Industrial Internet of Things anonymous cross-domain switching authentication method based on distributed trust

Abstract

The invention discloses an industrial Internet of Things anonymous cross-domain switching authentication method based on distributed trust. The method comprises the following steps: firstly, completing initialization of system parameters in each domain; the authentication server of each domain negotiates a system master key pair through a distributed key generation protocol; equipment in each domain completes registration in the domain (TA completes registration and obtains a pseudonym and a secret key; the other domain AS completes security authentication of the equipment and issues an identity token embedded with a time key; the device initiates a cross-domain mutual authentication request to other domain devices in the validity period of the identity token and negotiates a session key; and real identity tracing and revocation processing of malicious equipment are carried out. According to the method, complete decentralization is realized for the problems of single-point failure and the like in a traditional centralized authentication architecture in the industrial Internet of Things, authentication delay is reduced through an anonymous cross-domain switching authentication scheme, and a time key is embedded in an identity token, so that dynamic management of equipment is realized. According to the method, safe anonymous cross-domain switching authentication can be achieved, common attacks including response attacks, pretending attacks and man-in-the-middle attacks are resisted, and meanwhile the computing overhead and the communication overhead are low.

Description

Technical Field

[0001] The present invention relates to Internet of Things and information security technology, and in particular to an anonymous cross-domain switching authentication method for industrial Internet of Things based on distributed trust. Background Art

[0002] Industrial Internet of Things (IIoT) is an important extension of IoT technology in the industrial field. However, as the manufacturing industry becomes increasingly complex and sophisticated, the production process of a single product may need to span multiple production areas. For example, the manufacturing process of an electric car usually involves collaboration in multiple fields such as the automotive manufacturing industry, the electronics manufacturing industry, the energy industry, and the technology industry to meet the production needs of automotive design, production, and intelligent services. Cross-domain production collaboration integrates resources and technologies from multiple fields and allocates them reasonably, ultimately achieving intelligent, efficient, and sustainable production processes.

[0003] Different industrial enterprises share a large amount of real-time data generated by automation equipment in industrial production in smart factories to complete cross-domain collaboration. However, these real-time data are transmitted on public channels and may be subject to tampering, forgery and other attacks from malicious attackers. Considering the security risks of cross-domain data transmission, enterprises often manage and maintain data separately and are unwilling to share with other enterprises. It is difficult for data to flow and share securely between different IIOT domains, which brings about the problem of data islands. Authentication schemes can be used to break the data island phenomenon. However, in cross-domain IIoT, the data contains sensitive information such as control parameters, and the identity information of the device may also contain privacy information. Therefore, it is of great significance to design a cross-domain authentication scheme to achieve secure data sharing while protecting device privacy.

[0004] Generally, anonymous cross-domain authentication schemes for IIoT can be divided into two types: centralized and distributed. The centralized scheme uses a trusted authority TA to assist in cross-domain authentication, where any cross-domain authentication is transmitted by the local TA. The target domain TA receives the corresponding identity information from the local TA. Therefore, the centralized authentication scheme requires multiple rounds of communication, which brings a large overhead and is difficult to implement in real-time industrial production. In addition, the increase in cross-domain authentication requests may impose a heavy burden on the TA, which may lead to a single point of failure.

[0005] In most distributed authentication schemes, TA offloads authentication capabilities such as identity information or credentials to auxiliary edge nodes in each IIoT domain. In this case, the edge node can authenticate users in the management domain with lower latency. However, once the device moves to another domain, the edge node must obtain identity information from TA. This means that the participation of TA is still required to complete cross-domain authentication. Some distributed schemes use Shamir secret sharing to distribute sub-master keys to edge nodes or servers. However, in the current scheme, this distribution process still requires the participation of TA participants. Therefore, the existing distributed authentication schemes still have the shortcomings of centralized network architecture to a certain extent and cannot achieve complete decentralization.

[0006] In addition, the performance of cross-domain authentication also needs attention. As mentioned earlier, cross-domain authentication in current schemes often involves the participation of infrastructure and multiple rounds of interaction. Frequent cross-domain authentication processes bring huge burdens to real-time industrial production. Switching authentication uses a token mechanism to avoid infrastructure participation during authentication. When the token is valid, the device can use it to prove its legitimate identity and complete mutual authentication with other domain devices, thereby improving authentication efficiency. However, there is no similar mechanism in the current anonymous cross-domain authentication scheme. Summary of the invention

[0007] Purpose of the invention: The purpose of the present invention is to solve the deficiencies in the prior art and to provide an anonymous cross-domain switching authentication method for industrial Internet of Things based on distributed trust.

