CN113242548B - Wireless Internet of things equipment communication key exchange method under 5G network environment - Google Patents

Wireless Internet of things equipment communication key exchange method under 5G network environment Download PDF

Info

Publication number
CN113242548B
CN113242548B CN202110777176.8A CN202110777176A CN113242548B CN 113242548 B CN113242548 B CN 113242548B CN 202110777176 A CN202110777176 A CN 202110777176A CN 113242548 B CN113242548 B CN 113242548B
Authority
CN
China
Prior art keywords
terminal equipment
res
signature verification
access point
verification module
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
CN202110777176.8A
Other languages
Chinese (zh)
Other versions
CN113242548A (en
Inventor
陈文�
周兰
康明
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Sichuan Gehou Technology Co ltd
Original Assignee
Sichuan University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Sichuan University filed Critical Sichuan University
Priority to CN202110777176.8A priority Critical patent/CN113242548B/en
Publication of CN113242548A publication Critical patent/CN113242548A/en
Application granted granted Critical
Publication of CN113242548B publication Critical patent/CN113242548B/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
    • G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
    • G16Y30/00—IoT infrastructure
    • G16Y30/10—Security thereof
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/009—Security arrangements; Authentication; Protecting privacy or anonymity specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种5G网络环境下的无线物联网设备通信密钥交换方法，包括IoT网络中准备建立保密通信的终端设备UEA和终端设备UEB，以及位于5G服务网络中的签名验证模块SA和签名验证模块SB，终端设备UEA和终端设备UEB分别通过无线接入点APA和无线接入点APB接入各自对应的服务网络中;通信密钥交换方法包括：终端设备UEA和终端设备UEB协商通信密钥；根据终端设备UEA或UEB与各自对应的无线接入点APA或APB之间的无线信道物理特征进行身份签名验证，双方通过各自所属5G服务网络中的签名验证模块SA和签名验证模块SB向无线接入点APA和无线接入点APB验证签名的有效性；本发明实现了对中间人攻击的防御以及避免对第三方CA/PKI的依赖。

Figure 202110777176

The invention discloses a communication key exchange method for wireless Internet of Things devices in a 5G network environment, including a terminal device UE A and a terminal device UE B prepared to establish secure communication in the IoT network, and a signature verification module located in the 5G service network. S A and the signature verification module S B , the terminal equipment UE A and the terminal equipment UE B respectively access their corresponding service networks through the wireless access point AP A and the wireless access point AP B ; the communication key exchange method includes: a terminal The device UE A and the terminal device UE B negotiate the communication key; the identity signature verification is performed according to the physical characteristics of the wireless channel between the terminal device UE A or UE B and the corresponding wireless access point AP A or AP B. The signature verification module S A and the signature verification module S B in the 5G service network verify the validity of the signature to the wireless access point AP A and the wireless access point AP B ; the present invention realizes the defense against man-in-the-middle attacks and avoids damage to third parties. CA/PKI dependencies.

