Efficient and safe Internet of Vehicles authentication method
By introducing technical means such as message authentication, session key negotiation and group key update into the Internet of Vehicles, the computational bottleneck and insufficient forward security of existing solutions are solved, efficient and secure inter-vehicle communication is achieved, and the reliability and security of the system are improved.
Patent Information
- Application Number
- CN202511006463.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-22
- Publication Date
- 2025-09-12
AI Technical Summary
Existing Internet of Vehicles authentication schemes have high computational overhead in resource-constrained environments, which can easily lead to communication or computing bottlenecks. In addition, they lack forward security and are difficult to defend against attacks, affecting system efficiency and security.
An efficient and secure Internet of Vehicles authentication scheme is designed, including vehicle registration, RSU registration, identity authentication, communication, and vehicle joining/leaving phases. Data security and forward security are ensured through technical means such as message authentication code, session key negotiation, and group key update.
It achieves efficient data transmission in resource-constrained environments, resists replay attacks, message tampering and identity fraud attacks, ensures the security and privacy of inter-vehicle communications, and improves the reliability and forward security of the system.
Smart Images
Figure CN120640288A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to an identity authentication method in the field of information security, and more specifically to an efficient and secure vehicle network authentication method. Background Art
[0002] The Internet of Vehicles (IoV) refers to the use of wireless communication technologies to connect vehicles to the internet, enabling information exchange and data sharing between vehicles and with infrastructure. To ensure system security and trustworthiness, IoV authentication is a critical component. A typical Internet of Vehicles (IoV) authentication architecture consists of three key components: roadside units (RSUs), vehicles, and trusted authorities (TAs). RSUs are typically roadside infrastructure installed on roadsides, providing communication support for vehicles. Vehicles transmit and receive data using onboard units (OBUs). The TA is responsible for managing the authentication and security of audio and video systems by verifying the identity of each vehicle and facilitating communication between vehicles and infrastructure. However, due to the open wireless communication environment, the IoV requires a reliable and secure authentication and key agreement scheme to ensure that data exchanged in public channels cannot be forged or modified by adversaries. In most existing authentication schemes, vehicles are typically authenticated through an online trusted authority (TA). However, the efficiency of these centralized authentication schemes is easily affected by the TA's computational and communication bottlenecks as traffic density increases. Therefore, providing a secure authentication and key agreement protocol is crucial to ensuring the security of the IoV network.
[0003] A typical connected vehicle authentication scheme involves three types of participants: multiple vehicle gateways, a group of vehicle users, and sensor nodes distributed around vehicles and infrastructure. Because onboard gateways and sensor nodes typically have limited computing and storage resources, and connected vehicle applications require high security, authentication and key agreement protocols must be lightweight, capable of operating in resource-constrained environments, and resilient to various known attacks, such as man-in-the-middle and replay attacks. Furthermore, the authentication scheme should possess properties such as user anonymity and forward secrecy to ensure secure communication between vehicles and with the infrastructure, while guaranteeing data confidentiality, integrity, and availability. The general process for connected vehicle authentication typically includes several key steps. First, the vehicle or onboard system sends an authentication request to the onboard gateway. Next, the gateway challenges the vehicle to provide specific identity credentials. After the vehicle submits the credentials, the gateway verifies them, including checking the digital signature and certificate validity. Once verified, the gateway and vehicle undergo a secure negotiation to establish the session keys or security parameters required for encrypted communication.
[0004] Currently, existing IoV authentication schemes suffer from two serious security issues. The first is resource constraints. Most schemes rely on computationally expensive asymmetric cryptographic algorithms (such as elliptic curve cryptography (ECC)). As traffic density increases, these centralized authentication mechanisms can easily lead to communication or computational bottlenecks, impacting system efficiency. Furthermore, if the online trusted institution fails or service is interrupted, vehicles may not be able to access their data in a timely manner, placing high demands on service availability and business continuity. The second issue is insufficient forward security. Forward security ensures that even if the system's long-term key is compromised in the future, the security of previous communications will not be affected. This property is crucial in high-security scenarios. However, many existing schemes are not specifically designed to guarantee this property. Once an attacker obtains the session key or other key parameters at a certain point in time, they can back-decrypt past communications and obtain sensitive information such as vehicle location and driving behavior. Therefore, as IoV technology is increasingly applied to scenarios with higher security requirements, there is an urgent need to design a more efficient, reliable, and forward-secure authentication mechanism. Summary of the Invention
[0005] This paper designs an efficient and secure IoV authentication scheme to ensure that data exchanged on public channels cannot be forged or modified by adversaries, thus ensuring IoV data security. It implements the following six security requirements: message authentication, key agreement, forward security, resistance to replay attacks, resistance to message tampering attacks, and resistance to identity fraud attacks.
