Lightweight privacy-preserving data sharing methods for connected vehicles

Abstract

This invention discloses a lightweight privacy-preserving data sharing method for vehicle-to-everything (V2X) networks, relating to the field of V2X technology. This method aims to address the problems of high computational overhead and poor robustness in dynamic networks inherent in existing privacy protection schemes. The method includes: generating primary masks that are opposites of each other between vehicles; each vehicle calculating the sum of its primary masks to obtain a target mask and synchronizing it with a roadside unit (LSU); during data sharing, vehicles submit masked data superimposed with the data to be shared and the target mask; the LSU sums the received masked data; when a vehicle disconnects, the LSU adds the target mask of the disconnected vehicle to the summation result for compensation, thereby obtaining accurate aggregated data. This invention relies solely on addition and subtraction operations, resulting in low computational overhead, and effectively handles vehicle disconnections, ensuring the robustness and privacy of data aggregation.

Description

Technical Field

[0001] This invention relates to the field of vehicle networking technology, and in particular to a lightweight privacy-preserving data sharing method for vehicle networking. Background Technology

[0002] Vehicle-to-everything (V2X) communication enables real-time information exchange between vehicles, roadside infrastructure, and cloud service platforms, making it a key technology for intelligent transportation and autonomous driving. However, the openness and dynamism of V2X also bring serious security challenges.

[0003] First, the security of existing vehicle-to-everything (V2X) networks, which widely rely on traditional public-key cryptography such as elliptic curve cryptography and RSA, is based on mathematical problems such as large integer factorization and discrete logarithms. With the rapid development of quantum computing technology, quantum algorithms such as Shor's can theoretically break these cryptographic systems in polynomial time, posing a long-term and disruptive security threat to existing V2X identity authentication and data encryption mechanisms.

[0004] Secondly, to protect highly sensitive user data such as vehicle location and driving behavior, academia and industry have proposed various advanced privacy protection technologies, such as zero-knowledge proofs and fully homomorphic encryption. However, these technologies have extremely high computational costs; proof generation or ciphertext computation typically takes hundreds of milliseconds or even seconds, making it difficult to meet the millisecond-level low latency requirements of vehicle-to-everything (V2X) communication and unsuitable for resource-constrained edge devices such as vehicles or roadside units.

[0005] Finally, the Internet of Vehicles (IoV) is a highly dynamic mobile network environment where vehicles frequently switch between the coverage areas of different roadside units, resulting in intermittent and unstable network connections. Existing distributed authentication schemes (such as basic threshold signatures) or data aggregation schemes typically require all participants to be online simultaneously within a specific time window. The unexpected disconnection of any participant can lead to authentication failure or incorrect aggregation results, making it difficult to adapt to the actual application scenarios of the IoV. Summary of the Invention

[0006] This invention provides a lightweight privacy-preserving data sharing method for the Internet of Vehicles (IoV), which at least solves the problem that existing data aggregation schemes typically require all participants to be online simultaneously within a specific time window, and the unexpected disconnection of any participant may lead to incorrect aggregation results, making them unsuitable for the actual application scenarios of the IoV.

[0007] This invention provides a lightweight, privacy-preserving data sharing method for vehicle-to-everything (V2X) networks, comprising: For each vehicle within the coverage area of ​​the same roadside unit, a pair of master masks, which are opposites of each other and are kept by both parties respectively, are generated between them. Each vehicle synchronizes its own target mask with the roadside unit. The target mask of a vehicle is the sum of all the master masks stored by itself. During data sharing, each vehicle submits masked data, which includes its own data to be shared and the target mask, to its respective roadside unit. The roadside unit sums all the received masked data to obtain an aggregate sum; when there is a disconnected vehicle that fails to submit masked data, the roadside unit adds the target mask of the disconnected vehicle to the aggregate sum to obtain the final aggregate result.

[0008] In some embodiments, each vehicle within the coverage area of ​​the same roadside unit generates a pair of master masks, which are opposites of each other and are held by both parties respectively, specifically including: For each vehicle within the coverage area of ​​the same roadside unit, a pair of master masks with opposite numbers are generated between each vehicle and its K nearest vehicles.

[0009] In some embodiments, it also includes: The roadside unit assigns a spare mask to each vehicle within its coverage area, and the sum of multiple spare masks is zero; Each vehicle's masking data is also superimposed with its own backup mask. When a vehicle that has gone offline fails to submit masking data, the roadside unit will also add the backup mask of the offline vehicle to the aggregate sum.

[0010] In some embodiments, data encryption between the vehicle and the roadside unit is achieved through a layered hybrid quantum cryptography system; The layered hybrid quantum cryptography system includes a root trust layer, a domain session layer, and a message authentication layer; In the root trust layer, the authentication authority generates a long-term signature key pair and a key encapsulation pair for the vehicle through a post-quantum cryptography algorithm and a post-quantum key encapsulation mechanism, respectively; and when the vehicle enters a new security domain, the authentication authority uses the long-term signature key to achieve signature authentication between the vehicle and the roadside unit in the new security domain. In the domain session layer, when a vehicle enters a new security domain, the roadside unit negotiates a shared seed between the vehicles based on the key encapsulation and generates a short-term communication key based on the shared seed. In the message authentication layer, once the signature authentication is successful, data encryption and data signing between the vehicle and the roadside unit in the new security domain are achieved based on the short-term communication key.

