Method for verifying a lightweight post-quantum wireless ad hoc network and terminal

Abstract

The application provides a wireless ad hoc network authentication method and terminal based on lightweight post-quantum, and the method comprises the following steps: generating a prime number sequence containing a first preset number of prime numbers according to a security parameter; calculating the Pisano period length corresponding to each prime number according to a Fibonacci sequence; generating a private key seed with a first preset length according to the security parameter; obtaining a first private key based on the private key seed and the Pisano period length corresponding to each prime number; calculating a first public key corresponding to the first private key; signing a first request sent based on the first private key, and then sending the signed first request and the first public key; and verifying a second request received based on a second public key received, and generating a session key after the verification is passed, and performing data transmission according to the session key. The application is suitable for low-power wireless ad hoc networks, and device mutual authentication is added in the networking. The session key is negotiated between the devices that pass the identity verification, and the post-quantum security of the communication process is protected.

Description

Technical Field

[0001] This invention relates to the field of wireless ad hoc network security technology, and in particular to a wireless ad hoc network verification method and terminal based on lightweight post-quantum. Background Technology

[0002] This invention is applicable to large-scale network access scenarios for low-power wireless terminals. The core problem currently faced is that edge nodes have extremely limited computing power, storage, and energy consumption, making it difficult to support existing post-quantum signature algorithms. Furthermore, traditional networking processes lack a two-way verification mechanism based on device identity, posing risks of forged node injection and man-in-the-middle attacks. Specifically, in the construction of the power IoT, Industry 4.0, and smart city sensing layers, a large number of low-power wireless terminals such as temperature sensors, humidity sensors, partial discharge sensors, SF6 (sulfur hexafluoride) sensors, mechanical status sensors, water immersion sensors, and door magnetic sensors are deployed at the edge. With the digitization and wirelessization of information collection processes, existing sensors typically report data wirelessly to save on manual meter reading and wiring construction. However, in actual large-scale deployments, the following three major pain points are faced: 1. Difficulties of wired access: In scenarios such as power transmission line towers, underground cable trenches, cable mezzanine in power distribution rooms, and GIS rooms in substations, the cost of cabling construction can reach as high as 300,800 yuan / meter, and power access is difficult (there is no mains power access point, and additional power lines or solar panels need to be laid or installed). As a result, the total cost of traditional wired RS-485 / fiber optic deployment often exceeds that of wireless solutions by 510 times, and the construction cycle is extended by 2 to 3 weeks. 2. Vulnerability of wireless transmission and heterogeneous interference: Bluetooth mesh, ZigBee, Thread, LoRa and other technologies operate in the 2.4GHz ISM (Industrial, Scientific and Medical Band) band, which shares the spectrum with Wi-Fi, microwave ovens, Bluetooth classic protocols and other technologies. Field tests showed that co-channel interference can cause the packet loss rate to jump from 1% to 15%~30%, and adjacent channel interference can reduce the signal-to-noise ratio (SNR) by 610dB. 3. Dual lack of security awareness and computing resources: Edge ad hoc network nodes such as Bluetooth mesh, ZigBee, Thread, and LoRa have extremely limited resources. Typical hardware configurations are only ARM Cortex-M0+ / M3 / M33 level MCUs (16~160MHz), 8~256KB RAM, and 32512KB Flash. The power consumption budget is between microamplitude sleep current and milliamplitude operating current. Existing standard post-quantum cryptography algorithms (such as ML-DSA and SLH-DSA) take hundreds of milliseconds to several seconds to sign a single signature on this type of hardware, with a signature length of 242,049,856 bytes, far exceeding the upper limit of approximately 384 bits (48 bytes) of effective payload per packet of conventional ad hoc network nodes. Moreover, complex modular operations shorten the terminal battery life from the designed 5 years to less than 1 year. In the application of sensors in the power grid field, it is not suitable for power supply scenarios such as poles / cables, which are difficult to access, and seriously restricts the direct deployment of post-quantum cryptography on edge nodes. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a wireless self-organizing network verification method and terminal based on lightweight post-quantum, which can achieve high-security network access verification under the constraints of edge gateway hardware.

[0004] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: A lightweight post-quantum-based method for verifying wireless ad hoc networks includes: Generate a sequence of prime numbers containing a first preset number of prime numbers based on security parameters; Calculate the length of the Pisano period corresponding to each prime number in the Fibonacci sequence; A private key seed of a first preset length is generated based on the security parameters, and a first private key is obtained based on the private key seed and the Pisano period length corresponding to each prime number. Calculate the first public key corresponding to the first private key; After signing the first request based on the first private key, the signed first request and the first public key are sent; and the received second request is verified based on the received second public key, and a session key is generated after the verification is successful, and data is transmitted according to the session key.

[0005] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows: A lightweight post-quantum-based wireless ad hoc network verification terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor, when executing the computer program, implements the various steps of the aforementioned lightweight post-quantum-based wireless ad hoc network verification method.

[0006] The beneficial effects of this invention are as follows: It generates private and public keys used in the authentication process based on the number-theoretic properties of prime numbers and the Fibonacci sequence; it utilizes the natural differences in the Pisano periods corresponding to different prime numbers to provide heterogeneous length constraints, resulting in higher parameter flexibility; and it performs calculations by looking up prime number sequences, reducing the computational complexity of signatures from that of traditional lattice signatures. Reduce to On the Cortex-M33 platform (64MHz clock speed, integrated SHA-3 hardware acceleration core), the measured single signature time is approximately 815 milliseconds and the signature verification time is approximately 512 milliseconds, which is about 60-100 times faster than ML-DSA-44 (approximately 800-1200 milliseconds in the same platform) and about 200-600 times faster than SLH-DSA (approximately 38 seconds in the same platform). The device only needs to pre-store approximately 1KB of prime number sequence list and Pisano periodic table, and the private key seed. Requires only 128,256 bits, eliminates the need to maintain a Merkle tree and tree paths, and reduces storage overhead by approximately 80%~90% compared to LMS / XMSS; the typical signature length is only 580 bytes (approximately 324 bytes after truncation optimization), a 76% compression compared to ML-DSA-44 (approximately 2,420 bytes) and a 93%~99% compression compared to SLH-DSA (approximately 8,000,500,000 bytes), and can be transmitted via Bluetooth mesh segmented transmission mechanism. It carries packet protocols such as Message or ZigBee / LoRa; the energy consumption of a single signature operation is about 0.05-0.2mJ, which is 12 orders of magnitude lower than traditional post-quantum signature schemes, meeting the lifespan requirement of more than 5 years for button batteries or energy harvesting power supply; by adding two-way mutual recognition of devices and a one-time private key derivation mechanism based on a counter to the networking process of wireless self-organizing network, the network access devices are authenticated. Only devices that have been authenticated will negotiate the session key. Even if a single signature is broken, it is impossible to trace back to other signatures or long-term private key seeds, thus achieving zero-trust network access and end-to-end post-quantum security. Attached Figure Description

[0007] Figure 1 This is a flowchart of a wireless self-organizing network verification method based on lightweight post-quantum according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a wireless self-organizing network verification terminal based on lightweight post-quantum according to an embodiment of the present invention. Detailed Implementation

[0008] To explain in detail the technical content, objectives, and effects of the present invention, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0009] In existing technologies, with the development of quantum computing technology, Shor's algorithm (a quantum algorithm) can break traditional cryptographic systems based on large integer factorization (RSA, Rivest-Shamir-Adleman) and discrete logarithms (ECC, Elliptic Curve Cryptography / DSA, Digital Signature Algorithm) in polynomial time. In August 2024, NIST (National Institute of Standards and Technology) officially released the following post-quantum cryptography (PQC) standards: FIPS (Federal Information Processing Standard) 203 (ML-KEM, Module-Lattice-Based Key-Encapsulation Mechanism), FIPS 204 (ML-DSA, Module-Lattice-Based Digital Signature Algorithm), and FIPS 205 (SLH-DSA, Stateless Hash-Based Digital Signature Algorithm). NIST also plans to release the FALCON (FN-DSA) algorithm as FIPS 206 (FN-DSA, FFT over NTRU-Lattice-Based Digital Signature Algorithm; FFT stands for Fast Fourier Transform). Transform (Fast Fourier Transform); NTRU (Number Theory Research Unit) marks the beginning of the post-quantum signature era in cryptography.

