Wireless sensor network group authentication and key agreement method based on secret sharing

Abstract

The invention discloses a group authentication and key agreement method suitable for a wireless sensor network, which realizes security authentication and key agreement between a sensor node and a sink node in the wireless sensor network by using a (t-1)-order binary variable symmetric polynomial, a secret sharing technology and a Chinese remainder theorem. Specifically, the method comprises the steps of registration center initialization, sensor node registration, aggregation node registration, secret reconstruction factor collection, secret value reconstruction and authentication, session key calculation and integrity verification. According to the method, complex cryptographic operation is not needed, authentication steps are simplified, data security is enhanced, dynamic addition of a new sensor node is supported, the finally negotiated session key does not depend on a secret value recovered by a sink node, and various security risks are effectively defended. The method is suitable for wireless sensor equipment with limited resources, various attack means can be resisted, and the information security of the wireless sensor network is ensured.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a wireless sensor network group authentication and key negotiation method based on secret sharing. Background Art

[0002] Wireless sensor networks, a new type of network integrating sensing, communication, and computing, have become integrated into every aspect of our lives. From environmental monitoring to smart cities and military reconnaissance, they are ubiquitous, collecting, transmitting, and processing vast amounts of data, supporting a wide range of intelligent services. With unique advantages such as flexible deployment, wide coverage, and strong self-organization, wireless sensor networks play an irreplaceable role in various fields. However, wireless sensor networks face more serious security challenges than wired and traditional wireless networks. Firstly, the wireless communication methods, openness, harshness, and self-organization of their deployment environments make them more vulnerable to security threats such as data tampering, replay attacks, masquerading attacks, and node capture attacks. These attacks can not only lead to data leakage and tampering, but can also disrupt the normal operation of wireless sensor networks and even threaten national security and social stability. Secondly, the small size, limited resources, battery operation, and irreplaceable nature of sensor nodes make the security of wireless sensor networks particularly complex.

[0003] A wireless sensor network (WSN) is a self-organizing network composed of a large number of randomly deployed sensor nodes within a monitoring area. The sensor nodes transmit collected data hop by hop to a sink node, which aggregates and compresses the data before transmitting it to a management node via the Internet or other network communication methods. Group authentication and key agreement are key technologies for ensuring information security in WSNs. Group authentication ensures that nodes in a WSN can mutually confirm their identities, while key agreement establishes secure communication keys between nodes, thereby ensuring the confidentiality and integrity of subsequent communications.

[0004] Traditional group authentication and key agreement methods have several challenges. For example, methods based on public key certificates face certificate management issues, while methods based on bilinear pairing and elliptic curve cryptography suffer from high computational overhead, making them unsuitable for resource-constrained wireless sensor devices. Furthermore, methods based on threshold mechanisms carry the risk of multiple sensor nodes colluding or being compromised, leading to the leakage of the system's master secret and negotiated keys. Therefore, finding efficient, secure, and lightweight group authentication and key agreement methods is an urgent challenge in the field of information security. Summary of the Invention

[0005] To address the problems of existing group authentication and key agreement methods, such as high computational overhead and inability to resist physical capture attacks, replay attacks, and collusion attacks by multiple sensor nodes, this application provides a group authentication and key agreement method for wireless sensor networks based on secret sharing, which adopts the following technical solutions:

[0006] Assume that there are m sensors and 1 sink node in the group.

[0007] A wireless sensor network group authentication and key negotiation method based on secret sharing includes: registration center initialization, sensor node registration, sink node registration, collection of secret reconstruction factors, reconstruction of secret values and authentication, calculation of session keys and integrity verification.

[0008] Furthermore, the registration center is initialized, including:

[0009] The registration center is initialized, selecting a large prime number, key parameters, a t-1-order binary variable symmetric polynomial, and a hash function, and announcing the public parameters: the large prime number and the hash function;

[0010] The specific implementation method of registration center initialization is:

[0011] The registration center selects a large prime number p;

[0012] Randomly select k mutually prime positive integers n1, n2...n in the finite field GF(p) k ; Non-equal positive integers n s , c, d, r, R; t-1 degree two-variable symmetric polynomial F(x, y) = a 0,0 +a 1,0 x+a 0,1 y+a 1,1 xy+...+a t-1,t-1 x t-1 y t-1 ;in

[0013] Choose two collision-resistant hash functions on GF(p): Public p, H1, H2;

[0014] Where k represents the maximum number of sensors in the group;

[0015] n1,n2...n k They represent the registration center as the sensor node sensor i (i=1,2...k) selected identifier;

[0016] n s The identifier selected by the registration center for the sink node Sink;

[0017] c is selected by the registration center and assigned to the sensor node sensor i (i=1,2...m) and sink node Sink, used for sensor node sensor i (i=1,2...m) and the sink node Sink calculate the secret reconstruction factor;

[0018] d is selected by the registration center and assigned to the sink node Sink, which is used by the sink node to reconstruct the secret value;

[0019] r is selected by the registration center and assigned to the sensor node sensor i (i=1,2...m) and the long-term key parameters of the sink node, used for the sensor node sensor i (i=1,2...m) and the sink node Sink calculate the session key;

[0020] R is selected by the registration center and assigned to the sensor node sensor i (i=1,2...m) and the long-term key parameters of the sink node, used for the sensor node sensor i (i=1,2...m) and the sink node Sink calculate the symmetric key;

[0021] t-1 is the order of the two-variable symmetric polynomial F(x,y);

[0022] a 0,0 ,a 1,0 ,a 0,1 ...a t-1,t-1 is the coefficient of the two-variable symmetric polynomial F(x,y), a i,j =a j,i ;

[0023] x and y are two independent unknown variables;

[0024] m is the initial number of sensor nodes in the group;

[0025] {0,1} * Represents a string of any length consisting of 0s and 1s;

[0026] represents an integer from 0 to p (excluding 0 and p);

[0027] It means defining a hash function H1, where the input of H1 is a string of any length consisting of 0 and 1, and the output is an integer between 0 and p;

[0028] It means defining a hash function H2, where the input of H2 is a link of two strings of arbitrary length consisting of 0 and 1, and the output is an integer between 0 and p.

