PKI-to-IBC heterogeneous broadcast signcryption and key negotiation method oriented to Internet of Things communication equipment
By utilizing PKI and IBC encryption and signature technologies, a heterogeneous broadcast signature and key negotiation method was designed to address the security challenges of IoT devices in open environments, enabling secure communication and low-overhead broadcast communication between devices across different systems.
Patent Information
- Application Number
- CN202511659499.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-13
- Publication Date
- 2026-02-10
AI Technical Summary
IoT communication devices face security challenges such as message integrity, authenticity, and confidentiality in open environments. Existing solutions are difficult to meet the interconnection needs between devices across different systems, and the computation and communication overhead is relatively large.
Employing PKI and IBC encryption and signature technologies, a heterogeneous broadcast signature and key negotiation method is designed. Through asymmetric encryption, digital signature, and collision one-way hash function, the integrity, authenticity, reliability, and confidentiality of messages are protected, and one-to-many broadcast communication is supported.
It achieves interoperability across cryptographic systems, reduces computational and communication overhead, is suitable for resource-constrained IoT devices, and ensures the establishment of secure communication channels.
Smart Images
Figure CN121508808A_ABST
Abstract
Description
Technical Field
[0001] This invention is primarily aimed at IoT communication devices, involving the fields of information security and cryptography, particularly asymmetric encryption and decryption, digital signatures, broadcast communication and key negotiation technologies. In particular, it relates to a heterogeneous broadcast signature and key negotiation method that combines PKI and IBC, which can achieve secure message transmission and key negotiation in heterogeneous environments. It is applicable to IoT communication, including the secure communication needs of various communication devices such as maritime hubs, industrial IoT, and smart manufacturing. Background Technology
[0002] With the rapid development of the Internet of Things (IoT), a large number of sensing and control devices have been connected to the network, enabling increasingly frequent data exchange and sharing. These information interactions not only enhance the interoperability between devices but also drive continuous improvement in automation and intelligence levels. However, IoT communication devices are generally deployed in open environments with limited computing power, and the lack of unified protocol standards among diverse devices poses significant challenges to data security.
[0003] In the Internet of Things (IoT) environment, devices transmit operational status data, control commands, and sensing information. These messages may be subject to the following threats: (1) Incomplete messages: If messages are damaged or lost during transmission, the commands will be incomplete, weakening the collaborative control capabilities between devices. (2) Message tampering: Malicious attackers may modify the transmitted content and replace the control commands, thereby causing device control failure or even security incidents. (3) Message forgery: Attackers may forge the identity of legitimate devices, send false messages to deceive the recipient, or inject a large number of spam messages to cause network congestion. (4) Data leakage: If sensitive data is transmitted in an insecure channel, it is very easy for attackers to steal it, resulting in privacy leaks and data abuse.
[0004] Therefore, in the Internet of Things (IoT) environment, the information transmission between various devices must ensure its authenticity, integrity, and confidentiality to prevent attacks and information leaks by malicious adversaries. Current security measures for networked devices can guarantee the reliability, authenticity, integrity, and confidentiality of data through encryption and digital signatures. However, these solutions have the following main shortcomings: 1. Limitations of a single cryptographic system: Most solutions are based on a single PKI or IBC system, which is insufficient to meet the interconnection needs between devices across different systems. 2. Lack of efficient broadcast mechanisms: Most existing solutions are point-to-point communication modes, which cannot meet the "one-to-many" broadcast message transmission requirements in IoT scenarios. 3. High computational and communication overhead: Many solutions rely on complex operations such as bilinear pairing, resulting in a heavy computational burden on the device side, which is not conducive to deployment on resource-constrained terminal devices. Summary of the Invention
[0005] To address the aforementioned issues and meet application requirements, this invention provides a heterogeneous broadcast signature and key negotiation method for PKI to IBC communication devices in the Internet of Things (IoT) communication field. By employing technologies such as asymmetric encryption, digital signatures, and collisional one-way hash functions, a heterogeneous broadcast signature and key negotiation method is designed to ensure the integrity, authenticity, reliability, unforgeability, and confidentiality of messages transmitted in open networks.
