Lightweight encryption and authentication method for wireless sensor network, and related device

Abstract

Provided in the present application is a lightweight encryption and authentication method for a wireless sensor network. The method comprises: a gateway node respectively generating a sensor ephemeral key and a user ephemeral key on the basis of a one-way hash function and a preconfigured physically unclonable function, and respectively sending to a user end and a sensor node the sensor ephemeral key, the user ephemeral key, a preconfigured sensor long-term key and a preconfigured user long-term key; and after the user end and the sensor node are registered, the user end performing identity authentication on identity information currently input by a user, and performing, on the basis of the identity information, mutual authentication between the user end, the gateway node and the sensor node, so as to send a sensor hash-based message authentication code and a user hash-based message authentication code to the sensor node on the basis of the authentication result, such that the sensor node and the gateway node perform key agreement and authentication to obtain a session key, and wireless sensor network communication can thus be performed on the basis of the session key, thereby effectively solving the problem of authenticating the security of a wireless sensor network.

Description

Lightweight encryption authentication methods and related equipment for wireless sensor networks Technical Field

[0001] This application relates to the field of communication network security technology, and in particular to a lightweight encryption authentication method, apparatus, device, and storage medium for wireless sensor networks. Background Technology

[0002] Currently, with the development of Internet of Things (IoT) technology, Wireless Sensor Networks (WSNs) have been widely used in environmental monitoring, industrial automation, smart homes, and other fields as an important means of data acquisition and monitoring. However, due to the resource-constrained nature and open communication environment of wireless sensor networks, they face challenges such as data security, privacy protection, and identity authentication. Most existing wireless sensor network authentication methods rely on complex cryptographic mechanisms. Although these methods provide high security, they are computationally complex and have low efficiency on sensor nodes with limited resources, making them unsuitable for such nodes. Therefore, it is necessary to design an authentication method that can both ensure security and adapt to the resource limitations of wireless sensor networks.

[0003] Summary of the Invention

[0004] This application provides a lightweight encryption authentication method for wireless sensor networks. It can reduce computational complexity and simplify the authentication process by using physically unclonable functions and one-way hash functions, thereby reducing communication overhead and improving the overall performance of the system. It is suitable for resource-constrained sensor nodes and can effectively solve the security authentication problem of wireless sensor networks.

[0005] To achieve the above objectives, a first aspect of this application provides a lightweight encryption authentication method for a wireless sensor network. The wireless sensor network includes a user terminal, a gateway node, and sensor nodes connected in communication. The method includes: the gateway node generating a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physically non-cloning function, respectively, and sending the sensor instantaneous key, the user instantaneous key, a preset sensor long-term key, and the user long-term key to the user terminal and the sensor nodes, respectively; the user terminal acquiring a user-generated user identity identifier and user password data, and sending the user identity identifier to the gateway node to complete user registration; and the sensor nodes acquiring a sensor identifier and a sensor initial value, and sending the sensor identifier and the sensor initial value to the gateway node. The system completes sensor registration. The user terminal verifies the user's currently input identity information based on the user's identity identifier and password data, and performs mutual authentication between the user terminal, the gateway node, and the sensor node based on the identity information. It then sends a sensor hash message authentication code and a user hash message authentication code to the sensor node according to the authentication result. The sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and a random number and timestamp generated by the gateway node, obtaining a session key according to the authentication result. The session key is shared among the user terminal, the gateway node, and the sensor node to facilitate data exchange between them.

[0006] In some embodiments, the gateway node generates a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physically unclonable function (PUF), respectively, including: generating random one-time random numbers R1 and R2 based on a collision-resistant one-way hash function h(.); and generating challenge values ​​C1 and C2 and an initialization vector using the physically unclonable function PUF. and Based on random numbers R1 and R2, challenge values ​​C1 and C2, and initialization vector and Generate instantaneous sensing key T S and user instantaneous key T M ;in,

[0007] In some embodiments, the sensor node acquires a sensor identifier and an initial sensing value, and sends the sensor identifier and the initial sensing value to the gateway node to complete sensor registration, including: the sensor node acquiring a sensor identifier (SID). j and initial sensor value IV SAnd share the sensor identifier SID with the gateway node via a secure channel. j and the initial sensing value IV S The gateway node transmits the initial sensing value IV through a secure channel. S The parameter set formed by the long-term sensing key and the long-term user key is sent to the memory of the sensor node so that the sensor node sets the loop counter c to 1.

[0008] In some embodiments, the user terminal verifies the user's currently input identity information based on the user identity identifier and the user password data, including: the user terminal receiving the user's input identity identifier UID. i * and password PW i * If the user terminal verifies the user-input identity identifier (UID) i * and password PW i * The user identity identifier UID cached on the user's client i If the user's password data PWi is matched, the user is successfully authenticated. Upon successful authentication, the user's client sends the identity identifier UID to the gateway node. i * .

[0009] In some embodiments, the mutual authentication between the user terminal, the gateway node, and the sensor node based on the identity information, and the sending of the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result, includes: the gateway node based on the user identity identifier UID i Verify the identity identifier UID i * If verification is successful, a random number R3 is generated, and the user identification ID UID is used to determine the appropriate method. i The authentication parameter A1 = (R3||UID) is obtained. i The sensor node then sends the authentication response corresponding to A1 to the sensor node; the sensor node retrieves the counter c and the sensing instantaneous key T. S and the user's instantaneous key T M And determine the timestamp T1 to calculate the authentication parameters. The gateway node sends the authentication message corresponding to A2 to the gateway node; the gateway node calculates the security token based on R3 and A2. The security token A4 is sent to the user terminal; the user terminal obtains the sensing instantaneous key T corresponding to the counter c.S Based on T S Upon successful verification of the security token A4, a message containing the timestamp T1 and the random number R3 is obtained. And send A5 to the gateway node; the gateway node calculates the UID containing the user identity identifier. i The sensor node's identification SID j The authentication message B1, consisting of the counter c, the random number R3, and the timestamp T1, is sent to the user terminal; the user terminal obtains the user instantaneous key T corresponding to the counter c. M Based on T M Verify B1. If verification is successful, send a message containing the timestamp T1 and the user identification ID (UID). i The sensor node's identification SID j The authentication message B2 containing the counter c and the random number R3 is sent to the gateway node; the gateway node sends the sensor hash message authentication code based on B2. User hash message authentication code Send to the sensor node.

