CN113242548A - Wireless Internet of things equipment communication key exchange method under 5G network environment - Google Patents

Wireless Internet of things equipment communication key exchange method under 5G network environment Download PDF

Info

Publication number
CN113242548A
CN113242548A CN202110777176.8A CN202110777176A CN113242548A CN 113242548 A CN113242548 A CN 113242548A CN 202110777176 A CN202110777176 A CN 202110777176A CN 113242548 A CN113242548 A CN 113242548A
Authority
CN
China
Prior art keywords
res
terminal equipment
signature
access point
signature verification
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202110777176.8A
Other languages
Chinese (zh)
Other versions
CN113242548B (en
Inventor
陈文�
周兰
康明
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Sichuan Gehou Technology Co ltd
Original Assignee
Sichuan University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Sichuan University filed Critical Sichuan University
Priority to CN202110777176.8A priority Critical patent/CN113242548B/en
Publication of CN113242548A publication Critical patent/CN113242548A/en
Application granted granted Critical
Publication of CN113242548B publication Critical patent/CN113242548B/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
    • G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
    • G16Y30/00—IoT infrastructure
    • G16Y30/10—Security thereof
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/009—Security arrangements; Authentication; Protecting privacy or anonymity specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种5G网络环境下的无线物联网设备通信密钥交换方法，包括IoT网络中准备建立保密通信的终端设备UEA和终端设备UEB，以及位于5G服务网络中的签名验证模块SA和签名验证模块SB，终端设备UEA和终端设备UEB分别通过无线接入点APA和无线接入点APB接入各自对应的服务网络中;通信密钥交换方法包括：终端设备UEA和终端设备UEB协商通信密钥；根据终端设备UEA或UEB与各自对应的无线接入点APA或APB之间的无线信道物理特征进行身份签名验证，双方通过各自所属5G服务网络中的签名验证模块SA和签名验证模块SB向无线接入点APA和无线接入点APB验证签名的有效性；本发明实现了对中间人攻击的防御以及避免对第三方CA/PKI的依赖。

Figure 202110777176

The invention discloses a communication key exchange method for wireless Internet of Things devices in a 5G network environment, including a terminal device UE A and a terminal device UE B prepared to establish secure communication in the IoT network, and a signature verification module located in the 5G service network. S A and the signature verification module S B , the terminal equipment UE A and the terminal equipment UE B respectively access their corresponding service networks through the wireless access point AP A and the wireless access point AP B ; the communication key exchange method includes: a terminal The device UE A and the terminal device UE B negotiate the communication key; the identity signature verification is performed according to the physical characteristics of the wireless channel between the terminal device UE A or UE B and the corresponding wireless access point AP A or AP B. The signature verification module S A and the signature verification module S B in the 5G service network verify the validity of the signature to the wireless access point AP A and the wireless access point AP B ; the present invention realizes the defense against man-in-the-middle attacks and avoids damage to third parties. CA/PKI dependencies.

