Distributed trust-based anonymous cross-domain handover authentication method for industrial internet of things

Abstract

The application discloses an anonymous cross-domain switching authentication method based on distributed trust for an industrial Internet of Things, which first completes initialization of system parameters in each domain; authentication servers of each domain negotiate a system master key pair through a distributed key generation protocol; devices in each domain complete registration in a domain (TA), obtain pseudonyms and keys; other domain AS complete security authentication of the devices and issue identity tokens embedded with time keys; the devices initiate cross-domain mutual authentication requests to other domain devices within a valid period of the identity tokens and negotiate session keys; and real identity tracing and revocation processing are performed on malicious devices. The application realizes complete decentralization in view of problems such as single-point failure in a traditional centralized authentication architecture in the industrial Internet of Things, reduces authentication delay through an anonymous cross-domain switching authentication scheme, and embeds time keys in identity tokens to realize dynamic management of the devices. The application can realize safe anonymous cross-domain switching authentication, resist common attacks including response attacks, impersonation attacks and man-in-the-middle attacks, and has low computing and communication overheads.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical fields of Internet of Things and information security, and particularly relates to an anonymous cross-domain switching authentication method for industrial Internet of Things based on distributed trust. BACKGROUND

[0002] Industrial Internet of Things (IIoT) is an important extension of Internet of Things technology in the industrial field. However, as the complexity and refinement of manufacturing industry continue to improve, the production process of a single product may need to cross multiple production fields. For example, the manufacturing process of an electric vehicle usually involves the cooperation of multiple fields such as automobile manufacturing industry, electronic manufacturing industry, energy industry and technology industry, to meet the production needs of automobile design, production and intelligent services. Cross-domain production cooperation integrates resources and technologies of multiple fields and reasonably allocates them, so as to realize intelligent, efficient and sustainable development of the production process.

[0003] Different industrial enterprises share a large amount of real-time data generated by automated equipment in intelligent factories in industrial production to complete cross-domain cooperation. However, these real-time data are transmitted on public channels and may be tampered with, forged and attacked by malicious attackers. Considering the security risks existing in cross-domain data transmission, enterprises often manage and maintain data independently and are reluctant to share them with other enterprises. Data are difficult to flow and share securely between different IIOT domains, causing data island problem. Identity verification scheme can be used to break the data island phenomenon. However, in cross-domain IIoT, data contain sensitive information such as control parameters, and the identity information of equipment may also contain private information. Therefore, it is of great significance to design a cross-domain authentication scheme to protect the privacy of equipment while realizing secure data sharing.

[0004] Generally, the anonymous cross-domain authentication scheme of IIoT can be divided into centralized and distributed two kinds. The centralized scheme uses a trusted authority TA to assist in cross-domain authentication, in which any cross-domain authentication is transmitted by the local TA. The target domain TA receives the corresponding identity information from the local TA. Therefore, the centralized authentication scheme needs to perform multiple rounds of communication, which brings a large overhead and is difficult to implement in real-time industrial production. In addition, the increase of cross-domain identity authentication requests may bring heavy burden to the TA, which may cause single point failure.

[0005] In most distributed identity authentication schemes, the TA offloads identity information or credentials, etc. identity authentication capabilities to the edge nodes assisted in each IIoT domain. In this case, the edge node can authenticate the user in the management domain with lower delay. However, once the device moves to another domain, the edge node must obtain the identity information from the TA. This means that the TA is still required to complete cross-domain identity authentication. Some distributed schemes use Shamir secret sharing to distribute sub-master keys to edge nodes or servers. But in the current scheme, this allocation process still requires the participation of the TA participant. Therefore, the existing distributed authentication scheme still has the shortcomings of centralized network architecture to some extent, and cannot achieve complete decentralization.

[0006] In addition, the performance of cross-domain authentication also needs attention, as mentioned earlier, the cross-domain authentication in the current scheme often involves the participation of the infrastructure and multiple rounds of interaction, and the frequent cross-domain authentication process brings a huge burden to real-time industrial production. Switching identity authentication uses a token mechanism to avoid infrastructure participation during identity authentication. In the case of a valid token, the device can use it to prove its legal identity and complete mutual authentication with other domain devices, thereby improving authentication efficiency. However, in the current anonymous cross-domain authentication scheme, there is no similar mechanism. SUMMARY

[0007] The purpose of the present application is to solve the problems existing in the prior art and provide an anonymous cross-domain switching authentication method for industrial Internet of Things based on distributed trust.

[0008] Technical scheme: An anonymous cross-domain switching authentication method for industrial Internet of Things based on distributed trust, comprising the following steps:

[0009] Step (1), complete the initialization of the system parameters in each domain, that is, the trusted authority TA of each domain initializes the system parameters {G1, G2, q, P, e, mpk A , H0, H1, H2, H3} in the respective domain.