[0006] According to one aspect of this specification, a method for PKI to IBC heterogeneous broadcast signature encryption and key negotiation for Internet of Things (IoT) communication devices is provided, applied to a data collection base station, the method comprising: Obtain parameters released by the registration management agency, including but not limited to the system public key and related hash functions; Obtain a digital certificate from a registration authority through a PKI mechanism; The message is signed and sent to multiple devices simultaneously using a broadcast mechanism; The receiving terminal sensing device verifies the integrity and source legitimacy of the message using its own key. The terminal sensing device obtains the private key and public key reconstruction factor through the IBC mechanism. Based on the received information, a shared session key is generated in collaboration with the terminal sensing device to establish a secure communication channel.
[0007] As a further technical solution, messages are signed and encrypted based on a broadcast mechanism and sent simultaneously to multiple devices, including: The data collection base station reconstructs the public key of the terminal sensing device that needs to be sent. ,in ; The data collection base station selects a random number. ,calculate Then calculate the signature. and , in, , Indicates the current timestamp; Data collection base station calculation polynomial of degree ,in and They represent taking and x-coordinate Let the coefficients of the polynomial be denoted as and the set of coefficients be denoted as . ; Data collection base station is set to signature Then broadcast Give Each terminal sensing device.
[0008] As a further technical solution, during the system initialization phase, the registration management agency generates elliptic curve parameters and the system master key, and publishes system parameters, including but not limited to the system public key and related hash functions.
[0009] According to one aspect of this specification, a method for PKI to IBC heterogeneous broadcast signature encryption and key negotiation for Internet of Things (IoT) communication devices is provided, applied to terminal sensing devices, the method comprising: Obtain parameters released by the registration management agency, including but not limited to the system public key and related hash functions; The private key and public key reconstruction factor are obtained from the registry through the IBC mechanism; The receiving data collection base station signs and broadcasts messages to multiple devices simultaneously based on a broadcast mechanism. The data collection base station obtains a digital certificate through a PKI mechanism. Use its own key to verify message integrity and source legitimacy; After successful verification, a shared session key is generated in collaboration with the data collection base station to establish a secure communication channel.
[0010] As a further technical solution, the private key and public key reconstruction factor are obtained from the registry authority through the IBC mechanism, including: Send identity token To the registration management agency, among which Used to distinguish different terminal sensing devices and ; Receive identity verification from the registration management agency After the validity of the key is verified, the private key and public key reconstruction factor are calculated and sent.
[0011] As a further technical solution, the integrity and source legitimacy of messages are verified using the user's own key, including: After receiving the message, the terminal sensing device SDi checks the timestamp. The effectiveness; timestamp When valid, it utilizes the terminal sensing device's own private key. ,calculate , The public key for the data collection base station, This is to identify the device. Using anti-collision hash functions The hash value obtained after mapping; SDi extraction from terminal sensing devices The x-coordinate is denoted as , through calculation To recover to further obtain ,in, The superscript represents the coefficients of the polynomial. Indicates exponentiation; Terminal sensing devices verify equations Whether it holds true or not is used to verify the authenticity and completeness of the message source, where G represents the group element. Req represents the shared point calculated by the data collection base station, and Req represents the key negotiation request. H1 and H2 represent hash functions, respectively, and represent digital certificates.
[0012] As a further technical solution, if the equation holds true, it indicates that the message was sent by the data collection base station CS and the message is complete, and the process continues to the next stage; otherwise, it terminates.
[0013] According to one aspect of this specification, a PKI to IBC heterogeneous broadcast signature and key negotiation system for Internet of Things (IoT) communication devices is provided, applied to a data collection base station, the system comprising: The first acquisition module is used to acquire parameters released by the registration management agency, including but not limited to the system public key and related hash functions; The first registration module is used to obtain digital certificates from the registration management authority through the PKI mechanism; The signature module is used to signature messages based on a broadcast mechanism and send them to multiple devices simultaneously. The first key negotiation module is used to respond to the terminal sensing device after it has verified the integrity and source legitimacy of the message using its own key, and to work with the terminal sensing device to generate a shared session key and establish a secure communication channel. The terminal sensing device obtains the private key and public key reconstruction factor through the IBC mechanism.
