Remote user identity authentication protocol method based on attribute encryption and alliance chain

Abstract

The present invention provides a remote user identity authentication protocol method based on attribute encryption and consortium chain, relating to the fields of cryptography and information security technology. The method includes: a cloud server generates an independent user identity credential for each user using user identity information and a first random number. Even if an attacker is a registered user, they cannot obtain the identity credentials of other users to launch various attacks, thereby providing forward security; the cloud server uses the attributes of legitimate fog nodes to generate an attribute encryption key, encrypting the user identity credential and uploading it to the consortium chain. The user identity credential is updated during each identity authentication process, ensuring that only legitimate fog nodes can decrypt user authentication requests and generate response data, thus enabling the revocation of malicious fog nodes; and during each identity authentication process, the user and multiple fog nodes use new temporary pseudonyms to initiate authentication requests. This prevents attackers from distinguishing whether two sessions originate from the same user or fog node, thus ensuring untraceability.

Description

Technical Field

[0001] The present invention relates to the field of cryptography and information security technology, and in particular to a remote user identity authentication protocol method based on attribute encryption and alliance chain. Background Art

[0002] With the development of the Internet of Things (IoT), data in networks is exploding. Traditional computing and storage devices are struggling to cope, requiring more powerful computing and storage resources. For many users, purchasing and maintaining their own computing and storage equipment can be unaffordable. Cloud computing has gained widespread adoption for its on-demand services, resource elasticity, and centralized management. Users can access cloud storage, computing resources, and application services over the Internet. Data transmitted between users and cloud servers may contain a significant amount of user privacy, necessitating encrypted transmission. This requires a secure session key to be negotiated between the user and the cloud server to encrypt the data. However, the authentication and key negotiation process between users and cloud servers can be vulnerable to various attacks, such as impersonation attacks, replay attacks, and device theft. Attackers can exploit these methods to obtain session keys or private information between users and the server. Therefore, robust authentication protocols are necessary to overcome these attacks.

[0003] Currently, identity authentication protocols are often used to overcome various attacks, typically employing a distributed authentication scheme that combines consortium chains with cloud and fog computing. This involves storing user authentication data on a consortium chain comprised of multiple fog nodes to complete user authentication. However, when cloud servers generate user credentials, they leak their long-term secrets. Assuming the attacker is a registered user, they can obtain the cloud server's long-term secrets and decrypt authentication request messages initiated by other users in public channels, thereby launching various types of attacks. During the user registration phase, the cloud server stores the generated credentials for the user in plaintext on a consortium chain comprised of fog nodes and cloud servers. If an entity in the system discovers that a fog node has been captured by an attacker and has become malicious, the system cannot prevent the node from obtaining user privacy data from the consortium chain, nor can it remove the malicious fog node from the system. During the user authentication phase, each session uses the same pseudonym. An attacker can use this fixed pseudonym to trace two sessions to the same user, thereby leaking user privacy. Summary of the Invention

[0004] The purpose of the embodiments of the present invention is to provide a remote user identity authentication protocol method based on attribute encryption and consortium chain, which solves the problems in the existing technology that it is unable to resist various attacks launched by attackers as registered users, cannot revoke malicious fog nodes from the system, and cannot resist tracking attacks.

[0005] To solve the above technical problems, the embodiments of the present invention provide the following technical solutions:

[0006] A first aspect of the present invention provides a remote user identity authentication protocol method based on attribute encryption and consortium chain, the method comprising:

[0007] The cloud server generates the system public key and cloud server master key based on the attribute encryption algorithm;

[0008] Multiple fog nodes store fog node credentials, fog node private keys, and fog node temporary pseudonyms. The fog node credentials are data generated by the cloud server based on the fog node pseudonym and the cloud server master key. The fog node private key is data generated by the cloud server based on the system public key, the cloud server master key, and the fog node attributes.

[0009] Multiple users store user data, and the alliance chain stores the encrypted user authentication data. User data is determined by the user identity information and the first random number. The alliance chain consists of a cloud server and multiple fog nodes.

[0010] When no malicious node exists among the multiple fog nodes, identity authentication and key negotiation are performed according to the fog node attribute access policy, user identity information, user data, fog node credential, fog node temporary pseudonym, and fog node private key to determine a first session key and first new user data, where the first new user data includes a new user temporary pseudonym, a new user identity credential ciphertext, and new user identity credential verification data;

[0011] When there are malicious nodes among multiple fog nodes, a new fog node attribute access policy is generated using the attribute encryption algorithm. Identity authentication and key negotiation are performed based on the new fog node attribute access policy, user identity information, user data, fog node credentials, fog node temporary pseudonym, and fog node private key to determine the second session key and the second new user data. The new fog node attribute access policy is an access policy that does not include malicious nodes.

[0012] Compared with the prior art, the remote user identity authentication protocol method based on attribute encryption and alliance chain provided by the present invention, the cloud server generates the system public key and the cloud server master key according to the attribute encryption algorithm; multiple fog nodes store fog node credentials, fog node private keys and fog node temporary pseudonyms, the fog node credentials are data generated by the cloud server according to the fog node pseudonym and the cloud server master key, the fog node private key is data generated by the cloud server according to the system public key, the cloud server master key and the fog node attributes; multiple users store user data, and the alliance chain stores the user identity authentication data ciphertext, the user data is data determined by the user identity information and the first random number,, the alliance chain consists of a cloud server and multiple fog nodes; when there is no malicious node among the multiple fog nodes, according to the fog node The fog node attribute access policy, user identity information, user data, fog node credentials, fog node temporary pseudonym and fog node private key are used to perform identity authentication and key negotiation to determine a first session key and a first new user data, where the first new user data includes a new user temporary pseudonym, a new user identity credential ciphertext and new user identity credential verification data; when there are malicious nodes among multiple fog nodes, a new fog node attribute access policy is generated by using an attribute encryption algorithm, and identity authentication and key negotiation are performed based on the new fog node attribute access policy, user identity information, user data, fog node credentials, fog node temporary pseudonym and fog node private key to determine a second session key and a second new user data, where the new fog node attribute access policy is an access policy that does not include malicious nodes. In this way, the cloud server uses user identity information and the first random number to generate an independent user identity credential for each user. Even if the attacker is a registered user, he cannot obtain the identity credentials of other users to launch various attacks, and forward security is provided. The cloud server uses the attributes of legitimate fog nodes to generate an attribute encryption key to encrypt the user identity credential and upload it to the consortium chain, ensuring that only legitimate fog nodes can decrypt user authentication requests and generate response messages, realizing the malicious fog node revocation function. In each session, the user and fog node use a new temporary pseudonym to initiate authentication requests. The attacker cannot distinguish whether the two sessions are from the same user or fog node, ensuring untraceability. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0014] Figure 1 The system architecture diagram of the remote user identity authentication protocol method based on attribute encryption and alliance chain is schematically shown;

[0015] Figure 2The flowchart of the remote user identity authentication protocol method based on attribute encryption and alliance chain is schematically shown. DETAILED DESCRIPTION

[0016] Exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. Rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0017] It should be noted that, unless otherwise specified, the technical or scientific terms used in the present invention should have the common meanings understood by those skilled in the art to which the present invention belongs.

