A quantum key dynamic distribution and switching method for high-frequency authentication of Internet of Vehicles

Abstract

The application relates to the technical field of Internet of Vehicles communication, and discloses a quantum key dynamic distribution and switching method for high-frequency authentication of Internet of Vehicles, which comprises a pre-charge quantum key stage, a registration stage, an authentication stage and a re-authentication stage: when a vehicle moves to a new roadside unit coverage range, the vehicle and the new roadside unit perform lightweight bidirectional identity authentication and negotiate to generate a new session key; a quantum key distribution link switching stage: the link state parameters of a main link between a quantum security cloud and a roadside unit are monitored in real time, when the link state parameters do not satisfy a set threshold condition and are judged as link degradation, the quantum security cloud coordinates the roadside unit to stop new key distribution of the main link, and on the premise of maintaining the current session state, the key source is switched to a backup link to obtain a quantum key at the next session key update. The application realizes low-latency and non-susceptible switching of quantum security between multiple roadside units.

Description

Technical Field

[0001] This invention relates to the field of vehicle-to-everything (V2X) communication technology, specifically a method for dynamic distribution and switching of quantum keys for high-frequency authentication in V2X, and a system applying this method. Background Technology

[0002] Intelligent Transportation Systems (ITS) Intelligent Transportation Systems, ITS The Internet of Vehicles (IoV) is currently undergoing a transformation from "informatization" to "connectivity and intelligence," and the IoV is... Internet of Vehicles, IoV With its rapid development, it has become ITS This crucial component enables interconnection between vehicles, roads, and the cloud, forming a modern... ITS The neural network. In the vehicle-to-everything (V2X) environment, vehicles can interact with roadside units (Roadside Units). Roadside Unit, RSU This allows for two-way authentication and the use of various low-latency, location-aware applications to improve traffic conditions and enhance driving safety. However, IoV They often rely on public wireless channels to complete the transmission and exchange of data, and the transmitted data generally contains sensitive data such as vehicle identity information and location information. Therefore, they are extremely vulnerable to various security threats such as man-in-the-middle attacks, replay attacks, and impersonation attacks. Once such data is leaked, it will cause serious privacy and security problems.

[0003] Existing solutions often employ elliptic curve cryptography (ECC) Elliptic Curve Cryptography, ECC Anonymous authentication can be achieved through methods such as ) or bilinear mapping, and by using public key infrastructure (PKI). Public Key Infrastructure, PKI The certificate system ensures the security of vehicle-to-everything (V2X) communication, thereby enabling a point-to-point independent authentication mode. However, with... ITS The rapid development has led to a surge in the number of vehicles. RSU The deployment density also increases accordingly, with vehicles frequently entering or leaving while traveling at high speeds. RSU In areas with limited coverage, traditional point-to-point solutions cannot meet the business needs of vehicles simultaneously accessing multiple emergency services. Therefore, how to address this issue in multiple... RSU Achieving millisecond-level switching authentication and continuous service has become a core challenge in ensuring the continuity of connected vehicle services. However, based on ECC The proposed solutions generally have high computational overhead, making them difficult to meet high-frequency requirements. Although bilinear mapping is relatively... ECC It can improve security, but the computational and communication overhead also increases accordingly. PKI Certificate systems also face the risk of centralization. If the certification authority is attacked or malfunctions, the entire trust system will collapse, creating a single point of failure and leading to privacy breaches. Furthermore, with the rapid development of quantum technology, traditional cryptographic systems face threats from quantum computing, for example… Shor Quantum algorithms can efficiently solve problems in polynomial time. ECCCryptographic systems, therefore, traditional methods of communication are vulnerable to malicious eavesdropping and theft. How to address this issue in multi-channel communication systems... RSU Achieving rapid authentication switching and quantum-secure privacy protection are urgent technical problems to be solved in the field of vehicle-to-everything (V2X) communication. Summary of the Invention

[0004] To address the technical problems existing in the prior art, this invention provides a method for dynamic distribution and switching of quantum keys for high-frequency authentication in vehicle-to-everything (V2X) networks, aiming to achieve multi-channel... RSU Quantum-secure, low-latency, seamless handover reduces the computational overhead and communication latency of handover authentication, ensuring continuous and stable operation of services in high-speed mobile scenarios of the Internet of Vehicles.

[0005] To achieve the above objectives, the present invention provides the following technical solution: This invention discloses a method for dynamic distribution and switching of quantum keys for high-frequency authentication in vehicle-to-everything (V2X) networks, comprising: Pre-charge quantum key stage: Quantum security cloud and roadside unit conduct quantum key distribution and establish a quantum key pool including main link and backup link; Quantum security cloud pre-charges quantum keys for vehicles and stores the bound quantum key index information on the blockchain; Registration phase: The roadside unit and the vehicle send registration requests to the quantum security cloud respectively; the quantum security cloud calculates and assigns pseudo-identities, public-private key pairs constructed based on polynomial rings, and identity binding tags to the roadside unit and the vehicle respectively based on lattice cryptography, and stores the identity binding tags on the blockchain; Authentication Phase: The vehicle and the target roadside unit conduct two-way identity authentication based on their respective pseudo-identities, public keys, and identity binding tags on the blockchain through a ciphertext challenge and response mechanism; after successful authentication, the target roadside unit selects a quantum key from the quantum key pool and distributes it to the vehicle, and the two parties negotiate to generate a session key for the current session based on the quantum key; Re-authentication phase: When the vehicle moves into the coverage area of ​​the new roadside unit, the vehicle and the new roadside unit use the historically distributed quantum key, timestamp parameters and public parameters on the blockchain to perform lightweight two-way identity authentication and negotiate to generate a new session key; Quantum key distribution link switching phase: Real-time monitoring of the link status parameters of the main link between the quantum security cloud and the roadside unit. When the link status parameters do not meet the set threshold conditions and are determined to be link degradation, the quantum security cloud coordinates the roadside unit to stop the new key distribution of the main link, and under the premise of maintaining the current session state, seamlessly switches the key source to the backup link to obtain the quantum key during the next session key update.