[0011] In some embodiments, the post-quantum cryptography algorithm is Dilithium, and the post-quantum key encapsulation mechanism is Kyber.

[0012] In some embodiments, the data encryption and the data signature are implemented using the AES-GCM-128 symmetric authentication encryption algorithm and the Ed25519 lightweight signature algorithm, respectively.

[0013] In some embodiments, in the root trust layer, the private key in the vehicle's long-term signature key pair is decomposed into multiple private key fragments by the certification authority. The certification authority distributes the multiple private key fragments to multiple roadside units in the new security domain for safekeeping, and the vehicle itself does not retain any private key fragments. The multiple roadside units pre-calculate and cache a portion of the signature share based on the private key fragments they hold. When a vehicle initiates a signature authentication request, the authentication authority reconstructs the complete Dilithium signature based on multiple partial signature shares using Lagrange interpolation and then performs vehicle signature authentication based on this complete Dilithium signature.

[0014] In some embodiments, the certification authority uses a threshold secret sharing scheme to break down the private key in the vehicle's long-term signature key pair into multiple private key fragments.

[0015] In some embodiments, the threshold value in the threshold secret sharing scheme is configured to be positively correlated with the security level requirement.

[0016] In some embodiments, when a vehicle submits masked data, a data commitment corresponding to the data to be shared is also generated and submitted. After masking and aggregating the data, the roadside unit uses data commitments to audit the validity of the shared data.

[0017] This invention provides a lightweight, privacy-preserving data sharing method for vehicle-to-everything (V2X) networks. By introducing a master mask and a target mask, and having the roadside unit compensate for vehicle disconnection using its synchronized target mask, this method achieves privacy-preserving aggregation of vehicle data to be shared without relying on high-overhead cryptographic tools such as homomorphic encryption. This method relies only on addition and subtraction operations, resulting in extremely low computational overhead and meeting the low-latency requirements of V2X networks. Simultaneously, the disconnection compensation mechanism effectively solves the problem of aggregation failure caused by frequent vehicle disconnections during high-speed movement, ensuring the robustness of the aggregation process and the correctness of the results. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1This is a flowchart illustrating the lightweight privacy-preserving data sharing method provided by the present invention; Figure 2 This is a schematic diagram of the disconnection compensation mechanism in the lightweight privacy-preserving data sharing method provided by the present invention; Figure 3 This is a schematic diagram of the layered hybrid quantum cryptography system in the lightweight privacy-preserving data sharing method provided by the present invention; Figure 4 This is a schematic diagram of the distributed private key storage and threshold signature mechanism in the lightweight privacy-preserving data sharing method provided by the present invention; Figure 5 This is a flowchart illustrating a lightweight privacy-preserving data sharing method provided by the present invention; Figure 6 This is a schematic diagram of the architecture of the lightweight privacy-preserving data sharing system provided by the present invention. Detailed Implementation

[0020] The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and should not be construed as limiting the scope of the invention.

[0021] In the description of this invention, it should be noted that the terms "center," "longitudinal," "lateral," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0022] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "connected" and "linked" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0023] In one embodiment of this application, a lightweight privacy-preserving data sharing method for vehicle-to-everything (V2X) communication specifically includes: Within the coverage area of ​​the same roadside unit, each vehicle generates a pair of master masks that are opposites of each other and are kept by both parties. Each vehicle synchronizes its own target mask to the roadside unit, and the target mask of a vehicle is the sum of all the master masks it keeps. During data sharing, each vehicle submits masked data, which is superimposed with its own data to be shared and target mask, to its respective roadside unit. The roadside unit sums all the received masked data to obtain an aggregate sum. When a vehicle that has gone offline fails to submit masked data, the roadside unit adds the target mask of the offline vehicle to the aggregate sum to obtain the final aggregation result.

[0024] Specifically, this method first requires that in the same roadside unit (e.g. Figure 1 This involves establishing connections between vehicles (e.g., vehicle A and vehicle B) within the coverage area of ​​a roadside unit (RSU). For example, vehicle A and vehicle B negotiate to generate a master mask pair (M_ab, M_ba), where M_ab = -M_ba. Vehicle A stores M_ab, and vehicle B stores M_ba. The purpose is that in subsequent aggregation calculations, these paired masks can cancel each other out through simple addition, thereby eliminating their impact on the final aggregation result. This is the foundation for achieving lightweight privacy protection.