[0018] The method in the embodiment of the present invention is described in detail below.

[0019] Figure 1 The system architecture diagram of the remote user identity authentication protocol method based on attribute encryption and alliance chain is schematically shown. Figure 1 As shown, the system consists of three types of entities: multiple users, multiple fog nodes (i.e., multiple fog server nodes), and cloud servers. Users are resource-constrained entities, capable of performing simple computations and storing small amounts of data. The large computational and storage resources required by these users are provided by the fog nodes and cloud servers. In this system, the cloud server and all fog nodes form a consortium chain. Registration information sent by multiple users to the cloud server is stored on the consortium chain. Multiple fog nodes perform user identity authentication and provide some storage and computing resources to multiple users. The cloud server is the central server in the system, responsible for authenticating multiple fog nodes, determining whether multiple fog nodes are malicious, and providing computing and storage resources to multiple users.

[0020] The remote user authentication protocol in this invention consists of five parts: cloud server initialization, multiple fog node registration, multiple user registration, authentication and key agreement, and multiple fog node revocation. Both the multiple user registration and multiple fog node registration phases are completed over a secure channel, while the authentication and key agreement phases are completed over a public channel.

[0021] Figure 2 The flowchart of the remote user identity authentication protocol method based on attribute encryption and alliance chain in the embodiment of the present invention is schematically shown. Figure 2 As shown, the method may include:

[0022] S201. The cloud server generates a system public key and a cloud server master key according to an attribute encryption algorithm.

[0023] Step S201 is the cloud server initialization phase. The cloud server generates the system public key PK and the cloud server master key MK according to the attribute encryption algorithm, and selects the one-way hash function h(); finally, the public parameter<h(),PK> .

[0024] S202. Multiple fog nodes store fog node credentials, fog node private keys, and fog node temporary pseudonyms.

[0025] The fog node private key is data generated by the cloud server based on the system public key, the cloud server master key, and the fog node's attributes. The fog node credential is data generated by the cloud server based on the fog node pseudonym and the cloud server master key. The fog node temporary pseudonym is data encrypted by the cloud server using the fog node pseudonym and a third random number, using the cloud server master key as the symmetric encryption key, using a symmetric encryption algorithm.

[0026] Step S202 is the phase of multiple fog nodes registration.

[0027] Specifically, multiple fog nodes store fog node credentials, fog node private keys, and fog node temporary pseudonyms, including:

[0028] Step A1: Multiple fog nodes use the fog node pseudonym HID k Send to the cloud server.

[0029] Step A2: When the cloud server receives registration requests from multiple fog nodes, it assigns a corresponding attribute A to each fog node. k ; Using each attribute A k , the system public key PK and the cloud server master key MK, generate the corresponding private key KeyGen (MK, PK, A k )→SK k , and generate a third random number r k ; Using the cloud server master key MK, the third random number r k , using a symmetric encryption algorithm and a third random number r k HID pseudonym for fog nodes k Encrypt and get the temporary pseudonym TID of the fog node k =ENC MK (HID k ,r k ); for fog node pseudonym HID k The fog node certificate S is obtained by performing concatenation and one-way hash operation with the cloud server master key MK. k =h(HID k ||MK) and generate fog node attribute access policy A, and the private key SK of each fog node k , Fog node temporary pseudonym TID k and fog node attribute access policy Sk Sent to the corresponding multiple fog nodes.

[0030] Cloud Server will (SK k ,TID k ,S k ) is sent to multiple fog nodes.

[0031] Step A3: Multiple fog nodes send the private key SK of each fog node k , Fog node temporary pseudonym TID k and fog node credentials S k for storage.

[0032] Multiple fog nodes will (SK k ,TID k ,S k ) for storage.

[0033] S203. Multiple users store user data, and the alliance chain stores the encrypted user authentication data.

[0034] The user data is data determined by using the user identity information and the first random number. The user data includes the user identity certificate S i ', user identity credential verification data L i , biological auxiliary information τ i and user temporary pseudonym TID i , user identity information includes biometric information BIO i , ID i and password PW i .

[0035] The following step S203 is a multiple user registration stage.

[0036] Specifically, multiple users store user data, and the consortium chain stores the encrypted user authentication data, including:

[0037] Step B1: Multiple users use biometric information BIO i , determine the biometric information key and biometric auxiliary information (σ i ,τ i ) and the identity ID i 、Password PW i and biometric key σ i Perform concatenation and one-way hash operations to obtain the user's pseudonym HID i and set the user's pseudonym HID i Send to the cloud server.

[0038] Multiple users input biometric information BIO i , ID i and password PW i, calculate (σ i ,τ i )=Gen(BIO i ) and HID i =h(ID i ||PW i ||σ i ), send HID i to the cloud server.

[0039] Step B2: The cloud server does not have the user pseudonym HID in the local list i When the first random number r is generated i and user temporary pseudonym TID i ; For user pseudonym HID i and the first random number r i Perform concatenation and one-way hash operations to obtain the user identity credential S i =h(HID i ||r i ); According to the system public key PK, the cloud server master key MK, the fog node attribute access policy A and the first random number r i , use attribute encryption algorithm to encrypt user authentication data, and get user authentication data ciphertext US i =ENC PK,MK,A (r i ,HID i ,TID i ), the user's temporary pseudonym TID i and user authentication data ciphertext US i Upload it to the alliance chain composed of cloud servers and multiple fog nodes, and upload the user identity certificate S i and user temporary pseudonym TID i Send to multiple users.

[0040] Cloud server upload (TID i ,US i ) to the alliance chain, the cloud server sends (S i ,TID i ) to multiple users.

[0041] Step B3: Multiple users receive user identity credentials and user temporary pseudonyms (S i ,TID i ) and then, according to the identity ID i 、Password PW i and biometric key σ i , using XOR operation to encrypt user identity certificate S i , get the user identity credential ciphertext User identity credential S i, ID i 、Password PW i , biometric information key σ i and the user's temporary pseudonym TID i , perform concatenation and one-way hash operations to obtain the user identity credential verification data L i =h(S i ||ID i ||PW i ||σ i ||TID i ).

[0042] Step B4: Multiple users store user identity credential ciphertext S i ', user identity credential verification data L i , biological auxiliary information τ i and the user's temporary pseudonym TID i .

