Communication information security management system and method for computing resource perception scenarios

Abstract

The present invention discloses a communication information security management system and method for computing power resource perception scenarios, which relates to the field of computing power perception and multi-node communication security technology. The present invention first establishes a computing power perception center, constructs a finite field, generates an elliptic curve and an Abelian group, generates the center's private key, public key, secret value and secret factor and makes them public; one or more nodes send information containing identity identification and timestamps to the center, and the center verifies the timestamp and assigns a secret value to the node, and calculates the broadcast message fragment; after receiving the broadcast message fragment, the node calculates the shared secret value, encrypts the resource information, generates a pseudonym, summary, signature, etc. and sends them to the center, and the center verifies the information and decrypts the message; when the node changes, the center calculates a new broadcast message according to the node status, updates the local storage and publishes it, thereby realizing a dynamic response to the node status change. This method improves the efficiency of multi-node authentication and the scalability of the system, and ensures the security and privacy of information transmission.

Description

Technical Field

[0001] The present invention relates to the field of computing power perception and multi-node communication security technology, and specifically to a communication information security management system and method for computing power resource perception scenarios. Background Art

[0002] The present invention belongs to the field of computing power perception and multi-node communication security technology, and specifically relates to a communication information security management system and method for computing power resource perception scenarios. It is suitable for system environments with dense deployment of dynamic nodes such as edge computing, Internet of Things terminals, and intelligent networked devices.

[0003] With the development of edge computing and computing network architecture, an increasing number of computing nodes, such as edge computing devices, smart terminals, and embedded nodes, are being deployed near user data sources to improve the flexibility of computing power distribution and task response speed. This has led to the establishment of a computing power awareness system that integrates "cloud, edge, and end" collaboration. In this system, computing power awareness servers, as core control nodes, must monitor the resource status of each computing node in the network in real time, including computing power, storage capacity, bandwidth utilization, and network latency, in order to facilitate task allocation and resource optimization.

[0004] In actual deployments, especially in large-scale heterogeneous network environments, numerous devices are connected to and removed from the computing network. These devices include edge computing nodes, access routers, smart switches, industrial control terminals, and in-vehicle connected devices. As the scale and variety of these devices continue to expand, system scalability and availability face increasing challenges. Therefore, before engaging in task collaboration or resource sharing, each node must report its resource status to the computing power awareness server. To ensure overall system security, identity authentication and communication channel protection are essential to prevent security risks such as malicious device impersonation, resource tampering, and communication interference. Furthermore, existing mechanisms generally utilize plaintext transmission of computing power resource information, exposing sensitive status data such as node computing power, storage capacity, and network load to theft and analysis. Attackers can exploit this information to launch targeted resource abuse attacks or exploit system vulnerabilities, further exacerbating the security risks of node privacy leakage and the exposure of the computing power network topology.

[0005] However, the existing security authentication mechanisms are mostly based on point-to-point interactive authentication protocols (such as TLS, ECDSA, symmetric key authentication, etc.), which have problems when facing large-scale multi-node concurrent authentication requirements.

[0006] The problems of low authentication efficiency and poor scalability are that nodes need to establish authentication sessions with the server one by one. The authentication delay increases linearly with the number of nodes, which cannot meet the real-time requirements in high-density environments. The frequent joining and exit of nodes in the system requires constant updating of authentication keys or reconstruction of session links, which increases the management burden. In addition, there are problems such as complex certificate maintenance, difficulty in revoking public keys, and public key replacement.

[0007] To address the above problems, some studies have attempted to introduce batch signatures, group key negotiation and other means to improve authentication efficiency, but there are still limitations such as high algorithm complexity, difficult key management, and insufficient dynamic adaptation capabilities. Summary of the Invention

[0008] Therefore, the present invention proposes a communication information security management system and method for computing power resource perception scenarios, so as to realize efficient, flexible and secure authentication of multiple nodes in computing power perception scenarios, and solve the key problems of low authentication efficiency and poor scalability in the existing technology.

[0009] To achieve the above object, the present invention provides the following technical solutions:

[0010] Step S1: Establish a computing power perception center, which is a central server for information calculation, node interaction, and data storage; construct a finite field, select two numbers in the finite field as elliptic curve parameters to generate an elliptic curve, and generate an Abelian group based on the elliptic curve; the computing power perception center generates a private key and a public key, and generates a secret value; and calculates a secret factor of the secret value based on the secret value;

[0011] Step S1-1: The computing power perception center selects a random prime number q to obtain a finite field Z * q , the Z * q Contains elements {1, 2, ..., q-1}; choose a random prime number p to get the multiplicative group Z * p , the Z * p The multiplication group contains elements {1, 2, ..., p-1}, and the operation is multiplication modulo p, where p>q; a one-way mapping function is selected as the secure hash function h;

[0012] Step S1-2: Select two numbers a and b in the finite field as elliptic curve parameters to generate an elliptic curve, and the elliptic curve is represented by y 2 = x 3+ ax + b mod p, where y is the ordinate, x is the abscissa, and mod is the modulo operation; a point P is taken on the elliptic curve to generate a group G, where group G is an Abelian group with points on the elliptic curve as carriers and base point P as generators, and the operation follows the elliptic curve point addition rule;