Figure 202110777176

Description

Wireless Internet of things equipment communication key exchange method under 5G network environment
Technical Field
The invention relates to the technical field of network security, in particular to a wireless Internet of things equipment communication key exchange method under a 5G network environment.
Background
The emergence of 5G provides a more complete solution for the development of smart cities, smart medical services and smart power grids. Under the 5G network environment, the Internet of things technology (IoT) is greatly promoted, and the network realizes communication between people and objects and between the objects. Therefore, when thousands of IoT devices wirelessly access the network to communicate in the 5G network, it is important to design an efficient and secure wireless network communication key exchange method to support establishment of a reliable wireless encrypted transmission channel between any pair of IoT nodes in order to ensure confidentiality and integrity of communication data.
The conventional key exchange method has the following problems:
problem (1): dependence on a third party authoritative key distribution system, CA/PKI:
the traditional RSA Key agreement algorithm uses the digital envelope principle, the communication initiator Alice encrypts the communication Key Enc = RSA (Key, PKBob) by using the public Key PKBob of the receiver Bob and the RSA algorithm and sends it to Bob, and Bob decrypts Enc by using the private Key to obtain the communication Key. In order to avoid man-in-the-middle attacks, Alice needs to query the public key of Bob to the trusted third party CA/PKI in the above process. However, in practical applications, since the internet of things devices are large in scale and limited in device resources, many internet of things devices do not register a public key in the CA/PKI, and massive public key queries to the CA/PKI may cause network performance bottlenecks.
Problem (2): independent of CA/PKI, but vulnerable to man-in-the-middle attacks:
another widely used class of Key Exchange algorithms DHKE (Differ-Hellman Key Exchange) does not provide direct encryption or decryption, but rather uses the complexity of the "discrete logarithm problem" to negotiate keys. DHKE avoids reliance on CA/PKI, however the key exchange protocol does not verify the identity of the public key sender and cannot prevent man-in-the-middle attacks. In order to realize the defense of the DHKE against man-in-the-middle attacks, the existing improved method proposes that the private keys of two communication parties are used for signing a key agreement process, however, the process introduces a credible public key distribution process by using a third party CA/PKI, returns to the problem (1), and depends on the CA/PKI again.
Disclosure of Invention
Aiming at solving the problems in the prior art, the invention aims at 1) the key exchange of the traditional wireless Internet of things node is easy to be attacked by a man-in-the-middle; 2) the private key is required to be transmitted by relying on CA/PKI to resist man-in-the-middle attack; 3) the invention provides a wireless Internet of things device communication key exchange method under a 5G network environment, and provides a method for carrying out signature authentication on a communication key negotiated by two communication parties based on the physical channel characteristics between an IoT device and an access point on the basis of the characteristic that the wireless physical channel characteristics between the IoT device and the 5G service network access point are only sensed by an IoT terminal and the access point when key exchange is carried out under the 5G wireless Internet of things environment, so that defense against man-in-the-middle attacks is realized, and dependence on third-party CA/PKI is avoided.
In order to achieve the purpose, the invention adopts the technical scheme that: a wireless Internet of things equipment communication key exchange method under a 5G network environment comprises a terminal equipment UE which prepares to establish secret communication in an IoT networkAAnd terminal equipment UEBAnd a signature verification module S located in the 5G service networkAAnd a signature verification module SBThe terminal equipment UEAAnd terminal equipment UEBRespectively through wireless access points APAAnd a wireless access point APBThe communication key exchange method comprises the following steps:
step 1, terminal equipment UEAAnd terminal equipment UEBNegotiating a communication key;
