Multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication

Abstract

The invention discloses a multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication. The method specifically comprises the following steps: step 1, registering an unmanned aerial vehicle, a roadside unit and a fog node to a cloud server CS; 2, an unmanned aerial vehicle login stage; 3, after the unmanned aerial vehicle logs in, when the unmanned aerial vehicle passes through the responsible area of a certain roadside unit for the first time, the unmanned aerial vehicle starts to carry out authentication communication with the roadside unit in a single-domain scene; 4, when the unmanned aerial vehicle is about to move into the area where the next roadside unit # imgabs0 # is located, the roadside unit where the unmanned aerial vehicle is located currently sends the false identity of the unmanned aerial vehicle to # imgabs1 #, if the unmanned aerial vehicle communicates with # imgabs2 # for the first time, a data request is entered, # imgabs3 # requests private data of the unmanned aerial vehicle from the CS, then the step 5 is executed, and otherwise, the step 5 is executed directly; and step 5, performing cross-regional authentication on the unmanned aerial vehicle and # imgabs4 #.

Description

Technical Field

[0001] The present invention belongs to the field of communication security technology, and in particular relates to a multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication. Background Art

[0002] The low-altitude economy is developing rapidly, and all parties are making more and more full use of low-altitude airspace. The demand for communication exists not only between drones and ground control systems, but also between unmanned aerial vehicles, between users and aircraft, etc. Since the low-altitude economy is usually in an exposed and open environment, it often needs to cross domains. Whether it is physical attack or virtual network attack, it is relatively easy to cause economic losses and security problems. Therefore, it is extremely necessary to establish an authentication and key negotiation mechanism during communication to protect privacy and property security.

[0003] Existing technical solutions only consider the communication between drones and edge servers, usually using smart card information collection methods, using PUF-based authentication methods to authenticate single and multiple verifiers, or for the sake of portability, only the node (cloud server) sends the materials required for session authentication to the drone, and then continues to use the materials between drone sessions. These methods can meet some security requirements, but are easy to crack, and do not consider the communication needs between drones and edge nodes, drones, and users at the same time, as well as the cross-domain situations between them. When multiple entities authenticate each other, a single node being attacked will cause the entire system to fail to complete the task correctly, and the repeated authentication of some entities across domains will increase the amount of calculation and bring secondary attacks. Summary of the invention

[0004] Purpose of the invention: In order to solve the problems existing in the above-mentioned prior art, the present invention provides a multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication.

[0005] Technical solution: The present invention provides a multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication, which is specifically:

[0006] Step 1: Align the drone , roadside unit and fog nodes Register with the cloud server CS;

[0007] Step 2: Drone login stage;

[0008] Step 3: After the drone logs in, when it passes through the responsible area of ​​a roadside unit for the first time, the drone begins to authenticate and communicate with the roadside unit in a single-domain scenario; and the roadside unit is recorded as ;

[0009] Step 4: When the drone is about to move to the next roadside unit When in the area of ​​responsibility, Send the drone's pseudo-identity to If the drone is first connected to Communication, then enter the data request, Request the drone's private data from CS, then go to step 5, otherwise go directly to step 5;

[0010] Step 5: Regulate the drone and Conduct cross-region authentication.

[0011] Beneficial effects: In the new low-altitude economic scenario, the present invention provides security for the cross-domain communication needs frequently encountered by drones, adopts cloud and fog nodes to reduce the computing pressure of a single cloud node, considers dynamic allocation of fog node memory, and makes full use of computing resources. The present invention adopts multi-factor authentication, taking into account the communication needs of drones with edge nodes, drones, and users at the same time as well as cross-domain situations, increases the security of authentication, and avoids repeated authentication between multiple entities; the present invention applies hardware SGX to the space drone communication environment to improve the security of the protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 This is a system authentication scenario diagram of the present invention. DETAILED DESCRIPTION

[0013] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0014] The multi-entity cross-domain authentication scenario diagram of the present invention is as follows Figure 1 As shown in the figure, the system model includes five entities: roadside unit, user, drone, cloud node and fog node.