[0010] In some embodiments, the method further includes: the sensor node incrementing the value of the counter c after each successful completion of the authentication process.

[0011] In some embodiments, the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and a random number and timestamp generated by the gateway node to obtain a session key according to the authentication result. This includes: the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, the random number R3, and the timestamp T1, so that the sensor node calculates the session key δ(c), wherein the calculation formula for the session key δ(c) is:

[0012] Where B3=h(T1||Φ(c)),

[0013] To achieve the above objectives, a second aspect of this application provides a lightweight encryption authentication device for a wireless sensor network. The device includes: a system setting module, configured to control a gateway node to generate a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physical non-cloning function, respectively, and to send the sensor instantaneous key, the user instantaneous key, a preset sensor long-term key, and the user long-term key to a user terminal and a sensor node, respectively; a registration module, configured to control the user terminal to obtain a user-generated user identity identifier and user password data, and to send the user identity identifier to the gateway node to complete user registration; and to control the sensor node to obtain a sensor identifier and a sensor initial value, and to send the sensor identifier and the sensor initial value to the gateway node to complete sensor registration; and a login authentication module. The system is configured to control the user terminal to authenticate the user's currently input identity information based on the user identity identifier and the user password data, and to perform mutual authentication between the user terminal, the gateway node, and the sensor node based on the identity information, so as to send the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result; the key negotiation module is configured to control the sensor node to perform key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and a random number and timestamp generated by the gateway node, so as to obtain a session key according to the authentication result; so that the session key is shared among the user terminal, the gateway node, and the sensor node, and the user terminal, the gateway node, and the sensor node exchange data based on the session key.

[0014] To achieve the above objectives, a third aspect of the present application provides an electronic device, comprising: at least one processor; at least one memory for storing at least one program; and, when at least one of the programs is executed by at least one of the processors, implementing a lightweight encryption authentication method for a wireless sensor network as described in any one of the first aspects.

[0015] To achieve the above objectives, a fourth aspect of the present application provides a computer-readable storage medium storing computer-executable instructions for performing a lightweight encryption authentication method for a wireless sensor network as described in any one of the fourth aspects.

[0016] This application provides a lightweight encryption authentication method, apparatus, device, and storage medium for wireless sensor networks. The method is applied to a wireless sensor network consisting of user terminals, gateway nodes, and sensor nodes connected wirelessly. The method includes: a key generation and distribution phase, where the gateway node generates a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physically non-cloning function, respectively, and sends the sensor instantaneous key, user instantaneous key, preset sensor long-term key, and user long-term key to the user terminal and sensor nodes, respectively; a registration phase, where the user terminal obtains a user-generated identity identifier and user password data, and sends the user identity identifier to the gateway node to complete user registration; and the sensor nodes obtain a sensor identifier and initial sensor value, and send the sensor identifier and initial sensor value to the gateway node to complete sensor registration; and a login authentication phase, where the user terminal verifies the user's currently input identity information based on the user identity identifier and user password data, and performs mutual authentication between the user terminal, gateway node, and sensor nodes based on the identity information. The system sends the sensor hash message authentication code and the user hash message authentication code to the sensor node based on the authentication result. During the key negotiation phase, the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and the random number and timestamp generated by the gateway node. The session key is obtained based on the authentication result and then shared among the user terminal, the gateway node, and the sensor node for data exchange. It is understood that one-way hash functions are used to encrypt and hash data, ensuring the irreversibility of data. Physically unclonable functions generate unique keys based on hardware characteristics, which are difficult to copy. Therefore, this application can ensure the security of data transmission by combining instantaneous keys and long-term keys, and adopts a multi-authentication mechanism, including local verification at the user terminal and mutual authentication between the gateway node and the user terminal and sensor nodes, to ensure that only legitimate users and sensors can access the network. Furthermore, the session key negotiation based on timestamps and random numbers ensures that each communication has a new key, thereby enhancing the security of the system. In summary, through the aforementioned lightweight encryption and authentication mechanism, this application can effectively solve the security problem in wireless sensor networks and is suitable for sensor nodes with limited resources. Attached Figure Description

[0017] Figure 1 is a schematic diagram of the architecture of a wireless sensor network provided in an embodiment of this application;

[0018] Figure 2 is a flowchart of a lightweight encryption authentication method for wireless sensor networks provided in an embodiment of this application;

[0019] Figure 3 is a flowchart of a lightweight encryption authentication method for wireless sensor networks provided in an embodiment of this application;

[0020] Figure 4 is a flowchart of a lightweight encryption authentication method for wireless sensor networks provided in an embodiment of this application;

[0021] Figure 5 is a flowchart of obtaining visually associated words and image mask location information according to an embodiment of this application;

[0022] Figure 6 is a flowchart of a lightweight encryption authentication method for wireless sensor networks provided in an embodiment of this application;

[0023] Figure 7 is a flowchart of a lightweight encryption authentication method for wireless sensor networks provided in an embodiment of this application;

[0024] Figure 8 is a timing flowchart of a lightweight encryption authentication method for wireless sensor networks provided in an embodiment of this application;

[0025] Figure 9 is a timing flowchart of a lightweight encryption authentication method for wireless sensor networks provided in an embodiment of this application;

[0026] Figure 10 is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0028] In some embodiments, although functional modules are divided in the system diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the foregoing drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0029] Furthermore, unless otherwise explicitly specified and limited, the term "connection / linkage" should be interpreted broadly, for example, it can be a fixed connection or a movable connection, a detachable connection or a non-detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection or a connection that can communicate with each other; it can be a direct connection or an indirect connection through an intermediate medium.

[0030] In the description of the embodiments in this application, the terms "one embodiment / implementation," "another embodiment / implementation," or "some embodiments / implementations," "in the above embodiments / implementations," etc., refer to specific features, structures, materials, or characteristics described in conjunction with embodiments or examples that are included in at least two embodiments or implementations disclosed in this application. In this application disclosure, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or implementation. It should be noted that although a logical order is shown in the flowcharts, in some cases, the steps shown or described may be performed in a different order than that shown in the flowcharts.