step 2, according to the terminal equipment UEAOr UEBWith respective corresponding wireless access points APAOr APBThe wireless channel physical characteristics between the two parties carry out identity signature verification through a signature verification module S in the 5G service network to which the two parties belongAAnd a signature verification module SBTo the wireless access point APAAnd a wireless access point APBVerifying the validity of the signature.
As a further improvement of the present invention, the step 1 specifically comprises the following steps:
(1) one terminal device selects a generator g and a large prime number p, and sends the generator g and the large prime number p to the other terminal device;
(2) terminal equipment UEAAnd terminal equipment UEBRespectively selecting a random number X and y between 2 and p-2, namely X is more than or equal to 2 and less than or equal to p-2, y is more than or equal to 2 and less than or equal to p-2, and calculating an intermediate value X = gxmod p and Y = gy mod p；
(3) Terminal equipment UEATerminal equipment UE collected in past T secondsAWith wireless access point APAPhysical characteristic V of wireless channel therebetweenAIntermediate value X = g as signature key pairxmod p carries out signature to generate terminal equipment UEAIdentity signed MACX=f(X||VA) Terminal equipment UEBTerminal equipment UE collected in past T secondsBWith wireless access point APBPhysical characteristic V of wireless channel therebetweenBIntermediate value Y = g as signature key pairymod p carries out signature to generate terminal equipment UEBIdentity signed MACY=f(Y||VB) Where f () is a hash function, | | is a join operation;
(4) terminal equipment UEAWill negotiate the vector (X, MAC)X，TMSIA，SNAID) to the terminal equipment UEBTerminal equipment UEBWill negotiate the vector Y, MACY，TMSIB，SNBID to the terminal equipment UEA，TMSIAAnd TMSIBRespectively terminal equipment UEAAnd terminal equipment UEBAt its corresponding service network SNAAnd service network SNBTemporary identities, SN, registered inAID and SNBID is terminal equipment UE respectivelyAAnd terminal equipment UEBThe serving network ID of the location.
As a further development of the invention, in step 2 the terminal equipment UEAThe identity signature verification specifically comprises the following steps:
(a) terminal equipment UEAWill receive negotiation vector Y, MACY，TMSIB，SNBID to the signature verification module SABy a signature verification module SAAccording to SNBID will authenticate request { Y, TMSIB，SNBID is forwarded to the service network SNBSignature verification module SB；
(b) Signature verification module SBChecking SNBIf the ID is the ID of the service network, if not, setting a return value ResB=‘error1', go to step (e), otherwise { Y, TMSIBForward to the wireless access point APBRequesting to calculate the TMSIBHash signatures corresponding to the terminal devices;
(c) wireless access point APBReceiving { Y, TMSIBChecking TMSIBIf the local equipment is not the local equipment registered by the access point, if not, the return value Res is setB=‘error2'go to step (d)', otherwise the terminal equipment UE collected in the past T secondsBWith wireless access point APBPhysical characteristic V of wireless channel therebetweenBSigning Y as a signing key to generate a terminal equipment UEBAuthentication signature MAC ofY'=f(Y||VB) Where f () is a hash function, | | is a join operation, the wireless access point APBSet the return value to ResB=‘MACY'’；
(d) Wireless access point APBWill ResBReturned to the signature verification module SB。
(e) Signature verification module SBWill ResBForwards to the signature verification module SA。
(f) If ResBIs' error r1'or' error2', then signature verification module SADirect return to ResBTo the terminal equipment UEAElse, signature verification module SAComparing terminal equipment UEBIdentity signed MACYAnd ResBTerminal equipment UE contained inBAuthentication identity signature MACY': if MACY=MACY', set ResB= OK', otherwise Res is setB= FAILED', then returns ResBTo the terminal equipment UEA。
(g) Terminal equipment UEACheck ResBIf ResBIf 'OK', then Y is calculatedxmod p, i.e. (g)y)xmod p derives the session key K1=gxymod p, otherwise, reinitiating with the terminal equipment UEBThe key agreement process of (1);
terminal equipment UEBThe identity signature verification specifically comprises the following steps:
(A) terminal equipment UEBWill receive negotiation vector { X, MACX，TMSIA，SNAID to the signature verification module SBBy a signature verification module SBAccording to SNAID will authenticate request { X, TMSIA，SNAID forward to service networkComplex SNASignature verification module SA；