[0015] The multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication of the present invention constructs a system model including five entities: roadside unit, user, drone, cloud node and fog node; it includes a drone registration stage, a roadside unit (RSU) registration stage, a user registration stage, a fog node registration stage, a login and authentication stage, a notification stage, a data request stage and a cross-domain authentication stage.

[0016] The drone registration phase includes the following steps:

[0017] Step 1.1: First Drone Select Identity , Password , biometrics and random numbers , using the fuzzy extractor's generator function to extract randomly distributed strings from biometric features and public helper strings ; Finally, the identity Transmitted to the CS (Cloud Serve) cloud server through a secure channel.

[0018] Step 1.2: After receiving the message, CS selects a random number , calculate the pseudo-identity of the drone and drones’ private data ,Will It is saved in the database and finally transmitted to the corresponding drone through a secure channel. h(.) represents the hash function. It is the long-term key of CS.

[0019] Step 1.3: After receiving the message, the drone calculates , , , It is a summary of information and is used to verify the integrity and correctness of identity information when logging in. is the ciphertext after the password is encrypted. To encrypt the drone's private data, Indicates XOR operation; the drone will Stored in the onboard unit OBU.

[0020] The roadside unit registration phase includes the following steps:

[0021] Step 2.1: jth roadside unit Select Identity and random numbers , and Sent to CS via a secure channel.

[0022] Step 2.2: After receiving the message, CS selects a random number , calculate the pseudo-identity of the roadside unit and private data Will{ Save in the database, CS will { } is sent to the corresponding roadside unit, and { , , }Sent to all fog nodes.

[0023] Step 2.3: The roadside unit stores the received message in memory.

[0024] Step 2.4: After receiving the message, the fog node Save to the database, and , }Save to the software protection extension module SGX.

[0025] The fog node registration phase includes the following steps:

[0026] Step 3.1: Take the mth fog node For example, the fog node selects identity , random numbers And send the identity and random number to CS through a secure channel.

[0027] Step 3.2: After receiving the message, CS selects a random number , calculate the pseudo identity of the fog node and private data ,Will Save in the database, { , }Transmitted to fog nodes through secure channels;

[0028] Step 3.3: The fog node stores the received message in the database.

[0029] The login and authentication phase includes the following steps:

[0030] During the login phase, the user first enters the drone’s identity, password, and scanned biometrics. The drone then calculates a new string using the fuzzy extractor’s regeneration function based on the user’s biometrics. , the user inputs the drone's identity, password, biometrics, and Substitute into In the calculation formula, we get ,verify and Are they equal? ​​If they are equal, the login is successful, otherwise the login fails.

[0031] UAV in single domain scenario and a roadside unit The process of achieving authentication is as follows:

[0032] Step 4.1: After successful login, Select random number and timestamp , the drone calculates its own private data based on the random number using the following formula , , and :

[0033] = h( || )

[0034] =( || )

[0035] =h( || )

[0036] =h( || || || )

[0037] in, is the value obtained by encrypting the drone identity, pseudo identity, and private data using random numbers. is the encrypted value of the drone’s pseudo identity and private data. For drones and roadside units Parameters used by the fog node to authenticate the drone during the authentication process.

[0038] Drones will As data Send to roadside unit .

[0039] Step 4.2: Verify after receiving the message The freshness of the timestamp in the data (in this embodiment, the freshness of the timestamp is verified by calculating the absolute value of the difference between the time when the data is received and the timestamp in the data. If the absolute value of the difference is greater than or equal to the preset time threshold, the verification fails). If the verification fails, the authentication is terminated, otherwise the authentication continues. pass Retrieve the private data stored in SGX. If it is not retrieved, it means that the drone is Is the first communication or data In was tampered with by the attack; if not retrieved, Send a data request to CS, requesting private data about the drone, and then go to step 4.3; otherwise, it means that there has been communication, and go to step 4.3; for Received The value of .

[0040] Step 4.3: Select random number and timestamp ,calculate , and :

[0041]

[0042]

[0043] =h( || || || )

[0044] in, For roadside units Private data and false identities The encrypted value, The value obtained by encrypting the private data and pseudo-identity of the roadside unit with a random number; For drones and roadside units Used by fog nodes to authenticate

[0045] Parameters for roadside unit verification, Will As data Sent to the corresponding fog node, where Received by roadside units The value of Received by roadside units The value of Received by roadside units The value of .