[0031] Currently, with the development of Internet of Things (IoT) technology, Wireless Sensor Networks (WSNs) have been widely used in environmental monitoring, industrial automation, smart homes, and other fields as an important means of data acquisition and monitoring. However, due to the resource-constrained nature and open communication environment of wireless sensor networks, they face challenges such as data security, privacy protection, and identity authentication. Most existing wireless sensor network authentication methods rely on complex cryptographic mechanisms. Although these methods provide high security, they are computationally complex and have low efficiency on sensor nodes with limited resources, making them unsuitable for such nodes. Therefore, it is necessary to design an authentication method that can both ensure security and adapt to the resource limitations of wireless sensor networks.

[0032] Based on this, this application provides a lightweight encryption authentication method for wireless sensor networks, comprising: a gateway node generating a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physical non-cloning function, respectively, and sending the sensor instantaneous key, the user instantaneous key, a preset sensor long-term key, and the user long-term key to the user terminal and the sensor node, respectively; after the user terminal and the sensor node register, the user terminal authenticates the identity information currently entered by the user, and performs mutual authentication between the user terminal, the gateway node, and the sensor node based on the identity information, so as to send the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result, so that the sensor node and the gateway node perform key negotiation authentication to obtain a session key, and then wireless sensor network communication can be carried out based on the session key, effectively solving the security authentication problem of wireless sensor networks.

[0033] The embodiments of this application will be further described below with reference to the accompanying drawings.

[0034] Referring to Figure 1, which is a schematic diagram of the architecture of a wireless sensor network provided in an embodiment of this application, the first aspect of this application provides a lightweight encryption authentication method for a wireless sensor network. The wireless sensor network includes a user terminal, a gateway node, and sensor nodes connected in communication. It can be understood that a wireless sensor network (WSN) is a distributed network composed of multiple sensor nodes used to monitor and collect data from the environment or a specific area. A WSN includes the following three main entities: sensor node (SensorNode, S...). j These nodes are distributed within the area of ​​interest to collect data (such as environmental parameters like temperature and humidity) and send it to the central node or other nodes; Gateway Node (GWN): Acting as a bridge between sensor nodes and the external network, the gateway node is responsible for processing and forwarding data, as well as performing authentication and other security-related tasks; User End (MD) i ): This typically refers to end users or applications that want access to the data collected by sensor nodes. User U i Can be used via mobile device MD i (such as a smartphone or tablet) to access from S j The data.

[0035] In some embodiments, Figure 1 illustrates a network model for a WSN, in which the user terminal communicates with the sensor node via a mobile device. There is no direct communication between the user terminal and the sensor node; instead, communication is relayed through a gateway node. Furthermore, S j and MD i Both embed physically unclonable functions, which act as hardware-based cryptographic primitives during authentication. GWN is deployed based on some long-term master key Ψ. S and Ψ U Generate transient key pairs that are unique for each session and are derived from the master key and the preset Trivium stream cipher initial values.

[0036] Understandably, a Physically Unclonable Function (PUF) is a hardware-based cryptographic primitive that leverages the physical properties of hardware (such as minute differences in the manufacturing process) to generate unique keys or identifiers. Sensor node S j and user-side MD i Both embed a PUF for key generation during the authentication process, while the gateway node (GWN) is responsible for generating and managing transient key pairs derived from the long-term master key Ψ. S and Ψ UThe initial value is derived from the Trivium stream cipher; further, the protocol execution process corresponding to this application may include the following stages: system setup stage, in which the gateway node selects a collision-resistant one-way hash function and generates a random number (nonce) and an initialization vector (IV) to generate an instantaneous key pair; user and sensor registration stage, where users and sensor nodes need to register to participate in communication. Users generate an identity identifier (UIDi) and a password (PW) and share the identity identifier with the gateway node through a secure channel. Sensor nodes select their unique identifier (SIDj) and an initial value (IVS) and send them to the gateway node; login and authentication stage, where users enter identity information through mobile devices, the devices verify the user's identity, and perform mutual authentication with the gateway node and sensor nodes; key negotiation stage, once the user and sensor nodes are authenticated, they negotiate a session key for encrypted communication; data exchange stage, where the session key is shared among the user, gateway node, and sensor nodes to ensure the security of data transmission.

[0037] Through these steps, this application can ensure data security and privacy protection while reducing computing, energy and communication costs to suit resource-constrained wireless sensor network environments.

[0038] Referring to Figure 2, which is a flowchart of a lightweight encryption authentication method for wireless sensor networks provided in an embodiment of this application, the method includes:

[0039] In step S210, the gateway node generates a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physical non-cloning function, respectively, and sends the sensor instantaneous key, the user instantaneous key, the preset sensor long-term key, and the user long-term key to the user terminal and the sensor node, respectively.

[0040] In step S220, the user terminal obtains the user-generated user identity identifier and user password data, and sends the user identity identifier to the gateway node to complete user registration; the sensor node obtains the sensor identifier and sensor initial value, and sends the sensor identifier and sensor initial value to the gateway node to complete sensor registration.

[0041] In step S230, the user terminal verifies the identity information currently entered by the user based on the user identity identifier and user password data, and performs mutual authentication between the user terminal, the gateway node and the sensor node based on the identity information, so as to send the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result.

[0042] In step S240, the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and the random number and timestamp generated by the gateway node, so as to obtain a session key according to the authentication result; the session key is shared among the user terminal, the gateway node, and the sensor node to exchange data between the user terminal, the gateway node, and the sensor node based on the session key.

[0043] One-way hash functions are cryptographic functions used to generate fixed-length outputs (hash values) that are difficult to deduce from the original input, enabling gateway nodes to use them to generate transient keys. Physically unclonable functions (PUFs) are hardware-based cryptographic primitives that leverage minute differences in device manufacturing processes to generate unique keys or identifiers, used for generating transient keys. Sensor-based transient keys (T...) S ) and user instantaneous key (T) M The transient key is a one-time-use key used to protect the security of a specific session. Gateway nodes generate these two keys using a PUF and a one-way hash function; the long-term sensor key (Ψ) S ) and user long-term key (Ψ) U Long-term keys are pre-configured keys used to generate transient keys and remain unchanged throughout their lifecycle.

[0044] Among them, User Identity Detection (UID) i ) and user password data (PW i Generates data for users so they can register and authenticate; Sensor Identifier (SID) j ) and initial sensor value (IV) S The sensor node generates this data for registration. The sensor identifier is a unique identifier for the sensor node, while the sensor initial value is used to generate the transient key.