[0043] Multiple user stores (S i ',L i ,τ i ,TID i ).

[0044] During the user registration phase, the cloud server uses the user's pseudonym HID i And the temporary random number is used to generate the user identity credential S for the user i Even if the attacker is a registered user, the attacker cannot obtain other user credentials because the attacker cannot know the user's pseudonym HID i and the generated random number r i , do not know the identity credentials S of other users i , attackers cannot obtain any useful information from the data transmitted in the public channel during the authentication phase to launch various attacks.

[0045] S204: When no malicious node exists among the multiple fog nodes, identity authentication and key negotiation are performed based on the fog node attribute access policy, user identity information, user data, fog node credentials, fog node temporary pseudonym, and fog node private key to determine a first session key and first new user data.

[0046] The first new user data includes a new temporary pseudonym, a new user identity credential, and new user identity credential verification data.

[0047] Step S204 and step S205 are the identity authentication and key negotiation stages.

[0048] Specifically, when there are no malicious nodes among the multiple fog nodes, identity authentication and key negotiation are performed based on the fog node attribute access policy, user identity information, user data, fog node credentials, fog node temporary pseudonyms, and fog node private keys to determine a first session key and first new user data. The first new user data includes a new user temporary pseudonym, a new user identity credential ciphertext, and new user identity credential verification data, including:

[0049] Step C1: Multiple users determine a user identity authentication request message based on user identity information and user data, and send the user identity authentication request message to multiple fog nodes.

[0050] The user identity authentication request message includes the first message M1, the second message M2, the first current timestamp T1 and the user temporary pseudonym TID i .

[0051] Specifically, multiple users determine user identity authentication request messages based on user identity information and user data, and send the user identity authentication request messages to multiple fog nodes, including:

[0052] Step C11: Multiple users use biometric information BIO i and biological auxiliary information τ i , determine the biometric information key σ i .

[0053] Multiple users enter biometric information into the device i , ID i and password PW i , calculate σ i =Rep(BIO i ,τ i ).

[0054] Step C12: Based on identity ID i 、Password PW i and biometric key σ i , use XOR operation to decrypt the user identity credential ciphertext S i ', get the first user identity certificate S i *.

[0055] Multiple users based Calculate the first user identity credential S i *.

[0056] Step C13: First user identity certificate S i *、ID i 、Password PW i , biometric information key σ i and the user's temporary pseudonym TID i, perform XOR operation and one-way hash operation in sequence to obtain the calculated user identity credential verification message L i *.

[0057] Multiple users use L i *=h(S i *||ID i ||PW i ||σ i ||TID i ) calculation, and obtain the calculated user identity credential verification message L i *.

[0058] Step C14: After the calculated user identity credential verification data L i * Verify data with user identity credentials L i When the same, multiple users log in successfully and generate a fourth random number r u and a first current timestamp T1.

[0059] If L i *=L i , then multiple users log in successfully, and then multiple users generate a fourth random number r u and a first current timestamp T1.

[0060] Step C15: User identity certificate S i 、User pseudonym HID i , perform one-way hash operation to obtain the intermediate data h(S i ||HID i ), and using the intermediate data h(S i ||HID i ) The fourth random number r is subjected to an XOR operation u Encryption to obtain the first message M1.

[0061] Multiple users use A first message M1 is calculated.

[0062] Step C16: User identity certificate S i , first current timestamp T1, user pseudonym HID i and the fourth random number r u , perform a one-way hash operation to obtain the second message M2.

[0063] Multiple users use M2=h(S i ||T1||HID i ||r u ), calculate the second message M2.

[0064] Step C17: The first message M1, the second message M2, the first current timestamp T1 and the user temporary pseudonym TID i Send to multiple fog nodes.

[0065] Multiple users send (M1, M2, T1, TID i ) to multiple fog nodes.

[0066] Step C2: The plurality of fog nodes determine the first fog node identity authentication request message according to the user identity authentication request message, the fog node private key, the first random number, the user identity authentication data ciphertext, the fog node credential, and the fog node temporary pseudonym.

[0067] The first fog node identity authentication request message includes the third message M3, the fourth message M4, the fifth message M5, the second current timestamp T2 and the fog node temporary pseudonym TID k .

[0068] Specifically, the multiple fog nodes determine the first fog node identity authentication request message according to the user identity authentication request message, the fog node private key, the first random number, and the user identity authentication data ciphertext, including:

[0069] Step C21: When the difference between the first received timestamp T1* and the first current timestamp T is not greater than the preset timestamp ΔT, multiple fog nodes search for the user's temporary pseudonym TID in the alliance chain. i , if it exists, then the user authentication data ciphertext US i Decrypt and get the first random number r i 、User pseudonym HID i and decrypted user temporary pseudonym TID i *.

[0070] The first receiving timestamp is the timestamp that multiple fog nodes receive from multiple users (M1, M2, T1, TID i The preset timestamp ΔT may be 60 seconds. There may be various preset timestamps ΔT, and the preset timestamp ΔT is not specifically limited here.

[0071] Multiple fog nodes receive multiple users' sent (M1, M2, T1, TID i ) message and then check the timestamp. If |T1*-T1|≤ΔT, multiple fog nodes search for the user’s temporary pseudonym TID in the alliance chain. i , if it exists, multiple fog nodes calculate

[0072] Step C22: Decrypt the temporary pseudonym TID of the user i * and user temporary pseudonym TID i If the same, the user pseudonym HIDi , the first random number r i Perform XOR operation and one-way hash operation in sequence to obtain the first user identity certificate S i *; Based on user identity credentials S i and user pseudonym HID i , decrypt the first message M1 using the XOR operation to obtain the fifth random number r u *; for the first user identity certificate S i *, first current timestamp T1, user pseudonym HID i and the fifth random number r u *, perform XOR operation and one-way hash operation in sequence to obtain the user authentication message M2*.

[0073] Check TID i * = TID i , if established, multiple fog nodes calculate S i * = h(HID i ||r i ), M2*=h(S i *||T1||HID i ||r u *).

[0074] Step C23: When the user identity authentication message M2* and the second message M2 are the same, multiple fog nodes successfully authenticate multiple users, and multiple fog nodes generate a sixth random number r g and a second current timestamp T2.

[0075] If M2=M2*, multiple fog nodes successfully authenticate multiple users, and then multiple fog nodes generate the sixth random number r g and a second current timestamp T2.

[0076] Step C24: Based on the fog node certificate S k and fog node pseudonym HID k , encrypt the fourth random number r using XOR operation u , get the third message M3; according to the user pseudonym HID i and the sixth random number r g , encrypt the fourth random number r using XOR operation u , get the fourth message M4; for the fourth random number r u , fog node temporary pseudonym HID k 、User pseudonym HID i , fog node certificate S k , the second current timestamp T2 and the sixth random number r g , perform XOR operation and one-way hash operation in sequence to obtain the fifth message M5.