[0046] Step 4.4: Fog node verifies after receiving data The freshness of the timestamp in the time stamp. If the verification fails, the authentication is terminated. Otherwise, the pseudo-identity of the drone received is used. Matching drone private data If no match is found, the authentication is terminated. If a match is found, the identity of the drone is deduced based on the private data of the matched drone. and the random number chosen by the drone :

[0047] ( ) =

[0048]

[0049] in, For and The encrypted value, Indicates the fog node receives The value of .

[0050] Calculation parameters :

[0051]

[0052] in, Received by fog nodes Value, if and If they are equal, it means that the data in M1 and M2 have not been attacked, and authentication continues; otherwise, authentication is terminated; Received by fog nodes The value of .

[0053] The fog node receives the roadside unit Fake identity , matching roadside units Identity and private data If no match is found, the authentication is terminated, otherwise the roadside unit is derived Random number selected and parameters :

[0054]

[0055] =h( || || || )

[0056] in, Received by fog nodes The value of For the general and Substitute into the calculation The value obtained after the formula is Received by fog nodes The value of .

[0057] like and If they are equal, continue authentication and go to step 4.5; otherwise, terminate authentication. Received by fog nodes The value of .

[0058] Step 4.5: Fog node selects timestamp , calculate the parameters used by the roadside unit to authenticate the fog node during the drone and roadside unit authentication process :

[0059]

[0060]

[0061] in, The value is the combination of the drone identity and the roadside unit identity and the encrypted random number; the fog node sends the data As data Send to roadside unit .

[0062] Step 4.6: Verify after receiving data The freshness of the timestamp in the message. If the verification fails, the authentication is terminated. Otherwise, The identity of the drone is derived using the following formula and the random number chosen by the drone , and calculate the session key for the roadside unit to conduct a session with the drone :

[0063]

[0064]

[0065] in, for Received The value of .

[0066] Calculate the parameters according to the following formula :

[0067]

[0068] like and If they are equal, authentication continues; otherwise, authentication is terminated. Received for roadside units The value of Received for roadside units The value of .

[0069] Select Timestamp , calculate the parameters used by the drone to authenticate the roadside unit during the drone and roadside unit authentication process :

[0070]

[0071]

[0072] in, for and Combined with the encrypted value of the random number; The data As data Send to drone.

[0073] Step 4.7: Verify after receiving the data If the verification fails, the authentication is terminated. Otherwise, the drone uses the following formula to deduce the identity of the roadside unit. , a random number selected by the roadside unit and the session key for the drone to speak to the roadside unit :

[0074]

[0075]

[0076] in, Received for drone The value of .

[0077] Calculation parameters :

[0078]

[0079] in, Received for drone The value of .

[0080] like and If they are equal, then the drone and Complete mutual authentication and establish session keys, otherwise terminate authentication; Received for drone The value of .

[0081] In step 4.2 Sending data request to CS to request private data about drones includes three entities: roadside unit , CS and fog nodes; this stage is specifically as follows:

[0082] Step A: Generate request data , choose a random number and timestamp , and calculate the roadside unit identity and private data combined with the random number encrypted value and the parameters used in step 3.4 for CS to verify with the roadside unit :

[0083]

[0084]

[0085] Will As data Sent to CS.

[0086] Step B: CS receives data and verifies it The freshness of the timestamp in the CS. If the verification fails, the authentication is terminated. Otherwise, the CS receives the Fake identity Match the corresponding identity If no match is found, it indicates that the data If attacked, the authentication is terminated. Private data and random numbers Perform deduction to obtain the derived private data and random numbers :

[0087]

[0088] )

[0089] Calculation parameters :

[0090]

[0091] If and If they are equal, go to step C, otherwise terminate the authentication; Received for CS The value of Received for CS The value of .

[0092] Step C: CS selects timestamp and ,use Private data about drones Encrypt through symmetric encryption to obtain encrypted data , calculate the parameters for the roadside unit to verify with the CS :

[0093]

[0094]

[0095] in, Indicates the use of Perform encryption operations.

