A method for establishing a group key supporting dynamic change of a node and forward security

Abstract

The application relates to a method for establishing a forward security group key supporting dynamic change of a node, relates to the technical field of network security, and solves the problem that an existing group key establishment scheme cannot support dynamic change of a group node, and comprises the following steps: a trusted center selects system parameters, wherein pre-shared keys exist between two nodes in a group; each node of a current group generates a group key of the current group and a state value of the current group according to the system parameters and the pre-shared keys; in response to a new node joining the current group, the new node sends a temporary key and identity information of the new node to any target node of the current group; the target node authenticates the identity of the new node according to the temporary key and the identity information of the new node, the system parameters and a pre-shared key between the target node and the new node, and sends the group key of the current group and the state value of the current group to the new node after the authentication is passed.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for establishing a forward-secure group key that supports dynamic changes in nodes. Background Technology

[0002] Decentralized self-organizing network technology enables the rapid construction of a mobile communication network at any time and any location without the support of existing information infrastructure, making it possible for terminals to achieve decentralized, free, and rapid communication.

[0003] The current decentralized self-organizing network scenario has the following four prominent characteristics:

[0004] 1. Decentralized: In ad hoc networks, nodes are peer-to-peer, with no traditional control center. Each legitimate node can initiate the group key establishment process, making it difficult to apply centralized solutions to establish efficient security authentication and key establishment mechanisms for ad hoc networks.

[0005] 2. Rapid Network Topology Changes: During operation, events such as new nodes joining the network and existing nodes leaving the network cause frequent changes in the ad hoc network topology. This characteristic requires ad hoc networks to strictly manage the identities of incoming and outgoing nodes, especially to be able to quickly change the group key when a node leaves the network.

[0006] 3. High demand for multi-node communication: In most cases, nodes need to exchange information in real time to ensure that the work is completed effectively. For example, when computing together, intermediate data needs to be shared with other nodes in real time, and when multiple nodes work together, information such as current status and location needs to be shared with other nodes in real time.

[0007] This requires ad hoc networks to have the ability to quickly establish group keys for communication and to meet the dynamic joining and leaving requirements of nodes. However, current group key establishment schemes suffer from high computational and communication overhead and a large number of communication rounds, and symmetric cryptography-based group key establishment schemes cannot support dynamic changes in group nodes. Therefore, how to establish a group key establishment scheme that supports dynamic changes in nodes is an urgent problem to be solved. Summary of the Invention

[0008] Based on the above analysis, the embodiments of the present invention aim to provide a method for establishing a forward-secure group key that supports dynamic changes in nodes, in order to solve the problem that existing group key establishment schemes cannot support dynamic changes in group nodes.

[0009] This invention provides a method for establishing a forward-secure group key that supports dynamic node changes, comprising the following steps:

[0010] Step S100: The trusted center selects system parameters, which are system parameters of a communication system consisting of a group of multiple nodes, wherein there is a pre-shared key between each pair of nodes in the group;

[0011] Step S200: Each node in the current group generates the group key and the state value of the current group based on the system parameters and the pre-shared key;

[0012] Step S300: In response to a new node joining the current group, the new node sends its temporary key and identity information to any target node in the current group;

[0013] Step S400: The target node authenticates the identity of the new node based on the temporary key, the identity information, the system parameters, and the pre-shared key between the target node and the new node. After successful authentication, the target node sends the group key and the status value of the current group to the new node.

[0014] Further improvements to the above method include the following steps:

[0015] Step S500: In response to a node leaving the current group, the remaining nodes in the current group update the node set of the current group;

[0016] Step S600: After the update, each node generates a new group key and a new state value for the current group based on the system parameters, the pre-shared key, and the current group's state value.

[0017] Based on a further improvement of the above method, step S400 includes:

[0018] Step S401: The target node generates first verification information based on its temporary key, the pre-shared key between itself and the new node, the new node's temporary key and identity information, and the system parameters;

[0019] Step S402: The new node verifies the first verification information based on the pre-shared key between itself and the target node and the system parameters. After the verification is successful, the new node generates second verification information based on the pre-shared key between itself and the target node, its temporary key, its identity information, and the system parameters.

[0020] Step S403: The target node verifies the second verification information based on its temporary key, the pre-shared key between itself and the new node, the new node's temporary key and identity information, and the system parameters. After the verification is successful, the target node sends the group key of the current group and the status value of the current group to the new node.

[0021] Based on a further improvement of the above method, step S401 includes:

[0022] The target node encrypts its temporary key according to the system parameters and the pre-shared key between itself and the new node to obtain the first ciphertext.

