Multi-agent-based efficient batch authentication method and system applied to industrial Internet of Things

Abstract

The invention discloses a multi-agent-based efficient batch authentication method and system applied to an industrial Internet of Things. A trusted mechanism carries out system initialization and completes registration of Internet of Things equipment and a gateway and generation of a key material; the gateway performs mutual authentication with all Internet of Things equipment in the system, and is responsible for selecting proxy equipment, issuing a message authentication task and verifying an execution result of the message authentication task; the multiple proxy devices jointly execute the message authentication task issued by the gateway and send a task execution result to the gateway; the message sender signs the shared data by using a private key of the message sender; and the message receiver determines whether to receive the message sent by the message sender according to the valid message list and the invalid message list broadcasted by the gateway. According to the invention, the message authentication process in the system is transferred to the proxy device with rich computing resources for execution, and the efficiency of message authentication in the system is effectively improved.

Description

Technical Field

[0001] This invention relates to message authentication technology, specifically to a high-efficiency batch authentication method and system based on multiple agents for application in the Industrial Internet of Things. Background Technology

[0002] In the Industrial Internet of Things (IIoT), smart devices continuously generate massive amounts of industrial data in real time, covering multiple aspects such as production processes, equipment status, and environmental monitoring. To achieve collaboration and intelligent control between devices, smart devices need to exchange and analyze industrial data in real time. However, industrial data faces various security threats during transmission. Specifically, attackers can disrupt industrial production by intercepting and tampering with industrial data. Message authentication is an effective means of ensuring data transmission security. Its core function is to verify the integrity of messages and confirm the sender's identity, and it has been widely used in the IIoT. With the rapid expansion of the IIoT, the number of connected devices and the amount of data generated are growing exponentially, leading to a significant increase in the computational overhead of message authentication between devices. However, the computing power of IIoT devices varies greatly; resource-constrained devices typically have limited computing power, and message authentication tasks can place an excessive burden on them, thus affecting the overall efficiency and security of the system. Therefore, this invention studies a more efficient multi-agent-based message authentication method.

[0003] Agent-based message authentication methods improve efficiency by offloading the complex task of message authentication to resource-rich agent nodes. Smart devices then only need to decide whether to accept a message based on the agent's authentication result. However, most existing agent-based authentication methods employ a single-agent model, where a single trusted node is responsible for authenticating all messages in the entire Industrial IoT system and broadcasting the authentication results to other entities. First, the security of this method relies on the assumption that the agent node is completely trustworthy, which is often difficult to achieve in real-world Industrial IoT scenarios. Second, the message authentication capability of a single agent node is limited; when the message volume is too large, the agent node may not be able to complete authentication in a timely manner.

[0004] To overcome the efficiency limitations of the single-agent model, researchers have proposed a message authentication method based on a multi-agent model. This method selects industrial IoT devices within the system as agent devices, with each agent directly responsible for authenticating different batches of messages. Since the agent devices are not entirely trustworthy, to ensure the verifiability of the authentication results, this approach requires embedding an anti-tampering module in the industrial IoT device and pre-storing the verifier's key. While this method improves authentication efficiency, resource-constrained industrial IoT devices typically lack the necessary hardware support; furthermore, existing research has shown that attackers can bypass the anti-tampering module to obtain the internally stored key, thereby threatening system security.

[0005] For example, Chinese patent application CN119922547A provides a batch message verification method and system for industrial Internet of Things. This technology enables devices to authenticate each other with edge servers. Then, the message sender sends a message to the edge server, which aggregates the messages sent by the sender and forwards them to the message receiver.

[0006] However, this patent does not take into account that in the Industrial Internet of Things (IIoT) scenario, the message recipient may be multiple devices. That is, if a message needs to be sent to multiple devices, the edge server needs to aggregate the message multiple times in order to send it to different devices respectively, which leads to the problem of redundant authentication.

[0007] Therefore, existing message authentication methods cannot effectively solve the problem of message authentication efficiency. Summary of the Invention

[0008] Purpose of the invention: The purpose of this invention is to address the shortcomings of existing technologies and provide a high-efficiency batch authentication method and system based on multiple agents for industrial Internet of Things (IoT). The method utilizes agent devices to perform message authentication tasks, and the gateway verifies the task results and broadcasts them to other devices, thereby improving the efficiency of message authentication within the system.

