Implicit attack resistant medical tactile internet security authentication system and method

Abstract

The invention belongs to the technical field of communication, and provides an implicit-attack-resistant medical tactile internet security authentication system and an implicit-attack-resistant medical tactile internet security authentication method. The system comprises a trusted authority (TA), a remote doctor (RDs), a medical robot (MRs) and a gateway (GW). The TA is responsible for registration of all remote doctors, medical robots and gateways in the medical tactile internet. After a remote doctor registers on the TA, remote touch control over the medical robot can be achieved through the gateway by means of mutual authentication with the gateway and the medical robot. The medical robot is deployed in a hospital and supports inquiry and operation. The gateway serves as an incompletely credible relay device and is responsible for assisting identity authentication and shared key negotiation between a remote doctor and the medical robot, and safe communication is ensured.

Description

Technical Field

[0001] This invention belongs to, but is not limited to, the field of communication technology, and particularly relates to a medical tactile internet security authentication system and method resistant to covert attacks. Background Technology

[0002] The tactile internet, based on the rapidly developing fifth-generation mobile communication (5G) technology, aims to achieve refined interaction between humans and the digital world. It seeks to transmit digital information to the user's tactile sensory system in real time by simulating human tactile perception. It involves a range of technologies, including virtual reality, augmented reality, and human-computer interaction, providing a more immersive and realistic experience. The tactile internet has a wide range of applications, with healthcare being one of the most prominent. In the medical field, tactile internet technology can be used to simulate surgical procedures, train medical professionals, and improve the professionalism and success rate of surgeries. Simultaneously, the high speed and low latency of 5G technology ensure the real-time nature and accuracy of remote surgeries, helping remote doctors to more accurately perceive patients' physiological indicators and providing more comprehensive information support for telemedicine. Furthermore, the tactile internet can provide real-time tactile feedback in rehabilitation treatment, promoting the patient's recovery process. For patients in remote areas, 5G-based tactile internet-based telemedicine can also play a role in balancing medical resources. For such remote application scenarios, ultra-low latency, ultra-high reliability, and ultra-high security are all crucial objectives. Meanwhile, as an open network, the tactile internet is vulnerable to various attacks, including replay attacks, denial-of-service attacks, desynchronization attacks, man-in-the-middle attacks, differential privacy attacks, fake data injection attacks, and impersonation attacks, which can compromise the security authentication process. In the context of telemedicine, the information transmitted between entities is crucial to patients and remote doctors; malicious attacks can lead to undesirable consequences, such as incorrect diagnoses or unintended surgeries, and in severe cases, even threaten patients' lives. Therefore, it is essential to ensure that information transmission between entities takes place in a secure and privacy-preserving environment. Designing a secure identity authentication and key negotiation scheme is an effective solution to ensure the security of transmitted information.

[0003] Currently, authentication schemes designed for the tactile internet environment typically suffer from the following drawbacks: (1) Some schemes, despite employing lightweight methods, are insecure against attacks such as impersonation, stolen verifiers, and privileged insider trading; (2) Some schemes, while satisfying security requirements, have excessively high computational costs; (3) Most current authentication methods only consider one type of attack when analyzing security, neglecting the existence of implicit attacks, resulting in many self-proving secure methods actually having security vulnerabilities. This invention addresses these problems in a targeted manner: (1) The scheme considers resistance to various known security attacks in detail. (2) The use of computationally expensive cryptographic primitives is minimized during the authentication process, ensuring low overall computational costs. (3) The concept of implicit attacks is introduced, and an enhanced security proof analysis method incorporating implicit attacks is used in the security analysis process. Summary of the Invention

[0004] To address the problems existing in the prior art, this invention provides a medical tactile internet security authentication system and method resistant to covert attacks.

[0005] This invention is implemented as follows: a medical tactile internet security authentication system resistant to stealth attacks, characterized in that the system comprises:

[0006] The Trusted Authority (TA) is a fully trusted entity in the network, responsible for the registration of all remote doctors, medical robots, and gateways in the Medical Touch Internet.

[0007] Remote doctors (RDs) connect to trusted and authoritative medical devices (TAs) and are required to register with the TA. After mutual authentication with the gateway and medical robot, they can remotely control the medical robot through the gateway.

[0008] Medical robots (MRs) are deployed in hospital offices, operating rooms, and other locations, and can replace remote doctors to conduct patient consultations and even perform surgeries.

[0009] The gateway (GW) connects to remote doctors (RDs) and medical robots (MRs). The gateway is a relay device in the medical tactile internet, acting as an intermediate node between remote doctors and medical robots. It is considered not entirely trusted. It is responsible for assisting remote doctors and medical robots in identity authentication and helping them to communicate subsequently through a shared key.

