WO2009094938A1 - Method for managing wireless multi-hop network key - Google Patents

Method for managing wireless multi-hop network key Download PDF

Info

Publication number
WO2009094938A1
WO2009094938A1 PCT/CN2009/070255 CN2009070255W WO2009094938A1 WO 2009094938 A1 WO2009094938 A1 WO 2009094938A1 CN 2009070255 W CN2009070255 W CN 2009070255W WO 2009094938 A1 WO2009094938 A1 WO 2009094938A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
public
registered device
private key
wireless multi
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2009/070255
Other languages
English (en)
French (fr)
Inventor
Yuelei Xiao
Jun Cao
Xiaolong Lai
Zhenhai Huang
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Iwncomm Co Ltd
Original Assignee
China Iwncomm Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Iwncomm Co Ltd filed Critical China Iwncomm Co Ltd
Priority to KR1020107018359A priority Critical patent/KR101173770B1/ko
Priority to US12/864,317 priority patent/US8688974B2/en
Priority to EP09706489.3A priority patent/EP2247130B1/en
Publication of WO2009094938A1 publication Critical patent/WO2009094938A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/061—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/18—Self-organising networks, e.g. ad-hoc networks or sensor networks

Definitions

  • a wireless multi-hop network key management method is submitted to the Chinese Patent Office on January 23, 2008, and the application number is 200810017387.6, and the invention name is "an ID-based wireless multi-hop network key management method" Priority of the patent application, the entire contents of which is incorporated herein by reference.
  • the present invention relates to the field of network information security technologies, and in particular, to a wireless multi-hop network key management method. Background technique
  • PDAs personal digital assistants
  • P0S personal operation space
  • the information exchange between these terminal devices mostly depends on the connection of the cable, which is very inconvenient to use.
  • Mobile, automatic interconnection this is wireless multi-hop network technology. In a wireless multi-hop network, communication data between non-adjacent terminal devices needs to be transmitted in a multi-hop route.
  • the Trust Center is the key management center of the network and is responsible for configuring key information for all devices in the network.
  • the trusted center can be acted upon by the network coordinator or by other devices specified by the network coordinator in the network.
  • Wireless multi-hop network supports two network topologies: Type network and point-to-point network, the network topology of the point-to-point network can be divided into a network structure and a cluster structure, as shown in Figure 1-3.
  • the key management methods currently used are usually a pre-shared key based key management method and a PKI based key management method.
  • 3 ⁇ 4f is a larger network.
  • it is not suitable for wireless multi-hop networks due to the management of certificates and the large amount of traffic.
  • the present invention provides a key management method for a wireless multi-hop network, which generates a public-private key based on each device's own ID to encrypt and authenticate devices in a wireless multi-hop network, thereby improving the security and performance of the wireless multi-hop network.
  • the existing pre-shared key-based key management method is not suitable for large-scale networks and the PKI-based key management method is not suitable for wireless multi-hop networks.
  • the trusted center constructs an ID-based public key according to the identity of the registered device
  • the registered device securely obtains an ID-based public-private key pair from the trusted center of the wireless multi-hop network; the key storage step:
  • a master key and an ID-based public-private key pair for generating a private key of the registered device based on the ID are stored.
  • the coordinator can know the validity of the ID-based public key according to the public key revocation list of the trusted center, thereby improving the security of the wireless multi-hop network authentication access; using the ID-based public-private key pair, non-interactively Key negotiation is performed to improve the performance of the wireless multi-hop network.
  • Figure 1 is a schematic diagram of a conventional star wireless multi-hop network topology
  • FIG. 2 is a schematic diagram of a conventional mesh network topology
  • FIG. 3 is a schematic diagram of a conventional cluster network topology
  • FIG. 4 is a flowchart of a method for managing a wireless multi-hop network key in an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of an authentication access system of a wireless multi-hop network according to an embodiment of the present invention. In the figure:
  • A is the terminal device requesting authentication access
  • B is the coordinator associated with A
  • S is the trusted center of the wireless multi-hop network.
  • the technical solution provided by the present invention is applicable to a security application protocol when the WAPI framework method (TePA, ternary peer-to-peer authentication control method) is applied on a specific network including a wireless local area network and a wireless metropolitan area network.
  • WAPI framework method TePA, ternary peer-to-peer authentication control method
  • Wireless multi-hop networks include low-rate wireless personal area networks, high-rate wireless personal area networks, and wireless sensor networks. This key management method can be applied to these networks.
  • the wireless multi-hop network key management provided by the present invention mainly includes generation, distribution, storage, change and revocation of an ID-based key.
  • ID-based wireless multi-hop network key management method S01, key generation:
  • the trusted center in the wireless multi-hop network first constructs the ID-based public key of the registered device according to the identity of the registered device, and then uses the cryptographic gate P ⁇ mechanism to go up to the trusted center.