[0077] Multiple fog node computing and M5=h(r u ||HID k ||HID i ||S k ||T2||r g ).

[0078] Step C25: Send the third message M3, the fourth message M4, the fifth message M5, the second current timestamp T2 and the fog node temporary pseudonym TID k Send to the cloud server.

[0079] Multiple fog nodes send (M3, M4, M5, T2, TID k ) to the cloud server.

[0080] Step C3: When there is no malicious node among the multiple fog nodes, the cloud server authenticates the fog node according to the first fog node identity authentication request message and the cloud server master key, determines the session key between the multiple users and the cloud server according to the user identity information and the second random number and generates a new user temporary pseudonym, determines the cloud server identity authentication request message according to the new user temporary pseudonym, the session key and the fog node credential, and determines the new user identity authentication data ciphertext and generates a third current timestamp according to the fog node attribute access policy, the system public key, the cloud server master key and the new user temporary pseudonym, updates the user identity authentication data ciphertext to the new user identity authentication data ciphertext, and stores the new user credential verification ciphertext in the alliance chain composed of the cloud server and the multiple fog nodes.

[0081] The cloud server identity authentication request message includes the sixth message M6, the new user temporary pseudonym ciphertext TID sni , New user credential ciphertext S sni 、New fog node temporary pseudonym ciphertext TID snk , a third current timestamp T3, a session key verification message CSK, and an eighth random number r cs *.

[0082] Specifically, when there is no malicious node among the multiple fog nodes, the cloud server authenticates the multiple fog nodes according to the first fog node identity authentication request message and the cloud server master key, including:

[0083] Step C31a: When the difference between the second received timestamp T2* and the second current timestamp T2 is not greater than the preset timestamp ΔT, the cloud server assigns the fog node a temporary pseudonym TID k Decrypt and get the calculated fog node pseudonym HID k * and the third random number r k .

[0084] The cloud server receives multiple fog nodes (M3, M4, M5, T2, TID k ) message and then checks the timestamp. If |T2*-T2|≤ΔT, the cloud server calculates the HID k *||r k =DEC MK (TID k ).

[0085] Step C32 a: Calculate the fog node pseudonym HID k * and the cloud server master key MK are XORed and hashed in sequence to obtain the first fog node certificate S k *.

[0086] Cloud servers utilize S k * = h(HID k *||MK), calculate the first fog node certificate S k *.

[0087] Step C33 a: Based on the first fog node credential S k * and the calculated fog node pseudonym HID k *, decrypt the third message M3 using the XOR operation to obtain the fifth random number r u *.

[0088] Cloud server utilization Calculate the fifth random number r u *.

[0089] Step C34 a: According to the fifth random number r u *Decrypt the fourth message M4 to obtain the first user pseudonym HID i * and the seventh random number r g *.

[0090] Cloud server utilization Calculate the first user pseudonym HID i * and the seventh random number r g *.

[0091] Step C35 a: For the fourth message r u *, calculated fog node pseudonym HID k *、First user pseudonym HID i *、First fog node certificate S k *, the second current timestamp T2 and the seventh random number r g *, perform a one-way hash operation to obtain the fog node authentication message M5*.

[0092] Cloud server uses M5*=h(r u *||HIDk *||HID i *||S k *||T2||r g *), calculate the fog node authentication message M5*.

[0093] Step C36 a: When the fog node authentication message M5* and the fifth message M5 are identical, the cloud server successfully authenticates multiple fog nodes.

[0094] If M5*=M5, the cloud server successfully authenticates multiple fog nodes.

[0095] If M5*=M5, after the cloud server successfully authenticates multiple fog nodes, it will use the user identity information and the second random number r cs Determine the session keys between multiple users and the cloud server and generate new temporary pseudonyms for the users, including:

[0096] If M5*=M5, after the cloud server successfully authenticates multiple fog nodes, the cloud server generates a second random number r cs , according to the sixth random number r g , calculate the session key SK between multiple users and the cloud server = h(HID i ||r cs ||r u ), the ninth random number r will be generated l The cloud server will also generate a random number r ni , calculate the new user secret S ni =h(HID i ||r ni ), generate a new user temporary pseudonym TID ni , using US ni =ENC PK,MK,A (r ni ,HID i ,TID ni ), calculate the new user identity credential ciphertext US ni , in the alliance chain (TID i ,US i ) is updated to (TID ni ,US ni ), generating a third current timestamp T3.

[0097] Specifically, based on the new user temporary pseudonym, session key, and fog node credentials, the cloud server identity authentication request message is determined, including:

[0098] Step C31b: Based on the fog node pseudonym HID k 、The ninth random number r l and the sixth random number r g, determine the new fog node temporary pseudonym ciphertext TID snk .

[0099] Exploiting TID nk =ENC MK (HID k ,r l )and Calculate the new fog node temporary pseudonym ciphertext TID snk .

[0100] Step C32b: According to the sixth random number r g Temporary pseudonym TID for new users ni Encrypt to get the new user temporary pseudonym ciphertext TID sni .

[0101] Cloud server utilization Calculate the new user temporary pseudonym ciphertext TID sni .

[0102] Step C33b: Based on the fog node certificate S k and user identity credentials S i , encrypt the new user identity certificate S using the XOR operation ni , get the first user identity credential ciphertext S sni .

[0103] Cloud server utilization Calculate the first user identity credential ciphertext S sni .

[0104] Step C34b: Session key SK, new user identity certificate S ni and the new user's temporary pseudonym TID ni , perform XOR operation and one-way hash operation to obtain the session key verification message CSK.

[0105] The cloud server uses CSK=h(SK||S ni ||TID ni ), calculate the session key verification message CSK.

[0106] Step C35b: Based on the new user identity credential S ni and the new user's temporary pseudonym TID ni , use XOR operation to get the second random number r cs Encrypt and get the eighth random number r cs *.

[0107] Cloud server utilization Calculate the eighth random number r cs *.

[0108] Step C36b: Temporary pseudonym TID for the new user ni , the third current timestamp T3, the new fog node temporary pseudonym TID nk , new user identity credential S ni , fog node certificate S k , session key verification message CSK and the eighth random number r cs *, perform an XOR operation and a one-way hash operation to obtain the sixth message M6.

[0109] The cloud server uses M6=h(TID ni ||T3||TID nk ||S ni ||S k ||CSK||r cs *), calculate the sixth message M6.