[0014] According to one aspect of this specification, a PKI to IBC heterogeneous broadcast signature encryption and key negotiation system for Internet of Things (IoT) communication devices is provided, applied to terminal sensing devices, the system comprising: The second acquisition module is used to acquire parameters released by the registration management agency, including but not limited to the system public key and related hash functions; The second registration module is used to obtain the private key and public key reconstruction factor from the registration management authority through the IBC mechanism; The decryption module is used to receive messages that the data collection base station decrypts based on a broadcast mechanism and sends to multiple devices simultaneously. It uses its own key to verify the integrity and legitimacy of the message source. The data collection base station obtains a digital certificate through a PKI mechanism. The second key negotiation module is used to work with the data collection base station to generate a shared session key and establish a secure communication channel after successful verification.
[0015] According to one aspect of the present invention, a PKI to IBC heterogeneous broadcast signature and key negotiation system for Internet of Things (IoT) communication devices is provided, comprising a registration management agency, a data collection base station, and multiple terminal sensing devices. The registration management agency is connected to the data collection base station and the multiple terminal sensing devices respectively. The data collection base station is used to execute the steps of a method applied to the data collection base station, and the terminal sensing devices are used to execute the steps of a method applied to the terminal sensing devices.
[0016] According to one aspect of the present invention, a non-transitory computer-readable storage medium is provided, the non-transitory computer-readable storage medium storing computer instructions that cause the computer to perform the method described herein.
[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: (1) Heterogeneous communication: Supports secure interaction between devices in PKI and IBC systems, realizes interoperability across cryptographic systems, and adapts to the heterogeneous deployment needs of different devices in the Internet of Things.
[0018] (2) Broadcast communication: It achieves efficient broadcast signature encryption through polynomial construction, supports one-to-many message distribution, reduces redundant calculation and transmission overhead, and is suitable for large-scale Internet of Things environments.
[0019] (3) Key negotiation: Based on signing and designing, an efficient key negotiation mechanism is introduced to enable the data collection base station and the terminal sensing device to establish a session key, thereby building a secure communication channel and ensuring the confidentiality and reliability of subsequent data exchange.
[0020] (4) Low computational overhead: This solution avoids the use of bilinear pairing operations and adopts an efficient computation method on elliptic curves, which significantly reduces the computational complexity of the signing and designing process, making it more suitable for deployment of IoT communication devices with limited resources. Attached Figure Description
[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0022] Figure 1 This is a schematic diagram of the architecture of the PKI to IBC heterogeneous broadcast signature and key negotiation method for IoT communication devices provided in an embodiment of the present invention.
[0023] Figure 2This is a flowchart illustrating the PKI to IBC heterogeneous broadcast signature and key negotiation method for IoT communication devices provided in an embodiment of the present invention.
[0024] Figure 3 This is a schematic diagram illustrating the information interaction of a PKI to IBC heterogeneous broadcast signature and key negotiation method for IoT communication devices provided in an embodiment of the present invention. Detailed Implementation
[0025] To address the security threats, application requirements, and shortcomings of existing solutions in current technologies, this invention proposes a PKI-to-IBC heterogeneous broadcast signature and key negotiation method for IoT communication devices, utilizing PKI and IBC encryption and signature technologies. This method satisfies the protection of message integrity, authenticity, reliability, and confidentiality between heterogeneous IoT communication devices, thereby improving the security of communication between devices.
[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. In addition, the technical features of the various embodiments or individual embodiments provided by the present invention can be arbitrarily combined to form new technical solutions. Such combinations are not bound by the order of steps and / or structural composition patterns, but must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.
[0027] This invention provides a method for heterogeneous broadcast signature encryption and key negotiation from PKI to IBC for Internet of Things (IoT) communication devices. Figure 1 Taking the architecture as an example, the entities involved include a Registration Authority (RA), a Collection Station (CS), and multiple Sensing Devices (SDi). Used to distinguish different terminal sensing devices.
