Ad hoc network peer-to-peer master key generation, identity authentication and session key negotiation method

Abstract

The invention discloses a master key generation, identity authentication and session key negotiation method among peer bodies of an ad hoc network, and belongs to the technical field of wireless communication security, and the master key generation comprises the following steps: in a node network access initialization stage, generating a quantum random number of a node through a quantum entropy source generator; the total key space is divided into a plurality of continuous intervals by adopting an equal-division mapping algorithm, each interval corresponds to a preset key segment, and a quantum key table is formed; in a key negotiation stage, nodes of both communication parties extract ID identifiers and quantum random numbers, and execute a composite hash operation to generate an intermediate hash value; and performing Block division on the intermediate hash value, and generating a master key of nodes of both communication parties in combination with the quantum key table. On the basis of a master key, a quantum security authentication mechanism and a key negotiation mechanism are lightened, and efficient identity authentication and key negotiation in a dynamic networking environment are realized on the premise of ensuring quantum attack resistance.

Description

Technical Field

[0001] The present invention relates to the technical field of wireless communication security, and in particular to a method for master key generation, identity authentication and session key negotiation between peers in an ad hoc network. Background Art

[0002] As a new type of communication infrastructure for smart grids, power wireless mesh networks are widely deployed in scenarios such as equipment monitoring on the distribution and utilization side of power systems and emergency repairs. Their topology exhibits multi-hop dynamic networking characteristics: network nodes (including power-specific equipment such as smart meters, fault indicators, and inspection terminals) perform both terminal access and data relay functions, autonomously forming a decentralized peer-to-peer network based on power service needs. This type of network offers significant advantages in scenarios such as power emergency communications and distributed energy access. However, traditional cryptographic security mechanisms face multiple challenges due to the low transmission rates caused by wireless channel contention and interference, as well as the generally limited computing power and unstable energy supply of power terminal devices. Especially under the security protection requirements of the critical information infrastructure of the power system, the following technical problems need to be solved: (1) The contradiction between dynamic topology and key management. Power nodes frequently change their network positions with maintenance operations and fault switching. The manual pre-setting of keys has a key update overhead of the order of N²; (2) The contradiction between long-term security and quantum threats. The current RSA / ECC algorithm has the risk of key cracking under the attack of Shor's quantum algorithm, which is difficult to meet the equipment service cycle requirements of more than 20 years in the power system; (3) The contradiction between resource limitation and security strength. Most power mesh self-organizing network terminals are ARM Cortex-M-class low-power processors, which cannot support high-intensity computing; (4) The contradiction between channel efficiency and authentication delay. The existing two-way authentication protocol requires more than 3 handshake interactions, which is easy to cause business data transmission congestion at the typical channel rate of power wireless mesh (<1Mbps).

[0003] While existing quantum secure communication technologies offer enhanced security through quantum key distribution (QKD), their reliance on optical fiber channels to transmit quantum states and the need for complex phase compensation systems fundamentally conflict with the RF transmission environment and random access characteristics of mobile nodes in power wireless mesh networks. In typical scenarios, such as overhead line inspections in distribution networks and mobile substation equipment operations, network nodes often operate in non-line-of-sight (NLOS) communication, making them unable to meet the stringent channel stability requirements of quantum key distribution. Therefore, there is an urgent need to develop lightweight security mechanisms tailored to the characteristics of power wireless mesh networks, enabling efficient identity authentication and key negotiation in dynamic networking environments while ensuring resistance to quantum attacks. Summary of the Invention

[0004] The purpose of the present invention is to overcome the deficiencies in the prior art and provide a method for master key generation, identity authentication and session key negotiation between peers in an ad hoc network, so as to solve technical problems such as complex key management and weak quantum resistance of traditional solutions.

