IWSN sensor access authentication protocol method of TCA and PUF

Abstract

The invention discloses an IWSN sensor access authentication protocol method based on TCA and PUF, and provides an IWSN sensor access authentication protocol based on TCA and PUF in order to solve the problem that a sensor is prone to common network attacks and the problem that a complex authentication algorithm is not applicable due to the fact that IWSN sensor resources are limited. The access authentication server performs bidirectional user identity authentication, platform identity authentication and platform integrity verification on the sensor and the gateway to ensure that only the safe and credible sensor can access a reliable network to resist various common network attacks and collusion attacks; according to the invention, platform identity authentication and key negotiation are carried out by using the PUF based on the characteristics of uniqueness and unclonability of the PUF, and secret data is not stored in a memory for resisting physical attacks; in addition, simple encryption and signature calculation are carried out by using a simple XOR algorithm and a Hash algorithm, so that the calculation overhead is ensured to be acceptable by a resource-limited sensor.

Description

Technical Field

[0001] The present invention discloses an IWSN sensor access authentication protocol method based on TCA and PUF in the technical field of trusted computing trusted connection architecture. Background Art

[0002] Industrial Wireless Sensor Networks (IWSNs) are widely used in many fields, providing various real-time monitoring services and control applications. Compared with traditional wired industrial networks, IWSNs show great potential and advantages in terms of infrastructure (no long cables), cost reduction, and convenience of troubleshooting, maintenance, replacement, and upgrading. IWSNs can operate in harsh environments and quickly obtain accurate and reliable results. However, since sensor devices in IWSNs use public channels (i.e., the Internet) to transmit information, they are vulnerable to network attacks such as replay attacks, man-in-the-middle attacks, and impersonation attacks; in addition, sensors are usually deployed in unattended field environments, so they are vulnerable to physical attacks; in addition, sensors in IWSNs are resource-constrained devices, and traditional Internet protection schemes are too complex and therefore not applicable to them. Therefore, it is crucial to design a secure and lightweight protocol to ensure that only secure and trusted sensors can access IWSN to protect environmental data in industrial production processes.

[0003] In order to solve the problem of attackers illegally accessing IWSN and stealing data through network attacks, many researchers have proposed ideas. Most of the current solutions are based on identity authentication schemes based on encryption keys or certificates. When a sensor applies to access the IWSN, it sends identity data or identity certificates encrypted by encryption keys to the gateway. Only after passing the authentication is it allowed to access the network.

[0004] However, the authentication scheme based on encryption keys or certificates ignores the following: 1. Many researchers assume that the gateway is trustworthy and do not defend it. If the gateway is implanted with a virus by an attacker or the attacker disguises it as a gateway device, it may cause the sensor to think that the other party is a legitimate gateway and send the collected data to the attacker or collude with the insiders to allow more illegal sensors to access the network. 2. The attacker can directly physically capture the sensor and obtain the secret data stored in its memory, and then disguise it as a legitimate sensor to access the IWSN.

[0005] Trusted Connection Architecture (TCA) adds two layers to the traditional network access layer to complete the platform identity authentication and platform integrity authentication of the access network to the terminal, thereby meeting the requirements of trustworthiness, integrity and completeness. In addition, it also adds the identity authentication and platform authentication of the terminal to the network, which has higher security. After the terminal applies to access the network, the access network first performs identity authentication and platform authentication on the access terminal. If the measurement results meet the decision made by the policy warehouse, the terminal is considered trustworthy and is allowed to access the network. Otherwise, it will be isolated and repaired.

[0006] A physical unclonable function (PUF) is a one-way hardware security primitive that extracts specific feature data related to a device from the microscopic, unclonable physical randomness generated by factors such as temperature and process limitations during the device manufacturing process. These features are fixed and unclonable, and are unique and stable, so PUF can be used as a hardware fingerprint for authentication. In addition, because PUF is related to the hardware structure, once an attacker uses a probe, its physical structure will be destroyed, so it can be used to resist physical attacks.