Figure 202110777176

Description

Wireless Internet of things equipment communication key exchange method under 5G network environment
Technical Field
The invention relates to the technical field of network security, in particular to a wireless Internet of things equipment communication key exchange method under a 5G network environment.
Background
The emergence of 5G provides a more complete solution for the development of smart cities, smart medical services and smart power grids. Under the 5G network environment, the Internet of things technology (IoT) is greatly promoted, and the network realizes communication between people and objects and between the objects. Therefore, when thousands of IoT devices wirelessly access the network to communicate in the 5G network, it is important to design an efficient and secure wireless network communication key exchange method to support establishment of a reliable wireless encrypted transmission channel between any pair of IoT nodes in order to ensure confidentiality and integrity of communication data.
The conventional key exchange method has the following problems:
problem (1): dependence on a third party authoritative key distribution system, CA/PKI:
the traditional RSA Key agreement algorithm uses the digital envelope principle, the communication initiator Alice encrypts the communication Key Enc = RSA (Key, PKBob) by using the public Key PKBob of the receiver Bob and the RSA algorithm and sends it to Bob, and Bob decrypts Enc by using the private Key to obtain the communication Key. In order to avoid man-in-the-middle attacks, Alice needs to query the public key of Bob to the trusted third party CA/PKI in the above process. However, in practical applications, since the internet of things devices are large in scale and limited in device resources, many internet of things devices do not register a public key in the CA/PKI, and massive public key queries to the CA/PKI may cause network performance bottlenecks.
Problem (2): independent of CA/PKI, but vulnerable to man-in-the-middle attacks:
another widely used class of Key Exchange algorithms DHKE (Differ-Hellman Key Exchange) does not provide direct encryption or decryption, but rather uses the complexity of the "discrete logarithm problem" to negotiate keys. DHKE avoids reliance on CA/PKI, however the key exchange protocol does not verify the identity of the public key sender and cannot prevent man-in-the-middle attacks. In order to realize the defense of the DHKE against man-in-the-middle attacks, the existing improved method proposes that the private keys of two communication parties are used for signing a key agreement process, however, the process introduces a credible public key distribution process by using a third party CA/PKI, returns to the problem (1), and depends on the CA/PKI again.
Disclosure of Invention
Aiming at solving the problems in the prior art, the invention aims at 1) the key exchange of the traditional wireless Internet of things node is easy to be attacked by a man-in-the-middle; 2) the private key is required to be transmitted by relying on CA/PKI to resist man-in-the-middle attack; 3) the invention provides a wireless Internet of things device communication key exchange method under a 5G network environment, and provides a method for carrying out signature authentication on a communication key negotiated by two communication parties based on the physical channel characteristics between an IoT device and an access point on the basis of the characteristic that the wireless physical channel characteristics between the IoT device and the 5G service network access point are only sensed by an IoT terminal and the access point when key exchange is carried out under the 5G wireless Internet of things environment, so that defense against man-in-the-middle attacks is realized, and dependence on third-party CA/PKI is avoided.
In order to achieve the purpose, the invention adopts the technical scheme that: a wireless Internet of things equipment communication key exchange method under a 5G network environment comprises a terminal equipment UE which prepares to establish secret communication in an IoT networkAAnd terminal equipment UEBAnd a signature verification module S located in the 5G service networkAAnd a signature verification module SBThe terminal equipment UEAAnd terminal equipment UEBRespectively through wireless access points APAAnd a wireless access point APBThe communication key exchange method comprises the following steps:
step 1, terminal equipment UEAAnd terminal equipment UEBNegotiating a communication key;
step 2, according to the terminal equipment UEAOr UEBWith respective corresponding wireless access points APAOr APBThe wireless channel physical characteristics between the two parties carry out identity signature verification through a signature verification module S in the 5G service network to which the two parties belongAAnd a signature verification module SBTo wireless access pointsAPAAnd a wireless access point APBVerifying the validity of the signature.
As a further improvement of the present invention, the step 1 specifically comprises the following steps:
(1) one terminal device selects a generator g and a large prime number p, and sends the generator g and the large prime number p to the other terminal device;
(2) terminal equipment UEAAnd terminal equipment UEBRespectively selecting a random number X and y between 2 and p-2, namely X is more than or equal to 2 and less than or equal to p-2, y is more than or equal to 2 and less than or equal to p-2, and calculating an intermediate value X = gxmod p and Y = gy mod p；
(3) Terminal equipment UEATerminal equipment UE collected in past T secondsAWith wireless access point APAPhysical characteristic V of wireless channel therebetweenAIntermediate value X = g as signature key pairxmod p carries out signature to generate terminal equipment UEAIdentity signed MACX=f(X||VA) Terminal equipment UEBTerminal equipment UE collected in past T secondsBWith wireless access point APBPhysical characteristic V of wireless channel therebetweenBIntermediate value Y = g as signature key pairymod p carries out signature to generate terminal equipment UEBIdentity signed MACY=f(Y||VB) Where f () is a hash function, | | is a join operation;