[0029] Furthermore, sensor node registration includes:

[0030] Before the sensor nodes are deployed, they register with the registration center. The registration center uses the secret sharing algorithm to assign key parameters and secret shares to the sensor nodes. The sensor nodes then store the key parameters and secret shares securely.

[0031] The specific implementation of sensor node registration is as follows:

[0032] For sensor nodes i (i=1,2...m), the registration center calculates the secret share i =F(n i ,y), the secret share and key parameters <share i ,n i ,n s ,c,r,R>Sent to sensor node sensor i ;

[0033] sensor node sensor i Received <share i ,n i ,n s ,c,r,R>, randomly select the challenge C i , calculate the response R i =PUF(C i ), using the response R i XOR encrypt the secret share and key parameters Finally, the sensor node stores {C i ,(share i ,n i ,n s ,c,r,R)'}.

[0034] Furthermore, the aggregation node registration includes:

[0035] Before the sink node is deployed, it registers with the registration center. The registration center uses the secret sharing algorithm to assign key parameters and secret shares to the sink node. The sink node stores the key parameters and secret shares securely.

[0036] The specific implementation of aggregation node registration is as follows:

[0037] For the sink node, the registration center calculates the secret share s =F(ns ,y), and calculate the hash value H = H1(F(c,d)) of the secret value F(c,d), and pass the secret share and key parameter <share through a secure channel s ,H,n1,n2...n k ,n s ,c,d,r,R>sent to the sink node Sink;

[0038] Sink receives <share s ,H,n1,n2...n k ,n s ,c,d,r,R>, randomly select the query C s , calculate the response R s =PUF(C s ), using the response R s XOR encrypt the secret share and key parameters Finally, the sink node stores {C s ,(share s ,H,n1,n2...n k ,n s ,c,d,r,R)'}.

[0039] Furthermore, collecting secret reconstruction factors includes:

[0040] The sink node applies the Chinese remainder theorem to transmit the parameters of the session key and collects the secret reconstruction factors calculated by each sensor node in the group for subsequent authentication. At the same time, it applies a t-1-order binary variable symmetric polynomial to generate a symmetric key.

[0041] The specific implementation method of collecting secret reconstruction factors is:

[0042] First, the sink node extracts {C s ,(share s ,H,n1,n2...n k ,n s ,c,d,r,R)'}, using the query C s Mapping Response R s =PUF(C s ), and then use the response R s Decrypt securely stored parameters Secondly, the sink node uses the Chinese remainder theorem to send the sensor nodes in the group i (i=1,2...m) pass the session key component parameter r s .

[0043] Furthermore, the secret value is reconstructed and authenticated, including:

[0044] After the sink node collects the secret reconstruction factors of all sensor nodes in the group, it uses the Lagrange interpolation theorem to restore the univariate polynomial, substitutes the authentication parameters into the univariate polynomial to reconstruct the secret value and verify the authenticity of the identity of each sensor node;

[0045] The specific implementation method of reconstructing the secret value and performing authentication is:

[0046] The sink node collects the secret reconstruction factor c of all sensor nodes in the group i '=F(n i ,c)(i=1,2...m), the univariate polynomial is recovered using the secret reconstruction factor and Lagrange interpolation theorem Substitute the parameter d into the polynomial F(x,c) to recover the secret value F(d,c), hash the secret value F(d,c) to obtain H'=H1(F(d,c)), and determine whether the calculated H' is equal to the stored H to verify whether the secret reconstruction is successful. If not, the authentication fails; otherwise, proceed to the next step.

[0047] Furthermore, the session key is calculated and integrity verified, including:

[0048] After authentication, each node calculates the session key using the parameters assigned by the registration center and the parameters generated and distributed by the aggregation node, verifies the integrity of the session key, and updates the key parameters after each session key negotiation is completed.

[0049] The specific implementation method of calculating the session key and verifying the integrity is as follows:

[0050] The sink node selects the current time stamp T3 and uses the long-term key parameter r and the temporary key parameter r s and timestamp T3 to calculate the session key sk = H2(r×r s || T3), hash the session key sk and timestamp T3 to obtain A3 = H2(sk|| T3);

[0051] The sink node broadcasts the message Msg = <A3, T3>;

[0052] After receiving the message Msg=<A3,T3>, each sensor node checks the freshness of T3. If it fails, it discards the data packet; otherwise, it uses the long-term key parameter r and the temporary key parameter r s and timestamp T3 to calculate sk=H2(r×r s|| T3), hash the session key sk and timestamp T3 to obtain A3'=H2(sk|| T3), and determine whether the calculated A3' is equal to the received A3. If so, the key negotiation is successful, otherwise the packet is discarded;

[0053] After each round of authentication key negotiation is completed, the sink node updates the value of r in the memory to the value of h(r) and the value of R to the value of R1; all sensor nodes in the group update the value of r in the memory to the value of h(r) and the value of R to the value of R1' to ensure that the session key sk=H2(r×r s ||T3) and symmetric key With known key security.