[0009] Technical Solution: This invention provides a high-efficiency batch authentication method based on multiple agents for industrial IoT, comprising the following steps:

[0010] Step 1: The message sender processes the message locally, while the trusted authority generates and publishes the system's public key. System authentication public key , and system private key Then, the IoT devices and gateways apply for registration with a trusted organization, which calculates the pseudo-identity of the IoT devices. Private key and public key And the true identity of the gateway. Private key and public key Next, the gateway and the IoT device authenticate each other, that is, the IoT device sends an authentication request to the gateway. The gateway verifies the authentication request from the IoT device and replies with an authentication response message. Then the IoT device and the gateway calculate the session key respectively. Finally, the message sender includes the data, random number, device pseudo-identity, and time information. Embed the signature to obtain the signature information ;

[0011] Step 2: The agent performs the message authentication task, which includes the following process:

[0012] Step 2.1: Select the proxy device, i.e., the gateway selects the device based on its message signature verification capability. One IoT device acts as a proxy, and then the gateway is... Each agent calculates the corresponding verification private key. and verify public key And generate and publish threshold public keys. ;

[0013] Step 2.2: The gateway publishes a message authentication task. The gateway selects the system... The system processes each message that needs authentication, calculates the hash value for each message, and publishes the corresponding message list and hash values ​​as a message authentication task to [the relevant authority / organization]. An agent; this Each agent verifies the integrity and consistency of the message based on the hash value. If they match, the agent accepts the message authentication task; if they do not match, the agent requests a retransmission of the original message.

[0014] Step 2.3: The agent performs the message authentication task, that is... This is jointly certified by multiple agents. The message is signed, and then the hash value of the authenticated message is stored in... In the process, the hash value of the authentication failure message is stored in The agent calculates the threshold signature based on the authentication result. and proof value and threshold signature Proof value and message list and Send to the gateway;

[0015] Step 2.4: The gateway verifies the proxy's task execution result using the secret sharing algorithm. Threshold signature of each agent and proof value If the verification passes, the gateway will send the message list. Message List Threshold signature Broadcast to the Internet of Things (IoT) environment;

[0016] Step 3: The message receiver receives the message and first verifies the gateway's message. After receiving the data broadcast by the gateway, the message receiver verifies its validity.

[0017] Then the message receiver calculates the hash value corresponding to the message sent by the message sender and stores it in the message list. and Find the hash value; if it's in the message list... If it is in the message list, then receive the message; if it is in the message list... If the message is rejected, it will be ignored.

[0018] The proxy-based mechanism in this invention is reflected in the following aspects: The message sender sends messages in a broadcast manner, meaning that the message receiver, gateway, and proxy can all receive the message. The gateway distributes message authentication tasks to the proxies in batches. The proxies authenticate the messages according to the message authentication task requirements, separating valid and invalid messages and storing them in different message lists. Simultaneously, they calculate a proof value and a threshold signature to verify the correctness of the results, and finally return the message list, proof value, and threshold signature to the gateway. After receiving the results from multiple proxies, the gateway verifies the correctness of the results based on the proof value. If the verification passes, the gateway broadcasts the threshold signature and message list to the IoT environment. The message receiver decides how to process the message sent by the message sender based on the results broadcast by the gateway. In other words, during the message reception process, only the proxy and gateway perform the authentication process; the message receiver does not need to authenticate the message, thus reducing the pressure on resource-constrained devices to verify messages and improving system efficiency.

[0019] Furthermore, in step 1, bilinear pairing is first selected. ,in and For the order of cyclic group and They are groups Hequn Generator; select random number As the system private key, calculate the system public key. Select random number Computing system authentication public key , Choose three hash functions: , , ;

[0020] For IoT device registration, trusted organizations should be selected. As equipment Real identity; select random number Calculate random numbers ; Calculate the equipment false identity , Among them, the component of false identity , ; Calculate the equipment private key Public key ;

[0021] For gateway registration, trusted organizations choose... As the true identity of the gateway; select a random number. Calculate random numbers Finally, the gateway's private key is calculated. Public key .