[0023] The target node generates a second ciphertext based on its temporary key, the pre-shared key between itself and the new node, the new node's temporary key and identity information, and the system parameters;

[0024] The first verification information includes the first ciphertext and the second ciphertext.

[0025] Based on a further improvement of the above method, step S200 includes:

[0026] Step A200: Each node in the current group encrypts its own temporary key and sends it to its neighboring nodes in the current group according to the system parameters and the pre-shared key;

[0027] Step A300: Each node in the current group converts the temporary key of its neighboring nodes into its own broadcast ciphertext based on the system parameters and the pre-shared key; and

[0028] Step A400: Each node in the current group verifies the broadcast ciphertext of all other nodes according to the system parameters, and after successful verification, generates the key and state value of the current group according to the system parameters and the broadcast ciphertext of all other nodes.

[0029] Based on a further improvement of the above method, step S600 includes:

[0030] Step A410: After the update, each node encrypts its temporary key and sends it to its neighboring nodes according to the system parameters and the pre-shared key;

[0031] Step A420: After the update, each node converts the temporary keys of its neighboring nodes into their respective broadcast ciphertexts based on the system parameters and the pre-shared key; and

[0032] Step A430: After the update, each node verifies the broadcast ciphertext of all other nodes according to the system parameters, and after the verification is successful, generates a new group key and a new state value for the current group based on the system parameters and the broadcast ciphertext of all other nodes.

[0033] Based on a further improvement of the above method, the system parameters include a symmetric encryption / decryption algorithm, a first hash function, and a second hash function. The trusted center performs the following operation to select the system parameters:

[0034] Choose a symmetric encryption algorithm: And the corresponding symmetric decryption algorithm: Where {0,1} * A bit string of 0s and 1s of arbitrary length. This represents the value space of the symmetric encryption key;

[0035] Choose the first hash function

[0036] Choose the second hash function Where l is the output bit length of the second hash function. The value space of the key for the second hash function.

[0037] Based on a further improvement of the above method, the target node generates a second ciphertext according to its temporary key, its pre-shared key with the new node, the new node's temporary key and identity information, and the system parameters, including:

[0038] The target node calculates the second ciphertext h1 according to the following formula:

[0039] h1=H2(GK i,new ID i ||ID new ||r i ||r new ),

[0040] Among them, GK i,new ID represents the pre-shared key between the target node and the new node. i ID represents the identity information of the target node. new Represents the identity information of the new node, r i The temporary key representing the target node, r new The temporary key represents the new node, || represents the connector, and H2() is the second hash function in the system parameters.

[0041] Based on a further improvement of the above method, the new node generates second verification information according to its pre-shared key with the target node, its temporary key, its identity information, and the system parameters, including:

[0042] The new node calculates the second verification information h2 according to the following formula:

[0043] h2=H2(GK new,i ID i ||ID new ||r i +r new )

[0044] Among them, GKi,new ID represents the pre-shared key between the target node and the new node. i ID represents the identity information of the target node. new r represents the identity information of the new node i The temporary key representing the target node, r new The temporary key represents the new node, and || represents the connector.

[0045] Based on a further improvement of the above method, the system parameters include a negotiation node election algorithm. Before executing step A200, the establishment method further includes the following steps:

[0046] Each node in the current group executes the negotiation node election algorithm to obtain n node groups and one node in each node group participating in key negotiation, where n is less than or equal to the number of nodes in the current group;

[0047] Each node participating in key negotiation sorts all n nodes to obtain a list of nodes connected end to end; and the nodes in steps A200 to A400 refer to the nodes among the n nodes.

[0048] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0049] 1. This solution supports the dynamic joining and leaving of group nodes.

[0050] 2. In this scheme, even if the long-term private key (pre-shared key) held by the node is leaked, the adversary still cannot obtain the group key before the long-term private key was leaked, nor can he obtain the group key after the long-term private key was leaked. Therefore, forward security and backward security are satisfied.

[0051] 3. This scheme constructs pairwise shared keys based on pre-shared secrets. Each user only needs symmetric encryption / decryption operations and random number addition / subtraction operations, resulting in high computational efficiency.

[0052] 4. In this scheme, each participating node only needs to send a symmetric encrypted ciphertext of a random number during the key establishment process, or only needs to send a random number and a hash value, resulting in low communication overhead.

[0053] 5. This scheme can guarantee that all users generate the same session key.