[0006] As a further improvement to the above scheme, prior to the pre-filling quantum key stage, the following is also included: System initialization phase: The quantum security cloud selects and publishes a set of public system parameters. Simultaneously, the quantum security cloud, acting as the smart contract manager, deploys the smart contracts to the blockchain. Roadside units join the blockchain as nodes and are configured with quantum key distribution devices to form a quantum key distribution network. The set of public system parameters includes a set polynomial prime dimension parameter, a first modulus, a second modulus, and multiple sets of one-way hash functions. The first modulus is greater than the second modulus and the two are coprime. The polynomial prime dimension parameter and the first modulus are used to jointly construct a polynomial ring.

[0007] As a further improvement to the above scheme, the specific steps for roadside unit registration during the registration phase include: Roadside unit generation timestamp and quantum random numbers Combined with the real identity of the roadside unit The registration information is generated and sent to the quantum security cloud; Quantum-secure cloud checks timestamps Once valid, calculate the pseudo-identity of the roadside unit. Subsequently in the polynomial ring Selecting the private key polynomial , Calculate the public key and signature parameters Based on exported public parameters Calculate roadside unit identity binding tags Information is stored on the blockchain via smart contracts. and will Send to the roadside unit; where, For the first modulus, Indicates to Perform modulo operation; This is the second modulus; ; ; For connecting symbols; , and For different one-way hash functions; The specific steps for vehicle registration include: Vehicle generation timestamp and quantum random numbers Combined with the vehicle's real identity And send the pre-charged quantum key to form a registration request message to the quantum security cloud; Quantum-secure cloud checks timestamps Once valid, the vehicle's true identity is calculated using the pre-charged quantum key. To calculate the vehicle's false identity Subsequently in the polynomial ring Selecting the private key polynomial , Calculate the public key and signature parameters ,in Based on exported public parameters Calculate vehicle identity binding tags Information is stored on the blockchain via smart contracts. and will Send to the vehicle; among them, .

[0008] As a further improvement to the above scheme, the authentication phase specifically includes: Vehicle-side timestamp generation and quantum random numbers Calculate the first message digest Generate random polynomials Calculate the vehicle commitment value And further calculate the first challenge value. Compared with the first response value Subsequently, the vehicle packaging message Select a random sparse ternary polynomial Using the public key of the target roadside unit Encryption to generate the first ciphertext and the first ciphertext With timestamp Send to the target roadside unit; The target roadside unit receives the first ciphertext. And check the timestamp Once valid, use its own private key polynomial. calculate And decrypt to obtain plaintext ; Query the vehicle's identity binding tag on the blockchain through smart contracts and publicly available parameters Recalculate the first message digest using plaintext data With the first challenge value The target roadside unit verifies the vehicle's identity by binding a tag. and Are they the same? Verify the equation. Check if the verification is successful; if both are successful, the vehicle identity verification is successful. Target roadside unit generation timestamp and quantum random numbers Selecting a quantum key from a quantum key pool Calculate the second message digest Generate random polynomials Calculate the target roadside unit commitment value And further calculate the second challenge value. With the second response value ; then package the message Select a random sparse ternary polynomial Using vehicle public key Encryption to generate second ciphertext , the second ciphertext With timestamp Return to vehicle; Vehicle receives second ciphertext And check the timestamp After it is valid, decrypt the second ciphertext. Obtain plaintext Recalculate the second message digest using plaintext data With the second challenge value Verify the identity binding tag of the target roadside unit. and Check if they are the same, and verify the signature equation. Check if the authentication is successful; if successful, the target roadside unit authentication is successful. After both vehicle and target roadside unit authentications are successful, both parties calculate and generate the session key for the current session. .

[0009] As a further improvement to the above scheme, the re-authentication phase specifically includes: When a vehicle moves into the coverage area of ​​the new roadside unit, the vehicle sends a message to the new roadside unit containing a pseudo-identity, a first hash message digest, and a current timestamp. The re-authentication request; where the first hash message digest is generated by the vehicle pseudo-identity. Current timestamp and the quantum keys distributed in history Derived by common hash calculation; The new roadside unit received a re-authentication request and checked the timestamp. Once valid, the first hash message digest is recalculated based on its own records to verify the vehicle's legitimacy. If valid, a timestamp is generated for the new roadside unit. By querying vehicle public key parameters through blockchain, based on quantum key distribution. Calculate the new session key It will include the new roadside unit pseudo-identity, the second hash message digest, and the timestamp. The response message is sent to the vehicle; The vehicle received the response message and checked the timestamp. After verification, the second hash message digest is recalculated and verified. If the verification passes, the authentication of the new roadside unit is successful, and the new session key is established. The negotiation was successful.

