A blockchain-based pseudo-identity protection method for cross-domain authentication of internet of vehicles

Abstract

The application discloses a kind of blockchain-based pseudo-identity protection's cross-domain authentication method of Internet of Vehicles, comprising: vehicle user and server apply for registration to trusted agency, and by deploying multi-center registration node architecture to reduce the system pressure of centralized registration;Vehicle in the domain corresponding to the edge authentication server sends pseudonym application to the server, and the server establishes pseudonym mapping relationship and uploads to blockchain;Vehicle makes cross-domain application, and target domain authentication server verifies the legality of vehicle using pseudo-identity data recorded in blockchain to confirm its access right;Server and vehicle complete the generation of service key through negotiation, to guarantee the confidentiality and integrity of data interaction in subsequent cross-domain computing offloading process of vehicle.The application improves the scalability and trust flexibility of cross-domain authentication in Internet of Vehicles, enhances the data protection capability and identity anonymity in the process of vehicle offloading task, and realizes more efficient, safer and more private cross-domain service interaction.

Description

Technical Field

[0001] This invention belongs to the field of cross-domain vehicle networking and vehicle privacy protection technology, and in particular relates to a cross-domain authentication method for vehicle networking based on blockchain for pseudo-identity protection. Background Technology

[0002] As a key infrastructure in intelligent transportation systems, the Internet of Vehicles (IoV) is playing an increasingly important role in the modern transportation ecosystem. Through real-time data exchange and information collaboration, IoV enables drivers to optimize their decision-making, thereby significantly improving road traffic efficiency and driving safety. However, with the rapid growth in the number of vehicles and the diversification of functional requirements, issues such as privacy risks, limited computing resources, and communication bandwidth pressure are becoming increasingly prominent, severely restricting the sustainable development of in-vehicle networks. In practical applications, vehicles also need to perform identity authentication and cross-domain task offloading when moving between different areas, and complex authentication algorithms are not suitable for vehicle equipment. Furthermore, the privacy information of vehicle users is also an important factor for the reasonable and legal advancement of anonymous authentication in IoV.

[0003] Blockchain technology, due to its decentralized, immutable, and traceable characteristics, has gradually gained widespread attention in in-vehicle networks. Unlike traditional centralized systems, blockchain achieves multi-party collaboration and consensus through a distributed ledger mechanism, effectively improving the system's credibility and security. Therefore, blockchain-based in-vehicle network architectures have been proposed. Although blockchain has significant advantages in improving data transparency, ensuring information integrity, and promoting mutual trust among participants, its application in in-vehicle networks still faces many challenges, especially in handling high-frequency data interactions, dynamic vehicle access, and cross-domain authentication. How to maintain real-time system responsiveness, reduce vehicle load, and efficiently perform cross-domain authentication while ensuring data consistency and privacy protection has become a key issue in designing blockchain-based in-vehicle network architectures. Summary of the Invention

[0004] To address the aforementioned technical issues, this invention proposes a blockchain-based pseudo-identity protection method for cross-domain authentication in the Internet of Vehicles (IoV). This method helps improve the scalability and trust flexibility of cross-domain authentication in IoV, enhances data protection capabilities and identity anonymity during vehicle unloading tasks, and thus achieves more efficient, secure, and private cross-domain service interactions.

[0005] To achieve the above objectives, this invention provides a blockchain-based method for cross-domain authentication in the Internet of Vehicles (IoV) with pseudo-identity protection, comprising:

[0006] A trusted institution initializes the system's cryptographic parameters and generates a master private key and a public key;

[0007] Vehicle users submit their identity information to a trusted institution, generate vehicle registration parameters using the master private key, and complete the registration after verification using the public key.

[0008] The edge server and the compute server each generate key pairs and register them with a trusted institution.

[0009] The vehicle generates a random number and authentication message in its domain, establishes a shared key encryption binding parameter with the edge server, and sends a pseudonym request.