[0022] Furthermore, the steps for mutual authentication between the gateway and the IoT device in step 1 are as follows:

[0023] First of all, the equipment Select random number Calculate random numbers ;equipment Generate signature ;

[0024] Then the equipment Send authentication request Give to the gateway, where ;

[0025] The gateway received an authentication request. Then, using the system public key and equipment public key Verify authentication request The legitimacy;

[0026] Next, the gateway selects a random number. Calculate random numbers The gateway calculates the session key. ;

[0027] Then the gateway generates a signature. ; and on Use session key Symmetric encryption is used to obtain The gateway sends an authentication response. Give equipment ,in ;

[0028] equipment Received authentication response Verification and authentication response Legality; equipment Calculate the session key and verify Whether or not If they are equal, then the equipment... send Give it to the gateway;

[0029] Final gateway verification Whether or not If they are equal, then the gateway and device... Mutual authentication is successful, and a session key is generated;

[0030] Finally, the method for generating message signatures by IoT devices is as follows: First, the data to be sent by the message sender, the pseudo-identity, the time information, and a random number are embedded in the signature, i.e., calculation... Random water , , It's data. It's time information; finally, a complete signature is obtained. .

[0031] Furthermore, the detailed method of step 2.1 is as follows:

[0032] First, the gateway verifies the functionality of each IoT device within the system under normal operating conditions. The time cost of signing a document is considered, and selection is made based on the performance of the cost. Each device acts as a proxy to assist in message authentication;

[0033] Gateway selection random numbers , producing polynomials Then the gateway, based on the polynomials, respectively Each agent generates a corresponding verification private key. Verify public key ,in It's a fake identity for the agent. It is the hash value of the fake identity. It is the agent's order. ;

[0034] Finally, the gateway calculates and publishes the threshold public key. and agent equipment .

[0035] Furthermore, the detailed method for the gateway publishing message authentication task in step 2.2 is as follows:

[0036] First, the gateway filters out messages with low freshness within the system. Then, the gateway selects messages from within the system. For each message that requires authentication, calculate the hash value for that message. and ,in ;

[0037] Next, the gateway from Select from agents An agent is responsible for executing this. The task is to authenticate the message; then the message hash value is used. and Send to this One agent;

[0038] Finally, the agent also calculates the corresponding hash value based on the message it received and compares it with the hash value. and The system compares the messages received by the agent with those received by the gateway. If they are equal, it indicates that the agent received the same message as the gateway and performs the authentication task. Otherwise, the message reception is inconsistent, and the agent requests the corresponding original message to be retransmitted.

[0039] Furthermore, the steps in step 2.3, where the agent performs the message authentication task, are as follows:

[0040] First, each agent calculates the hash value of the message. ,in ; It's data. It is time information;

[0041] Then, the proxy verification equation If the query fails, the agent continues to re-authenticate the messages using a binary search method, and stores the hash values ​​of the successfully authenticated messages in the message list. In the process, the hash value of a message that fails verification is stored in the message list. middle;

[0042] Next, the agent targets the message list. The message calculation proof value ,in Then the agent targets the message list. Message List and hash value Calculate the threshold signature ;

[0043] Finally, each agent will Embedded into the signature, the signature is calculated. and will Send to the gateway.

[0044] Furthermore, the steps for the gateway to verify the proxy's task execution result are as follows:

[0045] First, the gateway verifies the signature of each proxy. After verifying the correctness of all statements, we will then verify the equation. Whether it is valid, among which ;

[0046] If the equation does not hold, the gateway will... The message itself verifies its validity, and simultaneously uses the agent's private key to calculate the proof value that each agent should calculate. And compare it with the received proof value to find the agent who sent the incorrect result;

[0047] If the equation If successful, the gateway will continue verification. The gateway checks whether the equation holds true. If it does, it indicates that the authentication results of all tasks performed by the agents are consistent and correct; if the equation does not hold true, the gateway will... The message itself verifies its validity, and simultaneously uses the agent's private key to calculate the proof value that each agent should calculate. And compare it with the received proof value to find the agent who sent the incorrect result;

[0048] Then, the gateway uses the private key pair Signature obtained and will Broadcast to industrial IoT environments.

[0049] Furthermore, the steps for the message receiver to receive the message in step 3 are as follows:

[0050] First, the message receiver receives the broadcast from the gateway. Then, the gateway's public key is used to verify the validity of the message;

[0051] After the verification is valid, the gateway continues to verify the equation. Does the equation hold true? If the equation holds true, it indicates the message list. , Credible;

[0052] Then, the message receiver calculates the hash value of the message sent by the message sender. In the message list and message list Search in, if the hash value exist If the hash value is in the middle, then the message is received; if the hash value is in the middle, then the message is received. exist If the message is rejected, it will be ignored.