[0010] As a further improvement to the above scheme, in the pre-charging quantum key stage, the establishment of a quantum key pool including a main link and a backup link specifically includes: The quantum-secure cloud and the roadside unit transmit and receive randomly generated polarized photon sequences through a quantum channel and perform measurements. The two parties compare the measured basis vectors through a classical channel, retain the bits with consistent basis vectors to form a screening key, and generate the final key through error correction and privacy amplification. Based on the generated final key, the roadside unit establishes a master key pool for the main link and a backup key pool for the backup link. The quantum-secure cloud pre-charges vehicles with quantum keys, specifically including: The quantum-secure cloud fills the vehicle's security chip with pre-charged quantum keys. The vehicle extracts its own hardware serial number and sends it to the quantum-secure cloud through a secure channel. The quantum-secure cloud compiles the quantum key index and writes the index and key tag into the blockchain by calling a smart contract.

[0011] As a further improvement to the above scheme, the specific steps of the seamless switching during the quantum key distribution link switching phase include: The monitoring module continuously collects the main link quantum error rate and the main link key generation rate. If the quantum error rate is greater than the set error rate threshold or the key generation rate is less than the set minimum key generation rate threshold, a link degradation alarm is sent to the quantum security cloud. The quantum-safe cloud stops the allocation of new session keys on the main link, records on-chain state events, and confirms with the monitoring module of the backup link that the status of the backup link meets the switching conditions. The quantum security cloud queries the current quantum key tag on the blockchain and maps and synchronizes it to the quantum key tag of the backup link to ensure that vehicles and roadside units use keys from the same source and with the same numbering rules. The main link quantum key that is not expired will continue to run the current business session until the current quantum key expires and triggers a session rekey request. The key used for business data encryption will be seamlessly migrated to the quantum key generated by the backup link to prevent frequent jitter switching caused by the link status fluctuating near the threshold.

[0012] As a further improvement to the above scheme, the link degradation alarm includes a timestamp. Alarm Summary The alarm summary ; It is a one-way hash function; For connecting symbols; Main link quantum error rate; Main link key generation rate; After the quantum-secure cloud confirms that the status of the backup link meets the switching conditions and issues an instruction, the roadside unit updates the switching table and uploads it to the blockchain; the switching table includes the current primary link identifier, the backup link identifier for the next switch, and the quantum key tag that serves as the starting point for the switch.

[0013] As a further improvement to the above scheme, in the registration, authentication and re-authentication stages, after receiving the data packet containing the timestamp, the information receiver checks the validity of the timestamp by determining whether the time difference between the locally generated timestamp and the timestamp extracted from the data packet exceeds a set time difference threshold; if the time difference exceeds the time difference threshold, the data packet is determined to be invalid and the current process is terminated.

[0014] This invention also discloses a quantum key dynamic distribution and switching system for high-frequency authentication in vehicle-to-everything (V2X) networks, which applies the quantum key dynamic distribution and switching method for high-frequency authentication in V2X networks as described above; the system includes: The quantum-safe cloud is used to initialize system parameters, deploy smart contracts, establish a primary and backup dual-link quantum key pool with roadside units, pre-charge quantum keys for vehicles, and perform registration and identity binding tag on-chain operations for vehicles and roadside units based on lattice cryptography; it is also used to monitor the quantum key distribution link and issue switching instructions when it degrades. Multiple roadside units are used as blockchain nodes to synchronize with the quantum security cloud and store quantum keys. During the authentication phase, quantum keys are issued to vehicles and session keys are negotiated. During the re-authentication phase, lightweight authentication is performed with vehicles based on historical quantum keys. After receiving a switching instruction, the switching table is updated to switch the subsequent key source to the backup link. The vehicle terminal is equipped with anti-tampering devices and a quantum-safe chip for securely storing pre-charged quantum keys and registration parameters. When moving across regions, it triggers authentication or re-authentication operations with roadside units to complete low-latency key negotiation and business communication.

[0015] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention constructs a secure communication mechanism for vehicle-to-everything (V2X) networks that includes pre-charged quantum keys, identity registration, two-way authentication, re-authentication, and quantum key distribution link switching. It utilizes quantum key distribution and lattice-based cryptography to complete identity verification and session key negotiation between vehicles and roadside units. When the main link's state parameters fail to meet a set threshold, the key source is seamlessly switched to a backup link during the next session key update. This mechanism addresses the underlying algorithmic security vulnerabilities in traditional V2X authentication schemes when facing quantum computing-based cracking, reduces the computational overhead and communication latency of authentication switching, and ensures continuous and stable operation of V2X services in high-speed mobile scenarios.

[0016] 2. This invention achieves decentralized device trust management by introducing a lattice cryptography mechanism based on polynomial rings to calculate pseudo-identities and public-private key pairs, and combining this with distributed storage of identity binding tags via blockchain smart contracts. This mechanism avoids the single point of failure risk caused by the failure of the certification center in traditional public key infrastructure certificate systems, while using pseudo-identity mapping to conceal the true identity of the vehicle, preventing the direct leakage of vehicle location and identity-sensitive data.

[0017] 3. This invention designs a re-authentication protocol based on historically distributed quantum keys and publicly available blockchain parameters. This allows vehicles to verify their identity and negotiate a new session key without re-executing the complete asymmetric encryption / decryption process when moving across regions to the coverage area of ​​a new roadside unit. This strategy reduces the computational load on nodes and the number of signaling interactions in multi-roadside unit coverage scenarios, meeting the low-latency handover authentication requirements of connected vehicles at high speeds.

[0018] 4. This invention employs independent maintenance of a primary and backup dual-link quantum key pool and a session-level key remapping strategy. When the primary link's quantum error rate increases or the key generation rate decreases, new key allocation is stopped, the current session is maintained, and the session migrates to the backup link during the next key update. Simultaneously, a time difference threshold determination mechanism is incorporated into the data packet interactions at each stage. This strategy avoids frequent jitter switching caused by fluctuations in the communication link near the state threshold critical point, ensuring a smooth service transition. Furthermore, timestamp verification intercepts replay attacks where malicious nodes repeatedly send historical packets. Attached Figure Description

[0019] Figure 1 This is a system framework diagram of the quantum key dynamic distribution and switching method for high-frequency authentication in vehicle networking according to an embodiment of the present invention.