[0054] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0055] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0056] Figure 1 This is a flowchart illustrating a method for establishing a forward-secure group key that supports dynamic node changes according to one embodiment of the present invention.

[0057] Figure 2 This is a flowchart illustrating a method for establishing a forward-secure group key that supports dynamic node changes according to another embodiment of the present invention. Detailed Implementation

[0058] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0059] Figure 1 This is a flowchart illustrating a method for establishing a forward-secure group key that supports dynamic node changes, according to an embodiment of the present invention.

[0060] The following is combined Figure 1 An embodiment of the present invention will be described.

[0061] like Figure 1 As shown, the method for establishing a forward-secure group key that supports dynamic node changes includes:

[0062] Step S100: The trusted center selects system parameters. The system parameters are the system parameters of a communication system consisting of a group of multiple nodes, and there are pre-shared keys between each pair of nodes in the group.

[0063] In this embodiment, the Trusted Center can select system parameters based on an initialization algorithm. This initialization algorithm takes a certain security level as input and selects a set of system parameters.

[0064] In some embodiments, the initialization algorithm includes performing the following operations:

[0065] The algorithm takes the security level κ as input and performs the following operations:

[0066] 1. Choose a symmetric encryption algorithm: And the corresponding symmetric decryption algorithm: Where {0,1} * A bit string of 0s and 1s of arbitrary length. This represents the value space for the symmetric encryption key. The bit length is t. Enc(K,M) and Dec(K,C) represent encrypting the plaintext message M and decrypting the ciphertext message C using the symmetric key K, respectively. The value of the bit length t of the symmetric encryption key is determined according to the security level required by the specific task.

[0067] 2. Select the first hash function

[0068] 3. Choose the second hash function Where l is the output bit length of the second hash function. The value space of the key for the second hash function.

[0069] 4. From Then select the hash key K of the group and distribute the hash key K to each node in the group.

[0070] 5. From Then select the initial state value S0 of the group and distribute the initial state value S0 to each node in the group.

[0071] In some embodiments, the initialization algorithm further includes performing the following operations:

[0072] 6. Select a negotiation node election algorithm. This algorithm can take the identity information of all nodes in the current group (let's say there are m nodes) as input, divide all nodes in the group into n groups, and select one node from each group, finally obtaining n groups and n nodes (m≥n).

[0073] In the above embodiments, the symmetric encryption / decryption algorithm corresponding to security level κ, the first hash function, the second hash function, the hash key K, and the initial state value S0 are a set of system parameters.

[0074] It should be noted that this embodiment is beneficial when the group size is large and the information transmission between nodes is unstable, because it is difficult to guarantee that all nodes will participate in the negotiation process under such circumstances. Therefore, this embodiment limits the number of nodes participating in group key negotiation to an acceptable range.

[0075] In this embodiment, the specific implementation of the negotiation node election algorithm and the values ​​of m and n are determined according to specific application requirements and group size, and this embodiment does not impose any restrictions.

[0076] In any of the above embodiments, a pre-shared symmetric encryption key GK exists between each pair of nodes in the group. ij The symmetric encryption key GK ij For user ID i and user ID j A pre-shared key, where i,j∈{0,…,m-1}. A pre-shared symmetric encryption key GK.ij The existing algorithm for generating a shared key between the two parties can be followed, and will not be described in detail in this embodiment.

[0077] Step S200: Each node in the current group generates the group key and the state value of the current group based on the system parameters and the pre-shared key.

[0078] The current group refers to the group of nodes participating in the group key calculation. If there is no grouping, the current group includes all nodes, with a quantity of m; if there is grouping and negotiation node election, the current group includes the n elected nodes that need to participate in the key calculation.

[0079] In this embodiment, each node in the current group can generate the group key and state value of the current group through a group key establishment algorithm. The group key establishment algorithm takes the pre-shared key and system parameters among the nodes of the current group as input and outputs the group key and state value of the current group.

[0080] In some embodiments, the group key establishment algorithm includes the following steps:

[0081] Step A200: Each node in the current group encrypts its own temporary key and sends it to its neighboring nodes in the group according to the system parameters and the pre-shared key.

[0082] In one embodiment, for a scenario where no grouping and negotiation node election have been conducted, each node i (i ranges from 1 to m) in the current group can perform the following operations:

[0083] 1. Sort m nodes according to a specific rule (such as by distance between nodes, or by the first letter of their identity names), resulting in a contiguous list of identities. Let this list be {ID0, ID1, ..., ID...} m-1}, where ID0 = ID m For node ID m-1 The next item, the node is ID. i (i∈{0,…,m-1}).