[0053] This invention also discloses a high-efficiency batch message authentication system based on multiple agents for industrial Internet of Things, including a trusted institution, a gateway, an agent, a message sender, and a message receiver;

[0054] The trusted institution performs system initialization and completes the registration of IoT devices and gateways, as well as the generation of key materials. The generated key materials are sent to the IoT devices and gateways through a secure channel. The gateway performs mutual authentication with all IoT devices in the system, and is responsible for selecting proxy devices, publishing message authentication tasks, and verifying the execution results of message authentication tasks. It also broadcasts the list of valid messages and the list of invalid messages to the industrial IoT environment. Multiple proxy devices jointly execute the message authentication tasks published by the gateway and send the task execution results to the gateway. The message sender signs the shared data using its private key and broadcasts the signature and data together to the industrial IoT environment. After receiving the message from the message sender, the message receiver does not process it, but decides whether to accept the message sent by the message sender based on the list of valid messages and the list of invalid messages broadcast by the gateway.

[0055] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0056] (1) The message authentication method based on multiple agents of the present invention can effectively improve the efficiency of message authentication within the system while protecting the security of message transmission.

[0057] (2) The present invention greatly reduces the trust requirements of the proxy device by using the secret sharing method and threshold signature, while reducing the redundant process in message authentication. Attached Figure Description

[0058] Figure 1 This is a schematic diagram of the system structure of the present invention;

[0059] Figure 2 This is an overall flowchart of the present invention;

[0060] Figure 3 This is a flowchart of the local processing of the present invention;

[0061] Figure 4 This is a flowchart of the message authentication process of the present invention;

[0062] Figure 5 This is a flowchart of the message receiver message of the present invention;

[0063] Figure 6 is a comparative experimental diagram of the various technical solutions in the embodiments. Detailed Implementation

[0064] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.

[0065] like Figure 2 As shown, the efficient batch authentication method based on multiple agents for industrial IoT of the present invention includes the following steps:

[0066] Step 1: The message sender processes the message locally, while the trusted authority generates and publishes the system's public key. System authentication public key , and system private key Then, the IoT devices and gateways apply for registration with a trusted organization, which calculates the pseudo-identity of the IoT devices. Private key and public key And the true identity of the gateway. Private key and public key Next, the gateway and the IoT device authenticate each other, that is, the IoT device sends an authentication request to the gateway. The gateway verifies the authentication request from the IoT device and replies with an authentication response message. Then the IoT device and the gateway calculate the session key respectively. Finally, the message sender includes the data, random number, device pseudo-identity, and time information. Embed the signature to obtain the signature information ;

[0067] Step 2: The agent performs the message authentication task, which includes the following process:

[0068] Step 2.1: Select the proxy device, i.e., the gateway selects the device based on its message signature verification capability. One IoT device acts as a proxy, and then the gateway is... Each agent calculates the corresponding verification private key. and verify public key And generate and publish threshold public keys. ;

[0069] Step 2.2: The gateway publishes a message authentication task. The gateway selects the system... The system processes each message that needs authentication, calculates the hash value for each message, and publishes the corresponding message list and hash values ​​as a message authentication task to [the relevant authority / organization]. An agent; this Each agent verifies the integrity and consistency of the message based on the hash value. If they match, the agent accepts the message authentication task; if they do not match, the agent requests a retransmission of the original message.

[0070] Step 2.3: The agent performs the message authentication task, that is... This is jointly certified by multiple agents. The message is signed, and then the hash value of the authenticated message is stored in... In the process, the hash value of the authentication failure message is stored in The agent calculates the threshold signature based on the authentication result. and proof value and threshold signature Proof value and message list and Send to the gateway;

[0071] Step 2.4: The gateway verifies the proxy's task execution result using the secret sharing algorithm. Threshold signature of each agent and proof value If the verification passes, the gateway will send the message list. Message List Threshold signature Broadcast to the Internet of Things (IoT) environment;

[0072] Step 3: The message receiver receives the message and first verifies the gateway's message. After receiving the data broadcast by the gateway, the message receiver verifies its validity.

[0073] Then the message receiver calculates the hash value corresponding to the message sent by the message sender and stores it in the message list. and Find the hash value; if it's in the message list... If it is in the message list, then receive the message; if it is in the message list... If the message is rejected, it will be ignored.