(B) Signature verification module SAChecking SNAIf the ID is the ID of the service network, if not, setting a return value ResA=‘error1', go to step (E), otherwise { X, TMSIAForward to the wireless access point APARequesting to calculate the TMSIAHash signatures corresponding to the terminal devices;
(C) wireless access point APAReceiving { X, TMSIAChecking TMSIAIf the local equipment is not the local equipment registered by the access point, if not, the return value Res is setA=‘error2'go to step (D)', otherwise the terminal equipment UE collected in the past T secondsAWith wireless access point APAPhysical characteristic V of wireless channel therebetweenASigning X as a signing key to generate a terminal device UEAAuthentication identity signature MACX'=f(X||VA) Where f () is a hash function, | | is a join operation, the wireless access point APASet the return value to ResA=‘MACX'’；
(D) Wireless access point APAWill ResAReturned to the signature verification module SA。
(E) Signature verification module SAWill ResAForwards to the signature verification module SB。
(F) If ResAIs' error r1'or' error2', then signature verification module SBDirect return to ResATo the terminal equipment UEBElse, signature verification module SBComparing terminal equipment UEAIdentity signed MACXAnd ResATerminal equipment UE contained inAAuthentication signature MAC ofX': if MACX=MACX', set ResA= OK', otherwise Res is setA= FAILED', then returns ResATo the terminal equipment UEB。
(G) Terminal equipment UEBCheck ResAIf ResAIs 'OK'Then calculate Xymod p, i.e. (g)x)ymod p derives the session key K2=gxymod p, otherwise, reinitiating with the terminal equipment UEBThe key agreement process of (1);
if the session key K1=K2=gxymod p, then the terminal equipment UEAAnd terminal equipment UEBTo complete the identity signature verification and key agreement process.
The invention has the beneficial effects that:
the invention utilizes the independence of wireless channels in the process of key exchange: according to the characteristic that the wireless physical channel characteristics between the IoT equipment and the 5G wireless network access point are only perceived and used by the IoT terminal and the access point, signature authentication is provided for the key exchange algorithm DHKE based on the physical channel characteristics between the IoT equipment and the service network access point, so that defense against man-in-the-middle attacks is achieved, and dependence on third-party CA/PKI is avoided. The method solves the problems that under the 5G network environment, the number of Internet of things devices is large, key registration authentication is mostly not carried out in CA/PKI, the safe key distribution is difficult to be carried out by means of the CA/PKI, and a traditional DHKE key distribution method which is separated from the CA/PKI faces man-in-the-middle attack.
Drawings
FIG. 1 is a schematic diagram of a system architecture in an embodiment of the present invention;
fig. 2 is a flowchart of key agreement and signature authentication according to an embodiment of the present invention.
Detailed Description
Embodiments of the present invention will be described in detail below with reference to the accompanying drawings.
Examples
As shown in fig. 1, a method for exchanging communication keys of wireless internet of things devices in a 5G network environment includes two terminal devices UE in an IoT network to establish secure communicationAAnd terminal equipment UEBTerminal equipment UEAAnd terminal equipment UEBThe Service Networks (SN) are respectively: SN (service provider)A，SNBService network wireless access point APAAnd a wireless access point APBIn 5G softwareSignature verification module S of semantic network SDNA,SB。
Two terminal equipment UEAAnd UEBThe identity authentication of the service network access is carried out according to 5G network identity authentication protocol EAP-AKA' or 5G-AKA respectively, and the authentication is carried out through a wireless access point APAAnd APBAccessing 5G network, and recording respective service network ID SNAID,SNBID。
1. Terminal equipment UEAAnd UEBBefore formal communication, a communication key negotiation step is first performed, and a negotiation basic flow is shown in fig. 2.
1）UEASelecting a generator g and a large prime number p, and sending (g, p) to the UEB；
2) Subsequent UEASelecting a random number X between 2 and p-2, wherein X is more than or equal to 2 and less than or equal to p-2, and calculating an intermediate value X = gx mod p；
3）UEAUE acquired in past T secondsAWith wireless access point APAPhysical characteristic V of wireless channel therebetweenAAs signature key pair X = gxmod p signs to generate MACX=f(X||VA) Where f () is a hash function, | | is a join operation;