[0010] Another objective of this invention is to provide a medical tactile internet security authentication method based on the aforementioned anti-stealth attack medical tactile internet security authentication system, which specifically includes an initialization phase, a registration phase, and an authentication phase.

[0011] The initialization phase initializes system parameters, specifically including:

[0012] S1: The trusted authority TA first selects a large prime number q (at least 512 bits in size) that has an infinity point or a zero point. Nonsingular elliptic curve E on a finite field (Galois field) GF(q) q (u, v), its form is: y 2 =x 3 +ux+v(mod q); where 4u 3 +27v 2 ≠ 0 (mod q), and u, v∈Z q ={0, 1, ..., q-1}; TA lies on the elliptic curve E q Choose a base point P on (u, v) with the same order as q; TA randomly generates a... As the system private key, calculate the system public key Pub = k·P;

[0013] S2: TA selects a one-way cryptographic hash function h: {0, 1} * →{0,1} l It can process an input string of arbitrary length x∈{0,1} * Mapped to a fixed-length l-bit output string h(x)∈{0,1} l For example, h(·) can be considered as a secure hash algorithm (SHA-1) that produces a 160-bit hash value. For higher security, it can also be SHA-256 or SHA-512.

[0014] S3: TA stores the system private key k in the database and publishes the parameter {E}. q (u, v), P, Pub, h(·)};

[0015] The trusted authorities in the registration phase include remote doctors, gateways, and medical robot registrations, specifically including:

[0016] Gateway Registration: A trusted and authoritative entity (TA) selects a real identity ID for the gateway (GW). GW Calculate the pseudo-identity PID GW =h(ID) GW ||k), generate private key Then load {PID} for GW GW k GW};

[0017] Medical robot registration: For each deployed medical robot MR j TA generates a unique identity ID for it. j Calculate the pseudo-identity PID j =h(ID) j ||k), generate a random challenge Generate a public-private key pair In MR j Before accessing the network, TA loads the registration credentials for it. And make the Pub public j ;

[0018] Remote Doctor Registration: Remote doctors must register with the TA before using the system for the first time. The registration process is as follows:

[0019] Step RDR1: Remote Doctor RD i Select their real identity ID i and password PW i Then generate a registration request (Req). i =E pub (ID i Then send the Req through a secure channel. i Give it to them;

[0020] Step RDR2: Received Req i Then, TA calculates D. k (Req i To confirm RD i The identity of the user is determined, and a temporary identity TID is generated for them. i and a public-private key pair And send {TID i {k i Pub i}, PID GW} Give RD i , where PID GW It is a fake identity for the gateway (GW);

[0021] Step RDR3: After receiving the message from TA, RD i Generate random numbers calculate PID i =h(ID) i ||n i ), stored in the terminal device's memory And make the Pub public i ;

[0022] The authentication phase enables gateway-assisted remote doctors and medical robots to authenticate each other and negotiate a shared key for subsequent secure communication between the two parties, specifically including:

[0023] Registered remote doctor RD i After successful login, the gateway will assist it in connecting with the registered medical robot MR. j Perform mutual authentication;

[0024] (1) Login: Remote Doctor RD i Enter ID′ in its device i and PW′ i Then, mobile device computing Determine if there is an n′ i =n i If the login is successful, then the login process is complete.

[0025] (2) Mutual authentication: After successfully logging in, the remote doctor authenticates with the medical robot with the assistance of the gateway. The authentication steps are as follows:

[0026] Step RMA1: Remote Doctor RD i Randomly generated Calculate the PID using the current timestamp T1. i =h(ID) i ||n i ), S i =h(r i ||TID i ||PID i ||T1), R i =S i P and B = S i +k i Then, send message M1 = {R} through a public channel. i B, Pub i Pub j T1} is given to the gateway GW;

[0027] Step RMA2: After receiving M1 at time T′1, the GW first checks whether |T′1-T1| < ΔT, where ΔT is the system's "maximum transmission delay"; if not, the current session is terminated; otherwise, the GW verifies B·P = R. i +Pub i Is it true? If true, then generate randomly. Calculate V GW =h(r GW ||k GW ||PID GW ||T2); where T2 is the current timestamp; then calculate and Finally, send M2 = {R} i C, D, T2} give Pub j Corresponding MR j ;

[0028] Step RMA3: MR at T′2 j Upon receiving message M2, first check if |T′2-T2|<ΔT; if not, terminate the current session; otherwise, MR jcalculate Verify if it exists If satisfied, then generate the current timestamp T3 and a random number. calculate R j =S j P and E = S j +k j Finally, calculate the session key. and Session Key Authenticator SKV j =h(SK j ||T3); then send M3={R j E, SKV j T3} is given to GW;