[0007] In summary, based on the idea that TCA and PUF can meet the needs of two-way authentication and physical security of sensors in IWSN, the present invention proposes new ideas and thoughts to address the problems existing in the current IWSN sensor access authentication protocol. Therefore, the present invention proposes a secure and lightweight access authentication protocol method for IWSN sensors based on TCA and PUF. Summary of the invention

[0008] In order to resist various network attacks and more powerful collusion attacks and physical attacks encountered during the access authentication process of IWSN sensors, and to solve the problem that the sensor resources in IWSN are limited and cannot perform complex calculations, the present invention proposes a secure and lightweight access authentication protocol method for IWSN sensors based on TCA and PUF. By applying TCA to wireless sensor networks, a trusted third party initiates two-way identity authentication and platform authentication for access devices and IWSNs; at the same time, the key is hidden in the physical structure of PUF instead of in the memory, ensuring that attackers cannot obtain secret data through physical attacks; in addition, encryption or signing is achieved through simple hash calculations or XOR algorithms, reducing the computing overhead of sensors.

[0009] The present invention applies TCA to wireless sensor networks, takes the sensors that need to be accessed as AR, the gateway as AC, and the access authentication server as the trusted third party PM, and proposes a two-way identity authentication protocol. Secondly, in order to resist physical attacks, the sensors and networks of the present invention do not store any secret data, but generate it through PUF during access authentication. The scheme is divided into a registration phase and an access authentication phase. In the registration phase, the sensors and gateways register with the access authentication server respectively, and exchange various secret data through a secure channel for use in the access authentication phase; in the access phase, the PM initiates two-way identity authentication and platform authentication for the AR and AC.

[0010] Registration phase. The sensor selects the stable bit of the SRAM-PUF through the neighbor generation algorithm, and the server selects the challenge C from the stable bit. Then the sensor generates the corresponding response R and other secret data (user, password, platform integrity metric) and sends it to the server. The server calculates the key and auxiliary data through the fuzzy extractor algorithm and returns the auxiliary data and temporary identity ID to the sensor. The gateway also performs the same registration process in this phase.

[0011] SRAM PUF. SRAM PUF uses the unique and unpredictable behavior of SRAM cells when powered on to generate a unique identifier. Its basic principle is that the power-on state of each SRAM cell is microscopically affected by the manufacturing process, making the response of each chip unique. The formula can be expressed as: R = PUF (C).

[0012] Neighbor Generation Algorithm. Not all bits of SRAM PUF are stable, and the neighbor analysis algorithm enhances the reliability of SRAM PUF by selecting the most stable bits. The algorithm assumes that a stable cell is more likely to be surrounded by other stable cells, marks cells as "stable" or "unstable" during the enrollment test, and excludes unstable cells from PUF challenge selection. It then focuses on stable units, assigning higher weights to cells surrounded by more stable neighbors. Cells that exceed a predetermined threshold weight are selected as PUF challenges, ensuring a more reliable and robust PUF response.

[0013] Fuzzy extractor algorithm. Although the most stable bits are selected, the challenge of PUF may still cause slight differences due to noise, voltage, aging, etc. The fuzzy extractor algorithm generates the same key with slightly different responses from the input. It usually consists of two parts: the extractor can extract reliable keys and auxiliary data from the original input data, using the formula: (KEY, HELP DATA) = FE.Gen (input); the constructor can reproduce a reliable key from the help data and input data, using the formula: (KEY) = FE.Rec (input, HELP DATA).

[0014] Authentication phase. The authentication phase includes two-way authentication of the sensor and gateway, platform authentication, and platform integrity verification. PUF is unique and cannot be cloned, so it is regarded as a device fingerprint for platform authentication in the authentication phase. Then, a key is generated through the response of PUF, and the user identity and platform integrity measurement value are encrypted and signed with the key and sent to PM for user authentication and platform integrity verification. After the verification is passed, PM returns the authentication result to the sensor and gateway and updates the virtual identity ID. At this point, the identity authentication and platform authentication in the authentication phase are completed. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a schematic diagram of the overall architecture of the application scenario of the present invention.

[0016] Figure 2 This is a schematic diagram of the protocol transmission in the registration phase of the present invention.