[0010] After verifying the pseudonym application, the edge server generates a pseudonym identifier, uploads the pseudonym mapping relationship to the blockchain, and returns an encrypted response to the vehicle.

[0011] When a vehicle enters the target domain, a cross-domain authentication request containing a pseudonym is sent to the target domain edge server;

[0012] The target domain edge server extracts pseudo-identity data from the blockchain, restores the binding parameters, and verifies the legitimacy of the request;

[0013] After cross-domain authentication is successful, the target domain edge server and computing server collaborate to generate a session key, and the vehicle generates the same session key and verifies its integrity.

[0014] Optionally, trusted authorities may initialize system password parameters including:

[0015] The trusted institution selects an elliptic curve and constructs an additive cyclic group to generate a master private key and a corresponding public key.

[0016] Select two long-term secret values ​​and calculate their hash parameters; publish the hash parameters and some public parameters, and store the remaining parameters securely.

[0017] Optional, vehicle registration includes:

[0018] A trusted institution generates a temporary key and a random number, and calculates authentication parameters and binding parameters;

[0019] A set of verification codes is generated based on the binding parameters and secret values, and the parameters are sent to the vehicle.

[0020] Registration is completed by establishing a mathematical relationship between vehicle verification and authentication parameters and the public key.

[0021] Optionally, edge servers and compute servers may register with trusted organizations, including:

[0022] The edge server generates a public-private key pair and submits it to a trusted authority;

[0023] After verification by a trusted institution, auxiliary authentication parameters containing hash parameters are returned.

[0024] Optionally, sending a pseudonym request includes:

[0025] The vehicle generates random numbers and calculates intermediate variables to construct an authentication message containing a timestamp;

[0026] The binding parameters and timestamp are encrypted using a shared key and sent to the edge server along with the pseudonym and public key.

[0027] Optionally, the pseudonym identifier generated after the edge server verifies the pseudonym application includes:

[0028] The edge server verifies the timestamp, decrypts the data, and generates a random number.

[0029] Calculate the pseudonym identifier and verification value based on random numbers and bound parameters;

[0030] Upload the pseudonym, public key, and authentication message to the blockchain.

[0031] Optionally, sending a cross-domain authentication request containing a pseudonym to the target domain edge server includes:

[0032] The target domain edge server queries historical data associated with pseudonyms in the blockchain;

[0033] Restore the bound parameters based on the public key and auxiliary parameters;

[0034] Verify the consistency between the hash of the request message and the restore parameters.

[0035] Optionally, the target domain edge server and the computing server collaborate to generate a session key, and the vehicle generates the same session key and verifies its integrity, including:

[0036] The target domain edge server calculates the session parameters and encrypts them before sending them to the computing server.

[0037] The server generates a random number after decryption, and then calculates the session key and response value.

[0038] The vehicle uses a random number to reverse-calculate the session key and verify the integrity of the response value.

[0039] Technical effects of the invention:

[0040] (1) Blockchain-based cross-domain two-way cross-domain authentication, with blockchain technology as the underlying support, keeps the interaction process between the vehicle and other regional servers anonymous and traceable, which helps to solve the problems of lightweight authentication, task offloading and single registry center load in cross-domain environment.

[0041] (2) Distributed trust architecture, which balances anonymity and traceability. Under this structure, the TA is only responsible for entity registration and does not participate in the subsequent authentication process.

[0042] (3) The anonymity mechanism protects user privacy. Anonymous authentication is achieved by generating pseudonyms by edge servers. No TA is required to participate in pseudonym management. This not only protects the privacy of vehicle identity, but also effectively reduces the vehicle's computing burden and the storage pressure on the blockchain. It is suitable for resource-constrained in-vehicle environments.

[0043] (4) The key negotiation mechanism ensures the secure transmission of information. By establishing a shared secret key between the two communicating parties through key negotiation, the confidentiality and integrity of subsequent encrypted communication data transmission are ensured, and information security can be guaranteed even on insecure channels. Attached Figure Description

[0044] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0045] Figure 1 This is a flowchart illustrating a cross-domain authentication method for vehicle networking based on blockchain for pseudo-identity protection, according to an embodiment of the present invention.