[0013] Step S1-3: The computing power perception center generates the private key sk CPC ∈ Z * q and public key information PK CPC = sk CPC ·P; generate secret value S={S1, S2, ...S n}, S i represents {S1, S2, ...S n}, S i ∈Z * p , i∈[1,n], generate n secret values in total; calculate the secret factor x i = S 1 ×S 2 ×.....×S n / S i , x i The inverse element y i ≡ 1 / x i m od S i , calculate the secret factor product x i ×y i ; The computing power perception center saves {S, {S1, x1×y1},..., {{S n , x n ×y n}}} to local, where S represents all generated secret values;

[0014] Step S1-4: The computing power perception center publishes {P, G, q, p, h, PK CPC}, where P is the generator of the P point group G, G is the group G, q and p are selected prime numbers, h is a secure hash function, PK CPC It is the public key information.

[0015] Step S2: The node sends registration information containing an identity and a timestamp to the computing power perception center; if the timestamp is expired, the registration information is discarded; if the timestamp is not expired, the computing power perception center registers the node and assigns a secret value; the computing power perception center calculates the broadcast message fragment, which is the value broadcasted by the computing power perception center;

[0016] Step S2-1, Node ID i Send registration information {ID i T i}, where ID i is the true identity of the node, T i is the timestamp;

[0017] Step S2-2: The computing power perception center receives the registration information {ID i T i}, first check T i Is it expired? If it is expired, the registration information is discarded. If it is not expired, the computing power perception center registers the node, starting from S={S1, S2, ..S n}Select ID i The secret value S i , and select the corresponding x i ×y i ; Calculate the computing power perception center and ID based on the secure hash function h i The shared secret value US i , US i =h(ID i ,sk CPC , T e ), where T e Is the defined expiration time; and calculate the node ID i Corresponding broadcast message fragment SA i = US i ×x i ×y i , store {ID i , x i ×y i , T e};The computing power perception center will use the secret value S i Return to Node ID i ;

[0018] Step S2-3: If m nodes register at the same time, the broadcast message fragment SA = SA1+SA2+....+SA m =US1×x1×y1+US2×x2×y2+...+US m ×x m ×y m, where m < n, and n is the total number of secret values generated in step S2-2;

[0019] Step S2-4. After the node receives the secret value S i , it saves it locally.

[0020] Step S3. After the node registration is completed, the computing power awareness center performs broadcast message fragmentation. After the node receives it, it calculates the shared secret value; encrypts the resource information according to the shared secret value, generates a pseudonym, a secret value digest, a timestamp, a signature, and the encrypted resource information, and sends them to the computing power awareness center; the computing power awareness center verifies the timestamp, calculates the node identity, verifies the node signature, and decrypts the plaintext message;

[0021] Step S3-1. After all nodes are registered, the computing power awareness center broadcasts SA to the area, which includes registered nodes and unregistered nodes;

[0022] Step S3-2. When the node ID i needs to periodically upload the resource information M i to the computing power awareness center, ID i calculates the shared secret value US i = SA mod S i ; encrypts the resource message M i to generate the ciphertext C i = US i ⨁M i , where ⨁ represents the exclusive OR operation; ID i selects a communication pseudonym. The selection process is as follows: randomly select r i [[ID=3~6]]∈Z * q , and calculate the random value R i =r i P, generate the pseudonym PID i = h(r i PK CPC )⨁ID i ; calculate and generate the sending message C i , and the digest of the secret value: ɑ i =h(C i , US i , ID i , T j ), where T j is the timestamp; calculate the signature θ = US i +ɑ i r i ; ID i sends the authentication message {C i , θ, PID i , R i, T j} to the computing power perception center, where C i represents the ciphertext, θ represents the signature, PID i Node ID i The pseudonym, R i represents the random value, T j Represents the timestamp.

[0023] Step S3-3: The computing power perception center receives the authentication message {C i , PID i , R i , T j}, first check T j Whether it times out. If so, the authentication message is discarded. If not, the node's real identity ID is calculated. i = PID i ⨁h(sk CPC R i ), then retrieve the local storage information {ID i , x i ×y i , T e}, judge T e Is it expired? If it is expired, the node ID i If the registration information is invalid, the message is discarded. If it is not expired, the shared secret value US is calculated. i =h(ID i ,sk CPC , T e ), and the summary value ɑ i =h(C i , US i , ID i , T j ), verify whether θP is equal to US i P+ɑ i R i , if they are equal, then decrypt the plaintext message; the decryption process is: M i = C i ⨁US i ;

[0024] If the computing power perception center receives multiple groups of messages at the same time, it calculates the signature θ of each group of messages for batch verification. The batch verification process is as follows:

[0025]

[0026] in m Representatives share m Nodes send m Group message, θ iRepresents the signature of each group of messages, P is the generator of P point group G, US i Represents the shared secret value of each node, ɑ i Represents the secret value summary of each node, r i represents the value obtained by random selection, R i Represents the random value.