[0008] Technical solution: An anonymous cross-domain switching authentication method for industrial Internet of Things based on distributed trust of the present invention comprises the following steps:

[0009] Step (1) completes the initialization of system parameters in each domain, that is, the trusted authority TA in each domain initializes the system parameters {G1, G2, q, P, e, mpk A ,H0,H1,H2,H3};

[0010] Where G1 and G2 are two groups with generators P and prime order q, H0, H1, H2, H3 are four hash functions; mpk A =msk A P is the public key of domain A; is the private key of domain A;

[0011] Step (2) sets the distributed system master key, that is, the authentication server AS of each domain negotiates the system master key pair through the distributed key generation DKG protocol to establish cross-domain trust without introducing a trusted third party; the specific method is:

[0012] For the authentication server AS in domain Ai Calculate and distribute to authentication servers AS in other domains j The secret share f i (j) and sent to the corresponding AS via a secure channel j ,j∈[1,n],j≠i;AS i Receive AS from other domains j Share your secret share j (i) After validation, AS i Calculate its secret share s i As the local private key, the system public key P is finally obtained pub and system private key s;

[0013] Step (3), during the registration phase, the device DE in each domain completes registration with the trusted authority TA in the domain and obtains a pseudonym and a key. The specific method is as follows:

[0014] Equipment DE i Send a message containing his / her ID to TA. i Registration request; TA verification ID i Is it unique? After verification, the trusted organization TA is the device DE i Calculate device pseudonym PID i and the corresponding time key, and then transmit it through a secure channel Return to device DE i ;

[0015] Step (4), pre-authentication phase, the authentication server AS of other domains completes the authentication of the device DE in domain A. i The device DE i First, complete the authentication and obtain partial tokens, and aggregate them to generate identity tokensσ u ; The specific method is:

[0016] DE i Authentication server AS in other domains j Send pre-authentication request req and record the current timestamp T1; AS j After receiving the pre-authentication request, verify whether the time and time key are valid. After the verification is passed, calculate the partial token first And part of the token and the current timestamp T2 is sent to the device DE i ;

[0017] Equipment DE i After receiving, first verify the timestamp T2, and after verification, DE i Calculate partial token σ i,j, when the number of partial tokens collected is greater than the threshold t, multiple authentication servers AS j Carry out batch verification; after batch verification is passed, DE i Calculate and store the identity token σ i ;

[0018] Step (5), cross-domain authentication phase, domain A device DE i Use your own legal identity tokenσ i To the device DE in domain B j Send cross-domain authentication request, DE j Verification i The validity of the session key sk is negotiated ij ; The specific method is:

[0019] DE in domain A i To device DE in domain B j Send mutual authentication request req, record the current timestamp T3; device DE j After receiving the request message, first verify whether the timestamp T3 and time key ts are valid. After the verification is passed, DE j Calculate the session key sk ij , and returns the response message {M j ,R j ,T4} to device DE i ; After receiving the response, DE i Verify the received response. If the verification is successful, mutual authentication is completed and the session key sk is negotiated. ij For subsequent data transmission;

[0020] Step (6): trace the real identity of the malicious device and revoke it.

[0021] Furthermore, the detailed process of step (1) is as follows:

[0022] Step (1.1), TA in field A generates two groups G1 and G2 with generator P and prime order q, where G1 is an additive cyclic group and G2 is a multiplicative cyclic group, and determines the bilinear pairing: e:G1×G1→G2;

[0023] Step (1.2), TA selects a random number As the private key of domain A, and calculate the corresponding public key mpk A =msk A P, and choose a secure hash function: H0:{0,1} * ×{0,1} * →G1, H1: H2: H3:

[0024] Step (1.3), TA public domain system parameters {G1, G2, q, P, e, mpk A ,H0,H1,H2,H3}, and store msk secretly locally A .

[0025] Furthermore, the specific process of generating the master key of the distributed system in step (2) is as follows:

[0026] Step (2.1), the AS of each domain randomly selects a t-1 degree polynomial. For the authentication server of domain A, the polynomial is f i (x) = a i,0 +a i,1 x+a i,2 x 2 +...+a i,t-1 x t-1 mod q;

[0027] in is a randomly selected coefficient, f i (0) = a i,0 As a secret shared with other domain ASs; AS i Calculate the secret share f distributed to other domain authentication servers i (j) and sent to the corresponding AS via a secure channel j ;f i (j) is AS i Sent to AS via secure channel j The secret share, f j (i) is AS j Sent to AS via secure channel i of secret share;

[0028] Step (2.2), AS i Receive AS from other domains j Share your secret share j (i) and then, by judging the equation Is it established to verify the AS j The validity of the secret share, if established, proceed to the subsequent steps, otherwise, refuse to share; i k is the kth power of i introduced into the polynomial;

[0029] Step (2.3), AS i Calculate its secret share s i =∑ j∈CS f j (i) As the local private key and the corresponding public key PK i =s iP, where CS is the set of all legal nodes participating in the master key generation process of the distributed system; through the formula P pub =s i P calculates the system public key, then all authentication servers have a part of the secret share of the system private key, through the formula s = ∑ i∈CS a i,0 Reconstruct the system private key s.