[0010] However, existing post-quantum signature algorithms (including lattice-based ML-DSA and hash-based SLH-DSA) have the following problems, making it difficult to directly deploy them on edge terminals in self-organizing network methods such as Bluetooth mesh, ZigBee, and LoRa. Furthermore, the following problems exist: 1. High computational overhead: Matrix-vector multiplication and number-theoretic transformations (NTT) take hundreds of milliseconds or even seconds on Cortex-M0 / M3 (32-bit MCU models) level MCUs (Microcontroller Units). Actual measurements show that a Cortex-M3 (48MHz) takes approximately 1.5~2.5 seconds to run ML-DSA-44 signatures, which cannot meet the real-time requirements of second-level status reporting in industrial scenarios; 2. High storage requirements: Signature length or public key size reaches thousands to tens of thousands of bytes (ML-DSA-44 signature is approximately 2,420 bytes, SLH-DSA can reach a maximum of approximately 49,856 bytes), exceeding the payload of Bluetooth mesh message PDUs (Protocol Data Units) (a single packet payload is approximately 384 bits / 48 bytes, still limited after segmented transmission), and even more so than ZigBee (a single packet payload is approximately 127 bytes) and LoRa (LoRaWAN). Transmission within the MAC layer payload (approximately 51222 bytes) is more difficult; 3. Energy consumption sensitivity: Complex modular operations and large memory accesses cause the terminal battery to be quickly depleted. The measured power consumption of a single signature of ML-DSA-44 on a Cortex-M33 is approximately 515mJ, while this solution consumes only approximately 0.05~0.2mJ. In the application of sensors in the power grid field, it is not suitable for pole / cable scenarios where power supply is difficult.

[0011] Among related technologies, hash chain-based signature schemes (including LMS, Leighton-Micali Signature; XMSS, eXtended Merkle Signature Scheme) rely solely on hash function security and have been standardized by NIST SP 800-208 (the top-level recommendation standard including LMS and XMSS) and IETF RFC 8554 (the technical specification for LMS signature) and RFC 8391 (the technical specification for XMSS signature), possessing inherent post-quantum security. These schemes employ the Winternitz one-time signature structure (a hash function-based one-time signature scheme), which fragments the message digest, with each fragment's value determining the number of hash chain iterations. Multiple sets of one-time public keys are aggregated using a Merkle tree (a hash function-based authentication data structure) to achieve multiple signatures.

[0012] However, in resource-constrained edge terminals, LMS / XMSS has the following limitations: 1. Complex state management: It is necessary to maintain the state of Merkle tree nodes and the index of used OTS (One-Time Signature Index). State loss or rollback will lead to security failure. The state data volume is usually 416KB, which is a heavy burden for edge nodes with only 32256KB of RAM; 2. Storage overhead: Merkle tree paths and multiple OTS public keys require a lot of memory. The public key library grows linearly with the number of signatures. When Nmax=2^20 (about 1 million signatures), the storage of the public key library on a single device on the platform side can reach more than 4MB; 3. Uniform parameters: Each Winternitz chain uses a uniform length parameter and lacks the ability to use number theory structures for natural parameterization.

[0013] Edge-side ad hoc network encryption schemes in related technologies (including symmetric encryption based on AES, Advanced Encryption Standard, and pre-set keys) suffer from problems such as difficulty in key updates and poor forward security. Directly porting standard post-quantum signature algorithms or traditional hash chain signature schemes fails to meet the real-time, low-power, and state simplification requirements of resource-constrained terminals. There is an urgent need for an encryption and decryption method that is computationally lightweight (millisecond-level latency), communication lightweight (hundred-byte-level signatures), has simplified state management (no Merkle tree required, only a counter), possesses post-quantum security, and is generalizable to various wireless protocols.

[0014] To at least address the aforementioned issues, this application introduces a prime number sequence. The Pisano period length corresponding to each prime number in the Fibonacci sequence is calculated, and this Pisano period length is used to calculate the public-private key pair used in the authentication process. The network negotiation session key is only completed after the device has been authenticated. This approach allows for flexible adaptation to devices of different sizes, broadening its applicability, while reducing the computational burden on the device during task execution. This solution is not only applicable to Bluetooth mesh networks, but also, by adjusting the broadcast channel base address Adv_base and the number of available channels N_ch, to network access authentication and anti-interference transmission for low-power wireless ad hoc networks such as ZigBee (16 channels, 2.4GHz band channels 11~26), LoRa (Sub-GHz band channel adaptive), and industrial wireless sensor networks (WIA-PA / WirelessHART, etc.). Only the channel parameter table needs to be replaced for different protocol specifications during the factory pre-configuration stage. The core PF-PQS (Prime-Fibonacci Post-Quantum Signature, a custom name in this application, referring to the signature verification process in steps 110 to 150 below) signature verification algorithm does not require modification and has good protocol generalization capabilities. It is particularly suitable for environments with weak hardware capabilities and limited resources in edge scenarios within ad hoc networks, effectively reducing response time and thus meeting the speed requirements of real-time communication scenarios.

[0015] The following describes in detail a lightweight post-quantum wireless ad hoc network authentication method of the present invention. This method can be used by devices already connected to Bluetooth mesh, ZigBee, Thread, or LoRa to authenticate devices that need to join their Bluetooth mesh, ZigBee, Thread, or LoRa network. Please refer to... Figure 1 The method 100 includes steps 110 to 150.

[0016] The wireless ad hoc network verification method based on lightweight post-quantum in this invention can be used for ad hoc networks such as Bluetooth mesh, ZigBee, Thread, and LoRa. A corresponding edge ad hoc network encryption and decryption system is shown in Table 1 below.

[0017] Table 1

[0018] The wireless self-organizing network edge gateway hardware includes: a main control unit (ARM Cortex-M33 or RISC-V, supporting TrustZone / MPU); a wireless communication RF module (supporting Bluetooth mesh 5.0+ / ZigBee 3.0 / LoRa protocol stacks, supporting broadcast / relay / proxy / friend roles); optional wired interfaces (RS-485 / Ethernet); a secure storage unit (SE, SecureElement / TEE, Trusted Execution Environment, used to store private key seeds and prime number sequence tables); and a 2.4GHz or Sub-GHz anti-interference RF front-end (supporting adaptive broadcast channel selection).

[0019] Step 110: Generate a prime number sequence P containing a first preset number n prime numbers according to the security parameters.

[0020] P is the set of prime number sequences consisting of the first n prime numbers, where n is the length of the prime number sequence, i.e., the total number of prime numbers in the sequence, and is a positive integer; p i Let be the i-th prime number in P, where i is the prime index in P, a positive integer, and 1 ≤ i ≤ n. We can directly use P and its corresponding Pisano period... It is pre-configured and securely stored in the terminal SE.

[0021] Where n is determined according to the safety parameters, n = ceil(L) hash / w), where L hash The bit length of the hash digest is determined by the security parameter λ (e.g., λ=128 corresponds to SHA3-256 output L). hash =256 bits), w is the width of the fragmentation unit (described in step 1512). Example: λ=128, L hash =256, with an 8-bit index value field and an 8-bit numeric field, then w=16. If based on w, the corresponding n=ceil(256 / 16)=16; if based solely on the 8-bit numeric field, then n=32. λ determines L. hash The number of private keys required for a single signature is indirectly determined by n; the expected maximum number of message fragments is the upper limit of n, which provides an upper limit constraint on the expected maximum number of message fragments m (n≥m).

[0022] Step 120: Calculate the Pisano period length corresponding to each prime number according to the Fibonacci sequence.

[0023] For prime number p i Its Fibonacci modulus sequence under the Pisano period is as follows:

[0024] in, prime number The corresponding Fibonacci mode sequence of the 1st Item value; For the first The Fibonacci numbers satisfy the recurrence relation , , ( ); is the index of a term in the Fibonacci sequence, and is a non-negative integer; The set of natural numbers; This is the modulo operator. The sequence is periodic, and its period is called the Pisano period length, denoted as . . prime number The corresponding Pisano period length is a positive integer.

[0025] Step 130: Generate a private key seed of a first preset length based on the security parameters, and obtain a first private key based on the private key seed and the Pisano period length corresponding to each prime number. Wherein, the security parameters... It is a positive integer, which can take the values ​​128 or 256, and determines the security strength of the algorithm.

[0026] In one alternative implementation, step 130 includes step 131.

[0027] Step 131, x = (x1, ..., x2) i ,…,x n ); , i∈[1,n]; In the formula, x represents the first private key, x i represents the i-th private key component in the first private key; PRF represents the pseudo-random function; s represents the private key seed; mod represents the modulo operation; pi represents the i-th prime number in the prime number sequence; n represents the total number of prime numbers in the prime number sequence; This represents the length of the Pisano period corresponding to the i-th prime number.

[0028] Where the random seed s = ∈ {0, 1} λ The private key seed is a random bit string of length λ, {0,1}. λ Let λ represent the set of binary strings of length λ.

[0029] In this way, after generating the private key seed, a random number is generated based on the private key seed and the number of bits in the current private key component using a pseudo-random function. Then, the randomness of the private key is improved by taking the modulo of the Pisano period length corresponding to the prime number with the same number of bits in the current private key component. This improves the randomness of the private key and allows multiple usable private key components to be obtained at once. During the signing process, each slice of data to be signed can be completed using a separate private key, further enhancing security. Moreover, the signing process of each slice can be computed in parallel, thereby improving the efficiency of the signing process.

[0030] Step 140: Calculate the first public key corresponding to the first private key.

[0031] In one alternative implementation, step 140 includes step 141.