[0029] Step RMA4: After receiving M3 at T′3, GW first checks whether the inequality |T′3-T3|<ΔT holds; if it does, it continues to verify whether E·P=R holds. j +Pub j If satisfied, generate the current timestamp T4 and calculate... And send message M4={R j SKV j C, F, T3, T4} give RD i ;

[0030] Step RMA5: RD at T′4 i If M4 is received, and |T′4-T4|<ΔT holds true, then first calculate... Stored in the device using PID_i XOR. Get PID GW Then verify Is it true? If true, then calculate. and SKV i =h(SK i ||T3); If SKV i =SKV j If the mutual authentication is successful, then the TID is updated. i =h(TID) i ||SK i ||T4);

[0031] Through the above steps, RD i With MR j A shared session key SK was successfully established via GW. i (=SK j ).

[0032] Another object of the present invention is to provide a computer device, the computer device including a memory and a processor, the memory storing a computer program, which, when executed by the processor, causes the processor to perform the steps of the medical tactile internet security authentication method against covert attacks.

[0033] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the medical tactile internet security authentication method against covert attacks.

[0034] Another objective of this invention is to provide an information data processing terminal for implementing the medical tactile internet security authentication system resistant to covert attacks.

[0035] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:

[0036] First, this invention primarily achieves mutual authentication between remote doctors, gateways, and medical robots, allowing remote doctors and medical robots to negotiate secure and shared session keys. The working principle is as follows: The first stage is the initialization stage, where a trusted authority selects parameters for the medical tactile internet system and initializes the system. The second stage is the registration stage, where the trusted authority registers the deployed gateway and medical robot, and the remote doctor registers with the trusted authority. The third stage, after the remote doctor logs in, involves mutual authentication between the remote doctor and the medical robot with the assistance of the gateway, and the negotiation of a shared session key. After registration, the registration parameters are stored in the memory of the remote doctor's terminal device. During use, the remote doctor enters their identity and password on the terminal device to log in. After successful login, a tactile control request is sent to the target medical robot to complete mutual authentication and generate a session key for subsequent secure communication. The smart medical tactile internet security authentication method provided by this invention solves the problems that cannot be solved at present: during the authentication and key negotiation process, it fully analyzes the situation where attackers have multiple implicit attack capabilities, and it has been proven that the protocol is still secure even under the strongest implicit attack; when negotiating secure communication keys, it does not violate the low latency and high reliability required for medical tactile internet authentication; the communication scheme is lightweight, ensuring low overall computational cost.

[0037] Second, the expected benefits and commercial value of the technical solution of this invention after transformation are as follows:

[0038] The tactile internet aims to deliver digital information to users in real time by simulating human tactile perception, enabling sophisticated interaction between humans and the digital world. It not only transmits traditional audiovisual information and data but also achieves instant communication of tactile information such as touch sensation, driving force, motion state, vibration, and surface texture, thus shifting communication from content delivery to guidance and control. Therefore, the tactile internet is considered the next stage of the Internet of Things (IoT) evolution, signifying a complete revolution in the existing applications and services of the internet, leading the next generation of systems towards a new, highly anthropomorphic communication realm. The tactile internet has a wide range of applications, with healthcare being one of the most prominent. In the medical field, tactile internet technology can be used to simulate surgical procedures, train medical professionals, and improve the professionalism and success rate of surgeries. Simultaneously, the rapidly developing 5G technology, with its high speed and low latency, can ensure the real-time performance and accuracy of remote surgeries, helping remote doctors more accurately perceive patients' physiological indicators and providing more comprehensive information support for telemedicine, thus more conveniently solving complex medical problems in human society. This invention primarily aims to protect the secure communication processes within a medical tactile internet, particularly by resisting covert attacks that many solutions overlook, a key factor in ensuring the successful implementation of the tactile internet. Therefore, the technical solution of this invention, once commercialized, will generate significant expected benefits and commercial value.

[0039] Third, this anti-stealth attack medical touch internet security authentication system achieves secure authentication and privacy protection for each node in the medical touch internet through the collaboration of four modules: trusted authority, remote doctor, medical robot, and gateway, effectively resisting stealth attacks.

[0040] First, during the system initialization phase, the Trusted Authority (TA) generates the system's public-private key pair and configures security parameters, sharing the relevant key information and encryption parameters with the network. These keys and parameters provide a secure foundation for encrypted communication during subsequent registration and authentication processes. As the only fully trusted entity in the network, the TA is responsible for identity management and key distribution throughout the system, providing authoritative assurance for the registration and authentication of each node.