[0027] Step S4: When a node joins, leaves, or is updated, the computing power perception center calculates a new broadcast message based on the node status, updates the local storage information, and re-announces the new broadcast message to the area.

[0028] Step S4-1: When there is new identity information ID k1 When a node joins, the computing power perception center is ID k1 Choose a new secret value S k1 , and calculate the secret factor product x k1 ×y k1 ;

[0029] Calculate the new broadcast message SA new1 =SA old1 + h(ID k1 ,sk CPC , T e )×x k1 ×y k1 , where SA old1 This is the broadcast message before the new node joins;

[0030] S k1 Send to ID k1 , announce the new SA to the region new1 ;

[0031] Step S4-2: When there is identity information ID k2 When the node leaves, the computing power perception center queries the ID k2 Information {ID k2 , x k2 ×y k2 , T e}, where x k2 ×y k2 ID k2 The product of the secret factors, T e The expiration time is defined;

[0032] Calculate the new broadcast message SA new2 =SA old2 - h(ID k2 ,sk CPC , T e )×x k2 ×yk2 ; , where SA old2 This is the broadcast message before the node leaves;

[0033] Delete {ID k2 , x k2 ×y k2 , T e} information, announce the new SA to the region new2 ;

[0034] Step S4-3: When the identity information is ID k3 When a node needs to update information, the computing power perception center queries the ID k3 Information {ID k3 , x k3 ×y k3 , T e};

[0035] Select the new S k3 new3 And calculate the corresponding secret factor product x k3 new3 ×y k3 new3 , calculate the new broadcast message:

[0036] SA new3 =SA old3 - h(ID k3 ,sk CPC , T e )×x k3 ×y k3 + h(ID k3 ,sk CPC , T e new3 )×x k3 new3 ×y k3 new3 , where SA old3 It is the broadcast message before the node updates the information, T e new3 is the new expiration time, and S k new3 Send to ID k3 , announce the new SA to the region new3 .

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] 1. The present invention constructs a group authentication mechanism through the Chinese remainder theorem and combines it with the dynamic allocation strategy of the moduli space to achieve single efficient authentication and batch authentication capabilities. It supports only local parameter updates when nodes are dynamically added or deleted without the need to reconstruct the entire network authentication link, significantly improving the authentication efficiency and adaptability in highly dynamic scenarios.

[0039] 2. This invention uses the collaborative design of Chinese remainder theorem parameter anonymization encapsulation and lightweight encryption to ensure the confidentiality of resource data transmission while avoiding complex computing overhead, achieving a balance between semantic hiding of sensitive information, anti-eavesdropping and lightweight authentication, and achieving the dual advantages of privacy protection and efficiency optimization.

[0040] 3. This invention deeply couples the authentication protocol with the computing power scheduling process, uses the Chinese remainder theorem parameters to ensure the integrity of resource information and the credibility of the source, provides a secure data foundation for computing power scheduling, and relies on the scalability of the Chinese remainder theorem mathematical architecture to build a general security framework covering cloud-edge-end collaboration, software-defined networks and other scenarios, supporting integrated security management of heterogeneous resources and cross-scenario migration applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a flow chart of a communication information security management method for computing power resource perception scenarios according to the present invention;

[0042] Figure 2 A schematic diagram of routing computing power scheduling for a communication information security management method for computing power resource perception scenarios according to the present invention;

[0043] Figure 3 A schematic diagram of an application of a communication information security management method for computing resource perception scenarios in a software-defined network according to the present invention;

[0044] Figure 4 A schematic diagram of the application of a communication information security management method for computing power resource perception scenarios in a cloud-edge computing network according to the present invention;

[0045] Figure 5 This is a schematic diagram of the application of a communication information security management method for computing power resource perception scenarios in the present invention in an edge computing network.

[0046] Figure 6 This is a schematic diagram of the structure of a communication information security management system for computing resource perception scenarios in the present invention; DETAILED DESCRIPTION

[0047] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0048] Example 1: Figure 1 As shown, the present invention provides a technical solution, a communication information security management method for computing resource perception scenarios, and the communication information security management method includes the following steps:

[0049] Step S1: Establish a computing power perception center, which is a central server for implementing a communication information security management method for computing power resource perception scenarios; construct a finite field, select two numbers in the finite field as elliptic curve parameters to generate an elliptic curve, and generate an Abelian group based on the elliptic curve; generate a private key and a public key of the computing power perception center, generate a secret value, and calculate a secret factor of the secret value;

[0050] Step S1-1: The computing power perception center selects a random prime number q to obtain a finite field Z * q , the Z * q Contains elements {1, 2, ..., q-1}; choose a random prime number p to get the multiplicative group Z * p , the Z * p The multiplication group contains elements {1, 2, ..., p-1}, and the operation is multiplication modulo p, where p>q; a one-way mapping function is selected as the secure hash function h;