4）UEAwill negotiate the vector (X, MAC)X，TMSIA，SNAID) to the UEB，TMSIAFor the UEATemporary identities, SNs, registered in a service networkAID is UEAThe serving network ID of the location;
5）UEBselecting a random number Y between 2 and p-2, wherein Y is more than or equal to 2 and less than or equal to p-2, and calculating an intermediate value Y = gy mod p；
6）UEBUE acquired in past T secondsBWith wireless access point APBPhysical characteristic V of wireless channel therebetweenBAs signature key pair Y = gymod p signs to generate MACY=f(Y||VB) Where f () is a hash function, | | is a join operation;
7）UEBwill { Y, MACY，TMSIB，SNBID to UEA，TMSIBFor the UEBTemporary identities, SNs, registered in a service networkBID is UEBThe serving network ID of the location.
2、UEAAnd UEBStarting identity signature verification, and enabling the two parties to pass through signature verification modules S in the 5G service networks to which the two parties belongA,SBTo the wireless access point APAAnd APBThe validity of the signature is verified, and the basic flow of signature verification is shown in fig. 2:
1）UEAto receive { Y, MACY，TMSIB，SNBID to SAFrom SAAccording to SNBID will authenticate request { Y, TMSIB，SNBID is forwarded to the service network SNBSignature verification module SB；
2）SBChecking SNBWhether the ID is the ID of the service network or not, if not, the return value Res is setB=‘error1', go to step 5), otherwise { Y, TMSIBForward to the wireless access point APBRequesting to calculate the TMSIBHash signatures of corresponding terminals;
3）APBreceiving { Y, TMSIBChecking TMSIBIf the local equipment is not the local equipment registered by the access point, if not, the return value Res is setB=‘error2', go to step 4), otherwise, the UE acquired in the past T secondsBAnd APBPhysical characteristic V of wireless channel therebetweenBSigning Y as a signing key to generate a MACY'=f(Y||VB) Where f () is a hash function, | | | is a join operation, APBSet the return value to ResB=‘MACY'’；
4）APBWill ResBIs returned to SB；
5）SBWill ResBForward to SA；
6) If ResBIs' error r1'or' error2', then SADirect return to ResBTo UEAElse SAComparing MACsYAnd ResBMAC contained inY': if MACY=MACY', set ResB= OK', otherwise Res is setB= FAILED', then returns ResBTo UEA；
7）UEACheck ResBIf ResBIf 'OK', then Y is calculatedxmod p derives the session key K1=gxymod p, otherwise, re-initiating the key agreement process with B;
8）UEBsignature verification procedure and UEASimilarly, if S is the finalBReturned to the UEBRes ofAIf 'OK', then calculate Xymod p derives the session key K2=gxy mod p。
As can be seen from the key agreement and signature verification process, if the UE is in use, the UE will perform the key agreement and signature verification processA，UEBAll the identities are true identities, the same communication key K can be generated finally1=K2=gxymod p; on the contrary, as shown in fig. 1, there is an illegal user UECIntention to implement man-in-the-middle attacks due to stealing of the channel from the UEA，UEBWith wireless access point APAAnd APBPhysical independence of legitimate channels between, UECThe channel state eigenvector V cannot be obtainedA,VB(ii) a And the UECStealing channel communication characteristic VCAnd VA,VBDifferent from each other, f (Y | | | V) cannot be utilizedC) And f (X | | V)C) Impersonating UEAOr UEBAnd passing signature verification.
The invention utilizes the characteristics that the 5G network has high communication speed, the wireless physical channel characteristics between the IoT terminal and the access point are kept stable in a full-duplex communication period, and the channel characteristics are only sensed by the terminal and the access point to carry out the identity authentication of the communicator. Preferably, the selectable physical channel characteristics associated with the wireless physical channel are: channel GAIN (GAIN), Received Signal Strength (RSSI), Channel State Information (CSI): amplitude, phase, carrier Frequency (FRE), Channel Impulse Response (CIR), Channel Frequency Response (CFR), received signal envelope (Env), Bit Error Rate (BER), all may be collected by physical layer signal analysis. In a particular embodiment, one or a combination of features may be selected based on the IoT terminal class, network environment, and the like.
The above-mentioned embodiments only express the specific embodiments of the present invention, and the description thereof is more specific and detailed, but not construed as limiting the scope of the present invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the inventive concept, which falls within the scope of the present invention.