[0010] Wherein G1 and G2 are two groups with P as the generator and q as the prime order, H0, H1, H2, H3 are four hash functions; mpk A = msk A P is the public key of domain A; is the private key of domain A;

[0011] Step (2), set the distributed system master key, that is, the authentication server AS of each domain negotiates the system master key pair through the distributed key generation DKG protocol, establishes cross-domain trust, and does not need to introduce a trusted third party; the specific method is:

[0012] For the authentication server AS of domain Ai computes the secret share f j of the authentication server AS i of other domains, and sends it to the corresponding AS j through a secure channel, j∈[1, n], j≠i; AS i receives the secret share f j of the authentication server AS j of other domains, and after the verification of the validity, the AS i computes its secret share s i as the local private key, and finally obtains the system public key P pub and the system private key s.

[0013] Step (3), registration phase, the device DE in each domain completes registration in the trusted authority TA in the domain, and obtains a pseudonym and a key; the specific method is as follows:

[0014] The device DE i sends a registration request containing its identity ID i to the TA; the TA verifies whether the identity ID i is unique, and after the verification, the trusted authority TA calculates the device pseudonym PID i and the corresponding time key for the device DE i , and then returns them to the device DE i through a secure channel.

[0015] Step (4), pre-authentication phase, the authentication server AS of other domains completes the security authentication of the device DE i of the domain A, and issues an identity token embedded with a time key; the device DE i firstly obtains part of the token after the authentication, and aggregates it to generate the identity token σ u ; the specific method is as follows:

[0016] The device DE i sends a pre-authentication request req to the authentication server AS j of other domains, and records the current time stamp T1; after receiving the pre-authentication request, the AS j verifies whether the time and the time key are valid, and after the verification, firstly calculates part of the token and sends the part of the token and the current time stamp T2 to the device DE i .

[0017] After receiving, the device DE i firstly verifies the time stamp T2, and after the verification, the DE i calculates part of the token σ i,j ​When the number of collected partial tokens is greater than the threshold t, the plurality of authentication servers AS j are batch-verified; after the batch authentication is passed, the DE i calculates and stores the identity token σ i ;

[0018] Step (5), cross-domain authentication phase, the DE i of domain A uses its own legal identity token σ i to send a cross-domain authentication request to the DE j of domain B, the DE j verifies the validity of σ i and negotiates the session key sk ij ; the specific method is as follows:

[0019] The DE i in domain A sends a mutual authentication request req to the DE j in domain B, and records the current timestamp T3; after the DE j receives the request message, it first verifies the validity of the timestamp T3 and the time key ts, and after the verification is passed, the DE j calculates the session key sk ij and returns the response message {M j , R j , T4} to the DE i ; after receiving the response, the DE i verifies the received response, and after the verification is passed, the mutual authentication is completed and the session key sk ij is negotiated for subsequent data transmission;

[0020] Step (6), real identity tracing and revocation processing for malicious devices.

[0021] Further, the detailed process of step (1) is as follows:

[0022] Step (1.1), the TA in domain A generates two groups G1 and G2 with the generator P and the prime number q, wherein G1 is an additive cyclic group, G2 is a multiplicative cyclic group, and determines the bilinear pairing: e: G1 × G1 → G2;

[0023] Step (1.2), the TA selects a random number as the private key of domain A, and calculates the corresponding public key mpk A = msk A P, and selects a secure hash function: H0: {0,1} * × {0,1} * → G1, H1: H2: H3:

[0024] Step (1.3), TA public domain system parameters {G1, G2, q, P, e, msk, H0, H1, H2, H3} and locally store msk A . A .

[0025] Further, the specific process of step (2) for distributed system master key generation is as follows:

[0026] Step (2.1), AS of each domain randomly selects a t-1 degree polynomial, for the authentication server of domain A, the polynomial is f i (x) = a i,0 +a i,1 x+a i,2 x 2 +...+a i,t-1 x t-1 mod q;

[0027] Wherein is a randomly selected coefficient, f i (0) = a i,0 as a secret shared with other domain AS; AS i calculates the secret share f i (j) distributed to other domain authentication server and sends to the corresponding AS j through a secure channel; f i (j) is the secret share sent by AS i to AS j through a secure channel, f j (i) is the secret share sent by AS j to AS i through a secure channel;

[0028] Step (2.2), after AS i receives the secret share f j (i) shared by AS j of other domains, it verifies the validity of the secret share from AS j by judging whether the equation holds, if it holds, proceed to the subsequent steps, otherwise, reject the sharing; i k is the k-th power of i brought into the polynomial;

[0029] Step (2.3), AS i calculates its secret share s i = ∑ j∈CS f j (i) as a local private key and the corresponding public key PK i = s iP, wherein CS is the set of all legal nodes participating in the distributed system master key generation process; through the formula P pub = s i P, the system public key is calculated, and all authentication servers have a part of the secret share of the system private key, through the formula s = ∑ i∈CS a i,0 The system private key s is reconstructed.