[0051] Step S1-2: Select two numbers a and b in the finite field as elliptic curve parameters to generate an elliptic curve, and the elliptic curve is represented by y 2 = x 3 + ax + b mod p, where y is the ordinate, x is the abscissa, and mod is the modulo operation; a point P is taken on the elliptic curve to generate a group G, where group G is an Abelian group with points on the elliptic curve as carriers and base point P as generators, and the operation follows the elliptic curve point addition rule;

[0052] Step S1-3: The computing power perception center generates the private key sk CPC ∈ Z * q and public key information PK CPC = sk CPC ·P; generate secret value S={S1, S2, ...Sn}, where S i ∈Z * p , i∈[1,n]; calculate SM = S 1 ×S 2 ×.....×S n , x i = SM / S i , x i The inverse element y i ≡ 1 / x i m od S i , and the product of the secret value x i ×y i ; The computing power perception center saves {S, {S1, x1×y1},..., {{S n , x n ×y n}}} to local;

[0053] Step S1-4: The computing power perception center publishes {P, G, q, p, h, PK CPC}, where P is the generator of the P point group G, G is the group G, q and p are selected prime numbers, h is a secure hash function, PK CPC It is the public key information.

[0054] Step S2: The node sends registration information containing an identity and a timestamp to the computing power perception center. If the timestamp is expired, the registration information is discarded. If the timestamp is not expired, the computing power perception center assigns a secret value to the node. The computing power perception center calculates the broadcast message fragment, which is the value broadcasted by the computing power perception center.

[0055] Step S2-1: Node ID i Send registration information {ID i T i}, where ID i is the true identity of the node, T i is the timestamp;

[0056] Step S2-2: The computing power perception center receives the registration information {ID i T i}, first check T i Is it expired? If it is expired, the registration information is discarded. If it is not expired, the computing power perception center registers the node, starting from S={S1, S2, ..S n}Select IDi The secret value S i , and select the corresponding x i ×y i ; Calculate the computing power perception center and ID based on the secure hash function h i The shared secret value US i , US i =h(ID i ,sk CPC , T e ), where T e Is the defined expiration time; and calculate the node ID i Corresponding broadcast message fragment SA i = US i ×x i ×y i , store {ID i , x i ×y i , T e};The computing power perception center will use the secret value S i Return to Node ID i ;

[0057] Step S2-3: If multiple nodes register at the same time, the broadcast message fragment SA = SA1+SA2+....+SA m =US1×x1×y1+US2×x2×y2+...+US m ×x m ×y m , where m <n;

[0058] Step S2-4: When the node receives the secret value S i Then save it locally.

[0059] Step S3: After the node registration is completed, the computing power perception center performs message segmentation. After receiving the message, the node calculates the shared secret value. The resource information is encrypted according to the shared secret value, and a pseudonym, secret value summary, timestamp, signature, and encrypted resource information are generated and sent to the computing power perception center. The computing power perception center verifies the timestamp, computing node identity, verification node signature, and decrypts the plaintext message.

[0060] Step S3-1: After all nodes are registered, the computing power perception center broadcasts SA to the area, which includes registered nodes and unregistered nodes;

[0061] Step S3-2, when the node ID i It is necessary to periodically update resource information M i When uploading to the computing power perception center, ID i Calculate the shared secret value US through the broadcast message SAi = SA mod S i ; The resource message M i Encryption generates ciphertext C i = US i ⨁M i , where ⨁ represents the XOR operation; ID i Choose a pseudonym for communication. The selection process is: randomly select r i ∈Z * q , and calculate the random value R i =r i P, generate pseudonymous PID i = h(r i PK CPC )⨁ID i ; Calculate and generate the message C i , and the summary of the secret value: ɑ i =h(C i , US i , ID i , T j ), where T j is the timestamp; calculate the signature θ=US i +ɑ i r i ;ID i Send authentication message i ,θ,PID i , R i , T j} to the computing power perception center, where C i represents the ciphertext, θ represents the signature, PID i Node ID i The pseudonym, R i represents the random value, T j Represents the timestamp.

[0062] Step S3-3: The computing power perception center receives the authentication message {C i , PID i , R i , T j}, first check T j Whether it times out. If so, the authentication message is discarded. If not, the node's real identity ID is calculated. i = PID i ⨁h(sk CPC R i ), then retrieve the local storage information {ID i , x i ×y i , T e}, judge Te Is it expired? If it is expired, the node ID i If the registration information is invalid, the message is discarded. If it is not expired, the shared secret value US is calculated. i =h(ID i ,sk CPC , T e ), and the summary value ɑ i =h(C i , US i , ID i , T j ), verify whether θP is equal to US i P+ɑ i R i , if they are equal, the signature authentication is successful and the plaintext message is decrypted; the decryption process is: M i =C i ⨁US i If the computing power perception center receives multiple groups of messages at the same time, it calculates the signature θ of each group of messages for batch verification. The batch verification process is as follows:

[0063]

[0064] in m Representatives share m Nodes send m Group message, θ i Represents the signature of each group of messages, P is the generator of P point group G, US i Represents the shared secret value of each node, ɑ i Represents the secret value summary of each node, r i represents the value obtained by random selection, R i Represents the random value.