[0030] Furthermore, in step (3), the device DE i The specific process of registering a local TA in a domain is as follows:

[0031] Step (3.1), receive DE i After the registration request is received, the trusted authority TA first checks the ID locally i Have you registered to verify the identifier ID? i Is it unique and check it in the blacklist. If it exists, the registration process is terminated. Then, the trusted agency TA selects a random number a i , calculate A i =a i P, PID i =(PID' i ,A i );

[0032] Step (3.3), the trusted institution TA is the device DE i Choose a random number k i And calculate K i =k i P and u i =k i +msk A H1(PID i ,K i )modq; To achieve dynamic management of the device, TA generates a corresponding time key for the device pseudonym. TA first selects a random number b i And calculate the point B of the elliptic curve i =b i P; TA then calculates the Schnorr signature based on the randomly selected validity period ts

[0033] TA sends Return to the device;

[0034] Step (3.4), DE i After receiving the response, store it locally And create a table in the local database to store the pseudonyms and corresponding device status.

[0035] Furthermore, in step (4), the device DE i Complete pre-authentication with other domain authentication servers AS and obtain identity token σ i The specific process is as follows:

[0036] Step (4.1), DE i Choose a random number r i And calculate R i =r i ·P, V i =H3(K i ,R i ,PID i )·r i +u i , and send the authentication server AS to other domains j (j∈[1,n]) sends a pre-authentication request K i ,R i ,V i , is the intermediate variable;

[0037] Step (4.2), after receiving the request message, AS j First, verify whether T1 is valid by T-T1<Δt, where Δt is the preset threshold; then, AS j By verifying the formula Whether the time key ts is valid or not; when both the timestamp T1 and the time key ts are verified to be valid, AS j Then continue with the subsequent steps to authenticate the device identity;

[0038] Step (4.3), AS j Check V i ·P=H3(K i ,R i ,PID i )·R i +K i +H1(PID i ,K i )·mpk A Is it established to verify DE i , if the equation holds, the authentication of the device is completed and the partial token σ is calculated i,j =s j ·H0(PID i ||ts) and Return message Give device DE i , where T2 is the current timestamp;

[0039] Step (4.4), equipment DE iAfter receiving the response message, first check the timestamp T2 with T-T2<Δt. After confirming the freshness of the message, DE i Calculating partial tokens When the number of collected partial tokens is greater than the threshold t, DE i By equation For multiple authentication servers AS j Carry out batch verification;

[0040] After certification, DE i Computing identity tokens And stored locally for subsequent cross-domain authentication process, where is the Lagrange coefficient.

[0041] Furthermore, in step (5), the device DE i and other domain devices DE j The specific process of cross-domain mutual authentication is as follows:

[0042] Step (5.1), DE i Select random number And calculate R' i =r' i ·P, M i =H2(PID i ,e(σ i ,P),T3),DE i To device DE in domain B j Send mutual authentication request

[0043] Step (5.2), equipment DE j After receiving the request message, firstly, the equation T-T3<Δt and Verify the message freshness and time key ts is valid. After verification, DE j Calculate M' i =H2(PID i ,e(P pub ,H0(PID i ||ts)),T3), and by judging M i =M' i Whether to establish certification DE i ;

[0044] Step (5.3), equipment DE j Select random number And calculate R j =r j ·P, M j =H1(r j R' i ,T4),DEj Calculate the session key sk ij =H2(PID i ,r j R' i ,T4), and returns the response message {M j ,R j ,T4} to device DE i ;

[0045] Step (5.4), after receiving the response, DE i First check timestamp T4, verify the message freshness and calculate M' j =H1(PID i ,r' i R j ,T4), by judging M j =M' j Is it established to authenticate the device DE j ; After certification, DE i Calculate the session key sk ij =H2(PID i ,r i 'R j ,T4), then DE i and DE j Complete mutual authentication.

[0046] Furthermore, the specific process of identity tracking and revoking of malicious devices in step (6) is as follows:

[0047] Step (6.1), equipment DE i Send the corresponding pseudonym PID to the trusted institution TA on the public channel i , request to update the time key ts;

[0048] Step (6.2), update PID i Before the time key is sent, the trusted authority TA first checks the total pseudonym status in the local database, and then selects a random number b i And calculate B i =b i P, then calculates the signature for the validity period ts Send a message To the corresponding device;

[0049] Step (6.3), DE i By equation Determine the validity of the time key, save it locally, and complete the update;

[0050] Step (6.4), when a device in the domain is found to have malicious behavior, TA can iand the private key msk through the equation Trace back to the true identity of the device;

[0051] TA will calculate the ID i Add to blacklist, stop updating time key, and update PID in local database i The corresponding status completes the revocation of the malicious device.

[0052] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0053] (1) Aiming at the security issues of cross-domain authentication of industrial Internet of Things and the single point of failure in traditional centralized framework, the present invention proposes a secure distributed authentication method based on DKG algorithm. The trusted institution TA is only used to issue certificates for local IIoT devices. Cross-domain identity authentication is implemented by distributed authentication service, which independently negotiates the master key through DKG algorithm. Therefore, cross-domain authentication is independent of the trusted third party, thus achieving complete decentralization without single point of failure.

[0054] (2) The present invention also proposes an anonymous and efficient cross-domain handover authentication scheme, which embeds a time key in the token for handover, thereby improving the efficiency and security of token management. In addition, the scheme can implement anonymous authentication in a distributed framework and reduce latency through a handover algorithm.