[0054] Furthermore, the secret sharing-based wireless sensor network group authentication and key agreement method also includes registration of newly deployed sensor nodes. That is, when a new sensor node needs to join the group, before the new sensor node is deployed, the new sensor node registers with a registration center. The registration center applies a secret sharing algorithm to assign key parameters and secret shares to the new sensor node. The new sensor node securely stores the acquired key parameters and secret shares.

[0055] Furthermore, the wireless sensor network group authentication and key agreement method based on secret sharing also includes the newly deployed sensor node applying to the sink node to join the group, that is: the new sensor node sends a request to join the group to the sink node, and after receiving the request, the sink node informs the new sensor node of the updated key parameters and simultaneously applies a t-1 order binary variable symmetric polynomial to generate a symmetric key.

[0056] This application has the following beneficial effects:

[0057] 1. The method described in this application does not require cryptographic operations with high computational overhead, such as bilinear pairing operations and elliptic curve multiplication operations, and is suitable for resource-constrained wireless sensor devices.

[0058] 2. The method described in this application uses an offline registration center, and does not require online auxiliary authentication by the registration center when the aggregation node and the sensor node perform identity authentication and key negotiation, which simplifies the authentication steps, reduces the attack surface of the adversary, and enhances data security.

[0059] 3. The method described in this application supports the dynamic addition of new sensor nodes, is scalable and flexible, and can be applied to various complex application scenarios and changing environmental conditions.

[0060] 4. The session key finally negotiated by the method described in this application does not depend on the secret value recovered by the aggregation node, which effectively prevents the risk of multiple sensor nodes colluding or being hacked to leak the system master secret and the negotiated session key.

[0061] 5. The method described in this application has mutual authentication, forward security and known key security, and can resist attacks such as internal privilege attacks, replay attacks, masquerade attacks and physical capture attacks of sensor nodes. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 This is a system architecture diagram of an embodiment of a wireless sensor network group authentication and key agreement method based on secret sharing of the present application.

[0063] Figure 2 This is a flow chart of the wireless sensor network group authentication and key negotiation method based on secret sharing in this application.

[0064] Figure 3 This is a diagram of the registration process of sensor nodes in the wireless sensor network group authentication and key agreement method based on secret sharing in this application.

[0065] Figure 4 This is a diagram of the registration process of the aggregation node in the wireless sensor network group authentication and key agreement method based on secret sharing in this application.

[0066] Figure 5 This is a message interaction diagram of the sink node and the sensor node in the authentication and key negotiation phase (including steps 4, 5, and 6) in the wireless sensor network group authentication and key negotiation method based on secret sharing of this application.

[0067] Figure 6 This is a process diagram of a sink node collecting secret values in the wireless sensor network group authentication and key agreement method based on secret sharing in this application.

[0068] Figure 7 This is a process diagram of recovering the secret computing key by the aggregation node in the wireless sensor network group authentication and key agreement method based on secret sharing of the present application.

[0069] Figure 8 This is a message interaction diagram of a newly deployed sensor applying to join a group (including steps 7 and 8) in the wireless sensor network group authentication and key agreement method based on secret sharing of this application.

[0070] Figure 9 This is a diagram of the registration process of a newly deployed sensor node in the wireless sensor network group authentication and key agreement method based on secret sharing of this application.

[0071] Figure 10 This is a process diagram of a newly deployed sensor node applying to a sink node to join a group in the wireless sensor network group authentication and key agreement method based on secret sharing in this application. DETAILED DESCRIPTION

[0072] Unless otherwise defined, all technical and scientific terms used herein have the same meanings as commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of the application are for the purpose of describing specific embodiments only and are not intended to limit this application. The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of this application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0073] The background of the present method embodiment is the wireless sensor network deployed in a nuclear power plant monitoring system. The nuclear power plant monitoring system uses the wireless sensor network to monitor key data such as radiation levels, temperature and humidity, and pipeline pressure in real time within the nuclear power plant. To prevent unauthorized device access and data leakage, the wireless sensor network group identity authentication and key agreement method described in this application is applied to improve the system's anti-attack capabilities, ensure data security, and provide a solid guarantee for the safe operation of the nuclear power plant.

[0074] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0075] like Figure 1 As shown, the system architecture of the method embodiment proposed in this application includes m wireless sensor devices, including gas sensors, radiation sensors, temperature sensors, humidity sensors, pressure sensors, and vibration sensors; a gateway device; and a trusted registration center (RC). Before deployment, each node registers with the registration center (RC) to obtain authentication parameters and secret values. The gateway device and sensor devices use these authentication parameters and secret values to implement identity authentication and key negotiation. Each sensor device regularly collects data based on its own monitoring task and encrypts this data using a negotiated group session key and sends it to the gateway. The gateway integrates and processes the data before uploading it to the management node.

[0076] The flowchart of the wireless sensor network group authentication and key agreement method based on secret sharing is as follows: Figure 2 As shown, the following steps are included:

[0077] Step S1: Registration center initialization.

[0078] In an embodiment of the present application, the registration center initialization includes: initializing the registration center, selecting a large prime number, a key parameter, a t-1 order binary variable symmetric polynomial and a hash function, and publishing public parameters: a large prime number and a hash function, wherein the large prime number is used to define a finite field, and the hash function is used to define two hash operations in the method.