Claims (1)

1. A wireless Internet of things equipment communication key exchange method under a 5G network environment is characterized by comprising terminal equipment UE which prepares to establish secret communication in an IoT networkAAnd terminal equipment UEBAnd a signature verification module S located in the 5G service networkAAnd a signature verification module SBThe terminal equipment UEAAnd terminal equipment UEBRespectively through wireless access points APAAnd a wireless access point APBThe communication key exchange method comprises the following steps:
step 1, terminal equipment UEAAnd terminal equipment UEBNegotiating a communication key;
the step 1 specifically comprises the following steps:
(1) one terminal device selects a generator g and a large prime number p, and sends the generator g and the large prime number p to the other terminal device;
(2) terminal equipment UEAAnd terminal equipment UEBRespectively selecting a random number X and y between 2 and p-2, namely X is more than or equal to 2 and less than or equal to p-2, y is more than or equal to 2 and less than or equal to p-2, and calculating an intermediate value X = gxmod p and Y = gy mod p；
(3) Terminal equipment UEATerminal equipment UE collected in past T secondsAWith wireless access point APAPhysical characteristic V of wireless channel therebetweenAIntermediate value X = g as signature key pairxmod p carries out signature to generate terminal equipment UEAIdentity signed MACX=f(X||VA) Terminal equipment UEBTerminal equipment UE collected in past T secondsBWith wireless access point APBPhysical characteristic V of wireless channel therebetweenBIntermediate value Y = g as signature key pairymod p carries out signature to generate terminal equipment UEBIdentity signed MACY=f(Y||VB) Where f () is a hash function, | | is a join operation;
(4) terminal equipment UEAWill negotiate the vector (X, MAC)X，TMSIA，SNAID) to the terminal equipment UEBTerminal equipment UEBWill negotiate the vector Y, MACY，TMSIB，SNBID to the terminal equipment UEA，TMSIAAnd TMSIBRespectively terminal equipment UEAAnd terminal equipment UEBAt its corresponding service network SNAAnd service network SNBTemporary identities, SN, registered inAID and SNBID is terminal equipment UE respectivelyAAnd terminal equipment UEBThe serving network ID of the location;
step 2, according to the terminal equipment UEAOr UEBWith respective corresponding wireless access points APAOr APBThe wireless channel physical characteristics between the two parties carry out identity signature verification through a signature verification module S in the 5G service network to which the two parties belongAAnd a signature verification module SBTo the wireless access point APAAnd a wireless access point APBVerifying the validity of the signature;
in step 2, the terminal equipment UEAThe identity signature verification specifically comprises the following steps:
(a) terminal equipment UEAWill receive negotiation vector Y, MACY，TMSIB，SNBID to the signature verification module SABy a signature verification module SAAccording to SNBID will authenticate request { Y, TMSIB，SNBID is forwarded to the service network SNBSignature verification ofModule SB；
(b) Signature verification module SBChecking SNBIf the ID is the ID of the service network, if not, setting a return value ResB=‘error1', go to step (e), otherwise { Y, TMSIBForward to the wireless access point APBRequesting to calculate the TMSIBHash signatures corresponding to the terminal devices;
(c) wireless access point APBReceiving { Y, TMSIBChecking TMSIBIf the local equipment is not the local equipment registered by the access point, if not, the return value Res is setB=‘error2'go to step (d)', otherwise the terminal equipment UE collected in the past T secondsBWith wireless access point APBPhysical characteristic V of wireless channel therebetweenBSigning Y as a signing key to generate a terminal equipment UEBAuthentication signature MAC ofY'=f(Y||VB) Where f () is a hash function, | | is a join operation, the wireless access point APBSet the return value to ResB=‘MACY'’；