[0074] The proxy-based mechanism in this invention is reflected in the following aspects: The message sender sends messages in a broadcast manner, meaning that the message receiver, gateway, and proxy can all receive the message. The gateway distributes message authentication tasks to the proxies in batches. The proxies authenticate the messages according to the message authentication task requirements, separating valid and invalid messages and storing them in different message lists. Simultaneously, they calculate a proof value and a threshold signature to verify the correctness of the results, and finally return the message list, proof value, and threshold signature to the gateway. After receiving the results from multiple proxies, the gateway verifies the correctness of the results based on the proof value. If the verification passes, the gateway broadcasts the threshold signature and message list to the IoT environment. The message receiver decides how to process the message sent by the message sender based on the results broadcast by the gateway. In other words, during the message reception process, only the proxy and gateway perform the authentication process; the message receiver does not need to authenticate the message, thus reducing the pressure on resource-constrained devices to verify messages and improving system efficiency.

[0075] like Figure 3 As shown, in step 1 of this embodiment, bilinear pairing is first selected. ,in and For the order of cyclic group and They are groups Hequn Generator; select random number As the system private key, calculate the system public key. Select random number Computing system authentication public key , Choose three hash functions: , , ;

[0076] For IoT device registration, trusted organizations should be selected. As equipment Real identity; select random number ,calculate ; Calculate the equipment false identity , Among them, the component of false identity , ; Calculate the equipment private key Public key ;

[0077] For gateway registration, trusted organizations choose... As the true identity of the gateway; select a random number. Calculate random numbers Finally, the gateway's private key is calculated. Public key .

[0078] Step 1: The steps for mutual authentication between the gateway and the IoT device are as follows:

[0079] First of all, the equipment Select random number Calculate random numbers ;equipment Generate signature ;

[0080] Then the equipment Send authentication request Give to the gateway, where ;

[0081] The gateway received an authentication request. Then, using the system public key and equipment public key Verify authentication request The legitimacy;

[0082] Next, the gateway selects a random number. Calculate The gateway calculates the session key. ;

[0083] Then the gateway generates a signature. ; and on Use session key Symmetric encryption is used to obtain The gateway sends an authentication response. Give equipment ,in ;

[0084] equipment Received authentication response Verification and authentication response Legality; equipment Calculate the session key and verify Whether or not If they are equal, then the equipment... send Give it to the gateway;

[0085] Final gateway verification Whether or not If they are equal, then the gateway and device... Mutual authentication is successful, and a session key is generated;

[0086] Finally, the method for generating message signatures by IoT devices is as follows: First, the data to be sent by the message sender, the pseudo-identity, the time information, and a random number are embedded in the signature, i.e., calculation... ,in , , It's data. It's time information; finally, a complete signature is obtained. .

[0087] like Figure 4 As shown, the detailed method for step 2.1 is as follows:

[0088] First, the gateway verifies the functionality of each IoT device within the system under normal operating conditions. The time cost of signing a document is considered, and selection is made based on the performance of the cost. Each device acts as a proxy to assist in message authentication;

[0089] Gateway selection random numbers , producing polynomials Then the gateway, based on the polynomials, respectively Each agent generates a corresponding verification private key. Verify public key ,in It's a fake identity for the agent. It is the hash value of the fake identity. It is the agent's order. ;

[0090] Finally, the gateway calculates and publishes the threshold public key. and agent equipment .

[0091] Furthermore, the detailed method for the gateway publishing message authentication task in step 2.2 is as follows:

[0092] First, the gateway filters out messages with low freshness within the system. Then, the gateway selects messages from within the system. For each message that requires authentication, calculate the hash value for that message. and ,in ;

[0093] Next, the gateway from Select from agents An agent is responsible for executing this. The task is to authenticate the message; then the message hash value is used. and Send to this One agent;

[0094] Finally, the agent also calculates the corresponding hash value based on the message it received and compares it with the hash value. and The system compares the messages received by the agent with those received by the gateway. If they are equal, it indicates that the agent received the same message as the gateway and performs the authentication task. Otherwise, the message reception is inconsistent, and the agent requests the corresponding original message to be retransmitted.

[0095] Step 2.3 The steps for the agent to perform the message authentication task are as follows:

[0096] First, each agent calculates the hash value of the message. ,in ; It's data. It is time information;

[0097] Then, the proxy verification equation If the query fails, the agent continues to re-authenticate the messages using a binary search method, and stores the hash values ​​of the successfully authenticated messages in the message list. In the process, the hash value of a message that fails verification is stored in the message list. middle;

[0098] Next, the agent targets the message list. The message calculation proof value ,in Then the agent targets the message list. Message List and hash value Calculate the threshold signature ;

[0099] Finally, each agent will Embedded into the signature, the signature is calculated. and will Send to the gateway.