[0096] CS receives the pseudo-identity of the fog node Match the identity of the fog node , calculate the private data of fog nodes ,use right Encrypted by symmetric encryption technology to obtain encrypted data , the calculation fog node verifies the parameters to the CS :

[0097]

[0098]

[0099] in, Indicates the use of Perform encryption operations.

[0100] CS will As data Send to roadside unit ,Will It is sent to the fog node as data M7.

[0101] Step D: Verify after receiving data The freshness of the timestamp in the calculation. If the verification fails, the authentication is terminated. Otherwise, the calculation parameter :

[0102]

[0103] in, for Received The value of for Received The value of .

[0104] like and If they are not equal, the authentication is terminated. If they are equal, it indicates Not attacked, that is ,right Decrypt and obtain the decrypted private data of the drone. Will Stored in SGX. for Received The value of .

[0105] After receiving the data, the fog node verifies The freshness of the timestamp in the calculation. If the verification fails, the authentication is terminated. Otherwise, the calculation parameter :

[0106]

[0107] in, Received by fog nodes The value of The fog node receives The value of .

[0108] like and If they are not equal, the authentication is terminated. If they are equal, Decryption is performed to obtain the private data of the drone after decryption. The fog node will Stored in SGX; Received by fog nodes The value of .

[0109] The data request phase is a cross-domain data request phase, which includes the following steps:

[0110] Step 5.1: First generate the data request , choose a random number and timestamp In the calculation data request phase, the fog node sends Parameters for verification :

[0111]

[0112]

[0113] in, To use a random number and timestamp Identity and private data The encrypted value, Will{ } as data Sent to fog nodes.

[0114] Step 5.2: After receiving the message, the fog node verifies The freshness of the timestamp in the fog node. If the verification fails, the authentication is terminated. Otherwise, the fog node will Fake identity Match to Identity , and found in SGX Private data , and then derive the random number according to the following formula:

[0115]

[0116] in, is the derived random number, Received by fog nodes The value of

[0117] Calculation parameters :

[0118]

[0119] in, Received by fog nodes The value of .

[0120] like and If they are equal, authentication continues; otherwise, authentication is terminated. Received by fog nodes The value of .

[0121] Fog node selection timestamp , the fog node receives the pseudo-identity of the drone Find the same in SGX The corresponding drone’s private data , and Encrypt and get the encrypted data , and calculate the data request phase Parameters for verifying the fog node :

[0122]

[0123]

[0124] in, Indicates the use of Perform encryption operations.

[0125] The fog node will As data Send to .

[0126] Step 5.3: Verify after receiving the message The freshness of the timestamp in the code. If the verification fails, the verification is terminated, otherwise the code is decrypted. , and calculate the parameters :

[0127]

[0128] in, for Received The value of for Received The value of .

[0129] like and If they are equal, the authentication is successful. right Decryption is performed to obtain the drone's private data. Successful authentication indicates that the data has not been tampered with. Decrypted drone private data and drone's original private data The same, otherwise the certification is terminated; for Received The value of .

[0130] The notification phase includes the following steps:

[0131] In drones and During the communication process, you will be informed You will move to In area 2, Will inform in advance , Will pass The pseudo-identity of the drone sent is used to determine whether the drone has communicated with itself before. If it is the first communication, it enters the cross-domain data request phase and requests the private data of the drone from the fog node. If there has been communication, the drone enters the area and communicates with the fog node. During communication, skip the data request phase and directly enter the cross-domain authentication phase.

[0132] Step 6.1: First generate the request data , select Timestamp , calculation is used to notify the fog node to the roadside unit Verify parameters :

[0133]

[0134] Will As data Sent to fog nodes.

[0135] Step 6.2: Fog node verifies after receiving data The freshness of the timestamp in the fog node. If the verification fails, the authentication is terminated. Otherwise, according to the roadside unit received by the fog node Fake identity match Identity , calculation parameters :

[0136] in, Received by fog nodes The value of .

[0137] like and If they are equal, the fog node selects the timestamp , and based on the roadside units received Fake identity match Identity , calculated for the notification phase Parameters for verifying the fog node , otherwise the authentication is terminated; Received by fog nodes Values:

[0138]

[0139] The fog node will As data , send to ; Request data received by the fog node , Received by fog nodes .