  • the k trusted centers of the group submit the ID-based public key of the registered device, and then the k trusted centers generate the partial ID private key of the registered device by using the owned partial master key and send it to the wireless multi-hop network.
  • the trusted center, and finally the trusted center synthesizes the ID-based private key of the registered device using the ID-based partial private key of the registered device.
  • the wireless multi-hop network constructs a public key based on the ID of the registered device according to the identity of the registered device, and then generates the private key of the registered device based on the ID using the local key stored in the local device.
  • the public key of the registered device based on the ID may be a concatenation value of the CA certificate identity of the trusted center in the wireless multi-hop network, the wireless multi-hop network identifier, the identity of the registered device, and the time limit of the public key.
  • the key generation includes the following steps:
  • Step 11 The trusted center in the wireless multi-hop network constructs an ID-based public key according to the identity of the registered device, for example, the public key of the registered device based on the ID is a concatenation value of the identity of the registered device and the time limit of the public key;
  • Step 12 The trusted center in the wireless multi-hop network generates an ID-based private key of the registered device.
  • the registered device After the registered device submits the identity of the registered device to the trusted center of the wireless multi-hop network, the registered device obtains the public-private key pair based on the ID of the registered device.
  • the ID-based private key needs to be encrypted and transmitted to the registered device to ensure the security of the private key.
  • the key distribution includes the following steps:
  • Step 21 The registered device submits its own identity, such as a device ID, to the trusted center of the wireless multi-hop network.
  • Step 22 The registered device securely obtains an ID-based public-private key pair from the trusted center of the wireless multi-hop network.
  • the master key used to generate the ID-based private key of the registered device is shared by the upper trusted center group
  • the master key is divided into n parts by a polynomial function, and the n parts are stored in n trusted centers of the upper layer trusted center group.
  • Each trusted center stores a portion of the master key.
  • the master key used to generate the ID-based private key of the registered device can also be stored in the trusted center of the wireless multi-hop network.
  • the trusted center of the wireless multi-hop network completes the registration of the ID-based public-private key pair of the device, and then deletes the public-private key pair of the registered device based on the ID, and stores only its own ID-based public-private key pair.
  • the registration device stores the ID-based public-private key pair of the registered device obtained from the trusted center of the wireless multi-hop network. Among them, the ID-based private key needs to be stored securely.
  • the key storage includes the following steps:
  • Step 31 Acquire and store a master key for generating a private key of the registered device based on the ID.
  • Step 32 Store an ID-based public-private key pair of the registered device.
  • a public key revocation list is maintained in the trusted center of the wireless multi-hop network for recording the revoked public key, so that the registered device can query whether the public key based on the ID is revoked.
  • the registration device When the registration device leaks based on the private key of the ID, the registration device applies for offline cancellation of the ID-based public key of the device to the trusted center in the wireless multi-hop network, and after receiving the application, the trusted center will The registered device adds the public key revocation list based on the public key of the ID;
  • the registration device applies to the trusted center for the deregistration device ID-based public key by using the security protection of the session key between the trusted center in the wireless multi-hop network.
  • the trusted center adds the public key of the registered device based on the ID to the public key revocation list.
  • the registration device applies to the trusted center to change the registration device ID-based public-private key pair by using the session key between the trusted center in the wireless multi-hop network.
  • the letter center reconstructs the ID-based public key of the registered device, and then obtains (or locally generates) the registered device ID-based public key corresponding to the ID device from the upper-level trusted center group, and finally The trusted center utilizes the session key transmission with the registered device to regenerate the public-private key pair of the registered device based on the ID, while the original registered device
  • the ID-based public key is added to the public key revocation list.
  • the key management scheme proposed by the present invention adopts an ID-based public key system, and each device can perform secure communication in a wireless multi-hop network by using a public-private key based on its own ID, thereby improving a wireless multi-hop network.
  • Security and performance Since the ID-based public key itself has the undo feature and the ID-based public key length is short, this not only reduces the number of public key validity queries, but also reduces the transmission load, thereby improving the performance of the wireless multi-hop network. .
  • the ternary structure similar to that described in the Chinese wireless local area network standard is adopted.
  • the device and the coordinator can know the validity of the ID-based public key according to the public key revocation list of the trusted center, thereby improving The security of wireless multi-hop network authentication access; using ID-based public and private key pairs, key negotiation can be performed non-interactively, thereby improving the performance of the wireless multi-hop network.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Description