[0025] The underlying principle lies in utilizing the idea of ​​secret sharing, splitting a zero-valued secret (M_ab + M_ba = 0) between two participants. During data aggregation, as long as both participants submit their data, the masked portions they carry are naturally eliminated. Furthermore, the data and masked portions of a single participant are completely random to an eavesdropper, making it impossible to deduce the original data. In this way, this method solves the privacy leakage problem during data transmission and aggregation without introducing complex cryptographic operations (such as homomorphic encryption), achieving lightweight privacy protection.

[0026] Subsequently, each vehicle synchronizes its target mask with the roadside unit (RSU). A vehicle's target mask is defined as the sum of all master masks stored by that vehicle. For example, if vehicle A negotiates a master mask M_ab with vehicle B and also negotiates a master mask M_ad with vehicle D, then vehicle A's target mask TMa is M_ab + M_ad. After calculating its own TMa, each vehicle sends it to the RSU, providing necessary information for subsequent disconnection compensation mechanisms. The RSU pre-stores the target masks of all vehicles.

[0027] The underlying principle is that the target mask represents the total mask values ​​that a vehicle needs to "contribute" in the entire mask network. When all vehicles are online, the sum of all target masks is necessarily zero (because all primary masks are paired and opposite). However, when a vehicle goes offline, its unsubmitted target mask portion disrupts this balance. But the roadside unit has backups of all vehicle target masks; by compensating for the target masks of the offline vehicle, the balance can be restored, meaning the sum of all target masks remains zero, thus canceling each other out. Therefore, this method provides crucial robustness for handling highly dynamic vehicular network scenarios with network instability.

[0028] In the core phase of data sharing, each vehicle submits masked data, superimposed with its own data to be shared and a target mask, to its respective roadside unit (RSU). Specifically, vehicle A calculates "data A + TMa" and sends this result as masked data to the RSU. This step is the core operation for achieving data blinding, that is, hiding the value of the original data without changing the data's aggregability. The principle is that any third party (including other vehicles) who does not know TMa cannot decipher "data A" from "data A + TMa". In this way, the vehicle's original sensitive data (such as precise location, speed, etc.) is effectively protected before leaving the vehicle.

[0029] Next, the roadside unit (RSU) sums all the received masked data to obtain an aggregate sum. For example, if both vehicle A and vehicle B submit data, the RSU will calculate (data A + TMa) + (data B + TMb). Since the sum of the target masks of all online vehicles (TMa + TMb) is zero, TMA and TMb cancel each other out, allowing the RSU to obtain data A + data B. If vehicle C exists but did not submit data due to disconnection, the aggregate sum is not the final result and needs to be compensated through a subsequent disconnection compensation mechanism.

[0030] The disconnection compensation mechanism is a core innovation of this invention. When a disconnected vehicle fails to submit masking data, the roadside unit adds the target mask of the disconnected vehicle to the aggregate sum to obtain the final aggregation result. For example, refer to... Figure 1Suppose vehicles A, B, and C participate in aggregation, but vehicle C goes offline. The Roadside Unit (RSU) only receives (data A + TMMa) and (data B + TMb). Upon detecting vehicle C's offline status, the RSU retrieves the target mask TMc of vehicle C from its backup data and performs the final calculation: (data A + TMMa) + (data B + TMb) + TMc. Since TMA + TMb + TMc = 0 in a complete network, the above calculation result is equal to "data A + data B". Through this offline compensation mechanism, this method solves the stringent condition of traditional distributed privacy aggregation schemes requiring all participants to be online simultaneously, greatly improving the robustness and availability of the solution in real-world vehicle-to-everything (V2X) environments.

[0031] In summary, by introducing a master mask and a target mask, and having the roadside unit use its synchronized target mask for compensation when a vehicle disconnects, the method of this invention can achieve privacy-preserving aggregation of vehicle data to be shared without relying on high-overhead cryptographic tools such as homomorphic encryption. This method relies only on addition and subtraction operations, resulting in extremely low computational overhead and meeting the low-latency requirements of vehicle-to-everything (V2X) networks. Simultaneously, the disconnection compensation mechanism effectively solves the problem of aggregation failure caused by frequent vehicle disconnections during high-speed movement, ensuring the robustness of the aggregation process and the correctness of the results.

[0032] In one specific implementation, each vehicle within the coverage area of ​​the same roadside unit generates a pair of master masks with at least one other vehicle, which are respectively kept by both parties and are opposite to each other. Specifically, this includes generating a pair of master masks with each vehicle within the coverage area of ​​the same roadside unit and its nearest K vehicles, which are respectively kept by both parties and are opposite to each other.

[0033] Here, "nearest" can refer to the Euclidean distance in terms of geographical location or the number of hops in the network topology. K is a configurable parameter, such as K=3 or K=5.

[0034] By limiting negotiation to the nearest K vehicles, broadcast negotiation with all vehicles within the coverage area is avoided, significantly reducing communication overhead and the complexity of the negotiation process, especially in scenarios with high vehicle density. Secondly, establishing mask relationships with neighboring vehicles helps form locally stable communication clusters. When vehicles are moving smoothly on the road, the set of their neighbors changes relatively slowly, thus reducing the need for frequent master mask negotiation and target mask updates, improving system stability and efficiency. Finally, by adjusting the value of K, a flexible trade-off can be struck between privacy protection strength (more mask pairs mean a more complex mask network) and system overhead.