[0006] In order to achieve the above-mentioned purpose, the present invention is implemented by adopting the following technical solutions: including vehicle registration stage, RSU registration stage, identity authentication stage, communication stage, vehicle joining stage and vehicle leaving stage;
[0007] During the vehicle registration phase, the vehicle sends a registration request to the Trusted Authority (TA), which returns a registration response message containing a unique identifier and a pre-shared key, and stores the vehicle information in the list of authorized users.
[0008] In the RSU registration phase, the roadside unit (RSU) performs a registration process similar to that of the vehicle to obtain a unique identification and pre-shared key;
[0009] During the identity authentication phase, vehicles and RSUs can freely join the RSU group to share information after registration. Vehicles in the group perform mutual authentication and key negotiation based on communication requirements, ensuring the security of identity and information by calculating and verifying the message authentication code (MAC) and session key.
[0010] During the communication phase, the communication is encrypted using the negotiated session key. The sender generates a timestamp and MAC, and the receiver verifies the MAC and timestamp to ensure that the message has not been tampered with and is fresh.
[0011] During the vehicle joining phase, the new vehicle selects a trusted vehicle in the group for authentication and session key negotiation. The trusted vehicle node encrypts the identity of the new vehicle using the group key and broadcasts it to all vehicles in the group. The RSU group updates the shared key.
[0012] During the vehicle departure phase, the exiting vehicle broadcasts a departure message, other nodes discard their session keys, and the group key is updated to ensure security.
[0013] In one solution, during the vehicle registration phase, the vehicle generates a random number and appends it to the registration request to enhance the randomness and security of the registration request. When returning the registration response message, the TA also generates a random number to ensure two-way security of communication.
[0014] In one solution, during the RSU registration phase, the RSU sends a registration request along with its physical location and device information. When the TA returns a registration response message, it verifies the physical location and device information of the RSU to ensure the legitimacy and physical security of the RSU.
[0015] In one solution, during the identity authentication phase, when the vehicle generates an authentication request message, it includes a timestamp and the vehicle's digital signature to ensure the timeliness and non-repudiation of the request message. The recipient needs to synchronize the clock during verification to confirm the validity of the timestamp.
[0016] In one solution, during the communication phase, the sender adds a serial number when generating a communication message to prevent replay attacks. After verifying the MAC and timestamp, the receiver also needs to verify the continuity of the serial number to ensure the uniqueness of the message.
[0017] In one solution, during the vehicle joining phase, when a new vehicle selects a trusted vehicle for identity authentication, it first obtains the trust scores of all vehicles in the group and selects the vehicle with the highest score for authentication to improve the reliability of authentication.
[0018] In one solution, during the vehicle departure phase, the exiting vehicle appends its signature and the last communication record when broadcasting the departure message, so that other vehicles can verify the authenticity of its departure and securely update the group key.
[0019] In one solution, during the group key update process, the RSU dynamically adjusts the complexity of the group key according to the number and trust of vehicles in the current group to achieve a balance between security and computational efficiency.
[0020] Beneficial effects of the present invention:
[0021] (1) Message authentication: The receiving vehicle can check the validity of the message sent by the vehicle and ensure that the message has not been maliciously modified.
[0022] (2) Key negotiation: To facilitate secure communication between vehicles, the group key plays a vital role within the same RSU. Vehicles within the same RSU collaboratively generate a group key, which enables secret message communication between vehicles. When a vehicle joins or leaves the group, the current group key needs to be updated.
