Internet of Things routing method and system based on homomorphic encryption

Abstract

The invention relates to the technical field of computer network and information security, and particularly discloses an Internet of Things routing method and system based on homomorphic encryption, a group of encryption key pairs supporting homomorphic operation are generated by using a central key management server, and a source node performs homomorphic encryption on a plaintext address by using a public key to generate a homomorphic encryption address; after an intermediate routing node receives a ciphertext data packet sent by a previous hop node, performing item-by-item homomorphic matching on a homomorphic encryption address prefix of a local routing table maintained locally and a homomorphic encryption address in the ciphertext data packet; and selecting the ciphertext identifier of the next-hop node according to the multiple matching results and the corresponding multiple ciphertext identifiers of the next-hop node, re-packaging to generate a next-hop ciphertext data packet, and continuing to forward until the next-hop ciphertext data packet reaches the target node. And each node in the network can realize path judgment and ciphertext forwarding decision on the premise of not decrypting a target address, so that network layer privacy attacks such as flow analysis, path inference and node identification can be effectively resisted.

Description

Technical Field

[0001] The present invention relates to the field of computer network and information security technologies, and in particular to an Internet of Things routing method and system based on homomorphic encryption. Background Art

[0002] With the widespread adoption of the Internet of Things (IoT), a large number of terminal devices in the network generate sensitive communication data. Traditional routing mechanisms based on plaintext address matching are prone to metadata leakage and traffic analysis attacks. Although solutions such as Virtual Private Networks (VPNs) and The Onion Router (Tor) can enhance anonymity, they generally suffer from complex deployment and high computational overhead, making them unsuitable for resource-constrained IoT environments. Homomorphic encryption (HE) enables the processing of encrypted data without decryption, providing strong privacy protection capabilities. However, existing HE technologies lack targeted routing structure design and lightweight computational optimization for network-layer applications, making it difficult to meet the dual requirements of real-time and scalability in distributed IoT networks. Therefore, an efficient routing method that combines HE mechanisms, supports homomorphic encryption address matching, and is suitable for IoT scenarios is urgently needed. Summary of the Invention

[0003] The present invention provides an Internet of Things routing method and system based on homomorphic encryption, aiming to solve the problem in existing Internet of Things networks that routing nodes must decrypt the destination address of data packets when forwarding paths, thereby exposing path metadata and being susceptible to traffic analysis.

[0004] To solve the above technical problems, the present invention provides an Internet of Things routing method based on homomorphic encryption, comprising the steps of:

[0005] The central key management server generates a set of encryption key pairs that support homomorphic operations, namely public keys and private keys; distributes the public keys to the source node and all intermediate routing nodes; the private keys are retained by the central key management server;

[0006] The source node uses the public key to perform homomorphic encryption on the plaintext address to generate a homomorphic encrypted address, and encapsulates the homomorphic encrypted address with the original data packet to form a ciphertext data packet and sends it to the intermediate routing node;

[0007] The intermediate routing node maintains a local routing table for all next-hop nodes. Each entry in the local routing table includes a homomorphically encrypted address prefix and a ciphertext identifier of the next-hop node. The homomorphically encrypted address prefix is obtained by encrypting the public key.

[0008] After receiving the ciphertext data packet sent by the previous hop node, the intermediate routing node performs homomorphic matching on the homomorphically encrypted address prefix of the local routing table maintained locally with the homomorphically encrypted address in the ciphertext data packet, obtaining multiple matching results.

[0009] The intermediate routing node selects the ciphertext identifier of the next hop node based on the multiple matching results and the corresponding ciphertext identifiers of the multiple next hop nodes, re-encapsulates the generated next hop ciphertext data packet, and continues to forward it;

[0010] The destination node receives the final forwarded ciphertext data packet and performs content parsing.

[0011] Furthermore, the source node performs homomorphic encryption on the plaintext address to generate a homomorphic encrypted address, specifically:

[0012] Split the plaintext address into multiple plaintext fields according to the prefix structure;

[0013] Use the public key to independently perform homomorphic encryption on each plaintext field to obtain multiple encrypted fields;

[0014] Concatenate multiple encrypted fields to obtain a homomorphically encrypted address.

[0015] Furthermore, the public key is used to identify the i-th plaintext field a i Perform homomorphic encryption to obtain the encrypted field C i =Enc pk (a i +δ i ), δ i Indicates the random value used for address perturbation, Enc pk (·) indicates homomorphic encryption using the public key pk.