[0110] Step C37b: Send the sixth message M6 and the new user temporary pseudonym ciphertext TID sni , the first user identity credential ciphertext S sni 、New fog node temporary pseudonym ciphertext TID snk , a third current timestamp T3, a session key verification message CSK, and an eighth random number r cs *, sent to multiple fog nodes.

[0111] The cloud server will (M6, TID sni ,S sni ,TID snk ,T3,CSK,r cs *) sent to multiple fog nodes.

[0112] Step C4: The multiple fog nodes determine the second fog node identity authentication request message according to the cloud server identity authentication request message.

[0113] The second fog node identity authentication request message includes the second ciphertext S u , seventh message M7, fourth current timestamp T and eighth random number r cs *.

[0114] Specifically, the multiple fog nodes determine the second fog node identity authentication request message according to the cloud server identity authentication request message, including:

[0115] Step C41: When the difference between the third receiving timestamp T3* and the third current timestamp T3 is not greater than the preset timestamp ΔT, the fog nodes receive the data according to the sixth random number r g Decrypt the new fog node temporary pseudonym ciphertext TID snk , get the first new fog node temporary pseudonym TID nk *; According to the sixth random number rg Decrypt the first user's temporary pseudonym ciphertext TID sni , get the first new user temporary pseudonym TID ni *; According to the fog node certificate S k and user identity credentials S i , decrypt the first user identity credential ciphertext S using XOR operation sni , get the first new user identity certificate S ni *; Temporary pseudonym TID for the first new user ni *, the third current timestamp T3, the first new fog node temporary pseudonym TID nk *、First new user identity certificate S ni *, the eighth random number r cs *, fog node certificate S k The session key verification message CSK is XORed and hashed to obtain the cloud server authentication message M6*.

[0116] The third receiving timestamp is the time when multiple fog nodes receive the data sent by the cloud server (M6, TID sni ,S sni ,TID snk ,T3,CSK,r cs *) Timestamp of the message.

[0117] After receiving the message, multiple fog nodes check the timestamp. If |T3*-T3|≤ΔT, calculate and M6*=h(TID ni *||T3||TID nk *||S ni *||r cs *||S k ||CSK).

[0118] Step C42: When the cloud server authentication message M6* and the sixth message M6 are the same, the fog nodes generate a fourth current timestamp T4 and generate a fourth random number r u and user identity credentials S i , encrypt the new user identity certificate S using the XOR operation ni and the new user's temporary pseudonym TID ni , get the second ciphertext S u .

[0119] If M6=M6*, multiple fog nodes generate a fourth current timestamp T4 and use Calculate the second ciphertext S u .

[0120] Step C43: New user identity certificate Sni , New user temporary pseudonym TID ni , user identity credentials S i , the fourth random number r u 、The eighth random number r cs *, the session key verification message CSK and the fourth current timestamp T4, perform an exclusive OR operation and a one-way hash operation to obtain a seventh message M7.

[0121] Multiple fog nodes use M7=h(S ni ||TID ni ||S i ||r u ||r cs *||CSK||T4), calculate the seventh message M7.

[0122] Step C44: The second ciphertext S u , seventh message M7, fourth current timestamp T4 and eighth random number r cs *, send to multiple users.

[0123] Multiple fog nodes will (S u ,M7,T4,r cs *)Send to multiple users.

[0124] Step C5: The multiple users determine the session key and the first new user data according to the second fog node identity authentication request message, the user identity information and the new user temporary pseudonym, and update the user data to the first new user data, so that the multiple users and the cloud server communicate through the session key.

[0125] User data includes user identity credential ciphertext S i ', user identity credential verification data L i , biological auxiliary information τ i and user temporary pseudonym TID i , correspondingly, the first new user data includes the new user identity credential ciphertext S ni ', new user identity credential verification data L i ′, biological auxiliary information τ i and the new user's temporary pseudonym TID ni .

[0126] Specifically, the multiple users determine a new session key and first new user data based on the second fog node identity authentication request message, the user identity information, and the new user temporary pseudonym, and update the user data to the first new user data, so that data between the multiple users and the cloud server is encrypted using the new session key, including:

[0127] Step C51: When the difference between the fourth receiving timestamp T4* and the fourth current timestamp T4 is not greater than the preset timestamp ΔT, multiple users receive the data according to the fourth random number r u and user identity credentials S i , decrypt the second ciphertext S using XOR operation u , get the first new user identity certificate S ni * and the first new user temporary pseudonym TID ni *; Based on the first new user identity certificate S ni * and the first new user temporary pseudonym TID ni *, decrypt the eighth random number r using XOR operation cs *, get the second random number r cs ; For user pseudonym HID i 、The eighth random number r cs *, the fourth random number r u Perform XOR operation and one-way hash operation to obtain a new session key SK*; perform XOR operation and one-way hash operation on the new session key SK* and the first new user identity certificate S ni * and the first new user temporary pseudonym TID ni *, perform XOR operation and one-way hash operation to obtain the session key message authentication code CSK*; for the first new user identity certificate S ni *、First new user temporary pseudonym TID ni *、User identity certificate S i , the fourth random number r u 、The eighth random number r cs *, the session key message authentication code CSK* and the fourth current timestamp T4 are subjected to an exclusive OR operation and a one-way hash operation to obtain the first fog node authentication message M7*.

[0128] The fourth receiving timestamp T4* is the time when multiple users receive the messages sent by multiple fog nodes (S u ,M7,T4,r cs *) Timestamp of the message.

[0129] Multiple users receive (S u ,M7,T4,r cs *) message, if |T4*-T4|≤ΔT, multiple users calculate CSK*=h(SK*||S ni *||TID ni *), SK*=h(HID i ||r cs *||r u ) and M7*=h(S ni *||TIDni *||S i ||r u ||r cs *||CSK*||T4).

[0130] Step C52: When the first fog node identity authentication message M7* and the seventh message M7 are identical, the identity authentication and key negotiation are successful.

[0131] Step C53: Multiple users according to their identity IDs i , secret ID i Code PW and biometric information key σ i , encrypt the new user identity certificate S using the XOR operation ni , get the new user identity credential ciphertext S ni '; For the new user identity credential ciphertext S ni , ID i 、Password PW i , biometric information key σ i and the new user's temporary pseudonym TID ni , perform XOR operation and one-way hash operation to obtain the new user identity credential verification data L i ′.

[0132] Multiple users calculate separately and L′ i =h(S ni ||ID i ||PW i ||σ i ||TID ni ).

[0133] Step C54: Pass the user identity credential ciphertext S i 'Update to the new user identity credential ciphertext S ni ', user identity credential verification data L i Update to the new user identity credential verification data L i ', the user's temporary pseudonym TID i Update to a new temporary user TID ni , so that multiple users and the cloud server can negotiate session keys through new user data.