[0020] Figure 2 This is a signaling diagram for the pre-charge quantum key stage in an embodiment of the present invention.

[0021] Figure 3 This is a signaling diagram for the registration phase in an embodiment of the present invention.

[0022] Figure 4 This is a signaling diagram for the authentication phase in an embodiment of the present invention.

[0023] Figure 5 This is a signaling diagram of the re-authentication phase in an embodiment of the present invention.

[0024] Figure 6 This is a signaling diagram of the quantum key distribution link switching phase in an embodiment of the present invention. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] To improve vehicle-road cooperative scenarios V2I To ensure security, privacy, and efficiency in interactive communication, this embodiment provides a dynamic quantum key distribution and switching method for high-frequency authentication in vehicle-to-everything (V2X) networks. This method is applied to a dynamic quantum key distribution and switching system for high-frequency authentication in V2X networks, as shown in the system framework diagram below. Figure 1 As shown. The system includes: a quantum-safe cloud, multiple roadside units, and vehicle terminals. Figure 1 QRNG chip A quantum random number chip, installed in the vehicle, is used to generate quantum random numbers; RSU stands for Roadside Unit; Block stands for Blockchain; QKD stands for Quantum Key Distribution Device / Network; QSC stands for Quantum Secure Cloud.

[0027] The quantum-safe cloud is used to initialize system parameters, deploy smart contracts, establish a primary and backup dual-link quantum key pool with roadside units, pre-charge quantum keys for vehicles, and perform registration and identity binding tag on-chain operations for vehicles and roadside units based on lattice cryptography. It is also used to monitor the quantum key distribution link and issue switching instructions when it degrades.

[0028] Multiple roadside units are used as blockchain nodes to synchronize with the quantum security cloud and store quantum keys. During the authentication phase, they issue quantum keys to vehicles and negotiate session keys. During the re-authentication phase, they perform lightweight authentication with vehicles based on historical quantum keys. After receiving a switching instruction, they update the switching table to switch the subsequent key source to the backup link.

[0029] The vehicle terminal is equipped with anti-tampering devices and a quantum-safe chip for securely storing pre-charged quantum keys and registration parameters. When moving across regions, it triggers authentication or re-authentication operations with roadside units to complete low-latency key negotiation and business communication.

[0030] like Figure 1 As shown, the quantum key dynamic distribution and switching method in this embodiment includes seven stages: initialization stage, pre-charge quantum key stage, registration stage, authentication stage, re-authentication stage, and quantum key distribution link switching stage. Some symbol definitions involved in this embodiment are shown in Table 1.

[0031] Table 1: Symbol Definitions

[0032] During the initialization phase, the quantum-safe cloud is a fully trusted entity. This phase mainly involves initializing the entire system, and the steps are as follows: QSC Select three sets of core integer parameters ,in It is a large prime number, representing the dimension of the polynomial, which can be set in this invention. , It is a large module. It is a small module and satisfies , and The greatest common divisor is 1. Based on this, in the polynomial ring... Take two more sets of polynomials inside. Simultaneously, three sets of one-way hash functions with collision resistance properties are constructed. , , ,satisfy , , Public key private key Ultimately, a unified set of public system parameters will be released. Furthermore, QSC serves as a smart contract ( Smart Contract, SC Administrators deploy smart contracts to the blockchain, and RSU It needs to join the blockchain as a node, and each RSU Deploy one QKD Equipment, Formation QKD The network uses smart contracts to achieve efficient authentication.

[0033] In the pre-charge quantum key stage, the specific process is as follows: Figure 2 As shown, a system was first built based on the BB84 protocol. QSC and RSU The quantum key distribution process between them involves the following steps: a. Quantum state preparation and transmission: QSC As the sender, a sequence of classical bits is randomly generated, and each bit is encoded by randomly selecting a conjugate basis ("+" basis or "×" basis). The prepared polarized photon sequence is then sent to the quantum channel. RSU .

[0034] b. Quantum state reception and measurement: RSU As the receiver, the received photon sequence is also randomly selected to measure either the "+" basis or the "×" basis to obtain a set of preliminary measurement results.

[0035] c. Basis Vector Alignment and Key Selection: Both parties exchange their respective measurement basis vector information through a public classical channel, retaining the corresponding bits where both parties' basis vector selections are consistent, forming a selection key. sifted key ).

[0036] d. Post-processing stage: Both parties perform error correction on the screening key ( Error Correction ) and privacy amplification ( Privacy Amplification This process eliminates channel noise, errors caused by eavesdropping, and information leakage, generating an unconditionally secure final key.

[0037] e. Multi-link key pool construction: To improve the reliability and availability of key distribution, RSU Establish the main link based on the above process. With backup link The corresponding master key pool With backup key pool This provides secure key support for subsequent vehicle-to-everything (V2X) communication.

[0038] In addition, the vehicle is equipped with tamper-proof devices and quantum-safe chips. These devices are responsible for securely storing pre-filled quantum keys, which are then filled via a quantum-safe cloud. Simultaneously, the keys are encrypted and stored in... QSC Backup is performed during the process. The vehicle originates from... TPD Extract the hardware serial number ( HSN ), and sent to via secure channel QSC . QSC Received HSN Then, calculate and call SC Will Write it into the blockchain, Send to the vehicle. Upon receiving the message, the vehicle stores it. At this point, the pre-charge quantum key stage is complete.