[0016] Furthermore, the kth homomorphically encrypted address prefix is homomorphically matched with the homomorphically encrypted address in the ciphertext data packet, and the matching result is expressed as C j represents the jth ciphertext bit of the homomorphically encrypted address, p kj represents the jth ciphertext bit of the kth homomorphically encrypted address prefix, l represents the bit length of each homomorphically encrypted address or each homomorphically encrypted address prefix, Enc(p kj ) indicates that p kj Encryption, HomSub(C j ,Enc(p kj ))=C j ·Enc(-p kj ), IsZero(·) is a homomorphic Boolean function, ∧ represents an AND operation; when the homomorphic encryption address completely matches the prefix of the kth homomorphic encryption address, then Match k =1, otherwise it is encrypted 0.

[0017] Furthermore, when homomorphically matching each homomorphically encrypted address prefix with the homomorphically encrypted address in the ciphertext data packet, an address block matrix is constructed for the homomorphically encrypted address according to the splicing order of the encryption fields, and all homomorphically encrypted address prefixes are constructed into a prefix block matrix; element-level homomorphic matching is performed on the address block matrix and the prefix block matrix in parallel to generate a parallel Boolean ciphertext matrix, and then all elements in the parallel Boolean ciphertext matrix are ANDed together to obtain the final matching result.

[0018] Furthermore, the intermediate routing node selects the ciphertext identifier of the next hop node according to the multiple matching results and the corresponding ciphertext identifiers of the multiple next hop nodes. NH k is the ciphertext identifier of the next hop node of the k-th routing table entry, and K represents the number of entries contained in the local routing table of the current node.

[0019] Furthermore, each intermediate routing node maintains a local routing table RT={(P k ,NH k )|k=1,2,...,K},P k =[Enc(p k1 ),Enc(p k2 ),...,Enc(p kl )] is the homomorphic encryption address prefix of the kth routing table entry, p kj is the jth ciphertext bit of the kth homomorphically encrypted address prefix, NH k =Enc(nh k ) is the ciphertext identifier of the next hop node in the kth routing table entry; nh k represents the identifier of the next hop node in the kth routing table entry, and Enc(·) is the encryption function.

[0020] The present invention also provides an Internet of Things routing system based on homomorphic encryption, the key of which is that it includes a central key management server, a source node, multiple intermediate routing nodes and a target node;

[0021] The central key management server is used to generate a set of encryption key pairs that support homomorphic operations, namely public keys and private keys; distribute the public keys to the source node and all intermediate routing nodes; the private keys are retained by the central key management server;

[0022] The source node is used to perform homomorphic encryption on the plaintext address using the public key to generate a homomorphic encrypted address, and encapsulate the homomorphic encrypted address with the original data packet to form a ciphertext data packet and then send it to the intermediate routing node;

[0023] The intermediate routing node is used to maintain a local routing table for all next-hop nodes, where each entry in the local routing table includes a homomorphically encrypted address prefix and a ciphertext identifier of the next-hop node, and the homomorphically encrypted address prefix is obtained by encrypting the public key;

[0024] The intermediate routing node is further configured to, after receiving the ciphertext data packet sent by the previous hop node, perform homomorphic matching on a local routing table maintained locally with the homomorphically encrypted address in the ciphertext data packet, thereby obtaining multiple matching results.

[0025] The intermediate routing node is further configured to select a ciphertext identifier of a next-hop node according to the multiple matching results and the corresponding ciphertext identifiers of the multiple next-hop nodes, re-encapsulate and generate a next-hop ciphertext data packet, and continue forwarding;

[0026] The target node is used to receive the ciphertext data packet that is finally forwarded and perform content parsing.

[0027] Preferably, the source node and the intermediate routing node are deployed with a key management and initialization module, a homomorphic encryption address generation module, an encrypted routing table construction and management module, a ciphertext prefix matching and path calculation module, a next-hop node decision module, a communication interface and forwarding module, and a cache and routing acceleration module;

[0028] The key management and initialization module is used to store the public key and provide encryption parameters and public keys to the homomorphic encryption address generation module and the encryption routing table construction and management module;

[0029] The homomorphic encryption address generation module is used to split the plaintext target address into multiple address fields according to the prefix structure, call the encryption parameters to perform homomorphic encryption respectively, and splice them into a homomorphic encryption address that supports structured matching;