[0079] The specific implementation method of registration center initialization is:

[0080] The registration center selects a large prime number p;

[0081] Randomly select k mutually prime positive integers n1, n2...n in the finite field GF(p) k ; Non-equal positive integers n s , c, d, r, R; t-1 degree two-variable symmetric polynomial F(x, y) = a 0,0 +a 1,0 x+a 0,1 y+a 1,1 xy+...+a t-1,t-1 x t-1 y t-1 ;in

[0082] Choose two collision-resistant hash functions on GF(p): Public p, H1, H2.

[0083] Where k represents the maximum number of sensors in the group;

[0084] n1,n2...n k They represent the registration center as the sensor node sensor i (i=1,2...k) selected identifier;

[0085] n s The identifier selected by the registration center for the sink node Sink;

[0086] c is selected by the registration center and assigned to the sensor node sensor i (i=1,2...m) and sink node Sink, used for sensor node sensor i (i=1,2...m) and the sink node Sink calculate the secret reconstruction factor;

[0087] d is selected by the registration center and assigned to the sink node Sink, which is used by the sink node to reconstruct the secret value;

[0088] r is the registration center selected and assigned to the sensor node sensor i (i=1,2...m) and the long-term key parameters of the sink node, used for the sensor node sensor i (i=1,2...m) and the sink node Sink calculate the session key;

[0089] R is the registration center selected and assigned to the sensor node sensori (i=1,2...m) and the long-term key parameters of the sink node, used for the sensor node sensor i (i=1,2...m) and the sink node Sink calculate the symmetric key;

[0090] t-1 is the order of the two-variable symmetric polynomial F(x,y);

[0091] a 0,0 ,a 1,0 ,a 0,1 ...a t-1,t-1 is the coefficient of the two-variable symmetric polynomial F(x,y), a i,j =a j,i ;

[0092] x and y are two independent unknown variables;

[0093] m is the initial number of sensor nodes in the group;

[0094] {0,1} * Represents a string of any length consisting of 0s and 1s;

[0095] represents an integer from 0 to p (excluding 0 and p);

[0096] It means defining a hash function H1, where the input of H1 is a string of any length consisting of 0 and 1, and the output is an integer between 0 and p;

[0097] It means defining a hash function H2, where the input of H2 is a link of two strings of arbitrary length consisting of 0 and 1, and the output is an integer between 0 and p.

[0098] In the embodiment of the present application, publishing public parameters refers to public parameters: specifically, the large prime number p and hash functions H1 and H2 selected by the registration center, p is used to define the finite field GF(p), H1 and H2 are used to define the two hash functions in the method, and the purpose of publishing the large prime number p and hash functions H1 and H2 is to allow the registration center, aggregation node and sensor node to use a consistent finite field and hash function system to facilitate subsequent authentication and key negotiation operations.

[0099] In the embodiment of the present application, a t-1 degree two-variable symmetric polynomial is used for secret sharing and reconstruction, and its symmetry is used to construct a unique symmetric key between the sink node and each sensor node.

[0100] In the embodiment of the present application, the hash function has one-way and collision resistance properties.

[0101] H1 is used in steps 3 and 5. Here, the secret F(c, d) is securely stored. The hash function H1 is used to hash it and the hash value is stored instead of F(c, d). In this way, even if the adversary captures the device and extracts the hash value, the secret F(c, d) cannot be deduced. H2 is used in step 6. The session key sk = H2 (r × r s ||T3), even if the adversary obtains the session key, it cannot infer the long-term private key r and temporary key r contained in it. s ,Collision resistance is to ensure that the session key cannot be disguised, that is, it is impossible to find different inputs to get the correct output.

[0102] Step S2: sensor node registration.

[0103] In an embodiment of the present application, sensor node registration includes: before the sensor node is deployed, the sensor node registers with a registration center, the registration center applies a secret sharing algorithm to assign key parameters and secret shares to the sensor node, and the sensor node securely stores the obtained key parameters and secret shares.

[0104] Please refer to the sensor node registration process Figure 3 , the specific implementation is:

[0105] For sensor nodes i (i=1,2...m), using the t-1 order binary variable symmetric polynomial F(x,y) and its sensor node sensor i (i=1,2...m) selected identifier n i , the registration center is the sensor node sensor i (i=1,2...m) calculate the secret share share i =F(n i ,y),share i is a one-variable polynomial. Finally, the secret share and key parameter <share are transmitted through a secure channel. i ,n i ,n s ,c,r,R>Sent to sensor node sensor i .

[0106] sensor node sensor i Received <share i ,n i ,n s ,c,r,R>, then apply the Physical Unclonable Function (PUF) to the secret share and key parameters <share i ,n i ,ns ,c,r,R> for secure storage. Physical uncloning function is a technology that uses the natural and non-replicable microscopic physical properties of hardware to generate unique identification or keys. It is widely used in hardware security, authentication and anti-counterfeiting, and is mainly used to prevent hardware devices from being forged, cloned or tampered with. PUF authenticates devices based on the "challenge-response pair" mechanism, that is, R = PUF (C). The specific steps are: sensor node sensor i Randomly select challenge C i , calculate the response R i =PUF(C i ), using the response R i XOR encrypt the secret share and key parameters Finally, the sensor node sensor i Storage i ,(share i ,n i ,n s ,c,r,R)'}.