[0005] To achieve the above object, the present invention is implemented by adopting the following technical solutions:

[0006] In a first aspect, the present invention provides a method for generating a master key between peers in an ad hoc network, comprising:

[0007] During the node network initialization phase, the quantum random number of the node is generated by the quantum entropy source generator;

[0008] The total key space is divided into a plurality of continuous intervals using an equal division mapping algorithm, each of the intervals corresponding to a preset key segment, to form a quantum key table;

[0009] During the key negotiation phase, the communicating nodes extract the ID and quantum random number, and perform a composite hash operation to generate an intermediate hash value.

[0010] The intermediate hash value is divided into blocks, and combined with the quantum key table to generate the master keys of the communicating nodes.

[0011] Optionally, the quantum entropy source generator uses quantum noise or vacuum fluctuations of a single-photon detector as a source of randomness.

[0012] Optionally, the adopting of an equal division mapping algorithm to divide the total key space into a plurality of continuous intervals includes:

[0013] Use 32-bit value space as the total key space, denoted as ;

[0014] The multiple continuous intervals are divided into:

[0015]

[0016] Where, For the intervals, is the number of intervals.

[0017] Optionally, the quantum key table is stored in a secure chip that is resistant to physical attacks, and an access rights control policy is set to allow only authorized processes to call key data in the quantum key table through a secure API.

[0018] Optionally, performing a composite hash operation to generate an intermediate hash value includes:

[0019] Assume that the two communicating parties are nodes A and B, and the ID and quantum random number of node A are and , the ID and quantum random number of node B are and ;

[0020] Perform bit expansion operations on ID identification and quantum random numbers:

[0021]

[0022] Where, It is a fixed filling position;

[0023] Input the bit expansion operation result into the national secret SM3 hash function to generate an intermediate hash value :

[0024]

[0025] Where, It is the national encryption SM3 hash function.

[0026] Optionally, dividing the intermediate hash value into blocks and generating master keys of both communicating nodes in combination with the quantum key table includes:

[0027] The intermediate hash value is divided into blocks, with each 32 bits being a block, to generate a block sequence , , is the number of blocks;

[0028] Calculate the index parameters for each block :

[0029]

[0030] Where, is the number of intervals;

[0031] According to the index parameter Determine the interval it is in, obtain the preset key segment corresponding to the interval, and perform an XOR operation to obtain the master key :

[0032]

[0033] Where, is the master key of node A and node B, For blocks The corresponding preset key segment.

[0034] Optionally, the master key is written into a non-volatile memory and a life cycle is set. When the life cycle is reached, the master key is regenerated.

[0035] In a second aspect, the present invention provides an identity authentication method between peers in an ad hoc network based on the above-mentioned master key generation method, comprising:

[0036] In the identity authentication stage, the quantum random number of the node is generated by the quantum entropy source generator;

[0037] Node A sends an authentication request message to node B, which includes node A's ID, quantum random number, and current timestamp;

[0038] Node B obtains the corresponding master key based on the ID of node A , generate a message authentication code through a hash algorithm , returns the message authentication code to node A , Node B’s ID, quantum random number, and current timestamp;

[0039] Node A verifies the message authentication code If it is valid, a message authentication code is generated by the hash algorithm. , returns the message authentication code to node B ;

[0040] Node B verifies the message authentication code If the identity verification is valid, the identity verification is completed;

[0041] Among them, the message authentication code and message authentication codes for:

[0042]

[0043]

[0044] Where, is the ID of node A, quantum random number and current timestamp, It is the ID of node B, quantum random number and current timestamp.

[0045] Optionally, the current timestamp adopts the UTC synchronized clock, and the error window is set to ±1ms; if it is detected that the current timestamp exceeds the window or the quantum random number is reused, the identity authentication is immediately terminated and an alarm is triggered.

[0046] In a third aspect, the present invention provides a method for negotiating a session key between peers in an ad hoc network based on the above-mentioned master key generation method, comprising:

[0047] During the session key negotiation phase, the quantum random number of the node is generated by the quantum entropy source generator;

[0048] Node A generates Diffie-Hellman parameters: large prime number p, generator g, private key ;

[0049] Calculate the public key , through the master key Encrypted public key : ;

[0050] Node A will 、 Generate a key negotiation message and send it to node B. is the quantum random number of node A, is the encryption algorithm;

[0051] Node B decryption Get the public key , and calculate the session key , is the quantum random number of node B, calculate the public key , through the master key encryption key : ;

[0052] Node B will Return to node A;

[0053] Node A decryption , and calculate the session key .