[0035] In one specific implementation, the lightweight privacy-preserving data sharing method further includes: the roadside unit assigns a spare mask to each vehicle within its coverage area and the sum of multiple spare masks is zero; the masked data of each vehicle is also superimposed with its own spare mask, and when there is a disconnected vehicle that fails to submit masked data, the roadside unit also adds the spare mask of the disconnected vehicle to the aggregate sum.

[0036] To further enhance the robustness and security of the system, this method also introduces a backup mask mechanism. (See reference...) Figure 2 Specifically, a roadside unit (such as RSU-1) assigns a spare mask to each vehicle (vehicle A / B / C) within its coverage area, and ensures that the sum of the multiple spare masks assigned to all vehicles within its coverage area is zero. For example, if RSU-1 covers vehicles A, B, and C, it will assign spare masks BMa, BMb, and BMc, satisfying BMa + BMb + BMc = 0.

[0037] In this implementation, the masking data for each vehicle is superimposed not only with its own target mask but also with its own backup mask. That is, the data submitted by vehicle A becomes "data A + TMa + BMa". Correspondingly, when a vehicle fails to submit masking data due to a disconnection, the roadside unit not only adds the target mask of the disconnected vehicle to the aggregate sum but also adds its backup mask to the aggregate sum. In other words, the roadside unit's compensation operation becomes adding "TMc + BMc".

[0038] Reference Figure 2 For example, within the coverage area of ​​the roadside unit RSU-1, there are vehicles A / B / C. Vehicles A / B / C carry data values ​​of 100 / 200 / 150 respectively, and the mask values ​​(target mask + spare mask) carried by vehicles A / B / C are 26 / 40 / -65 respectively. When vehicle C goes offline, the roadside unit RSU-1 fills in its mask value of -65, so that the final aggregation result is still 100+200=300, which is the sum of the data values ​​of vehicles A and B. Similarly, within the coverage area of ​​the roadside unit RSU-2, there are vehicles A / D / E. Vehicles A / D / E carry data values ​​of 120 / 180 / 90 respectively, and the mask values ​​(target mask + spare mask) carried by vehicles A / D / E are 30 / -10 / -20 respectively. There are no offline vehicles. Therefore, the final aggregation result is 120+180+90=390, which is the sum of the data values ​​of vehicles A, B and C.

[0039] The technical advantage of the above implementation method is that introducing a backup mask is equivalent to establishing a "vehicle-roadside unit" backup mask system in addition to the original "vehicle-to-vehicle" primary mask system. These two systems work in parallel, providing dual protection. First, since the backup mask is centrally generated and distributed by the roadside unit, the roadside unit has complete control over this portion of the mask, making the compensation mechanism more reliable. Second, this two-layer mask structure increases the difficulty of cracking; even if an attacker breaks through the primary mask negotiation process between some vehicles, the existence of the backup mask still provides a layer of protection for the data. Finally, by combining the primary and backup masks, the robustness and security of the entire privacy aggregation scheme are greatly enhanced.

[0040] Furthermore, to ensure data validity and traceability, when submitting masked data, vehicles can also generate and submit data commitments corresponding to the data to be shared. After aggregation, the roadside unit can use these data commitments to audit the validity of the data to be shared. Specifically, when submitting masked data, the vehicle attaches a data commitment value com_i = H(x_i || salt_i). Here, com_i is the data commitment, H is a hash function, x_i is the original data to be shared, and salt_i is a randomly generated salt value.

[0041] After data aggregation is complete, if auditing is required (e.g., to detect anomalies in the aggregation results), the roadside unit can request all participating vehicles to publish their original data to be shared, x_i, and salt_i. The roadside unit can then perform two verifications: first, verify that the H(x_i || salt_i) published by each vehicle matches its originally submitted com_i; second, verify that the published x_i is within a reasonable range.

[0042] The technical advantage of this implementation method lies in its ability to add a crucial layer of security to the system without compromising privacy. The "binding" nature of the data commitment ensures that once a vehicle submits its commitment, its original data cannot be tampered with; the "hiddenness" guarantees that the original data to be shared remains confidential until the disclosure phase. This effectively prevents malicious vehicles from submitting false or malicious data to interfere with the aggregation results, and once an anomaly is detected, the responsible party can be accurately traced, thereby significantly enhancing the credibility and security of the entire data sharing system.

[0043] In a preferred embodiment, to fundamentally address the long-term security threats faced by the Internet of Vehicles (IoV), particularly attacks from quantum computing, data encryption between the vehicle and the roadside unit can be implemented using a layered hybrid quantum cryptography system. Please refer to [link to relevant documentation]. Figure 2 The system includes a root trust layer, a domain session layer, and a message authentication layer.