[0039] During the registration phase, the process is as follows: Figure 3 As shown, the roadside unit is performed first. RSU Identity registration. The specific steps are as follows: a. Generate timestamps Choose a unique real identity RID Generate quantum random numbers Calculate registration information ,Will Sent via secure channel QSC .

[0040] b. After receiving the information, QSC checks... ,calculate Calculate false identities and in the polynomial ring Selecting the private key polynomial Calculate the public key ,calculate and signature parameters Public parameters Calculate identity binding tags Storage via SC and will Send to RSU .

[0041] c. RSU storage .

[0042] Then, vehicle registration is performed, following these steps: a. Generate timestamps Choose a unique real identity VID Generate quantum random numbers Calculate registration information Calculate registration request ,Will Sent via secure channel QSC .

[0043] b. QSC After receiving the information, check. ,index ,calculate ,calculate Calculate false identities and in the polynomial ring Selecting the private key polynomial Calculate the public key ,calculate and signature parameters Public parameters Calculate identity binding tags ,pass SC Uplink storage and will Send to the vehicle.

[0044] c. Vehicle storage .

[0045] The registration phase is now complete.

[0046] During the certification phase, the specific process is as follows: Figure 4 As shown, vehicles and RSU Mutual authentication is performed, and a temporary session key is generated. The specific steps in this stage are as follows: a. Generate timestamps Generate quantum random numbers Calculate message digest Generate random polynomials Calculate the vehicle commitment value (mod q), calculate the challenge value Calculate the response value Packed messages Select a random sparse ternary polynomial r and encrypt it. ,Will Sent via secure channel RSU .

[0047] b. After receiving the information, the RSU checks... ,calculate ,calculate The correctness verification is as follows: ; ; As shown above, the verification is correct.

[0048] Subsequently passed SC Perform blockchain query ,calculate ,calculate ,verify and Are they the same? Verify Whether this is true or not, and the correctness verification is as follows: left ; right ; As shown above, if the left side equals the right side, then the vehicle authentication is successful.

[0049] d. Generate timestamps Generate quantum random numbers Calculate the index Write to the blockchain Calculate message digest Generate random polynomials Calculate the target roadside unit commitment value Calculate the challenge value Calculate the response value Selecting quantum keys from the key pool Packed messages Select a random sparse ternary polynomial r ,encryption ,Will Send it to the vehicle via a secure channel.

[0050] e. After receiving the information, the vehicle checks... Generate timestamp ,calculate ,calculate Calculate message digest Calculate the challenge value ,verify and Are they the same? Verify Is the agreement valid? If so, negotiate the session key. ,encryption Will Sent via secure channel RSU .

[0051] f. After receiving the information, the vehicle checks... Calculate the session key Decryption If the calculated result is different from the decrypted result If they are equal, then the session key negotiation is successful.

[0052] During the recertification phase, the specific process is as follows: Figure 5 As shown, the steps are as follows: a. Vehicle generation timestamp ,calculate , will message Send to new RSU .

[0053] b. New RSU After receiving the information, check. ,calculate ,verify If the verification is successful, the vehicle identity verification is complete, and a timestamp is generated. ,pass SC Perform blockchain query Calculate the session key ,calculate , will message Send to the vehicle.

[0054] c. After receiving the information, the vehicle checks... ， calculate ,calculate ,verify Is it valid? If so, then the new RSU Authentication was successful, and session key negotiation was successful; At this point, the vehicle's recertification phase is complete.

[0055] like Figure 6 As shown, Figure 6In this context, QBER represents the quantum bit error rate, degraded indicates degradation or link degradation, key_id represents the key number / key ID, KMS-A and KMS-B represent key management systems A and B, respectively, and rekey indicates session key re-key or key update. During the quantum key distribution link switching phase, the following steps are performed: a. The link monitoring module continuously collects main link status parameters and uploads them to the blockchain. If satisfied or If this occurs, the main link is determined to be in a degraded state, and the monitoring module generates a timestamp. Alarm Summary and will Send to QSC.

[0056] b. QSC Upon receiving a degradation alert, to prevent the continued use of a degraded link from generating low-quality keys, the allocation of new session keys is immediately stopped. However, existing business sessions remain unaffected and can continue to be used until the key expires. Simultaneously, on-chain events are recorded. .

[0057] c. QSC The backup link status is queried from the backup node monitoring module, and the link monitoring module will provide backup link information. If not satisfied and If so, the switching condition is met.

[0058] d. QSC On-chain query of the quantum key tag at this time Mapped to backup link quantum key tags This ensures that both ends use keys from the same source and with the same numbering rules within the same time window. QSC Notify current service RSU During the next session key update, the key source will switch from the primary link to the backup link, and the encrypted information will be encrypted. and send RSU .

[0059] e. RSU Decrypt after receiving the message And through smart contracts SC The message's authenticity is verified, and then the switching table is updated and uploaded to the blockchain to ensure the message's authenticity and timeliness. ; f. Quantum keys that are still valid in the unexpired phase remain valid, and the current session continues until the quantum key expires, at which point the session ends. RSUThe key is updated, triggering the next session reconstruction request. Subsequently, the authentication phase is restarted to negotiate and update the session key and quantum key tags, allowing for a seamless business migration. L2 The source key prevents the link state from oscillating around the threshold, thus preventing frequent jitter switching.

[0060] At this point, QKD The link switching phase is complete.