[0017] Figure 3 This is a schematic diagram of the protocol transmission in the authentication phase of the present invention. DETAILED DESCRIPTION

[0018] The present invention will be described in detail below with reference to the specific embodiments shown in the accompanying drawings.

[0019] Figure 1 FIG. 1 is a schematic diagram of the overall architecture of an industrial wireless sensor network based on a trusted connection architecture of the present invention. Figure 1 As shown. Our system model includes three main entities: sensors, gateway nodes, and trusted connection authentication servers. Sensors are devices used in industrial production to collect environmental data and transmit them to gateway nodes. Before accessing the IWSN, it verifies the identity and platform integrity of the gateway to ensure that the data is sent to a trusted gateway node. In order to ensure that only sensors with legitimate identity and integrity can access the IWSN, the gateway is used to authenticate the sensor when it requests access and decide whether to allow it to access the network. The trusted connection authentication server is a trusted third party responsible for the unified authentication and management of sensors and gateways.

[0020] Figure 2 This is a schematic diagram of the protocol transmission during the registration phase, such as Figure 2 shown.

[0021] Before connecting to the IWSN, sensor nodes and gateway nodes must register with the trusted connection authentication server through a secure channel.

[0022] Step 21: The sensor reads its own ID s , and then calculate all stable challenge sets ASC s , and send these two data to the server.

[0023] AR->PM:{ID s ,ASC s}

[0024] Step 22, the server passes ASC s Combine to generate a challenge C s And inform the sensor.

[0025] PM->AR:{C s}

[0026] Step 23, the sensor generates a response using a physical unclonable function: R s =PUF(C s ), and generates its own integrity measurement value: I s =IMC(S), if the common needs user authentication, the sensor requires the user to enter the password PWD and R s , I S and PWD to the server.

[0027] AR->PM:{R s ,I s ,REQ u ,PWD}

[0028] Step 24, the server generates a key and helper data (K s ,HD s )=FE.Gen(R s ), generate a temporary virtual identity SID for the sensor s = hash(K S ||ID s ). Then, if user authentication is required in this scenario, the server generates the user's identity UID. The sensor stores the SID s , CRP s , K s , I s ,UID,PWD,and SID s , HD s , UID is sent to the sensor.

[0029] PM->AR:{SID s ,HD s ,UID}

[0030] In step 25, the sensor stores the received information.

[0031] Figure 3 This is a schematic diagram of the protocol transmission in the authentication phase, such as Figure 3 shown.

[0032] The authentication phase includes node authentication, platform authentication, and platform integrity verification. In the platform authentication part, we use PUF as the unique identifier of the sensor for platform authentication. The response generated by PUF is used for key negotiation. The generated key can help encrypt and decrypt data in the subsequent user authentication and platform integrity verification process.

[0033] Step 31: The sensor sends its temporary virtual identity SID to the gateway. s Apply for access authentication.

[0034] AR->AC:{SID s}

[0035] Step 32: After receiving the information, the gateway sends its own temporary virtual identity {SID s ,SID g}.

[0036] AC->PM:{SID s ,SID g}

[0037] Step 33, after receiving the SID of the sensor and gateway, the server reads their challenge C and key K from the database respectively. It generates two random numbers N1, N2 and the current timestamp T1. Then it encrypts N1 with the key of the sensor: And generate a verification message to prove that the timestamp T1 and the encrypted N1 have not been modified V1 = hash (T1, K s ,N1,SID s ) and use the same algorithm to process Then, the gateway sends the message {T1,C s ,C g ,N1 * ,V1,N2 * ,V2}.

[0038] PM->AC:{T1,C s ,C g ,N1 * ,V1,N2 * ,V2}

[0039] Step 34: When the gateway receives a data packet, it verifies whether the difference between T1 and the current timestamp is less than the threshold ΔT. If the difference between the two timestamps is greater than ΔT, it is considered that a replay attack may have occurred and the data packet is discarded directly. If it is less than ΔT, the verification is passed and the gateway directly generates a PUF response. Obtaining reliable keys using fuzzy extractors The gateway node then decrypts the random number And calculate V2'=hash(T1,K g ,N2,SID g ); if V2' = V2, it proves that N2 is correctly decrypted and the message has not been modified. The gateway will {T1,C s ,N1 * ,V1} is forwarded to the sensor.