[0032] Step 141, y = (y1, ..., y2) i ,…,y n ); , i∈[1,n]; ; ; In the formula, y represents the first public key, y i p represents the i-th public key component in the first public key; u represents the iterative input index value, which is a non-negative integer or a parsed unsigned integer; i Let represent the i-th prime number in the prime number sequence; n represents the total number of prime numbers in the prime number sequence. This represents the Pisano period length corresponding to the i-th prime number; L is the preset hash chain iteration number, which is a positive integer. The modulo operation ensures The input is always within the effective range of the Pisano period, so the selection of the number of iterations L is not limited by the minimum value of the Pisano period, but only needs to meet the engineering real-time constraints; Represents the Fibonacci modulo sequence; SHA-3(), Secure Hash Algorithm 3, is a third-generation secure hash algorithm; it is a NIST standard hash algorithm that utilizes the periodicity of prime numbers and the chaotic nature of Fibonacci growth to provide one-wayness and collision resistance based on the assumptions of a combination of hash function collision resistance and preimage difficulty; H nat () is a one-way function for the natural number sequence, H nat (u, p) i () is a one-way function for a sequence of natural numbers, iterating over input index value u and prime number p. i The output value below; A one-way function for a sequence of natural numbers Iteration The output value after that. It can be seen that in the actual calculation process, x... i Substitute u into the iterative formula for calculation, and then use u modulo... Use k to calculate the Fibonacci modular sequence; This is a bit string concatenation operator.

[0033] The commonly used value for L is 256 (corresponding to 8 bits for the numeric field of each fragment). The reason for this value is that L determines the range of values ​​that each fragment can represent [0, L-1], i.e., the number of bits for the numeric field is log2(L). The larger L is, the greater the computational cost of hash iterations for signature verification (approximately L / 2 iterations on average for verification); the smaller L is, the more fragments are needed to cover the same length digest, resulting in a longer signature. L=256 is comparable to the commonly used configuration of LMS, Leighton-Micali Signature (a signature algorithm) / Winternitz with parameter w=8: signature verification averages approximately 128 SHA-3 iterations, which is millisecond-level with Cortex-M33 hardware acceleration, and approximately 32 fragments are sufficient to cover a 256-bit digest, achieving a balance between computational overhead and signature length. The selection of L must also satisfy the constraint that n·log2(L) is not less than the digest length.

[0034] Specifically, zero iterations are defined as identity mappings: During the iteration process, the output of the t-th iteration (1≤t≤L) is a fixed-length hash value (byte string). This hash value is parsed into an unsigned integer according to a predefined big-endian order rule (or, if another encoding method is used, parsing according to that method, such as little-endian), and then used as the input index value u for the (t+1)-th iteration, thus ensuring continuous iteration over the integer domain. Since p1=2 corresponds to a Pisano period among the first 256 prime numbers... If the number is too small, a subset of prime numbers can be selected in the engineering implementation. (i.e., from) (Start) To ensure parameter diversity, or set short chain parameters separately for p1. If the prime number subset scheme is adopted, the prime number sequence and the corresponding Pisano period length table used in the subsequent public key calculation (step 141) and signing and verification processes are consistent with this subset, and the index value corresponds one-to-one with the prime number in the subset according to the sequence number.

[0035] H natThe encoded iterative input index value, the corresponding Fibonacci modulus sequence value, and a prime number (or its index) are concatenated into a fixed-length byte string and used as the first hash input for SHA-3. The output hash value is parsed into an unsigned integer and used as the input index value u for the next iteration. When calculating the Fibonacci modulus sequence, u is moduloed according to the Pisano period. This process is unidirectional and irreversible; there is no reverse decryption process. The post-quantum security of this scheme stems from the unidirectionality of the hash function (preimage difficulty), thus ensuring the security of the signature verification process. All certificate parameters are uniformly encoded according to big-endian, little-endian, or other uniform encoding rules before being input into SHA-3. Only the sorting method of the signing and verification ends needs to be consistent. If the sorting methods are inconsistent, even if the signature content has not been tampered with, a signature verification failure result will be output. Because protocols such as Bluetooth and TLS commonly use network byte order (big-endian), the alignment cost in engineering implementation is low.

[0036] Big-Endian encoding is a fixed-length unsigned integer byte string; where according to Longer than a certain length, with values ​​ranging from [0, p] i-1 ], from the current prime number p i Determine; prime numbers according to Compared to a specific length encoding, p n The largest prime number in the prime number sequence; u is encoded in 32-bit fixed-length encoding. The encoding width is determined by security parameters during the initialization phase, and the signing and verification ends must be consistent. The encoding width refers to the number of fixed-length encoding bits for each integer parameter, for example, the Fibonacci modulo sequence value... Longer than a certain length encoding (value range [0, p) i-1 ], from the current prime number p i (determines) prime number p i according to Longer than a certain length encoding (p) n The system uses a 32-bit fixed-length encoding for the largest prime number in the prime number sequence, and the counter is encoded separately before being concatenated. The total length of the concatenated array is the sum of the widths of each field. Alternatively, each parameter can be encoded separately according to its own fixed-length width before concatenation. Fixed-length encoding requires no additional separators.

[0037] Among related technologies, SHA-3 (Keccak) has mature open-source implementations, such as the Keccak Code Package, the SHA-3 module of mbedTLS, and the Keccak-f

[1600] Cortex-M assembly implementation in the PQM4 project; the Fibonacci modulus sequence can be calculated by fast doubling or shift-addition recursion, with a computational complexity of logarithmic level; the whole can be implemented in C language on Cortex-M33: the prime number sequence table and Pisano periodic table are pre-stored in SE, and the iteration process calls the SHA3-256 hardware acceleration core.

[0038] As described above, the public key is constructed based on the hash chain of natural numbers. Its security is based on the combined assumptions of the collision resistance and preimage difficulty of the SHA-3 hash function. Under the quantum random oracle model, by choosing a sufficiently large security parameter, the key length can be ensured to be sufficient, thereby maintaining a quantum security margin.

[0039] Step 150: After signing the first request based on the first private key, send the signed first request and the first public key; and verify the received second request based on the received second public key, and generate a session key after the verification is successful, and transmit data according to the session key.

[0040] In an alternative implementation, signing the first request based on the first private key in step 150 includes steps 1511 to 1515.

[0041] Step 1511: Calculate the message digest d=F(M) of the first request, where F() represents the hash algorithm, such as SHA-3, M represents the first request, and d is a fixed-length binary string.

[0042] Step 1512: Set the fragmentation unit width (bit width) w = L represents the preset number of hash chain iterations; This is the floor function; n represents the total number of prime numbers in the prime number sequence. Step 1513, Number of fragments m = L hash Indicates the length of the message digest; when using SHA3-256, L hash =256. When rounding up, if the last fragment is less than w bits, pad it with 0s up to w bits to ensure that all bits of the message digest are overwritten. Rounding down can also be used here, but if rounding down is used, w must be guaranteed to be divisible by L in the parameter constraints. hashIt also provides parameter examples for integer division relationships to avoid data loss issues; the method of rounding up has wider applicability to parameter selection.

[0043] Step 1514: The first part of each fragment... Bitwise parsing is done by adding 1 to an unsigned integer to get the index value. Bits are parsed into numerical values ​​to obtain an index sequence. With numerical sequences i j Let be the j-th index value in the index sequence, be a positive integer, and 1 ≤ i. j ≤n; dj is the integer value corresponding to the j-th segment of the message digest, satisfying 0≤d j ≤L; j is the fragment number, which is a positive integer, and 1≤j≤m, n≥m; in this way, fragments are decoupled from index values ​​and numerical values. The index value is used to locate the private key component, and the numerical value determines the number of hash chain iterations, so that the signature calculation of each fragment is independent and can be executed in parallel, which improves the signature efficiency; at the same time, each fragment corresponds to only a limited amount of private key information, and a single point of leakage does not affect the overall security of the signature.

[0044] Step 15: For each index Extract the private key component from the first private key x. Calculate the signature component based on the private key component. If the private key is updated based on each signature, then obtain the first private key x(cnt) corresponding to the counter value cnt, and extract the private key component. ;in, This represents the j-th signature component, which is the hash output value. Represents a one-way function over a sequence of natural numbers Iteration Next, the private key component serves as the starting index u of the hash chain, and the message digest fragment value d. j The distance to proceed along the chain is determined as the number of iterations instead of L.

[0045] As described above, for the first request, a new message digest is calculated, and the message digest is fragmented. For each fragment, a private key component is extracted from the first private key and signed. This allows multiple fragments of the message digest to be signed in parallel, improving the computational efficiency of the system while maintaining the digest length to ensure security.

[0046] In an optional implementation, the signing of the first request based on the first private key in step 150 further includes steps 1516 to 1517.

[0047] Step 1516: Generate a random salt value r and calculate the hash component of the random salt value. ;ps A fixed prime number is preset; for example, a random salt value can be of length 2. For a random bit string, a fixed prime number close to the median can be selected as the preset fixed prime number ps. , This is the floor operator.