[0030] The encrypted routing table construction and management module is used to generate and maintain a node-local routing table, where each entry in the routing table includes a homomorphically encrypted address prefix and a ciphertext identifier of the next-hop node;

[0031] The ciphertext prefix matching and path calculation module is used to perform homomorphic matching based on the homomorphically encrypted address prefix after the intermediate routing node receives the ciphertext address, and generate multiple matching results;

[0032] The next-hop node decision module is used to call the homomorphic Boolean selector to complete the calculation of the ciphertext next-hop address according to the matching result;

[0033] The communication interface and forwarding module is used to embed the next hop ciphertext address into the data packet control field and complete the data packet forwarding according to the Internet of Things protocol encapsulation mechanism;

[0034] The cache and routing acceleration module is used to store the ciphertext matching paths and next-hop decision results hit within a preset time period, and interacts bidirectionally with the ciphertext prefix matching and path calculation module and the encrypted routing table construction and management module;

[0035] The source node and the intermediate routing node apply corresponding modules according to application requirements.

[0036] Preferably, the homomorphic encryption address generation module of the source node, the ciphertext prefix matching and path calculation module of the intermediate routing node, and the next hop node decision module of the source node and the intermediate routing node are inserted between the link layer and the network layer.

[0037] Preferably, the intermediate routing node maintains K candidate next hops for each ciphertext prefix, and dynamically selects an available path among the K candidate next hops for ciphertext forwarding according to link reachability.

[0038] The present invention provides an Internet of Things routing method and system based on homomorphic encryption. A central key management server is used to generate a set of encryption key pairs that support homomorphic operations. The source node uses the public key to perform homomorphic encryption on the plaintext address to generate a homomorphic encryption address. After receiving the ciphertext data packet sent by the previous hop node, the intermediate routing node performs homomorphic matching on the homomorphic encryption address prefix of the locally maintained local routing table with the homomorphic encryption address in the ciphertext data packet. The ciphertext identifier of the next hop node is selected based on multiple matching results and the corresponding ciphertext identifiers of multiple next hop nodes. The next hop ciphertext data packet is repackaged and generated, and is forwarded continuously until it reaches the target node. The data packet completes the entire process of being initiated from the source node, routed through multiple hops of the intermediate nodes, and finally arriving at the target node. Each node in the path does not need to decrypt the address information at all times, which greatly reduces the security risks of passive monitoring and active analysis. At the same time, it has the advantages of being lightweight, modularly integrated, and easy to deploy. It is suitable for scenarios with high privacy requirements such as edge computing nodes, wireless sensor networks, smart grids, and medical terminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a flow chart of an Internet of Things routing method based on homomorphic encryption provided by an embodiment of the present invention;

[0040] Figure 2 This is a logical diagram of ciphertext prefix matching and homomorphic next-hop calculation provided by an embodiment of the present invention;

[0041] Figure 3 This is a complete flow chart of the encrypted data packet from construction to forwarding in the Internet of Things network provided by an embodiment of the present invention;

[0042] Figure 4 This is a module deployment diagram of a source node and an intermediate routing node provided by an embodiment of the present invention;

[0043] Figure 5 It is a schematic diagram of the integration of the system and protocol stack provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] To further illustrate the technical solution of this invention, the following detailed description of the implementation process of the IoT routing method and system based on homomorphic encryption is combined with the system structure diagram and functional module relationships. The system is deployed among the source node, intermediate routing nodes, and destination node. Based on a unified key system, it completes path matching and encrypted forwarding operations without decrypting the destination address.

[0045] The embodiment of the present invention provides an Internet of Things routing method based on homomorphic encryption, such as Figure 1 As shown in the flowchart, the steps include:

[0046] The central key management server generates a set of encryption key pairs that support homomorphic operations, namely public keys and private keys; distributes the public keys to the source node and all intermediate routing nodes; the private keys are retained by the central key management server;

[0047] The source node uses the public key to perform homomorphic encryption on the plaintext address to generate a homomorphic encrypted address, and then encapsulates the homomorphic encrypted address with the original data packet to form a ciphertext data packet and send it to the intermediate routing node;

[0048] The intermediate routing node maintains a local routing table for all next-hop nodes. Each entry in the local routing table includes a homomorphically encrypted address prefix and the ciphertext identifier of the next-hop node. The homomorphically encrypted address prefix is obtained by encrypting the public key.

[0049] After receiving the ciphertext data packet sent by the previous hop node, the intermediate routing node performs homomorphic matching on the homomorphically encrypted address prefix of the local routing table maintained locally with the homomorphically encrypted address in the ciphertext data packet, obtaining multiple matching results.