[0055] (3) The present invention adopts a detailed analysis model to evaluate the performance of the scheme. In addition, the security of the cryptographic protocol is evaluated through formal security analysis and can resist multiple types of attacks, including reply attacks, impersonation attacks and man-in-the-middle attacks, which is more secure than other related schemes. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a system model diagram of the present invention;

[0057] Figure 2 This is a diagram comparing computing overhead on the device side when the number of servers n=10 in one embodiment of the present invention. DETAILED DESCRIPTION

[0058] The technical solution of the present invention is described in detail below, but the protection scope of the present invention is not limited to the embodiments.

[0059] In view of the single point failure and other problems existing in the centralized framework of the traditional cross-domain authentication scheme, the present invention first proposes a secure distributed framework, which includes authentication servers in different domains. By introducing a distributed key generation protocol, ASs jointly negotiate the master key of the distributed system, and each AS holds a secret share of the system master private key, establishes distributed trust between different domains, avoids dependence on trusted third parties, and thus achieves complete decentralization. In order to meet the real-time requirements of industrial production, we designed a switching authentication algorithm embedded with time-related keys. The TA in the domain unloads the authentication capability to the authentication server, and the authentication server completes the identity authentication of the device. After the device completes pre-authentication with the AS of different domains, it obtains partial tokens signed by the secret share held by the AS, and after collecting partial tokens exceeding the threshold number, it batch authenticates the AS and calculates and generates its own legal identity token for subsequent cross-domain identity authentication. During the validity period of the token, the device can use the token and other domain devices to complete cross-domain mutual authentication, and can randomly switch to devices in other domains without re-performing the pre-authentication process, thereby reducing authentication delay and certificate management overhead. In addition, the TA can realize dynamic management of the device by stopping the time key of the token update, thereby improving the security of the system.

[0060] like Figure 1 As shown, the present invention relates to the following participating entities, namely, a trusted center (TA) in the domain, an authentication server (AS), and an IIoT device (DE). As a trusted third party, TA has more computing and storage resources and is responsible for initializing system parameters and registering entities in the domain. In addition, in order to achieve dynamic management of the device, TA also regularly updates the time key of the device. Except for tracking and revoking devices with malicious identities, TA does not participate in the authentication process of the device. The authentication server AS of each domain implements cross-domain authentication. TA transfers its own identity authentication capability to AS, and AS completes the identity authentication of devices in this domain and devices in other domains. Trust is established between authentication servers in different domains through a distributed key generation protocol. Device DE is an intelligent terminal that initiates authentication requests in the Internet of Things domain. It has low computing and storage capabilities. There are multiple devices in a domain, and they all need to communicate and interact with other devices in the domain to complete production collaboration, and the identity of the device should be anonymous.

[0061] In order to facilitate understanding of the technical solution of this embodiment, the meanings of the relevant variables are first explained, and the specific contents are shown in Table 1.

[0062] Table 1

[0063]

[0064]

[0065] In order to achieve secure communication and resource sharing between cross-domain devices, the present invention proposes to use the DKG protocol to negotiate the distributed system master key between ASs. The ASs of different IoT domains each hold a part of the system master key, thereby establishing trust between different domains, eliminating dependence on trusted third parties, and achieving complete decentralization. The anonymous cross-domain authentication scheme based on the switching algorithm of the present invention improves the authentication efficiency by introducing an identity token. The device can use the token to directly initiate a cross-domain authentication request, avoiding the involvement of the infrastructure, thereby reducing the authentication delay. In addition, by embedding a time key in the identity token, it is used to promptly revoke devices with malicious behavior, thereby achieving dynamic management of the device.

[0066] The anonymous cross-domain switching authentication method of the industrial Internet of Things based on distributed trust of the present invention comprises the following steps:

[0067] Step (1) completes the initialization of system parameters in each domain, that is, the trusted authority TA in each domain initializes the system parameters {G1, G2, q, P, e, mpk A ,H0,H1,H2,H3};

[0068] Where G1 and G2 are two groups with generators P and prime order q, H0, H1, H2, H3 are four hash functions; mpk A =msk A P is the public key of domain A; is the private key of domain A;

[0069] Step (2) sets the distributed system master key, that is, the authentication server AS of each domain negotiates the system master key pair through the distributed key generation DKG protocol to establish cross-domain trust without introducing a trusted third party; the specific method is:

[0070] For the authentication server AS in domain A i Calculate and distribute to authentication servers AS in other domains j The secret share f i (j) and sent to the corresponding AS via a secure channel j ,j∈[1,n],j≠i;AS i Receive AS from other domains j Share your secret share j (i) After validation, AS i Calculate its secret share s i As the local private key, the system public key P is finally obtained pub and system private key s;

[0071] Step (3), during the registration phase, the device DE in each domain completes registration with the trusted authority TA in the domain and obtains a pseudonym and a key. The specific method is as follows:

[0072] Equipment DE i Send a message containing his / her ID to TA. i Registration request; TA verification ID i Is it unique? After verification, the trusted organization TA is the device DE i Calculate device pseudonym PID i and the corresponding time key, and then transmit it through a secure channel Return to device DE i ;