[0048] Step 1517: Generate a signature Packet-by-packet signature digest verification can reduce bit error rate at the Bluetooth mesh broadcast layer and physical layer. Under these conditions, an extremely low tampering detection rate is achieved at the data link layer, and it is also applicable to other ad hoc network scenarios such as ZigBee, Thread, and LoRa. If the private key is updated after each signature, a counter is introduced. When generating a signature, the signature also needs to include the counter value cnt so that the receiver receiving the first request can retrieve the corresponding first public key based on cnt to complete the signature verification. Using SHA3-256 (hash output byte length L) hash (bytes), m=16, expected maximum number of signatures not exceeding 2 32 That is, cnt≤2 32 For example, the signature counter value cnt is represented by a 4-byte unsigned integer, and the complete signature length is approximately: (byte); in, For signature byte length; The length in bytes of the signature counter cnt; The length in bytes of the random salt value r; Hash component of random salt value The length of the bytes; here L hash The bytes are derived from the output length of SHA3-256; This represents the number of fragments, and its meaning is consistent with the definition in this section.

[0049] Truncate the hash output (take the first 16 bytes) and preserve... To maintain a 32-byte length without truncation, the signature length can be compressed to: the truncation target is each signature component σ. j The hash output byte length (and optional σ0) is truncated from 32 bytes to the first 16 bytes; the length L of the message digest d hash The length remains unchanged because the digest is used in the fragmentation process and cannot be truncated. That is, what is compressed is the number of bytes occupied by each component of the signature, not the message digest length. The truncated length is: (byte); like Synchronous truncation to 16 bytes further compresses the data to 308 bytes. This length is significantly smaller than ML-DSA-44 (approximately 2,420 bytes) and SLH-DSA (approximately 8,000~50,000 bytes), representing a 76%~99% compression compared to traditional post-quantum signature schemes. Furthermore, it can be transmitted via Bluetooth mesh segmentation, ZigBee APS layer packetization, or LoRa MAC layer fragmentation mechanisms, making it compatible with various narrowband wireless protocols. Signature length is not directly proportional to security strength: the verbosity of signatures like SLH-DSA stems from the need for stateless hash signatures to carry numerous authentication paths and tree structures, not from higher security levels. The security of this scheme is reduced to the difficulty of SHA-3 preimages; forging any signature component requires calculating the preimage of the hash output, which is impossible in the SHA-3 algorithm. When the component remains a complete 32 bytes, the complexity of a classic preimage attack is 2^3. 256 Grover's quantum attack is about 2 128 It satisfies the security level of λ=128; even after truncating to 16 bytes (128 bits), the classic complexity is 2. 128 Quantum Grover approx. 2 64 While the classical strength remains unchanged, the quantum security margin decreases. Therefore, the truncated version is positioned as an optional configuration for scenarios with extremely limited bandwidth, and is not the default configuration. The default configuration is recommended not to truncate (580 bytes). Multiple security safeguards: attackers need to find a valid preimage on the chain for all m signature components at the same time in order to forge a complete signature. In addition, the counter derives the private key once, and the random salt value prevents replay. If a single component is compromised, it will not affect other signatures or long-term seeds.

[0050] As described above, in addition to signing the message digest fragments, the signature data also introduces a random salt value and a hash component of the random salt value to further prevent replay attacks. When calculating the hash component of the random salt value, a fixed prime number in the prime number sequence is selected as a dedicated prime number to reduce the consumption of the prime number retrieval process.

[0051] In an optional implementation, a signature lightweight digest (8-16 bytes) is appended to the end of each wireless ad hoc network message PDU, which digest encodes the signature components. After converting to a fixed-length byte string, XOR each byte and accumulate them, then take the first few bytes. Byte generation.

[0052] in, The preset byte length for lightweight digests satisfies ,and The format of the wireless ad hoc network AccessPDU is determined by both the network's security requirements and the system's security. In addition to verifying each signature component individually, a lightweight digest is generated based on the signature component. This means that any change to a single signature will result in a change to the lightweight digest value. As a result, even if individual signature components are cracked, it will be detected and will not affect the overall security of the system.

[0053] In one optional implementation, the method further includes processing key telemetry data (transformer oil temperature, partial discharge peak value) using... Reed-Solomon code.

[0054] in, The length of the encoded codeword is a positive integer. Let be the length of the information bits, be a positive integer, and satisfy . The encoded block is hashed and then signed to ensure that even if some packets are lost, tampering can still be located through signature verification. The receiver verifies the signature in real time. If three consecutive packets fail to verify the signature, a broadcast channel switch and adaptive transmit power are triggered.

[0055] In an optional implementation, the method further includes step 101: when the device is manufactured, pre-store the Pisano period length corresponding to each prime number in the prime number sequence and the prime number sequence.

[0056] As described above, if the Pisano period length and prime number sequence corresponding to each prime number in the prime number sequence are calculated and pre-stored before the device leaves the factory, the Pisano period corresponding to the prime number can be directly obtained during the subsequent calculation of the public key and private key, without the need for real-time calculation, which further improves the real-time performance of the interaction process and reduces the interaction latency.

[0057] In an optional implementation, step 130 further includes step 132: setting a counter, obtaining a first private key based on the private key seed, the value of the counter, and the Pisano period length corresponding to each prime number. Then, in step 150, after signing the first request based on the first private key, the counter is updated. Updating the counter can increase the counter value by a preset value, for example, by 1, so the updated counter value is cnt. 新 =cnt 旧 +1. The next time a signature is needed, a completely new first private key is derived from the updated cnt.

[0058] In an optional implementation, this application also provides a lookup table optimization mechanism, in which the edge terminal pre-stores each prime number. Corresponding Pisano period value and a table storing prime number sequences (approximately 1KB in total); Fibonacci modulo sequence values The hash table is computed in real time by a hardware shift-add accelerator or cached on demand as a local lookup table for high-frequency prime numbers. The lookup table is stored in a read-only region of the SE. Hash iteration is implemented using a hardware-accelerated SHA-3 core.

[0059] As described above, after each signature, the counter is updated, and the first private key and the first public key are recalculated based on the updated counter value. In this way, the key used for each signature is different. Even if a signature is compromised, it is impossible to trace back to other signatures or private key seeds, thus ensuring the security of two-way authentication.

[0060] In one alternative implementation, step 132 includes step 1321.

[0061] Step 1321 ; ; Before calculating the private key for the first time, cnt is initialized to 0. The value of cnt is a non-negative integer, which is used to derive the one-time private key and prevent the private key from being reused.

[0062] In the formula, x (cnt) This indicates the first private key corresponding to the value cnt of the counter. Let represent the i-th private key component in the first private key, which is a non-negative integer; PRF represents a pseudo-random function, whose inputs are the private key seed s, the index i of the private key component, and the value cnt of the counter, and whose output is a pseudo-random bit string, which is converted into an unsigned integer and then subjected to a modulo operation; s represents the private key seed, cnt represents the value of the counter; mod represents the modulo operation, p i Let i represent the i-th prime number in the prime number sequence, where i is a positive integer and 1 ≤ i ≤ n; n represents the total number of prime numbers in the prime number sequence. This represents the Pisano period length corresponding to the i-th prime number; each private key component satisfies 0 ≤ ≤ .

[0063] Correspondingly, for each i∈[1,n], the corresponding first public key component is calculated. ; in, For the first Each public key component is a hash output value; construct the device's initial public key. .

[0064] in, For the initial signature counter The first public key at that time. Then the corresponding private key. The public key is also updated accordingly (cnt), providing a public key corresponding to the private key for signature verification, thus completing the full signature-verification process. During the factory initialization phase, the device can be pre-set with a counter (cnt) ranging from 0 to N. max -1 Calculate and upload the first public key corresponding to each cnt in batches. The public key is stored in the platform layer's public key repository; the platform layer maintains the public key component corresponding to each cnt according to a counter index to achieve signature verification. The device includes the signature during the signing process. The platform retrieves the corresponding value based on the current cnt value. Perform the signature verification process. Where N max This represents the maximum number of signatures during the device's entire lifecycle, a positive integer determined by both the device deployment cycle and the signature frequency. Specifically, the private key cannot be directly equated to the initial private key x, but is derived and updated along with the counter cnt. , corresponding to expand as ,in , Let pk be the length of the Pisano period corresponding to the i-th prime number; public key pk and Numerically consistent, and semantically pk specifically refers to the signature verification public key stored in the platform's public key library by index cnt, which is updated synchronously with cnt.

[0065] Storage capacity justification: (Approximately 1 million signatures) Taking a hash output length of 32 bytes as an example, the storage capacity of the platform's public key library on a single device is approximately... This is acceptable on the platform side; if a larger size is required... To prevent the public key database from expanding infinitely under a single seed, the private key seed s should be rotated regularly. Compared to existing quantum key algorithms, the public key component in this invention is the top of the hash chain, i.e., the fixed-length 32-byte output of SHA-3. The hash output is compressed to a fixed length and is independent of the chain length L. In contrast, lattice signature (ML-DSA) public keys need to carry matrix or polynomial coefficients. A single public key is about 1312 bytes and a signature is about 2420 bytes. The size is determined by the lattice dimension and cannot be compressed. This invention does not have an additional tree structure: LMS / XMSS needs to store Merkle tree nodes, tree paths, and multiple one-time public keys. This scheme only derives one-time private keys through a signature counter. The device side only needs to store λ-bit private key seed s, about 1KB of prime numbers, and a Pisano periodic table, without any tree state. In this invention, the platform side stores the data according to the counter cnt index. Each signature corresponds to n 32-byte components, i.e., a linear overhead of n times 32 bytes. After amortization over the entire lifecycle of the device, the storage per unit signature is much lower than the full public key overhead required for each verification of lattice signature. In summary, the fixed-length compression characteristic of one-way hashing allows the top 32 bytes to represent the entire hash chain, eliminating the need to preserve large-scale algebraic or tree-like structures like lattice or tree schemes. This is the fundamental reason for its smaller space requirements.