[0140] Step 6.3: After receiving the data The freshness of the timestamp in the time stamp. If the verification fails, the authentication is terminated. Otherwise, the parameters are calculated by the following formula :

[0141]

[0142] in, for Received timestamp If the value of and If they are not equal, the authentication is terminated. Otherwise, Retrieve the drone's private data based on the received drone's pseudo-identity. If the data is not retrieved, it is considered the first communication. Received by fog nodes The value of .

[0143] The cross-domain authentication phase includes the following steps:

[0144] Step 7.1: Drone selects random number and timestamp , computing cross-domain authentication phase Parameters for verifying the drone :

[0145]

[0146]

[0147]

[0148] in, To detect drone fake identities, drone private data and Fake identity The encrypted value, To adopt and random numbers UAV After the encrypted value, the drone will As data Send to ;

[0149] Step 7.2: After receiving the data, verify the data The freshness of the timestamp in the authentication process. If the authentication fails, the authentication process is terminated. Otherwise, The random number selected by the drone in step 7.1 is calculated according to the following formula:

[0150]

[0151] in, is the random number selected by the drone in step 7.1, for The identity of the received drone; for Received The value of For Received drone pseudo-identity , drone private data and Fake identity The encrypted value, The expression is:

[0152]

[0153] The parameters are calculated by the following formula :

[0154]

[0155] in, for Timestamp received;

[0156] judge and Are they equal? ​​If not, terminate the authentication, otherwise go to step 7.3; for Received The value of

[0157] Step 7.3: Select random number and timestamp , and calculate the cross-domain authentication phase for the drone to Authentication parameters as well as The key to initiate a call to the drone :

[0158]

[0159]

[0160] in, , To use random numbers and right Identity The encrypted value, Will As data Send to drone;

[0161] Step 7.4: After the drone receives the data, verify The freshness of the timestamp in the time stamp. If the verification fails, the authentication is terminated. Otherwise, the drone calculates the freshness of the timestamp through the following formula. Random numbers selected:

[0162]

[0163] in, For the calculated The random number selected, Received for drone identity, Received for drone The value of

[0164] Calculate the parameters according to the following formula and drones Key for initiating a call

[0165]

[0166]

[0167] in, Timestamp received by the drone If and If they are equal, the certification is passed, and the drone and Complete mutual authentication and establish session keys, otherwise terminate authentication.

[0168] During the user registration phase, users only need to register with the cloud node once. After authentication with the cloud node, the cloud node authenticates the drone. The initial communication between the user and the drone is completed through the cloud and fog nodes. After that, the user participates in the entire system communication as part of the drone without the need for separate communication.

[0169] Considering that a single fog node has a large amount of computational complexity in processing all requests at once, this embodiment adopts a load balancing algorithm. The communication sender searches for the three nearest fog nodes and distributes the workload in real time according to the remaining memory and computing power to reduce the computational pressure of a single fog node.

[0170] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present invention will not further describe various possible combinations.

Claims

1. A multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication, characterized in that: The method is as follows: Step 1: Align the drone , roadside unit and fog nodes Register with the cloud server CS; Step 2: Drone login stage; Step 3: After the drone logs in, when it passes through the responsible area of ​​a roadside unit for the first time, the drone begins to communicate with the roadside unit for authentication in a single-domain scenario; The roadside unit is recorded as ; Step 4: When the drone is about to move to the next roadside unit When in the area of ​​responsibility, Send the drone's pseudo-identity to If the drone is first connected to Communication, then enter the data request, Request the drone's private data from CS, then go to step 5, otherwise go directly to step 5; Step 5: Regulate the drone and Conduct cross-region authentication.