(4) terminal equipment UEAWill negotiate the vector (X, MAC)X，TMSIA，SNAID) to the terminal equipment UEBTerminal equipment UEBWill negotiate the vector Y, MACY，TMSIB，SNBID to the terminal equipment UEA，TMSIAAnd TMSIBRespectively terminal equipment UEAAnd terminal equipment UEBAt its corresponding service network SNAAnd service network SNBTemporary identities, SN, registered inAID and SNBID is terminal equipment UE respectivelyAAnd terminal equipment UEBThe serving network ID of the location.
As a further development of the invention, in step 2 the terminal equipment UEAIdentity labelThe name verification specifically comprises the following steps:
(a) terminal equipment UEAWill receive negotiation vector Y, MACY，TMSIB，SNBID to the signature verification module SABy a signature verification module SAAccording to SNBID will authenticate request { Y, TMSIB，SNBID is forwarded to the service network SNBSignature verification module SB；
(b) Signature verification module SBChecking SNBIf the ID is the ID of the service network, if not, setting a return value ResB=‘error1', go to step (e), otherwise { Y, TMSIBForward to the wireless access point APBRequesting to calculate the TMSIBHash signatures corresponding to the terminal devices;
(c) wireless access point APBReceiving { Y, TMSIBChecking TMSIBIf the local equipment is not the local equipment registered by the access point, if not, the return value Res is setB=‘error2'go to step (d)', otherwise the terminal equipment UE collected in the past T secondsBWith wireless access point APBPhysical characteristic V of wireless channel therebetweenBSigning Y as a signing key to generate a terminal equipment UEBAuthentication signature MAC ofY'=f(Y||VB) Where f () is a hash function, | | is a join operation, the wireless access point APBSet the return value to ResB=‘MACY'’；
(d) Wireless access point APBWill ResBReturned to the signature verification module SB。
(e) Signature verification module SBWill ResBForwards to the signature verification module SA。
(f) If ResBIs' error r1'or' error2', then signature verification module SADirect return to ResBTo the terminal equipment UEAElse, signature verification module SAComparing terminal equipment UEBIdentity signed MACYAnd ResBTerminal equipment UE contained inBOf (1)Verifying signature MACY': if MACY=MACY', set ResB= OK', otherwise Res is setB= FAILED', then returns ResBTo the terminal equipment UEA。
(g) Terminal equipment UEACheck ResBIf ResBIf 'OK', then Y is calculatedxmod p, i.e. (g)y)xmod p derives the session key K1=gxymod p, otherwise, reinitiating with the terminal equipment UEBThe key agreement process of (1);
terminal equipment UEBThe identity signature verification specifically comprises the following steps:
(A) terminal equipment UEBWill receive negotiation vector { X, MACX，TMSIA，SNAID to the signature verification module SBBy a signature verification module SBAccording to SNAID will authenticate request { X, TMSIA，SNAID is forwarded to the service network SNASignature verification module SA；
(B) Signature verification module SAChecking SNAIf the ID is the ID of the service network, if not, setting a return value ResA=‘error1', go to step (E), otherwise { X, TMSIAForward to the wireless access point APARequesting to calculate the TMSIAHash signatures corresponding to the terminal devices;
(C) wireless access point APAReceiving { X, TMSIAChecking TMSIAIf the local equipment is not the local equipment registered by the access point, if not, the return value Res is setA=‘error2'go to step (D)', otherwise the terminal equipment UE collected in the past T secondsAWith wireless access point APAPhysical characteristic V of wireless channel therebetweenASigning X as a signing key to generate a terminal device UEAAuthentication identity signature MACX'=f(X||VA) Where f () is a hash function, | | is a join operation, the wireless access point APASet the return value to ResA=‘MACX'’；
(D) Wireless access point APAWill ResAReturned to the signature verification module SA。
(E) Signature verification module SAWill ResAForwards to the signature verification module SB。
(F) If ResAIs' error r1'or' error2', then signature verification module SBDirect return to ResATo the terminal equipment UEBElse, signature verification module SBComparing terminal equipment UEAIdentity signed MACXAnd ResATerminal equipment UE contained inAAuthentication signature MAC ofX': if MACX=MACX', set ResA= OK', otherwise Res is setA= FAILED', then returns ResATo the terminal equipment UEB。
(G) Terminal equipment UEBCheck ResAIf ResAIf 'OK', then calculate Xymod p, i.e. (g)x)ymod p derives the session key K2=gxymod p, otherwise, reinitiating with the terminal equipment UEBThe key agreement process of (1);
if the session key K1=K2=gxymod p, then the terminal equipment UEAAnd terminal equipment UEBTo complete the identity signature verification and key agreement process.
The invention has the beneficial effects that:
the invention utilizes the independence of wireless channels in the process of key exchange: according to the characteristic that the wireless physical channel characteristics between the IoT equipment and the 5G wireless network access point are only perceived and used by the IoT terminal and the access point, signature authentication is provided for the key exchange algorithm DHKE based on the physical channel characteristics between the IoT equipment and the service network access point, so that defense against man-in-the-middle attacks is achieved, and dependence on third-party CA/PKI is avoided. The method solves the problems that under the 5G network environment, the number of Internet of things devices is large, key registration authentication is mostly not carried out in CA/PKI, the safe key distribution is difficult to be carried out by means of the CA/PKI, and a traditional DHKE key distribution method which is separated from the CA/PKI faces man-in-the-middle attack.
Drawings
FIG. 1 is a schematic diagram of a system architecture in an embodiment of the present invention;
fig. 2 is a flowchart of key agreement and signature authentication according to an embodiment of the present invention.
Detailed Description
Embodiments of the present invention will be described in detail below with reference to the accompanying drawings.