[0107] In the embodiment of the present application, step 2 is the registration of the sensor node. The registration center allocates a secret share to the sensor node i. i =F(n i ,y),share i It is a t-1 degree univariate polynomial with two uses: ① Sensor nodes use share i Calculate the secret reconstruction factor c i =F(n i ,c), c i =F(n i ,c) is sent to the sink node to prove its identity; after the sink node collects the secret reconstruction factors of all sensor nodes, it uses the Lagrange interpolation theorem to restore F(x, c), and then substitutes d into F(x, c) to restore the secret F(x, c), calculates the hash value of the secret and compares and verifies it to determine whether the secret is successfully restored. If the secret is successfully restored, it means that the secret reconstruction factors sent by all sensor nodes are correct, indicating that the sensor node identity authentication is passed. ② Sensor node i uses share i Calculate the unique symmetric key (symmetry) between the sensor node and the sink node. i =F(n i ,y) calculation The aggregation node uses share s =F(n s ,y) calculation

[0108] In the embodiment of the present application, PUF refers to a physical unclonable function, which is a function that uses the inherent characteristics of a physical entity to generate an unpredictable and difficult-to-copy response. i and the response R i These are binary strings. Commonly used for device authentication.

[0109] In the embodiment of the present application, by using the response R i Share i ,n i ,n s ,c,r,R) for encrypted storage; storage {C i ,(share i ,n i ,n s ,c,r,R)'}, so even if the adversary captures the device and extracts these secret shares and key parameters, since there is no response R i , the adversary cannot decrypt (share i ,n i ,n s ,c,r,R)'get(share i ,n i ,n s ,c,r,R), so the adversary cannot disguise the device.

[0110] Step S3: aggregation node registration.

[0111] In an embodiment of the present application, the aggregation node registration includes: before the aggregation node is deployed, the aggregation node registers with the registration center, the registration center applies a secret sharing algorithm to assign key parameters and secret shares to the aggregation node, and the aggregation node securely stores the obtained key parameters and secret shares.

[0112] For the aggregation node registration process, please refer to Figure 4 , the specific implementation is:

[0113] For the sink node, use the t-1-order binary variable symmetric polynomial F(x,y) and its identifier n selected for the sink node s , the registration center calculates the secret share for the sink node s =F(n s ,y), and calculate the hash value H = H1(F(c,d)) of the secret value F(c,d). H is used to verify whether the secret reconstruction is successful. Finally, the secret share and key parameter <share s ,H,n1,n2...n k ,n s ,c,d,r,R>is sent to the sink node Sink.

[0114] Sink receives <share s ,H,n1,n2...n k ,n s ,c,d,r,R>, randomly select the query C s , calculate the response R s =PUF(C s ), using the response R s XOR encrypt the secret share and key parameters Finally, the sink node stores {C s ,(share s ,H,n1,n2...n k ,n s ,c,d,r,R)'}.

[0115] The sink node receives <share s ,H,n1,n2...n k ,n s ,c,d,r,R>, apply PUF to the secret share and key parameters <share s ,H,n1,n2...n k ,n s ,c,d,r,R>for secure storage.

[0116] The specific steps are as follows: The sink node randomly selects the query C s , calculate the response R s =PUF(C s ), using the response R s XOR encrypt the secret share and key parameters Finally, the sink node stores {C s ,(share s ,H,n1,n2...n k ,n s ,c,d,r,R)'}.

[0117] In the embodiment of the present application, step 3 is the aggregation node registration, and the registration center allocates the secret share to the aggregation node. s =F(n s ,y),share s is a t-1 degree polynomial in one variable.

[0118] Step S4: Collect secret reconstruction factors.

[0119] In an embodiment of the present application, collecting the secret reconstruction factor includes: the aggregation node applies the Chinese remainder theorem to transmit the session key composition parameters, and collects the secret reconstruction factors calculated by each sensor node in the group for subsequent authentication, and at the same time applies a t-1 order binary variable symmetric polynomial to generate a symmetric key.

[0120] The process of collecting secret reconstruction factors can be found in Figure 6 , the specific implementation method is: First, the sink node extracts {C s ,(share s ,H,n1,n2...n k ,n s ,c,d,r,R)'}, using the query C s Mapping Response R s =PUF(C s ), and then use the response R s Decrypt securely stored parameters Secondly, the sink node uses the Chinese remainder theorem to send the sensor nodes in the group i (i=1,2...m) pass the session key component parameter r s The specific steps are as follows: the sink node uses the identifiers n1, n2...n of each sensor node to k calculate Calculate M i Module n i The multiplicative inverse N i , so that M i ×N i ≡1modn i ,calculate Pick a random number r s and R1, so that 0<r s <n i (i=1,2...k), calculate F i =r s ×X. Finally, the sink node uses its secret share s =F(n s ,y) and sensor nodes sensor i (i=1,2...m) identifier n i Calculate the sink node and sensor node sensor i Unique symmetric key between (i=1,2...m) Select the current time stamp T1 and use the symmetric key s i F i ,T1,R1 encryption Among them, M i, X is used for the Chinese remainder theorem, M is all moduli n1,n2...n k The product of M (also the node identifier) plays a role as a reference module in the entire calculation process. i is M divided by the modulus n i The value obtained. X is M i The purpose of the entire Chinese remainder theorem is to secretly transmit key parameters to nodes within the group, and nodes outside the group cannot obtain the key parameters.

[0121] The sink node Sink encrypts the message Msg si1 =<A1,T1> is sent to the sensor node sensor through the public channel i (i=1,2...m).