[0066] Security Note: The public key is constructed based on the top of a hash chain of natural numbers, and its security relies on the combined assumptions of the collision resistance of the SHA-3 hash function and the difficulty of preimage attacks. Under the quantum random oracle model, Grover's search algorithm can reduce the complexity of preimage attacks from... Down to By selecting a sufficiently large ( This maintains a quantum security margin. Because each signature uses a one-time private key derived from a different counter cnt, even if a signature is compromised, it is impossible to trace back to other signatures or long-term private key seeds s.

[0067] As described above, the private key is generated by introducing the value of a counter. After each signature, the value of the counter is updated, which will update the new private key. Thus, the private key used for each calculation is different. If a single signature is compromised, it will not affect the security of other signatures. In wireless ad hoc networks, which require continuous access to new devices, the security of the interaction process is further guaranteed.

[0068] In an optional implementation, steps 102 to 103 are also included.

[0069] Step 102: Obtain the event number t of the event to be broadcast, and obtain the target prime number p corresponding to the event to be broadcast. t =p ((t-1) mod n)+1 ; Step 103 ; In the formula, p ((t-1) mod n)+1 This represents the ((t-1) mod n)+1th prime number in the prime number sequence; ch t This indicates the main broadcast channel for the current event to be broadcast, with event number t; Adv base Indicates the base address of the broadcast channel; N ch This represents the total number of available main broadcast channels; when t > n, a prime number sequence can be cyclically reused, that is, the value of t mod n is taken as the event number to achieve continuous anti-interference transition.

[0070] For example, if a Bluetooth self-organizing network is used, the Bluetooth mesh main broadcast channels include Bluetooth LED channels 37, 38, and 39, the Bluetooth mesh broadcast channel base address is 37, and the total number of available Bluetooth mesh main broadcast channels is 3; if applied to a ZigBee network, then... Take 11, Taking 16 (corresponding to channels 11~26 in the 2.4GHz band), the pseudo-random distribution of the prime number sequence mod 16 can achieve adaptive hopping of channel 16; if LoRa is used in the self-organizing network mode, then... Select the starting channel of the available frequency band in the region. The number of available channels in the region is used to achieve interference avoidance in the Sub-GHz band. The first 256 prime numbers modulo 3 are... It periodically covers three broadcast channels. Due to the pseudo-randomness of prime number sequences, the broadcast channel selection driven by prime number sequences has inherent irregularity. This results in pseudo-random transitions between multiple main broadcast channels in a wireless ad hoc network, and the distribution of Bluetooth mesh broadcast events across channels 37 / 38 / 39, as well as the distribution of ZigBee broadcast events across channels in the 11-26 frequency bands. This provides stronger protection against Wi-Fi fixed-channel interference in the 2.4GHz band and leakage interference from microwave ovens at 2.45GHz. Furthermore, by reusing the prime number sequence from the cryptographic side for broadcast channel selection on the communication side, there is no need to store independent channel selection parameters, reducing terminal memory usage.

[0071] As described above, reusing the prime number sequence on the cryptographic side for broadcast channel selection on the communication side eliminates the need to store independent channel selection parameters, further reducing memory usage and making it more suitable for the hardware conditions of edge nodes.

[0072] In an optional implementation, step 150, which verifies the signature of the received second request based on the received second public key, includes steps 1521 to 1524.

[0073] Step 1521, Analysis ,verify This prevents signature tampering; if they are not equal, output... This indicates that the verification failed.

[0074] Step 1522: Recalculate the message digest The index sequence is derived according to the sharding rules described in step 1514. With numerical sequences For other devices, the signing process is the same as steps 110 to 150 above, except that the final generated public and private keys are denoted as the second public key and the second private key. Furthermore, because each device has a different private key seed s, the final generated public and private keys will also be different for different devices. Since two-way authentication is required during the network entry process of a self-organizing network, each node device in the wireless self-organizing network, as well as the device waiting to join the network, needs to generate a public-private key pair. The public key is stored uniformly in the platform for future use. It can be understood that each device acts as both a verifier, verifying the second request sent by other devices, and can also issue a first request for verification by other devices.

[0075] Step 1523, for each , sign component Parse into unsigned integers according to preset encoding rules (such as big-endian rules). This serves as the input index value for subsequent hash chain iterations.

[0076] Calculate the verification value ; in, The j-th verification value is the hash output; comparison. .

[0077] in, The second public key corresponding to the signature counter cnt of the sender of the received second request, stored in the platform's public key store. The Each component.

[0078] Step 1524: If all matches, output 1 to indicate that the verification passed; otherwise, output 0 to indicate that the verification failed.

[0079] As can be seen from the signature construction, a valid signature satisfies: Therefore, if the equation If the signature is valid, then the signature is legal.

[0080] Security Note: This scheme is based on the one-way nature of hash chains. Given signature components... Attackers cannot computationally reverse engineer the one-time second private key. (Based on the preimage difficulty of SHA-3). Since each signature generates a brand new one-time private key through a counter cnt, the same private key component is never reused, effectively resisting key recovery attacks and replay attacks.

[0081] This paper applies the aforementioned lightweight post-quantum-based wireless ad hoc network verification method to a real-world scenario, describing the two-way authentication process when a device joins the network. The two-way authentication is performed when an ad hoc network device (including Bluetooth mesh / ZigBee / LoRa sensor nodes or edge gateways) joins the network, including steps 210 to 230. The ad hoc network device is used as the execution device for this lightweight post-quantum-based wireless ad hoc network verification method.

[0082] The wireless self-organizing network edge gateway includes the following functional modules: 1. Natural Sequence Cipher Engine (NNCE) is a hardware engine that performs cryptographic operations based on the sequence of prime numbers and the Fibonacci sequence (collectively known as the natural number sequence). It includes a prime number sequence memory, a Fibonacci modulo operation accelerator, and a SHA-3 hardware hash kernel.

[0083] Hardware implementation of a prime number sequence memory (ROM, Read-Only Memory) before pre-storage The prime number sequence P consisting of prime numbers and the corresponding Pisano period length Occupying approximately 1KB; Fibonacci modulo operation accelerator (based on shift-addition implementation, replacing complex multipliers, supporting single-cycle modulo addition); SHA-3 hardware hash kernel (supports...) Fast iterative computation, throughput ).

[0084] 2. Wireless self-organizing network communication controller.

[0085] Supports Bluetooth Mesh 5.0+ / ZigBee 3.0 / LoRaWAN protocol stacks (broadcast / relay / proxy / friend roles); a prime number sequence P-driven broadcast channel selector (hardware lookup table implementation, per broadcast event). Channel switching); Real-time monitoring and interference avoidance logic for Received Signal Strength Indication (RSSI) (channel switching is triggered by three consecutive failed signature verifications).

[0086] 3. Security authentication and key management module.

[0087] Secure storage of device certificate (including the public key generated according to step 140) (SE / TEE); A two-way authentication state machine based on PF-PQS (Prime-Fibonacci Post-Quantum Signature, i.e., the signature process from steps 110 to 150 above) supports a three-stage Challenge-Response-Key Derivation process and is embedded in the wireless ad hoc network provisioning workflow. Session key derivation and periodic updates are supported (supporting key evolution based on a counter period: key evolution offsets are distributed quarterly via a secure channel). ).

[0088] in, The key is a positive integer, determined by the platform's security policy; let the key evolution function be... The key evolution function is used in the key evolution process, which involves updating the peripheral private key seed periodically by performing a PRF and XOR operation on an epoch basis.

[0089] in, This is the key evolution function, whose inputs are the original private key seed s and the key evolution offset. The key evolution cycle identifier epoch is used, and the output is the evolution material bit string; s is the original private key seed, that is, the private key seed in step 131; epoch is a positive integer; PRF is a pseudo-random function, whose meaning is the same as in step 1321, and it supports variable length input parameters.

[0090] Then the new private key seed .

[0091] in, This is the evolved private key seed; It is a bitwise XOR operator; at the same time, the old private key is securely erased to achieve forward security.

[0092] 4. Hybrid Access Manager.

[0093] GATT proxy access port (for Bluetooth mesh) or ZigBee Coordinator / LoRa Gateway access port, supporting low-power node Friend function; wireless self-organizing network broadcast radio frequency interface, supporting mesh / star network relay / proxy topology; data aggregation, signature proxy, and protocol conversion functions (Bluetooth mesh / ZigBee Model messages → MQTT / HTTPS).