[0046] Figure 2 This is a diagram illustrating the process of a vehicle user registering with a TA according to an embodiment of the present invention;

[0047] Figure 3 This is a diagram illustrating the registration process between the authentication server ES and the TA according to an embodiment of the present invention.

[0048] Figure 4 This is a diagram illustrating the process of a vehicle user applying for a pseudonym from the authentication server ES, as described in an embodiment of the present invention.

[0049] Figure 5 This is a diagram illustrating the cross-domain request and cross-domain authentication process for vehicle users according to an embodiment of the present invention.

[0050] Figure 6 This is a diagram illustrating the key negotiation process according to an embodiment of the present invention. Detailed Implementation

[0051] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0052] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0053] Vehicle (V): Electronic devices installed on a vehicle for communication and data exchange between vehicles, between a vehicle and infrastructure, or between a vehicle and a cloud server, to enable the vehicle to be intelligent, connected and automated.

[0054] Trusted Authority (TA): A TA is a trusted authority or entity responsible for the registration and identity information management of vehicles and servers.

[0055] Edge Server (ES): ES is a server responsible for verifying user identity in authentication and access control. It can quickly and efficiently verify vehicle identity to ensure the security and data integrity of the vehicle network.

[0056] Compute Server (CS): A CS is a server responsible for executing computational tasks during computational tasks or data processing. CS typically handles tasks such as unloading vehicle tasks and performing data calculations.

[0057] like Figure 1 As shown, this embodiment provides a blockchain-based method for cross-domain authentication of vehicle networks with pseudo-identity protection, including:

[0058] A trusted institution initializes the system's cryptographic parameters and generates a master private key and a public key;

[0059] Vehicle users submit their identity information to a trusted institution, generate vehicle registration parameters using the master private key, and complete the registration after verification using the public key.

[0060] The edge server and the compute server each generate key pairs and register them with a trusted institution.

[0061] The vehicle generates a random number and authentication message in its domain, establishes a shared key encryption binding parameter with the edge server, and sends a pseudonym request.

[0062] After verifying the pseudonym application, the edge server generates a pseudonym identifier, uploads the pseudonym mapping relationship to the blockchain, and returns an encrypted response to the vehicle.

[0063] When a vehicle enters the target domain, a cross-domain authentication request containing a pseudonym is sent to the target domain edge server;

[0064] The target domain edge server extracts pseudo-identity data from the blockchain, restores the binding parameters, and verifies the legitimacy of the request;

[0065] After cross-domain authentication is successful, the target domain edge server and computing server collaborate to generate a session key, and the vehicle generates the same session key and verifies its integrity.

[0066] Specifically, this embodiment includes the following steps:

[0067] First, the system is initialized, generating system parameters. The Trusted Authority (TA) is responsible for initializing the system's basic cryptographic parameters, including generating the system's elliptic curve, basic public-private key pairs, and long-term secret values. Simultaneously, the TA defines hash functions and calculates auxiliary security parameters. Subsequently, some parameters are published publicly, while other important data is securely stored, providing foundational support for subsequent authentication.

[0068] Next, the vehicle user registers. The vehicle submits its identity information to the registration authority (TA), which generates a temporary key, binding parameters, and a set of verification parameters. After receiving these parameters, the vehicle completes local verification; if successful, registration is complete.

[0069] Next, the server registers with the TA. The server consists of an edge server (ES) and a compute server (CS), each generating its own key pair and submitting its identity and public key to the TA. The TA verifies the server's identity and returns auxiliary authentication parameters.

[0070] Next comes the pseudonym application stage. After successful registration, the vehicle first generates a random number and combines it with the information obtained during registration to generate an authentication message. Simultaneously, a shared key is established with the edge server, and some important data is encrypted before the application is sent. Upon receiving the application, the edge server first verifies the validity of the message and decrypts the vehicle's binding information. Then, it generates a new pseudonym identifier, stores the relevant information in the blockchain, and returns the processing result to the vehicle. Once the vehicle verifies the information, the pseudonym application is complete, and the vehicle obtains an anonymity certificate.