[0050] The intermediate routing node selects the ciphertext identifier of the next hop node based on the multiple matching results and the corresponding ciphertext identifiers of the multiple next hop nodes, re-encapsulates the generated next hop ciphertext data packet, and continues to forward it;

[0051] The destination node receives the final forwarded ciphertext data packet and performs content parsing.

[0052] When the encrypted data packet reaches the destination node, its control header retains the encrypted structure, but the business data area can be parsed normally by the receiving application. If the destination node has the private key, it can optionally decrypt and verify the encrypted destination address for advanced functions such as path tracing, security auditing, or session tracking.

[0053] By applying this method, each node in the Internet of Things can rely on the homomorphic encryption prefix matching mechanism to implement path determination and ciphertext forwarding decisions without decrypting the target address, effectively resisting network-layer privacy attacks such as traffic analysis, path inference, and node identification.

[0054] During the system startup phase, the central key management server generates a set of encryption key pairs that support homomorphic operations, namely the public key pk and the private key sk. This embodiment uses a Paillier homomorphic encryption system that supports addition and multiplication, which satisfies:

[0055] Enc(m1+m2)=Enc(m1)·Enc(m2)

[0056] Enc(m1·λ)=Enc(m1) λ

[0057] Where: Enc(·) represents the encryption operation; m1 and m2 are different plaintexts; λ is the scalar coefficient.

[0058] The generated public key pk will be distributed to all participating nodes (all intermediate routing nodes and target nodes) for subsequent target address encryption and prefix table construction. The private key sk is retained by the center and is mainly used in special scenarios such as system auditing and address backtracking.

[0059] The source node uses the public key generated by the central key management server to perform structured encryption on the original target address field (plaintext address), specifically including the following steps:

[0060] Split the plaintext address into multiple plaintext fields according to the prefix structure;

[0061] Use the public key to independently perform homomorphic encryption on each plaintext field to obtain multiple encrypted fields;

[0062] Concatenate multiple encrypted fields to obtain a homomorphically encrypted address.

[0063] For example, the plaintext address A is split into n segments according to the prefix structure, that is, A=[a1,a2,…,a n ], each plaintext field is encrypted independently as Enc(a1), Enc(a2),…, Enc(a n ), get n encrypted fields, and finally concatenate them into a homomorphic encryption address C=[C1,...,C n ], encapsulate it into the data packet header, and get the ciphertext data packet and send it to the next routing node.

[0064] The source node addresses the i-th segment of the address field C. i Perform encryption as follows:

[0065] C i =Enc(a i,pk),i=1,2,...,n

[0066] Among them: a i Represents the i-th field (segment) of the homomorphically encrypted address, that is, the i-th bit or i-th group of bits of the target address in the structured encryption representation.

[0067] To further prevent traffic analysis attacks and path inference, the source node introduces a perturbation vector δ when generating the homomorphically encrypted address. This perturbation is additive noise selected from the homomorphically encrypted domain. The address ciphertext construction method becomes:

[0068] C i =Enc pk (a i +δ i )

[0069] Among them, δ i Indicates the random value used for address perturbation; Enc pk (·) indicates homomorphic encryption using the public key pk.

[0070] Each intermediate routing node maintains an encrypted local routing table for subsequent matching calculation and path determination, which is expressed as RT = {(P k ,NH k )|k=1,2,...,K}, K represents the number of entries in the local routing table, P k =[Enc(p k1 ),Enc(p k2 ),...,Enc(p kl )] is the homomorphic encryption address prefix of the kth routing table entry, p kj is the jth ciphertext bit of the kth homomorphically encrypted address prefix, NH k =Enc(nh k ) is the ciphertext identifier of the next hop node in the kth routing table entry; nh k represents the identifier of the next hop node in the kth routing table entry, and Enc(·) is the encryption function.

[0071] After receiving the ciphertext data packet from the source node, the intermediate routing node extracts the ciphertext address C and compares it with all the prefixes P in the local encryption routing table. k Homomorphic matching is performed item by item. The matching process is as follows Figure 2 shown.

[0072] For any prefix term P k , first perform homomorphic difference calculation on the j-th field:

[0073] D kj =C j ×Enc(-pkj )

[0074] C j Represents the j-th element of the homomorphically encrypted address vector C, that is, the j-th ciphertext bit, which is used for bit-by-bit prefix matching.