[0045] In some embodiments, authentication refers to the user terminal verifying the correctness of the identity information entered by the user, while mutual authentication refers to the authentication process between the user terminal, the gateway node, and the sensor node to ensure that all parties are legitimate participants. Sensor hash message authentication code. User hash message authentication code The authentication code is generated based on a hash function to ensure the integrity of the data and the authenticity of its source; the random number (R3) and timestamp (T1) are random values ​​generated by the gateway node to ensure the uniqueness of each session and prevent replay attacks; the session key (δ(c)) is a temporary key used to encrypt and decrypt data for a specific session, and the session key is determined between the sensor node and the gateway node through a key negotiation process.

[0046] In some embodiments, a key negotiation authentication process is used to negotiate a session key between the sensor node and the gateway node to ensure secure data transmission. The entire process reduces computational complexity by using lightweight encryption algorithms and hardware-based cryptographic primitives (such as PUFs) while ensuring the security of the wireless sensor network. Through these steps, the user terminal, gateway node, and sensor nodes can securely exchange data while protecting data privacy and integrity.

[0047] Understandably, this application ensures data transmission security by combining instantaneous and long-term keys, and employs a multi-factor authentication mechanism, including local authentication at the user end, mutual authentication between the gateway node and the user end and sensor nodes, ensuring that only legitimate users and sensors can access the network. Furthermore, through session key negotiation based on timestamps and random numbers, it ensures that each communication uses a new key, enhancing system security. In summary, through the aforementioned lightweight encryption and authentication mechanism, this application effectively solves the security problems in wireless sensor networks and is suitable for resource-constrained sensor nodes.

[0048] Referring to Figure 3, which is a flowchart of a lightweight encryption authentication method for a wireless sensor network according to an embodiment of this application; in some embodiments, the gateway node generates a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physical non-cloning function, respectively, including:

[0049] Step S310: Generate random one-time random numbers R1 and R2 based on the collision-resistant one-way hash function h(.);

[0050] Step S320: Use the Physically Unclonable Function (PUF) to generate challenge values ​​C1 and C2 and an initialization vector. and Based on random numbers R1 and R2, challenge values ​​C1 and C2, and initialization vector and Generate instantaneous sensing key T S and user instantaneous key T M ;in,

[0051] The collision-resistant one-way hash function h(.) possesses both one-way and collision-resistant properties. One-wayness means it is difficult to deduce the input from a given output; collision resistance means it is difficult to find two different inputs that produce the same output. This guarantees the security of the hash function. One-time random numbers R1 and R2 are used to create transient keys, which helps ensure that each generated key is unique, thereby improving security.

[0052] Among them, the challenge values ​​C1 and C2 are random values ​​generated by the PUF and used in the subsequent key generation process. They can be regarded as "questions" to the PUF, and the PUF will generate corresponding "answers" based on its internal physical properties; initialization vector and Used in encryption algorithms to ensure that even identical plaintext will not produce identical ciphertext, in the context of... and Used to add extra randomness, making the generated key more secure; Enc encryption function k () can encrypt the input using a long-term key k, which can refer to the previously mentioned sensor long-term key or user long-term key.

[0053] In some embodiments, Here, the symbol || represents the concatenation operation of data, that is, connecting multiple data segments together to form a continuous data stream. The above formula shows that this application can combine the output of PUF, initialization vector and random number to generate an instantaneous key, and use encryption function and hash function to further process it to obtain the final instantaneous key. Through the above steps, the gateway node can generate one-time sensor instantaneous key and user instantaneous key. These keys will be used in subsequent secure communication processes. Since the output of PUF is based on hardware characteristics, each sensor or user device will generate a different key, which increases the overall security of the system.

[0054] Referring to Figure 4, which is a flowchart of a lightweight encryption authentication method for a wireless sensor network according to an embodiment of this application; in some embodiments, the sensor node acquires a sensor identifier and an initial sensing value, and sends the sensor identifier and the initial sensing value to the gateway node to complete sensor registration, including:

[0055] Step S410, the sensor node acquires the sensor identifier (SID). j and initial sensor value IV S And share the sensor identifier (SID) with the gateway node via a secure channel. j and initial sensor value IV S ;

[0056] Step S420, the gateway node transmits the initial sensing value IV through the secure channel. S The parameter set formed by the long-term sensing key and the long-term user key is sent to the memory of the sensor node so that the sensor node sets the cycle counter c to 1.

[0057] In some embodiments, the sensor identifier (SID) j It is a unique identifier for the sensor node, used to uniquely identify the sensor node within the network, and the initial sensing value (IV).S This is an initial value used by sensor nodes during the registration process to generate a transient key; the secure channel is used to secure sensitive information (such as SID). j and IV S Security during transmission.

[0058] In some embodiments, the long-term sensing key is used to generate the short-term key and remains unchanged throughout the entire lifecycle; the long-term user key is used to generate the short-term key for the user terminal and remains unchanged throughout the entire lifecycle; the loop counter c: this is a counter used to track the number of authentication processes between the sensor node and the gateway node, and the value of the counter is incremented after each successful authentication.

[0059] Referring to Figure 5, which is a flowchart of a lightweight encryption authentication method for wireless sensor networks provided in an embodiment of this application; in some embodiments, the user terminal verifies the user's currently input identity information based on the user's identity identifier and user password data, including:

[0060] Step S510: The user terminal receives the user's input identity identifier (UID). i * and password PW i * ;

[0061] Step S520: If the user terminal verifies the user's input identity identifier UID i * and password PW i * User ID (UID) cached on the client side i and user password data PW i If a match is found, the user is successfully authenticated.

[0062] In step S530, if the user is successfully authenticated, the user terminal sends the identity identifier UID to the gateway node. i * .

[0063] In some embodiments, UID i * It is a user-input identifier used to uniquely identify the user within the network; the password is PW. i * This is the password data entered by the user, used to verify the user's identity. The client verifies that the user's entered identity identifier (UIDi) and password (PWi) match the user's cached identity identifier (UID). i and user password data PW i If a match is found, the user is successfully authenticated. Upon successful authentication, the user's client then sends its identity identifier (UID) to the gateway node.i * Understandably, the sensor registration process ensures that sensor nodes can securely join the network and establish the necessary trust relationship with the gateway node. The user authentication process ensures that only legitimate users can access network resources and services. By using secure channels and pre-configured long-term keys, these steps improve the security of the entire system. The use of a loop counter helps prevent replay attacks and ensures the correctness of the authentication process.