[0054] Compared with the prior art, the present invention has the following beneficial effects:

[0055] The present invention provides a method for master key generation, identity authentication, and session key negotiation between peers in a self-organizing network. During the master key generation process, a quantum entropy source generator is used to generate quantum random numbers for the nodes, and the inherent randomness of the key is guaranteed based on the unpredictability of quantum physical processes. Peers establish point-to-point master keys on demand based on quantum keys. After the initial negotiation is completed, the master keys implement a static binding mechanism. The master keys between different communication peers are independently generated through quantum channel parameters, ensuring the complete independence of the key sequence. Even if a single node is attacked, the key information correlation will not be leaked, effectively eliminating the systemic risks existing in the traditional network key system. By replacing the manually preset keys with the automatic negotiation mechanism of the master key, not only the maintainability and operational convenience of the key system are greatly improved, but also the problem of the exponential growth of the key distribution complexity with the number of nodes in the traditional N-square network is fundamentally solved, making the deployment of quantum secure communication technology in large-scale wireless mesh self-organizing networks engineering feasible. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a flow chart of a method for generating a master key between peers in an ad hoc network provided by an embodiment of the present invention;

[0057] Figure 2 Schematic diagram of dividing the total key space into multiple continuous intervals using an equal division mapping algorithm provided by an embodiment of the present invention;

[0058] Figure 3 This is a schematic diagram of the master key negotiation process between two peers in an ad hoc network provided by an embodiment of the present invention;

[0059] Figure 4 This is a schematic diagram of the master key calculation principle between two peers in an ad hoc network provided by an embodiment of the present invention;

[0060] Figure 5 This is a schematic diagram of identity authentication between two peers in an ad hoc network provided by an embodiment of the present invention;

[0061] Figure 6 The diagram is a schematic diagram of session key negotiation between two peers in an ad hoc network provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention.

[0063] Example 1:

[0064] like Figure 1 As shown, an embodiment of the present invention provides a method for generating a master key between peers in an ad hoc network, comprising the following steps:

[0065] Step S11: During the node network initialization phase, a quantum random number for the node is generated by a quantum entropy source generator.

[0066] Specifically, in this embodiment, the quantum entropy source generator uses quantum noise or vacuum fluctuations of a single-photon detector as a source of randomness to ensure that the intrinsic randomness of the key meets the requirements of anti-quantum attack.

[0067] Step S12: Use an equal-partition mapping algorithm to divide the total key space into multiple continuous intervals, each interval corresponding to a preset key segment, to form a quantum key table.

[0068] like Figure 2 As shown, specifically in this embodiment, the equal division mapping algorithm is used to divide the total key space into multiple continuous intervals including:

[0069] Use 32-bit value space as the total key space, denoted as ;

[0070] The multiple continuous intervals are divided into:

[0071]

[0072] Where, For the intervals, is the number of intervals.

[0073] Each quantum key segment corresponds to A numerical value is used for the subsequent dynamic quantum key table construction, and the divided key segments are written into the device's secure storage area in sequence to form a quantum key table.

[0074] The quantum key table is stored in a secure chip that is resistant to physical attacks, and an access control policy is set to allow only authorized processes to call the key data in the quantum key table through a secure API.

[0075] like Figure 3 and Figure 4 As shown, in step S13, during the key negotiation phase, the nodes of both communicating parties extract the ID identifier and the quantum random number, and perform a composite hash operation to generate an intermediate hash value.