(d) Wireless access point APBWill ResBReturned to the signature verification module SB；
(e) Signature verification module SBWill ResBForwards to the signature verification module SA；
(f) If ResBIs' error r1'or' error2', then signature verification module SADirect return to ResBTo the terminal equipment UEAElse, signature verification module SAComparing terminal equipment UEBIdentity signed MACYAnd ResBTerminal equipment UE contained inBAuthentication signature MAC ofY': if MACY=MACY', set ResB= OK', otherwise Res is setB= FAILED', then returns ResBTo the terminal equipment UEA；
(g) Terminal equipment UEACheck ResBIf ResBIf 'OK', then Y is calculatedxmod p, i.e. (g)y)xmod p derives the session key K1=gxymod p, otherwise, reinitiating with the terminal equipment UEBThe key agreement process of (1);
terminal equipment UEBThe identity signature verification specifically comprises the following steps:
(A) terminal equipment UEBWill receive negotiation vector { X, MACX，TMSIA，SNAID to the signature verification module SBBy a signature verification module SBAccording to SNAID will authenticate request { X, TMSIA，SNAID is forwarded to the service network SNASignature verification module SA；
(B) Signature verification module SAChecking SNAIf the ID is the ID of the service network, if not, setting a return value ResA=‘error1', go to step (E), otherwise { X, TMSIAForward to the wireless access point APARequesting to calculate the TMSIAHash signatures corresponding to the terminal devices;
(C) wireless access point APAReceiving { X, TMSIAChecking TMSIAIf the local equipment is not the local equipment registered by the access point, if not, the return value Res is setA=‘error2'go to step (D)', otherwise the terminal equipment UE collected in the past T secondsAWith wireless access point APAPhysical characteristic V of wireless channel therebetweenASigning X as a signing key to generate a terminal device UEAAuthentication signature MAC ofX'=f(X||VA) Where f () is a hash function, | | is a join operation, the wireless access point APASet the return value to ResA=‘MACX'’；
(D) Wireless access point APAWill ResAReturned to the signature verification module SA；
(E) Signature verification module SAWill ResAForwards to the signature verification module SB；
(F) If ResAIs' error r1'or' error2', then signature verification module SBDirect return to ResATo the terminal equipment UEBElse, signature verification module SBComparing terminal equipment UEAIdentity signed MACXAnd ResATerminal equipment UE contained inAAuthentication signature MAC ofX': if MACX=MACX', set ResA= OK', otherwise Res is setA= FAILED', then returns ResATo the terminal equipment UEB；
(G) Terminal equipment UEBCheck ResAIf ResAIf 'OK', then calculate Xymod p, i.e. (g)x)ymod p derives the session key K2=gxymod p, otherwise, reinitiating with the terminal equipment UEBThe key agreement process of (1);
if the session key K1=K2=gxymod p, then the terminal equipment UEAAnd terminal equipment UEBTo complete the identity signature verification and key agreement process.
CN202110777176.8A 2021-07-09 2021-07-09 Wireless Internet of things equipment communication key exchange method under 5G network environment Expired - Fee Related CN113242548B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110777176.8A CN113242548B (en) 2021-07-09 2021-07-09 Wireless Internet of things equipment communication key exchange method under 5G network environment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110777176.8A CN113242548B (en) 2021-07-09 2021-07-09 Wireless Internet of things equipment communication key exchange method under 5G network environment