[0100] The steps for the gateway to verify the proxy's task execution result are as follows:

[0101] First, the gateway verifies the signature of each proxy. After verifying the correctness of all statements, we will then verify the equation. Whether it is valid, among which ;

[0102] If the equation does not hold, the gateway will... The message itself verifies its validity, and simultaneously uses the agent's private key to calculate the proof value that each agent should calculate. And compare it with the received proof value to find the agent who sent the incorrect result;

[0103] If the equation If successful, the gateway will continue verification. If the equation also holds true, it indicates that the authentication results of all tasks performed by the agents are consistent and correct; if the equation does not hold true... If this is not true, then the gateway will... The message itself verifies its validity, and simultaneously uses the agent's private key to calculate the proof value that each agent should calculate. Then compare it with the received proof value to identify the agent who sent the incorrect result.

[0104] Then, the gateway uses the private key pair Signature obtained and will Broadcast to industrial IoT environments.

[0105] like Figure 3 As shown, the steps for the message receiver to receive the message in step 3 are as follows:

[0106] First, the message receiver receives the broadcast from the gateway. Then, the gateway's public key is used to verify the validity of the message;

[0107] After the verification is valid, the gateway continues to verify the equation. Does the equation hold true? If the equation holds true, it indicates the message list. , Credible;

[0108] Then, the message receiver calculates the hash value of the message sent by the message sender. In the message list and message list Search in, if the hash value exist If the hash value is in the middle, then the message is received; if the hash value is in the middle, then the message is received. exist If the message is rejected, it will be ignored.

[0109] like Figure 1 As shown, the present invention provides a high-efficiency batch message authentication system based on multiple agents for industrial IoT, comprising a trusted institution, a gateway, agents, message senders, and message receivers. The trusted institution performs system initialization and completes the registration of IoT devices and the gateway, as well as the generation of key materials. The generated key materials are sent to the IoT devices and the gateway through a secure channel. The gateway performs mutual authentication with all IoT devices within the system, and is responsible for selecting agent devices, publishing message authentication tasks, and verifying the execution results of message authentication tasks. It also broadcasts a list of valid messages and a list of invalid messages to the industrial IoT environment. Multiple agent devices jointly execute the message authentication tasks published by the gateway and send the task execution results to the gateway. The message sender signs the shared data using its private key and broadcasts the signature and data together to the industrial IoT environment. After receiving a message from the message sender, the message receiver does not process it but decides whether to accept the message based on the list of valid messages and the list of invalid messages broadcast by the gateway.

[0110] To further verify the feasibility and beneficial effects of the present invention, this embodiment uses the cryptographic library MiraclCore to simulate the operation of the scheme.

[0111] In this embodiment, the number of agents is set to 20, the threshold value is set to 4, and the number of messages is set to 200, 400, 600, 800, and 1000 respectively for the experiment. The programming language is Java, and the machine configuration is Windows 11 system, Intel Core Ultra5225H (1.7GHz, 32GB RAM).

[0112] As shown in Figure 6(a), it can be seen that the signature method used in this invention is more efficient than the prior art. The agent is more efficient than the prior art when performing batch verification of messages, and the efficiency advantage of this invention becomes more obvious as the number of messages increases.

[0113] As shown in Figure 6(b), it can be seen that the present invention is more efficient than the prior art in verifying the execution results of the proxy task. This is because the time cost of the existing solution in verifying the execution results of the proxy is proportional to the number of messages, while the time cost of the present invention is independent of the number of messages, so the time cost is lower and constant.

[0114] As shown in Figure 6(c), it can be seen that the message acquisition efficiency of the receiver in this invention is significantly higher than that of the prior art. This is because the existing technical solutions require the message receiver to complete the message verification alone, while our method has multiple agents responsible for message verification, and the message receiver only needs to receive the result.

[0115] As shown in Figure 6(d), since the gateway is only responsible for verifying the task execution results of the proxy, the message receiver only needs to verify the results of the gateway and the proxy, that is, it does not need to directly verify the message. Therefore, the total time overhead of message verification in this invention is significantly better than other methods, and it has better practicality in the industrial Internet of Things environment.