[0134] Multiple users will (S i ',L i ,τ i ,TID i ) is updated to (S ni ',L i ′,τ i ,TID ni ), and store.

[0135] During the registration phase, the cloud server generates temporary pseudonyms for multiple users and uploads them to a consortium chain consisting of multiple fog nodes. During the authentication phase, multiple users communicate with the fog nodes using temporary pseudonyms. After the fog nodes send the authentication information to the cloud server, the cloud server generates new temporary pseudonyms for the users and uploads them to the consortium chain. The fog nodes encrypt the new temporary pseudonyms through an XOR operation and return them to the users. Multiple users use different temporary pseudonyms in each session, and attackers cannot distinguish whether the two authentications are from the same user, ensuring that the privacy of multiple users cannot be tracked.

[0136] It realizes two-way authentication between multiple users and multiple fog nodes, and multiple fog nodes and cloud servers: multiple fog nodes use the user identity credentials S stored in the cloud server to authenticate each other. i and user pseudonym HID i Complete the authentication of the user. The cloud server sends the fog node credentials S to multiple fog nodes during the registration phase. k Complete the authentication of multiple fog nodes. Multiple fog nodes encrypt and send the sixth random number r to the cloud server. g Complete the authentication of the cloud server, multiple users pass the user identity credentials S i The fourth random number r is encrypted and sent to multiple fog nodes u Complete the authentication of multiple fog nodes.

[0137] S205. When a malicious node exists among the multiple fog nodes, a new fog node attribute access policy is generated using an attribute encryption algorithm. Identity authentication and key negotiation are performed based on the new fog node attribute access policy, user identity information, user data, fog node credentials, fog node temporary pseudonym, and fog node private key to determine a second session key and a second new user data.

[0138] Among them, the new fog node attribute access policy A' is an access policy that does not include malicious nodes.

[0139] Step S205 is the phase of revoking multiple fog nodes.

[0140] When the cloud server detects that a fog node is a malicious node, it will generate a new fog node attribute access policy A' and delete the attributes of the malicious fog node in the new fog node attribute access policy A'. When multiple users send authentication requests to the cloud server through legitimate fog nodes, the cloud server uses the new fog node attribute access policy A' to encrypt r ni 、HID i 、TID ni And upload it to the alliance chain, there is a new user authentication data ciphertext US of the malicious node n ″ i The corresponding expression is USn ″ i =ENC PK,MK,A′ (r ni ,HID i ,TID ni ).

[0141] Since the malicious fog node does not meet the attribute access policy, the malicious fog node cannot decrypt the secret of the user update in the alliance chain, and the malicious fog node is revoked. The operation when there are malicious nodes in multiple fog nodes is roughly the same as the operation when there are no malicious nodes in multiple fog nodes, that is, steps C3 to C5. The only difference is that the new user authentication data ciphertext US in the non-malicious node is ni =ENC PK,MK,A (r ni ,HID i ,TID ni ) is replaced with the new user authentication data ciphertext US containing the malicious node ni ″=ENC PK,MK,A′ (r ni ,HID i ,TID ni ).

[0142] This invention incorporates attribute encryption technology, assigning individual attributes to each fog node in the system. If a cloud server discovers a fog node as malicious, it generates an encryption key using a new fog node attribute access policy that excludes the malicious node's attributes. The cloud server then uses this key to encrypt user authentication data and uploads it to a consortium chain comprised of multiple fog nodes. Malicious fog nodes are unable to decrypt the ciphertext of user authentication data in the consortium chain using their own private keys. This invention overcomes the security issues of existing technologies and reduces computational overhead on multiple user devices.

[0143] Based on the above Figure 1It can be seen from the implementation method that the cloud server of the embodiment of the present invention generates a system public key and a cloud server master key according to an attribute encryption algorithm; multiple fog nodes store fog node credentials, fog node private keys and fog node temporary pseudonyms. The fog node credentials are data generated by the cloud server according to the fog node pseudonym and the cloud server master key. The fog node private key is data generated by the cloud server according to the system public key, the cloud server master key and the fog node attributes; multiple users store user data, and the alliance chain stores user authentication data ciphertext. User data is data determined by using user identity information and a first random number. The alliance chain consists of a cloud server and multiple fog nodes. When there is no malicious node among the multiple fog nodes, the alliance chain is based on the fog node attribute access policy, user identity information and the first random number. The fog node authentication and key negotiation are performed based on the fog node authentication information, user data, fog node credentials, fog node temporary pseudonym and fog node private key to determine a new session key and the first new user data, where the first new user data includes a new user temporary pseudonym, a new user identity credential and new user identity credential verification data; when there are malicious nodes among multiple fog nodes, a new fog node attribute access policy is generated by using an attribute encryption algorithm, and identity authentication and key negotiation are performed based on the new fog node attribute access policy, user identity information, user data, fog node credentials, fog node temporary pseudonym and fog node private key to determine the negotiated session key and the second new user data, where the new fog node attribute access policy is an access policy that does not include malicious nodes. In this way, user data is generated for each user using user identity information and the first random number. Even if the attacker is a registered user, he cannot obtain the user identity credentials of other users to launch various attacks, while ensuring forward security. The cloud server uses a new fog node attribute access policy to encrypt user authentication data. The new fog node attribute access policy does not include the attributes of malicious nodes. Malicious fog nodes cannot use their own private keys to decrypt the ciphertext of user authentication data, thus realizing the revocation function of malicious fog nodes. In each session, users and fog nodes use new temporary pseudonyms to initiate authentication requests. Attackers cannot distinguish whether two sessions come from the same user or fog node, ensuring untraceability.