[0044] In the root trust layer, the authentication authority generates long-term signature key pairs and key encapsulation pairs for the vehicle through post-quantum cryptography algorithms and post-quantum key encapsulation mechanisms, respectively; and when the vehicle enters a new security domain, the authentication authority uses the long-term signature key to achieve signature authentication between the vehicle and the roadside units in the new security domain.

[0045] In the domain session layer, when a vehicle enters a new security domain, the roadside unit negotiates a shared seed between the vehicles based on the key encapsulation and generates a short-term communication key based on the shared seed.

[0046] In the message authentication layer, once the signature authentication is successful, data encryption and data signing between the vehicle and the roadside unit in the new security domain are achieved based on the short-term communication key.

[0047] Specifically, in the root trust layer, the authentication authority uses post-quantum cryptography algorithms and post-quantum key encapsulation mechanisms to generate long-term identity credentials for vehicles, namely long-term signature key pairs and key encapsulation pairs. This layer establishes the trust foundation for the entire system, and its security directly determines the long-term reliability of the system. When a vehicle needs to enter a new security domain, such as moving from one city to another, the authentication authority uses the vehicle's long-term signature key to perform signature authentication between the vehicle and roadside units within the new security domain, establishing their respective legitimate identities.

[0048] In the domain session layer, once a vehicle successfully enters a new security domain, the roadside unit utilizes the trust relationship established in the root trust layer to negotiate a shared seed with the vehicle through a key encapsulation mechanism. Based on this shared seed, it uses a key derivation function (e.g., HKDF) to generate a series of session keys for short-term communication within that domain. This layer acts as a bridge, transforming high-cost post-quantum cryptographic operations into a series of lightweight symmetric keys, preparing for high-frequency communication.

[0049] In the message authentication layer, once signature authentication and session key negotiation are successful, the daily high-frequency data exchange between the vehicle and the roadside unit (e.g., dozens of location updates per second) is entirely based on the short-term communication key generated in the domain session layer, implemented through efficient symmetric encryption and data signature algorithms. For example, AES-GCM-128 can be used for encryption and authentication, or a lightweight signature algorithm can be used for signing. The entire system can be organized using a key derivation tree structure to ensure one-way key security.

[0050] The technical advantage of the above implementation lies in its layered design, which cleverly balances security and efficiency. The root trust layer uses a post-quantum algorithm, which has high computational overhead but is resistant to quantum attacks, ensuring the long-term security of the system; while the message authentication layer uses a traditional symmetric algorithm with low computational overhead and high speed, meeting the real-time communication requirements of low latency and high concurrency in vehicle-to-everything (V2X) networks. This strategy of combining short-term and long-term security with rigidity and flexibility is an effective way to solve future V2X security problems.

[0051] Preferably, the post-quantum cryptography algorithm used in the root trust layer is Dilithium, and the post-quantum key encapsulation mechanism is Kyber.

[0052] Dilithium and Kyber are the algorithms ultimately selected by the National Institute of Standards and Technology (NIST) in its Post-Quantum Cryptography (PQC) standardization project. The selection of these standardized algorithms, which have undergone years of rigorous review and evaluation by the global cryptography community, provides a reliable guarantee for the security of this invention. This not only ensures technological advancement and reliability but also guarantees good interoperability and compliance in future practical deployments.

[0053] Preferably, the data encryption algorithm and data signature algorithm used in the message authentication layer can be the AES-GCM-128 symmetric authentication encryption algorithm and the Ed25519 lightweight signature algorithm, respectively. That is, data encryption and data signature are implemented by the AES-GCM-128 symmetric authentication encryption algorithm and the Ed25519 lightweight signature algorithm, respectively.

[0054] AES-GCM-128 is a widely used and proven secure and efficient authentication and encryption algorithm. It can simultaneously encrypt and protect data integrity in a single operation, making it ideal for resource-constrained IoT devices. Ed25519, on the other hand, is a high-performance public-key signature algorithm with very fast signing and verification speeds and a small signature size, making it well-suited for vehicle-to-everything (V2X) communication scenarios requiring rapid signing of numerous small messages. By selecting these two mature and efficient algorithms, the computational and communication overhead of the message authentication layer can be minimized, ensuring the real-time performance of V2X communication.

[0055] In summary, the layered hybrid quantum cryptography system achieves one-way secure transmission of three layers of keys through a key derivation tree. In one example, the Dilithium long-term signature key pair / Kyber key encapsulation pair of the root trust layer serves as the root node, the short-term communication key of the domain session layer serves as the intermediate node, and the Ed25519 subkey / AES-GCM subkey of the message authentication layer serves as the leaf node; the leakage of subkeys does not affect the security of the parent key, and the update of the parent key is automatically propagated downwards through the derivation function.

[0056] In a preferred embodiment, in order to solve the problem of secure storage and use of vehicle private keys over a long period of time, the present invention introduces a distributed private key storage and threshold signature mechanism.