[0040] AC->AR:{T1,C s ,C g ,N1 *,V1}

[0041] Step 35, after receiving the data packet, the sensor first obtains the current timestamp T2 and verifies the timestamp to resist replay attacks. Then it decrypts the random number N1 and checks the integrity of the message. After successful decryption, the sensor generates a random number M1 and then encrypts the random number M1: Because R s It is composed of PUF(C s ) is calculated, so only PM and legal sensors can obtain the correct R s and K s Therefore, if the PM can be s Decrypting M1 * To obtain the correct M1, AR is a legitimate sensor. Then calculate the integrity measurement value of the sensor: I s =IMC(S); if user verification is not required, calculate V3 = hash(T2,M1,N1,I s Otherwise, the user needs to enter UID and PWD, and then the sensor calculates V3 = hash (T2, M1, N1, UID, PWD, I s ). This step has three purposes. The first purpose is to complete user authentication by having the user enter their UID and PWD. The second purpose is to use the integrity measurement function to measure key files and codes. If these important data have not been changed or deleted, then I s It will match the data in the registration and pass the platform integrity verification. Therefore, if PM checks V3 without errors, the platform integrity verification and user identity authentication are also successful. Third, the accuracy of the decrypted M1 can be confirmed, and the integrity of the information can also be confirmed to ensure that it has not been tampered with. The sensor then sends {T2, M1 * ,V3}.

[0042] AR->AC:{T2,M1 * ,V3}

[0043] Step 36, after the gateway receives the message sent by the sensor, it first obtains the current timestamp T3 and verifies the timestamp to resist replay attacks. Then it generates a random number M2. Subsequently, the gateway encrypts M2 using the same method as the sensor to obtain the ciphertext M2 * And the integrity verification value V4 of the data. Then the gateway sends the received message and the data generated by itself to the server: {T2,M1 * ,V3,T3,M2 * ,V4}.

[0044] AC->PM:{T2,M1 * ,V3,T2,M2 * ,V4}

[0045] Step 37, the server PM receives the data packet and obtains the current timestamp T4, verifies the timestamp to resist replay attacks, and decrypts M1 and M2: The server then reads the sensor's I s and REQ u To determine whether the sensor requires user authentication. If necessary, calculate V3'=hash(T2,M1,N1,UID,PWD,I s ); otherwise, calculate V3'=hash(T2,M1,N1,UID,PWD,I s ). If V3' is equal to V3, the sensor passes the access authentication. Then, PM reads the gateway's I g And calculate V4'=hash(T3,M2,N2,I g ). If V4' is equal to V4, the gateway passes the access authentication. If both the sensor and the gateway pass the identity authentication, the PM calculates the new temporary virtual identity SID of the sensor s = hash(M1,K s ,SID s ) and the gateway's new temporary virtual identity SID g = hash(M2,K g ,SID g ), and then generate the session key SK = hash (K s ,K g ,N1,N2), and encrypt the session key respectively and generate authentication result RES s = hash(T4,K g ,SK,SUCCESS) and RES g = hash(T4,K s ,SK,SUCCESS). Finally, PM sends {T4,N3 * ,RES s ,N4 * ,RES g}.

[0046] PM->AC:{T4,N3 * ,RES s ,N4 * ,RES g}

[0047] Step 38: After receiving the data packet, the gateway verifies the timestamp to prevent replay attacks and then calculates the session key. RES s '=hash(T4,K g,SK,SUCCESS) and verify RES s 'Is it equal to RES s If yes, the sensor access authentication is successful and the gateway grants the sensor access to the IWSN. The gateway calculates a new temporary virtual identity SID g = hash(M2,K g ,SID g ), then {T4,N4 * ,RES g}. Sent to the sensor.

[0048] AC->AR:{T4,N4 * ,RES g}

[0049] Step 39, after receiving the data packet, the sensor first calculates the verification timestamp to prevent replay attacks, and then calculates the session key RES g '=hash(T4,K s ,SK,SUCCESS) and verify RES' g Is it equal to RES? g , if they are equal, the gateway access authentication is passed and the sensor can access the IWSN. Finally, the sensor calculates a new temporary virtual identity SID s = hash(M1,K s ,SID s ).