[0144] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A remote user identity authentication protocol method based on attribute encryption and alliance chain, characterized in that: include: The cloud server generates the system public key and cloud server master key based on the attribute encryption algorithm; Multiple fog nodes store fog node credentials, fog node private keys, and fog node temporary pseudonyms, wherein the fog node credentials are data generated by the cloud server according to the fog node pseudonym and the cloud server master key, and the fog node private keys are data generated by the cloud server according to the system public key, the cloud server master key, and fog node attributes; Multiple users store user data, and the alliance chain stores encrypted user identity authentication data, wherein the user data is data determined using user identity information and a first random number, and the alliance chain is composed of the cloud server and the multiple fog nodes; When no malicious node exists among the plurality of fog nodes, performing identity authentication and key negotiation according to the fog node attribute access policy, the user identity information, the user data, the fog node credential, the fog node temporary pseudonym, and the fog node private key to determine a new session key and first new user data, where the first new user data includes a new user temporary pseudonym, a new user identity credential, and new user identity credential verification data; When a malicious node exists among the multiple fog nodes, a new fog node attribute access policy is generated by using an attribute encryption algorithm, and identity authentication and key negotiation are performed according to the new fog node attribute access policy, the user identity information, the user data, the fog node credential, the fog node temporary pseudonym, and the fog node private key to determine a negotiated session key and a second new user data, wherein the new fog node attribute access policy is an access policy that does not include the malicious node; The user data includes user identity credentials, user identity credential verification data, biometric auxiliary information and user temporary pseudonym, and the user identity information includes biometric information, identity and password; When no malicious node exists among the plurality of fog nodes, performing identity authentication and key negotiation according to the fog node attribute access policy, the user identity information, the user data, the fog node credential, the fog node temporary pseudonym, and the fog node private key to determine a new session key and first new user data, including: The multiple users determine a user identity authentication request message according to the user identity information and the user data, and send the user identity authentication request message to the multiple fog nodes; The multiple fog nodes determine a first fog node identity authentication request message based on the user identity authentication request message, the fog node private key, the first random number, the user identity authentication data ciphertext, the fog node credential, and the fog node temporary pseudonym; When there is no malicious node among the multiple fog nodes, the cloud server authenticates the multiple fog nodes according to the first fog node identity authentication request message and the cloud server master key, determines the session key between the multiple users and the cloud server according to the user identity information and the second random number and generates the new user temporary pseudonym, determines the cloud server identity authentication request message according to the new user temporary pseudonym, the session key and the fog node credential, determines a new user identity authentication data ciphertext and generates a third current timestamp according to the fog node attribute access policy, the system public key, the cloud server master key and the new user temporary pseudonym, updates the user identity authentication data ciphertext to the new user identity authentication data ciphertext, and stores the new user identity data verification ciphertext in the alliance chain composed of the cloud server and the multiple fog nodes; The multiple fog nodes determine a second fog node identity authentication request message according to the cloud server identity authentication request message; The multiple users determine the new session key and the first new user data according to the second fog node identity authentication request message, the user identity information, the user identity credential, and the new user temporary pseudonym, and update the user data to the first new user data, so that the multiple users and the cloud server communicate using the new session key; The multiple users store user data, and the alliance chain stores the encrypted user authentication data, including: The multiple users determine a biometric information key and the biometric auxiliary information based on the biometric information, and perform concatenation and one-way hash operations on the identity, the password, and the biometric information key to obtain a user pseudonym, and send the user pseudonym to the cloud server; When the user pseudonym does not exist in the local list, the cloud server generates the first random number and the user temporary pseudonym; performs a concatenation operation and a one-way hash operation on the user pseudonym and the first random number to obtain a user identity credential; encrypts the user authentication data using an attribute encryption algorithm according to the system public key, the cloud server master key, the fog node attribute access policy, and the first random number to obtain the user authentication data ciphertext; uploads the user temporary pseudonym and the user authentication data ciphertext to the consortium chain consisting of the cloud server and the multiple fog nodes, and sends the user identity credential and the user temporary pseudonym to the multiple users; After receiving the user identity certificate and the user temporary pseudonym, the multiple users encrypt the user identity certificate using an exclusive OR operation based on the identity, the password, and the biometric information key to obtain a user identity certificate ciphertext; and perform a concatenation and a one-way hash operation on the user identity certificate, the identity, the password, the biometric information key, and the user temporary pseudonym to obtain user identity certificate verification data; The plurality of users storing the user identity credential ciphertext, the user identity credential verification data, the biometric auxiliary information and the user temporary pseudonym; The user identity authentication request message includes a first message, a second message, a first current timestamp, and the user temporary pseudonym; the multiple users determine the user identity authentication request message according to the user identity information and the user data, and send the user identity authentication request message to the multiple fog nodes, including: The plurality of users determine the biometric information key based on the biometric information and the biometric auxiliary information; Decrypting the user identity credential ciphertext using an XOR operation based on the identity, the password, and the biometric information key to obtain a first user identity credential; performing an exclusive-OR operation and a one-way hash operation on the first user identity credential, the identity, the password, the biometric information key, and the temporary user pseudonym in sequence to obtain a calculated user identity credential verification message; When the calculated user identity credential verification message is identical to the user identity credential verification data, the multiple users log in successfully, and a fourth random number and the first current timestamp are generated; performing an exclusive-OR operation and a one-way hash operation on the user identity credential and the user pseudonym in sequence to obtain intermediate data, and encrypting the intermediate data using the fourth random number to obtain the first message; performing an exclusive OR operation and a one-way hash operation on the user identity credential, the first current timestamp, the user pseudonym, and the fourth random number in sequence to obtain the second message; Sending the first message, the second message, the first current timestamp, and the user temporary pseudonym to the multiple fog nodes; The first fog node identity authentication request message includes a third message, a fourth message, a fifth message, a second current timestamp, and the fog node temporary pseudonym. The multiple fog nodes determine the first fog node identity authentication request message according to the user identity authentication request message, the fog node private key, the first random number, the user identity authentication data ciphertext, the fog node credential, and the fog node temporary pseudonym, including: When the difference between the first receiving timestamp and the first current timestamp is not greater than a preset timestamp, the multiple fog nodes search the alliance chain for whether the user temporary pseudonym exists, and if so, decrypt the user identity verification data ciphertext to obtain the first random number, the user pseudonym, and the decrypted user temporary pseudonym; When the decrypted user temporary pseudonym is the same as the user temporary pseudonym, performing an exclusive OR operation and a one-way hash operation on the user pseudonym and the first random number in sequence to obtain a first user identity credential; decrypting the first message using an exclusive OR operation based on the user identity credential and the user pseudonym to obtain a fifth random number; and performing an exclusive OR operation and a one-way hash operation on the first user identity credential, the first current timestamp, the user pseudonym, and the fifth random number in sequence to obtain a user identity verification message; When the user identity authentication message and the second message are identical, the multiple fog nodes successfully authenticate the multiple users, and the multiple fog nodes generate a sixth random number and the second current timestamp; Encrypting the fourth random number using an exclusive OR operation based on the fog node credential and the fog node pseudonym to obtain the third message; encrypting the fourth random number using an exclusive OR operation based on the user pseudonym and the sixth random number to obtain the fourth message; and performing an exclusive OR operation and a one-way hash operation on the fourth random number, the fog node temporary pseudonym, the user pseudonym, the fog node credential, the second current timestamp, and the sixth random number in sequence to obtain the fifth message; sending the third message, the fourth message, the fifth message, the second current timestamp, and the fog node pseudonym to the cloud server; The cloud server identity authentication request message includes a sixth message, a new user temporary pseudonym ciphertext, a first user identity credential ciphertext, a new fog node temporary pseudonym ciphertext, the third current timestamp, a session key verification message, and an eighth random number; Determining a cloud server identity authentication request message according to the new user temporary pseudonym, the session key, and the fog node credential includes: Determine the new fog node temporary pseudonym ciphertext according to the fog node pseudonym, the ninth random number, and the sixth random number; Encrypting the new temporary pseudonym of the user according to the sixth random number to obtain the ciphertext of the new temporary pseudonym of the final user; Encrypting a new user identity credential using an XOR operation according to the fog node credential and the user identity credential to obtain a ciphertext of the first user identity credential; Performing an exclusive-OR operation and a one-way hash operation on the session key, the new user identity credential, and the new temporary user pseudonym to obtain the session key verification message; Encrypting the second random number using an exclusive-OR operation according to the new user identity credential and the new temporary user pseudonym to obtain the eighth random number; performing an exclusive-OR operation and a one-way hash operation on the new user temporary pseudonym, the third current timestamp, the new fog node temporary pseudonym, the new user identity credential, the fog node credential, the session key verification message, and the eighth random number to obtain a sixth message; Sending the sixth message, the new user temporary pseudonym ciphertext, the first user identity credential ciphertext, the new fog node temporary pseudonym ciphertext, the third current timestamp, the session key verification message, and the eighth random number to the multiple fog nodes; The second fog node identity authentication request message includes the second ciphertext, the seventh message, the fourth current timestamp and the eighth random number; The multiple fog nodes determine a second fog node identity authentication request message according to the cloud server identity authentication request message, including: When the difference between the third receiving timestamp and the third current timestamp is not greater than the preset timestamp, the multiple fog nodes decrypt the new fog node temporary pseudonym ciphertext according to the sixth random number to obtain a first new fog node temporary pseudonym; decrypt the first user temporary pseudonym ciphertext according to the sixth random number to obtain a first new user temporary pseudonym; decrypt the first user identity credential ciphertext according to the fog node credential and the user identity credential using an exclusive OR operation to obtain a first new user identity credential; perform an exclusive OR operation and a one-way hash operation on the first new user temporary pseudonym, the third current timestamp, the first new fog node temporary pseudonym, the first new user identity credential, the eighth random number, the fog node credential, and the session key verification message to obtain a cloud server authentication message; When the cloud server authentication message and the sixth message are the same, the multiple fog nodes generate a fourth current timestamp, and encrypt the new user identity credential and the new user temporary pseudonym using an exclusive OR operation based on the fourth random number and the user identity credential to obtain the second ciphertext; performing an exclusive-OR operation and a one-way hash operation on the new user identity credential, the new temporary user pseudonym, the user identity credential, the fourth random number, the eighth random number, the session key verification message, and the fourth current timestamp to obtain a seventh message; sending the second ciphertext, the seventh message, the fourth current timestamp, and the eighth random number to the multiple users; The first new user data includes a new user identity credential ciphertext, new user identity credential verification data, the biometric auxiliary information and a new user temporary pseudonym; The multiple users determine the new session key and the first new user data according to the second fog node identity authentication request message, the user identity information, and the new user temporary pseudonym, and update the user data to the first new user data, so that data between the multiple users and the cloud server is encrypted using the new session key, including: When the difference between the fourth receiving timestamp and the fourth current timestamp is not greater than the preset timestamp, the multiple users decrypt the second ciphertext using an exclusive OR operation based on the fourth random number and the user identity certificate to obtain the first new user identity certificate and the first new user temporary pseudonym; decrypt the eighth random number using an exclusive OR operation based on the first new user identity certificate and the first new user temporary pseudonym to obtain the second random number; perform an exclusive OR operation and a one-way hash operation on the user pseudonym, the eighth random number, and the fourth random number to obtain a new session key; perform an exclusive OR operation and a one-way hash operation on the new session key, the first new user identity certificate, and the first new user temporary pseudonym to obtain a session key message verification code; perform an exclusive OR operation and a one-way hash operation on the first new user identity certificate, the first new user temporary pseudonym, the user identity certificate, the fourth random number, the eighth random number, the session key message verification code, and the fourth current timestamp to obtain a first fog node authentication message; When the first fog node identity authentication message and the seventh message are identical, the identity authentication and key negotiation are successful; The multiple users encrypt the new user secret using an exclusive OR operation based on the identity, the password, and the biometric information key to obtain a new user identity credential ciphertext; perform an exclusive OR operation and a one-way hash operation on the new user identity credential ciphertext, the identity, the password, the biometric information key, and the new user temporary pseudonym to obtain new user identity credential verification data; The user identity credential ciphertext is updated to the new user identity credential ciphertext, the user identity credential verification data is updated to the new user identity credential verification data, and the user temporary pseudonym is updated to the new user temporary pseudonym, so that the multiple users and the cloud server negotiate a session key through the new user data.