[0028] The PKI to IBC heterogeneous broadcast signature and key negotiation method for IoT communication devices described in this embodiment is applied to a data collection base station, such as... Figure 2 and 3As shown, it mainly includes six stages: system initialization stage, data collection base station registration stage, terminal sensing device registration stage, heterogeneous signature encryption stage, designification stage, and key negotiation stage. The descriptions of each stage are as follows:
[0029] Phase 1: System Initialization Phase Step 1: The registration management agency selects four large integers. , , , Let the elliptic curve be defined, and its equation be... ,in , Belongs to the set of finite fields .remember For an infinitely distant point, the group Represented as .
[0030] Step 2: The registration management agency in the group Randomly select a group element Use this as the base point, and then select a random number. As the system master key, calculate This serves as the system's master public key. Four collision-resistant hash functions are defined. , , and , respectively defined as , , , ,in, Represents a 01 string of any length. Represents 0 to The positive integer group, This indicates a mapping relationship.
[0031] Step 3: The registration management agency sets up and publishes system parameters. At the same time, the system's master private key is secretly stored. .
[0032] Phase 2: Data collection base station registration (part of the PKI system) Step 1: The data collection base station selects a random number. As its private key, the corresponding public key is calculated as follows: Subsequently, the data collection base station sends an identification identifier. and public key Give it to the registration management agency.
[0033] Step 2: After receiving the identity and public key of the data collection base station, the registration management agency checks the legality of the identity and public key. If both are legal, proceed to the next step; otherwise, terminate.
[0034] Step 3: The registration management agency generates digital certificates for the data collection base stations. And send it to the data collection base station, where .
[0035] Phase 3: Registration of terminal sensing devices (belonging to the IBC system) Step 1: Each terminal sensing device (SDi) sends its identity identifier. To the registration management agency, among which Used to distinguish different terminal sensing devices and .
[0036] Step 2: Receive the identity identifier of the terminal sensing device SDi Afterwards, the registration authority checks the identity documents. The validity of the application will be verified; if valid, proceed to the next step; otherwise, rejection will be imposed.
[0037] Step 3: The registration management agency selects a random number. , calculate In addition, the registration authority (RA) calculates... As an auxiliary factor for public key reconstruction of terminal sensing device SDi.
[0038] Step 4: The registration management agency sends the information confidentially. Provide the terminal sensing device's SDi as its private key, and expose the public key reconstruction factor of the terminal sensing device's SDi. In this way, any device can obtain the public key of the terminal sensing device's SDi by reconstructing it. .
[0039] Phase 4: Heterogeneous Signature Phase Assuming the data collection base station wants to... A terminal sensing device initiates a key negotiation request. Perform the following steps: Step 1: The data collection base station needs to reconstruct the public key of the terminal sensing device to be transmitted. ,in , This is to identify the device. Using anti-collision hash functions The hash value obtained after mapping.
[0040] Step 2: The data collection base station selects a random number. Calculate shared points Then calculate the signature. and ,in, , This represents the current timestamp.
[0041] Step 3: Data collection base station calculation polynomial of degree ,in and They represent taking and x-coordinate Let the coefficients of the polynomial be denoted as and the set of coefficients be denoted as . .
[0042] Step 4: Set the signature of the data collection base station. Then broadcast Give Each terminal sensing device.
[0043] Phase 5: Deciphering the Secret Step 1: After receiving the message, the terminal sensing device SDi first checks the timestamp. The validity of the timestamp is checked; if the timestamp has expired, the process terminates; otherwise, proceed to the next step.
[0044] Step 2: The terminal sensing device SDi uses its own private key ,calculate .
[0045] Step 3: Extracting SDi from Terminal Sensing Devices The x-coordinate is denoted as , through calculation To recover Further access is possible .
[0046] Step 4: The terminal sensing device can verify the equation The system checks whether the equation holds true to verify the authenticity and completeness of the message source. If the equation holds true, it means the message was indeed sent by the data collection base station CS and is complete, allowing the system to proceed to the next stage; otherwise, the process terminates.
[0047] Phase 6: Key Negotiation Step 1: The terminal sensing device SDi selects a random number. Calculate the session key as Continue calculating Send to the data collection base station CS.