[0075] Call the IsZero(·) function on the differential result to generate the Boolean ciphertext result M kj :

[0076] M kj =IsZero(D kj )

[0077] The multi-field matching result is calculated through "homomorphic AND" to generate an indicator of whether the entire path matches:

[0078] Match k =M k1 ∧M k2 ∧...M kl .

[0079] Then, for any routing table entry (kth routing table entry), the matching operation is expressed as follows:

[0080]

[0081] If the prefix is fully matched, then Match k =1, otherwise it is encrypted 0.

[0082] Finally, for K prefixes, K matching results are obtained, forming a matching vector [Match1, Match2, ..., Match K ].

[0083] To ensure that the encrypted routing mechanism can be deployed in resource-constrained IoT terminal devices, this paper introduces multiple lightweight optimization strategies to reduce homomorphic computing overhead, compress encryption storage resources, and accelerate path selection efficiency. Specifically, the optimization strategy is to construct n ciphertext addresses and K ciphertext prefixes into a matrix form:

[0084] C batch =[C1,C2,...,C n ], P batch =[P1,P2,...,P K ]

[0085] Perform batch homomorphic differential matching and Boolean judgment to generate a parallel Boolean ciphertext matrix, improving throughput. Finally, all elements in the parallel Boolean ciphertext matrix are ANDed together to obtain the final matching result.

[0086] The present invention encodes the address field into a uniform length (such as 16 bits or 32 bits), supports addition and XOR of fixed-length ciphertext structures, facilitates data alignment when performing homomorphic operations, and reduces the number of multiplication operation levels.

[0087] Then, complete the following path selection operation to obtain:

[0088]

[0089] Of which: NH select Indicates Match-based k As a result, the next-hop homomorphic encryption address selected by the homomorphic selector function, that is, the next node to which the system forwards the encrypted data packet, is also in ciphertext form.

[0090] The above process always operates in the ciphertext space and does not involve decryption operations. The detailed process is as follows: Figure 3 As shown. After completing address encryption and first packet encapsulation, the source node sends the ciphertext data packet to the network. After any intermediate routing node receives the packet, it will iteratively run the following complete process: extract the ciphertext address field C in the packet header; query the local encryption prefix table and perform a match; the path decision module generates the next hop ciphertext address NH select The communication module is called to encapsulate the new packet header and send it to the next-hop node. After the next-hop node receives the packet, the above process repeats. This cycle continues until the destination node successfully receives and decapsulates the packet. Throughout this process, the address field remains in ciphertext, eliminating the need for nodes to parse or recover the plaintext address information, thus achieving full-path encryption and privacy protection.

[0091] It should be noted that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This embodiment is not limited here.

[0092] Corresponding to the above-mentioned Internet of Things routing method based on homomorphic encryption, this embodiment also provides an Internet of Things routing system based on homomorphic encryption, which includes a central key management server, a source node, multiple intermediate routing nodes and a target node.

[0093] Corresponding to the method, the central key management server is used to generate a set of encryption key pairs that support homomorphic operations, namely public keys and private keys; the public keys are distributed to the source node and all intermediate routing nodes; the private keys are retained by the central key management server;

[0094] The source node is used to perform homomorphic encryption on the plaintext address using the public key to generate a homomorphic encrypted address, and then encapsulate the homomorphic encrypted address with the original data packet to form a ciphertext data packet and send it to the intermediate routing node;

[0095] The intermediate routing node is used to maintain a local routing table for all next-hop nodes. Each entry in the local routing table includes a homomorphically encrypted address prefix and the ciphertext identifier of the next-hop node. The homomorphically encrypted address prefix is obtained by encrypting the public key.

[0096] The intermediate routing node is also used to perform homomorphic matching on a local routing table with the homomorphically encrypted address in the ciphertext data packet after receiving the ciphertext data packet sent by the previous hop node, thereby obtaining multiple matching results.

[0097] The intermediate routing node is also used to select the ciphertext identifier of the next hop node according to the multiple matching results and the corresponding ciphertext identifiers of the multiple next hop nodes, re-encapsulate and generate the next hop ciphertext data packet, and continue forwarding;

[0098] The destination node is used to receive the final forwarded ciphertext data packet and perform content parsing.

[0099] Preferably, Figure 5 As shown in the structural diagram, the source node and the intermediate routing node are deployed with the following functional modules: key management and initialization module, homomorphic encryption address generation module, encrypted routing table construction and management module, ciphertext prefix matching and path calculation module, next-hop node decision module, communication interface and forwarding module, cache and routing acceleration module.