[0064] Referring to Figure 6, which is a flowchart of a lightweight encryption authentication method for a wireless sensor network according to an embodiment of this application; in some embodiments, mutual authentication is performed between the user terminal, the gateway node, and the sensor node based on identity information, so as to send the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result, including:

[0065] Step S610, the gateway node is based on the user's identity identifier (UID). i Verify identity identifier UID i * If verification is successful, a random number R3 is generated, which is then used to determine the user's identity identifier (UID). i The authentication parameter A1 = (R3||UID) is obtained. i ), and send the authentication response corresponding to A1 to the sensor node;

[0066] Step S620: Sensor node retrieves counter c and sensing instantaneous key T S and user instantaneous key T M And determine the timestamp T1 to calculate the authentication parameters. And send the authentication message corresponding to A2 to the gateway node;

[0067] In step S630, the gateway node calculates the security token based on R3 and A2. And send security token A4 to the user terminal;

[0068] Step S640: The user terminal obtains the instantaneous sensing key T corresponding to counter c. S Based on T S Verify security token A4. If verification is successful, a message containing timestamp T1 and random number R3 will be received. And send A5 to the gateway node;

[0069] Step S650: The gateway node calculates the user identification UID. i Sensor node identification SID j The authentication message B1, consisting of counter c, random number R3, and timestamp T1, is sent to the user terminal.

[0070] Step S660: The user terminal obtains the user instantaneous key T corresponding to counter c. M Based on T M Verify B1. If verification is successful, send a message containing a timestamp T1 and the user's identifier UID. i Sensor node identification SID j The authentication message B2 containing the counter c and the random number R3 is sent to the gateway node;

[0071] Step S670, the gateway node transmits the sensor hash message authentication code based on B2. User hash message authentication code Send to the sensor node.

[0072] In some embodiments, corresponding to step S610, the gateway node checks the identity identifier UID sent by the user terminal. i * Does it match a known legitimate user ID (UID)? i Once a match is found and verification is successful, the gateway node generates a random number R3 and uses the random number R3 and the user's identifier UID. i Combined into authentication parameters A1 = (R3||UID) i Thus, the gateway node sends the authentication parameter A1 to the sensor node.

[0073] In some embodiments, corresponding to step S620, the sensor node reads the current value of the loop counter c, generates the current timestamp T1, and uses the sensor node's identity identifier SID. j Counter c, timestamp T1, and user identifier UID i To construct authentication parameter A2, so that the sensor node sends authentication parameter A2 to the gateway node.

[0074] In some embodiments, corresponding to step S630, the gateway node uses the previously generated random number R3, counter c, and timestamp T1 to create a security token A4, so that the gateway node sends the security token A4 to the user terminal.

[0075] In some embodiments, corresponding to step S640, the user terminal uses the sensing instantaneous key T corresponding to the current counter c. S To verify security token A4, if the verification is successful, the client constructs message A5 and sends it to the gateway node.

[0076] In some embodiments, corresponding to step S650, the gateway node calculates a user identity identifier (UID). i Sensor node identification SID jThe authentication message B1 is generated by the gateway node using the various parameters previously used, including counter c, random number R3, and timestamp T1, and is sent to the user terminal. This allows the gateway node to construct the authentication message B1 using the previously used parameters and send the authentication message B1 to the user terminal.

[0077] In some embodiments, corresponding to step S660, the user terminal uses the user instantaneous key T corresponding to the current counter c. M To verify authentication message B1, if the verification is successful, the client constructs authentication message B2 and sends it to the gateway node.

[0078] In some embodiments, corresponding to step S670, the gateway node constructs and sends a hash message authentication code to the sensor node based on the received authentication message B2.

[0079] Understandably, the aforementioned mutual authentication process ensures secure communication between the user terminal, gateway node, and sensor node by using a random number R3, a timestamp T1, and the user's identifier UID. i and the identification ID of the sensor node j Parameters, and by using various instantaneous keys T S and T M This process verifies these parameters, providing assurance of authentication and data integrity.

[0080] Referring to Figure 7, which is a flowchart of a lightweight encryption authentication method for wireless sensor networks provided in an embodiment of this application; in some embodiments, the method further includes:

[0081] In step S710, the sensor node increments the value of counter c after each successful authentication process.

[0082] Understandably, the sensor node increments the value of counter c by 1 after each successful authentication process. The use of counter c helps prevent replay attacks and ensures the timeliness of communication.

[0083] In some embodiments, the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and a random number and timestamp generated by the gateway node, in order to obtain a session key based on the authentication result. This includes: the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, the random number R3, and the timestamp T1, so that the sensor node calculates the session key δ(c), wherein the formula for calculating the session key δ(c) is: Where B3 = h(T1||Φ(c)),

[0084] In some embodiments, the sensor node receives a sensor hash message authentication code, a user hash message authentication code, a random number, and a timestamp from the gateway node to calculate a token δ(c), which is XORed by the timestamp T1 and the random number R3. Timestamp T1, User Identifier UID i Sensor node identification SID j And a string composed of random number R3.

[0085] In this process, the sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, a random number, and a timestamp. The sensor node uses the timestamp, the random number, the user's identity identifier, and the sensor node's identity identifier to calculate the session key δ(c). The operator represents a bitwise XOR operation, which ensures that even if some information is leaked, the key remains difficult to crack. Furthermore, the hash function h(.) ensures that even slight changes to the original data will produce completely different outputs, further enhancing key security.

[0086] Understandably, the session key δ(c) is calculated based on the current timestamp and random number, which ensures that even if future session keys are leaked, past session keys cannot be deduced. Similarly, even if past session keys are leaked, future session keys cannot be deduced because each new session generates a new timestamp and random number, and since each session contains a new timestamp, old session data cannot be reused. Furthermore, the calculation of the hash message authentication code depends on the timestamp and token, which ensures message integrity and source authentication.

[0087] In summary, this method enables sensor nodes and gateway nodes to establish a secure session key δ(c) through a key negotiation and authentication process. This key is calculated based on the current timestamp, a random number, the user's identity, and the sensor node's identity. This ensures efficient and secure communication even in resource-constrained environments.