[0073] Step (4), pre-authentication phase, the authentication server AS of other domains completes the authentication of the device DE in domain A. i The device DE i First, complete the authentication and obtain partial tokens, and aggregate them to generate identity tokensσ i ; The specific method is:

[0074] DE i Authentication server AS in other domains j Send pre-authentication request req and record the current timestamp T1; AS j After receiving the pre-authentication request, verify whether the time and time key are valid. After the verification is passed, calculate the partial token first And part of the token and the current timestamp T2 is sent to the device DE i ;

[0075] Equipment DE i After receiving, first verify the timestamp T2, and after verification, DE i Calculate partial token σ i,j , when the number of partial tokens collected is greater than the threshold t, multiple authentication servers AS j Carry out batch verification; after batch verification is passed, DE i Calculate and store the identity token σ i ;

[0076] Step (5), cross-domain authentication phase, domain A device DE i Use your own legal identity tokenσ i To the device DE in domain B j Send cross-domain authentication request, DE j Verification i The validity of the session key sk is negotiated ij ; The specific method is:

[0077] DE in domain A i To device DE in domain B jSend mutual authentication request req, record the current timestamp T3; device DE j After receiving the request message, first verify whether the timestamp T3 and time key ts are valid. After the verification is passed, DE j Calculate the session key sk ij , and returns the response message {M j ,R j ,T4} to device DE i ; After receiving the response, DE i Verify the received response. If the verification is successful, mutual authentication is completed and the session key sk is negotiated. ij For subsequent data transmission;

[0078] Step (6): trace the real identity of the malicious device and revoke it.

[0079] The detailed process of step (1) of this embodiment is as follows:

[0080] Step (1.1), TA in field A generates two groups G1 and G2 with generator P and prime order q, where G1 is an additive cyclic group and G2 is a multiplicative cyclic group, and determines the bilinear pairing: e:G1×G1→G2;

[0081] Step (1.2), TA selects a random number As the private key of domain A, and calculate the corresponding public key mpk A =msk A P, and choose a secure hash function: H0:{0,1} * ×{0,1} * →G1, H1: H2: H3:

[0082] Step (1.3), TA public domain system parameters {G1, G2, q, P, e, mpk A ,H0,H1,H2,H3}, and store msk secretly locally A .

[0083] The specific process of generating the distributed system master key in step (2) of this embodiment is as follows:

[0084] Step (2.1), the AS of each domain randomly selects a t-1 degree polynomial. For the authentication server of domain A, the polynomial is f i (x) = a i,0 +a i,1 x+a i,2 x 2 +…+a i,t-1 x t-1 mod q;

[0085] in is a randomly selected coefficient, f i (0) = a i,0 As a secret shared with other domain ASs; AS i Calculate the secret share f distributed to other domain authentication servers i (j) and sent to the corresponding AS via a secure channel j ;f i (j) is AS i Sent to AS via secure channel j The secret share, f j (i) is AS j Sent to AS via secure channel i of secret share;

[0086] Step (2.2), AS i Receive AS from other domains j Share your secret share j 9i), then by judging the equation Is it established to verify the AS j The validity of the secret share, if established, proceed to the subsequent steps, otherwise, refuse to share; i k is the kth power of i introduced into the polynomial;

[0087] Step (2.3), AS i Calculate its secret share s i =∑ j∈CS f j (i) As the local private key and the corresponding public key PK i =s i P, where CS is the set of all legal nodes participating in the master key generation process of the distributed system; through the formula P pub =s i P calculates the system public key, then all authentication servers have a part of the secret share of the system private key, through the formula s = ∑ i∈CS a i,0 Reconstruct the system private key s.

[0088] In the above steps, ASs jointly negotiate the distributed system master key through the DKG protocol. The ASs in each domain each hold a part of the system master key to establish trust, thereby avoiding the introduction of a trusted third party and achieving complete decentralization.

[0089] Step (3) of this embodiment: Device DE i The specific process of registering a local TA in a domain is as follows:

[0090] Step (3.1), receive DEi After the registration request is received, the trusted authority TA first checks the ID locally i Have you registered to verify the identifier ID? i Is it unique and check it in the blacklist. If it exists, the registration process is terminated. Then, the trusted agency TA selects a random number a i , calculate A i =a i P, PID i =(PID' i ,A i );

[0091] Step (3.3), the trusted institution TA is the device DE i Choose a random number k i And calculate K i =k i P and u i =k i +msk A H1(PID i ,K i )modq; To achieve dynamic management of the device, TA generates a corresponding time key for the device pseudonym. TA first selects a random number b i And calculate the point B of the elliptic curve i =b i P; TA then calculates the Schnorr signature based on the randomly selected validity period ts

[0092] TA sends Return to the device;

[0093] Step (3.4), DE i After receiving the response, store it locally And create a table in the local database to store the pseudonyms and corresponding device status.

