Identity-based edge computing authentication system

Abstract

The present application relates to an identity-based edge computing authentication system, which integrates technologies such as cryptography and key management. With the popularization of edge computing, a large number of edge devices access the network, and traditional authentication methods have many limitations in the face of edge computing environments, such as centralized authentication servers being prone to performance bottlenecks, requiring high network and device resources, and being difficult to adapt to device heterogeneity. The system builds a multi-level PKG key generation center, which generates a system master key from the root PKG and distributes private key generation keys to lower-level PKGs. The identity-based authentication mechanism allows devices to authenticate with a unique identity, avoiding complex certificate management and improving authentication efficiency. The secure communication and data encryption module uses symmetric encryption algorithms to encrypt transmitted data and asymmetric encryption algorithms to exchange keys. The system is efficient, secure, and scalable, and can efficiently and securely authenticate and manage edge computing devices, making it widely applicable in the field of edge computing.

Description

Technical Field

[0001] The identity-based edge computing authentication system involves multiple technical fields such as cryptography, key management, encrypted data storage, transport layer protocols, identity authentication and authorization. By integrating these technologies, it solves the problems of efficient and reliable authentication of a large number of terminal edge devices and encrypted transmission of privacy data stored in the devices. Background Technology

[0002] With the widespread application of edge computing in various fields, a large number of edge devices are connecting to the network. These devices generate and process massive amounts of sensitive data, making their security crucial. However, traditional authentication methods have many limitations when facing edge computing environments.

[0003] Existing shortcomings and deficiencies: On the one hand, traditional centralized authentication servers easily become performance bottlenecks, leading to authentication delays or even system crashes when a large number of edge devices simultaneously request authentication. On the other hand, traditional authentication protocols have high requirements for network stability and device resources, making them difficult to adapt to the resource-constrained and complex / variable network environments of edge devices. Furthermore, the heterogeneity of edge devices makes it difficult to implement a unified authentication mechanism. Therefore, there is an urgent need for an efficient, secure authentication system that is adaptable to edge computing environments. Summary of the Invention

[0004] Purpose of the invention: The purpose of this invention is to provide an edge computing authentication system based on identity identification, which achieves efficient and secure authentication of edge computing devices through a multi-level PKG key generation center, and solves the shortcomings of existing authentication methods in edge computing environments. Technical solution:

[0005] Multi-level PKG Key Generation Center: This system constructs a multi-level PKG key generation center, including a root PKG, first-level PKGs, and second-level PKGs. The root PKG is responsible for generating and managing the master key for the entire system and issuing private keys to the first-level PKGs. The first-level PKGs, authorized by the root PKG, generate private keys for the second-level PKGs, and so on. This hierarchical structure makes key management more flexible and secure, while reducing the burden on the root PKG and improving system scalability.

[0006] Identity-based authentication mechanism: Each edge computing device possesses a unique identity. During authentication, the device sends its identity to the authentication center. The authentication center generates a corresponding private key based on the device's identity through a multi-level PKG key generation center. The device uses this private key to sign the authentication information, and the authentication center verifies the signature using the corresponding public key, thus completing the authentication process. This identity-based authentication mechanism avoids the complex certificate management process of traditional authentication methods, improving authentication efficiency.

[0007] Secure Communication and Data Encryption: During communication between edge devices and the authentication center, symmetric encryption algorithms are used to encrypt data transmission, ensuring data confidentiality and integrity. Simultaneously, asymmetric encryption algorithms are used for key exchange to guarantee the secure distribution of symmetric encryption keys. Advantages of the invention:

[0008] Efficiency: The multi-level PKG key generation center structure makes key generation and management more efficient, reducing authentication latency. The identity-based authentication mechanism avoids cumbersome certificate operations, further improving authentication speed and meeting the real-time requirements of edge computing devices.

[0009] Security: Multi-layered key management and identity-based authentication enhance system security. Even if the private keys of a PKG at one level or some devices are leaked, the overall system security will not be affected. Simultaneously, secure communication and data encryption mechanisms protect data during transmission and storage.

[0010] Scalability: The multi-tiered architecture allows the system to easily handle the access of a large number of edge devices, exhibiting excellent scalability. New edge devices can be easily added to the system simply by registering and generating keys at the corresponding PKG level. Detailed Implementation

[0011] Figure 1 This is a flowchart of the authentication process of the present invention.

[0012] Figure 2 This is a diagram of the algorithm structure of the present invention.

[0013] 1. Establishment of a multi-level PKG key generation center: First, initialize the root PKG, generate the system master key, and set the relevant parameters of the root PKG, such as the encryption algorithm and key length.