[0065] Step S4: When a node joins, leaves, or is updated, the computing power perception center calculates a new broadcast message based on the node status, updates the local storage information, and re-announces the new broadcast message to the area.

[0066] Step S4-1: When there is new identity information ID k1 When a node joins, the computing power perception center is ID k1 Select an S k1 and x k1 ×y k1 ;

[0067] Calculate the new broadcast message SA new1 =SA old1 + h(ID k1 ,sk CPC , T e )×x k1×y k1 ;

[0068] S k1 Send to ID k1 , announce the new SA to the region new1 ;

[0069] Step S4-2: When there is identity information ID k2 When the node leaves, the computing power perception center queries the ID k2 Information {ID k2 , x k2 ×y k2 , T e};

[0070] Calculate the new broadcast message SA new2 =SA old2 - h(ID k2 ,sk CPC , T e )×x k2 ×y k2 ;

[0071] Delete {ID k2 , x k2 ×y k2 , T e} information, announce the new SA to the region new2 ;

[0072] Step S4-3: When the identity information is ID k3 When a node needs to update information, the computing power perception center queries the ID k3 Information {ID k3 , x k3 ×y k3 , T e};

[0073] Select the new S k3 new3 and x k3 new3 ×y k3 new3 , calculate the new broadcast message:

[0074] SA new3 =SA old3 - h(ID k3 ,sk CPC , T e )×x k3 ×y k3 + h(ID k3 ,sk CPC , T e new3 )×xk3 new3 ×y k3 new3 , where T e new3 is the new expiration time, and S k new3 Send to ID k3 , announce the new SA to the region new3 .

[0075] For example: In an edge computing network, there are three edge nodes ID1, ID2, and ID3 that need to register with the computing power perception center CPC and report computing power resource information.

[0076] First, initialize the computing power perception center:

[0077] Choose a prime number q=11, then the finite field Z * 11 Contains elements {1, 2, ..., 10}, prime number p = 23 (multiplicative group Z * 23 , elements {1, 2, ..., 22}, p>q.

[0078] The elliptic curve parameters are a=1, b=1, and the curve equation is y²=x³+x+1mod23.

[0079] The base point P = (1, 7) is on the elliptic curve, generating the Abelian group G, and the operation is the elliptic curve point addition.

[0080] Computing power perception center private key sk CPC =5∈Z * 11 , public key PK CPC =sk CPC ·P=5·(1,7), let the result be the point (18,12).

[0081] Initial secret value S={S1=3, S2=5, S3=7}, all ∈ Z * 23 ,calculate:

[0082] Secret value product SM=3×5×7=105

[0083] x1 =SM / S1 =105 / 3=35， y1 =35⁻¹ mod 3=2, so x1 × y1 =35×2=70

[0084] x2= SM / S2=21,y2=21⁻¹ mod 5=1, Thereforex²×y²=21×1=21

[0085] x3= SM / S2=15,y3=15⁻¹ mod 7=1, Therefore x3×y3=15×1=15

[0086] The computing power perception center locally stores {S1=3, x1×y1=70}, {S2=5, x2×y2=21}, {S3=7, x3×y3=15}, and publicly {P, G, q=11, p=23, h, PK CPC}.

[0087] Register node ID1:

[0088] Node ID1 sends registration information {ID1T1}, and timestamp T1 has not expired.

[0089] The computing power perception center assigns S1=3 and calculates the shared secret value US1=h(ID1, sk CPC =5, T e =1 hour), let h output be 10, and the broadcast message fragment SA1 = US1×x1×y1=10×70=700.

[0090] Local storage {ID1, x1×y1=70, T e =1 hour}, return S1=3 to node ID1.

[0091] Node ID2 registration (simultaneous registration scenario):

[0092] Node ID2 sends {ID2T2}, and the timestamp is valid.

[0093] Assign S2=5, calculate US2=h(ID2,sk CPC =5, T e =1 hour), let h output be 20, SA2=20×21=420.

[0094] Broadcast message fragment SA = SA1 + SA2 = 700 + 420 = 1120, the current number of registered nodes m = 2, and the total number of nodes n = 3.

[0095] Return S2=5 to node ID2.

[0096] Node ID1 reports resource information:

[0097] The computing power perception center broadcasts SA = 1120 and each node SA i .

[0098] Node ID1 calculates the shared secret value US1 = SA mod S1 = 1120 mod 3 = 1

[0099] Resource Information i = "CPU:80%, Mem:60%", after encryption C i =US1⨁M i =1⨁"CPU:80%, Mem:60%".

[0100] Generate pseudonyms:

[0101] Randomly select r1=2∈ Z * 11 , calculate R1 = r1·P = 2·(1,7), and let the result be the point (10, 5).

[0102] Let h output a random value, pseudonym PID1= h(r1PK CPC )⨁ ID1, XORed with ID1 to hide the real identity.