[0100] Key management and initialization module, which is used to store public keys and provide encryption parameters and public keys to the homomorphic encryption address generation module and the encryption routing table construction and management module;

[0101] The key management and initialization module is used to store public keys and provide encryption parameters and public keys to the homomorphic encryption address generation module and the encryption routing table construction and management module;

[0102] The homomorphic encryption address generation module is used to split the plaintext target address into multiple address fields according to the prefix structure, call the encryption parameters to perform homomorphic encryption respectively, and splice them into a homomorphic encryption address that supports structured matching;

[0103] The encrypted routing table construction and management module is used to generate and maintain the node's local routing table. Each entry in the routing table includes a homomorphically encrypted address prefix and the ciphertext identifier of the next hop node.

[0104] The ciphertext prefix matching and path calculation module is used to perform homomorphic matching based on the homomorphically encrypted address prefix after receiving the ciphertext address at the intermediate routing node, generating multiple matching results;

[0105] The next-hop node decision module is used to call the homomorphic Boolean selector to complete the calculation of the ciphertext next-hop address based on the matching results;

[0106] The communication interface and forwarding module is used to embed the next hop ciphertext address into the data packet control field and complete the data packet forwarding according to the standard IoT protocol encapsulation mechanism set by the system;

[0107] The cache and routing acceleration module is used to store the ciphertext matching paths and next-hop decision results hit within a preset time period, and interacts bidirectionally with the ciphertext prefix matching and path calculation module and the encrypted routing table construction and management module to improve path matching efficiency and response speed.

[0108] The homomorphic encryption address generation module of the source node, the ciphertext prefix matching and path calculation module of the intermediate routing node, and the next-hop node decision module of the source node and the intermediate routing node are inserted between the link layer and the network layer. They can be implemented as intermediate mounted logic modules in the protocol stack, decoupled from the existing communication protocol, and have good protocol transparency and module integration. Figure 5 The figure shows the integration between the system of the present invention and a typical protocol stack (such as MQTT and 6LoWPAN). As can be seen, the core functional modules of the system are embedded between the link layer and the network layer, and inserted into the forwarding path in the form of plug-ins, realizing non-intrusive deployment of the protocol.

[0109] The intermediate routing node maintains K candidate next hops for each ciphertext prefix and dynamically selects an available path among the K candidate next hops for ciphertext forwarding based on link reachability, achieving path failure adaptation and dynamic reconstruction functions.

[0110] The communication interface and forwarding module supports adaptation encapsulation based on different protocol stacks (such as IPv6, 6LoWPAN, MQTT or CoAP). First, write the ciphertext address field and select Write the encapsulation field; then, call the protocol adaptation layer and select the corresponding interface function based on the node protocol stack type; finally, send the packet through the broadcast / unicast interface and call the MAC layer or PHY layer sending function to achieve wireless forwarding.

[0111] The cache and routing acceleration module interacts with the ciphertext prefix matching and path calculation module and the encrypted routing table construction and management module. This module maintains the recent hit matching pairs (C,NH select ), quickly respond to duplicate addresses without re-selecting the path, improving the forwarding efficiency of high-frequency paths.

[0112] The system is adapted to the typical IoT protocol stack deployment environment, is compatible with the 6LoWPAN protocol, the Message Queuing Telemetry Transport Protocol (MQTT), and the Constrained Application Protocol (CoAP), and supports plug-in deployment without modifying the original protocol structure.

[0113] At this point, a data packet completes the entire process from source node initiation, through multi-hop routing via intermediate nodes, to final destination node arrival. No node along the path needs to decrypt address information, achieving the design goals of privacy protection, functional integrity, protocol transparency, and strong deployability. The system architecture comprises a source node, intermediate routing nodes, and a destination node, and includes complete modules for address encryption, ciphertext matching, path decision-making, and encrypted forwarding. It boasts protocol compatibility and edge deployability, making it suitable for IoT scenarios with high privacy requirements.