[0041] Next, during the registration phase, each remote doctor (RD) and medical robot (MR) must register with the TA and obtain a unique identity credential upon accessing the system. The TA generates a unique encryption key and pseudo-identity for each registered remote doctor and medical robot to enhance identity protection and prevent the leakage of their true identity. After registration, the TA transmits the relevant authentication information to the gateway in encrypted form, enabling the gateway to perform auxiliary authentication. Although the gateway is considered not entirely trusted, it can still securely transmit identity information through encryption measures.

[0042] During the authentication phase, the remote doctor authenticates with the gateway, and the gateway authenticates with the medical robot separately. First, the remote doctor performs two-way authentication with the gateway using their identity credentials and encryption key. The gateway, acting as a relay node, verifies the remote doctor's identity and then authenticates with the medical robot using its own identity information and shared key. This step-by-step authentication process not only ensures the authenticity of the remote doctor's and medical robot's identities but also establishes a shared key after successful authentication, enabling encrypted communication between the two parties.

[0043] Finally, during the communication phase, the remote doctor uses a gateway to perform tactile control operations on the medical robot. The gateway assists the remote doctor and the medical robot in establishing a secure shared key, which is used to encrypt the transmission of subsequent tactile control commands, ensuring data integrity and privacy. Even if the gateway is attacked or intercepted, its shared key encryption mechanism effectively prevents covert attacks, ensuring that communication information is not leaked and guaranteeing the security and stability of remote medical operations. Attached Figure Description

[0044] Figure 1 This is a structural diagram of the medical tactile internet security authentication system against covert attacks provided in an embodiment of the present invention;

[0045] Figure 2 This is a flowchart of a method for initializing system parameters during the initialization phase provided in an embodiment of the present invention;

[0046] Figure 3 This is a flowchart of the remote doctor registration method provided in an embodiment of the present invention;

[0047] Figure 4 This is a flowchart illustrating the authentication process for remote doctors and medical robots provided in this embodiment of the invention.

[0048] Figure 5 This invention provides a comparison of the communication costs of the authentication method provided in this embodiment with other related methods.

[0049] Figure 6 This invention provides a comparison of the computational costs of the authentication method provided in this embodiment with other related methods. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0051] like Figure 1 As shown, this embodiment of the invention provides a medical tactile internet security authentication system resistant to stealth attacks. The system includes:

[0052] The Trusted Authority (TA) is a fully trusted entity in the network, responsible for the registration of all remote doctors, medical robots, and gateways in the Medical Touch Internet.

[0053] Remote doctors (RDs) connect to trusted and authoritative medical devices (TAs) and are required to register with the TA. After mutual authentication with the gateway and medical robot, they can remotely control the medical robot through the gateway.

[0054] Medical robots (MRs) are deployed in hospital offices, operating rooms, and other locations, and can replace remote doctors to conduct patient consultations and even perform surgeries.

[0055] The gateway (GW) connects to remote doctors (RDs) and medical robots (MRs). The gateway is a relay device in the medical tactile internet, acting as an intermediate node between remote doctors and medical robots. It is considered not entirely trusted. It is responsible for assisting remote doctors and medical robots in identity authentication and helping them to communicate subsequently through a shared key.

[0056] This anti-stealth attack medical touch internet security authentication system works collaboratively through four components: Trusted Authority (TA), Remote Doctors (RDs), Medical Robots (MRs), and Gateway (GW) to ensure the security of remote medical operations and the reliability of identity authentication, effectively preventing stealth attacks.

[0057] First, the TA, as a fully trusted entity in the system, is responsible for the registration and authentication of all nodes in the network. During the initialization phase, the TA generates unique identity credentials and encryption keys for each remote doctor and medical robot, and stores this information in a secure environment to ensure the authenticity and uniqueness of the device's identity. The TA also configures the system's security parameters and shares public keys and key protocols with all devices, providing a solid security foundation for subsequent authentication.

[0058] In routine operation, remote doctors (RDs) use their registered identity credentials and encryption keys to send remote control requests to medical robots (MRs) through a gateway (GW). The gateway, acting as a relay device, receives the remote doctor's identity information and verifies its legitimacy with the TA, while also verifying the identity of the medical robot. Although the gateway is not entirely trustworthy, it assists remote doctors and medical robots in authentication and communication through encryption protocols, ensuring that data is not tampered with or intercepted.

[0059] After successful authentication, the gateway assists the remote doctor and the medical robot in establishing a shared session key. This key is used for the encrypted transmission of subsequent haptic control data, ensuring that the remote doctor's operating instructions are not stolen or forged during transmission to the medical robot. The generation and negotiation of the shared key are supported by TA's key protocol, giving the data encryption strong resistance to attacks and ensuring the integrity and confidentiality of communication.