[0023] (3) Forward security. Forward security in this solution specifically refers to the technology that prevents a vehicle from accessing the current vehicle communication after leaving the group. It allows existing vehicles to leave the group and update the existing group key so that the departing vehicle cannot calculate the modified group key.
[0024] (4) Resistance to replay attacks, in which the attacker captures intermediate secure transmission information and replays it to gain unauthorized access to security keys or messages. This scheme is resistant to replay attacks.
[0025] (5) Resistance to message tampering attacks. In a message tampering attack, the attacker can modify, delete, or change specific parts of the message. The attacker makes some changes to the message to help achieve the intended attack. This scheme can resist message tampering attacks.
[0026] (6) Resist identity fraud attacks. In this type of attack, the attacker attempts to disguise themselves as a legitimate vehicle by modifying the authentication information of a legitimate vehicle. If this attack is not properly protected, the malicious vehicle may perform illegal actions and cause traffic accidents. This solution can resist identity fraud attacks. BRIEF DESCRIPTION OF THE DRAWINGS
[0027] Figure 1 It is the overall flow chart of the method of the present invention;
[0028] Figure 2 This is the pseudo code for the authentication phase;
[0029] Figure 3 Pseudocode for the communication phase. DETAILED DESCRIPTION
[0030] To facilitate understanding of the present invention, the present invention will be described more fully below with reference to the accompanying drawings. The drawings illustrate exemplary embodiments of the present invention. However, the present invention may be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and comprehensive understanding of the present invention.
[0031] Unless otherwise defined, all technical and scientific terms used herein have the same meanings as those understood by those skilled in the art to which the present invention pertains. The terms used in the present specification are for the purpose of describing specific embodiments only and are not intended to limit the present invention. To facilitate understanding of the present invention, a more comprehensive description of the present invention will be provided below with reference to the accompanying drawings. Typical embodiments of the present invention are shown in the drawings. However, the present invention may be embodied in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and comprehensive understanding of the present invention.
[0032] An efficient and secure authentication method for the connected vehicle (IoV) network. With the rapid development of IoV technology, interoperability between vehicles has become a reality. However, existing IoV authentication protocols still face significant challenges. First, IoV security demands extremely high standards, but existing authentication protocols struggle to address complex security threats. For example, key management vulnerabilities can lead to key interception or tampering by attackers, compromising the confidentiality and integrity of vehicle communications. Second, with the increasing volume of vehicle and user data, privacy protection has become a major challenge. Existing authentication protocols fail to effectively protect sensitive information such as user identity and vehicle location, exposing users to the risk of tracking or information leakage. In particular, the lack of effective privacy protection measures in information collection and sharing raises public concerns about data security, hindering the widespread adoption and development of IoV technology. Finally, IoV authentication protocols must balance security with communication efficiency. Given the current challenges of insufficient processing power in on-board devices, limited network bandwidth, and complex and volatile mobile networks, designing efficient authentication protocols requires a balance between security and performance.
[0033] To address these challenges, we have designed an efficient and secure IoV authentication scheme to ensure that data exchanged on public channels cannot be forged or modified by adversaries, thus ensuring IoV data security. This protocol aims to achieve the following six security requirements under the attacker model shown in Table 1:
[0034] Message authentication. The receiving vehicle can check the validity of the message sent by the vehicle and ensure that the message has not been maliciously modified
[0035] Key negotiation. To facilitate secure communication between vehicles within the same RSU, a group key plays a crucial role. Vehicles within the same RSU collaboratively generate a group key, which enables secret message communication between vehicles. When a vehicle joins or leaves the group, the current group key needs to be updated.
[0036] Forward security. This solution's forward security specifically refers to the technology that prevents a vehicle from accessing existing vehicles after leaving the group. It allows existing vehicles to leave the group and update the existing group key, making it impossible for the departing vehicle to calculate the modified group key.
[0037] Resistant to replay attacks. In this type of attack, an attacker captures intermediate secure transmissions and replays them to gain unauthorized access to secure keys or messages.
[0038] Resist message tampering attacks. In a message tampering attack, the attacker can modify, delete, or change specific parts of the message. The attacker makes some changes to the message to help achieve the intended attack.