Examples
As shown in fig. 1, a method for exchanging communication keys of wireless internet of things devices in a 5G network environment includes two terminal devices UE in an IoT network to establish secure communicationAAnd terminal equipment UEBTerminal equipment UEAAnd terminal equipment UEBThe Service Networks (SN) are respectively: SN (service provider)A，SNBService network wireless access point APAAnd a wireless access point APBSignature verification module S located in SDN (software defined network) of 5GA,SB。
Two terminal equipment UEAAnd UEBThe identity authentication of the service network access is carried out according to 5G network identity authentication protocol EAP-AKA' or 5G-AKA respectively, and the authentication is carried out through a wireless access point APAAnd APBAccessing 5G network, and recording respective service network ID SNAID,SNBID。
1. Terminal equipment UEAAnd UEBBefore formal communication, a communication key negotiation step is first performed, and a negotiation basic flow is shown in fig. 2.
1）UEASelecting a generator g and a large prime number p, and sending (g, p) to the UEB；
2) Subsequent UEASelecting a random number X between 2 and p-2, wherein X is more than or equal to 2 and less than or equal to p-2, and calculating an intermediate value X = gx mod p；
3）UEAUE acquired in past T secondsAWith wireless access point APAPhysical characteristic V of wireless channel therebetweenAAs signature key pair X = gxmod p signs to generate MACX=f(X||VA) Where f () is a hash function, | | is a join operation;
4）UEAwill negotiate the vector (X, MAC)X，TMSIA，SNAID) to the UEB，TMSIAFor the UEATemporary identities, SNs, registered in a service networkAID is UEAThe serving network ID of the location;
5）UEBselecting a random number Y between 2 and p-2, wherein Y is more than or equal to 2 and less than or equal to p-2, and calculating an intermediate value Y = gy mod p；
6）UEBUE acquired in past T secondsBWith wireless access point APBPhysical characteristic V of wireless channel therebetweenBAs signature key pair Y = gymod p signs to generate MACY=f(Y||VB) Where f () is a hash function, | | is a join operation;
7）UEBwill { Y, MACY，TMSIB，SNBID to UEA，TMSIBFor the UEBTemporary identities, SNs, registered in a service networkBID is UEBThe serving network ID of the location.
2、UEAAnd UEBStarting identity signature verification, and enabling the two parties to pass through signature verification modules S in the 5G service networks to which the two parties belongA,SBTo the wireless access point APAAnd APBThe validity of the signature is verified, and the basic flow of signature verification is shown in fig. 2:
1）UEAto receive { Y, MACY，TMSIB，SNBID to SAFrom SAAccording to SNBID will authenticate request { Y, TMSIB，SNBID is forwarded to the service network SNBSignature verification module SB；
2）SBChecking SNBWhether the ID is the ID of the service network or not, if not, the return value Res is setB=‘error1', go to step 5), otherwise { Y, TMSIBForward to the wireless access point APBRequesting to calculate the TMSIBHash signatures of corresponding terminals;
3）APBreceiving { Y, TMSIBChecking TMSIBIf the local equipment is not the local equipment registered by the access point, if not, the return value Res is setB=‘error2', go to step 4), otherwise, the UE acquired in the past T secondsBAnd APBPhysical characteristic V of wireless channel therebetweenBSigning Y as a signing key to generate a MACY'=f(Y||VB) Where f () is a hash function, | | | is a join operation, APBSet the return value to ResB=‘MACY'’；
4）APBWill ResBIs returned to SB；
5）SBWill ResBForward to SA；
6) If ResBIs' error r1'or' error2', then SADirect return to ResBTo UEAElse SAComparing MACsYAnd ResBMAC contained inY': if MACY=MACY', set ResB= OK', otherwise Res is setB= FAILED', then returns ResBTo UEA；
7）UEACheck ResBIf ResBIf 'OK', then Y is calculatedxmod p derives the session key K1=gxymod p, otherwise, re-initiating the key agreement process with B;
8）UEBsignature verification procedure and UEASimilarly, if S is the finalBReturned to the UEBRes ofAIf 'OK', then calculate Xymod p derives the session key K2=gxy mod p。
As can be seen from the key agreement and signature verification process, if the UE is in use, the UE will perform the key agreement and signature verification processA，UEBAll the identities are true identities, the same communication key K can be generated finally1=K2=gxymod p; on the contrary, as shown in fig. 1, there is an illegal user UECIntention to implement man-in-the-middle attacks due to stealing of the channel from the UEA，UEBWith wireless access point APAAnd APBPhysical independence of legitimate channels between, UECThe channel state eigenvector V cannot be obtainedA,VB(ii) a And the UECStealing channel communication characteristic VCAnd VA,VBDifferent from each other, f (Y | | | V) cannot be utilizedC) And f (X | | V)C) Impersonating UEAOr UEBAnd passing signature verification.
The invention utilizes the characteristics that the 5G network has high communication speed, the wireless physical channel characteristics between the IoT terminal and the access point are kept stable in a full-duplex communication period, and the channel characteristics are only sensed by the terminal and the access point to carry out the identity authentication of the communicator. Preferably, the selectable physical channel characteristics associated with the wireless physical channel are: channel GAIN (GAIN), Received Signal Strength (RSSI), Channel State Information (CSI): amplitude, phase, carrier Frequency (FRE), Channel Impulse Response (CIR), Channel Frequency Response (CFR), received signal envelope (Env), Bit Error Rate (BER), all may be collected by physical layer signal analysis. In a particular embodiment, one or a combination of features may be selected based on the IoT terminal class, network environment, and the like.
The above-mentioned embodiments only express the specific embodiments of the present invention, and the description thereof is more specific and detailed, but not construed as limiting the scope of the present invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the inventive concept, which falls within the scope of the present invention.