[0103] Calculation Summary ɑ1 = h (C i , US1=1, ID1, T j ), let the output be 3, signature θ=US1+ɑ1r1=1+3×2=7.

[0104] Send Message i ,θ=7,PID1,R1=(10,5),T j} to the computing power perception center.

[0105] Check timestamp T j If the timeout is not reached, calculate the real identity ID1 = PID1 ⨁h(sk CPC R1=5·(10,5)).

[0106] Retrieve local {ID1, x1×y1=70, T e = 1 hour}, T e Not expired, recalculate US1=h(ID1, 5, T e =1 hour)=10.

[0107] Verify the signature: θ·P=7·(1,7), US1·P+ɑ1·R1=10·(1,7)+3·(10,5). If the two are equal on the elliptic curve, the signature is passed.

[0108] Decrypt ciphertext M i =C i ⨁US1=1⨁C i , get resource information.

[0109] Dynamic node management:

[0110] New node ID3 is added:

[0111] The computing power perception center allocates S3 and calculates US3=h(ID5,5,T e =1 hour), let h output be 15, SA3=15×15=225.

[0112] New Broadcast Message SA new =SA old +SA3=1120+225=1345, update local storage {ID3, x3×y3=15, T e = 1 hour}, broadcast SA new =1345.

[0113] Node ID 2 leaves:

[0114] The computing power perception center queries ID2's SA2=420 and calculates SA new =SA old -SA2=1345-420=925.

[0115] Delete the registration information of ID2 and broadcast SA new =925.

[0116] Node ID1 is updated, for example, the expiration time is extended:

[0117] Original T e =1 hour expires, node ID1 requests update, computing power perception center allocates new T e = 2 hours, calculate new US1 new =h(ID1,5,T e =2 hours), let h output be 12.

[0118] Calculating SA new = -SA1+US1 new ×x1×y1= -700+12×70=140, new broadcast message SA new =925+140=1065.

[0119] Update local T e = 2 hours, return new S1 = 3 (the secret value can remain unchanged, only the expiration time is updated), broadcast SA new =1065.

[0120] At the same time, if Figure 2 , Figure 3 , Figure 4 , Figure 5The authentication and privacy communication method proposed in this invention is not only applicable to the dynamic monitoring and scheduling of node computing power in computing resource perception scenarios, but can also be extended to cross-domain scenarios such as cloud-edge-end collaborative task scheduling, SDN network resource perception, and distributed storage resource discovery.

[0121] For example: In the software-defined network resource perception scenario, the controller needs to reliably collect and dynamically orchestrate resources such as the bandwidth and flow table capacity of a large number of forwarding devices; in the cloud-edge computing scenario, the computing power collaboration between edge nodes and cloud servers requires real-time verification of device identity and encrypted transmission load status.

[0122] Example 2, as Figure 6 As shown, the present invention provides a communication information security management system for computing power resource perception scenarios, which includes an initialization module, a node registration module, a security processing module, and a node management module; the initialization module is used to build a computing power perception center, generate the elliptic curve, Abelian group, public key, private key, secret value and secret factor of the secret value; the node registration module is used to verify the timestamp of the registration information, generate broadcast message fragments, and complete the authentication of the node identity; the security processing module is used to complete the encrypted transmission of node information; the node management module is used to respond to the joining, leaving and information update of nodes;

[0123] The output end of the initialization module is electrically connected to the input end of the node registration module; the output end of the node registration module is electrically connected to the input end of the security processing module; the output end of the security processing module is electrically connected to the input end of the node management module.

[0124] The initialization module includes a center establishment unit and a parameter generation unit; the center establishment unit is used to establish the computing power perception center; the parameter generation unit is used to construct a finite field, generate elliptic curves and Abelian groups, as well as private keys, public keys, secret values and secret factors of secret values.

[0125] The node registration module includes a request processing unit and a secret value allocation unit; the request processing unit is used to receive the node's registration information containing the real identity and timestamp, and verify the validity of the timestamp; the secret value allocation unit is used to allocate secret values to non-expired nodes, calculate broadcast message fragments, store the node's real identity, expiration time and secret value, and return the secret value to the node.

[0126] The security processing module includes an encryption communication unit and an information verification unit; the encryption communication unit is used by the node to encrypt resource information according to the shared secret value to generate ciphertext, generate a pseudonym, an intermediate value of the pseudonym, a timestamp, a signature and send it to the computing power perception center; the information verification unit is used by the computing power perception center to verify the validity of the timestamp, verify the signature and decrypt the resource information.

[0127] The node management module includes a status monitoring unit and a message update unit; the status monitoring unit is used to monitor the joining, leaving and information update of nodes; the message update unit is used to recalculate broadcast messages according to the node changes monitored by the status monitoring unit, update local storage information and announce new broadcast messages to the area.

[0128] Finally, it should be noted that it will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be embraced therein. Any reference signs in the claims should not be construed as limiting the claim to which they relate.