2. The multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication according to claim 1 is characterized in that: The specific stages of drone registration are: Drones Generate Identity , password , biometrics and random numbers , using the fuzzy extractor's generator function to extract randomly distributed strings from biometric features , and generate a public auxiliary string , and then the identity Transmit to CS via secure channel; CS receives the drone's identity After that, select a random number , calculate the pseudo-identity of the drone and private data ; and The data is stored in the database and transmitted to the drone through a secure channel; Drone received After that, the summary information is calculated according to the following formula , and encrypt its own private data to obtain encrypted data : ； ； in, represents the XOR operation, is the ciphertext after the password is encrypted. , h(·) represents the hash function, and then Stored in the onboard unit OBU; Roadside unit registration is specifically: Roadside unit Select Identity and random numbers ; and Send to CS via secure channel; CS received Then select a random number , calculate the pseudo-identity of the roadside unit and private data ; CS will Stored in the database and Send to ,Will Send to all fog nodes; Will Stored in memory, fog nodes will Save in the database Stored in the software protection extension module SGX; The specific registration of fog nodes is as follows: Fog nodes select identities and random numbers , and Send to CS via secure channel; After receiving the message, CS selects a random number , calculate the pseudo identity of the fog node and private data ;Will Save in the database Transmitted to fog nodes through secure channels; The fog nodes save the received data in the database.

3. The multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication according to claim 2 is characterized in that: The expressions of the pseudo-identity and private data of the drone are as follows: ； ； in, It is the long-term key of CS; The expressions for the pseudo-identity and private data of the roadside unit are as follows: ； ； The expressions of the pseudo identity and private data of the fog node are as follows: ； 。 4. The multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication according to claim 2 is characterized in that: The drone login authentication is specifically as follows: the user logs in to the drone, enters the drone's identity, password, and biometrics, and the drone calculates a new string using the regeneration function of the fuzzy extractor based on the biometrics entered by the user , the user inputs the drone's identity, password, biometrics, and Substitute into In the calculation formula, we get ,verify and Are they equal? ​​If they are equal, the login is successful, otherwise the login fails.

5. The multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication according to claim 2 is characterized in that: The step 3 is specifically as follows: Step 3.1: After the drone successfully logs in, a random number is generated and timestamp The drone uses the following formula to calculate its own private data based on the random number: : ； Step 3.2: Calculate the parameters used by the fog node to authenticate the drone in step 3 : ； in, , , is the value obtained by encrypting the drone identity, pseudo identity and private data using random numbers. is the encrypted value of the drone’s pseudo identity and private data; the drone will As data Send to curbside ; Step 3.3: Verify after receiving data If the verification fails, the authentication is terminated, otherwise go to step 3.4, the freshness of the timestamp verification is: calculate the absolute value of the difference between the time when the data is received and the timestamp in the data, if the absolute value of the difference is greater than or equal to the preset time threshold, the verification fails; Step 3.4: According to the pseudo-identity of the drone received Retrieve in SGX If the corresponding private data is not retrieved, Send a data request to CS to request private data about the drone, and then go to step 3.5 to continue authentication. If it can be retrieved, go directly to step 3.5 to continue authentication; Step 3.5: Select random number and timestamp Calculate the parameters used by the fog node to verify the roadside unit in step 3 : ； in, , , For roadside units Private data and fake identities The encrypted value, The value obtained by encrypting the private data and pseudo-identity of the roadside unit with a random number; for identity, then Will As data Sent to the corresponding fog node; Received by roadside units The value of Received by roadside units The value of Received by roadside units The value of Step 3.6: Fog node verifies after receiving data The freshness of the timestamp in the time stamp. If the verification fails, the authentication is terminated. Otherwise, the pseudo-identity of the drone received is used. Matching drone private data If no match is found, the authentication is terminated. If a match is found, the identity of the drone is deduced based on the private data of the matched drone. and the random number chosen by the drone : ； in, For and The encrypted value, , Indicates the fog node receives The value of Will , , as well as Substitute into the calculation The verification parameter is obtained from the formula ,like and If they are equal, continue authentication and go to step 3.7; otherwise, terminate authentication; Received by fog nodes The value of Received by fog nodes The value of Step 3.7: The fog node receives the roadside unit Pseudo-identity , matching roadside units Identity and private data If no match is found, the authentication is terminated, otherwise the roadside unit is derived Random number selected : ； in, Received by fog nodes The value of For the general and Substitute into the calculation The value obtained after the formula; Will , , as well as Substitute into the calculation The verification parameter is obtained from the formula ,like and If they are equal, continue authentication and go to step 3.8, otherwise terminate authentication; Received by fog nodes The value of Received by fog nodes The value of Step 3.8: Fog node selects timestamp , calculate the parameters used by the roadside unit to verify the fog node in step 3 : ； in, The value is the encrypted value of the drone identity and the roadside unit identity combined with the random number. , the fog node will As data Send to roadside unit ; Step 3.9: Verify after receiving data The freshness of the timestamp in the , , as well as Substitute into the calculation In the formula, we get the parameter ; Received for roadside units The value of Received by roadside units The value of like and If they are equal, continue authentication. The identity of the drone is derived using the following formula and the random number chosen by the drone , and calculate the session key for the roadside unit to initiate a session with the drone , otherwise the authentication is terminated: ； Step 3.10: Select Timestamp , calculate the parameters used for the drone to verify with the roadside unit in step 3 : ； in, for and Combined with the encrypted value of the random number, ; The data As data Send to drone; Step 3.11: Verify after receiving the data If the verification fails, the authentication is terminated. Otherwise, the drone uses the following formula to deduce the identity of the roadside unit. , a random number selected by the roadside unit and the session key for the drone to initiate a session with the roadside unit : ； ； in, Received for drone The value of Will , , as well as Substitute into the calculation In the formula, we get the parameter ,like and If the drone and Complete mutual authentication and establish session keys, otherwise terminate authentication; Received for drone The value of Received for drone The value of .