[0060] Finally, after successful verification and shared key negotiation, the remote doctor can perform real-time tactile control of the medical robot through the gateway, including remote operations such as consultations and surgeries. All communication data throughout the process is encrypted using the shared key, preventing the gateway from accessing the actual content. Even if the gateway is attacked, it cannot decrypt or tamper with the data, thus achieving security against covert attacks and ensuring the privacy and security of remote medical operations.

[0061] This invention provides a method for anti-stealth attack medical tactile internet security authentication based on the aforementioned anti-stealth attack medical tactile internet security authentication system. The method specifically includes an initialization phase, a registration phase, and an authentication phase.

[0062] This anti-stealth attack medical touch internet security authentication system achieves secure authentication and privacy protection for each node in the medical touch internet through the collaboration of four modules: trusted authority, remote doctor, medical robot, and gateway, effectively resisting stealth attacks.

[0063] First, during the system initialization phase, the Trusted Authority (TA) generates the system's public-private key pair and configures security parameters, sharing the relevant key information and encryption parameters with the network. These keys and parameters provide a secure foundation for encrypted communication during subsequent registration and authentication processes. As the only fully trusted entity in the network, the TA is responsible for identity management and key distribution throughout the system, providing authoritative assurance for the registration and authentication of each node.

[0064] Next, during the registration phase, each remote doctor (RD) and medical robot (MR) must register with the TA and obtain a unique identity credential upon accessing the system. The TA generates a unique encryption key and pseudo-identity for each registered remote doctor and medical robot to enhance identity protection and prevent the leakage of their true identity. After registration, the TA transmits the relevant authentication information to the gateway in encrypted form, enabling the gateway to perform auxiliary authentication. Although the gateway is considered not entirely trusted, it can still securely transmit identity information through encryption measures.

[0065] During the authentication phase, the remote doctor authenticates with the gateway, and the gateway authenticates with the medical robot separately. First, the remote doctor performs two-way authentication with the gateway using their identity credentials and encryption key. The gateway, acting as a relay node, verifies the remote doctor's identity and then authenticates with the medical robot using its own identity information and shared key. This step-by-step authentication process not only ensures the authenticity of the remote doctor's and medical robot's identities but also establishes a shared key after successful authentication, enabling encrypted communication between the two parties.

[0066] Finally, during the communication phase, the remote doctor uses a gateway to perform tactile control operations on the medical robot. The gateway assists the remote doctor and the medical robot in establishing a secure shared key, which is used to encrypt the transmission of subsequent tactile control commands, ensuring data integrity and privacy. Even if the gateway is attacked or intercepted, its shared key encryption mechanism effectively prevents covert attacks, ensuring that communication information is not leaked and guaranteeing the security and stability of remote medical operations.

[0067] like Figure 2 As shown, the initialization phase initializes system parameters, specifically including:

[0068] S1: The trusted authority TA first selects a large prime number q (at least 512 bits in size) that has an infinity point or a zero point. Nonsingular elliptic curve E on a finite field (Galois field) GF(q) q (u, v), its form is: y 2 =x 3 +ux+v(mod q); where 4u 3 +27v 2 ≠ 0 (mod q), and u, v∈Z q ={0, 1, ..., q-1}; TA lies on the elliptic curve E q Choose a base point P on (u, v) with the same order as q; TA randomly generates a... As the system private key, calculate the system public key Pub = k·P;

[0069] S2: TA selects a one-way cryptographic hash function h: {0, 1} * →{0,1} l It can process an input string of arbitrary length x∈{0,1} * Mapped to a fixed-length l-bit output string h(x)∈{0,1} l For example, h(·) can be considered as a secure hash algorithm (SHA-1) that produces a 160-bit hash value. For higher security, it can also be SHA-256 or SHA-512.

[0070] S3: TA stores the system private key k in the database and publishes the parameter {E}. q (u, v), P, Pub, h(·)};

[0071] The trusted authorities in the registration phase include remote doctors, gateways, and medical robot registrations, specifically including:

[0072] Gateway Registration: A trusted and authoritative entity (TA) selects a real identity ID for the gateway (GW). GW Calculate the pseudo-identity PIDGW =h(ID) GW ||k), generate private key Then load {PID} for GW GW k GW};

[0073] Medical robot registration: For each deployed medical robot MR j TA generates a unique identity ID for it. j Calculate the pseudo-identity PID j =h(ID) j ||k), generate a random challenge Generate a public-private key pair In MR j Before accessing the network, TA loads the registration credentials for it. And make the Pub public j ;