[0039] Resist identity fraud attacks. In this type of attack, an attacker attempts to disguise themselves as a legitimate vehicle by modifying the legitimate vehicle's authentication information. If this attack is not properly protected, the malicious vehicle may perform illegal actions and cause traffic accidents.
[0040] Table 1: Attacker Model
[0041]
[0042] The present invention consists of three main phases: registration, authentication, and communication. When a new vehicle or a RSU wishes to communicate with another vehicle, the TA must perform the registration phase, which distributes authentication parameters. Subsequently, during the authentication phase, the RSU and vehicle can mutually authenticate and negotiate a key using prekey. Table 2 shows the notation used in the present invention.
[0043] Table 2 Symbol definitions
[0044]
[0045] The overall process of the present invention is as follows Figure 1 As shown. Vehicle registration phase: 1. Vehicle registration request message; 2. Vehicle registration response message. RSU registration phase: 3. RSU registration request message; 4. RSU registration reply message. Authentication phase and communication phase: 5. Identity verification request message and message confirmation message; 6. Authentication response message; 7. RSU broadcasts basic security message and distributes group key. Vehicle entry and vehicle departure phase: 8-9. Group key is dynamically updated to ensure security. Detailed description of the above phases can be found in Figure 1 .
[0046] Step 1: Vehicle registration
[0047] S101, Vehicle i Send a registration request to TA.
[0048] S102, after receiving the registration request message, TA returns a registration response message, including the Vehicle i Generated unique identifier and prekey, and Save in the valid user list.
[0049] Step 2: RSU registration phase
[0050] Similarly, the roadside unit RSU in the vehicle network i Perform the same process as for the vehicle entity,
[0051] And obtain a unique identification ID and pre-shared key.
[0052] Step 3: Identity authentication
[0053] After registering with TA, Vehicle i You can freely join the RSU group to share road information. Subsequently, the vehicles in the group can perform mutual authentication and key negotiation based on communication requirements. After the negotiation within the group is completed, the RSU can collect the identities of all vehicles in the current group and then generate a group key. Used to broadcast basic security information within the group. In addition, vehicles can authenticate each other through a pre-shared key. The authentication process is as follows:
[0054] S301, Identity Verification Request: The vehicle generates a random number Timestamp and calculate Then send an authentication request message to the node Vehicle j , which includes Enc1 and MAC1.
[0055] S302, Authentication Response: Vehicle j After receiving the authentication request message, first decrypt Enc1 and check Freshness, then calculate If MAC1=MAC′1, by i Authentication. Subsequently, node x j Generate random numbers Generate timestamp And calculate the session key Message Authentication Code Finally, the corresponding authentication response message is sent.
[0056] S303, Message Confirmation: Vehicle i After receiving the response message, first decrypt Enc2 to get examine The freshness of . Then calculate If MAC2 = MAC′2, the vehicle is complete. j Subsequently, Vehicle i Calculate the session key and calculate and Finally, send the corresponding confirmation message to Vehicle j .
[0057] S304、Vehicle j After receiving the confirmation message, first calculate If MAC3 = MAC′3, the message has not been tampered with. Then calculate If Enc3=Enc′3, the key negotiation is complete. Figure 2 shown.
[0058] Step 4: Communication phase
[0059] After the session key is negotiated, the session key can be used Vehicle i and Vehicle j The communication between them is encrypted, and the communication process is as follows:
[0060] S401, Vehicle i To Vehicle j Send a plaintext message m, then Vehicle i Generate timestamp and calculate and Then send a communication message to Vehicle j .
[0061] S402, Vehicle j After receiving the communication message, first calculate MAC and check whether MAC1 is equal to MAC′1, where This confirms that the message has not been tampered with. Then decrypt the message Enc1 to obtain the plaintext message and timestamp After confirming the freshness of the message, we can trust that the plaintext message is correct and valid. Figure 3 shown.