6. The multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication according to claim 5 is characterized in that: The private data requested about the drone in step 3.4 is specifically: Step A: Generate request data , choose a random number and timestamp , and calculate the roadside unit identity and private data combined with the random number encrypted value and the parameters used in step 3.4 for CS to verify with the roadside unit : ； ； Will As data Send to CS; Step B: CS receives data and verifies it If the verification fails, the authentication is terminated. Otherwise, CS will Pseudo-identity Match the corresponding identity If no match is found, it indicates that the data If attacked, the authentication is terminated. If a match is found, Private data and random numbers Perform deduction to obtain the derived private data and random numbers : ； ； in, Received for CS The value of It is the long-term key of CS; Will , , and Substitute into the calculation In the formula, we get the parameter ;if and If they are equal, go to step C, otherwise terminate the authentication; Received for CS The value of Received for CS The value of Step C: CS selects timestamp and ,use Private data about drones Encrypt through symmetric encryption to obtain encrypted data , calculate the parameters for the roadside unit to verify with the CS in step 3.4 : ； CS receives the pseudo-identity of the fog node Match the identity of the fog node , calculate the private data of fog nodes ,use right Encrypted by symmetric encryption technology to obtain encrypted data , calculation step 3.4 fog node verifies the parameters to CS : ； CS will As data Send to roadside unit ,Will As data Send to fog nodes; Step D: Verify after receiving data The freshness of the timestamp in the message. If the verification fails, the authentication is terminated. Otherwise, , , as well as Substitute into the calculation In the formula, we get the parameter ,like and If they are not equal, the authentication is terminated. If they are equal, Decryption is performed to obtain the decrypted private data of the drone; wherein, for Received The value of for Received The value of for Received The value of Step E: Fog nodes verify after receiving data The freshness of the timestamp in the time stamp. If the verification fails, the authentication is terminated. Otherwise, , , as well as Substitute into the calculation In the formula, we get the parameter ,like and If they are not equal, the authentication is terminated. If they are equal, Decrypt and obtain the decrypted private data of the drone; Received by fog nodes The value of Received by fog nodes The value of Received by fog nodes The value of .

7. The multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication according to claim 2, characterized in that: In step 4, the following steps are used to determine whether the drone is Is this the first communication? Step 4.1: First generate the request data , select Timestamp , calculate the fog node to the roadside unit for step 4 Parameters for verification : ； Will As data Send to fog nodes; for False identity; for False identity; Step 4.2: Fog node verifies after receiving data The freshness of the timestamp in the fog node. If the verification fails, the authentication is terminated. Otherwise, according to the roadside unit received by the fog node Pseudo-identity match Identity , the freshness of the verification timestamp is to calculate the absolute value of the difference between the time when the data is received and the timestamp in the data. If the absolute value of the difference is greater than or equal to the preset time threshold, the verification fails; , as well as Substitute into the calculation In the formula, we get the parameter ; Received by fog nodes The value of like and If they are equal, the fog node selects the timestamp , and based on the roadside units received Pseudo-identity match Identity , calculated for step 4 Parameters for verifying the fog node , Received by fog nodes otherwise, the authentication is terminated; ； The fog node will As data , send to ; Request data received by the fog node , Received by fog nodes The value of Step 4.3: Verify after receiving data The freshness of the timestamp in the time stamp. If the verification fails, the authentication is terminated. Otherwise, the parameters are calculated by the following formula : ； in, for Received timestamp The value of for identity, if and If they are not equal, the authentication is terminated. Otherwise, The private data of the drone is retrieved based on the pseudo-identity of the drone received. If it is not retrieved, it is considered as the first communication. Received by fog nodes The value of .