[0088] Referring to Figure 8, which is a timing flowchart of a lightweight encryption authentication method for wireless sensor networks provided in an embodiment of this application; in some embodiments, Figure 8 corresponds to the system setup phase and registration phase in this application. In the system setup phase, the application executes a setup procedure by GWN, the goal of which is to generate secure values ​​that can be deployed in the registration and authentication phases. GWN first selects h(.) as a collision-resistant one-way hash function. Next, it generates two random one-time random numbers R1 and R2. Afterward, it challenges C1 and C2 and the initialization vector using a PUF. and To derive S separately j and MD i Instantaneous key: and Finally, it will T S and T M Released to MD i and S j As shown in Figure 2. Finally, the master key is sent to S via a secure channel. j and U i .

[0089] During the registration phase, user U i Generate a unique identity UID i And the password PW i These security parameters are then cached in MD. i In memory. After that, MD i Share UID with GWN via secure channel i Similarly, sensor node S j They will also choose their unique identifier, SID. j and initial value IV S The unique identifier SID j and initial value IV S It is also shared with GWN via a secure channel. Finally, as shown in Figure 8, the parameter set {Ψ S ,Ψ U IV S} was loaded into S j In memory, sensor node S j Set the loop counter c to 1.

[0090] Referring to Figure 9, which is a timing flowchart of a lightweight encryption authentication method for wireless sensor networks provided in an embodiment of this application; in some embodiments, Figure 9 corresponds to the login and authentication phase and the key negotiation phase in this application, the purpose of which is to allow MD i For user U i Perform authentication and facilitate MD i GWN and S j Mutual verification between them. The following steps detail these login and verification procedures:

[0091] Step 1: U i To MD i Provide UID i * and PW i * Then MD i Confirm whether In addition, it will check whether This causes the login session to be abandoned upon authentication failure. Otherwise, U i It will be MD i Authentication successful. Afterwards, MD i Send the authentication message Auth1 = {UID} to GWN via the public channel. i * As shown in Figure 3.

[0092] Step 2: From MD i After obtaining message Auth1, GWN confirms whether... Basically, if authentication fails, the session is terminated. Otherwise, it generates a one-time random number R3 and derives the parameter A1 = (R3||UID). i Finally, it compiles the authentication response Auth2={A1} and forwards it to S via a public channel. j .

[0093] Step 3: After receiving the Auth2 sent by GWN, S j The retrieval counter c and the equivalent instantaneous key pair T are used. S and T M Then, it will create the current timestamp T1 and calculate the value. Finally, it compiles the message Auth3={A2} and sends it to GWN.

[0094] Step 4: Upon obtaining Auth3, GWN calculates the security token. The security token is forwarded to MD via a public channel in message Auth4={A4}. i .

[0095] Step 5: After obtaining Auth4 from GWN, MD i Retrieve the instantaneous key T corresponding to the received counter c S Using this T S It verifies the HMAC of T1 received from GWN. If verification fails, the session is terminated. Otherwise, it exports... Then it sends this message back to GWN in the message Auth5={A5}. Finally, it increments the counter c by 1.

[0096] Step 6: After obtaining Auth5, GWN calculates... Subsequently, it sends B1 to MD in message Auth6={B1}. i As shown in Figure 3.

[0097] Step 7: After obtaining Auth6 from GWN, MD i Retrieve the instantaneous key T corresponding to the received counter cM Next, it will verify T1 and UID. i and SID j The HMAC is used. If the HMAC verification is successful, it verifies the time validity of T1. Furthermore, it also verifies the validity of T1 via Ψ. U Verify user U i The identity verification process is crucial. Essentially, if any one of these verifications fails, the session will terminate. Otherwise, the procedure in step 8 will be executed.

[0098] Step 8: MD i calculate It then sends this to GWN in the message Auth7={B2}. Afterward, it increments the counter c by 1.

[0099] Furthermore, during the corresponding key negotiation phase, after GWN has already obtained the key from sensor node S... j and the user's mobile device MD i Upon receiving the hash message authentication code, this phase is executed immediately. The following steps detail these key negotiation procedures:

[0100] Step 1: Use the received hash message authentication code and GWN Export Token And B3 = h(T1||Φ(c)). Then, GWN forwards the token Φ(c) from the message Auth8 = {Φ(c), B3} to S. j .

[0101] Step 2: After obtaining Auth8, S j Establish the current timestamp T2 and verify if T2-T1≤ΔT. Here, ΔT represents the maximum allowed transmission delay. If the verification fails, it means the response was received outside the set time window, and therefore the request is marked as a replay. Otherwise, S j Independently generated tokens and parameter B3 * =h(T1||Φ * (c)). Next, by confirming whether Verify the re-exported B3 * Is it equivalent to B3 received in message Auth8? If verification fails, the authentication process terminates. Otherwise, S j GWN has been effectively verified, and MD i It can be used to access the sensed data.

[0102] Step 3: S j Increment the loop counter c by 1 and export the session key. The session key δ(c) is in S j GWN and MD i This session key is shared between them. Subsequently, it will be used to secure data exchange on the public internet.

[0103] Through the above steps, this application can share session keys among the user terminal, gateway node, and sensor node to exchange data between the user terminal, gateway node, and sensor node based on the session keys.

[0104] Furthermore, the present application provides the following embodiments to analyze and illustrate the effects of the present application.

[0105] In some embodiments, the security of the negotiated session key is verified by employing a real or random (ROR) model. Specifically, the difficulties faced by an adversary attempting to obtain the communication session key are analyzed. By simulating different attack strategies that an adversary might adopt, the effectiveness of the scheme in resisting various attacks can be demonstrated. In addition, informal security analyses are conducted, including the use of various formalized and verified theorems, which demonstrate that the scheme can resist typical WSN attacks.

[0106] In some embodiments, this scheme can be implemented on a Windows 11 operating system machine equipped with an Intel Core i5 processor, 6GB RAM, and a 2.6GHz clock speed. For Trivium stream ciphers, using the pytrivium library in Python, the results show that 11 Hash Message Authentication Code (THMAC) operations and 3 One-Way Hash (Th) operations were performed. The experimental results show that the computational cost of this scheme is only 16.04ms, which is much lower than the computational cost of other related lightweight authentication schemes. Therefore, it can be concluded that this scheme is the most suitable for this environment because sensor nodes in WSNs have limited computing resources.