[0057] Reference Figure 3 Specifically, in the root trust layer, after the private key (e.g., the Dilithium private key) in the vehicle's long-term signature key pair is generated, the certification authority breaks it down into multiple private key fragments. These fragments are then distributed to multiple roadside units within the new security domain for safekeeping, while the vehicle itself does not retain any private key fragments. This design fundamentally eliminates the risk of private key leakage at the vehicle end.

[0058] To improve signature efficiency, each roadside unit can pre-calculate and cache partial signature shares using its private key fragments for common authentication request messages during idle periods. When a vehicle actually initiates a signature authentication request, an aggregation node collects these pre-calculated partial signature shares from multiple roadside units and quickly reconstructs the complete Dilithium signature using mathematical methods such as Lagrange interpolation. The vehicle's signature authentication is then performed based on this reconstructed complete signature.

[0059] The benefits of distributed private key storage are twofold: First, by fragmenting and distributing the private key across multiple fixed roadside units with higher physical security levels, the security of the private key is greatly improved, preventing the leakage of core keys due to theft or attack on a single vehicle. Second, the "pre-computation" mechanism shifts time-consuming cryptographic operations to off-peak hours, resulting in extremely low latency for online real-time signature authentication. This effectively solves the efficiency bottleneck of distributed authentication and meets the needs of vehicle-to-everything (V2X) networks for rapid cross-domain authentication.

[0060] Furthermore, the certification authority uses a threshold secret sharing scheme to break down the private key in the vehicle's long-term signature key pair into multiple private key fragments.

[0061] For example, an (n,t) threshold secret sharing scheme can be used, where n is the total number of roadside units and t is the minimum number of partial signature shares (threshold value) required to reconstruct the signature.

[0062] The (n,t) threshold secret sharing scheme provides quantifiable fault tolerance and security for distributed authentication systems. As long as at least t roadside units are online and functioning normally, the signature service will not be interrupted, allowing the system to tolerate up to (nt) roadside units failing, going offline, or being attacked simultaneously. Meanwhile, an attacker must compromise at least t roadside units simultaneously to obtain enough information to forge a signature, significantly increasing the barrier to entry and cost of an attack. This (n,t) threshold structure is key to achieving highly available and secure distributed systems.

[0063] In a preferred embodiment, the threshold value in the threshold-based secret sharing scheme is configured to be positively correlated with the security level requirements. This means that for an (n,t) threshold-based secret sharing scheme, the threshold value t can be dynamically adjusted according to the system's security posture. For example, under normal circumstances, a lower t value (e.g., t=n / 2+1) can be set to pursue higher efficiency and availability. When the system detects an increase in the security threat level (e.g., detecting signs of a large-scale coordinated attack), the t value can be dynamically increased (e.g., t=2n / 3), requiring more roadside units to participate in signing, thereby enhancing the system's security. For example, in normal scenarios, t can be set to 3; in peak traffic scenarios, t can be set to 4; and during security warnings, t can be set to 5.

[0064] Reference Figure 4 In one example scenario, the Certification Authority (CA) divides the private key into eight parts, which are then stored by eight roadside units (RSU-1 to RSU-8) within the same security domain. A threshold value t=5 is set (meaning that a complete signature can be recovered as long as five partial signature shares are available, and a maximum of three roadside units are allowed to go offline). When roadside units RSU-6 to RSU-8 go offline, the aggregation node can recover the complete signature by collecting the five partial signature shares provided by roadside units RSU-1 to RSU-5 and performing Lagrange interpolation.

[0065] Through the above design, the system's security strategy is no longer static and rigid, but possesses dynamic adaptability and resilient defense capabilities. The system can flexibly balance efficiency and security, automatically or manually adjusting its security baseline according to actual security needs and environmental changes, thereby ensuring business continuity while maximizing its ability to mitigate potential security risks.

[0066] It should be noted that the different specific implementation methods in the above embodiments can be combined to form different detailed embodiments.

[0067] The following is a detailed explanation of the lightweight privacy-preserving data sharing method in this application through a data sharing process example.

[0068] Reference Figure 4 In an example process: First, during the S100 system initialization phase, a new vehicle A registers with a certification authority (CA). The CA generates a long-term key pair for A based on the post-quantum algorithms Dilithium and Kyber. Next, the CA uses an (n,t) threshold secret sharing scheme to decompose the Dilithium private key into n private key fragments and securely distributes these fragments to n roadside units within the target security domain for safekeeping. Vehicle A itself does not retain any private key fragments, only securely storing its Kyber private key. Simultaneously, each roadside unit pre-computes and caches a portion of the signature share during idle periods.

[0069] Then, when vehicle A travels and enters a new security domain, it enters the S200 cross-domain authentication phase. Vehicle A first broadcasts an authentication request to that domain. Upon receiving the request, at least t roadside units online within that domain provide partial signatures using fragments of their private keys and pre-computed shares. An aggregation node collects these partial signatures and reconstructs the complete Dilithium signature using Lagrange interpolation, thus authenticating vehicle A. After successful authentication, vehicle A and the roadside units negotiate a domain session key using Kyber and derive the AES-GCM-128 key and Ed25519 key for the message authentication layer.