[0071] Next comes the cross-domain authentication phase. When a vehicle enters a new area, it needs to send an authentication request to the edge server of the target domain. The vehicle constructs an authentication message using the previously obtained pseudonym credentials and some authentication information. After receiving the request, the target domain edge server extracts historical registration information related to the pseudonym from the blockchain, reconstructs the vehicle's identity binding information through calculation, and verifies the authentication message. Once the verification is successful, cross-domain authentication is completed.

[0072] Finally, there is the key negotiation phase. After successful authentication, the target domain edge server collaborates with the target domain's compute server to complete the session key negotiation. The edge server first generates an authentication digest and encrypts it before sending it to the compute server. Upon receiving the digest, the compute server decrypts it, generates a random number, calculates the session key based on this number, and then returns the result to the vehicle. Upon receiving the response, the vehicle performs the corresponding reverse calculation to generate the same session key and verifies the message integrity. If verification is successful, both parties share the session key, and the vehicle can securely access services and resources within the target domain.

[0073] Furthermore, the trusted authority initializes the system's password parameters, including:

[0074] The trusted institution selects an elliptic curve and constructs an additive cyclic group to generate a master private key and a corresponding public key.

[0075] Select two long-term secret values ​​and calculate their hash parameters; publish the hash parameters and some public parameters, and store the remaining parameters securely.

[0076] Specifically, the trusted institution TA performs initialization, and TA selects a definition in the finite field F. q Elliptic curve E(F) on q ), and specify the generator P, constructing an additive cyclic group G of prime order q. Then, TA generates the master private key sk. TA PK with public key TA =sk TA To enhance system security, TA selects two long-term secret values ​​α and β, calculates hash parameters H1 = H(α) and H2 = H(α||β), publishes the hash function H, and securely stores the remaining parameters.

[0077] Furthermore, vehicle registration includes:

[0078] A trusted institution generates a temporary key and a random number, and calculates authentication parameters and binding parameters;

[0079] A set of verification codes is generated based on the binding parameters and secret values, and the parameters are sent to the vehicle.

[0080] Registration is completed by establishing a mathematical relationship between vehicle verification and authentication parameters and the public key.

[0081] Specifically, such as Figure 2 Vehicle V shown i Submit its identity to the local TA TA randomly generates a temporary key 'a' and a random number 'b'. V b TA Calculate the temporary public key A = a·P and the authentication parameter ω = a + sk TA ·h(ID Vi a) Bind parameter Ω = h(A||α), generate verification number B1 = h(Ω||h(α||β)||b V ), TA will {A, Ω, ω, B2, B3, b} TA C2} is sent to the vehicle. Vehicle verification ω·P=A+pk TA ·h(ID Vi A) After confirming whether the registration is successful, complete the registration.

[0082] Furthermore, the registration of edge servers and computing servers with trusted organizations includes:

[0083] The edge server generates a public-private key pair and submits it to a trusted authority;

[0084] After verification by a trusted institution, auxiliary authentication parameters containing hash parameters are returned.

[0085] Specifically, such as Figure 3 The edge server ES shown A Generate key pairs And submit it to TA, TA will return the parameter {b after verification. TA E1 = h(β), E2 = h(b) TA ||β)}, where E1 is the static auxiliary authentication parameter returned by TA, and E2 is the dynamic auxiliary authentication parameter returned by TA. Registration is complete. The registration process for the computing server is the same.

[0086] Furthermore, sending a pseudonym application includes:

[0087] The vehicle generates random numbers and calculates intermediate variables to construct an authentication message containing a timestamp;

[0088] The binding parameters and timestamp are encrypted using a shared key and sent to the edge server along with the pseudonym and public key.