[0122] sensor node sensor i (i=1,2...m) receives message Msg si1 =<A1,T1>, first check the freshness of T1, if it fails, discard the data packet; otherwise extract <C i ,(share i ,n i ,n s ,c,r,R)'>, using the query C i Mapping Response R i =PUF(C i ), and then use the response R i Decrypt securely stored parameters Secondly, the sensor node sensor i Using its secret share i =F(n i ,y) and the identifier of the sink node n s Calculate the symmetric key Use symmetric key s i 'Decrypted message After decrypting the message, check whether T1' is equal to T1 to verify the integrity of the message. If not, discard the data packet; otherwise, use your own secret share share i =F(n i ,y) Calculate the secret reconstruction factor c i =F(n i ,c), using F i ' and the Chinese remainder theorem to calculate the key parameter r s '=F i 'modn i . Select the current time stamp T2 and use the symmetric key s i 'Secret reconstruction factor c iEncrypted with timestamp T2

[0123] sensor node sensor i (i=1,2...m) Send the message Msg si2 =<A2,T2> is sent to the sink node Sink through the public channel.

[0124] The sink node receives the message Msg si2 =<A2,T2>, check the freshness of T2, if it fails, discard the data packet; otherwise, use the symmetric key s i Decrypting the message After decrypting the message, check whether T2' is equal to T2 to verify the integrity of the message. If not, discard the data packet.

[0125] In the embodiment of the present application, the specific process of step S5 and step S6 is as follows: Figure 7 As shown:

[0126] Step S5: reconstruct the secret value and perform authentication.

[0127] In an embodiment of the present application, reconstructing the secret value and performing authentication includes: after the sink node collects the secret reconstruction factors of all sensor nodes in the group, the sink node uses the Lagrange interpolation theorem to restore the univariate polynomial, substitutes the authentication parameter into the univariate polynomial to reconstruct the secret value and verify the authenticity of the identity of each sensor node;

[0128] Please refer to the process of reconstructing secret value and authenticating Figure 7 , the specific implementation is:

[0129] The sink node collects the secret reconstruction factor c of all sensor nodes in the group i '=F(n i ,c)(i=1,2...m), the univariate polynomial is recovered using the secret reconstruction factor and Lagrange interpolation theorem Substitute the parameter d into the polynomial F(x,c) to restore the secret value F(d,c), hash the secret value F(d,c) to obtain H'=H1(F(d,c)), and determine whether the calculated H' is equal to the stored H to verify whether the secret reconstruction is successful. If not, the authentication fails; otherwise, execute the next step, that is, execute step S6.

[0130] Step S6: Calculate the session key and verify the integrity.

[0131] In an embodiment of the present application, the session key is calculated and the integrity is verified, including: after authentication is passed, each node uses the parameters assigned by the registration center and the parameters generated and distributed by the aggregation node to calculate the session key, and verifies the integrity of the session key, and updates the key parameters after each session key negotiation is completed.

[0132] The specific implementation method of calculating the session key and verifying the integrity is as follows:

[0133] The sink node selects the current time stamp T3 and uses the long-term key parameter r and the temporary key parameter r s and timestamp T3 to calculate the session key sk = H2(r×r s || T3), hash the session key sk and timestamp T3 to obtain A3 = H2(sk|| T3);

[0134] The sink node broadcasts the message Msg = <A3, T3>;

[0135] After receiving the message Msg=<A3,T3>, each sensor node checks the freshness of T3. If it fails, it discards the data packet; otherwise, it uses the long-term key parameter r and the temporary key parameter r s and timestamp T3 to calculate sk=H2(r×r s || T3), hash the session key sk and timestamp T3 to obtain A3'=H2(sk|| T3), and determine whether the calculated A3' is equal to the received A3. If so, the key negotiation is successful, otherwise the packet is discarded;

[0136] After each round of authentication key negotiation is completed, the sink node updates the value of r in the memory to the value of h(r) and the value of R to the value of R1; all sensor nodes in the group update the value of r in the memory to the value of h(r) and the value of R to the value of R1' to ensure that the session key sk=H2(r×r s ||T3) and symmetric key With known key security.

[0137] In the embodiment of the present application, steps S4-S6 are a message interaction diagram between the sink node and the sensor node in the authentication and key negotiation phase, please refer to Figure 5 .

[0138] Step S7: Before the new sensor node is deployed, it registers with the registration center RC. The registration center RC applies a secret sharing algorithm to allocate key parameters and secret shares to the new sensor node. The new sensor node securely stores the acquired key parameters and secret shares.

[0139] Please refer to Figure 9, is a diagram of the registration process of a newly deployed sensor node in an embodiment of the present application, specifically as follows:

[0140] For newly deployed sensor nodes sensor p (m<p≤k), RC uses the t-1 order binary variable symmetric polynomial F(x,y) and its sensor node sensor p (m<p≤k) selected identifier n p Calculate the secret share p =F(n p ,y),share p is a one-variable polynomial. Finally, RC transmits the secret share and key parameter <share through a secure channel. p ,n p ,n s ,c>Sent to sensor node sensor p .

[0141] sensor node sensor p Received <share p ,n p ,n s ,c>, randomly select the query C p , calculate the response R p =PUF(C p ), using the response R p XOR encrypt the secret share and key parameters Storage p ,(share p ,n p ,n s ,c)'}.

[0142] In the embodiments of this application, Figure 8 Message interaction diagram for a newly deployed sensor applying to join a group (including steps S7 and S8).

[0143] In step S8, the new sensor node sends a request to join the group to the sink node. After receiving the request, the sink node informs the new sensor node of the updated authentication parameters and key parameters, and applies a t-1 order binary variable symmetric polynomial to generate a symmetric key to ensure the security of the communication channel between nodes.