[0048] Step 2: Data collection base station receives Then, calculate the session key with the terminal sensing device SDi. The method is .
[0049] Through the above methods, the data collection base station (CS) can use session keys. It establishes a secure channel with the corresponding terminal sensing device SDi to conduct secure communication and achieve data confidentiality protection.
[0050] Based on the same inventive concept as the aforementioned method embodiments, this invention also provides a PKI to IBC heterogeneous broadcast signature encryption and key negotiation method for IoT communication devices. This method is applied to terminal sensing devices and includes: obtaining parameters published by a registration management agency, including but not limited to the system public key and related hash functions; obtaining a private key and public key reconstruction factor from the registration management agency through the IBC mechanism; receiving a message that a data collection base station signs and broadcasts simultaneously to multiple devices based on a broadcast mechanism, wherein the data collection base station obtains a digital certificate through the PKI mechanism; verifying the integrity and source legitimacy of the message using its own key; and, after successful verification, collaboratively generating a shared session key with the data collection base station to establish a secure communication channel.
[0051] The implementation of the various embodiments of the present invention is based on programmed processing by a device with processor functionality. Therefore, in practical engineering, the technical solutions and functions of the various embodiments of the present invention are encapsulated into various modules. Based on this reality, and building upon the above embodiments, the present invention also provides a PKI to IBC heterogeneous broadcast signature and key negotiation system for IoT communication devices applied to data collection base stations. This system is used to execute the PKI to IBC heterogeneous broadcast signature and key negotiation method for IoT communication devices applied to data collection base stations in the above method embodiments.
[0052] The system includes: a first acquisition module for acquiring parameters released by the registration management authority, including but not limited to the system public key and related hash functions; a first registration module for obtaining a digital certificate from the registration management authority through a PKI mechanism; a signature module for signing messages based on a broadcast mechanism and sending them simultaneously to multiple devices; and a first key negotiation module for, in response to the terminal sensing device verifying the integrity and source legitimacy of the message using its own key, cooperating with the terminal sensing device to generate a shared session key and establish a secure communication channel, wherein the terminal sensing device obtains the private key and public key reconstruction factor through an IBC mechanism.
[0053] Based on the same inventive concept as any of the foregoing embodiments, embodiments of the present invention provide a PKI to IBC heterogeneous broadcast signature and key negotiation system for IoT communication devices applied to terminal sensing devices. This system is used to execute the PKI to IBC heterogeneous broadcast signature and key negotiation method for IoT communication devices applied to terminal sensing devices in the above method embodiments.
[0054] The system includes: a second acquisition module for acquiring parameters published by the registration management authority, including but not limited to the system public key and related hash functions; a second registration module for obtaining the private key and public key reconstruction factor from the registration management authority through the IBC mechanism; a desealing module for receiving messages that the data collection base station deseals based on a broadcast mechanism and sends simultaneously to multiple devices, and verifying the integrity and source legitimacy of the messages using its own key, wherein the data collection base station obtains a digital certificate through the PKI mechanism; and a second key negotiation module for, after successful verification, collaborating with the data collection base station to generate a shared session key and establish a secure communication channel.
[0055] The PKI to IBC heterogeneous broadcast signature encryption and key negotiation system for IoT communication devices provided in this invention is applied to data collection base stations or terminal sensing devices. Addressing the security threats, application requirements, and shortcomings of existing solutions, it employs several modules and uses technologies such as asymmetric encryption, digital signatures, and collisional one-way hash functions to design a heterogeneous broadcast signature encryption and key negotiation method, ensuring the integrity, authenticity, reliability, non-forgeability, and confidentiality of messages transmitted in open networks.
[0056] It should be noted that the system embodiments provided by the present invention are used not only to implement the methods in the above method embodiments, but also to implement the methods in other method embodiments provided by the present invention. The only difference is that corresponding functional modules are set. The principle is basically the same as that of the above system embodiments provided by the present invention. As long as those skilled in the art can improve the modules in the above system embodiments by referring to the specific technical solutions in other method embodiments and combining technical features to obtain corresponding technical means and technical solutions composed of these technical means, on the basis of the above system embodiments, and on the premise of ensuring the practicality of the technical solutions, they can obtain corresponding system-like embodiments for implementing the methods in other method-like embodiments.