[0114] In summary, the present invention provides an Internet of Things routing method and system based on homomorphic encryption, which uses a central key management server to generate a set of encryption key pairs that support homomorphic operations. The source node uses the public key to perform homomorphic encryption on the plaintext address to generate a homomorphic encryption address; after receiving the ciphertext data packet sent by the previous hop node, the intermediate routing node performs homomorphic matching on the homomorphic encryption address prefix of the locally maintained local routing table with the homomorphic encryption address in the ciphertext data packet, selects the ciphertext identifier of the next hop node according to multiple matching results and the corresponding ciphertext identifiers of multiple next hop nodes, re-encapsulates and generates the next hop ciphertext data packet, and continues to forward it until it reaches the target node. Each node in the network can rely on the homomorphic encryption prefix matching mechanism to realize path determination and ciphertext forwarding decision without decrypting the target address, effectively resisting network layer privacy attacks such as traffic analysis, path inference and node identification, and at the same time has the advantages of lightweight, modular integration, and easy deployment. It is suitable for edge computing nodes, wireless sensor networks, smart grids, medical terminals and other scenarios with high privacy requirements.

[0115] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be considered as equivalent replacement methods and are included in the scope of protection of the present invention.

Claims

1. The IoT routing method based on homomorphic encryption is characterized by: Including steps: The central key management server generates a set of encryption key pairs that support homomorphic operations, namely public keys and private keys; distributes the public keys to the source node and all intermediate routing nodes; the private keys are retained by the central key management server; The source node uses the public key to perform homomorphic encryption on the plaintext address to generate a homomorphic encrypted address, and encapsulates the homomorphic encrypted address with the original data packet to form a ciphertext data packet and sends it to the intermediate routing node; The intermediate routing node maintains a local routing table for all next-hop nodes. Each entry in the local routing table includes a homomorphically encrypted address prefix and a ciphertext identifier of the next-hop node. The homomorphically encrypted address prefix is obtained by encrypting the public key. After receiving the ciphertext data packet sent by the previous hop node, the intermediate routing node performs homomorphic matching on the homomorphically encrypted address prefix of the local routing table maintained locally with the homomorphically encrypted address in the ciphertext data packet, obtaining multiple matching results. The intermediate routing node selects the ciphertext identifier of the next hop node based on the multiple matching results and the corresponding ciphertext identifiers of the multiple next hop nodes, re-encapsulates the generated next hop ciphertext data packet, and continues to forward it; The destination node receives the final forwarded ciphertext data packet and performs content parsing.

2. The Internet of Things routing method based on homomorphic encryption according to claim 1 is characterized in that: The source node performs homomorphic encryption on the plaintext address to generate a homomorphic encrypted address, specifically: Split the plaintext address into multiple plaintext fields according to the prefix structure; Use the public key to independently perform homomorphic encryption on each plaintext field to obtain multiple encrypted fields; Concatenate multiple encrypted fields to obtain a homomorphically encrypted address.

3. The Internet of Things routing method based on homomorphic encryption according to claim 2 is characterized in that: Use the public key to encrypt the i-th plaintext field a i Perform homomorphic encryption to obtain the encrypted field C i =Enc pk (a i +δ i ), δ i Indicates the random value used for address perturbation, Enc pk (·) indicates homomorphic encryption using the public key pk.

4. The Internet of Things routing method based on homomorphic encryption according to claim 3 is characterized in that: Homomorphically match the kth homomorphically encrypted address prefix with the homomorphically encrypted address in the ciphertext data packet, and the matching result is expressed as C j represents the jth ciphertext bit of the homomorphically encrypted address, p kj represents the jth ciphertext bit of the kth homomorphically encrypted address prefix, l represents the bit length of each homomorphically encrypted address or each homomorphically encrypted address prefix, Enc(p kj ) indicates that p kj Encryption, HomSub(C j ,Enc(p kj ))=C j ·Enc(-p kj ), IsZero(·) is a homomorphic Boolean function, ∧ represents an AND operation; when the homomorphic encryption address completely matches the prefix of the kth homomorphic encryption address, then Match k =1, otherwise it is encrypted 0.

5. The Internet of Things routing method based on homomorphic encryption according to claim 4 is characterized in that: When homomorphically matching each homomorphically encrypted address prefix with the homomorphically encrypted address in the ciphertext data packet, an address block matrix is constructed for the homomorphically encrypted address according to the splicing order of the encrypted fields, and all homomorphically encrypted address prefixes are constructed into a prefix block matrix; element-level homomorphic matching is performed on the address block matrix and the prefix block matrix in parallel to generate a parallel Boolean ciphertext matrix, and then all elements in the parallel Boolean ciphertext matrix are ANDed together to obtain the final matching result.