[0070] After authentication, vehicle A begins participating in the S300 lightweight privacy aggregation phase. (Reference) Figure 1 The interaction sequence is as follows: First, vehicle A negotiates a primary mask with neighboring vehicles such as vehicle B, for example, (M_ab, M_ba). Simultaneously, the roadside unit assigns spare masks BMa / BMb / BMc, whose sum is zero, to vehicles A, B, and C. Next, each vehicle calculates and synchronizes its target mask with the roadside unit, for example, TMa = M_ab + … Then, online vehicles such as vehicles A and B superimpose their respective data to be shared, target mask, and spare mask, attach a data commitment, and submit the masked data to the roadside unit.

[0071] After collecting data, the roadside unit begins aggregation and compensation. It sums all received masked data. If vehicle C fails to submit data before the deadline, the roadside unit proactively adds the pre-stored target mask TMc and backup mask BMC of vehicle C to the sum. Since the sum of all primary and backup masks is zero, the final aggregated sum will be exactly equal to the sum of the original shared data of all online vehicles.

[0072] Finally, if necessary, the S400 audit and tracing phase can be initiated. Roadside units or third-party auditing agencies can leverage previously collected data commitments to require vehicles to disclose their original data to be shared and their salt values ​​to verify the validity and scope compliance of the data, thereby tracing malicious behavior.

[0073] This embodiment organically combines a layered hybrid quantum cryptography system, distributed threshold signatures, two-layer masked privacy aggregation, and a data commitment auditing mechanism to achieve an end-to-end secure data sharing solution that is resistant to future quantum attacks, meets the current real-time requirements of vehicle-to-everything (V2X) networks, and possesses high robustness and auditability. The synergistic effect of these technical features significantly improves the overall performance of the invention, achieving the technical goals of high efficiency, accuracy, security, and reliability.

[0074] As can be seen from the above description, the lightweight privacy-preserving data sharing provided in this application has the following technical effects: 1. By introducing a master mask and a target mask, and having the roadside unit compensate for vehicle disconnection using its synchronized target mask, the method of this invention can achieve privacy-preserving aggregation of vehicle data to be shared without relying on high-overhead cryptographic tools such as homomorphic encryption. This method relies only on addition and subtraction operations, resulting in extremely low computational overhead and meeting the low-latency requirements of vehicle-to-everything (V2X) networks. Simultaneously, the disconnection compensation mechanism effectively solves the problem of aggregation failure caused by frequent vehicle disconnections during high-speed movement, ensuring the robustness of the aggregation process and the correctness of the results.

[0075] 2. By introducing a backup mask mechanism, roadside units can perform outage compensation in a more efficient manner. Since the backup masks are uniformly allocated and managed by the roadside units and their sum is zero, when used in conjunction with the target mask, they can provide the system with dual compensation capabilities, further enhancing the system's robustness in the face of large-scale and variable outage situations.

[0076] 3. By introducing a layered hybrid post-quantum cryptography system, post-quantum algorithms (such as Dilithium and Kyber) are used at the root trust layer, effectively resisting the threat of future quantum computing and ensuring the long-term security of the system. At the same time, lightweight cryptographic algorithms (such as AES-GCM-128 and Ed25519) are used at the message authentication layer, ensuring the millisecond-level low latency requirements of daily high-frequency communication, and achieving an effective balance between long-term security and real-time performance.

[0077] 4. By adopting a threshold secret sharing scheme to fragment vehicle private keys and distribute them to multiple roadside units for safekeeping, and combining pre-computation and Lagrange interpolation to reconstruct signatures, not only is the single point of failure of vehicle private keys eliminated, but also the efficiency and availability of identity authentication are significantly improved through distributed collaboration and pre-computation optimization, so that the authentication service can still be provided normally when some roadside units fail.

[0078] In one embodiment of this application, a lightweight privacy-preserving data sharing system for vehicle-to-everything (V2X) networks is also provided, which serves as the physical carrier for implementing the above-described methods. Please refer to [link / reference]. Figure 6The system may include an on-board safety module, a roadside safety module, and a blockchain evidence storage module.

[0079] The vehicle security module is typically deployed within the vehicle's Hardware Security Module (HSM) or Trusted Execution Environment (TEE). Its primary responsibilities include securely storing the vehicle's short-term keys, performing key derivation operations, calculating master and target masks, generating masked data, and performing lightweight signature and encryption operations. According to a preferred design of the present invention, this module does not hold any long-term private key fragments, thus ensuring that even if the vehicle is physically compromised, the core identity keys will not be leaked.

[0080] The roadside security module consists of multiple roadside units fixedly deployed within the same security domain. Each roadside unit is a functional node, whose responsibilities include: storing a private key fragment, performing partial signature operations when needed, negotiating session keys with vehicles entering its coverage area, collecting and aggregating blinding data submitted by vehicles, and acting as a mask holder and compensator to compensate for missing masks for offline vehicles. A key feature of this invention is that the aggregation process of each roadside unit operates independently (e.g., ...). Figure 2 The aggregation of RSU-1 and RSU-2 coverage areas is independent and does not affect each other, which can well adapt to vehicle mobility.