[0050] It should be understood that although this specification is described based on implementation methods, not every implementation method contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each implementation method may also be appropriately combined and implemented according to the understanding of those skilled in the art.

[0051] The series of detailed descriptions listed above are only specific descriptions of feasible implementation modes of the present invention. They are not used to limit the protection scope of the present invention. All equivalent implementation modes or changes that do not deviate from the spirit of the invention should be included in the protection scope of the present invention.

Claims

1. A TCA and PUF IWSN sensor access authentication protocol method, characterized by: Design a lightweight access authentication protocol for sensor security in industrial wireless sensor networks (IWSN) environments; By expanding the trusted connection architecture TCA, the sensors in the IWSN are regarded as access requesters AR, the gateways are regarded as access controllers AC, and the access authentication servers are regarded as trusted third parties as policy managers PM. When the sensors apply to access the industrial wireless sensor network, PM performs two-way user authentication, platform authentication and platform integrity verification on the sensors and gateways to ensure that only secure and trusted sensors are connected to the network and that the connected networks are secure. PUF is used to perform platform authentication and negotiate keys by taking advantage of its uniqueness and non-clonability, and secret data is not stored in the memory to resist physical attacks. XOR and hash algorithms are used for encryption and signature calculations to ensure that the computational overhead is acceptable for resource-constrained sensors.

2. According to claim 1, a TCA and PUF IWSN sensor access authentication protocol method is characterized in that: Based on the trusted connection architecture, the physical unclonable function is used as a tool for platform identity authentication and key negotiation. Through the registration stage and the authentication stage, the lightweight, secure and trusted access authentication of sensors in the industrial wireless sensor network is realized. In the registration stage, the sensor and the gateway respectively select the stable bit of the SRAM-PUF through the neighbor generation algorithm, and the server selects the challenge C from the stable bit. Then the sensor generates the corresponding response R and other secret data and sends them to the server. The other secret data includes the user, password, and platform integrity measurement value. The server calculates the key and auxiliary data through the fuzzy extractor algorithm, and returns the auxiliary data and temporary identity ID to the sensor. The authentication stage includes two-way identity authentication of the sensor and the gateway, platform identity authentication and platform integrity verification. PUF is unique and unclonable. In the authentication stage, it is regarded as a device fingerprint for platform identity authentication. Then the key is generated through the response of the PUF, and the user identity and platform integrity measurement value are encrypted and signed with the key and sent to the PM for user identity authentication and platform integrity verification. After the verification is passed, the PM returns the authentication result to the sensor and the gateway and updates the virtual identity ID.

3. The IWSN sensor access authentication protocol method of TCA and PUF according to claim 2 is characterized in that: Registration process; Step 11: The sensor reads its own ID s , and then calculate all stable challenge sets ASC s , and send these two data to the server; Step 12: The server passes ASC s Combine to generate a challenge C s And inform the sensor; Step 13, the sensor generates a response using a physical unclonable function: R s =PUF(C s ), and generates its own integrity measurement value: I s =IMC(S), if the common needs user authentication, the sensor requires the user to enter the password PWD and R s , I S and PWD to the server; Step 14: The server generates a key and helper data (K s ,HD s )=FE.Gen(R s ), generate a temporary virtual identity SID for the sensor s = hash(K S ||ID s ); Then, if user authentication is required for this scenario, the server generates the user's identity UID; the sensor stores the SID s , CRP s , K s , I s ,UID,PWD, and SID s , HD s , UID is sent to the sensor; Step 15, the sensor stores the received information.