[0107] In some embodiments, considering the information exchange during the login, authentication, and key negotiation phases, assuming that information Auth1={UIDi*}, Auth2={A1}, Auth3={A2}, Auth4={A4}, Auth5={A5}, Auth6={B1}, Auth7={B2}, and Auth8={Φ(c),B3} is exchanged between Sj, GWN, and MDi, the result is that the cumulative computational overhead is 1824 bits, which is far lower than the communication overhead of other related lightweight authentication schemes. It is understood that, due to the limited communication capabilities of WSN sensor nodes, this scheme is best suited for deployment in this application domain.

[0108] In some embodiments, considering the power consumption of sensor nodes and mobile devices, in a WSN environment, energy is given by the product of computational overhead and maximum processing power, where the maximum processing power is 10.88 watts. In this embodiment, the power consumption of sensor nodes and mobile devices are 142.27 mJ and 152.43 mJ, respectively, which is much lower than the power consumption of other related lightweight authentication schemes. It is understood that since most sensor nodes in a WSN are battery powered, energy resources are limited. Therefore, this scheme performs well in terms of energy consumption and is very suitable for resource-constrained wireless sensor network environments.

[0109] In summary, through the above embodiments, the effectiveness of the lightweight encryption authentication mechanism of this application has been fully verified. This solution not only provides significant security and privacy protection, but also achieves efficient computing, energy saving and communication cost reduction in resource-constrained environments. It can effectively solve security problems in wireless sensor networks and is suitable for resource-constrained sensor nodes.

[0110] To achieve the above objectives, a second aspect of this application provides a lightweight encryption authentication device for a wireless sensor network. The device includes: a system setting module, configured to control a gateway node to generate a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physical non-cloning function, respectively, and to send the sensor instantaneous key, the user instantaneous key, a preset sensor long-term key, and the user long-term key to a user terminal and a sensor node, respectively; a registration module, configured to control the user terminal to obtain a user-generated user identifier and user password data, and to send the user identifier to the gateway node to complete user registration; and a sensor node to control the sensor node to obtain a sensor identifier and a sensor initial value, and to send the sensor identifier and the sensor initial value to the gateway node to complete sensing. The system includes a registration module and a login authentication module. The login authentication module controls the user terminal to verify the user's currently entered identity information based on the user's identity identifier and password data. It also controls mutual authentication between the user terminal, gateway node, and sensor node based on this identity information. The sensor node sends a sensor hash message authentication code and a user hash message authentication code to the sensor node based on the authentication result. The key negotiation module controls the sensor node to negotiate and authenticate with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and a random number and timestamp generated by the gateway node. The session key is then shared among the user terminal, gateway node, and sensor node, enabling data exchange between them.

[0111] To achieve the above objectives, a third aspect of the present application provides an electronic device, including: at least one processor; at least one memory for storing at least one program; and, when the at least one program is executed by the at least one processor, implementing a lightweight encryption authentication method for a wireless sensor network as described in any of the first aspects.

[0112] To achieve the above objectives, a fourth aspect of the present application provides a computer-readable storage medium storing computer-executable instructions for performing a lightweight encryption authentication method for a wireless sensor network as described in any of the fourth aspects.

[0113] Some embodiments of this application provide an electronic device. FIG10 is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Referring to FIG10, the electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the lightweight encryption authentication method for wireless sensor networks of any of the above embodiments. For example, it executes the method steps S210 to S240 in FIG2, the method steps S310 to S320 in FIG3, the method steps S410 to S420 in FIG4, the method steps S510 to S530 in FIG5, the method steps S610 to S670 in FIG6, and the method step S710 in FIG7.

[0114] The electronic device 1000 of this application embodiment includes one or more processors 1010 and memory 1020. FIG10 uses one processor 1010 and one memory 1020 as an example.

[0115] The processor 1010 and the memory 1020 can be connected via a bus or other means. Figure 10 shows an example of connection via a bus.

[0116] Memory 1020, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory 1020 may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory 1020 may optionally include memory 1020 remotely located relative to processor 1010. These remote memories can be connected to electronic device 1000 via a network, and examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0117] In some embodiments, when the processor executes a computer program, it executes the lightweight encryption authentication method for wireless sensor networks according to any of the above embodiments at preset intervals.

[0118] Those skilled in the art will understand that the device structure shown in FIG10 does not constitute a limitation on the electronic device 1000, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0119] In the electronic device 1000 shown in Figure 10, the processor 1010 can be used to call the lightweight encryption authentication method for wireless sensor networks stored in the memory 1020, thereby implementing the lightweight encryption authentication method for wireless sensor networks.

[0120] Based on the hardware structure of the above-mentioned electronic device 1000, various embodiments of the lightweight encryption authentication device for wireless sensor networks of this application are proposed. Meanwhile, the non-transitory software program and instructions required to implement the lightweight encryption authentication method for wireless sensor networks of the above embodiments are stored in a memory. When executed by a processor, the lightweight encryption authentication method for wireless sensor networks of the above embodiments is executed.

[0121] This application also provides a computer-readable storage medium storing computer-executable instructions for executing the lightweight encryption authentication method for wireless sensor networks described above. These instructions enable one or more processors to execute the lightweight encryption authentication method for wireless sensor networks according to any of the above embodiments, for example, executing method steps S210 to S240 in FIG2, method steps S310 to S320 in FIG3, method steps S410 to S420 in FIG4, method steps S510 to S530 in FIG5, method steps S610 to S670 in FIG6, and method step S710 in FIG7.

[0122] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform a lightweight encryption authentication method for a wireless sensor network that implements any of the above embodiments. For example, it executes method steps S210 to S240 in FIG2, method steps S310 to S320 in FIG3, method steps S410 to S420 in FIG4, method steps S510 to S530 in FIG5, method steps S610 to S670 in FIG6, and method step S710 in FIG7.

[0123] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network nodes. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0124] Those skilled in the art will understand that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer-readable storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer-readable storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer-readable storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0125] The above is a detailed description of the preferred embodiments of this application, but this application is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.