[0030] Further, in step (3), the device DE i The specific process of registration in the local TA in the domain is as follows:

[0031] Step (3.1), after receiving the registration request of DE i , the trusted authority TA first checks the ID i locally to verify whether the identifier ID i is unique, and checks in the blacklist, if it exists, the registration process is terminated; then, the trusted authority TA selects a random number a i , calculates A i = a i P, PID i = (PID' i , A i );

[0032] Step (3.3), the trusted authority TA selects a random number k i for the device DE i and calculates K i = k i P and u i = k i + msk A · H1(PID i , K i ) mod q; to realize the dynamic management of the device, the TA generates the corresponding time key for the device pseudonym. The TA first selects a random number b i and calculates the point B i = b i P of the elliptic curve; then, the TA calculates the Schnorr signature according to the randomly selected valid time period ts

[0033] The TA returns to the device through a secure channel;

[0034] Step (3.4), after DE i receives the response, stores locally and creates a table in the local database to store the pseudonym and the corresponding device state.

[0035] Further, the step (4) device DE i and other domain authentication servers AS complete pre-authentication to obtain identity token σ i The specific process is as follows:

[0036] Step (4.1), DE i selects a random number r i and calculates R i = r i · P, V i = H3(K i , R i , PID i )· r i + u i , and sends a pre-authentication request to the authentication server AS j (j ∈ [1, n]) of the other domain K i , R i , V i , are intermediate variables;

[0037] Step (4.2), after receiving the request message, the AS j firstly verifies whether T1 is valid by T-T1 < Δt, and Δt is a preset threshold value; subsequently, the AS j judges whether the time key ts is valid by verifying whether the formula is established; when both the time stamp T1 and the time key ts are verified to be valid, the AS j then continues the subsequent step of authenticating the device identity;

[0038] Step (4.3), the AS j checks whether V i · P = H3(K i , R i , PID i )· R i + K i + H1(PID i , K i )· mpk A is established to verify the DE i , if the equation is established, the authentication of the device is completed, and the partial token σ i,j = s j · H0(PID i || ts) and returns the message to the device DE i , wherein T2 is the current time stamp;

[0039] Step (4.4), the device DE iAfter receiving the response message, first check the timestamp T2 with T-T2<Δt. After confirming the freshness of the message, DE i Partial token calculation When the number of collected partial tokens is greater than the threshold t, DE i Through the equation To multiple authentication servers AS j Perform batch verification;

[0040] After authentication, DE i Calculate identity token And store locally for subsequent cross-domain authentication process, wherein Lagrange coefficient.

[0041] Further, step (5) device DE i And other domain devices DE j The specific process of cross-domain mutual authentication is as follows:

[0042] Step (5.1), DE i Select a random number And calculate R' i =r' i ·P, M i =H2(PID i ,e(σ i ,P),T3), DE i Send a mutual authentication request to the device DE j In domain B

[0043] Step (5.2), device DE j After receiving the request message, first verify the freshness of the message and whether the time key ts is valid through the equations T-T3<Δt and After verification, DE j Calculate M' i =H2(PID i ,e(P pub ,H0(PID i ||ts)),T3), and authenticate DE i Whether M i =M' i ;

[0044] Step (5.3), device DE j Select a random number And calculate R j =r j ·P, M j =H1(r j R' i ,T4), DEj Calculate session key sk ij =H2(PID) i ,r j R' i ,T4), and return the response message {M j ,R j T4} gives device DE i ;

[0045] Step (5.4), after receiving the response, DE i First, check the timestamp T4 to verify message freshness, then calculate M'. j =H1(PID) i ,r' i R j ,T4), by judging M j =M' j Is it valid to authenticate the device DE? j After authentication, DE i Calculate session key sk ij =H2(PID) i ,r i 'R j ,T4), then DE i and DE j Complete mutual authentication.

[0046] Furthermore, the specific process for tracking and revoking the identity of malicious devices in step (6) is as follows:

[0047] Step (6.1), Device DE i Send the corresponding pseudonym PID to the trusted institution TA through public channels. i Request an update to the time key ts;

[0048] Step (6.2), updating the PID i Before obtaining the time key, the trusted authority (TA) first checks the overall pseudonym status in the local database. Then, the TA selects a random number b. i And calculate B i =b i P, followed by a signature calculation for the valid time period ts. TA sends a message Provide to the corresponding equipment;

[0049] Step (6.3), DE i Through equations Determine the validity of the time key, save it locally, and complete the update;

[0050] Step (6.4): When malicious behavior is detected in a device within the domain, the TA can use the alias PID. iand the private key msk through the equation Tracing back to the real identity of the device;

[0051] The TA will calculate the ID i Join the blacklist, stop updating the time key, and update the PID in the local database i The corresponding state, complete the revocation of the malicious device.

[0052] Advantages: Compared with the prior art, the present application has the following advantages:

[0053] (1) The present application proposes a secure distributed authentication method based on DKG algorithm for the security problem of industrial Internet of Things cross-domain authentication and the single point failure problem existing in traditional centralized framework. The trusted authority TA is only used to issue certificates for local IIoT devices, and cross-domain identity authentication is realized by distributed identity authentication service. The distributed identity authentication service independently negotiates the master key through the DKG algorithm. Therefore, the cross-domain identity authentication is independent of the trusted third party, thereby realizing complete decentralization without the problem of single point failure.

[0054] (2) The present application also proposes an anonymous and efficient cross-domain switching authentication scheme, which embeds a time key in the token for switching, thereby improving the efficiency and security of token management. In addition, the scheme can realize anonymous authentication under a distributed framework, and reduce the delay through a switching algorithm.