[0074] Remote doctor registration: such as Figure 3 As shown, telemedicine doctors must register with the TA before using the system for the first time. The registration process is as follows:

[0075] Step RDR1: Remote Doctor RD i Select their real identity ID i and password PW i Then generate a registration request (Req). i =E pub (ID i Then send the Req through a secure channel. i Give it to them;

[0076] Step RDR2: Received Req i Then, TA calculates D. k (Req i To confirm RD i The identity of the user is determined, and a temporary identity TID is generated for them. i and a public-private key pair And send {TID i , {k i Pub i}, PID GW} Give RD i , where PID GW It is a fake identity for the gateway (GW);

[0077] Step RDR3: After receiving the message from TA, RD i Generate random numbers calculate PID i =h(ID) i ||ni ), stored in the terminal device's memory And make the Pub public i ;

[0078] The authentication phase enables gateway-assisted remote doctors and medical robots to authenticate each other and negotiate a shared key for subsequent secure communication between the two parties, specifically including:

[0079] Registered remote doctor RD i After successful login, the gateway will assist it in connecting with the registered medical robot MR. j Perform mutual authentication;

[0080] (1) Login: Remote Doctor RD i Enter ID′ in its device i and PW′ i Then, mobile device computing Determine if there is an n′ i =n i If the login is successful, then the login process is complete.

[0081] (2) Mutual authentication: After successfully logging in, the remote doctor authenticates with the medical robot with the assistance of the gateway. The authentication steps are as follows:

[0082] Step RMA1: Remote Doctor RD i Randomly generated Calculate the PID using the current timestamp T1. i =h(ID) i ||n i ), S i =h(r i ||TID i ‖PID i ||T1), R i =S i P and B = S i +k i Then, send message M1 = {R} through a public channel. i B, Pub i Pub j T1} is given to the gateway GW;

[0083] Step RMA2: After receiving M1 at time T′1, the GW first checks whether |T′1-T1| < ΔT, where ΔT is the system's "maximum transmission delay"; if not, the current session is terminated; otherwise, the GW verifies B·P = R. i +Pub i Is it true? If true, then generate randomly. Calculate V GW =h(r GW ||kGW ||PID GW ||T2); where T2 is the current timestamp; then calculate and Finally, send M2 = {R} i C, D, T2} give Pub j Corresponding MR j ;

[0084] Step RMA3: MR at T′2 j Upon receiving message M2, first check if |T′2-T2|<ΔT is satisfied; if not, terminate the current session; otherwise, MR j calculate Verify if it exists If satisfied, then generate the current timestamp T3 and a random number. calculate R j =S j P and E = S j +k j Finally, calculate the session key. and Session Key Authenticator SKV j =h(SK j ||T3); then send M3={R j E, SKV j T3} is given to GW;

[0085] Step RMA4: After receiving M3 at T′3, GW first checks whether the inequality |T′3-T3|>ΔT holds true; if it does, it continues to verify whether E·P=R holds true. j +Pub j If satisfied, generate the current timestamp T4 and calculate... And send message M4={R j SKV j C, F, T3, T4} give RD i ;

[0086] Step RMA5: RD at T′4 i If M4 is received, and |T′4-T4|<ΔT holds true, then first calculate... Stored in the device using PID_i XOR. Get PID GW Then verify Is it true? If true, then calculate. and SKV i =h(SK i ||T3); If SKV i =SKV j If the mutual authentication is successful, then the TID is updated.i =h(TID) i ||SK i ||T4);

[0087] Through the above steps, RD i With MR j A shared session key SK was successfully established via GW. i (=SK j ).

[0088] This invention provides a computer device, which includes a memory and a processor. The memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the medical tactile internet security authentication method against covert attacks.

[0089] This invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the medical tactile internet security authentication method against covert attacks.

[0090] This invention provides an information data processing terminal for implementing the medical tactile internet security authentication system against covert attacks.

[0091] The technical solution of this invention can be applied to medical tactile internet systems to ensure communication security. A typical application example is remote surgery. Authorized remote doctors control a remote robot to perform corresponding operations via touch, while simultaneously receiving tactile feedback from the patient. This helps remote doctors more accurately perceive the patient's physiological indicators, facilitating more accurate and timely treatment and contributing to the balancing of medical resources. If the communication security of the medical tactile internet system cannot be guaranteed, it can lead to erroneous operations and endanger the patient's life.