Claims (3)

1.一种5G网络环境下的无线物联网设备通信密钥交换方法，其特征在于，包括IoT网络中准备建立保密通信的终端设备UEA和终端设备UEB，以及位于5G服务网络中的签名验证模块SA和签名验证模块SB，所述终端设备UEA和终端设备UEB分别通过无线接入点APA和无线接入点APB接入各自对应的服务网络中;所述的通信密钥交换方法包括以下步骤：1. a wireless Internet of Things device communication key exchange method under 5G network environment, is characterized in that, comprises terminal equipment UE A and terminal equipment UE B that are prepared to establish confidential communication in IoT network, and the signature located in 5G service network The verification module S A and the signature verification module S B , the terminal equipment UE A and the terminal equipment UE B access the respective corresponding service networks through the wireless access point AP A and the wireless access point AP B respectively; the communication The key exchange method includes the following steps: 步骤1、终端设备UEA和终端设备UEB协商通信密钥；Step 1. The terminal equipment UE A and the terminal equipment UE B negotiate a communication key; 步骤2、根据终端设备UEA或UEB与各自对应的无线接入点APA或APB之间的无线信道物理特征进行身份签名验证，双方通过各自所属5G服务网络中的签名验证模块SA和签名验证模块SB向无线接入点APA和无线接入点APB验证签名的有效性。Step 2. Perform identity signature verification according to the physical characteristics of the wireless channel between the terminal equipment UE A or UE B and the corresponding wireless access point AP A or AP B. Both parties pass the signature verification module S A in the 5G service network to which they belong. And the signature verification module S B verifies the validity of the signature to the wireless access point AP A and the wireless access point AP B. 2.根据权利要求1所述的5G网络环境下的无线物联网设备通信密钥交换方法，其特征在于，所述步骤1具体包括以下步骤：2. The method for exchanging keys for wireless Internet of Things device communication in a 5G network environment according to claim 1, wherein the step 1 specifically comprises the following steps: （1）其中一个终端设备选取一个生成元g和一个大素数p，发送(g,p)给另外一个终端设备；(1) One of the terminal devices selects a generator g and a large prime number p, and sends (g, p) to another terminal device; （2）终端设备UEA和终端设备UEB分别选取介于2到p-2之间的一个随机数x和y，即2≤x≤p-2，2≤y≤p-2，计算中间值X=gx mod p和Y=gy mod p；(2) The terminal equipment UE A and the terminal equipment UE B select a random number x and y between 2 and p-2, that is, 2≤x≤p-2, 2≤y≤p-2, and calculate the middle Values X=g x mod p and Y=g y mod p; （3）终端设备UEA以过去T秒内采集到的终端设备UEA与无线接入点APA之间的无线信道物理特征VA作为签名密钥对中间值X=gx mod p进行签名，生成终端设备UEA的身份签名MACX=f(X||VA)，终端设备UEB以过去T秒内采集到的终端设备UEB与无线接入点APB之间的无线信道物理特征VB作为签名密钥对中间值Y=gy mod p进行签名，生成终端设备UEB的身份签名MACY=f(Y||VB)，其中f()为哈希散列函数，||为连接操作；(3) The terminal device UE A uses the wireless channel physical feature VA between the terminal device UE A and the wireless access point AP A collected in the past T seconds as the signature key to sign the intermediate value X=g x mod p , to generate the identity signature MAC X =f(X||V A ) of the terminal device UE A , and the terminal device UE B uses the physical data of the wireless channel between the terminal device UE B and the wireless access point AP B collected in the past T seconds. The feature V B is used as the signature key to sign the intermediate value Y=g y mod p, and the identity signature MAC Y =f(Y||V B ) of the terminal device UE B is generated, where f() is a hash function, || is the connection operation; （4）终端设备UEA将协商向量(X，MACX，TMSIA，SNAID)传给终端设备UEB，终端设备UEB将协商向量{Y，MACY，TMSIB，SNBID}传给终端设备UEA，TMSIA和TMSIB分别为终端设备UEA和终端设备UEB在其对应的服务网络SNA和服务网络SNB中注册的临时身份标识，SNAID和SNBID分别为终端设备UEA和终端设备UEB所在的服务网络ID。(4) The terminal equipment UE A transmits the negotiation vector (X, MAC X , TMSI A , SN A ID) to the terminal equipment UE B , and the terminal equipment UE B transmits the negotiation vector {Y, MAC Y , TMSI B , SN B ID} To the terminal equipment UE A , TMSI A and TMSI B are the temporary identities registered by the terminal equipment UE A and the terminal equipment UE B in their corresponding service network SN A and service network SN B respectively, SNA ID and SN B ID are the service network IDs where the terminal equipment UE A and the terminal equipment UE B are located respectively. 3.根据权利要求2所述的5G网络环境下的无线物联网设备通信密钥交换方法，其特征在于，在步骤2中，终端设备UEA的身份签名验证具体包括以下步骤：3. The wireless Internet of Things device communication key exchange method under 5G network environment according to claim 2, is characterized in that, in step 2, the identity signature verification of terminal equipment UE A specifically comprises the following steps: （a）终端设备UEA将收到的协商向量{Y，MACY，TMSIB，SNBID}传给签名验证模块SA，由签名验证模块SA根据SNBID将验证请求{Y，TMSIB，SNBID}转发给服务网络SNB的签名验证模块SB；(a) The terminal device UE A transmits the received negotiation vector {Y, MAC Y , TMSI B , SN B ID} to the signature verification module S A , and the signature verification module S A will verify the request {Y, TMSI B , SN B ID} is forwarded to the signature verification module SB of the service network SN B ; （b）签名验证模块SB检查SNBID是否是本服务网络的ID，若不是，则设置返回值ResB=‘error1’，转步骤（e），否则将{Y，TMSIB}转发给无线接入点APB，请求计算TMSIB对应终端设备的哈希签名；(b) The signature verification module SB checks whether the SN B ID is the ID of the service network, if not, set the return value Res B = 'error 1 ', and go to step (e), otherwise it will forward {Y, TMSI B } To the wireless access point AP B , request to calculate the hash signature of the terminal device corresponding to TMSI B ; （c）无线接入点APB接收到{Y，TMSIB}检查TMSIB是否为本接入点注册的本地设备，若不是设置返回值ResB=‘error2’，转步骤（d）;否则以过去T秒内采集到的终端设备UEB与无线接入点APB之间的无线信道物理特征VB作为签名密钥对Y进行签名，生成终端设备UEB的身份验证签名MACY'=f(Y||VB)，其中f()为哈希散列函数，||为连接操作,无线接入点APB设置返回值为ResB=‘MACY'’；(c) The wireless access point AP B receives {Y, TMSI B } and checks whether TMSI B is a local device registered by this access point. If it is not, set the