[0094] Step (4) of this embodiment: Device DE i Complete pre-authentication with other domain authentication servers AS and obtain identity token σ i The specific process is as follows:

[0095] Step (4.1), DE i Choose a random number r i And calculate R i )r i ·P, V i =H3(K i ,R i ,PID i )·r i +ui , and send the authentication server AS to other domains j (j∈[1,n]) sends a pre-authentication request K i ,R i ,V i , is the intermediate variable;

[0096] Step (4.2), after receiving the request message, AS j First, verify whether T1 is valid by T-T1<Δt, where Δt is the preset threshold; then, AS j By verifying the formula Whether the time key ts is valid or not; when both the timestamp T1 and the time key ts are verified to be valid, AS j Then continue with the subsequent steps to authenticate the device identity;

[0097] Step (4.3), AS j Check V i ·P=H3(K i ,R i ,PID i )·R i +K i +H1(PID i ,K i )·mpk A Is it established to verify DE i , if the equation holds, the authentication of the device is completed and the partial token σ is calculated i,j =s j ·H0(PID i ||ts) and Return message Give device DE i , where T2 is the current timestamp;

[0098] Step (4.4), equipment DE i After receiving the response message, first check the timestamp T2 with T-T2<Δt. After confirming the freshness of the message, DE i Calculating partial tokens When the number of collected partial tokens is greater than the threshold t, DE i By equation For multiple authentication servers AS j Carry out batch verification;

[0099] After certification, DE i Computing identity tokens And stored locally for subsequent cross-domain authentication process, where is the Lagrange coefficient.

[0100] Step (5) of this embodiment: Device DE i and other domain devices DE j The specific process of cross-domain mutual authentication is as follows:

[0101] Step (5.1), DE i Select random number And calculate R' i =r' i ·P, M i =H2(PID i ,e(σ i ,P),T3),DE i To device DE in domain B j Send mutual authentication request

[0102] Step (5.2), equipment DE j After receiving the request message, firstly, the equation T-T3<Δt and Verify the message freshness and time key ts is valid. After verification, DE j Calculate M' i =H2(PID i ,e(P pub ,H0(PID i ||ts)),T3), and by judging M i =M' i Whether to establish certification DE i ;

[0103] Step (5.3), equipment DE j Select random number And calculate R j =r j ·P, M j =H1(r j R' i ,T4),DE j Calculate the session key sk ij =H2(PID i ,r j R i ',T4), and returns the response message {M j ,R j ,T4} to device DE i ;

[0104] Step (5.4), after receiving the response, DE i First check timestamp T4, verify the message freshness and calculate M' j =H1(PID i ,r' i Rj ,T4), by judging M j =M' j Is it established to authenticate the device DE j ; After certification, DE i Calculate the session key sk ij =H2(PID i ,r i 'R j ,T4), then DE i and DE j Complete mutual authentication. In this step, the device uses the token to initiate authentication requests to other devices, realizing cross-domain authentication without infrastructure and reducing authentication delays. The token contains a time-related key and needs to be updated regularly by TA.

[0105] The specific process of tracking and revoking the identity of the malicious device in step (6) of this embodiment is as follows:

[0106] Step (6.1), equipment DE i Send the corresponding pseudonym PID to the trusted institution TA on the public channel i , request to update the time key ts;

[0107] Step (6.2), update PID i Before the time key is sent, the trusted authority TA first checks the total pseudonym status in the local database, and then selects a random number b i And calculate B i =b i P, then calculates the signature for the validity period ts Send a message To the corresponding device;

[0108] Step (6.3), DE i By equation Determine the validity of the time key, save it locally, and complete the update;

[0109] Step (6.4), when a device in the domain is found to have malicious behavior, TA can i and the private key msk through the equation Trace back to the true identity of the device;

[0110] TA will calculate the ID i Add to blacklist, stop updating time key, and update PID in local database i The corresponding status completes the revocation of the malicious device.

[0111] Example:

[0112] This embodiment runs on the Windows operating system. The host is equipped with an Intel i7-11700K CPU and 16GB RAM. The computational overhead of each operation of this method is shown in Table 2:

[0113] Table 2

[0114]

[0115] In Table 2, OP stands for operation, T stands for running time, and T sm Represents the scalar multiplication operation related to the elliptic curve, T mtp represents a map-to-point hash operation, T bp and represents the bilinear mapping operation, T exp Represents modular exponentiation.

[0116] In terms of communication overhead, since the present invention uses the BLS12381 curve with a security level of 128 bits, and |G| are 48 and 97 bytes respectively, assuming that the identifier |ID| is 20 bytes. In addition, the present invention assumes that the size of the timestamp and the time key are both 4 bytes, represented by |T|.

[0117] According to the above operations, the actual application calculation overhead and communication overhead results of the technical solution of the present invention are shown in Table 3. This result clearly shows that the calculation overhead of the technical method of the present invention is very lightweight and has obvious advantages over the existing methods.

[0118] Table 3

[0119]

[0120] In addition, this embodiment also considers the impact of setting different thresholds on the computing overhead of the device side when the total number of servers remains unchanged, as shown in the following example: Figure 2 As shown in the figure, the total number of servers is n = 10, and the threshold t ranges from [1, 10]. It can be observed that even when t = 10, that is, the device needs to interact with all authentication servers, it only takes about 7.7ms for the device to generate a valid identity token. The device can use the token to perform multiple authentication switches with other domain devices before the token expires, so this scheme can significantly improve efficiency and reduce authentication delays.