[0144] Please refer to Figure 10 , is a diagram showing the process of a newly deployed sensor node applying to the aggregation node to join a group according to an embodiment of the present application, specifically as follows:

[0145] sensor node sensor p Using Question C p Mapping Response R p =PUF(Cp ), and then use the response R p Decrypt securely stored parameters sensor node sensor p Using its secret share p =F(n p ,y) and the identifier of the sink node n s Calculate the symmetric key s p =F(n p ,n s )modp. Select the current time stamp T4 and use the symmetric key s p Encrypt your own identity and timestamp Send a join group request Msg to the sink node request =<i=p,A4,T4>.

[0146] The sink node receives the request Msg request =<i=p,A4,T4>, check the freshness of T4, if it fails, discard the data packet; otherwise, use the query C s Mapping Response R s =PUF(C s ), using the response R s Decryption parameters, Retrieval ID n p , calculate the sensor node sensor using the secret share and sensor node identity p Symmetric key s between the sink node and the sink p =F(n s ,n p )modp, decrypt the message using the symmetric key. (n p ',T4')=Dec sp (A4). Determine the n obtained by decrypting the message p 'Is it equal to the retrieved n p , to authenticate the sensor node sensor p The identity of T4 is determined to determine whether T4' is equal to T4 to verify the data integrity. If not, the data packet is discarded; otherwise, the current time stamp T5 is selected and the symmetric key s is used to verify the data integrity. p Encrypt the current key parameters Send the message Msg through the public channel respond =<A5,T5>Sent to sensor node sensor p .

[0147] sensor node sensor p Received message Msg respond=<A5,T5>, check the freshness of T5, if it fails, discard the data packet; otherwise, use the symmetric key s p Decrypting the message Determine whether T5' is equal to T5 to verify data integrity. If not, discard the data packet and resend the join group request packet to the sink node; otherwise, use the query C p Mapping Response R p =PUF(C p ), and then use the response R p XOR encrypt these parameters Finally, {(r,R)'} is stored.

[0148] Obviously, the embodiments described above are only some of the embodiments of the present application, rather than all of the embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions described in the aforementioned specific embodiments, or to make equivalent replacements for some of the technical features therein. Any equivalent structure made using the contents of the present application specification and the accompanying drawings, directly or indirectly used in other related technical fields, is also within the scope of patent protection of the present application.

Claims

1. A wireless sensor network group authentication and key agreement method based on secret sharing, characterized in that: include: Registration center initialization, sensor node registration, sink node registration, collection of secret reconstruction factors, reconstruction of secret values and authentication, calculation of session keys and integrity verification.

2. The wireless sensor network group authentication and key agreement method based on secret sharing according to claim 1, characterized in that: Registration center initialization, including: The registration center is initialized, selecting a large prime number, key parameters, a t-1-order binary variable symmetric polynomial, and a hash function, and announcing the public parameters: the large prime number and the hash function; The specific implementation method of registration center initialization is: The registration center selects a large prime number p; Randomly select k mutually prime positive integers n1, n2...n in the finite field GF(p) k ; Non-equal positive integers n s , c, d, r, R; t-1 degree two-variable symmetric polynomial F(x, y) = a 0,0 +a 1,0 x+a 0,1 y+a 1,1 xy+...+a t-1,t-1 x t-1 y t-1 ;in Choose two collision-resistant hash functions on GF(p): Public p, H1, H2; Where k represents the maximum number of sensors in the group; n1,n2...n k They represent the registration center as the sensor node sensor i (i=1,2...k) selected identifier; n s The identifier selected by the registration center for the sink node Sink; c is selected by the registration center and assigned to the sensor node sensor i (i=1,2...m) and sink node Sink, used for sensor node sensor i (i=1,2...m) and the sink node Sink calculate the secret reconstruction factor; d is selected by the registration center and assigned to the sink node Sink, which is used by the sink node to reconstruct the secret value; r is selected by the registration center and assigned to the sensor node sensor i (i=1,2...m) and the long-term key parameters of the sink node, used for the sensor node sensor i (i=1,2...m) and the sink node Sink calculate the session key; R is selected by the registration center and assigned to the sensor node sensor i (i=1,2...m) and the long-term key parameters of the sink node, used for the sensor node sensor i (i=1,2...m) and the sink node Sink calculate the symmetric key; t-1 is the order of the two-variable symmetric polynomial F(x,y); a 0,0 ,a 1,0 ,a 0,1 ...a t-1,t-1 is the coefficient of the two-variable symmetric polynomial F(x,y), a i,j =a j,i ; x and y are two independent unknown variables; m is the initial number of sensor nodes in the group; {0,1} * Represents a string of any length consisting of 0s and 1s; represents an integer from 0 to p (excluding 0 and p); It means defining a hash function H1, where the input of H1 is a string of any length consisting of 0 and 1, and the output is an integer between 0 and p; It means defining a hash function H2, where the input of H2 is a link of two strings of arbitrary length consisting of 0 and 1, and the output is an integer between 0 and p.