[0094] Step 210: The self-organizing network device sends an authentication request to the edge gateway that has joined the network, including steps 211 to 213.

[0095] Step 211: Self-organizing network device D generates a random challenge. .

[0096] Where D is the identifier (UUID or node address) of the self-organizing network device (wireless sensor device). The random challenge value generated for ad hoc network device D is of length [value missing]. random bit strings, These are the pre-set safety parameters.

[0097] Step 212: Calculate the signature : ; in, Sign the device; A unique identifier for the device; The current timestamp of the device forms M in step 1511; This is the first private key for the self-organizing network device D, and its generation method is the same as in step 130. The signature process is from step 1511 to step 1515; This is a bit string concatenation operator.

[0098] Step 213: Send authentication request frame: ,in[ This is the first request. For the signature corresponding to the first request, the authentication request frame also includes the value of the current signature counter cnt of device D, so that the verifier can retrieve the corresponding first public key from the platform's public key library based on cnt to complete the signature verification.

[0099] Step 220: The proxy node or edge gateway G verifies the first request and responds. This includes steps 221 through 224.

[0100] Step 221: Proxy node or edge gateway G verifies timestamp Freshness, i.e., validation T D Time difference with local time If the conditions are met, the subsequent steps will continue to prevent replay.

[0101] in, For identification of wireless ad hoc network agent nodes or edge gateways; This is the difference between the local time and the device timestamp. This is a preset time threshold, and it is a positive integer.

[0102] Step 222: Obtain D's public key pk from the platform. D include ,use verify The verification method is the same as steps 1521 to 1524 above.

[0103] If successful, a random challenge will be generated. With session key material .

[0104] in, For length is A random bit string; This is the session key material, with a length of [length missing]. Random bit strings, security parameters of network access devices To ensure successful mutual signature verification, all devices within the same wireless ad hoc network use a unified security parameter λ (e.g., 128 or 256) during the factory pre-configuration stage. This ensures consistency in hash digest length, fragmentation unit width, prime number sequence length, and signature / verification process, guaranteeing successful mutual signature verification between devices. Parameters can be negotiated between different networks through a secure channel, but must remain consistent within the same network.

[0105] Step 223: Calculate the second signature

[0106] in, Sign the proxy node / edge gateway; A unique identifier for the proxy node / edge gateway; for A hash function is used to bind the challenge value to a digest, forming M in step 1511; The second private key for the proxy node / edge gateway; The coordinator's random challenge value is defined in this section; The session key material defined in this section.

[0107] Step 224: Send authentication response frame: The authentication response frame also includes a hash value H calculated based on the random challenge CD. SHA3 (CD) is used by device D in step 232 to verify the relevance of the response frame to the current session challenge.

[0108] Step 230: Perform device verification and generate a session key. This includes steps 231 to 233.

[0109] Step 231, Equipment D Verification (use The verification process is the same as steps 1521 to 1524 above.

[0110] in, For the public key of the proxy node / edge gateway, including .

[0111] Step 232: Confirm that the response frame contains To verify the correlation. That is, according to C D Recalculate Judge the calculated result With the received response frame If they match, the verification passes, and a verification pass message is returned to device G, then step 233 is executed; otherwise, a verification failure message is returned. Verification This is used to prove that the response was indeed issued by the entity holding the G private key, resolving the issue of "who issued it" and verifying its authenticity; the confirmation response includes... This is used to prove that the response is in response to the challenge of this session. The response addresses the relevance issue of "which session it is for," preventing attackers from replaying legitimate responses from other sessions to the current session. Without the former, the identity of the other party cannot be verified; without the latter, replay attacks cannot be prevented. Both are indispensable.

[0112] Step 233: Both device D and device G calculate the session key. After receiving the verification information returned by device D, device G calculates the session key. After device D has successfully verified in steps 231 and 232, it calculates the session key.

[0113] ; in, It serves as a session key, which can be further derived into Bluetooth mesh NetKey (network key) and AppKey (application key), or the key required in other self-organizing networking methods such as ZigBee, Thread, and LoRa. It is a key derivation function, HKDF-SHA3 based on SHA-3; HKDF is an extract-and-expand key derivation function based on HMAC (Keyed-hash Message Authentication Code). The key-derived label is a pre-defined fixed ASCII string, such as "PF-PQS-AUTH-KEY-V1", used to distinguish different protocol contexts; This refers to the session key material generated in step 222. The key derivation label is a domain separation label of the KDF, a pre-defined fixed string used to isolate different protocol contexts and prevent cross-protocol key confusion attacks. For example, the same KDF can be used to derive the network access session key (label PF-PQS-AUTH-KEY-V1) and also for the above key evolution derivation (label PF-PQS-KEY-EVOLVE-V1). Different labels make the output key streams of the two derivations completely independent; the version number V1 facilitates future algorithm upgrades (such as enabling V2 after changing KDF parameters) to prevent the old and new systems from being mixed. Its function is similar to the use of different labels in TLS 1.3 HKDF to distinguish handshake keys from application keys. The generation of session keys is based entirely on post-quantum signatures, so even if a quantum computer exists, it is impossible to forge device identity or crack session keys. The combination of key evolution and session key is as follows: key evolution operates at the long-term private key seed level, updating the original private key seed s with PRF and XOR operation according to the epoch period to obtain the new private key seed, ensuring the forward security of the identity credentials used for subsequent signatures; session key derivation operates at the single session level, deriving the session key from the session key material generated in this authentication through HKDF-SHA3 in a one-time manner; the two layers achieve domain separation through different key derivation tags (PF-PQS-KEY-EVOLVE-V1 and PF-PQS-AUTH-KEY-V1), are independent of each other, and are decoupled step by step, together forming a complete post-quantum security link from device identity credentials to session communication keys.

[0114] In an optional implementation, the wireless ad hoc network edge gateway is also included as a proxy node / friend node to uniformly manage heterogeneous access, including steps 3101 to 3102.

[0115] Step 3101: For Bluetooth mesh scenarios, GATT (Generic Attribute Profile) proxy access (smartphones / tablets / low-power nodes): The edge gateway is an already networked device that performs proxy signing on data from low-power nodes (LPNs) connecting via GATT. Since low-power nodes do not require post-quantum computing capabilities, the edge gateway needs to sign the aggregated data packets using the above signing process before uploading them to the platform layer. For ZigBee / LoRa scenarios, the edge gateway acts as a Coordinator / Gateway, performing proxy signing on the aggregated data reported by the terminal nodes before uploading. The proxy signature format is: ; in, Sign for proxy; This refers to the aggregated sensor data message; This is a low-power node identifier; An edge gateway identifier for signing; include , is the edge gateway private key, and its generation method is the same as in step 130; This refers to the signature process from step 1511 to step 1515.

[0116] Step 3102: The platform layer obtains the public key of the proxy node to verify the proxy signature. The verification process is the same as the steps above and will not be repeated here.

[0117] In an alternative implementation, the method further includes wireless ad hoc network broadcast relay access, including step 3201.

[0118] Step 3201: Because the relay node in the wireless ad hoc network has lightweight computing capabilities, it can complete independent signing through steps 110 to 150 and then send a request to the edge gateway via broadcast relay. The edge gateway performs signature verification and policy checks (data threshold, frequency). The signature verification process is the same as steps 1521 to 1524 above. Policy checks are a common technical means in the wireless ad hoc network interaction process and will not be elaborated here. Unlike conventional policy checks, this scheme links the policy check results with the interference adaptive transmission mechanism in step 450. When the frequency exceeds the limit or consecutive signature verification fails, the broadcast channel is simultaneously triggered for elimination and updating, achieving synergy between security policies and anti-interference transmission.

[0119] As can be seen, in the GATT / ZigBee / LoRa proxy access mode, low-power node data is signed by the edge gateway and then uploaded to the IoT management platform (platform layer) via MQTT or HTTPS, where the platform performs unified signature verification. In the broadcast relay access mode, relay nodes independently sign the data and transmit it to the edge gateway for signature verification and aggregation via the wireless ad hoc network, before the gateway uploads it to the platform. Both access modes ultimately complete unified signature verification at the platform layer, achieving end-to-end quantum security and ensuring consistency of security policies.