[0084] 2. Node i selects a temporary key r i .

[0085] 3. Node i obtains the pairwise shared key GK with its two neighboring nodes. i,i+1 GK i,i-1 .

[0086] 4. Node i encrypts and calculates the temporary key C. i,i+1 =Enc(GK i,i+1 ,r i ) and C i,i-1 =Enc(GK i,i-1 ,r i ).

[0087] 5. Send C i,i+1 Give ID i+1 Send C i,i-1 Give ID i-1 .

[0088] In the above embodiment, Enc() is the symmetric encryption algorithm in the system parameters.

[0089] In other embodiments, for scenarios requiring grouping and negotiation node election, each node in the current group can perform the following operations:

[0090] Phase 1:

[0091] 1. Execute the negotiation node election algorithm to obtain n groups and n nodes participating in key negotiation. Within each node group, one node participates in key negotiation. n is less than or equal to the number of nodes in the group.

[0092] Phase 2:

[0093] Each of the n nodes participating in key negotiation performs the following operation:

[0094] 1. Sort n nodes according to a specific rule (such as by distance between nodes, or by the first letter of their identities), resulting in a contiguous list of identities. Let this list be {ID0, ID1, ..., ID...} n-1}, where ID0 = ID n For node ID n-1 The next item, the node is ID. i (i∈{0,…,n-1}).

[0095] 2. Select temporary key r i .

[0096] 3. Obtain the pairwise shared key GK i,i+1 GK i,i-1 .

[0097] 4. Encrypted computation C i,i+1 =Enc(GK i,i+1 ,r i ) and C i,i-1 =Enc(GK i,i-1 ,r i ).

[0098] 5. Send C i,i+1 Give ID i+1 Send C i,i-1 Give ID i-1 .

[0099] Step A300: Each node in the current group converts the temporary keys of its neighboring nodes into their own broadcast ciphertexts based on the system parameters and the pre-shared keys.

[0100] In this embodiment, each node in the current group obtains the C of its neighboring nodes. i+1,i and C i-1,i Then, the pre-shared key GK with neighboring nodes can be used. i,i+1 GK i,i-1 Decryption yields the temporary key r of the adjacent nodes. i+1 =Dec(GK i,i+1 C i+1,i ), r i-1 =Dec(GK i,i-1 C i-1,i ).

[0101] In this embodiment, each node can use a broadcast ciphertext generation algorithm to convert the temporary keys of neighboring nodes into broadcast ciphertext. The broadcast ciphertext generation algorithm takes the temporary keys of neighboring nodes and system parameters as input and outputs a broadcast ciphertext.

[0102] In some embodiments, the broadcast ciphertext generation algorithm includes the following steps:

[0103] Step A310: Each node obtains the first message based on the difference between the temporary keys of two adjacent nodes;

[0104] Step A320: Each node obtains the second message based on the system parameters and the first message.

[0105] Steps A310-A320 will be described below with reference to a specific embodiment.

[0106] Node ID i (i∈{0,…,m-1}) perform the following operation:

[0107] Calculate x i =r i+1 -r i-1 h i =H2(K,ID) i ||x i ), and (ID) i ,x i ,h i ) is sent as broadcast ciphertext to other node IDs j (j∈{0,…,m-1}andj≠i), where || represents the concatenation operator.

[0108] In the above embodiments, x i For node ID i First news, h i For node IDi The second message.

[0109] In this embodiment, all nodes in the group perform the above operation, so the domain of node i is {0,…,m-1}.

[0110] In other embodiments, steps A310-A320 may include a node ID. i (i∈{0,…,n-1}) perform the following operation:

[0111] Calculate x i =r i+1 -r i-1 h i =H2(K,ID) i ||x i ), and (ID) i ,x i ,h i ) is sent as broadcast ciphertext to other node IDs j (j∈{0,…,n-1}andj≠i), where || represents the concatenation operator.

[0112] In this embodiment, only the nodes participating in key negotiation in the group perform the above operation, so the domain of node i is {0,…,n-1}.

[0113] Step A400: Each node in the current group verifies the broadcast ciphertext of all other nodes according to the system parameters, and after successful verification, generates the group key and the state value of the current group based on the system parameters and the broadcast ciphertext of all other nodes.

[0114] In this embodiment, each node can use a broadcast ciphertext verification algorithm to verify the broadcast ciphertext of other nodes. The broadcast ciphertext verification algorithm takes the broadcast ciphertext of other nodes and system parameters as input and outputs the verification result.