8. The multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication according to claim 2, characterized in that: The data request in step 4 is specifically: Step a: First generate the data request , choose a random number and timestamp Then calculate the data request phase in step 4. Parameters for verification : ； in, To use a random number and timestamp Identity and private data The encrypted value, ; Will As data Send to fog node; Step b: Fog nodes verify after receiving data The freshness of the timestamp in the fog node. If the verification fails, the authentication is terminated. Otherwise, the fog node will Pseudo-identity Match to Identity , and found in SGX Private data , and then derive the random number according to the following formula ,get , the freshness of the verification timestamp is to calculate the absolute value of the difference between the time when the data is received and the timestamp in the data. If the absolute value of the difference is greater than or equal to the preset time threshold, the verification fails: ； in, Received by fog nodes The value of , , as well as Substitute into the calculation In the formula, we get the parameter ,like and If they are equal, go to step c, otherwise terminate the authentication; Received by fog nodes The value of Received by fog nodes The value of Step c: Fog node selects timestamp , the fog node receives the pseudo-identity of the drone Find the same in SGX The corresponding drone’s private data , and Encrypt and get the encrypted data , and calculate the data request phase in step 4 Parameters for verifying the fog node : ； The fog node will As data Send to ; Step d: Verify after receiving data The freshness of the timestamp in the , , and Substitute into the calculation In the formula, we get the parameter ;like and If they are equal, the authentication is successful. right Decryption is performed to obtain the drone's private data, otherwise the authentication is terminated; for Received The value of for Received The value of for Received The value of .

9. The multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication according to claim 8, characterized in that: Use in step c right Encryption is performed.

10. The multi-entity cross-domain key negotiation and authentication method based on multi-factor authentication according to claim 2, characterized in that: The authentication phase of step 5 is specifically as follows: Step 5.1: Drone selects random number and timestamp , calculated for step 5 Verification parameters for verification to the drone : ； in, , , To detect drone fake identities, drone private data and Fake identity The encrypted value, To adopt and random numbers Drone Identity After the encrypted value, the drone will As data Send to ; Step 5.2: Verify data after receiving it The freshness of the timestamp in the message. If the verification fails, the authentication is terminated. Otherwise, The random number selected by the drone in step 5.1 is calculated according to the following formula. The freshness of the verification timestamp is calculated by calculating the absolute value of the difference between the time when the data is received and the timestamp in the data. If the absolute value of the difference is greater than or equal to the preset time threshold, the verification fails. ； in, is the random number selected by the drone in step 5.1, for The identity of the received drone; for Received The value of For Received drone pseudo-identity , drone private data and Pseudo-identity The encrypted value, The expression is: ； The parameters are calculated by the following formula : ； in, for Received The value of judge and Are they equal? ​​If not, terminate the authentication, otherwise go to step 5.3; for Received The value of Step 5.3: Select random number and timestamp , and calculate the step 5 stage for the drone to Authentication parameters as well as The key to initiate a call to the drone : ； ； in, , To use random numbers and right Identity The encrypted value, Will As data Send to drone; Step 5.4 The drone verifies after receiving the data If the verification fails, the authentication is terminated. Otherwise, the drone calculates the freshness of the timestamp using the following formula Random numbers selected: ； in, For the calculated The random number selected, Received for drone identity, Received for drone The value of Calculate the parameters according to the following formula and drones The key for initiating a session : ； ； in, Timestamp received by the drone If and If they are equal, the authentication is successful and the session key is established; otherwise, the authentication is terminated. Received for drone The value of .

Images