Claims

1. A communication information security management method for computing resource perception scenarios, characterized by: Step S1: Establish a computing power perception center, which is a central server for information calculation, node interaction, and data storage; construct a finite field, select two numbers in the finite field as elliptic curve parameters to generate an elliptic curve, and generate an Abelian group based on the elliptic curve; the computing power perception center generates a private key and a public key, and generates a secret value; and calculates a secret factor of the secret value based on the secret value; Step S2: The node sends registration information including identity and timestamp to the computing power perception center; If the timestamp expires, the registration information is discarded. If the timestamp has not expired, the computing power perception center registers the node and assigns a secret value. The computing power perception center calculates the broadcast message fragment, which is the value broadcasted by the computing power perception center. Step S3: After the node registration is completed, the computing power perception center performs message segmentation. After receiving the message, the node calculates the shared secret value. The resource information is encrypted according to the shared secret value, and a pseudonym, secret value summary, timestamp, signature, and encrypted resource information are generated and sent to the computing power perception center. The computing power perception center verifies the timestamp, computing node identity, verification node signature, and decrypts the plaintext message. Step S4: When a node joins, leaves, or is updated, the computing power perception center calculates a new broadcast message based on the node status, updates the local storage information, and re-announces the new broadcast message to the region; The step S1 comprises: Step S1-1: The computing power perception center selects a random prime number q to obtain a finite field Z * q , the Z * q Contains elements {1, 2, ..., q-1}; choose a random prime number p to get the multiplicative group Z * p , the Z * p The multiplication group contains elements {1, 2, ..., p-1}, and the operation is multiplication modulo p, where p>q; a one-way mapping function is selected as the secure hash function h; Step S1-2: Select two numbers a and b in the finite field as elliptic curve parameters to generate an elliptic curve, and the elliptic curve is represented by y 2 =x 3 +ax+bmodp, where y is the ordinate, x is the abscissa, and mod is the modulo operation; a point P is taken on the elliptic curve to generate a group G, where group G is an Abelian group with points on the elliptic curve as carriers and base point P as generators, and the operation follows the elliptic curve point addition rule; Step S1-3: The computing power perception center generates the private key sk CPC ∈Z * q and public key information PK CPC =sk CPC ·P; generate secret value S = {S1, S2, ... S n }, S i represents {S1, S2, ...S n }, S i ∈Z * p , i∈[1,n], generate a total of n secret values; calculate the secret factor x i =S1×S2×.....×S n / S i , x i The inverse element y i ≡1 / x i modS i , calculate the secret factor product x i ×y i ; The computing power perception center saves {S, {S1, x1×y1}, ..., {{S n , x n ×y n }}} to local, where S represents all generated secret values; Step S1-4: The computing power perception center publishes {P, G, q, p, h, PK CPC }, where P is the generator of the P point group G, G is the group G, q and p are selected prime numbers, h is a secure hash function, PK CPC is the public key information; The step S2 comprises: Step S2-1: Node ID i Send registration information {ID i T i }, where ID i is the true identity of the node, T i is the timestamp; Step S2-2: The computing power perception center receives the registration information {ID i T i }, first check T i Is it expired? If it is expired, the registration information is discarded. If it is not expired, the computing power perception center registers the node, starting from S={S1, S2, ..S n }Select ID i The secret value S i , and select the corresponding x i ×y i ; Calculate the computing power perception center and ID based on the secure hash function h i The shared secret value US i , US i =h(ID i ,sk CPC , T e ), where T e Is the defined expiration time; and calculate the node ID i Corresponding broadcast message fragment SA i =US i ×x i ×y i , store {ID i , x i ×y i , T e }; The computing power perception center will send the secret value S i Return to Node ID i ; Step S2-3: If m nodes register simultaneously, broadcast the message shard SA = SA1 + SA2 +.... + SA m = US1 × x1 × y1 + US2 × x2 × y2 +... + US m × x m × y m , where m < n, and n is the total number of secret values generated in step S2-2; Step S2-4: When the node receives the secret value S i Then save it locally; The step S3 comprises: Step S3-1: After all nodes are registered, the computing power perception center broadcasts SA to the area, which includes registered nodes and unregistered nodes; Step S3-2, when the node ID i It is necessary to periodically update resource information M i When uploading to the computing power perception center, ID i Calculate the shared secret value US through the broadcast message SA i =SAmod S i ; The resource message M i Encryption generates ciphertext in Represents exclusive OR operation; ID i Choose a pseudonym for communication. The selection process is: randomly select r i ∈Z * q , and calculate the random value R i =r i P, generate pseudonyms Calculate and generate the sent message C i , and the summary of the secret value: ɑ i =h(C i , US i , ID i , T j ), where T j is the timestamp; calculate the signature θ = US i +ɑ i r i ;ID i Send authentication message i ,θ,PID i , R i , T j } to the computing power perception center, where C i represents the ciphertext, θ represents the signature, PID i Node ID i The pseudonym, R i represents the random value, T j represents said timestamp; Step S3-3: The computing power perception center receives the authentication message {C i , PID i , R i , T j }, first check T j Whether it times out. If so, the authentication message is discarded. If not, the true identity of the node is calculated. Then retrieve the local storage information {ID i , x i ×y i , T e }, judge T e Is it expired? If it is expired, the node ID i If the registration information is invalid, the message is discarded. If it is not expired, the shared secret value US is calculated. i =h(ID i ,sk CPC , T e ), and the summary value ɑ i =h(C i , US i , ID i , T j ), verify θ P Is it equal to US i P+ɑ i R i , if they are equal, then decrypt the plaintext message; the decryption process is: If the computing power perception center receives multiple groups of messages at the same time, it calculates the signature θ of each group of messages for batch verification. The batch verification process is as follows: Where m represents a total of m nodes sending m groups of messages, θ i Represents the signature of each group of messages, P is the generator of P point group G, US i Represents the shared secret value of each node, ɑ i Represents the secret value summary of each node, r i represents the value obtained by random selection, R i represents the random value; The step S4 comprises: Step S4-1: When there is new identity information ID k1 When a node joins, the computing power perception center is ID k1 Choose a new secret value S k1 , and calculate the secret factor product x k1 ×y k1 ; Calculate the new broadcast message SA new1 =SA old1 +h(ID k1 ,sk CPC , T e )×x k1 ×y k1 , where SA old1 This is the broadcast message before the new node joins; S k1 Send to ID k1 , announce the new SA to the region new1 ; Step S4-2: When there is identity information ID k2 When the node leaves, the computing power perception center queries the ID k2 Information {ID k2 , x k2 ×y k2 , T e }, where x k2 ×y k2 ID k2 The product of the secret factors, T e The expiration time is defined; Calculate the new broadcast message SA new2 =SA old2 -h(ID k2 ,sk CPC , T e )×x k2 ×y k2 ; Among them SA old2 This is the broadcast message before the node leaves; Delete {ID k2 , x k2 ×y k2 , T e } information, announce the new SA to the region new2 ; Step S4-3: When the identity information is ID k3 When a node needs to update information, the computing power perception center queries the ID k3 Information {ID k3 , x k3 ×y k3 , T e }; Select the new S k3 new3 And calculate the corresponding secret factor product x k3 new3 ×y k3 new3 , calculate the new broadcast message: SA new3 =SA old3 -h(ID k3 ,sk CPC , T e )×x k3 ×y k3 +h(ID k3 ,sk CPC , T e new3 )×x k3 new3 ×y k3 new3 , where SA old3 It is the broadcast message before the node updates the information, T e new3 is the new expiration time, and S k new3 Send to ID k3 , announce the new SA to the region new3 .