[0057] Based on the same inventive concept as any of the foregoing embodiments, this embodiment of the invention also provides a PKI to IBC heterogeneous broadcast signature and key negotiation system for Internet of Things (IoT) communication devices, including a registration management agency, a data collection base station, and multiple terminal sensing devices. The registration management agency is connected to the data collection base station and the multiple terminal sensing devices respectively. The data collection base station is used to execute the steps of the method applied to the data collection base station, and the terminal sensing devices are used to execute the steps of the method applied to the terminal sensing devices.
[0058] Based on the same inventive concept as any of the foregoing embodiments, this embodiment of the invention also provides a non-transitory computer-readable storage medium, characterized in that the non-transitory computer-readable storage medium stores computer instructions, the computer instructions causing the computer to execute the PKI to IBC heterogeneous broadcast signature and key negotiation method for IoT communication devices applied to data collection base stations or terminal sensing devices.
[0059] In summary, this invention discloses a PKI-to-IBC heterogeneous broadcast signature and key negotiation method for IoT communication devices, comprising six stages: system initialization, data collection base station registration, terminal sensing device registration, heterogeneous signature, desealing, and key negotiation. In the system initialization stage, the registration management agency generates elliptic curve parameters and a system master key, and publishes system parameters, including the system public key and related hash functions. In the registration stage, the data collection base station obtains a digital certificate through the PKI mechanism, and the terminal sensing device obtains a private key and public key reconstruction factor through the IBC mechanism. In the signature stage, the data collection base station signatures the message based on a broadcast mechanism and sends it simultaneously to multiple devices. In the desealing stage, the terminal sensing device uses its own key to verify the integrity and legitimacy of the message source. In the key negotiation stage, the data collection base station and the terminal sensing device collaboratively generate a shared session key and establish a secure communication channel. Compared with existing technologies, this invention supports heterogeneous interoperability between PKI and IBC systems, enables efficient one-to-many broadcast communication, and significantly reduces computing and communication overhead through a bilinear pairing-free design. It is suitable for resource-constrained IoT device deployments, including the secure communication needs of various communication devices such as maritime hubs, industrial IoT, and smart manufacturing, and has good security and practicality.
[0060] The terms “comprising” and “having”, and any variations thereof, in the specification, claims, and accompanying drawings of this invention are intended to cover a non-exclusive inclusion, such as a process, method, system, product, or apparatus that includes a series of steps or units, not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0061] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the technical solutions of the embodiments of the present invention.
Claims
1. A method for heterogeneous broadcast signature encryption and key negotiation from PKI to IBC for IoT communication devices, characterized in that, Applied to a data collection base station, the method includes: Obtain parameters released by the registration management agency, including but not limited to the system public key and related hash functions; Obtain a digital certificate from a registration authority through a PKI mechanism; The message is signed and sent to multiple devices simultaneously using a broadcast mechanism; The receiving terminal sensing device verifies the integrity and source legitimacy of the message using its own key. The terminal sensing device obtains the private key and public key reconstruction factor through the IBC mechanism. Based on the received information, a shared session key is generated in collaboration with the terminal sensing device to establish a secure communication channel.
2. The PKI to IBC heterogeneous broadcast signature and key negotiation method for IoT communication devices according to claim 1, characterized in that, Messages are signed and encrypted using a broadcast mechanism and sent simultaneously to multiple devices, including: The data collection base station reconstructs the public key of the terminal sensing device that needs to be sent. ,in ; The data collection base station selects a random number. ,calculate Then calculate the signature. and , in, , Indicates the current timestamp; Data collection base station calculation polynomial of degree ,in and They represent taking and x-coordinate Let the coefficients of the polynomial be denoted as and the set of coefficients be denoted as . ; Data collection base station is set to signature Then broadcast Give Each terminal sensing device.
3. The PKI to IBC heterogeneous broadcast signature and key negotiation method for IoT communication devices according to claim 1, characterized in that, During the system initialization phase, the registration management agency generates elliptic curve parameters and the system master key, and publishes system parameters, including but not limited to the system public key and related hash functions.