Publications (2)

Publication Number Publication Date
CN113242548A CN113242548A (en) 2021-08-10
CN113242548B true CN113242548B (en) 2021-09-17

Family

ID=77135227

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110777176.8A Expired - Fee Related CN113242548B (en) 2021-07-09 2021-07-09 Wireless Internet of things equipment communication key exchange method under 5G network environment

Country Status (1)

Country Link
CN (1) CN113242548B (en)

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112911588A (en) * 2021-02-04 2021-06-04 郑州信大捷安信息技术股份有限公司 Lightweight narrowband Internet of things secure transmission method and system
CN113037467A (en) * 2021-05-24 2021-06-25 杭州海康威视数字技术股份有限公司 Video Internet of things equipment key certificate management method, device and system

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113923052A (en) * 2015-07-03 2022-01-11 阿费罗有限公司 Apparatus and method for establishing a secure communication channel in an internet of things (IoT) system
US10516654B2 (en) * 2016-03-15 2019-12-24 Intel Corporation System, apparatus and method for key provisioning delegation
US20200107381A1 (en) * 2016-08-10 2020-04-02 Interdigital Patent Holdings, Inc. Methods, apparatus, and systems for power efficient d2d communications for wearable and iot devices
CN106130724A (en) * 2016-08-26 2016-11-16 浪潮集团有限公司 Internet of things terminal security implementation method adopting key agreement
CN109068284B (en) * 2018-09-28 2021-05-25 深圳大学 Physical layer authentication method and system based on group connection among Internet of things devices
CN108966232B (en) * 2018-09-28 2021-04-20 深圳大学 Wireless Internet of Things physical layer hybrid authentication method and system based on service network
CN109348477B (en) * 2018-09-28 2021-03-09 深圳大学 Wireless internet of things physical layer authentication method based on service network
CN111541776A (en) * 2020-05-09 2020-08-14 朗明智诚科技股份有限公司 Safe communication device and system based on Internet of things equipment

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112911588A (en) * 2021-02-04 2021-06-04 郑州信大捷安信息技术股份有限公司 Lightweight narrowband Internet of things secure transmission method and system
CN113037467A (en) * 2021-05-24 2021-06-25 杭州海康威视数字技术股份有限公司 Video Internet of things equipment key certificate management method, device and system

Also Published As

Publication number Publication date
CN113242548A (en) 2021-08-10

Similar Documents

Publication Publication Date Title
Malik et al. A survey of key bootstrapping protocols based on public key cryptography in the Internet of Things
Cao et al. Fast authentication and data transfer scheme for massive NB-IoT devices in 3GPP 5G network
CN116707791B (en) Distributed authentication key negotiation method in intelligent vehicle-mounted networking system
EP2416524B1 (en) System and method for secure transaction of data between wireless communication device and server
CN108667616B (en) Identity-based cross-cloud security authentication system and method
CN104639329B (en) User identity inter-authentication method based on Elliptic Codes
CN101902476B (en) Method for authenticating identity of mobile peer-to-peer user
Saied et al. A distributed approach for secure M2M communications
WO2010078755A1 (en) Method and system for transmitting electronic mail, wlan authentication and privacy infrastructure (wapi) terminal thereof
Chaturvedi et al. A secure zero knowledge authentication protocol for wireless (mobile) ad-hoc networks
CN109756877A (en) A kind of anti-quantum rapid authentication and data transmission method of magnanimity NB-IoT equipment
CN114268439A (en) Identity-based authentication key negotiation method based on lattice
CN101494862A (en) Access authentication method of wireless mesh network
Son et al. A zero-trust authentication scheme with access control for 6g-enabled iot environments
CN105075175A (en) Method and device for establishing session key
Mishra et al. A pairing-free identity based authentication framework for cloud computing
CN113411801A (en) Mobile terminal authentication method based on identity signcryption
CN116436640A (en) A lightweight terminal cross-domain authentication method for edge computing
CN106953727B (en) Group safety certifying method based on no certificate in D2D communication
CN120528614A (en) Cloud-edge collaborative multi-factor identity authentication method and system for ubiquitous networks
Nyangaresi et al. Message verification protocol based on bilinear pairings and elliptic curves for enhanced security in vehicular ad hoc networks
CN105978692A (en) Implementation method of 3GPP authentication and key agreement protocol
CN114584975A (en) Anti-quantum satellite network access authentication method based on SDN
CN116599659B (en) Certificate-free identity authentication and key negotiation method and system
Sarbini et al. A lightweight multifactor authentication scheme for wireless sensor networks in the Internet of Things

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
TR01 Transfer of patent right
TR01 Transfer of patent right

Effective date of registration: 20220401

Address after: 610000 No. 210, second floor, No. 115, Section 1, Jinhua Road, Jinjiang District, Chengdu, Sichuan Province (self numbering)

Patentee after: Sichuan gehou Technology Co.,Ltd.

Address before: 610000, No. 24, south section of Ring Road, Sichuan, Chengdu

Patentee before: SICHUAN University

CF01 Termination of patent right due to non-payment of annual fee
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20210917