[0089] Specifically, such as Figure 4 The vehicle shown generates random numbers d1 and d2. Combined with the previously obtained authentication parameters, the intermediate variables Z1, Z2, B′1, and C′1 are calculated. z1 associates the verification data and authentication parameters stored locally in the vehicle, z2 = h(pk) ESA ||Z1), z2 represents the vehicle's authentication data bound to the identity of a specific edge server. B′1 is used to recover the data required for verification from the parameters generated during the registration phase. C′1 is used to generate integrity verification data used in the encryption process, constructing the authentication message: m3 = h(Ω||d1||d2), where m1 is used to submit temporary authentication information and a random number to the edge server, m2 is used to submit authentication random numbers and integrity verification data to the edge server, and m3 is used to confirm that the vehicle has completed local authentication and participated in cross-domain session key generation. Subsequently, the vehicle calculates the shared key. Encrypt (Ω, T1), where T1 is a timestamp, and send a pseudonym request. Give the edge server ES A .

[0090] ES A Verify timestamp and calculate Decrypt the data, generate a random number x, and calculate the vehicle's pseudonym identifier. Temporary verification value generated by the edge server Verify the timestamp parameter ψ = h(x||T2), and... Upload to the blockchain and encrypt the response. Returned to the vehicle. The vehicle decrypts the response and then calculates... Verify whether h(x′||T′2)=ψ′ is true. If it is true, the pseudonym application is successful.

[0091] Furthermore, the pseudonym identifier generated after the edge server verifies the pseudonym application includes:

[0092] The edge server verifies the timestamp, decrypts the data, and generates a random number.

[0093] Calculate the pseudonym identifier and verification value based on random numbers and bound parameters;

[0094] Upload the pseudonym, public key, and authentication message to the blockchain.

[0095] Specifically, after the vehicle enters the target area, an authentication request is constructed. Will Send to the edge server ES of the target domain B .

[0096] Furthermore, sending a cross-domain authentication request containing a pseudonym to the target domain edge server includes:

[0097] The target domain edge server queries historical data associated with pseudonyms in the blockchain;

[0098] Restore the bound parameters based on the public key and auxiliary parameters;

[0099] Verify the consistency between the hash of the request message and the restore parameters.

[0100] Specifically, such as Figure 5 As shown in ES B Query via blockchain Corresponding data, including calculate Restore d′1 and Ω′, The system then verifies the validity of the request and whether the request (req) is correct. If the verification passes, the system proceeds to the key negotiation phase.

[0101] Furthermore, the target domain edge server collaborates with the computing server to generate a session key, and the vehicle generates the same session key and verifies its integrity, including:

[0102] The target domain edge server calculates the session parameters and encrypts them before sending them to the computing server.

[0103] The server generates a random number after decryption, and then calculates the session key and response value.

[0104] The vehicle uses a random number to reverse-calculate the session key and verify the integrity of the response value.

[0105] Specifically, such as Figure 6 After the cross-domain verification is confirmed as shown, ES B Calculate session parameters J2 is obtained by encrypting the session key EC and then sent to the computing server CS. B CS B Decrypt to obtain J′1, generate a random number y, and calculate: CS B Return the response {J3, M, T5} to the vehicle.

[0106] Calculation after vehicle receipt Generate session key SK′ CV And verify the integrity value M′=h(SK′) CV Check if ||J′1||y′) are consistent. If the verification is successful, the vehicle and the server will establish a shared key SK′. CV , for use in subsequent communication.

[0107] This blockchain-based cross-domain, two-way, cross-domain authentication uses blockchain technology as its underlying support. The interaction between vehicles and other regional servers remains anonymous and traceable, facilitating lightweight authentication, task offloading, and reducing the load on a single registry center in cross-domain environments. A distributed trust architecture balances anonymity and traceability. Under this structure, the TA (Task Agent) is only responsible for entity registration and does not participate in subsequent authentication processes. Anonymity mechanisms protect user privacy by generating pseudonyms on edge servers, eliminating the need for the TA to manage pseudonyms. This protects vehicle identity privacy while effectively reducing vehicle computational burden and blockchain storage pressure, making it suitable for resource-constrained in-vehicle environments. A key negotiation mechanism ensures secure information transmission. A shared secret key is established between the communicating parties through key negotiation, ensuring the confidentiality and integrity of subsequent encrypted data transmissions, guaranteeing information security even over insecure channels.