return value Res B = 'error 2 ', go to step (d); Otherwise, use the wireless channel physical feature V B between the terminal equipment UE B and the wireless access point AP B collected in the past T seconds as the signature key to sign Y, and generate the identity verification signature MAC Y ' of the terminal equipment UE B. =f(Y||V B ), where f() is the hash function, || is the connection operation, and the wireless access point AP B sets the return value to Res B ='MAC Y ''; （d）无线接入点APB将ResB返回给签名验证模块SB；(d) The wireless access point AP B returns Res B to the signature verification module S B ; （e）签名验证模块SB将ResB转发给签名验证模块SA；(e) The signature verification module S B forwards Res B to the signature verification module S A ; （f）若ResB为‘error1’或‘error2’，则签名验证模块SA直接返回ResB给终端设备UEA，否则签名验证模块SA比较终端设备UEB的身份签名MACY与ResB中包含的终端设备UEB的身份验证签名MACY'：若MACY=MACY'，设置ResB=‘OK’,否则设置ResB=‘FAILED’，随后返回ResB给终端设备UEA；(f) If Res B is 'error 1 ' or 'error 2 ', the signature verification module S A directly returns Res B to the terminal device UE A , otherwise the signature verification module S A compares the identity signature MAC Y of the terminal device UE B with The authentication signature MAC Y ' of the terminal device UE B contained in Res B : if MAC Y =MAC Y ', set Res B ='OK', otherwise set Res B ='FAILED', then return Res B to the terminal device UE A ; （g）终端设备UEA检查ResB的返回结果，若ResB为‘OK’，则计算Yx mod p，即（gy)x mod p得到会话密钥K1=gxymod p，否则重新发起与终端设备UEB的密钥协商过程；(g) The terminal device UE A checks the return result of Res B. If Res B is 'OK', calculate Y x mod p, that is, (g y ) x mod p to obtain the session key K 1 =g xy mod p, otherwise Re-initiate the key negotiation process with the terminal device UE B ; 终端设备UEB的身份签名验证具体包括以下步骤：The identity signature verification of the terminal device UE B specifically includes the following steps: （A）终端设备UEB将收到的协商向量{X，MACX，TMSIA，SNAID}传给签名验证模块SB，由签名验证模块SB根据SNAID将验证请求{X，TMSIA，SNAID}转发给服务网络SNA的签名验证模块SA；(A) The terminal device UE B transmits the received negotiation vector {X, MAC X , TMSI A , SNA ID} to the signature verification module S B , and the signature verification module S B will verify the request {X, TMSI A , SNA ID} is forwarded to the signature verification module S A of the serving network SNA ; （B）签名验证模块SA检查SNAID是否是本服务网络的ID，若不是，则设置返回值ResA=‘error1’，转步骤（E），否则将{X，TMSIA}转发给无线接入点APA，请求计算TMSIA对应终端设备的哈希签名；(B) The signature verification module S A checks whether the SN A ID is the ID of the service network, if not, set the return value Res A = 'error 1 ', and go to step (E), otherwise it will forward {X, TMSI A } To the wireless access point AP A , request to calculate the hash signature of the terminal device corresponding to TMSI A ; （C）无线接入点APA接收到{X，TMSIA}检查TMSIA是否为本接入点注册的本地设备，若不是设置返回值ResA=‘error2’，转步骤（D）;否则以过去T秒内采集到的终端设备UEA与无线接入点APA之间的无线信道物理特征VA作为签名密钥对X进行签名，生成终端设备UEA的身份验证签名MACX'=f(X||VA)，其中f()为哈希散列函数，||为连接操作,无线接入点APA设置返回值为ResA=‘MACX'’；(C) The wireless access point AP A receives {X, TMSI A } and checks whether TMSI A is a local device registered by this access point. If not, set the return value Res A = 'error 2 ', go to step (D); Otherwise, use the wireless channel physical feature VA between the terminal equipment UE A and the wireless access point AP A collected in the past T seconds as the signature key to sign X, and generate the identity verification signature MAC X ' of the terminal equipment UE A. =f(X||V A ), where f() is the hash function, || is the connection operation, the wireless access point AP A sets the return value to Res A ='MAC X ''; （D）无线接入点APA将ResA返回给签名验证模块SA；(D) The wireless access point AP A returns Res A to the signature verification module S A ; （E）签名验证模块SA将ResA转发给签名验证模块SB；(E) The signature verification module S A forwards Res A to the signature verification module S B ; （F）若ResA为‘error1’或‘error2’，则签名验证模块SB直接返回ResA给终端设备UEB，否则签名验证模块SB比较终端设备UEA的身份签名MACX与ResA中包含的终端设备UEA的身份验证签名MACX'：若MACX=MACX'，设置ResA=‘OK’,否则设置ResA=‘FAILED’，随后返回ResA给终端设备UEB；(F) If Res A is 'error 1 ' or 'error 2 ', the signature verification module S B directly returns Res A to the terminal device UE B , otherwise the signature verification module S B compares the identity signature MAC X of the terminal device UE A with the The authentication signature MAC X ' of the terminal equipment UE A contained in Res A : if MAC X =MAC X ', set Res A ='OK', otherwise set Res A ='FAILED', then return Res A to the terminal equipment UE B ; （G）终端设备UEB检查ResA的返回结果，若ResA为‘OK’，则计算Xy mod p,即（gx)y mod p得到会话密钥K2=gxy mod p，否则重新发起与终端设备UEB的密钥协商过程；(G) The terminal device UE B checks the return result of Res A. If Res A is 'OK', calculate X y mod p, that is (g x ) y mod p to obtain the session key K 2 =g xy mod p, otherwise Re-initiate the key negotiation process with the terminal device UE B ; 若会话密钥K1=K2=gxy mod p，则终端设备UEA和终端设备UEB的完成身份签名验证和密钥协商过程。If the session key K 1 =K 2 =g xy mod p, the terminal equipment UE A and the terminal equipment UE B complete the identity signature verification and key negotiation process.
CN202110777176.8A 2021-07-09 2021-07-09 Wireless Internet of things equipment communication key exchange method under 5G network environment Expired - Fee Related CN113242548B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110777176.8A CN113242548B (en) 2021-07-09 2021-07-09 Wireless Internet of things equipment communication key exchange method under 5G network environment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110777176.8A CN113242548B (en) 2021-07-09 2021-07-09 Wireless Internet of things equipment communication key exchange method under 5G network environment