[0115] In some embodiments, the broadcast ciphertext verification algorithm includes the following steps:

[0116] Step A401: Each node verifies the second message of all nodes according to the system parameters. If the second message of any node fails to be verified, the execution is terminated; otherwise, proceed to step A402.

[0117] Step A402: Each node sums the first messages from all nodes. If the sum is 0, the verification passes; otherwise, execution terminates.

[0118] Steps A401-A402 will be described below with reference to a specific embodiment.

[0119] Node ID i(i∈{0,…,m-1}) perform the following operation:

[0120] 1. Retrieve all (IDs) j ,x j ,h j After (j=0,…,m-1), verify h. j =H2(K,ID) j ||x j If any condition is not met, return and terminate execution.

[0121] 2. Determine whether the following conditions are met: x0 + x1 + ... + x m-1 =0, if not satisfied, return and terminate execution.

[0122] In the above embodiments, the hash function H2 and the hash key K are system parameters.

[0123] In other embodiments, steps A401-A402 may include a node ID. i (i∈{0,…,n-1}) perform the following operation:

[0124] 1. Retrieve all (IDs) j ,x j ,h j After (j=0,…,n-1), verify h. j =H2(K,ID) j ||x j If any condition is not met, return and terminate execution.

[0125] 2. Determine whether the following conditions are met: x0 + x1 + ... + x n-1 =0, if not satisfied, return and terminate execution.

[0126] In the above embodiments, the hash function H2 and the hash key K are system parameters.

[0127] In this embodiment, each node can generate a group key using a group key generation algorithm. The group key generation algorithm takes the broadcast ciphertext of other nodes and system parameters as input and outputs a group key.

[0128] In some embodiments, the group key generation algorithm includes the following steps:

[0129] Node ID i (i∈{0,…,m-1}) perform the following operation:

[0130] 1. Calculate the shared secret value gsk i =(m-1)x i +(m-2)x i-1 +…+x i-m+2-m(r i +r i+1 ).

[0131] 2. Calculate the session key wk i =H1(“GroupKey”,gsk i ,S0,ID0,x0,ID1,x1,…,ID m-1 ,x m-1 Session key wk i This is the group key, where "GroupKey" is the tag value.

[0132] In this embodiment, all nodes in the group perform the above operation, so the domain of node i is {0,…,m-1}.

[0133] In this embodiment, each node can use a state value update algorithm to generate the current group's state value. The state value update algorithm takes the broadcast ciphertext of other nodes and system parameters as input and outputs a current group state value.

[0134] In some embodiments, the state value update algorithm includes the following steps:

[0135] Node ID i (i∈{0,…,m-1}) perform the following operation:

[0136] Calculate the new state value S1 = H1(“State”, gsk i ,S0,ID0,x0,ID1,x1,…,ID m-1 ,x m-1 "State" is the label value.

[0137] In this embodiment, all nodes in the group perform the above operation, so the domain of node i is {0,…,m-1}.

[0138] In other embodiments, the group key generation algorithm includes the following steps:

[0139] Node ID i (i∈{0,…,n-1}) perform the following operation:

[0140] 1. Calculate the shared secret value gsk i =(n-1)x i +(n-2)x i-1 +…+x i-n+2 -n(r i +r i+1 ).

[0141] 2. Calculate the session key wk i =H1(“GroupKey”,gski ,S0,ID0,x0,ID1,x1,…,ID m-1 ,x m-1 Session key wk i This is the group key, where "GroupKey" is the tag value.

[0142] In this embodiment, only the nodes participating in key negotiation in the group perform the above operation, so the domain of node i is {0,…,n-1}.

[0143] In this embodiment, each node can use a state value update algorithm to generate the current group's state value. The state value update algorithm takes the broadcast ciphertext of other nodes and system parameters as input and outputs a current group state value.

[0144] In some embodiments, the state value update algorithm includes the following steps:

[0145] Node ID i (i∈{0,…,n-1}) perform the following operation:

[0146] Calculate the new state value S1 = H1(“State”, gsk i ,S0,ID0,x0,ID1,x1,…,ID n-1 ,x n-1 "State" is the label value.

[0147] In some embodiments, after obtaining the group key of the n nodes participating in key negotiation, it is also necessary to obtain the group key of the other nodes in each group that did not participate in key negotiation. After step A400, the method further includes:

[0148] Step A500: Each node participating in the key negotiation generates a shared secret value based on the broadcast ciphertext of other nodes.