[0108] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A blockchain-based cross-domain authentication method for vehicle networking with pseudo-identity protection, characterized in that, Comprise: A trusted authority initializes system password parameters and generates a master private key and a public key; A vehicle user submits an identity to the trusted authority, generates vehicle registration parameters through the master private key, and completes registration after verification through the public key; An edge server and a computing server respectively generate key pairs and register with the trusted authority; A vehicle generates a random number and an authentication message in the domain, establishes a shared key with the edge server to encrypt binding parameters, and sends a pseudonym application; The edge server generates a pseudonym identifier after verifying the pseudonym application, uploads a pseudo-identity mapping relationship to a blockchain, and returns an encrypted response to the vehicle; When the vehicle enters a target domain, it sends a cross-domain authentication request containing the pseudonym identifier to the target domain edge server; The target domain edge server extracts pseudo-identity data from the blockchain, restores the binding parameters and verifies the legality of the request; After cross-domain authentication is passed, the target domain edge server and the computing server cooperate to generate a session key, and the vehicle generates the same session key and verifies the integrity, which specifically includes: The target domain edge server calculates session parameters and encrypts them and sends them to the computing server; The computing server generates a random number after decryption, calculates a session key and a response value; The vehicle reversely calculates the session key through the random number and verifies the integrity of the response value.

2. The blockchain-based pseudo-identity protected authentication method for cross-domain authentication of Internet of Vehicles according to claim 1, characterized in that, The trusted authority initializes system password parameters, which include: The trusted authority selects an elliptic curve and constructs an additive cyclic group, generates a master private key and a corresponding public key; Two long-term secret values are selected and hash parameters are calculated; the hash parameters and part of the public parameters are published, and the rest of the parameters are stored securely. 3.The blockchain-based pseudo-identity protection authentication method for V2X cross-domain authentication according to claim 1, wherein, Vehicle registration includes: The trusted authority generates a temporary key and a random number, calculates authentication parameters and binding parameters; Based on the binding parameters and secret values, a set of verification numbers is generated, and the parameters are sent to the vehicle; The vehicle verifies the mathematical relationship between the authentication parameters and the public key to complete registration.

4. The blockchain-based pseudo-identity protected authentication method for cross-domain authentication of Internet of Vehicles according to claim 1, characterized in that, The edge server and the computing server register with the trusted authority, which includes: The edge server generates a public-private key pair and submits it to the trusted authority; The trusted authority returns an auxiliary authentication parameter containing a hash parameter after verification.

5. The blockchain-based pseudo-identity protected authentication method for cross-domain authentication in V2X according to claim 1, wherein, Sending a pseudonym application includes: The vehicle generates a random number and calculates an intermediate variable, constructs an authentication message containing a timestamp; Encrypt the binding parameters and the timestamp using the shared key, and send them to the edge server together with the pseudonym identifier and the public key.

6. The blockchain-based pseudo-identity protected authentication method for cross-domain authentication of Internet of Vehicles according to claim 1, characterized in that, The edge server generates a pseudonym identifier after verifying the pseudonym application, which includes: The edge server decrypts the data after verifying the timestamp, generates a random number; Based on the random number and the binding parameters, calculate the pseudonym identifier and the verification value; Upload the pseudonym identifier, public key, and authentication message to the blockchain.

7. The blockchain-based pseudo-identity protected authentication method for cross-domain authentication of Internet of Vehicles according to claim 1, characterized in that, Sending a cross-domain authentication request containing a pseudonym identifier to the target domain edge server includes: The target domain edge server queries the historical data associated with the pseudonym identifier in the blockchain; Based on the public key and the auxiliary parameter, restore the binding parameters; Verify the consistency of the request message and the restored parameter hash.

Images