Claims

1. An anonymous cross-domain switching authentication method for industrial Internet of Things based on distributed trust, characterized in that: The following steps are involved: Step (1) completes the initialization of system parameters in each domain, that is, the trusted authority TA in each domain initializes the system parameters {G1, G2, q, P, e, mpk A ,H0,H1,H2,H3}; Where G1 and G2 are two groups with generators P and prime order q, H0, H1, H2, H3 are four hash functions; mpk A =msk A P is the public key of domain A; is the private key of domain A; Step (2), setting the distributed system master key, that is, the authentication server AS of each domain negotiates the system master key pair through the distributed key generation DKG protocol to establish cross-domain trust without introducing a trusted third party; The specific method is: For the authentication server AS in domain A i Calculate and distribute to authentication servers AS in other domains j The secret share f i (j) and sent to the corresponding AS via a secure channel j ,j∈[1,n],j≠i;AS i Receive AS from other domains j Share your secret share j (i) After validation, AS i Calculate its secret share s i As the local private key, the system public key P is finally obtained pub and system private key s; Step (3), during the registration phase, the device DE in each domain completes registration with the trusted authority TA in the domain and obtains a pseudonym and a key. The specific method is as follows: Equipment DE i Send a message containing his / her ID to TA. i Request for registration; TA verification ID i Is it unique? After verification, the trusted organization TA is the device DE i Calculate device pseudonym PID i and the corresponding time key, and then transmit it through a secure channel Return to device DE i ; Step (4), pre-authentication phase, the authentication server AS of other domains completes the authentication of the device DE in domain A. i The security authentication and issuance of identity tokens with embedded time keys; Equipment DE i First, complete the authentication and obtain partial tokens, and aggregate them to generate identity tokensσ i ; The specific method is: DE i Authentication server AS in other domains j Send pre-authentication request req and record the current timestamp T1; AS j After receiving the pre-authentication request, verify whether the time and time key are valid. After the verification is passed, calculate the partial token first And part of the token and the current timestamp T2 is sent to the device DE i ; Equipment DE i After receiving, first verify the timestamp T2, and after verification, DE i Calculate partial token σ i,j , when the number of partial tokens collected is greater than the threshold t, multiple authentication servers AS j Carry out batch verification; After batch certification, DE i Calculate and store the identity token σ i ; Step (5), cross-domain authentication phase, domain A device DE i Use your own legal identity tokenσ i To the device DE in domain B j Send cross-domain authentication request, DE j Verification i The validity of the session key sk is negotiated ij ; The specific method is: DE in domain A i To device DE in domain B j Send mutual authentication request req, record the current timestamp T3; device DE j After receiving the request message, first verify whether the timestamp T3 and time key ts are valid. After the verification is passed, DE j Calculate the session key sk ij , and returns the response message {M j ,R j ,T4} to device DE i ; After receiving the response, DE i Verify the received response. If the verification is successful, mutual authentication is completed and the session key sk is negotiated. ij For subsequent data transmission; Step (6) traces and revokes the real identity of the malicious device.

2. According to the distributed trust-based anonymous cross-domain switching authentication method for industrial Internet of Things in claim 1, it is characterized in that: The detailed process of step (1) is as follows: Step (1.1), TA in field A generates two groups G1 and G2 with generator P and prime order q, where G1 is an additive cyclic group and G2 is a multiplicative cyclic group, and determines the bilinear pairing: e:G1×G1→G2; Step (1.2), TA selects a random number As the private key of domain A, and calculate the corresponding public key mpk A =msk A P, and choose a secure hash function: Step (1.3), TA public domain system parameters {G1, G2, q, P, e, mpk A ,H0,H1,H2,H3}, and store msk secretly locally A .

3. According to the distributed trust-based anonymous cross-domain switching authentication method for industrial Internet of Things in claim 1, it is characterized in that: The specific process of generating the distributed system master key in step (2) is as follows: Step (2.1), the AS of each domain randomly selects a t-1 degree polynomial. For the authentication server of domain A, the polynomial is f i (x) = a i,0 +a i,1 x+a i,2 x 2 +...+a i,t-1 x t-1 mod q; in is a randomly selected coefficient, f i (0) = a i,0 As a secret shared with other domain ASs; AS i Calculate the secret share f distributed to other domain authentication servers i (j) and sent to the corresponding AS via a secure channel j ;f i (j) is AS i Sent to AS via secure channel j The secret share, f j (i) is AS j Sent to AS via secure channel i of secret share; Step (2.2), AS i Receive AS from other domains j Share your secret share j (i) and then, by judging the equation Is it established to verify the AS j The validity of the secret share, if established, proceed to the subsequent steps, otherwise, refuse to share; i k is the kth power of i introduced into the polynomial; Step (2.3), AS i Calculate its secret share s i =Σ j∈CS f j (i) As the local private key and the corresponding public key PK i =s i P, where CS is the set of all legal nodes participating in the master key generation process of the distributed system; through the formula P pub =s i P calculates the system public key, then all authentication servers have a part of the secret share of the system private key, through the formula s = ∑ i∈CS a i,0 Reconstruct the system private key s.