[0149] Specifically, node ID i (i∈{0,…,n-1}) perform the following operation:

[0150] Calculate the shared secret value gsk i =(n-1)x i +(n-2)x i-1 +…+x i-n+2 -n(r i +r i+1 ).

[0151] Step A600: Each node participating in the key negotiation encrypts and sends the shared secret value to other nodes in its node group according to the pre-shared key.

[0152] Step A700: Other nodes within the node group generate the group key and the current group status value based on system parameters and shared secret values.

[0153] Specifically, other nodes within the node group can perform the following operations:

[0154] Calculate session key wk i =H1(“GroupKey”,gsk i ,S0,ID0,x0,ID1,x1,…,ID m-1 ,x m-1 "GroupKey" is the tag value. Session key wk i This is the group key. Calculate the current group state value S1 = H1(“State”, gsk i ,S0,ID0,x0,ID1,x1,…,ID n-1 ,x n-1 "State" is the label value.

[0155] Back Figure 1 .

[0156] Step S300: In response to a new node joining the current group, the new node sends its temporary key and identity information to any target node in the current group.

[0157] In this embodiment, if a new node needs to join the current group, the new node needs to authenticate itself with the nodes in the current group. The specific process is as follows:

[0158] In the first phase, the new node can perform the following operations:

[0159] 1. Select a temporary key r new ;

[0160] 2. Transfer the temporary key r new and its identity information ID new Send to any node ID in the current group i .

[0161] In this embodiment, the temporary key r of the new node is received in the current group. new and identity information ID new The node that is selected is the target node.

[0162] Step S400: The target node authenticates the identity of the new node based on the new node's temporary key and identity information, system parameters, and the pre-shared key between the target node and the new node. After successful authentication, the target node sends the group key of the current group and the state value of the current group to the new node.

[0163] In this embodiment, the target node can use a new node identity authentication algorithm to verify the identity information of the new node. The new node identity authentication algorithm takes the new node's temporary key and identity information, system parameters, and the pre-shared key between the target node and the new node as input, and outputs the new node identity authentication result.

[0164] In some embodiments, the process by which the target node authenticates the identity of the new node includes the following steps:

[0165] Step S401: The target node generates first verification information based on its temporary key, the pre-shared key between itself and the new node, the new node's temporary key, the identity information, and the system parameters.

[0166] Step S402: The new node verifies the first verification information based on the pre-shared key between itself and the target node and the system parameters. After the verification is successful, the new node generates the second verification information based on the pre-shared key between itself and the target node, its temporary key and identity information, and the system parameters.

[0167] Step S403: The target node verifies the second verification information based on its temporary key, the pre-shared key between itself and the new node, the new node's temporary key and identity information, and system parameters. After the verification is successful, the target node sends the group key of the current group and the status value of the current group to the new node.

[0168] Steps S401 to S403 will be described below with a specific embodiment.

[0169] In the second phase, the target node ID i Upon receiving the temporary key r of the new node new and its identity information ID new Then, target node ID i Perform the following operations:

[0170] 1. Select temporary key r i ';

[0171] 2. Obtain the pre-shared key GK with the new node. i,new ;

[0172] 3. Calculate the first ciphertext C1 = Enc(GK) i,new ,r i ) and the second ciphertext h1=H2(GK i,new ID i ||ID new ||r i ||r new ), || represents the concatenation operator;

[0173] 4. Combine the first ciphertext C1, the second ciphertext h1, and the target node's identity information ID. i Send to new node ID new .

[0174] In the third phase, the new node ID new Upon receiving the first ciphertext C1, the second ciphertext h1, and the target node's identity information ID... i Then perform the following operations:

[0175] 1. Obtain the pre-shared key GK with the target node. i,new ;

[0176] 2. Using GK i,new Decrypt the first ciphertext C1 to obtain the target node's temporary key r. i ';

[0177] 3. Calculate h1' = H2(GK) new,i ID i ||ID new ||r i ||r new The process will verify whether the equation h1' = h1 is true. If it is true, proceed to the next step; otherwise, terminate the execution.

[0178] 4. Calculate the second verification information h2 = H2(GK) new,i ID i ||ID new ||r i +r new And send the second verification information to the target node ID. i .

[0179] In the fourth stage, the target node ID i After receiving the second verification information h2 sent by the new node, perform the following operation:

[0180] 1. Calculate h2' = H2(GK) i,new ID i ||ID new ||r i +r new And verify whether the equation h2' = h2 holds true. If it does, then change the group key wk of the current group. i and the current group state value S k Send to new node ID new At the same time, it broadcasts the new node's identity information (ID) to other nodes in the current group. new If the condition is not met, execution will be terminated.