[0092] In terms of security, this invention can resist various known attacks, mainly including:

[0093] It is resistant to eavesdropping attacks, temporary secret disclosure attacks, long-term secret disclosure attacks, device capture attacks, privileged insider attacks, offline password guessing attacks, and combinations of these attacks (i.e., implicit attacks). It is also resistant to replay attacks, man-in-the-middle attacks, impersonation attacks, and desynchronization attacks. Furthermore, it offers anonymity, forward / backward key security, and session key security.

[0094] Regarding communication costs, this invention requires relatively low communication costs. To fairly compare communication costs, the data size involved is uniformly defined. It is assumed that a 160-bit elliptic curve cryptosystem provides the same level of security as a 1024-bit RSA public-key cryptosystem, and the point P on the elliptic curve is (160+160) = 320 bits (the x and y coordinates of P are both 160 bits). The encryption / decryption length using elliptic curve cryptography is 320 bits. It is also assumed that the identity, temporary identity, and temporary random number generated by GF(q) are all 160 bits long, the symmetric encryption / decryption length is 160 bits, and the timestamp is 32 bits. The hash digest length is 256 bits (using the SHA-256 algorithm). This invention requires the transmission of four messages, totaling 4128 bits. In other similar communication systems, Hu et al.'s system requires 4384 bits, while Li et al.'s system requires 6624 bits.

[0095] In terms of computational cost, this invention also has advantages. To facilitate comparison of the computational costs of different systems, the time required for a one-way cryptographic hash function, elliptic curve multiplication, and a physically unclonable function is defined as T. h T epm and T puf The experimental measurement values ​​used are: at the user equipment end, T h ≈0.067ms, T epm ≈13.56ms, T puf ≈0.023ms; On the IoT device side, T h ≈1.42ms, T epm ≈21.82ms, T puf ≈0.023ms; On the server side, T h ≈0.037ms, T epm ≈0.774ms. The computational cost of this invention at the remote doctor (user device) end is 7T. h +2T epm ≈27.589ms, the computation cost on the medical robot (IoT device) side is 4T. h +2T epm +T puf ≈49.343ms, gateway (server) cost is 4T h +2T epm The computation time is approximately 1.696ms, with a total computation cost of 78.628ms. In contrast, the system developed by Kaur et al. requires a computation cost of 273.831ms, the system invented by Hu et al. requires a cost of 95.91ms, and the system developed by Li et al. requires 136.08ms.

[0096] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0097] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A medical tactile internet security authentication system resistant to stealth attacks, characterized in that, The system includes: The Trusted Authority (TA), as a fully trusted entity, is responsible for the registration and authentication of remote doctors, medical robots, and gateways in the Medical Touch Internet. Remote doctors (RDs), registered with trusted and authoritative medical authorities (TAs), can remotely control medical robots via gateways using tactile feedback. Medical robots (MRs), deployed in medical settings, can replace remote doctors in conducting consultations and performing surgical procedures; The gateway (GW) connects remote doctors and medical robots, assisting them in authentication and facilitating secure communication through a shared key.

2. The medical tactile internet security authentication system against covert attacks as described in claim 1, characterized in that, The gateway (GW) is a partially trusted relay device that is responsible for transmitting authentication information and coordinating subsequent secure communications during the mutual authentication process between remote doctors and medical robots.

3. The medical tactile internet security authentication system against covert attacks as described in claim 1, characterized in that, The system employs elliptic curve cryptography for security authentication, where a trusted authority (TA) generates the system's public-private key pair and publishes the system's public key to ensure the security of identity authentication and communication between all devices.

4. The medical tactile internet security authentication system against covert attacks as described in claim 1, characterized in that, Remote doctors (RDs) use pseudo-identities for authentication in the system to prevent the leakage of their real identities. The authentication process ensures communication security through one-way hash functions and shared key generation mechanisms.