Claims

1. A high-efficiency batch authentication method based on multiple agents for industrial Internet of Things (IIoT), characterized in that, Includes the following steps: Step 1: The message sender processes the message locally, while the trusted authority generates and publishes the system's public key. System authentication public key , and system private key Then, the IoT devices and gateways apply for registration with a trusted organization, which calculates the pseudo-identity of the IoT devices. Private key and public key And the true identity of the gateway. Private key and public key Next, the gateway and the IoT device authenticate each other, that is, the IoT device sends an authentication request to the gateway. The gateway verifies the authentication request from the IoT device and replies with an authentication response message. Then the IoT device and the gateway calculate the session key respectively. Finally, the message sender includes the data, random number, device pseudo-identity, and time information. Embed the signature to obtain the signature information ; Step 2: The agent performs the message authentication task, which includes the following process: Step 2.1: Select the proxy device, i.e., the gateway selects the device based on its message signature verification capability. One IoT device acts as a proxy, and then the gateway is... Each agent calculates the corresponding verification private key. and verify public key And generate and publish threshold public keys. ; Step 2.2: The gateway publishes a message authentication task. The gateway selects the system... The system processes each message that needs authentication, calculates the hash value for each message, and publishes the corresponding message list and hash values ​​as a message authentication task to [the relevant authority / organization]. An agent; this Each agent verifies the integrity and consistency of the message based on the hash value. If they match, the agent accepts the message authentication task; if they do not match, the agent requests a retransmission of the original message. Step 2.3: The agent performs the message authentication task, that is... This is jointly certified by multiple agents. The message is signed, and then the hash value of the authenticated message is stored in... In the process, the hash value of the authentication failure message is stored in The agent calculates the threshold signature based on the authentication result. and proof value and threshold signature Proof value and message list and Send to the gateway; Step 2.4: The gateway verifies the proxy's task execution result using the secret sharing algorithm. Threshold signature of each agent and proof value If the verification passes, the gateway will send the message list. Message List Threshold signature Broadcast to the Internet of Things (IoT) environment; Step 3: The message receiver receives the message and first verifies the gateway's message. After receiving the data broadcast by the gateway, the message receiver verifies its validity. Then the message receiver calculates the hash value corresponding to the message sent by the message sender and stores it in the message list. and Find the hash value; if it's in the message list... If it is in the message list, then receive the message; if it is in the message list... If the message is rejected, it will be ignored.

2. The efficient batch authentication method based on multiple agents for industrial IoT as described in claim 1, characterized in that: In step 1, bilinear pairing is first selected. ,in and For the order of cyclic group and They are groups Hequn Generator; select random number As the system private key, calculate the system public key. ; Select random number Computing system authentication public key , Choose three hash functions: , , ; For IoT device registration, trusted organizations should be selected. As equipment The true identity of the person in question; Select random number Calculate random numbers ; Calculate the equipment false identity , Among them, the component of false identity , ; Calculate the equipment private key Public key ; For gateway registration, trusted organizations choose... As the true identity of the gateway; select a random number. Calculate random numbers Finally, the gateway's private key is calculated. Public key .

3. The efficient batch authentication method based on multiple agents for industrial IoT as described in claim 1, characterized in that, The steps for mutual authentication between the gateway and the IoT device in step 1 are as follows: First of all, the equipment Select random number Calculate random numbers ;equipment Generate signature ; Then the equipment Send authentication request Give to the gateway, where ; The gateway received an authentication request. Then, using the system public key and equipment public key Verify authentication request The legitimacy; Next, the gateway selects a random number. Calculate ; The gateway calculates the session key. ; Then the gateway generates a signature. ; and on Use session key Symmetric encryption is used to obtain The gateway sends an authentication response. Give equipment ,in ; equipment Received authentication response Verification and authentication response Legality; equipment Calculate the session key and verify Whether or not If they are equal, then the equipment... send Give it to the gateway; Final gateway verification Whether or not If they are equal, then the gateway and device... Mutual authentication is successful, and a session key is generated; Finally, the method for generating message signatures by IoT devices is as follows: First, the data to be sent by the message sender, the pseudo-identity, the time information, and a random number are embedded in the signature, i.e., calculation... , where random number random numbers , It's data. It is time information; Finally, the complete signature was obtained. .