[0076] Specifically in this embodiment, performing a composite hash operation to generate an intermediate hash value includes:

[0077] Assume that the two communicating parties are nodes A and B, and the ID and quantum random number of node A are and , the ID and quantum random number of node B are and ;

[0078] Perform bit expansion operations on ID identification and quantum random numbers:

[0079]

[0080] Where, To fix the padding bits, ensure that the input length meets the requirements of the national encryption SM3 hash function;

[0081] Input the bit expansion operation result into the national secret SM3 hash function to generate an intermediate hash value :

[0082]

[0083] Where, It is the national encryption SM3 hash function.

[0084] Step S14: Block the intermediate hash value and generate the master key of the communicating nodes in combination with the quantum key table.

[0085] Specifically in this embodiment, the intermediate hash value is divided into blocks, and the master keys of the communicating nodes are generated in combination with the quantum key table, including:

[0086] Divide the intermediate hash value into blocks, with each 32 bits as a block, and generate a block sequence , , is the number of blocks;

[0087] Calculate the index parameters for each block :

[0088]

[0089] Where, is the number of intervals;

[0090] According to the index parameter Determine the interval it is in, obtain the preset key segment corresponding to the interval, and perform an XOR operation to obtain the master key :

[0091]

[0092] Where, is the master key of node A and node B, For blocks The corresponding preset key segment.

[0093] The master key is written into the non-volatile memory and a life cycle is set. When the life cycle is reached, the master key is regenerated.

[0094] Example 2:

[0095] Based on the master key generation method provided in Example 1, this embodiment of the present invention provides an identity authentication method between peers in an ad hoc network, including the following steps:

[0096] like Figure 5 As shown, in the identity authentication stage, the quantum random number of the node is generated by the quantum entropy source generator;

[0097] Node A sends an authentication request message to node B. The authentication request message includes node A's ID, quantum random number, and current timestamp.

[0098] Node B obtains the corresponding master key based on the ID of node A , generate a message authentication code through a hash algorithm , returns the message authentication code to node A , Node B’s ID, quantum random number, and current timestamp;

[0099] Node A verifies the message authentication code If it is valid, a message authentication code is generated by the hash algorithm. , returns the message authentication code to node B ;

[0100] Node B verifies the message authentication code If the identity verification is valid, the identity verification is completed;

[0101] Among them, the message authentication code and message authentication codes for:

[0102]

[0103]

[0104] Where, is the ID of node A, quantum random number and current timestamp, It is the ID of node B, quantum random number and current timestamp.

[0105] Specifically, the current timestamp uses the UTC synchronized clock, and the error window is set to ±1ms; if it is detected that the current timestamp exceeds the window or the quantum random number is reused, the identity authentication is immediately terminated and an alarm is triggered.

[0106] Example 3:

[0107] Based on the master key generation method provided in Example 1, this embodiment of the present invention provides a method for negotiating a session key between peers in an ad hoc network, including the following steps:

[0108] like Figure 6 As shown, during the session key negotiation phase, the quantum random number of the node is generated by the quantum entropy source generator;

[0109] Node A generates Diffie-Hellman parameters: large prime number p, generator g, private key ;

[0110] Calculate the public key , through the master key Encrypted public key : ;

[0111] Node A will 、 Generate a key negotiation message and send it to node B. is the quantum random number of node A, is the encryption algorithm;

[0112] Node B decryption Get the public key , and calculate the session key , is the quantum random number of node B, calculate the public key , through the master key encryption key : ;

[0113] Node B will Return to node A;

[0114] Node A decryption , and calculate the session key .

[0115] The session key lifetime is set to be valid for a single communication session and will be automatically destroyed after timeout.

[0116] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0117] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0118] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0119] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0120] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for generating a master key between peers in an ad hoc network, characterized in that: include: During the node network initialization phase, the quantum random number of the node is generated by the quantum entropy source generator; The total key space is divided into a plurality of continuous intervals using an equal division mapping algorithm, each of the intervals corresponding to a preset key segment, to form a quantum key table; During the key negotiation phase, the communicating nodes extract the ID and quantum random number, and perform a composite hash operation to generate an intermediate hash value. The intermediate hash value is divided into blocks, and combined with the quantum key table to generate the master keys of the communicating nodes.

