ]]> 3T mv +3T h ]]> (2d+1)T mv +3dT h +4dT add ]]>

[14] T mm +2T mv +3T h ]]> 3T mv +3T h ]]> (2d+1)T mv +3dT h +4dT add ]]>

[15] T mv +T h ]]> [CAT mv +T h ]]> [CAT mv +dT h +4dT add ]]> The present scheme T sd +T mv +(p+k)T h ]]> T mv +(p+k)T h ]]> T mv +(p+k)T h +2dT add ]]>

[0099] wherein "d" represents the number of messages.

[0100] Function verification of the embodiment:

[0101] After setting the values of various parameters, the advantages of the present application and other comparative documents in storage space and computational efficiency are discussed using specific data. Set , and the specific results are as follows:

[0102] Comparison of signature length between the present application and related comparative documents: As shown in Figure 3 , the signature length designed by the present method is 1 / 2 or even more shorter than that of other batch authentication methods. Since the cloud server receives multiple signatures for batch authentication, the present method can improve the communication efficiency of the cloud server and save bandwidth resources. Therefore, the present application is more suitable for the case where the vehicle density is large in the Internet of Vehicles.

[0103] Comparison of computational efficiency of message signature algorithm between the present application and related comparative documents: As shown in Figure 4 , the message signature speed of the attribute-based batch authentication method for the safety of the Internet of Vehicles designed by the present method is faster than that of other schemes in the message signature stage. Therefore, the present application is more suitable for resource-constrained vehicles in the Internet of Vehicles.

[0104] Comparison of computational efficiency of message batch authentication algorithm between the present application and related comparative documents: As shown in Figure 5 , the time of batch authentication of the attribute-based batch authentication method for the safety of the Internet of Vehicles designed by the present method increases slowly with the increase of the number of signatures in the message batch authentication stage, which directly leads to a shorter response time of the cloud server. Therefore, the present application is more suitable for massive message communication in the Internet of Vehicles.

[0105] The response time diagram of the cloud server under the influence of vehicle density of the application: as shown in the figure, Figure 6 The simulation network simulation is carried out by using professional network simulation software, the parameter simulation area is set to 1*1( ), the data transmission rate is 6Mbps, and the physical layer uses IEEE802.11p protocol. The simulation shows that the batch authentication method involved in the application can complete the response within 3.5s even if 40 vehicles are served at the same time. Therefore, the application can adapt to the realistic demand of batch authentication in vehicle networking.

[0106] The comparison of the response time of single authentication and batch authentication of the cloud server under the influence of vehicle density of the application: as shown in the figure, Figure 7 The response delay of the batch authentication of the application is only 55%-70% of that of the single authentication, and at least 30% of the time is saved. The response delay of 20-40 vehicles is only 4-13 times of that of one vehicle. Therefore, the application is more suitable for massive message communication in vehicle networking.

[0107] The packet loss rate diagram under the influence of vehicle speed and vehicle density of the application: as shown in the figure, Figure 8 The packet loss rate of the batch authentication method of the application is less than 3% when the vehicle density is 20-25 and the vehicle speed is 5-25m / s. Even in the case of 40 vehicles and 25m / s, the packet loss rate of the application is always less than 15%. Therefore, the application can adapt to the realistic demand of batch authentication in vehicle networking.

[0108] The radar chart for comparing the implementation effects of the application and the existing achievements: as shown in the figure, Figure 9 The batch authentication scheme designed in the application is more powerful, and can complete batch authentication efficiently while meeting more security requirements.

[0109] The application is described with reference to the flowcharts and / or block diagrams of the method, device (system) and computer program product of the application. It should be understood that each flow and / or block in the flowchart and / or block diagram and the combination of the flows and / or blocks in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device that implements the functions specified in the flow Figure 1 The flow or multiple flows and / or blocks Figure 1 The device that implements the functions specified in the flow or multiple flows and / or blocks.

[0110] The above-described embodiments are merely preferred embodiments of the present application, and the present application is not limited thereto. Various changes and modifications can be made thereto by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the present application.