2. A communication information security management system for computing power resource perception scenarios, which is applied to the communication information security management method for computing power resource perception scenarios described in claim 1, characterized in that: The system includes an initialization module, a node registration module, a security processing module, and a node management module; the initialization module is used to build a computing power perception center and generate the elliptic curve, Abelian group, public key, private key, secret value, and secret factor of the secret value; the node registration module is used to verify the timestamp of the registration information, generate broadcast message fragments, and complete the authentication of the node identity; the security processing module is used to complete the encrypted transmission of node information; and the node management module is used to respond to the joining, leaving, and information update of nodes. The output end of the initialization module is electrically connected to the input end of the node registration module; the output end of the node registration module is electrically connected to the input end of the security processing module; the output end of the security processing module is electrically connected to the input end of the node management module.

3. A communication information security management system for computing power resource perception scenarios according to claim 2, characterized in that: The initialization module includes a center establishment unit and a parameter generation unit; the center establishment unit is used to establish the computing power perception center; the parameter generation unit is used to construct a finite field, generate elliptic curves and Abelian groups, as well as private keys, public keys, secret values and secret factors of secret values.

4. The communication information security management system for computing power resource perception scenarios according to claim 2, characterized in that: The node registration module includes a request processing unit and a secret value allocation unit; the request processing unit is used to receive the node's registration information containing the real identity and timestamp, and verify the validity of the timestamp; the secret value allocation unit is used to allocate secret values to non-expired nodes, calculate broadcast message fragments, store the node's real identity, expiration time and secret value, and return the secret value to the node.

5. The communication information security management system for computing power resource perception scenarios according to claim 2 is characterized by: The security processing module includes an encryption communication unit and an information verification unit; the encryption communication unit is used by the node to encrypt resource information according to the shared secret value to generate ciphertext, generate a pseudonym, an intermediate value of the pseudonym, a timestamp, a signature and send it to the computing power perception center; the information verification unit is used by the computing power perception center to verify the validity of the timestamp, verify the signature and decrypt the resource information.

6. The communication information security management system for computing resource perception scenarios according to claim 2, characterized in that: The node management module includes a status monitoring unit and a message update unit; the status monitoring unit is used to monitor the joining, leaving and information update of nodes; the message update unit is used to recalculate broadcast messages according to the node changes monitored by the status monitoring unit, update local storage information and announce new broadcast messages to the area.

Images