[0055] (3) The present application uses a detailed analysis model to evaluate the performance of the scheme. In addition, the security of the cryptographic protocol is evaluated through formal security analysis, and can resist multiple types of attacks, including response attacks, impersonation attacks and man-in-the-middle attacks, and has stronger security compared with other related schemes. BRIEF DESCRIPTION OF DRAWINGS

[0056] Figure 1 The system model diagram of the present application;

[0057] Figure 2 The comparison chart of the computing overhead of the device end when the number of servers n=10 in an embodiment of the present application. DETAILED DESCRIPTION

[0058] The technical scheme of the present application will be described in detail below, but the protection scope of the present application is not limited to the described embodiments.

[0059] In view of the single point failure and other problems existing in the centralized framework in the traditional cross-domain authentication scheme, the application first proposes a secure distributed framework, which includes authentication servers in different domains, the main key of the distributed system is negotiated by introducing a distributed key generation protocol, and each AS holds a secret share of the system main private key, distributed trust is established between different domains, avoiding the dependence on a trusted third party, so that complete decentralization is realized. In order to meet the real-time demand of industrial production, we design a switching authentication algorithm embedded with time-related key. The TA in the domain offloads the authentication capability to the authentication server, and the authentication server completes the identity authentication of the device. The device first completes the pre-authentication with the AS in different domains to obtain the partial token signed by the AS holding the secret share, and after collecting the partial token exceeding the threshold value, the device batch authenticates the AS and calculates the legal identity token of itself, which is used for subsequent cross-domain identity authentication. Within the validity period of the token, the device can use the token and other domain devices to complete cross-domain mutual authentication, and can randomly switch to other domain devices without re-performing the pre-authentication process, thereby reducing the authentication delay and certificate management overhead. In addition, the TA can realize dynamic management of the device by stopping updating the time key of the token, thereby improving the security of the system.

[0060] As Figure 1 shown, the application relates to the following participating entities, i.e., an intra-domain trusted center (TA), an authentication server (AS) and an IIoT device (DE). The TA, as a trusted third party, has more computing and storage resources, and is responsible for initializing system parameters and registering entities in the domain. In addition, in order to realize dynamic management of the device, the TA also regularly updates the time key of the device, and in addition to tracking and revoking devices with malicious identities, the TA does not participate in the authentication process of the device. The authentication server AS of each domain implements cross-domain authentication, and the TA transfers its identity authentication capability to the AS, which completes the identity authentication of the devices in the domain and the devices in other domains. The authentication servers in different domains establish trust through a distributed key generation protocol. The device DE is a smart terminal that initiates an authentication request in the Internet of Things domain, and has low computing and storage capacity. There are multiple devices in a domain, which need to communicate and interact with other devices in the domain to complete production cooperation, and the identity of the device should be anonymous.

[0061] In order to facilitate the understanding of the technical scheme of the embodiment, the meanings of related variables are explained first, and the specific content is shown in Table 1.

[0062] Table 1

[0063]

[0064]

[0065] To achieve secure communication and resource sharing between cross-domain devices, this invention proposes utilizing the DKG protocol to negotiate a distributed system master key between ASs. ASs in different IoT domains each hold a portion of the system master key, thereby establishing trust between different domains, eliminating reliance on trusted third parties, and achieving complete decentralization. This invention's anonymous cross-domain authentication scheme based on a switching algorithm improves authentication efficiency by introducing an identity token. Devices can directly initiate cross-domain authentication requests using the token, avoiding infrastructure involvement and reducing authentication latency. Furthermore, by embedding a time key in the identity token, devices exhibiting malicious behavior can be promptly revoked, enabling dynamic device management.

[0066] The present invention provides an anonymous cross-domain handover authentication method for industrial IoT based on distributed trust, comprising the following steps:

[0067] Step (1): Initialize the system parameters within each domain, that is, the Trusted Organization (TA) of each domain initializes the system parameters {G1,G2,q,P,e,mpk} within its respective domain. A ,H0,H1,H2,H3};

[0068] G1 and G2 are two groups with generators P and prime order q, and H0, H1, H2, and H3 are four hash functions; mpk A =msk A P is the public key of domain A; It is the private key for domain A;

[0069] Step (2): Set the distributed system master key. That is, the authentication servers (AS) of each domain generate the DKG protocol to negotiate the system master key pair through the distributed key, establishing cross-domain trust without the need to introduce a trusted third party. The specific method is as follows:

[0070] For the authentication server AS of domain A i Calculate the authentication server AS distributed to other domains j secret share f i (j), and send it to the corresponding AS via a secure channel. j , j∈[1,n],j≠i; AS i Received AS from other domains j Secret share to yourself f j (i) After that, perform validity verification. Once the verification is successful, AS i Calculate its secret share s i As the local private key, the system public key P is ultimately obtained. pub and system private key s;

[0071] Step (3), the registration phase, involves each device (DE) in its domain registering with the Trusted Authority (TA) within that domain and obtaining a pseudonym and key; the specific method is as follows:

[0072] Device DE i Send a registration request containing its identity ID to TA; TA verifies the identity ID i ; if the identity ID is unique, TA computes a pseudonym PID for DE and a corresponding time key, and returns them to DE over a secure channel i ; i ; i ; i ;

[0073] Step (4), pre-authentication phase, the authentication server AS of other domains completes the secure authentication of DE of domain A and issues an identity token embedded with time key; DE first acquires part of the token after authentication and aggregates it to generate the identity token σ i ; i ; i ;

[0074] DE i ; j ; j ; ; i ;

[0075] DE i ; i ; i,j ; j ; i ; i ;

[0076] Step (5), cross-domain authentication phase, DE of domain A sends a cross-domain authentication request to DE of domain B using its own legal identity token σ i ; i ; j ; j ; i ; ij ;

[0077] DE in domain A i ; j ​​Send mutual authentication request req, record current timestamp T3; device DE j After receiving the request message, first verify whether the timestamp T3 and the time key ts are valid, and after verification, DE j Calculate the session key sk ij , and return the response message {M j , R j , T4} to the device DE i ; After receiving the response, DE i verify the received response, and after verification, complete mutual authentication and negotiate the session key sk ij for subsequent data transmission;

[0078] Step (6), real identity tracing and revocation processing for malicious devices.

[0079] The detailed process of step (1) of the embodiment is as follows:

[0080] Step (1.1), the TA in domain A generates two groups G1 and G2 with P as the generator and q as the prime order, wherein G1 is an additive cyclic group, G2 is a multiplicative cyclic group, and determines a bilinear pairing: e: G1xG1→G2;

[0081] Step (1.2), the TA selects a random number as the private key of domain A, and calculates the corresponding public key mpk A = msk A P, and selects a secure hash function: H0: {0,1} * x {0,1} * →G1, H1: H2: H3:

[0082] Step (1.3), the TA discloses the domain system parameters {G1, G2, q, P, e, mpk A , H0, H1, H2, H3} and stores the local secret msk A .

[0083] The specific process of step (2) of the embodiment for generating a distributed system master key is as follows:

[0084] Step (2.1), each domain AS randomly selects a t-1 degree polynomial, and for the authentication server of domain A, the polynomial is f i (x) = a i,0 +a i,1 x+a i,2 x 2 +…+a i,t-1 x t-1 mod q;

[0085] wherein are randomly selected coefficients, f i (0) = a i,0 is a secret shared with other domain AS; AS i calculates the secret share f i (j) and sends it to the corresponding AS j through a secure channel; f i (j) is the secret share of AS i sent to AS j through a secure channel; f j (i) is the secret share of AS j sent to AS i through a secure channel;

[0086] Step (2.2), AS i receives the secret share f j 9i) shared by other domain AS j to itself, and then verifies the validity of the secret share from AS j by judging whether the equation holds true, and if so, proceeds to the subsequent steps, otherwise, rejects the sharing; k is the k-th power of i brought into the polynomial;

[0087] Step (2.3), AS i calculates its secret share s i =∑ j∈CS f j (i) as a local private key and the corresponding public key PK i = s i P, wherein CS is the set of all legal nodes participating in the distributed system master key generation process; the system public key is calculated through the formula P pub = s i P, then all authentication servers have a part of the secret share of the system private key, and the system private key s is reconstructed through the formula s =∑ i∈CS a i,0 .

[0088] The above steps are jointly negotiated by AS through the DKG protocol to generate the distributed system master key, and each AS of each domain holds a part of the system master key, establishes trust, thereby avoiding the introduction of a trusted third party, and realizing complete decentralization.

[0089] Step (3) of the embodiment, the device DE i registers with the local TA in the domain as follows:

[0090] Step (3.1), upon receiving DEi Upon receiving the registration request, the trusted authority TA first checks the ID i locally to verify that the identifier ID i is unique and in the blacklist, if any, and terminates the registration procedure; subsequently, the trusted authority TA selects a random number a i , computes A i = a i P, PID i = (PID' i , A i );

[0091] Step (3.3), the trusted authority TA selects a random number k i for the device DE i and computes K i = k i P and u i = k i + msk A · H1(PID i , K i ) mod q; to achieve dynamic management of the device, the TA generates a corresponding time key for the device pseudonym. The TA first selects a random number b i and computes the point B i = b i P of the elliptic curve; subsequently, the TA computes the Schnorr signature

[0092] according to a randomly selected valid time period ts. The TA returns to the device through a secure channel;

[0093] Step (3.4), after the DE i receives the response, stores locally and creates a table in the local database to store the pseudonym and the corresponding device status.