4. The IWSN sensor access authentication protocol method of TCA and PUF according to claim 2 is characterized in that: Registration process; Step 21: The sensor sends its temporary virtual identity SID to the gateway. s Apply for access certification; Step 22: After receiving the information, the gateway sends its own temporary virtual identity {SID s ,SID g }; Step 23, after receiving the SIDs of the sensor and gateway, the server reads their challenge C and key K from the database respectively; generates two random numbers N1, N2 and the current timestamp T1; and then encrypts N1 using the sensor's key: And generate a verification message to prove that the timestamp T1 and the encrypted N1 have not been modified V1 = hash (T1, K s ,N1,SID s ), and use the same algorithm to process N2: V2=hash(T1,K g ,N1,SID g ); then, send the message {T1, C s , C g , N1 * , V1, N2 * , V2}; Step 24: When the gateway receives a data packet, it verifies whether the difference between T1 and the current timestamp is less than the threshold ΔT. If the difference between the two timestamps is greater than ΔT, it is considered that a replay attack may have occurred and the data packet is discarded directly. If it is less than ΔT, the verification is successful and the gateway directly generates a PUF response. Obtaining reliable keys using fuzzy extractors The gateway node then decrypts the random number And calculate V2'=hash(T1,K g ,N2,SID g ); if V2'=V2, it proves that N2 is correctly decrypted and the message has not been modified; the gateway will {T1,C s ,N1 * ,V1} is forwarded to the sensor; Step 25, after receiving the data packet, the sensor first obtains the current timestamp T2 and verifies the timestamp to resist replay attacks; Then decrypt the random number N1 and check the integrity of the message; After successful decryption, the sensor generates a random number M1, which is then encrypted: R s By PUF(C s ) calculation, only PM and legal sensors can obtain the correct R s and K s ; If PM is obtained by using the corresponding K s Decrypting M1 * To obtain the correct M1, AR is a legitimate sensor; then calculate the integrity measurement value of the sensor: I s =IMC(S); if user verification is not required, calculate V3 = hash(T2,M1,N1,I s ); Otherwise, the user needs to enter UID and PWD, and then the sensor calculates V3 = hash (T2, M1, N1, UID, PWD, I s ); The sensor then sends {T2,M1 * ,V3}; Step 26, after the gateway receives the message sent by the sensor, it first obtains the current timestamp T3 and verifies the timestamp to resist replay attacks; then it generates a random number M2; The gateway then encrypts M2 using the same method as the sensor to obtain the ciphertext M2 * And the integrity verification value V4 of the data; The gateway then sends the received message and the data it generates to the server: {T2,M1 * ,V3,T3,M2 * ,V4}; Step 27, the server PM receives the data packet and obtains the current timestamp T4, verifies the timestamp to resist replay attacks, and decrypts M1 and M2: The server then reads the sensor's I s and REQ u To determine whether the sensor requires user authentication; if necessary, calculate V3'=hash(T2,M1,N1,UID,PWD,I s ); otherwise, calculate V3'=hash(T2,M1,N1,UID,PWD,I s ); If V3' is equal to V3, the sensor passes the access authentication; then, PM reads the gateway's I from the database g And calculate V4'=hash(T3,M2,N2,I g ); if V4' is equal to V4, the gateway passes the access authentication; if both the sensor and the gateway pass the identity authentication, the PM calculates the new temporary virtual identity SID of the sensor respectively s = hash(M1,K s ,SID s ) and the gateway's new temporary virtual identity SID g = hash(M2,K g ,SID g ), and then generate the session key SK = hash (K s , K g , N1, N2), and encrypt the session key respectively and generate authentication result RES s = hash(T4,K g ,SK,SUCCESS) and RES g = hash(T4,K s ,SK,SUCCESS); finally PM sends {T4, N3 * , RES s , N4 * , RES g }; Step 28: After receiving the data packet, the gateway verifies the timestamp to prevent replay attacks and then calculates the session key. RES s '=hash(T4,K g ,SK,SUCCESS) and verify RES s 'Is it equal to RES s If yes, the sensor access authentication is successful and the gateway grants the sensor access to the IWSN; The gateway calculates a new temporary virtual identity SID g = hash(M2,K g ,SID g ), then {T4, N4 * , RES g };Send to sensor; Step 29, after receiving the data packet, the sensor first calculates the verification timestamp to prevent replay attacks, and then calculates the session key RES g '=hash(T4,K s ,SK,SUCCESS) and verify RES' g Is it equal to RES? g If they are equal, the gateway access authentication is passed and the sensor accesses the IWSN; finally, the sensor calculates a new temporary virtual identity SID s = hash(M1,K s ,SID s ).

Images