[0061] In summary, in this invention, the road end relies on... QKD The quantum physics layer and protocol layer generate secure shared keys resistant to quantum computing, which are then passed through the key management layer (…). KMS The key pooling scheduling and dynamic distribution mechanism completes the vehicle and... RSU This invention provides rapid switching authentication between quantum channels and quantum communication. QKD The protocol enables continuous key generation, pool storage, on-demand allocation, and post-use destruction. It leverages the non-cloning property of quantum states to ensure keys cannot be eavesdropped or forged, thus addressing the privacy concerns surrounding sensitive data such as vehicle identity and location. Furthermore, in multiple... RSU During the high-frequency handover authentication phase, this invention employs a dual-key pool independent maintenance mechanism for primary and backup links. When the primary link degrades, seamless service migration is achieved through session-level key re-keying, realizing millisecond-level low-latency handover authentication. This invention integrates a dynamic quantum key distribution and smooth handover mechanism into traditional vehicle-to-everything (V2X) authentication schemes, relying on... QKD The quantum-safe architecture ensures quantum resistance to computation and privacy protection throughout the entire communication process. Furthermore, through key pooling management and coordinated link state switching, it achieves higher security compared to traditional methods. ECC Bilinear mapping PKI The solution reduced many RSU It reduces the computational overhead, communication latency, and centralized single-point failure risk of authentication switching in various scenarios, and improves the security of the vehicle throughout its entire lifecycle, adapting to the high-frequency continuous service requirements of high-speed mobility in the Internet of Vehicles.

[0062] This embodiment also provides the following specific theoretical analysis of the method mentioned above: 1. Attack Scenario Analysis (1) Quantum computing attack simulation: Adversary A intercepts the parameters transmitted through the public channel and uses a quantum computer to run quantum algorithms to solve the traditional discrete logarithm problem (DLP) or the elliptic curve discrete logarithm problem (ECDLP) in order to decrypt the communication content or forge digital signatures.

[0063] Theoretical Security Analysis: Lattice Cryptography Difficulty: The public key and signature mechanism of this scheme are built on a truncated polynomial ring. Up, and set N=503 If an attacker wants to obtain the public key... Or verify parameters Recover the private key polynomial The signature private key s is essentially equivalent to finding the shortest or compact vector on an NTRU lattice of dimension 2N. It has been proven that quantum algorithms such as Shor cannot solve the lattice basis problem on high-dimensional Euclidean lattices in polynomial time.

[0064] (2) Quantum physics channel eavesdropping simulation: During the pre-filling and QKD network key negotiation phase, adversary A intercepts photons in the quantum channel and attempts to measure their polarization state. Subsequently, photons in the same state are prepared and sent to the receiver (interception-retransmission attack) to obtain the shared key pool. m / Pool b Quantum key K i .

[0065] Theoretical security analysis: ① The no-cloning theorem and Heisenberg uncertainty principle: Non-orthogonal quantum states cannot be precisely copied. The probability that an adversary chooses a measurement basis that matches the sender's basis vectors is only 1 / 2. If the basis vectors are chosen incorrectly, the quantum state will collapse, inevitably introducing additional qubit error rates. ② Information-theoretic security guarantee: If the error rate exceeds the theoretical threshold, the system will determine that eavesdropping has occurred after screening and error correction and directly terminate key generation. Through privacy amplification, the mutual information obtained by the adversary can be exponentially compressed to near zero, ensuring that the generated physical key is information-theoretically indistinguishable.

[0066] (3) Simulation of man-in-the-middle attack and forgery / impersonation attack: adversary A disguises himself as a legitimate vehicle V i Sending an authentication request, or forging signature parameters They attempted to deceive the RSU into passing the certification.

[0067] Theoretical security analysis: ① Unforgeability: Vehicle response satisfies ,in To bind identity digest With promise The challenge value is (mod q). Under the Random Oracle Model (ROM), if A can construct a valid oracle in polynomial time... If a forged pair is found, the SVP hard problem on the ring can be solved in polynomial time, which is clearly unreasonable. ② Dual identity binding and blockchain tamper-proofing: public key With publicly available verification parameters Identity-bound tags It is strongly bound and solidified on the blockchain. Even if an adversary tampers with the transmitted message, they cannot alter the on-chain state T, which has been confirmed through distributed consensus. xV Any public key substitution attack will be affected by... It was immediately intercepted by the RSU.

[0068] (4) Replay attack simulation: Adversary A intercepts and listens to historical legitimate communication ciphertexts or re-authentication messages, and then resends them to RSU later in an attempt to trick the system into a denial-of-service state.

[0069] Theoretical security analysis: ① Timestamp tolerance verification: All interactive messages explicitly include a timestamp T, which is strictly verified by the receiver. If the delay exceeds the allowed time window The message was discarded. ② Strong binding of quantum random numbers and one-way hashes: authentication digests. Session key .in It comes from a hardware true quantum random number chip and possesses true physical randomness (the entropy source is unpredictable).

[0070] (5) Privacy tracking and location association analysis attack simulation: Adversary A deploys listening devices on multiple RSU nodes in an attempt to track the driving trajectory and real identity of a specific vehicle by comparing the identifiers in the communication messages.

[0071] Theoretical security analysis: ① Conditional privacy protection: Vehicle's true identity VID The encryption and concealment are achieved through quantum random numbers during the pre-filling and registration phases. Only a false identity is exposed on open channels. ② Forward / backward non-linkability: During the re-authentication phase, the session key... The quantum key K, dynamically injected from the previous authentication cycle, was introduced. i And the new RSU timestamp T R2 This makes the message stream generated during cross-RSU handover computationally indistinguishable from a uniform random sequence in polynomial time, thereby severing the correlation between communication data between different RSUs.