Publications (2)

Publication Number Publication Date
CN113242548A true CN113242548A (en) 2021-08-10
CN113242548B CN113242548B (en) 2021-09-17

Family

ID=77135227

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110777176.8A Expired - Fee Related CN113242548B (en) 2021-07-09 2021-07-09 Wireless Internet of things equipment communication key exchange method under 5G network environment

Country Status (1)

Country Link
CN (1) CN113242548B (en)

Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106130724A (en) * 2016-08-26 2016-11-16 浪潮集团有限公司 Internet of things terminal security implementation method adopting key agreement
WO2017160394A1 (en) * 2016-03-15 2017-09-21 Intel Corporation System, apparatus and method for key provisioning delegation
CN107710216A (en) * 2015-07-03 2018-02-16 阿费罗有限公司 Apparatus and method for establishing a secure communication channel in an Internet of Things (IoT) system
CN108966232A (en) * 2018-09-28 2018-12-07 深圳大学 Wireless internet of things physical layer hybrid authentication method and system based on service network
CN109068284A (en) * 2018-09-28 2018-12-21 深圳大学 The physical layer authentication method and system connected based on group between internet of things equipment
CN109348477A (en) * 2018-09-28 2019-02-15 深圳大学 Physical layer authentication method for wireless Internet of things based on service network
CN109831933A (en) * 2016-08-10 2019-05-31 交互数字专利控股公司 Methods, devices and systems for power efficient D2D communication for wearable and IoT devices
CN111541776A (en) * 2020-05-09 2020-08-14 朗明智诚科技股份有限公司 Safe communication device and system based on Internet of things equipment
CN112911588A (en) * 2021-02-04 2021-06-04 郑州信大捷安信息技术股份有限公司 Lightweight narrowband Internet of things secure transmission method and system
CN113037467A (en) * 2021-05-24 2021-06-25 杭州海康威视数字技术股份有限公司 Video Internet of things equipment key certificate management method, device and system