6. The Internet of Things routing method based on homomorphic encryption according to claim 5 is characterized in that: The ciphertext identifier of the next hop node selected by the intermediate routing node based on multiple matching results and the corresponding ciphertext identifiers of multiple next hop nodes NH k is the ciphertext identifier of the next hop node of the kth routing table entry, and K represents the number of entries contained in the local routing table of the current node; Each intermediate routing node maintains a local routing table RT = {(P k ,NH k )|k=1,2,...,K},P k =[Enc(p k1 ),Enc(p k2 ),...,Enc(p kl )] is the homomorphic encryption address prefix of the kth routing table entry, p kj is the jth ciphertext bit of the kth homomorphically encrypted address prefix, NH k =Enc(nh k ) is the ciphertext identifier of the next hop node in the kth routing table entry; nh k represents the identifier of the next hop node in the kth routing table entry, and Enc(·) is the encryption function.

7. The IoT routing system based on homomorphic encryption is characterized by: It includes a central key management server, a source node, multiple intermediate routing nodes and a target node; The central key management server is used to generate a set of encryption key pairs that support homomorphic operations, namely public keys and private keys; distribute the public keys to the source node and all intermediate routing nodes; the private keys are retained by the central key management server; The source node is used to perform homomorphic encryption on the plaintext address using the public key to generate a homomorphic encrypted address, and encapsulate the homomorphic encrypted address with the original data packet to form a ciphertext data packet and then send it to the intermediate routing node; The intermediate routing node is used to maintain a local routing table for all next-hop nodes, where each entry in the local routing table includes a homomorphically encrypted address prefix and a ciphertext identifier of the next-hop node, and the homomorphically encrypted address prefix is obtained by encrypting the public key; The intermediate routing node is further configured to, after receiving the ciphertext data packet sent by the previous hop node, perform homomorphic matching on a local routing table maintained locally with the homomorphically encrypted address in the ciphertext data packet, thereby obtaining multiple matching results. The intermediate routing node is further configured to select a ciphertext identifier of a next-hop node according to the multiple matching results and the corresponding ciphertext identifiers of the multiple next-hop nodes, re-encapsulate and generate a next-hop ciphertext data packet, and continue forwarding; The target node is used to receive the ciphertext data packet that is finally forwarded and perform content parsing.

8. The IoT routing system based on homomorphic encryption according to claim 7, characterized in that: The source node and intermediate routing nodes are deployed with a key management and initialization module, a homomorphic encryption address generation module, an encrypted routing table construction and management module, a ciphertext prefix matching and path calculation module, a next-hop node decision module, a communication interface and forwarding module, and a cache and routing acceleration module; The key management and initialization module is used to store the public key and provide encryption parameters and public keys to the homomorphic encryption address generation module and the encryption routing table construction and management module; The homomorphic encryption address generation module is used to split the plaintext target address into multiple address fields according to the prefix structure, call the encryption parameters to perform homomorphic encryption respectively, and splice them into a homomorphic encryption address that supports structured matching; The encrypted routing table construction and management module is used to generate and maintain a node-local routing table, where each entry in the routing table includes a homomorphically encrypted address prefix and a ciphertext identifier of the next-hop node; The ciphertext prefix matching and path calculation module is used to perform homomorphic matching based on the homomorphically encrypted address prefix after the intermediate routing node receives the ciphertext address, and generate multiple matching results; The next-hop node decision module is used to call the homomorphic Boolean selector to complete the calculation of the ciphertext next-hop address according to the matching result; The communication interface and forwarding module is used to embed the next hop ciphertext address into the data packet control field and complete the data packet forwarding according to the Internet of Things protocol encapsulation mechanism; The cache and routing acceleration module is used to store the ciphertext matching paths and next-hop decision results hit within a preset time period, and interacts bidirectionally with the ciphertext prefix matching and path calculation module and the encrypted routing table construction and management module; The source node and the intermediate routing node apply corresponding modules according to application requirements.

9. The IoT routing system based on homomorphic encryption according to claim 8, characterized in that: The homomorphic encryption address generation module of the source node, the ciphertext prefix matching and path calculation module of the intermediate routing node, and the next hop node decision modules of the source node and the intermediate routing node are inserted between the link layer and the network layer.

10. The Internet of Things routing system based on homomorphic encryption according to claim 9, characterized in that: The intermediate routing node maintains K candidate next hops for each ciphertext prefix, and dynamically selects an available path among the K candidate next hops for ciphertext forwarding according to link reachability.

Images