3. The wireless sensor network group authentication and key agreement method based on secret sharing according to claim 1, characterized in that: Sensor node registration includes: Before the sensor nodes are deployed, they register with the registration center. The registration center uses the secret sharing algorithm to assign key parameters and secret shares to the sensor nodes. The sensor nodes then store the key parameters and secret shares securely. The specific implementation of sensor node registration is as follows: For sensor nodes i (i=1,2...m), the registration center calculates the secret share i =F(n i ,y), the secret share and key parameters <share i ,n i ,n s ,c,r,R>Sent to sensor node sensor i ; sensor node sensor i Received <share i ,n i ,n s ,c,r,R>, randomly select the challenge C i , calculate the response R i =PUF(C i ), using the response R i XOR encrypt the secret share and key parameters Finally, the sensor node stores {C i ,(share i ,n i ,n s ,c,r,R)'}.

4. The wireless sensor network group authentication and key agreement method based on secret sharing according to claim 1, characterized in that: Sink node registration includes: Before the sink node is deployed, it registers with the registration center. The registration center uses the secret sharing algorithm to assign key parameters and secret shares to the sink node. The sink node stores the key parameters and secret shares securely. The specific implementation of aggregation node registration is as follows: For the sink node, the registration center calculates the secret share s =F(n s ,y), and calculate the hash value H = H1(F(c,d)) of the secret value F(c,d), and pass the secret share and key parameter <share through a secure channel s ,H,n1,n2...n k ,n s ,c,d,r,R>sent to the sink node Sink; The sink node receives <share s ,H,n1,n2...n k ,n s ,c,d,r,R>, randomly select the query C s , calculate the response R s =PUF(C s ), using the response R s XOR encrypt the secret share and key parameters Finally, the sink node stores {C s ,(share s ,H,n1,n2...n k ,n s ,c,d,r,R)'}.

5. The method for group authentication and key agreement in wireless sensor networks based on secret sharing according to claim 1, characterized in that: Collecting secret reconstruction factors includes: The sink node applies the Chinese remainder theorem to transmit the parameters of the session key and collects the secret reconstruction factors calculated by each sensor node in the group for subsequent authentication. At the same time, it applies a t-1-order binary variable symmetric polynomial to generate a symmetric key. The specific implementation method of collecting secret reconstruction factors is: First, the sink node extracts {C s ,(share s ,H,n1,n2...n k ,n s ,c,d,r,R)'}, using the query C s Mapping Response R s =PUF(C s ), and then use the response R s Decrypt securely stored parameters Secondly, the sink node uses the Chinese remainder theorem to send the sensor nodes in the group i (i=1,2...m) pass the session key component parameter r s .

6. The wireless sensor network group authentication and key agreement method based on secret sharing according to claim 1, characterized in that: Reconstructing secret values and performing authentication, including: After the sink node collects the secret reconstruction factors of all sensor nodes in the group, it uses the Lagrange interpolation theorem to restore the univariate polynomial, substitutes the authentication parameters into the univariate polynomial to reconstruct the secret value and verify the authenticity of the identity of each sensor node; The specific implementation method of reconstructing the secret value and performing authentication is: The sink node collects the secret reconstruction factor c of all sensor nodes in the group i '=F(n i ,c)(i=1,2...m), the univariate polynomial is recovered using the secret reconstruction factor and Lagrange interpolation theorem Substitute the parameter d into the polynomial F(x,c) to recover the secret value F(d,c), hash the secret value F(d,c) to obtain H'=H1(F(d,c)), and determine whether the calculated H' is equal to the stored H to verify whether the secret reconstruction is successful. If not, the authentication fails; otherwise, proceed to the next step.

7. The wireless sensor network group authentication and key agreement method based on secret sharing according to claim 1, characterized in that: Calculates session keys and verifies integrity, including: After authentication, each node calculates the session key using the parameters assigned by the registration center and the parameters generated and distributed by the aggregation node, verifies the integrity of the session key, and updates the key parameters after each session key negotiation is completed. The specific implementation method of calculating the session key and verifying the integrity is as follows: The sink node selects the current time stamp T3 and uses the long-term key parameter r and the temporary key parameter r s and timestamp T3 to calculate the session key sk = H2(r×r s || T3), hash the session key sk and timestamp T3 to obtain A3 = H2(sk|| T3); The sink node broadcasts the message Msg = <A3, T3>; After receiving the message Msg=<A3,T3>, each sensor node checks the freshness of T3. If it fails, it discards the data packet; otherwise, it uses the long-term key parameter r and the temporary key parameter r s and timestamp T3 to calculate sk=H2(r×r s || T3), hash the session key sk and timestamp T3 to obtain A3'=H2(sk|| T3), and determine whether the calculated A3' is equal to the received A3. If so, the key negotiation is successful, otherwise the packet is discarded; After each round of authentication key negotiation is completed, the sink node updates the value of r in the memory to the value of h(r) and the value of R to the value of R1; all sensor nodes in the group update the value of r in the memory to the value of h(r) and the value of R to the value of R1' to ensure that the session key sk=H2(r×r s ||T3) and symmetric key With known key security.

8. The wireless sensor network group authentication and key agreement method based on secret sharing according to claim 1, characterized in that: It also includes the registration of newly deployed sensor nodes, that is: when a new sensor node needs to join the group, before the new sensor node is deployed, the new sensor node registers with the registration center, and the registration center applies the secret sharing algorithm to assign key parameters and secret shares to the new sensor node. The new sensor node will securely store the obtained key parameters and secret shares.

9. The wireless sensor network group authentication and key agreement method based on secret sharing according to claim 1, characterized in that: It also includes the newly deployed sensor node applying to the sink node to join the group, that is: the new sensor node sends a request to the sink node to apply to join the group. After receiving the request, the sink node informs the new sensor node of the updated key parameters and applies a t-1-order binary variable symmetric polynomial to generate a symmetric key.

Images