[0062] Step 5: Vehicle joining stage
[0063] Assume that vehicle Vehicle0 wants to join the RSU group. Vehicle0 can randomly select an existing trusted vehicle node in the group, such as Vehiclex Authenticate and negotiate a session key Then, the trusted vehicle node Vehicle x Use group key groupkey x Encrypt the identity of Vehicle0 and broadcast it to all vehicles in the group. After Vehicle0 joins the RSU group, the RSU group will use the formula Update the shared key within the network.
[0064] Step 6: Vehicle departure phase
[0065] Assume that vehicle Vehicle0 wants to exit the current RSU network x, then Vehicle0 broadcasts that it wants to exit, and other nodes mark And discard the session key with Vehicle0. At this point, you can use the formula to update the group key.
[0066] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).
[0067] It should be understood that the detailed description of the technical solutions of the present invention using the preferred embodiments above is illustrative and not restrictive. A person skilled in the art, after reading the present specification, may modify the technical solutions described in the embodiments or replace some of the technical features therein with equivalents; such modifications or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. An efficient and secure vehicle network authentication method, characterized by: It includes vehicle registration phase, RSU registration phase, identity authentication phase, communication phase, vehicle joining phase and vehicle leaving phase; During the vehicle registration phase, the vehicle sends a registration request to the Trusted Authority (TA), which returns a registration response message containing a unique identifier and a pre-shared key, and stores the vehicle information in the list of authorized users. In the RSU registration phase, the roadside unit (RSU) performs a registration process similar to that of the vehicle to obtain a unique identification and pre-shared key; During the identity authentication phase, vehicles and RSUs can freely join the RSU group to share information after registration. Vehicles in the group perform mutual authentication and key negotiation based on communication requirements, ensuring the security of identity and information by calculating and verifying the message authentication code (MAC) and session key. During the communication phase, the communication is encrypted using the negotiated session key. The sender generates a timestamp and MAC, and the receiver verifies the MAC and timestamp to ensure that the message has not been tampered with and is fresh. During the vehicle joining phase, the new vehicle selects a trusted vehicle in the group for authentication and session key negotiation. The trusted vehicle node encrypts the new vehicle's identity using the group key and broadcasts it to all vehicles in the group. The RSU group updates the shared key. During the vehicle departure phase, the exiting vehicle broadcasts a departure message, other nodes discard their session keys, and the group key is updated to ensure security.
2. The efficient and secure vehicle networking authentication method according to claim 1, characterized in that: During the vehicle registration phase, the vehicle generates a random number and appends it to the registration request to enhance the randomness and security of the registration request. When the TA returns the registration response message, it also generates a random number to ensure the two-way security of the communication.
3. The efficient and secure vehicle networking authentication method according to claim 1, characterized in that: In the RSU registration phase, the RSU sends a registration request with its physical location and device information. When the TA returns a registration response message, it verifies the physical location and device information of the RSU to ensure the legitimacy and physical security of the RSU.
4. The efficient and secure vehicle networking authentication method according to claim 1, characterized in that: During the identity authentication phase, when the vehicle generates an authentication request message, it includes a timestamp and the vehicle's digital signature to ensure the timeliness and non-repudiation of the request message. The recipient needs to synchronize the clock during verification to confirm the validity of the timestamp.
5. The efficient and secure vehicle networking authentication method according to claim 1, characterized in that: In the communication phase, the sender adds a serial number when generating a communication message to prevent replay attacks. After verifying the MAC and timestamp, the receiver also needs to verify the continuity of the serial number to ensure the uniqueness of the message.
6. The efficient and secure vehicle networking authentication method according to claim 1, characterized in that: In the vehicle joining phase, when a new vehicle selects a trusted vehicle for identity authentication, it first obtains the trust scores of all vehicles in the group and selects the vehicle with the highest score for authentication to improve the reliability of authentication.
7. The efficient and secure vehicle networking authentication method according to claim 1, characterized in that: During the vehicle departure phase, the exiting vehicle attaches its signature and the last communication record when broadcasting the departure message, so that other vehicles can verify the authenticity of its departure and safely update the group key.
8. The efficient and secure vehicle networking authentication method according to claim 1, characterized in that: During the group key update process, the RSU dynamically adjusts the complexity of the group key according to the number and trust of vehicles in the current group to achieve a balance between security and computational efficiency.