5. A medical tactile internet security authentication method based on the medical tactile internet security authentication system against covert attacks as described in any one of claims 1 to 4, characterized in that, This method specifically includes an initialization phase, a registration phase, and an authentication phase; The initialization phase initializes system parameters, specifically including: S1: The credible and authoritative TA first selects a large prime number q that has an infinity point or a zero point. nonsingular elliptic curve E on the finite field GF(q) q (u, v), its form is: y 2 =x 3 +ux+v(mod q); where 4u 3 +27v 2 ≠ 0 (mod q), and u, v∈Z q ={0, 1, ..., q-1}; TA lies on the elliptic curve E q Choose a base point P on (u, v) with the same order as q; TA randomly generates a... As the system private key, calculate the system public key Pub = k·P; S2: TA selects a one-way cryptographic hash function h: {0, 1} * →{0,1} l It can process an input string of arbitrary length x∈{0,1} * Mapped to a fixed-length l-bit output string h(x)∈{0,1} l For example, h(·) can be considered a secure hash algorithm that produces a 160-bit hash value. For higher security, it can also be SHA-256 or SHA-512. S3: TA stores the system private key k in the database and publishes the parameter {E}. q (u, v), P, Pub, h(·)}; The trusted authorities in the registration phase include remote doctors, gateways, and medical robot registrations, specifically including: Gateway Registration: A trusted and authoritative entity (TA) selects a real identity ID for the gateway (GW). GW Calculate the pseudo-identity PID GW =h(ID) GW ||k), generate private key Then load {PID} for GW GW ,k GW }; Medical robot registration: For each deployed medical robot MR j TA generates a unique identity ID for it. j Calculate the pseudo-identity PID j =h(ID) j ||k), generate a random challenge Generate a public-private key pair In MR j Before accessing the network, TA loads the registration credentials for it. And make the Pub public j ; Remote Doctor Registration: Remote doctors must register with the TA before using the system for the first time. The registration process is as follows: Step RDR1: Remote Doctor RD i Select their real identity ID i and password PW i Then generate a registration request (Req). i =E pub (ID i Then send the Req through a secure channel. i Give it to them; Step RDR2: Received Req i Then, TA calculates D. k (Req i To confirm RD i The identity of the user is determined, and a temporary identity TID is generated for them. i and a public-private key pair And send {TID i , {k i Pub i }, PID GW } Give RD i , where PID GW It is a fake identity for the gateway (GW); Step RDR3: After receiving the message from TA, RD i Generate random numbers calculate PID i =h(ID) i ||n i ), stored in the terminal device's memory And make the Pub public i ; The authentication phase enables gateway-assisted remote doctors and medical robots to authenticate each other and negotiate a shared key for subsequent secure communication between the two parties, specifically including: After a registered remote doctor (RDi) successfully logs in, the gateway assists them in connecting with the registered medical robot (MR). j Perform mutual authentication; (1) Login: Remote Doctor RD i Enter ID′ in its device i and PW′ i Then, mobile device computing Determine if there is an n′ i =n i If the login is successful, then the login process is complete. (2) Mutual authentication: After successfully logging in, the remote doctor authenticates with the medical robot with the assistance of the gateway. The authentication steps are as follows: Step RMA1: Remote Doctor RD i Randomly generated Calculate the PID using the current timestamp T1. i =h(ID) i ||n i ), S i =h(r i ||TID i ||PID i ||T1), R i =S i P and B = S i +k i Then, send message M1 = {R} through a public channel. i B, Pub i Pub j T1} is given to the gateway GW; Step RMA2: After receiving M1 at time T′1, the GW first checks whether |T′1-T1| < ΔT, where ΔT is the system's "maximum transmission delay"; if not, the current session is terminated; otherwise, the GW verifies B·P = R. i +Pub i Is it true? If true, then generate randomly. Calculate V GW =h(r GW ||k GW ||PID GW ||T2); where T2 is the current timestamp; then calculate and Finally, send M2 = {R} i C, D, T2} give Pub j Corresponding MR j ; Step RMA3: MR at T′2 j Upon receiving message M2, first check if |T′2-T2|<ΔT is satisfied; if not, terminate the current session; otherwise, MR j calculate Verify if it exists If satisfied, then generate the current timestamp T3 and a random number. calculate R j =S j P and E = S j +k j Finally, calculate the session key. and Session Key Authenticator SKV j =h(SK j ||T3); then send M3={R j E, SKV j T3} is given to GW; Step RMA4: After receiving M3 at T′3, GW first checks whether the inequality |T′3-T3|<ΔT holds; if it does, it continues to verify whether E·P=R holds. j +Pub j If satisfied, generate the current timestamp T4 and calculate... And send message M4={R j SKV j C, F, T3, T4} give RD i ; Step RMA5: RD at T′4 i If M4 is received, and |T′4-T4|<ΔT holds true, then first calculate... Stored in the device using PID_i XOR. Get PID GW Then verify Is it true? If true, then calculate. and SKV i =h(SK i ||T3); If SKV i =SKV j If the mutual authentication is successful, then the TID is updated. i =h(TID) i ||SK i ||T4); Through the above steps, RD i With MR j A shared session key SK was successfully established via GW. i (=SK j ).

6. A computer device, characterized in that, The computer device includes a memory and a processor. The memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of the medical tactile internet security authentication method against covert attacks as described in claim 5.

7. A computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the medical tactile internet security authentication method against covert attacks as described in claim 5.

8. An information data processing terminal, characterized in that, The information data processing terminal is used to implement the medical tactile internet security authentication system against covert attacks as described in any one of claims 1 to 4.

Images