Patent Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107710216A (en) * 2015-07-03 2018-02-16 阿费罗有限公司 Apparatus and method for establishing a secure communication channel in an Internet of Things (IoT) system
WO2017160394A1 (en) * 2016-03-15 2017-09-21 Intel Corporation System, apparatus and method for key provisioning delegation
CN109479049A (en) * 2016-03-15 2019-03-15 英特尔公司 System, apparatus and method for key supply commission
CN109831933A (en) * 2016-08-10 2019-05-31 交互数字专利控股公司 Methods, devices and systems for power efficient D2D communication for wearable and IoT devices
CN106130724A (en) * 2016-08-26 2016-11-16 浪潮集团有限公司 Internet of things terminal security implementation method adopting key agreement
CN108966232A (en) * 2018-09-28 2018-12-07 深圳大学 Wireless internet of things physical layer hybrid authentication method and system based on service network
CN109068284A (en) * 2018-09-28 2018-12-21 深圳大学 The physical layer authentication method and system connected based on group between internet of things equipment
CN109348477A (en) * 2018-09-28 2019-02-15 深圳大学 Physical layer authentication method for wireless Internet of things based on service network
CN111541776A (en) * 2020-05-09 2020-08-14 朗明智诚科技股份有限公司 Safe communication device and system based on Internet of things equipment
CN112911588A (en) * 2021-02-04 2021-06-04 郑州信大捷安信息技术股份有限公司 Lightweight narrowband Internet of things secure transmission method and system
CN113037467A (en) * 2021-05-24 2021-06-25 杭州海康威视数字技术股份有限公司 Video Internet of things equipment key certificate management method, device and system

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
程贤兵: "5G网络中D2D安全动态群组认证和密钥协商协议", 《东南大学学报(自然科学版)》 *

Also Published As

Publication number Publication date
CN113242548B (en) 2021-09-17

Similar Documents

Publication Publication Date Title
Cao et al. Fast authentication and data transfer scheme for massive NB-IoT devices in 3GPP 5G network
CN116707791B (en) Distributed authentication key negotiation method in intelligent vehicle-mounted networking system
EP2416524B1 (en) System and method for secure transaction of data between wireless communication device and server
CN108667616B (en) Identity-based cross-cloud security authentication system and method
CN104639329B (en) User identity inter-authentication method based on Elliptic Codes
CN101902476B (en) Method for authenticating identity of mobile peer-to-peer user
CN112165386B (en) Data encryption method and system based on ECDSA
WO2010078755A1 (en) Method and system for transmitting electronic mail, wlan authentication and privacy infrastructure (wapi) terminal thereof
CN109756877A (en) A kind of anti-quantum rapid authentication and data transmission method of magnanimity NB-IoT equipment
CN112039660B (en) Internet of things node group identity security authentication method
CN101494862A (en) Access authentication method of wireless mesh network
CN105075175A (en) Method and device for establishing session key
Son et al. A zero-trust authentication scheme with access control for 6g-enabled iot environments
CN110020524A (en) A kind of mutual authentication method based on smart card
CN111654481B (en) Identity authentication method, identity authentication device and storage medium
CN113411801A (en) Mobile terminal authentication method based on identity signcryption
Xu et al. Anti-quantum certificateless group authentication for massive accessing IoT devices
CN112333705A (en) Identity authentication method and system for 5G communication network
CN116436640A (en) A lightweight terminal cross-domain authentication method for edge computing
CN116388995A (en) A lightweight smart grid authentication method based on PUF
CN120528614A (en) Cloud-edge collaborative multi-factor identity authentication method and system for ubiquitous networks
CN119232352A (en) Blockchain-assisted multi-server authentication method and system based on quantum key
Nyangaresi et al. Message verification protocol based on bilinear pairings and elliptic curves for enhanced security in vehicular ad hoc networks
WO2007028328A1 (en) Method, system and device for negotiating about cipher key shared by ue and external equipment
CN112533213A (en) Key negotiation method, device, terminal and storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
TR01 Transfer of patent right

Effective date of registration: 20220401

Address after: 610000 No. 210, second floor, No. 115, Section 1, Jinhua Road, Jinjiang District, Chengdu, Sichuan Province (self numbering)

Patentee after: Sichuan gehou Technology Co.,Ltd.

Address before: 610000, No. 24, south section of Ring Road, Sichuan, Chengdu

Patentee before: SICHUAN University

TR01 Transfer of patent right
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20210917

CF01 Termination of patent right due to non-payment of annual fee