Claims

1. A lightweight encryption authentication method for wireless sensor networks, characterized in that, The wireless sensor network includes user terminals, gateway nodes, and sensor nodes connected in communication; the method includes: The gateway node generates a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physical non-cloning function, respectively, and sends the sensor instantaneous key, the user instantaneous key, the preset sensor long-term key, and the user long-term key to the user terminal and the sensor node, respectively. The user terminal obtains the user-generated user identity identifier and user password data, and sends the user identity identifier to the gateway node to complete user registration; the sensor node obtains the sensor identifier and sensor initial value, and sends the sensor identifier and sensor initial value to the gateway node to complete sensor registration. The user terminal verifies the user's currently input identity information based on the user identity identifier and the user password data, and performs mutual authentication between the user terminal, the gateway node, and the sensor node based on the identity information, so as to send the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result; The sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and the random number and timestamp generated by the gateway node, so as to obtain the session key according to the authentication result; The session key is shared among the user terminal, the gateway node, and the sensor node to facilitate data exchange between them.

2. The lightweight encryption authentication method for wireless sensor networks according to claim 1, characterized in that, The gateway node generates sensor instantaneous keys and user instantaneous keys based on a one-way hash function and a preset physical non-cloning function, respectively, including: Generate random one-time numbers R1 and R2 based on the collision-resistant one-way hash function h(.); Use the Physically Unclonable Function (PUF) to generate challenge values ​​C1 and C2, as well as an initialization vector. and Based on random numbers R1 and R2, challenge values ​​C1 and C2, and initialization vector and Generate instantaneous sensing key T S and user instantaneous key T M ; in, 3. The lightweight encryption authentication method for wireless sensor networks according to claim 2, characterized in that, The sensor node acquires a sensor identifier and an initial sensor value, and sends the sensor identifier and the initial sensor value to the gateway node to complete sensor registration, including: The sensor node acquires the sensor identifier SID. j and initial sensor value IV S And share the sensor identifier SID with the gateway node via a secure channel. j and the initial sensing value IV S ; The gateway node transmits the initial sensing value IV via a secure channel. S The parameter set formed by the long-term sensing key and the long-term user key is sent to the memory of the sensor node so that the sensor node sets the loop counter c to 1.

4. The lightweight encryption authentication method for wireless sensor networks according to claim 3, characterized in that, The user terminal verifies the user's currently entered identity information based on the user's identity identifier and the user's password data, including: The user terminal receives the user's input identity identifier (UID). i * and password PW i * ; If the user terminal verifies the user-input identity identifier UID i * and password PW i * The user identity identifier UID cached on the user's client i If the password data PWi matches the user's password data, then the user has been successfully authenticated. If the user is successfully authenticated, the user terminal sends the identity identifier UID to the gateway node. i * .

5. The lightweight encryption authentication method for wireless sensor networks according to claim 4, characterized in that, The step of performing mutual authentication between the user terminal, the gateway node, and the sensor node based on the identity information, and sending the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result, includes: The gateway node is based on the user identity identifier (UID). i Verify the identity identifier UID i * If verification is successful, a random number R3 is generated, and the user identification ID UID is used to determine the appropriate method. i The authentication parameter A1 = (R3||UID) is obtained. i ), and send the authentication response corresponding to A1 to the sensor node; The sensor node retrieves the counter c and the sensing instantaneous key T. S and the user's instantaneous key T M and determine the time Stamp T1 is used to calculate authentication parameters. And send the authentication message corresponding to A2 to the gateway node; The gateway node calculates the security token based on R3 and A2. And send the security token A4 to the user terminal; The user terminal obtains the sensing instantaneous key T corresponding to the counter c. S Based on T S Upon successful verification of the security token A4, a message containing the timestamp T1 and the random number R3 is obtained. And send A5 to the gateway node; The gateway node calculation includes the user identity identifier (UID). i The sensor node's identification SID j The authentication message B1 consisting of the counter c, the random number R3, and the timestamp T1 is sent to the user terminal. The user terminal obtains the user instantaneous key T corresponding to the counter c. M Based on T M Verify B1. If verification is successful, send a message containing the timestamp T1 and the user identification ID (UID). i The sensor node's identification SID j The authentication message B2 containing the counter c and the random number R3 is sent to the gateway node; The gateway node uses the sensor hash message authentication code based on B2. User hash message authentication code Send to the sensor node.

6. The lightweight encryption authentication method for wireless sensor networks according to claim 5, characterized in that, The method further includes: The sensor node increments the value of the counter c after each successful authentication process.

7. The lightweight encryption authentication method for wireless sensor networks according to claim 5, characterized in that, The sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and the random number and timestamp generated by the gateway node, in order to obtain a session key according to the authentication result, including: The sensor node performs key negotiation authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, the random number R3, and the timestamp T1, so that the sensor node can calculate the session key δ(c), wherein the calculation formula of the session key δ(c) is: Where B3 = h(T1||Φ(c)), 8. A lightweight encryption authentication device for wireless sensor networks, characterized in that, The device includes: The system settings module is used to control the gateway node to generate a sensor instantaneous key and a user instantaneous key based on a one-way hash function and a preset physical non-cloning function, respectively, and to send the sensor instantaneous key, the user instantaneous key, the preset sensor long-term key, and the user long-term key to the user terminal and the sensor node, respectively. The registration module is used to control the user terminal to obtain the user-generated user identity identifier and user password data, and send the user identity identifier to the gateway node to complete user registration; and to control the sensor node to obtain the sensor identifier and sensor initial value, and send the sensor identifier and sensor initial value to the gateway node to complete sensor registration. The login authentication module is used to control the user terminal to verify the identity information currently entered by the user based on the user identity identifier and the user password data, and to perform mutual authentication between the user terminal, the gateway node and the sensor node based on the identity information, so as to send the sensor hash message authentication code and the user hash message authentication code to the sensor node according to the authentication result; The key negotiation module is used to control the sensor node to perform key negotiation and authentication with the gateway node based on the sensor hash message authentication code, the user hash message authentication code, and the random number and timestamp generated by the gateway node, so as to obtain a session key according to the authentication result; so that the session key is shared among the user terminal, the gateway node, and the sensor node, and the user terminal, the gateway node, and the sensor node exchange data based on the session key.

9. An electronic device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When at least one of the programs is executed by at least one of the processors, the lightweight encrypted authentication method for wireless sensor networks as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing computer-executable instructions for performing a lightweight encryption authentication method for a wireless sensor network as described in any one of claims 1 to 7.

Images