4. The efficient batch authentication method based on multiple agents for industrial IoT as described in claim 1, characterized in that, The detailed method for step 2.1 is as follows: First, the gateway verifies the functionality of each IoT device within the system under normal operating conditions. The time cost of signing a document should be considered, and a selection should be made based on the performance of the cost. Each device acts as a proxy to assist in message authentication; Gateway selection random numbers , producing polynomials ; Then the gateway is based on the polynomial respectively Each agent generates a corresponding verification private key. Verify public key ,in It's a fake identity for the agent. It is the hash value of the fake identity. It is the agent's order. ; Finally, the gateway calculates and publishes the threshold public key. and agent equipment .

5. The efficient batch authentication method based on multiple agents for industrial IoT as described in claim 1, characterized in that: The detailed method for step 2.2, the gateway publishing message authentication task, is as follows: First, the gateway filters out messages with low freshness within the system. Then, the gateway selects messages from within the system. For each message that requires authentication, calculate the hash value for that message. and ,in ; Next, the gateway from Select from agents An agent is responsible for executing this. The task is to authenticate the message; then the message hash value is used. and Send to this One agent; Finally, the agent also calculates the corresponding hash value based on the message it received and compares it with the hash value. and The system compares the messages received by the agent with those received by the gateway. If they are equal, it indicates that the agent received the same message as the gateway and performs the authentication task. Otherwise, the message reception is inconsistent, and the agent requests the corresponding original message to be retransmitted.

6. The efficient batch authentication method based on multiple agents for industrial IoT as described in claim 1, characterized in that: The steps for the agent to perform the message authentication task in step 2.3 are as follows: First, each agent calculates the hash value of the message. ,in ; It's data. It is time information; Then, the proxy verification equation If the query fails, the agent continues to re-authenticate the messages using a binary search method, and stores the hash values ​​of the successfully authenticated messages in the message list. In the process, the hash value of a message that fails verification is stored in the message list. middle; Next, the agent targets the message list. The message calculation proof value ,in Then the agent targets the message list. Message List and hash value Calculate the threshold signature ; Finally, each agent will Embedded into the signature, the signature is calculated. and will Send to the gateway.

7. The efficient batch message authentication method based on multiple agents in the Industrial Internet of Things as described in claim 1, characterized in that: The steps in step 2.4, where the gateway verifies the proxy's task execution result, are as follows: First, the gateway verifies the signature of each proxy. After verifying the correctness of all statements, we will then verify the equation. Whether it is valid, among which ; If the equation does not hold, the gateway will... The message itself verifies its validity, and simultaneously uses the agent's private key to calculate the proof value that each agent should calculate. And compare it with the received proof value to find the agent who sent the incorrect result; If the equation If successful, the gateway will continue verification. If the equation is true, it indicates that the authentication results of all tasks performed by the agents are consistent and correct. Then, the gateway uses the private key pair Signature obtained and will Broadcast to industrial IoT environments.

8. The efficient batch message authentication method based on multiple agents in the Industrial Internet of Things as described in claim 1, characterized in that: The steps for the message receiver to receive the message in step 3 are as follows: First, the message receiver receives the broadcast from the gateway. Then, the gateway's public key is used to verify the validity of the message; After the verification is valid, the gateway continues to verify the equation. Does the equation hold true? If the equation holds true, it indicates the message list. , Credible; Then, the message receiver calculates the hash value of the message sent by the message sender. In the message list and message list Search in, if the hash value exist If the hash value is in the middle, then the message is received; if the hash value is in the middle, then the message is received. exist If the message is rejected, it will be ignored.

9. A system for implementing the efficient batch message authentication method based on multiple agents for industrial Internet of Things as described in any one of claims 1 to 8, characterized in that, This includes trusted institutions, gateways, proxies, message senders, and message receivers; The trusted organization in the system initializes the system and completes the registration of IoT devices and gateways and the generation of key materials. The generated key materials are sent to IoT devices and gateways through a secure channel. The gateway performs mutual authentication with all IoT devices in the system, and is responsible for selecting proxy devices, publishing message authentication tasks, and verifying the execution results of message authentication tasks. It also broadcasts the list of valid messages and the list of invalid messages to the industrial IoT environment. Multiple agent devices jointly execute the message authentication task published by the gateway and send the task execution result to the gateway; the message sender uses its private key to sign the shared data and broadcasts the signature and data together to the industrial IoT environment; after receiving the message from the message sender, the message receiver does not process it, but decides whether to accept the message sent by the message sender based on the list of valid messages and the list of invalid messages broadcast by the gateway.

Images