[0181] Figure 2This is a flowchart illustrating a method for establishing a forward-secure group key that supports dynamic node changes according to another embodiment of the present invention. Figure 2 As shown, the method for establishing a forward-secure group key that supports dynamic node changes includes steps S100-S600, wherein steps S100-S400 are consistent with... Figure 1 The method is the same as in the previous section, so it will not be repeated here.

[0182] In this embodiment, Figure 2 The method also includes the following steps:

[0183] Step S500: In response to a node leaving the current group, the remaining nodes in the current group update the node set of the current group.

[0184] Step S600: After the update, each node generates a new group key and a new group state value based on the system parameters, the pre-shared key, and the current group state value.

[0185] In this embodiment, if a node goes out of control and is at risk of being captured by an adversary, it needs to be removed from the group and the group key and state value need to be updated.

[0186] In some embodiments, step S600 includes the following steps:

[0187] Step A410: After the update, each node encrypts its temporary key and sends it to its neighboring nodes according to the system parameters and the pre-shared key;

[0188] Step A420: After the update, each node converts the temporary keys of its neighboring nodes into their respective broadcast ciphertexts based on the system parameters and the pre-shared key; and

[0189] Step A430: After the update, each node verifies the broadcast ciphertext of all other nodes according to the system parameters, and after the verification is successful, generates a new group key and a new state value for the current group based on the system parameters and the broadcast ciphertext of all other nodes.

[0190] Steps A410 to A430 are similar to steps A200 to A400 described above, that is, steps A410 to A430 use a similar group key establishment algorithm as in steps A200 to A400. The main differences are as follows:

[0191] 1. During the execution of the group key establishment algorithm described above, the remaining nodes of the current group can update the group key by executing the following formula:

[0192] wk i=H1(“GroupKey”,gsk i ,S k ,ID0,x0,ID1,x1,…,ID n-1 ,x n-1 )

[0193] Among them, S k This is the current state value of the group before the group key is updated, and "GroupKey" is the tag value.

[0194] As can be seen from the above formula, the difference lies in the adaptive adjustment of the initial state value S0 in steps A200 to A400 to the current group state value S before the group key update. k .

[0195] 2. The remaining nodes in the current group can update the current group state value by executing the following formula:

[0196] S k+1 =H1(“State”,gsk i ,S k ,U0,x0,U1,x1,…,U n-1 ,x n-1 )

[0197] Among them, S k This represents the current state of the group before the group key is updated; "State" is the tag value.

[0198] As can be seen from the above formula, the difference lies in the adaptive adjustment of the initial state value S0 in steps A200 to A400 to the current group state value S before the group key update. k .

[0199] It should be noted that since the information of each node in the group changes dynamically, each time the group state value changes due to the change of node information, each node updates the group key and group state value according to the group state value before the node information change, thereby realizing the dynamic update of the group key and group state value.

[0200] The embodiments described above have at least the following beneficial technical effects:

[0201] 1. This solution supports the dynamic joining and leaving of group nodes.

[0202] 2. In this scheme, even if the long-term private key (pre-shared key) held by the node is leaked, the adversary still cannot obtain the group key before the long-term private key was leaked, nor can he obtain the group key after the long-term private key was leaked. Therefore, forward security and backward security are satisfied.

[0203] 3. This scheme constructs pairwise shared keys based on pre-shared secrets. Each user only needs symmetric encryption / decryption operations and random number addition / subtraction operations, resulting in high computational efficiency.

[0204] 4. In this scheme, each participating node only needs to send a symmetric encrypted ciphertext of a random number during the key establishment process, or only needs to send a random number and a hash value, resulting in low communication overhead.

[0205] 5. This scheme can guarantee that all users generate the same session key.

[0206] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for establishing a forward-secure group key that supports dynamic node changes, characterized in that, Includes the following steps: Step S100: The trusted center selects system parameters, which are system parameters of a communication system consisting of a group of multiple nodes, wherein there is a pre-shared key between each pair of nodes in the group; Step S200: Each node in the current group generates the group key and the state value of the current group based on the system parameters and the pre-shared key; Step S300: In response to a new node joining the current group, the new node sends its temporary key and identity information to any target node in the current group; Step S400: The target node authenticates the identity of the new node based on the temporary key, the identity information, the system parameters, and the pre-shared key between the target node and the new node. After successful authentication, the target node sends the group key and the status value of the current group to the new node.