[0081] The blockchain evidence storage module can be a consortium blockchain or a public blockchain. Its role is to serve as a highly trusted, immutable distributed ledger for recording critical security events and data summaries. For example, a vehicle's public key, the threshold signature parameters (n, t), the Merkle root generated by data commitments in each data aggregation event, and the final aggregation result can all be recorded on the blockchain. The blockchain does not store the original sensitive data; it only stores data fingerprints used for auditing and verification, thus providing transparent and traceable auditing capabilities for the entire system.

[0082] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A lightweight privacy-preserving data sharing method for vehicle-to-everything (V2X) networks, characterized in that, include: For each vehicle within the coverage area of ​​the same roadside unit, a pair of master masks, which are opposites of each other and are kept by both parties respectively, are generated between them. Each vehicle synchronizes its own target mask with the roadside unit. The target mask of a vehicle is the sum of all the master masks stored by itself. During data sharing, each vehicle submits masked data, which includes its own data to be shared and the target mask, to its respective roadside unit. The roadside unit sums all the received masked data to obtain an aggregate sum; when there is a disconnected vehicle that fails to submit masked data, the roadside unit adds the target mask of the disconnected vehicle to the aggregate sum to obtain the final aggregate result.

2. The lightweight privacy-preserving data sharing method for vehicle networking according to claim 1, characterized in that, For each vehicle within the coverage area of ​​the same roadside unit, a pair of master masks, which are opposites of each other and are held by both parties respectively, are generated between them. Specifically, this includes: For each vehicle within the coverage area of ​​the same roadside unit, a pair of master masks with opposite numbers are generated between each vehicle and its K nearest vehicles.

3. The lightweight privacy-preserving data sharing method for vehicle networking according to claim 1, characterized in that, Also includes: The roadside unit assigns a spare mask to each vehicle within its coverage area, and the sum of multiple spare masks is zero; Each vehicle's masking data is also superimposed with its own backup mask. When a vehicle that has gone offline fails to submit masking data, the roadside unit will also add the backup mask of the offline vehicle to the aggregate sum.

4. The lightweight privacy-preserving data sharing method for vehicle networking according to claim 1, characterized in that, Data encryption between vehicles and roadside units is achieved through a layered hybrid quantum cryptography system; The layered hybrid quantum cryptography system includes a root trust layer, a domain session layer, and a message authentication layer; In the root trust layer, the authentication authority generates a long-term signature key pair and a key encapsulation pair for the vehicle through a post-quantum cryptography algorithm and a post-quantum key encapsulation mechanism, respectively; and when the vehicle enters a new security domain, the authentication authority uses the long-term signature key to achieve signature authentication between the vehicle and the roadside unit in the new security domain. In the domain session layer, when a vehicle enters a new security domain, the roadside unit negotiates a shared seed between the vehicles based on the key encapsulation and generates a short-term communication key based on the shared seed. In the message authentication layer, once the signature authentication is successful, data encryption and data signing between the vehicle and the roadside unit in the new security domain are achieved based on the short-term communication key.

5. The lightweight privacy-preserving data sharing method for vehicle networking according to claim 4, characterized in that, The post-quantum cryptography algorithm is Dilithium, and the post-quantum key encapsulation mechanism is Kyber.

6. The lightweight privacy-preserving data sharing method for vehicle networking according to claim 4, characterized in that, The data encryption and data signature are implemented using the AES-GCM-128 symmetric authentication encryption algorithm and the Ed25519 lightweight signature algorithm, respectively.

7. The lightweight privacy-preserving data sharing method for vehicle networking according to claim 5, characterized in that, In the root trust layer, the private key in the vehicle's long-term signature key pair is decomposed into multiple private key fragments by the certification authority. The certification authority distributes the multiple private key fragments to multiple roadside units in the new security domain for safekeeping, and the vehicle itself does not retain any private key fragments. The multiple roadside units pre-calculate and cache a portion of the signature share based on the private key fragments they hold. When a vehicle initiates a signature authentication request, the aggregation node reconstructs the complete Dilithium signature based on multiple partial signature shares using Lagrange interpolation, and then performs vehicle signature authentication based on this complete Dilithium signature.

8. The lightweight privacy-preserving data sharing method for vehicle networking according to claim 7, characterized in that, The certification authority uses a threshold secret sharing scheme to break down the private key in the vehicle's long-term signature key pair into multiple private key fragments.

9. The lightweight privacy-preserving data sharing method for vehicle networking according to claim 8, characterized in that, The threshold value in the threshold-based secret sharing scheme is configured to be positively correlated with the security level requirements.

10. The lightweight privacy-preserving data sharing method for vehicle networking according to claim 3, characterized in that, When a vehicle submits masked data, a data commitment corresponding to the data to be shared is also generated and submitted. After masking and aggregating the data, the roadside unit uses data commitments to audit the validity of the shared data.

Images