[0120] In summary, the PF-PQS algorithm is based on the number theory properties of the natural number sequence (prime numbers + Fibonacci sequence) and the one-wayness of the SHA-3 hash chain. Its security is built upon the standard cryptographic assumptions of SHA-3 collision resistance and preimage difficulty, making it resistant to quantum attacks such as Shor's algorithm, thus exhibiting high security. Compared to LMS / XMSS, which requires maintaining Merkle tree states and paths, PF-PQS derives a one-time private key vector solely through a signature counter cnt, eliminating the need for a Merkle tree, reducing state management complexity and storage overhead, and simplifying the state management process. Utilizing the natural differences in the Pisano periods corresponding to different prime numbers, it provides heterogeneous length constraints for each hash chain, enriching parameter diversity and offering greater parameterization flexibility compared to the unified parameters of Winternitz. Through prime number sequence lookup and hash chain iterative computation, it reduces the computational complexity of signature calculations from that of traditional lattice signatures. Reduce to This achieves lightweight computation, with signature and verification times on the Cortex-M33 platform reaching millisecond levels, meeting the real-time requirements (status reporting cycle in seconds) of self-organizing networking methods such as Bluetooth mesh, ZigBee, Thread, and LoRa; N lat The lattice dimension parameter in the lattice signature scheme is used for comparison with the complexity of PF-PQS and is independent of the prime number sequence length n in this paper; the typical signature length is 580 bytes (approximately 324 bytes after truncation optimization), which can be carried through Bluetooth mesh / ZigBee / LoRa segmented message transmission mechanisms, significantly smaller than ML-DSA-44 (approximately 2,420 bytes) and SLH-DSA (approximately 8,000~50,000 bytes), resulting in lightweight communication and adaptability to various wireless ad hoc network narrowband message transmissions. Simultaneously, it achieves zero-trust ad hoc networks, requiring devices to undergo post-quantum signature two-way authentication to prevent unauthorized device access; the session key is negotiated based on PF-PQS, and historical session key materials ( , , The private key seed is destroyed after derivation, ensuring forward security for historical sessions even if the seed is leaked long-term. The Low Power Node (LPN) of the Wireless Ad Hoc Network is implemented lightweight using PF-PQS and can be powered by a coin cell battery / energy harvesting system, with controllable computational power consumption in low-power mode. Various proxy nodes can have signatures proxies via the edge gateway, eliminating the need for them to upgrade their own cryptographic capabilities and protecting existing investments.

[0121] The following section provides an example of applying the aforementioned lightweight post-quantum-based wireless self-organizing network verification method to a real-world scenario. Bluetooth networking is used as a specific example, but this does not constitute a limitation on the application scenarios of this solution. The self-organizing network method can also be compatible with ZigBee, Thread, LoRa, etc. mentioned above.

[0122] The scenario involves deploying Bluetooth mesh vibration sensors, temperature sensors, and SF6 sensors in a 10kV substation of a municipal power company to monitor the overall operational status of the substation. The substation contains 2.4GHz interference sources such as Wi-Fi APs (Access Points, channel 6 / 11), ZigBee gateways, and microwave ovens. On-site measurements show a background noise level of approximately -65dBm, with peak interference at the same frequency reaching -45dBm. The implementation process includes steps 410 to 450.

[0123] Step 410: On-site hardware deployment and network topology planning.

[0124] Five Bluetooth mesh edge gateways (model: based on nRF52840, integrating Cortex-M33 and ARM TrustZone, SE security unit is ATECC608B, pre-stored prime number sequence table and Pisano periodic table of about 1KB, RAM size is 256KB, Flash size is 1MB) are deployed at the four corners and top of the station building. The gateways are connected to the IoT management terminal in the station building after being aggregated via RS-485. Twelve Bluetooth mesh sensor nodes (model: based on nRF52811, Cortex-M4, RAM size is 24KB, Flash size is 192KB, powered by CR2032 button batteries, designed life of 5 years) are deployed at transformers, switch cabinets and cable joints. The sensor nodes are pre-set with private key seed s (128 bits), prime number sequence P (n=16, the first 16 prime numbers) and corresponding Pisano periodic length table, and initial counter cnt=0. The network topology adopts a mesh structure of "edge gateway + sensor node". The gateway acts as a proxy node and friend node, the sensor node is a low power node (LPN), the broadcast interval is set to 100ms, the transmit power is set to 0dBm (default), and the RSSI monitoring period is 1 second.

[0125] Step 420: Anti-interference configuration.

[0126] Edge gateway configuration prime sequence broadcast channel selection: Bluetooth mesh master broadcast channel base address Number of available channels (Corresponding to 37 / 38 / 39); Broadcast Channel Selection Formula .

[0127] in, For the first The index of the Bluetooth mesh master broadcast channel used by each broadcast event; For the prime number sequence The specific implementation process for the number of prime numbers is the same as steps 102 to 103 above; t represents the number of available channels; t represents the broadcast event sequence number; mod represents the modulo operator.

[0128] Channel distribution verification data: The values ​​of the first 256 prime numbers mod 3 are... The broadcast will periodically cover three broadcast channels. The channel diagrams for the first 20 broadcast events are shown in Table 1 below.

[0129] Table 1

[0130] Due to the pseudo-randomness of the prime number sequence, the distribution of broadcast events between 37 / 38 / 39 is irregular, naturally avoiding interference from the fixed Wi-Fi channels (channels 6 / 11 corresponding to 2.437GHz / 2.462GHz) within the station. Actual measurement data shows that without enabling prime number sequence channel switching, the average packet loss rate of sensor nodes within the station is approximately 8.5%, with RSSI fluctuations ranging from -75dBm to -55dBm. After enabling the pseudo-random channel selection driven by the prime number sequence of this solution, after 72 hours of continuous monitoring, the average packet loss rate decreased to 1.2%, and RSSI stability improved by approximately 40%, effectively avoiding periodic interference from the microwave oven and sudden Wi-Fi traffic surges.

[0131] Step 430: Network access authentication.

[0132] The new sensor node S needs to have its initial certificate written using a handheld configuration tool (smartphone / tablet) by maintenance personnel (including...). of ).

[0133] in, For sensor node identification; For nodes The public key is generated in the same way as in step 140. Upon network access, the new sensor node and edge gateway perform bidirectional PF-PQS authentication, which is the signing and verification process described in step 150 above. After successful authentication, the standard Bluetooth mesh provisioning process is embedded to complete network joining and open the data port. The measured total latency of the complete bidirectional authentication process for a single node (including signing, verification, and session key derivation) is approximately 4560 milliseconds, with PF-PQS signature calculation taking approximately 12 milliseconds, verification taking 8 milliseconds, and channel transmission and protocol interaction taking approximately 2540 milliseconds, meeting the "install and go" operational efficiency requirements in the field.

[0134] Step 440: Normal data transmission and power consumption monitoring.

[0135] The sensor node collects temperature / vibration / SF6 concentration data every 30 seconds. The data packet is approximately 20 bytes long and is transmitted in segments via Bluetooth mesh (each segment is approximately 812 bytes of payload). ， (Divided into 23 segments). The daily active time of a node is approximately 48 seconds (including data acquisition, signing, and transmission), with a sleep current of approximately 1.5μA and an active current of approximately 3mA (including RF and MCU operations). Calculations show that the energy consumption of a single PF-PQS signature operation (including SHA-3 hardware acceleration) is approximately 0.08mJ, which is lower than the software-simulated ML-DSA-44 (approximately 8mJ measured on the same platform). Combined with the CR2032 coin cell battery with a nominal capacity of 220mAh, the theoretical battery life can reach 6.2 years, meeting the grid's design specification of "5 years of maintenance-free operation".

[0136] The communication process between nodes also includes step 450, interference adaptive transmission.

[0137] The edge gateway continuously monitors the RSSI and signature failure rate of each broadcast channel. If a channel experiences consecutive signature failures (determined to be an interference channel), the corresponding prime number mapping is removed from the broadcast channel selection pattern, and the available channel set is dynamically updated. This method eliminates signature failures caused by channel interference resulting in inconsistent transmitted and received data. For example, if a high-power Wi-Fi hotspot is temporarily activated in the station, occupying channel 6 (2.437GHz, near Bluetooth channel 38), and the gateway detects that the RSSI of channel 38 is below -70dBm three times consecutively and the signature failure rate exceeds 5%, it automatically removes channel 38 and uses only 37 / 39 for prime number sequence mapping. The three-channel mode is automatically restored 24 hours after the interference is eliminated.

[0138] In an optional implementation, step 460, alarm data priority signature, is also included.

[0139] For example, when the device temperature exceeds a threshold (>65°C), the node enters emergency mode; the alarm message is double-signed: node signature. +Edge Gateway Proxy Signature .in, Sign the node, and generate it in the same way as in step 212; The edge gateway agent signature is generated in the same way as in step 3101. Real-time reception by the platform is ensured through a reliable Bluetooth mesh transmission mechanism.

[0140] In this way, wireless transmission exhibits anti-interference capabilities in a 2.4GHz multi-protocol coexistence scenario in a power distribution station, and all successfully received data is verified and signed by PF-PQS to ensure tamper-proof integrity. After three months of deployment and operation, statistics show that approximately 1.2 × 10⁻⁶ data packets have been transmitted cumulatively. 6 The signature verification pass rate was 99.7%, and the average response time for abnormal alarms (from sensor triggering to platform display) was approximately 180 milliseconds. No security incidents caused by signature verification failures occurred, verifying the engineering feasibility of this solution in real complex electromagnetic environments.