2. The remote user identity authentication protocol method based on attribute encryption and alliance chain according to claim 1 is characterized in that: The plurality of fog nodes store fog node credentials, fog node private keys, and fog node temporary pseudonyms, including: The multiple fog nodes send the fog node pseudonyms to the cloud server; When the cloud server receives the registration requests from the multiple fog nodes, it assigns a corresponding attribute to each fog node; uses each attribute, the system public key, and the cloud server master key to generate a corresponding private key for each fog node and a third random number; encrypts the fog node pseudonym using a symmetric encryption algorithm and the third random number to obtain the fog node temporary pseudonym; performs concatenation and a one-way hash operation on the fog node pseudonym and the cloud server master key in sequence to obtain a fog node credential and generate the fog node attribute access policy; and sends the private key of each fog node, the fog node temporary pseudonym, and the fog node credential to the corresponding multiple fog nodes; The multiple fog nodes store the private key of each fog node, the fog node temporary pseudonym, and the fog node credential.

3. The remote user identity authentication protocol method based on attribute encryption and alliance chain according to claim 2 is characterized in that: When there is no malicious node among the multiple fog nodes, the cloud server authenticates the multiple fog nodes according to the first fog node identity authentication request message and the cloud server master key, including: When the difference between the second receiving timestamp and the second current timestamp is not greater than the preset timestamp, the cloud server decrypts the fog node temporary pseudonym to obtain a calculated fog node pseudonym and the third random number; Performing an exclusive OR operation and a one-way hash operation on the calculated fog node pseudonym and the cloud server master key in sequence to obtain a first fog node credential; Decrypting the third message using an XOR operation according to the first fog node credential and the calculated fog node pseudonym to obtain the fifth random number; decrypting the fourth message according to the fifth random number to obtain the first user pseudonym and a seventh random number; performing a one-way hash operation on the fourth message, the calculated fog node pseudonym, the first user pseudonym, the first fog node credential, the second current timestamp, and the seventh random number in sequence to obtain a fog node authentication message; When the fog node authentication message and the fifth message are identical, the cloud server successfully authenticates the multiple fog nodes.

Images