[0094] Step (4) of the embodiment, the device DE i and the authentication server AS of other domains complete pre-authentication and obtain the identity token σ i . The specific process is as follows:

[0095] Step (4.1), the DE i selects a random number r i and computes R i ) r i · P, V i = H3(K i , R i , PID i ) · r i + ui and to the authentication server AS of other domains. j (j∈[1,n]) Send a pre-authentication request K i ,R i V i , is an intermediate variable;

[0096] Step (4.2): After receiving the request message, AS j First, verify the validity of T1 by using T-T1 < Δt, where Δt is a preset threshold; then, AS j By verifying the formula The validity of the timestamp T1 is determined by whether the time key ts is valid; once both the timestamp T1 and the time key ts are verified to be valid, AS... j Then proceed to the next step to authenticate the device's identity;

[0097] Step (4.3), AS j Check V i ·P=H3(K i ,R i ,PID i )·R i +K i +H1(PID i ,K i )·mpk A To verify DE, we need to determine whether it holds true. i If the equation holds true, then the device authentication is complete, and the partial token σ is calculated. i,j =s j ·H0(PID i ||ts) and Return message Give the device DE i T2 is the current timestamp;

[0098] Step (4.4), Device DE i Upon receiving the response message, first check the timestamp T2 using T-T2 < Δt. After confirming message freshness, DE... i Calculate part token When the number of collected tokens exceeds the threshold t, DE i Through equations For multiple authentication servers AS j Perform batch verification;

[0099] After certification, DE i Calculate identity token And store it locally for subsequent cross-domain authentication processes, where is the Lagrange multiplier.

[0100] Step (5) device DE i and other domain devices DE j The specific procedure of cross-domain mutual authentication is as follows:

[0101] Step (5.1), DE i selects a random number and calculates R' i = r' i · P, M i = H2(PID i , e(σ i , P), T3), DE i sends a mutual authentication request to the device DE j in domain B

[0102] Step (5.2), device DE j After receiving the request message, first verifies the message freshness and whether the time key ts is valid through the equations T-T3< Δt and , and after verification, DE j calculates M' i = H2(PID i , e(P pub , H0(PID i || ts)), T3), and authenticates DE i by judging whether M i = M' i is true;

[0103] Step (5.3), device DE j selects a random number and calculates R j = r j · P, M j = H1(r j R' i , T4), DE j calculates the session key sk ij = H2(PID i , r j R i ', T4), and returns the response message {M j , R j , T4} to the device DE i ;

[0104] Step (5.4), after receiving the response, DE i first checks the timestamp T4, and after verifying the message freshness, calculates M' j = H1(PID i , r' i Rj , by judging whether M j = M' j is true or not to authenticate the device DE j ; after the authentication is passed, DE i calculates the session key sk ij = H2(PID i , r i , R j , T4), then DE i and DE j complete mutual authentication. In this step, the device uses the token to initiate an authentication request to other devices, realizing infrastructure-free cross-domain authentication and reducing authentication delay. The token contains a time-related key and needs to be updated by TA in time.

[0105] The specific process of identity tracking and revocation of malicious devices in step (6) of the embodiment is as follows:

[0106] Step (6.1), the device DE i sends the corresponding pseudonym PID i to the trusted authority TA through a public channel, and requests to update the time key ts;

[0107] Step (6.2), before updating the time key of PID i , the trusted authority TA first checks the total pseudonym state in the local database, then the TA selects a random number b i and calculates B i = b i P, then calculates the signature for the valid time period ts, and sends the message to the corresponding device;

[0108] Step (6.3), DE i judges the validity of the time key by the equation , and saves it to the local to complete the update;

[0109] Step (6.4), when malicious behavior is found in the devices in the domain, the TA can trace back to the real identity of the device according to the pseudonym PID i and the private key msk through the equation ;

[0110] The TA adds the calculated ID i to the blacklist, stops updating the time key, and updates the corresponding state of PID i in the local database, and completes the revocation of the malicious device.

[0111] Embodiment:

[0112] The embodiment runs on a Windows operating system, the host is equipped with an Intel i7-11700K CPU and 16GB RAM, and the calculation overhead of each operation of the method is shown in Table 2:

[0113] Table 2

[0114]

[0115] In Table 2, OP represents operation, T represents running time, T sm represents a scalar multiplication operation related to an elliptic curve, T mtp represents a map-to-point hash operation, T bp represents a bilinear mapping operation, T exp represents a modular exponentiation operation.

[0116] In terms of communication overhead, since the present application uses a BLS12381 curve with a security level of 128 bits, where and |G| are 48 and 97 bytes respectively, and assuming that the identifier |ID| is 20 bytes. In addition, the present application assumes that the size of the timestamp and the time key are both 4 bytes, denoted by |T|.

[0117] According to the above operations, the actual application calculation and communication overhead results of the technical scheme of the present application are shown in Table 3, which clearly shows that the calculation overhead of the technical method of the present application is very lightweight, and has obvious advantages compared with existing methods.

[0118] Table 3

[0119]

[0120] In addition, the embodiment also considers the impact of setting different thresholds on the device-side calculation overhead when the total number of servers is constant, as shown in Figure 2 where the total number of servers is n = 10, and the threshold t takes values in the range [1, 10]. It can be observed that even when t = 10, i.e. the device needs to interact with all authentication servers, the device only needs about 7.7 ms to generate a valid identity token. The device can use this token to perform multiple identity authentication switches with other domain devices before the token expires, so this scheme can significantly improve efficiency and reduce authentication delay.