[0141] The following section further expands the applicable scenarios of this solution, using Bluetooth mesh power distribution room monitoring as an example for detailed explanation. However, those skilled in the art should understand that the above-mentioned PF-PQS core algorithm and system architecture can be adapted through protocol parameters and generalized to the following scenarios: 1. ZigBee / Thread Smart Building: Integrating Advanced Technologies... base Let's set it to 11, N ch Set to 16, the pseudo-randomness of prime number sequence mod 16 is used to realize the adaptive hopping of 16 channels in the ZigBee 2.4GHz band. The edge gateway acts as ZigBee Coordinator to perform PF-PQS bidirectional authentication and proxy signature for terminal sensors. 2. LoRaWAN Wide-Area Meter Reading: In low-voltage power meter reading and water meter reading scenarios, prime number sequences are multiplexed for LoRa's Sub-GHz channel selection (such as the 470~510MHz band in China, N...). ch (Retrieve the number of available channels), the terminal water / electricity meter has a built-in PF-PQS lightweight module, which performs signature verification when entering the network through the LoRa gateway, solving the security risks caused by the long-term non-updation of the traditional AES-128 pre-set key; 3. Industrial Wireless Sensor Network (IWSN): In the star / mesh hybrid network of WIA-PA (Wireless Networks for Industrial Automation-Process Automation) or WirelessHART, PF-PQS is embedded into the existing network access process. Its millisecond-level latency meets the requirements of industrial control cycle (usually 10~100ms), and its 580-byte signature is adapted to the industrial wireless short frame structure. 4. Widely applicable across all aspects of the power Internet of Things: From transmission line towers (Bluetooth mesh / ZigBee monitoring of conductor temperature, icing, and wind deflection), substations (LoRa monitoring of surge arrester leakage current), distribution rooms (in this embodiment) to the power consumption side (smart circuit breaker mesh networking), a unified PF-PQS security framework can be adopted to achieve end-to-end quantum security from the edge to the cloud. The platform only needs to maintain one set of public key library and signature verification logic, which greatly reduces the security operation and maintenance costs of multi-protocol heterogeneous systems.

[0142] Please refer to Figure 2 The present invention also provides a lightweight post-quantum-based wireless ad hoc network verification terminal 500, including a memory 501, a processor 502, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the various steps of a lightweight post-quantum-based wireless ad hoc network verification method as described above.

[0143] In summary, this application provides a lightweight post-quantum-based wireless ad hoc network verification method and terminal. It derives a one-time private key vector through a signature counter, eliminating the need to maintain Merkle trees and tree paths, and removing Merkle tree states, thus reducing state management complexity and storage overhead. Number theory parameterization leverages the natural differences in the Pisano periods corresponding to different prime numbers to provide naturally heterogeneous length constraints for each hash chain, enhancing parameter diversity. Parameter reuse allows the prime number sequence used for signatures to be directly reused for wireless ad hoc network broadcast channel selection, reducing the total number of pre-configured parameters in the terminal.

[0144] To address the heavy computational and state management burden of post-quantum signatures at edge terminals, a lightweight post-quantum signature mechanism based on natural number sequence algorithms (PF-PQS, Prime-Fibonacci Post-Quantum Signature, a custom name used in this application) is proposed. This mechanism utilizes the number-theoretic properties of natural number sequences (prime sequences, Fibonacci sequences) to parameterize hash chain iterative operations. On the Cortex-M33 platform, the signature / verification latency is reduced to 520 milliseconds (60,600 times faster than standard signatures), the signature length is controlled at 324,580 bytes (76%-99% compression compared to standard signatures), and the device-side storage overhead is only about 1KB (80%~90% lower than LMS / XMSS). Furthermore, it eliminates the need to maintain the Merkle tree state.

[0145] To address the reliability issues of wireless ad hoc networks in the complex electromagnetic environment of the 2.4GHz band, an anti-interference adaptive broadcast channel selection protocol is designed. The prime number sequence of PF-PQS is reused as the broadcast channel selection parameter for various wireless protocols, realizing the coordination of cryptographic parameters and communication parameters. Combined with the packet-by-packet verification mechanism of signature digest, the data integrity rate is improved in the 2.4GHz co-frequency interference environment. To address the lack of two-way network access authentication for ad hoc network devices, a device identity authentication and key negotiation framework based on post-quantum signatures is constructed. PF-PQS two-way authentication is embedded in the wireless ad hoc network provisioning process, eliminating the need to pre-store authentication whitelists and enabling real-time authentication to achieve zero-trust network access. It addresses the issue of unified security for wireless ad hoc network proxy nodes and low-power nodes, providing an integrated security architecture for Bluetooth mesh edge gateways that is compatible with heterogeneous access methods such as GATT proxy connections, ZigBee Coordinator access, LoRa Gateway access, and various wireless broadcast relays.

[0146] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for verifying wireless ad hoc networks based on lightweight post-quantum quantum computing, characterized in that, include: Generate a sequence of prime numbers containing a first preset number of prime numbers based on security parameters; Calculate the length of the Pisano period corresponding to each prime number in the Fibonacci sequence; A private key seed of a first preset length is generated based on the security parameters, and a first private key is obtained based on the private key seed and the Pisano period length corresponding to each prime number. Calculate the first public key corresponding to the first private key; After signing the first request based on the first private key, the signed first request and the first public key are sent; and the received second request is verified based on the received second public key, and a session key is generated after the verification is successful, and data is transmitted according to the session key.

2. The method according to claim 1, characterized in that, The step of generating a private key seed of a first preset length based on the security parameters, and obtaining the first private key based on the private key seed and the Pisano period length corresponding to each prime number, includes: x=(x1,…,x i ,…,x n ); ,i∈[1,n]; In the formula, x represents the first private key, x i represents the i-th private key component in the first private key; PRF represents a pseudo-random function; s represents the private key seed; mod represents the modulo operation; pi represents the i-th prime number in the prime number sequence; n represents the first preset quantity; This represents the length of the Pisano period corresponding to the i-th prime number.

3. The method according to claim 1, characterized in that, The calculation of the first public key corresponding to the first private key includes: y=(y1,…,y i ,…,y n ); ,i∈[1,n]; ； ； ； In the formula, y represents the first public key, y i Represents the i-th public key component in the first public key; u represents the iterative input index value; p i This represents the i-th prime number in the prime number sequence; n represents the first preset quantity; This represents the length of the Pisano period corresponding to the i-th prime number; This represents a one-way function representing a sequence of natural numbers, iterating over input index values ​​u and prime numbers p. i The output value is set below; L is the preset number of iterations. Represents the Fibonacci modulo sequence; SHA-3() is a hash algorithm; prime number The corresponding Fibonacci mode sequence of the 1st Item value; For the first Fibonacci numbers; This is the index of a term in the Fibonacci sequence.

4. The method according to claim 1, characterized in that, Also includes: Set a counter to obtain a first private key based on the private key seed, the value of the counter, and the Pisano period length corresponding to each prime number; After signing the first request based on the first private key, the counter is updated.

5. The method according to claim 4, characterized in that, The process of obtaining the first private key based on the private key seed, the value of the counter, and the Pisano period length corresponding to each prime number includes: ； ； In the formula, x (cnt) This indicates the first private key corresponding to the value cnt of the counter. Represents the i-th private key component in the first private key; PRF represents a pseudo-random function; s represents the private key seed; cnt represents the value of the counter; mod represents the modulo operation; p i This represents the i-th prime number in the prime number sequence; n represents the first preset quantity; This represents the length of the Pisano period corresponding to the i-th prime number.

6. The method according to claim 3, characterized in that, The step of signing the first request based on the first private key includes: Calculate the message digest d=F(M) of the first request, where F() represents the hash algorithm and M represents the first request; Set the width of the slice unit w= L represents the preset number of hash chain iterations; This is the floor function; n represents the first preset quantity; Number of fragments m= L hash Indicates the length of the message digest; The first part of each slice Bitwise parsing is done by adding 1 to an unsigned integer to get the index value. Bits are parsed into numerical values ​​to obtain an index sequence. With numerical sequences ; For each index Extract the private key component from the first private key x. Calculate the signature component based on the private key component. The value of L is d. j , representing the number of iterations; Represents the i-th prime number in the prime number sequence j There are prime numbers, and u takes the value of , indicating the iterative input index value.

7. The method according to claim 6, characterized in that, The step of signing the first request based on the first private key further includes: Generate a random salt value r, and calculate the hash component of the random salt value. ;p s Preset a fixed prime number; Generate signature .

8. The method according to claim 1, characterized in that, Also includes: When the device leaves the factory, the Pisano period length corresponding to each prime number in the prime number sequence and the prime number sequence are pre-stored.

9. The method according to claim 1, characterized in that, The data transmission based on the session key includes: Obtain the event number t of the event to be broadcast, and obtain the target prime number p corresponding to the event to be broadcast. t =p ((t-1) mod n)+1 ; ； In the formula, p ((t-1) mod n)+1 This represents the ((t-1) mod n)+1th prime number in the prime number sequence, where n represents the first preset quantity; ch t This indicates the main broadcast channel for the current event to be broadcast, with event number t; Adv base Indicates the base address of the broadcast channel; N ch This indicates the total number of available main broadcast channels.

10. A lightweight post-quantum-based wireless ad hoc network verification terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements each step of the lightweight post-quantum-based wireless ad hoc network verification method according to any one of claims 1 to 9.

Images