Claims

1. A method for secure batch authentication in a cloud service oriented Internet of Vehicles, characterized in that, The batch authentication method comprises: Step 1: Taking the application of cloud service in Internet of Vehicles as the research background, a secure batch authentication protocol applied to vehicle-cloud, road-cloud and vehicle-road communication technology is designed, and the protocol comprises four entities of trusted authority, cloud server, vehicle and road test unit; Step 2: System setup phase: Trusted authority with high performance server based on lattice cryptography algorithms Generate system public parameters and trusted authority's public-private key pair; Step 3: Key extraction phase: the vehicle and the road testing unit make a registration request to the trusted authority and send the access control policy matching their attributes, the trusted authority generates the identifier and the private key according to its access control policy and lattice cryptography algorithm generate the identifier and the private key and return them to the corresponding entity; Step 4: Vehicle and road test unit send message to cloud server stage: the vehicle and road test unit use the private key of itself to digitally sign the sent message, and then send the message, signature, attribute and identifier to the cloud server; Step 5: Cloud server single authentication stage: when the cloud server only receives a single message, it firstly checks whether the attribute and the access control policy are matched, if not matched, the verification is ended; if matched, the authenticity and integrity of the message are verified by using a single authentication algorithm; Step 6: Cloud server batch authentication stage: when the cloud server receives a large number of messages, it firstly checks whether the attribute and the access control policy are matched, if not matched, the verification is ended; if matched, the authenticity and integrity of the messages are verified by using a batch authentication algorithm.

2. The secure batch authentication method for cloud service oriented V2X scenario of claim 1, wherein, The specific steps of the system establishment stage comprise: Trusted organizations based on system parameters Generate a set of security parameters Then, select three secure hash functions: ; wherein is a security parameter and satisfies , is an identifier, is an identifier of length, is a polynomial ring defined by modulo and modulo operations, i.e. , is a k-dimensional vector space over the polynomial ring , is a k x k-dimensional vector space over the polynomial ring ; The secure hash function inputs a specified length of 0 and 1 string, and outputs a string with a length pre-defined by the standard of the used hash function; Trusted authority setup and a unit matrix The trusted authority utilizes an algorithm to generate and trapdoors The public key of the trusted authority is and the private key is where is an l+k dimensional vector space over the polynomial ring and is an l x k dimensional vector space over the polynomial ring . 3.The method of claim 2, wherein, The specific steps of the key extraction stage comprise: Trusted authority according to access control policy Generating an identifier for a vehicle or road testing unit Wherein the attribute , , ; Trusted authority computation , ; Trusted authority modifying access control policy Post-obtain function , , according to Compute , ; Trusted authority operation Algorithm, The private key is obtained, and the identifier and the private key are sent to the vehicle or road testing unit, which verifies the correctness of the private key it receives by calculating whether the equation is true.

4. The vehicle-to-everything security batch authentication method for a cloud service scenario of claim 3, wherein, The specific steps of the vehicle and road test unit sending message to the cloud server stage comprise: Vehicle or road testing unit to message to be sent to cloud server Carrying out a digital signature; Vehicle or drive test unit computation , wherein the attribute , wherein is selected according to a Gaussian distribution , is a Gaussian parameter; Vehicle or drive test unit calculation , and ; Vehicle or drive test unit computation and ; Vehicle or drive test unit operation Algorithm, , obtaining a signature Then the Is sent to a cloud server.

5. The secure batch authentication method for cloud service oriented V2X scenario of claim 4, wherein, The specific steps of the cloud server single authentication stage comprise: The cloud server receives only a single message wherein is a signature, an attribute which is first calculated if the verification ends, if the following steps are performed; Cloud server computing , and ; Cloud server computing and ; Cloud server computing , ; The cloud server decides whether to receive the message by calculating whether the equation is established.

6. The vehicle-to-everything security batch authentication method for a cloud service scenario of claim 5, wherein, The specific steps of the cloud server batch authentication stage comprise: The cloud server receives a mass of messages wherein is a signature, is an attribute which is first computed if the verification ends, if the following steps are performed; Cloud server computing , and ; Cloud server computing and ; Cloud server computing , ; The cloud server decides whether to receive the batch of messages by calculating whether the following equation holds true or not.

7. The vehicle-to-everything security batch authentication method for a cloud service scenario of claim 5, wherein, The cloud server single authentication phase decides whether to receive the correctness of this message by calculating the equation whether the following is established: 。 8. The vehicle-to-everything security batch authentication method for a cloud service scenario of claim 6, wherein, The cloud server batch authentication phase decides whether to accept the correctness of the batch of messages by computing the equation whether the following holds: 。

Images