[0072] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for dynamic distribution and switching of quantum keys for high-frequency authentication in vehicle-to-everything (V2X) networks, characterized in that, include: Pre-charged quantum key stage: Quantum key distribution is carried out between the quantum security cloud and the roadside unit to establish a quantum key pool including the main link and backup links; The quantum security cloud pre-charges vehicles with quantum keys and stores the bound quantum key index information on the blockchain. Registration phase: The roadside unit and the vehicle respectively send registration requests to the quantum security cloud; The quantum-secure cloud calculates and assigns pseudo-identities, public-private key pairs constructed based on polynomial rings, and identity binding tags to roadside units and vehicles based on lattice cryptography, and stores the identity binding tags on the blockchain. Authentication Phase: The vehicle and the target roadside unit conduct two-way identity authentication based on their respective pseudo-identities, public keys, and identity binding tags on the blockchain through a ciphertext challenge and response mechanism; after successful authentication, the target roadside unit selects a quantum key from the quantum key pool and distributes it to the vehicle, and the two parties negotiate to generate a session key for the current session based on the quantum key; Re-authentication phase: When the vehicle moves into the coverage area of ​​the new roadside unit, the vehicle and the new roadside unit use the historically distributed quantum key, timestamp parameters and public parameters on the blockchain to perform lightweight two-way identity authentication and negotiate to generate a new session key; Quantum key distribution link switching phase: Real-time monitoring of the link status parameters of the main link between the quantum security cloud and the roadside unit. When the link status parameters do not meet the set threshold conditions and are determined to be link degradation, the quantum security cloud coordinates the roadside unit to stop the new key distribution of the main link, and under the premise of maintaining the current session state, seamlessly switches the key source to the backup link to obtain the quantum key during the next session key update.

2. The quantum key dynamic distribution and switching method for high-frequency authentication in vehicle-to-everything (V2X) networks according to claim 1, characterized in that, Prior to the pre-charge quantum key stage, the following also applies: System initialization phase: The quantum security cloud selects and publishes a set of public system parameters. Simultaneously, the quantum security cloud, acting as the smart contract manager, deploys the smart contracts to the blockchain. Roadside units join the blockchain as nodes and are configured with quantum key distribution devices to form a quantum key distribution network. The set of public system parameters includes a set polynomial prime dimension parameter, a first modulus, a second modulus, and multiple sets of one-way hash functions. The first modulus is greater than the second modulus and the two are coprime. The polynomial prime dimension parameter and the first modulus are used to jointly construct a polynomial ring.

3. The quantum key dynamic distribution and switching method for high-frequency authentication in vehicle-to-everything (V2X) networks according to claim 2, characterized in that, The specific steps for roadside units to register their identities during the registration phase include: Roadside unit generation timestamp and quantum random numbers Combined with the real identity of the roadside unit The registration information is generated and sent to the quantum security cloud; Quantum-secure cloud checks timestamps Once valid, calculate the pseudo-identity of the roadside unit. Subsequently in the polynomial ring Selecting the private key polynomial , Calculate the public key and signature parameters Based on exported public parameters Calculate roadside unit identity binding tags Information is stored on the blockchain via smart contracts. and will Send to the roadside unit; where, For the first modulus, Indicates to Perform modulo operation; This is the second modulus; ; ; For connecting symbols; , and For different one-way hash functions; The specific steps for vehicle registration include: Vehicle generation timestamp and quantum random numbers Combined with the vehicle's real identity And send the pre-charged quantum key to form a registration request message to the quantum security cloud; Quantum-secure cloud checks timestamps Once valid, the vehicle's true identity is calculated using the pre-charged quantum key. To calculate the vehicle's false identity Subsequently in the polynomial ring Selecting the private key polynomial , Calculate the public key and signature parameters ,in Based on exported public parameters Calculate vehicle identity binding tags Information is stored on the blockchain via smart contracts. and will Send to the vehicle; among them, .

4. The quantum key dynamic distribution and switching method for high-frequency authentication in vehicle-to-everything (V2X) networks according to claim 3, characterized in that, The authentication phase specifically includes: Vehicle-side timestamp generation and quantum random numbers Calculate the first message digest Generate random polynomials Calculate the vehicle commitment value And further calculate the first challenge value. Compared with the first response value Subsequently, the vehicle packaging message Select a random sparse ternary polynomial Using the public key of the target roadside unit Encryption to generate the first ciphertext and the first ciphertext With timestamp Send to the target roadside unit; The target roadside unit receives the first ciphertext. And check the timestamp Once valid, use its own private key polynomial. calculate And decrypt to obtain plaintext ; Query the vehicle's identity binding tag on the blockchain through smart contracts and publicly available parameters Recalculate the first message digest using plaintext data With the first challenge value The target roadside unit verifies the vehicle's identity by binding a tag. and Are they the same? Verify the equation. Check if the verification is successful; if both are successful, the vehicle identity verification is successful. Target roadside unit generation timestamp and quantum random numbers Selecting a quantum key from a quantum key pool Calculate the second message digest Generate random polynomials Calculate the target roadside unit commitment value And further calculate the second challenge value. With the second response value ; then package the message Select a random sparse ternary polynomial Using vehicle public key Encryption to generate second ciphertext , the second ciphertext With timestamp Return to vehicle; Vehicle receives second ciphertext And check the timestamp After it is valid, decrypt the second ciphertext. Obtain plaintext Recalculate the second message digest using plaintext data With the second challenge value Verify the identity binding tag of the target roadside unit. and Check if they are the same, and verify the signature equation. Check if the authentication is successful; if successful, the target roadside unit authentication is successful. After both vehicle and target roadside unit authentications are successful, both parties calculate and generate the session key for the current session. .