Claims

1. An anonymous cross-domain handover authentication method for industrial IoT based on distributed trust, characterized in that, Includes the following steps: Step (1): Initialize the system parameters within each domain, that is, the Trusted Organization (TA) of each domain initializes the system parameters {G1,G2,q,P,e,mpk} within its respective domain. A ,H0,H1,H2,H3}; G1 and G2 are two groups with generators P and prime order q, and H0, H1, H2, and H3 are four hash functions; mpk A =msk A P is the public key of domain A; It is the private key for domain A; Step (2): Set the distributed system master key, that is, the authentication server AS of each domain generates the DKG protocol to negotiate the system master key pair through the distributed key, and establish cross-domain trust without the need to introduce a trusted third party. The specific method is as follows: For the authentication server AS of domain A i Calculate the authentication server AS distributed to other domains j secret share f i (j), and send it to the corresponding AS via a secure channel. j , j∈[1,n],j≠i; AS i Received AS from other domains j Secret share to yourself f j (i) After that, perform validity verification. Once the verification is successful, AS i Calculate its secret share s i As the local private key, the system public key P is ultimately obtained. pub and system private key s; Step (3), the registration phase, involves each device (DE) in its domain registering with the Trusted Authority (TA) within that domain and obtaining a pseudonym and key; the specific method is as follows: Equipment DE i Send TA a message containing their identity ID i The registration request; TA Verification Identifier ID i Whether it is unique, after verification, the trusted organization TA is the device DE. i Computing device pseudonym PID i And the corresponding time key, and then through a secure channel to... Return to device DE i ; Step (4), the pre-authentication phase, where the authentication servers AS of other domains complete the authentication of the device DE in domain A. i Security authentication, and issuance of identity tokens embedded with time keys; Equipment DE i First, after completing authentication, obtain a portion of the tokens and aggregate them to generate an identity token σ. i The specific method is as follows: DE i Authentication Servers (AS) for other domains j Send a pre-authentication request (req) and record the current timestamp (T1); AS j Upon receiving the pre-authentication request, verify the validity of the time and time key. If the verification is successful, calculate a partial token. and some tokens Send the current timestamp T2 to device DE i ; Equipment DE i Upon receipt, first verify the timestamp T2; if verification is successful, then DE... i Calculate the partial token σ i,j When the number of collected tokens exceeds the threshold t, multiple authentication servers AS are targeted. j Perform batch verification; After batch authentication is approved, DE i Calculate and store the identity token σ i ; Step (5), Cross-domain authentication phase, Domain A device DE i Use your own legitimate identity token σ i To Domain B device DE j Send cross-domain authentication request, DE j Verify σ i Validity and negotiate session key sk ij The specific method is as follows: DE in domain A i Device DE in domain B j Send a mutual authentication request (req) and record the current timestamp (T3); Device DE j Upon receiving the request message, first verify the validity of the timestamp T3 and the time key ts. If the verification is successful, DE... j Calculate session key sk ij and return the response message {M j ,R j T4} gives device DE i After receiving the response, DE i The received response is verified. If the verification is successful, mutual authentication is completed and a session key sk is negotiated. ij Used for subsequent data transmission; Step (6): Tracing and revoking the true identity of malicious devices.

2. The anonymous cross-domain handover authentication method for industrial IoT based on distributed trust according to claim 1, characterized in that, The detailed process of step (1) is as follows: Step (1.1): TA in domain A generates two groups G1 and G2 with generator P and prime order q, where G1 is an additive cyclic group and G2 is a multiplicative cyclic group, and determines the bilinear pairing: e: G1×G1→G2; Step (1.2): TA selects a random number. Use it as the private key for domain A, and calculate the corresponding public key mpk. A =msk A P, and choose a secure hash function: Step (1.3), TA public domain system parameters {G1,G2,q,P,e,mpk} A ,H0,H1,H2,H3}, and secretly store msk locally. A .

3. The anonymous cross-domain handover authentication method for industrial IoT based on distributed trust according to claim 1, characterized in that, The specific process of generating the distributed system master key in step (2) is as follows: Step (2.1): Randomly select a polynomial of degree t-1 for each domain's AS. For the authentication server of domain A, the polynomial is f. i (x)=a i,0 +a i,1 x+a i,2 x 2 +...+a i,t-1 x t-1 mod q; in The coefficients are randomly selected, f i (0) = a i,0 As a secret shared with other domains (AS); AS i Calculate the secret share f distributed to other domain authentication servers. i (j) and send it to the corresponding AS via a secure channel. j ;f i (j) is AS i Send to AS via secure channel j The secret share, f j (i) is AS j Send to AS via secure channel i The secret share; Step (2.2), AS i Received AS from other domains j Secret share to yourself f j (i) After that, by judging the equation Whether it is true or false is used to verify the origin of AS. j The validity of the secret share is verified; if valid, proceed to the next steps; otherwise, the sharing is rejected. k This refers to the k-th power of i in the polynomial; Step (2.3), AS i Calculate its secret share s i =Σ j∈CS f j (i) Used as the local private key and the corresponding public key PK i =s i P, where CS is the set of all legitimate nodes participating in the master key generation process of the distributed system; P is expressed by the formula... pub =s i P calculates the system public key, then all authentication servers possess a portion of the secret share of the system private key, as shown by the formula s = ∑ i∈CS a i,0 Reconstruct the system private key s.