4. According to the distributed trust-based anonymous cross-domain switching authentication method for industrial Internet of Things in claim 1, it is characterized in that: The step (3) equipment DE i The specific process of registering a local TA in a domain is as follows: Step (3.1), receive DE i After the registration request is received, the trusted authority TA first checks the ID locally i Have you registered to verify the identifier ID? i Is it unique? Check it in the blacklist. If it exists, terminate the registration process. Then, the trusted authority TA selects a random number a i , calculate A i =a i P, PID i =(PID′ i ,A i ); Step (3.3), the trusted institution TA is the device DE i Choose a random number k i And calculate K i =k i P and u i =k i +msk A H1(PID i ,K i )mod q; To achieve dynamic management of the device, TA generates a corresponding time key for the device pseudonym. TA first selects a random number b i And calculate the point B of the elliptic curve i =b i P; TA then calculates the Schnorr signature based on the randomly selected validity period ts TA sends Return to the device; Step (3.4), DE i After receiving the response, store it locally And create a table in the local database to store the pseudonyms and corresponding device status.

5. According to the distributed trust-based anonymous cross-domain switching authentication method for industrial Internet of Things in claim 1, it is characterized in that: The step (4) equipment DE i Complete pre-authentication with other domain authentication servers AS and obtain identity token σ i The specific process is as follows: Step (4.1), DE i Choose a random number r i And calculate R i =r i ·P, V i =H3(K i ,R i ,PID i )·r i +u i , and send the authentication server AS to other domains j (j∈[1,n]) sends a pre-authentication request K i ,R i ,V i , is the intermediate variable; Step (4.2), after receiving the request message, AS j First, verify whether T1 is valid by T-T1<Δt, where Δt is the preset threshold; Subsequently, AS j By verifying the formula Whether the time key ts is valid or not; when both the timestamp T1 and the time key ts are verified to be valid, AS j Then continue with the subsequent steps to authenticate the device identity; Step (4.3), AS j Check V i ·P=H3(K i ,R i ,PID i )·R i +K i +H1(PID i ,K i )·mpk A Is it established to verify DE i , if the equation holds, the authentication of the device is completed and the partial token σ is calculated i,j =s j ·H0(PID i ||ts) and Return message Give device DE i , where T2 is the current timestamp; Step (4.4), equipment DE i After receiving the response message, first check the timestamp T2 with T-T2<Δt. After confirming the freshness of the message, DE i Calculating partial tokens When the number of collected partial tokens is greater than the threshold t, DE i By equation For multiple authentication servers AS j Carry out batch verification; After certification, DE i Computing identity tokens And stored locally for subsequent cross-domain authentication process, where is the Lagrange coefficient.

6. The anonymous cross-domain switching authentication method for industrial Internet of Things based on distributed trust according to claim 1 is characterized in that: The step (5) equipment DE i and other domain devices DE j The specific process of cross-domain mutual authentication is as follows: Step (5.1), DE i Select random number And calculate R′ i = r′ i ·P, M i =H2(PID i ,e(σ i ,P),T3),DE i To device DE in domain B j Send mutual authentication request Step (5.2), equipment DE j After receiving the request message, firstly, the equation T-T3<Δt and Verify the message freshness and time key ts is valid. After verification, DE j Calculate M′ i =H2(PID i ,e(P pub ,H0(PID i ||ts)),T3), and by judging M i =M′ i Whether to establish certification DE i ; Step (5.3), equipment DE j Select random number And calculate R j =r j ·P, M j =H1(r j R′ i ,T4),DE j Calculate the session key sk ij =H2(PID i ,r j R′ i ,T4), and returns the response message {M j ,R j ,T4} to device DE i ; Step (5.4), after receiving the response, DE i First check the timestamp T4, verify the message freshness and calculate M′ j =H1(PID i ,r′ i R j ,T4), by judging M j =M′ j Is it established to authenticate the device DE j ; After certification, DE i Calculate the session key sk ij =H2(PID i ,r′ i R j ,T4), then DE i and DE j Complete mutual authentication.

7. The anonymous cross-domain switching authentication method for industrial Internet of Things based on distributed trust according to claim 1 is characterized in that: The specific process of tracking and revoking the identity of the malicious device in step (6) is as follows: Step (6.1), equipment DE i Send the corresponding pseudonym PID to the trusted institution TA on the public channel i , request to update the time key ts; Step (6.2), update PID i Before the time key is sent, the trusted authority TA first checks the total pseudonym status in the local database, and then selects a random number b i And calculate B i =b i P, then calculates the signature for the validity period ts Send a message To the corresponding device; Step (6.3), DE i By equation Determine the validity of the time key, save it locally, and complete the update; Step (6.4), when a device in the domain is found to have malicious behavior, TA can i and the private key msk through the equation Trace back to the true identity of the device; TA will calculate the ID i Add to blacklist, stop updating time key, and update PID in local database i The corresponding status completes the revocation of the malicious device.

Images