2. The method for establishing according to claim 1, characterized in that, It also includes the following steps: Step S500: In response to a node leaving the current group, the remaining nodes in the current group update the node set of the current group; Step S600: After the update, each node generates a new group key and a new state value for the current group based on the system parameters, the pre-shared key, and the current group's state value.

3. The method for establishing according to claim 1, characterized in that, Step S400 includes: Step S401: The target node generates first verification information based on its temporary key, the pre-shared key between itself and the new node, the new node's temporary key and identity information, and the system parameters; Step S402: The new node verifies the first verification information based on the pre-shared key between itself and the target node and the system parameters. After the verification is successful, the new node generates second verification information based on the pre-shared key between itself and the target node, its temporary key, its identity information, and the system parameters. Step S403: The target node verifies the second verification information based on its temporary key, the pre-shared key between itself and the new node, the new node's temporary key and identity information, and the system parameters. After the verification is successful, the target node sends the group key of the current group and the status value of the current group to the new node.

4. The method for establishing according to claim 3, characterized in that, Step S401 includes: The target node encrypts its temporary key according to the system parameters and the pre-shared key between itself and the new node to obtain the first ciphertext. The target node generates a second ciphertext based on its temporary key, the pre-shared key between itself and the new node, the new node's temporary key and identity information, and the system parameters; The first verification information includes the first ciphertext and the second ciphertext.

5. The method for establishing according to claim 1, characterized in that, Step S200 includes: Step A200: Each node in the current group encrypts its own temporary key and sends it to its neighboring nodes in the current group according to the system parameters and the pre-shared key; Step A300: Each node in the current group converts the temporary key of its neighboring nodes into its own broadcast ciphertext based on the system parameters and the pre-shared key; and Step A400: Each node in the current group verifies the broadcast ciphertext of all other nodes according to the system parameters, and after successful verification, generates the key and state value of the current group according to the system parameters and the broadcast ciphertext of all other nodes.

6. The method for establishing according to claim 2, characterized in that, Step S600 includes: Step A410: After the update, each node encrypts its temporary key and sends it to its neighboring nodes according to the system parameters and the pre-shared key; Step A420: After the update, each node converts the temporary keys of its neighboring nodes into their respective broadcast ciphertexts based on the system parameters and the pre-shared key; and Step A430: After the update, each node verifies the broadcast ciphertext of all other nodes according to the system parameters, and after the verification is successful, generates a new group key and a new state value for the current group based on the system parameters and the broadcast ciphertext of all other nodes.

7. The method for establishing according to claim 4, characterized in that, The system parameters include a symmetric encryption / decryption algorithm, a first hash function, and a second hash function. The trusted center performs the following operations to select the system parameters: Choose a symmetric encryption algorithm: And the corresponding symmetric decryption algorithm: Where {0,1} * A bit string of 0s and 1s of arbitrary length. This represents the value space of the symmetric encryption key; Choose the first hash function Choose the second hash function Where l is the output bit length of the second hash function. The value space of the key for the second hash function.

8. The method for establishing according to claim 7, characterized in that, The target node generates a second ciphertext based on its temporary key, its pre-shared key with the new node, the new node's temporary key and identity information, and the system parameters, including: The target node calculates the second ciphertext h1 according to the following formula: h1=H2(GK i,new ,ID i ||ID new ||r i ||r new ), Among them, GK i,new ID represents the pre-shared key between the target node and the new node. i ID represents the identity information of the target node. new Represents the identity information of the new node, r i The temporary key representing the target node, r new The temporary key represents the new node, || represents the connector, and H2() is the second hash function in the system parameters.

9. The method for establishing according to claim 7, characterized in that, The new node generates second verification information based on its pre-shared key with the target node, its temporary key, its identity information, and the system parameters, including: The new node calculates the second verification information h2 according to the following formula: h2=H2(GK new,i ,ID i ||ID new ||r i +r new ) Among them, GK i,new ID represents the pre-shared key between the target node and the new node. i ID represents the identity information of the target node. new Represents the identity information of the new node, r i The temporary key representing the target node, r new The temporary key represents the new node, and || represents the connector.

10. The method for establishing according to claim 5, characterized in that, The system parameters include a negotiation node election algorithm. Before executing step A200, the establishment method further includes the following steps: Each node in the current group executes the negotiation node election algorithm to obtain n node groups and one node in each node group participating in key negotiation, where n is less than or equal to the number of nodes in the current group; Each node participating in key negotiation sorts all n nodes to obtain a list of nodes connected end to end; Furthermore, the nodes in steps A200 to A400 refer to the nodes among the n nodes.

Images