4. The anonymous cross-domain handover authentication method for industrial IoT based on distributed trust according to claim 1, characterized in that, The device DE in step (3) i The specific process for registering a local TA within the domain is as follows: Step (3.1), Receive DE i After receiving the registration request, the trusted authority (TA) first checks the ID locally. i Has it already been registered to verify the identifier ID? i Check if it is unique and check it in the blacklist; if it exists, terminate the registration process. Subsequently, the trusted institution TA selects a random number a. i Calculate A i =a i P, PID i =(PID′) i A i ); Step (3.3), the trusted authority TA is the device DE i Select a random number k i And calculate K i =k i P and u i =k i +msk A H1 (PID) i ,K i )mod q; To achieve dynamic management of the device, TA generates a corresponding time key for the device pseudonym. TA first selects a random number b. i And calculate point B of the elliptic curve. i =b i P; Subsequently, TA calculates the Schnorr signature based on the randomly selected valid time period ts. TA will use a secure channel Return to the device; Step (3.4), DE i After receiving the response, store it locally. And create a table in the local database to store the pseudonyms and the corresponding device status.

5. The anonymous cross-domain handover authentication method for industrial IoT based on distributed trust according to claim 1, characterized in that, The device DE in step (4) i Complete pre-authentication with other domain authentication servers (AS) to obtain identity token σ i The specific process is as follows: Step (4.1), DE i Select a random number r i And calculate R i =r i ·P,V i =H3(K i ,R i ,PID i )·r i +u i and to the authentication server AS of other domains. j (j∈[1,n]) Send a pre-authentication request K i ,R i V i , is an intermediate variable; Step (4.2): After receiving the request message, AS j First, verify whether T1 is valid by using T-T1 < Δt, where Δt is a preset threshold. Subsequently, AS j By verifying the formula The validity of the timestamp T1 is determined by whether the time key ts is valid; once both the timestamp T1 and the time key ts are verified to be valid, AS... j Then proceed to the next step to authenticate the device's identity; Step (4.3), AS j Check V i ·P=H3(K i ,R i ,PID i )·R i +K i +H1(PID i ,K i )·mpk A To verify DE, we need to determine whether it holds true. i If the equation holds true, then the device authentication is complete, and the partial token σ is calculated. i,j =s j ·H0(PID i ||ts) and Return message Give the device DE i T2 is the current timestamp; Step (4.4), Device DE i Upon receiving the response message, first check the timestamp T2 using T-T2 < Δt. After confirming message freshness, DE... i Calculate part token When the number of collected tokens exceeds the threshold t, DE i Through equations For multiple authentication servers AS j Perform batch verification; After certification, DE i Calculate identity token And store it locally for subsequent cross-domain authentication processes, where is the Lagrange multiplier.

6. The anonymous cross-domain handover authentication method for industrial IoT based on distributed trust according to claim 1, characterized in that, The device DE in step (5) i Other domain devices DE j The specific process of cross-domain mutual authentication is as follows: Step (5.1), DE i Select random number And calculate R′ i =r′ i ·P,M i =H2(PID) i ,e(σ i ,P),T3),DE i Device DE in domain B j Send mutual authentication request Step (5.2), Equipment DE j After receiving the request message, first use the equation T-T3<Δt and Verify message freshness and the validity of the time key ts. If verification is successful, DE... j Calculate M′ i =H2(PID) i ,e(P pub H0(PID) i ||ts)),T3), and by judging M i =M′ i Is DE certification valid? i ; Step (5.3), Equipment DE j Select random number And calculate R j =r j ·P,M j =H1(r j R′ i ,T4), DE j Calculate session key sk ij =H2(PID) i ,r j R′ i ,T4), and return the response message {M j ,R j T4} gives device DE i ; Step (5.4), after receiving the response, DE i First, check the timestamp T4 to verify message freshness, then calculate M′. j =H1(PID) i ,r′ i R j ,T4), by judging M j =M′ j Is it valid to authenticate the device DE? j After authentication, DE i Calculate session key sk ij =H2(PID) i ,r′ i R j ,T4), then DE i and DE j Complete mutual authentication.

7. The anonymous cross-domain handover authentication method for industrial IoT based on distributed trust according to claim 1, characterized in that, The specific process of tracking and revoking the identity of the malicious device in step (6) is as follows: Step (6.1), Device DE i Send the corresponding pseudonym PID to the trusted institution TA through public channels. i Request an update to the time key ts; Step (6.2), updating the PID i Before obtaining the time key, the trusted authority (TA) first checks the overall pseudonym status in the local database. Then, the TA selects a random number b. i And calculate B i =b i P, followed by a signature calculation for the valid time period ts. TA sends a message Provide to the corresponding equipment; Step (6.3), DE i Through equations Determine the validity of the time key, save it locally, and complete the update; Step (6.4): When malicious behavior is detected in a device within the domain, the TA can use the alias PID. i and the private key msk through the equation Tracing the true identity of the device; TA will calculate the ID i Add to the blacklist, stop updating the time key, and update the PID in the local database. i The corresponding status completes the revocation of the malicious device.

Images