4. A method for heterogeneous broadcast signature encryption and key negotiation from PKI to IBC for IoT communication devices, characterized in that, Applied to terminal sensing devices, the method includes: Obtain parameters released by the registration management agency, including but not limited to the system public key and related hash functions; The private key and public key reconstruction factor are obtained from the registry through the IBC mechanism; The receiving data collection base station signs and broadcasts messages to multiple devices simultaneously based on a broadcast mechanism. The data collection base station obtains a digital certificate through a PKI mechanism. Use its own key to verify message integrity and source legitimacy; After successful verification, a shared session key is generated in collaboration with the data collection base station to establish a secure communication channel.
5. The PKI to IBC heterogeneous broadcast signature and key negotiation method for IoT communication devices according to claim 4, characterized in that, The private key and public key reconstruction factors are obtained from the registry through the IBC mechanism, including: Send identity token To the registration management agency, among which Used to distinguish different terminal sensing devices and ; Receive identity verification from the registration management agency After the validity of the key is verified, the private key and public key reconstruction factor are calculated and sent.
6. The PKI to IBC heterogeneous broadcast signature and key negotiation method for IoT communication devices according to claim 4, characterized in that, Verify message integrity and source legitimacy using your own key, including: After receiving the message, the terminal sensing device SDi checks the timestamp. Validity; timestamp When valid, it utilizes the terminal sensing device's own private key. ,calculate , The public key for the data collection base station, This is to identify the device. Using anti-collision hash functions The hash value obtained after mapping; SDi extraction from terminal sensing devices The x-coordinate is denoted as , through calculation To recover to further obtain ,in, The superscript represents the coefficients of the polynomial. Indicates exponentiation; Terminal sensing devices verify equations Whether it holds true or not is used to verify the authenticity and completeness of the message source, where G represents the group element. Req represents the shared point calculated by the data collection base station, and Req represents the key negotiation request. Indicates a digital certificate. and This represents a hash function.
7. A PKI-to-IBC heterogeneous broadcast signature encryption and key negotiation system for Internet of Things (IoT) communication devices, characterized in that: The system, applied to a data collection base station, includes: The first acquisition module is used to acquire parameters released by the registration management agency, including but not limited to the system public key and related hash functions; The first registration module is used to obtain digital certificates from the registration management authority through the PKI mechanism; The signature module is used to signature messages based on a broadcast mechanism and send them to multiple devices simultaneously. The first key negotiation module is used to respond to the terminal sensing device after it has verified the integrity and source legitimacy of the message using its own key, and to work with the terminal sensing device to generate a shared session key and establish a secure communication channel. The terminal sensing device obtains the private key and public key reconstruction factor through the IBC mechanism.
8. A PKI to IBC heterogeneous broadcast signature encryption and key negotiation system for Internet of Things (IoT) communication devices, characterized in that: The system, applied to terminal sensing devices, includes: The second acquisition module is used to acquire parameters released by the registration management agency, including but not limited to the system public key and related hash functions; The second registration module is used to obtain the private key and public key reconstruction factor from the registration management authority through the IBC mechanism; The decryption module is used to receive messages that the data collection base station decrypts based on a broadcast mechanism and sends to multiple devices simultaneously. It uses its own key to verify the integrity and legitimacy of the message source. The data collection base station obtains a digital certificate through a PKI mechanism. The second key negotiation module is used to work with the data collection base station to generate a shared session key and establish a secure communication channel after successful verification.
9. A PKI-to-IBC heterogeneous broadcast signature encryption and key negotiation system for Internet of Things (IoT) communication devices, characterized in that: The system includes a registration management agency, a data collection base station, and multiple terminal sensing devices. The registration management agency is connected to the data collection base station and the multiple terminal sensing devices. The data collection base station is used to perform the steps of the method described in any one of claims 1 to 3, and the terminal sensing devices are used to perform the steps of the method described in any one of claims 4 to 6.
10. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions that cause the computer to perform the method described in any one of claims 1 to 3 or the method described in any one of claims 4 to 6.