2. The method for generating a master key between peers in an ad hoc network according to claim 1, wherein: The quantum entropy source generator uses quantum noise or vacuum fluctuation of a single-photon detector as a randomness source.

3. The method for generating a master key between peers in an ad hoc network according to claim 1, wherein: The method of dividing the total key space into multiple continuous intervals by using an equal division mapping algorithm includes: Use 32-bit value space as the total key space, denoted as ; The multiple continuous intervals are divided into: Where, For the intervals, is the number of intervals.

4. The method for generating a master key between peers in an ad hoc network according to claim 1, wherein: The quantum key table is stored in a secure chip that is resistant to physical attacks, and an access control policy is set to allow only authorized processes to call the key data in the quantum key table through a secure API.

5. The method for generating a master key between peers in an ad hoc network according to claim 1, wherein: The performing of the composite hash operation to generate an intermediate hash value comprises: Assume that the two communicating parties are nodes A and B, and the ID and quantum random number of node A are and , the ID and quantum random number of node B are and ; Perform bit expansion operations on ID identification and quantum random numbers: Where, It is a fixed filling position; Input the bit expansion operation result into the national secret SM3 hash function to generate an intermediate hash value : Where, It is the national encryption SM3 hash function.

6. The method for generating a master key between peers in an ad hoc network according to claim 1, wherein: The block division of the intermediate hash value and the generation of the master keys of the communicating nodes in combination with the quantum key table include: The intermediate hash value is divided into blocks, with each 32 bits being a block, to generate a block sequence , , is the number of blocks; Calculate the index parameters for each block : Where, is the number of intervals; According to the index parameter Determine the interval it is in, obtain the preset key segment corresponding to the interval, and perform an XOR operation to obtain the master key : Where, is the master key of node A and node B, For blocks The corresponding preset key segment.

7. The method for generating a master key between peers in an ad hoc network according to claim 1, wherein: The master key is written into a non-volatile memory and a life cycle is set. When the life cycle is reached, the master key is regenerated.

8. A method for identity authentication between peers in an ad hoc network based on the master key generation method according to any one of claims 1 to 7, characterized in that: include: In the identity authentication stage, the quantum random number of the node is generated by the quantum entropy source generator; Node A sends an authentication request message to node B, which includes node A's ID, quantum random number, and current timestamp; Node B obtains the corresponding master key based on the ID of node A , generate a message authentication code through a hash algorithm , returns the message authentication code to node A , Node B’s ID, quantum random number, and current timestamp; Node A verifies the message authentication code If it is valid, a message authentication code is generated by the hash algorithm. , returns the message authentication code to node B ; Node B verifies the message authentication code If the identity verification is valid, the identity verification is completed; Among them, the message authentication code and message authentication codes for: Where, is the ID of node A, quantum random number and current timestamp, It is the ID of node B, quantum random number and current timestamp.

9. The method for identity authentication between peers in an ad hoc network according to claim 8, wherein: The current timestamp adopts the UTC synchronized clock, and the error window is set to ±1ms; if it is detected that the current timestamp exceeds the window or the quantum random number is reused, the identity authentication is immediately terminated and an alarm is triggered.

10. A method for negotiating a session key between peers in an ad hoc network based on the master key generation method according to any one of claims 1 to 7, characterized in that: include: During the session key negotiation phase, the quantum random number of the node is generated by the quantum entropy source generator; Node A generates Diffie-Hellman parameters: large prime number p, generator g, private key ; Calculate the public key , through the master key Encrypted public key : ; Node A will 、 Generate a key negotiation message and send it to node B. is the quantum random number of node A, is the encryption algorithm; Node B decryption Get the public key , and calculate the session key , is the quantum random number of node B, and the public key is calculated , through the master key encryption key : ; Node B will Return to node A; Node A decryption , and calculate the session key .

Images