5. The quantum key dynamic distribution and switching method for high-frequency authentication in vehicle-to-everything (V2X) networks according to claim 4, characterized in that, The re-authentication phase specifically includes: When a vehicle moves into the coverage area of ​​the new roadside unit, the vehicle sends a message to the new roadside unit containing a pseudo-identity, a first hash message digest, and a current timestamp. The re-authentication request; where the first hash message digest is generated by the vehicle pseudo-identity. Current timestamp and the quantum keys distributed in history Derived by common hash calculation; The new roadside unit received a re-authentication request and checked the timestamp. Once valid, the first hash message digest is recalculated based on its own records to verify the vehicle's legitimacy. If valid, a timestamp is generated for the new roadside unit. By querying vehicle public key parameters through blockchain, based on quantum key distribution. Calculate the new session key It will include the new roadside unit pseudo-identity, the second hash message digest, and the timestamp. The response message is sent to the vehicle; The vehicle received the response message and checked the timestamp. After verification, the second hash message digest is recalculated and verified. If the verification passes, the authentication of the new roadside unit is successful, and the new session key is established. The negotiation was successful.

6. The quantum key dynamic distribution and switching method for high-frequency authentication in vehicle-to-everything (V2X) networks according to claim 1, characterized in that, In the pre-charge quantum key stage, the establishment of a quantum key pool including a main link and a backup link specifically includes: The quantum-secure cloud and the roadside unit transmit and receive randomly generated polarized photon sequences through a quantum channel and perform measurements. The two parties compare the measured basis vectors through a classical channel, retain the bits with consistent basis vectors to form a screening key, and generate the final key through error correction and privacy amplification. Based on the generated final key, the roadside unit establishes a master key pool for the main link and a backup key pool for the backup link. The quantum-secure cloud pre-charges vehicles with quantum keys, specifically including: The quantum-secure cloud fills the vehicle's security chip with pre-charged quantum keys. The vehicle extracts its own hardware serial number and sends it to the quantum-secure cloud through a secure channel. The quantum-secure cloud compiles the quantum key index and writes the index and key tag into the blockchain by calling a smart contract.

7. The quantum key dynamic distribution and switching method for high-frequency authentication in vehicle-to-everything (V2X) networks according to claim 1, characterized in that, During the quantum key distribution link switching phase, the specific steps of the seamless switching include: The monitoring module continuously collects the main link quantum error rate and the main link key generation rate. If the quantum error rate is greater than the set error rate threshold or the key generation rate is less than the set minimum key generation rate threshold, a link degradation alarm is sent to the quantum security cloud. The quantum-safe cloud stops the allocation of new session keys on the main link, records on-chain state events, and confirms with the monitoring module of the backup link that the status of the backup link meets the switching conditions. The quantum security cloud queries the current quantum key tag on the blockchain and maps and synchronizes it to the quantum key tag of the backup link to ensure that vehicles and roadside units use keys from the same source and with the same numbering rules. The main link quantum key that is not expired will continue to run the current business session until the current quantum key expires and triggers a session rekey request. The key used for business data encryption will be seamlessly migrated to the quantum key generated by the backup link to prevent frequent jitter switching caused by the link status fluctuating near the threshold.

8. The quantum key dynamic distribution and switching method for high-frequency authentication in vehicle-to-everything (V2X) networks according to claim 7, characterized in that, The link degradation alarm includes a timestamp. Alarm Summary The alarm summary ; It is a one-way hash function; For connecting symbols; Main link quantum error rate; Main link key generation rate; After the quantum-secure cloud confirms that the status of the backup link meets the switching conditions and issues an instruction, the roadside unit updates the switching table and uploads it to the blockchain; the switching table includes the current primary link identifier, the backup link identifier for the next switch, and the quantum key tag that serves as the starting point for the switch.

9. The quantum key dynamic distribution and switching method for high-frequency authentication in vehicle-to-everything (V2X) networks according to claim 1, characterized in that, During the registration, authentication, and re-authentication phases, after receiving a data packet containing a timestamp, the information recipient checks the validity of the timestamp by determining whether the time difference between the locally generated timestamp and the timestamp extracted from the data packet exceeds a set time difference threshold. If the time difference exceeds the time difference threshold, the data packet is determined to be invalid and the current process is terminated.

10. A quantum key dynamic distribution and switching system for high-frequency authentication in vehicle-to-everything (V2X) networks, characterized in that, The system employs the quantum key dynamic distribution and switching method for high-frequency authentication in vehicle-to-everything (V2X) networks as described in any one of claims 1 to 9; the system comprises: The quantum-safe cloud is used to initialize system parameters, deploy smart contracts, establish a primary and backup dual-link quantum key pool with roadside units, pre-charge quantum keys for vehicles, and perform registration and identity binding tag on-chain operations for vehicles and roadside units based on lattice cryptography; it is also used to monitor the quantum key distribution link and issue switching instructions when it degrades. Multiple roadside units are used as blockchain nodes to synchronize with the quantum security cloud and store quantum keys. During the authentication phase, quantum keys are issued to vehicles and session keys are negotiated. During the re-authentication phase, lightweight authentication is performed with vehicles based on historical quantum keys. After receiving a switching instruction, the switching table is updated to switch the subsequent key source to the backup link. The vehicle terminal is equipped with anti-tampering devices and a quantum-safe chip for securely storing pre-charged quantum keys and registration parameters. When moving across regions, it triggers authentication or re-authentication operations with roadside units to complete low-latency key negotiation and business communication.

Images