[0014] According to the system plan, the root PKG generates private keys for the first-level PKG and securely distributes them to each first-level PKG.

[0015] After receiving the private key, the first-level PKG generates a key for the second-level PKG based on the region or device type it manages, and so on, thus completing the construction of a multi-level PKG key generation center.

[0016] 2. Edge device registration and certification: When an edge device first connects to the system, it sends its identity identifier to the local secondary PKG.

[0017] The secondary PKG generates a private key for the device based on the device's identity using the private key obtained from the primary PKG, and then securely sends the private key to the device.

[0018] When a device needs to be authenticated, it uses its private key to sign the authentication information and then sends the signed authentication information to the authentication center.

[0019] After receiving the authentication information, the authentication center obtains the corresponding public key from the multi-level PKG key generation center based on the device's identity and verifies the validity of the signature. If the signature verification passes, authentication is successful, and the device is allowed to access the system; otherwise, authentication fails, and device access is denied.

[0020] 3. Secure communication and data encryption: When establishing a communication connection between the edge device and the authentication center, the asymmetric encryption algorithm ECC is used for key exchange to generate a symmetric encryption key. During communication, both parties use the symmetric encryption algorithm AES to encrypt and transmit data.

[0021] Through the above specific implementation methods, the edge computing authentication system based on identity identification of the present invention can efficiently and securely realize the authentication and management of edge computing devices, and has broad application prospects.

Claims

1. An edge computing authentication system based on identity identification, characterized in that, It includes a multi-level PKG key generation center, an identity-based authentication mechanism, and a secure communication and data encryption module: Multi-level PKG Key Generation Center: It consists of a hierarchical structure of root PKG, first-level PKG, second-level PKG, etc. The root PKG is responsible for generating and managing the system master key and issuing private keys to the first-level PKG. The first-level PKG generates private keys for the second-level PKG based on the authorization of the root PKG, and so on, to achieve hierarchical key management.

2. Identity-based authentication mechanism: Each edge computing device has a unique identity. During authentication, the device sends its identity to the authentication center, which generates a corresponding private key based on the identity through a multi-level PKG key generation center. The device uses the private key to sign the authentication information, and the authentication center uses the corresponding public key to verify the signature to complete the authentication.

3. Secure Communication and Data Encryption Module: When the edge device communicates with the authentication center, it uses a symmetric encryption algorithm to encrypt the data during transmission and uses an asymmetric encryption algorithm for key exchange to ensure the confidentiality and integrity of the data and the secure distribution of the symmetric encryption key.

4. The edge computing authentication system based on identity verification according to claim 1, characterized in that, The method for establishing the multi-level PKG key generation center includes: Initialize the root PKG, generate the system master key, and set the relevant parameters of the root PKG, including the encryption algorithm and key length; According to the system plan, the root PKG generates private keys for the first-level PKG and securely distributes them to each first-level PKG. After receiving the private key generation key, the first-level PKG generates a private key generation key for the second-level PKG based on the region or device type it manages, and so on, thus completing the construction of a multi-level PKG key generation center.

5. The edge computing authentication system based on identity verification according to claim 1, characterized in that, The process for registering and authenticating the edge device is as follows: When an edge device first connects to the system, it sends its identity identifier to the local secondary PKG; The secondary PKG generates a key for the device based on the device's identity using the private key obtained from the primary PKG, and securely sends it to the device. When a device is authenticated, it signs the authentication information with its private key and sends the signed authentication information to the authentication center. After receiving the authentication information, the authentication center obtains the corresponding public key from the multi-level PKG key generation center based on the device's identity and verifies the signature validity. If the signature verification passes, the authentication is successful, and the device is allowed to access the system; if the verification fails, the authentication fails, and the device access is denied.

6. The edge computing authentication system based on identity verification according to claim 1, characterized in that, The secure communication and data encryption are implemented as follows: when the edge device and the authentication center establish a communication connection, the asymmetric encryption algorithm ECC is used to exchange keys and generate a symmetric encryption key; during the communication process, both parties use the symmetric encryption algorithm AES to encrypt and transmit data.

7. An edge computing authentication method based on identity identification, applied to the edge computing authentication system based on identity identification as described in any one of claims 1-4, characterized in that, Includes the following steps: Establish a multi-level PKG key generation center to complete the key generation and distribution of root PKG, first-level PKG, second-level PKG, etc., according to the method described in claim 2; The edge device registration and authentication process is executed, and the edge device registration, private key generation, authentication information signing and authentication center signature verification are completed according to the steps described in claim 3. Secure communication and data encryption are achieved by exchanging keys and transmitting encrypted data between the edge device and the authentication center in the manner described in claim 4.

Images