一种无线多跳网络密钥管理方法 本申请要求于 2008 年 01 月 23 日提交中国专利局、 申请号为 200810017387.6, 发明名称为"一种基于 ID 的无线多跳网络密钥管理方法" 的中国专利申请的优先权， 其全部内容通过引用结合在本申请中。 技术领域 本发明涉及网络信息安全技术领域， 尤其涉及一种无线多跳网络密钥管 理方法。 背景技术
随着计算机网络和全球移动通信技术的发展，便携的数字处理终端设备 已经成为人们日常生活和办公的必需品， 这些终端设备包括笔记本电脑、 个 人数字助理（PDA ) 、 计算机外设、 移动电话、 寻呼机和家用电子产品等。 它们都具有较强的处理能力和较大的存储空间， 从而形成了一个个人操作空 间 （P0S ) 。 但是目前这些终端设备之间的信息交换大都还依赖于电缆的连 接， 使用非常不方便， 人们越来越需要一种无线技术将个人操作空间内的这 些终端设备连接起来， 真正实现终端设备之间可移动的、 自动的互联， 这就 是无线多跳网络技术。 在无线多跳网络中， 非相邻终端设备之间的通信数据 需要以多跳路由的方式传输。
在无线多跳网络中存在着四种角色的设备： 终端设备、 路由协调器、 网 络协调器和可信中心。 终端设备可与该网络中的其他设备进行通信， 但在该 网络中不能为其他设备转发数据， 即不能完成路由功能。 路由协调器除了完 成终端设备的功能外还负责为该网络中的其他设备转发数据， 即能完成路由 功能。 网络协调器负责发送网络信标、 建立一个网络、 管理网络节点、 存储 网络节点信息、 寻找一对节点间的路由消息和不断地接收信息， 也能为该网 络中的其他设备转发数据， 即能完成路由功能。 网络协调器和路由协调器可 统称为协调器。 可信中心是该网络的密钥管理中心， 负责为该网络中的所有 设备配置密钥信息。 可信中心可以由网络协调器充当， 也可以由网络协调器 在该网络中指定的其他设备充当。 无线多跳网络支持两种网络拓朴结构： 星 型网络和点到点网络， 点到点网络的网络拓朴结构又可分为网状结构和簇型 结构， 如图 1-图 3所示。
对于无线多跳网络， 目前采用的密钥管理方法通常为基于预共享密钥的 密钥管理方法和基于 PKI的密钥管理方法。
对于第一种密钥管理方法， 由于预共享密钥不便于管理， 一般不适合于
¾f莫较大的网络。 对于第二种密钥管理方法， 由于证书的管理以及通信量较 大， 所以也不适合无线多跳网络。 发明内容
本发明提供一种无线多跳网络的密钥管理方法， 基于每个设备自身 ID 产生公私钥， 以对无线多跳网络中设备进行加密认证， 提高了无线多跳网络 的安全性和性能， 解决了现有基于预共享密钥的密钥管理方法不适合于规模 较大的网络以及基于 PKI的密钥管理方法不适合无线多跳网络的技术问题。
本发明实施例提供的一种无线多跳网络密钥管理方法， 包括：
密钥产生步骤：
可信中心根据注册设备的身份标识构造基于 ID的公钥；
可信中心利用所述公钥和主密钥产生该注册设备的基于 ID的私钥； 密钥分发步骤：
注册设备向无线多跳网络的可信中心提交自身的身份标识；
注册设备从该无线多跳网络的可信中心安全获得基于 ID的公私钥对； 密钥存储步骤：
存储用于产生注册设备基于 ID的私钥的主密钥及基于 ID的公私钥对。 存储注册设备的基于 ID的公私钥对。
综上所述， 本发明提出的密钥管理方案， 采用基于 ID的公钥体制， 每 个设备利用基于自身 ID的公私钥可以在无线多跳网络中进行安全通信， 从 而提高了无线多跳网络的安全性和性能。 由于基于 ID的公钥本身具有撤销 特性且基于 ID的公钥长度较短， 这样不仅可以减少了公钥有效性查询的次 数， 而且还减少了传输的负荷， 从而提高了无线多跳网络的性能。 而且采用 了类似于中国无线局域网标准中所述的三元结构，在认证接入过程中设备和 协调器都可以根据可信中心的公钥撤销表知道其基于 ID的公钥有效性， 从 而提高了无线多跳网络认证接入的安全性； 利用基于 ID的公私钥对， 可以 非交互式地进行密钥协商， 从而提高了无线多跳网络的性能。 附图说明
图 1为现有的星型无线多跳网络拓朴结构图；
图 2为现有的网状网络拓朴结构图；
图 3为现有的簇型网络拓朴结构图；
图 4是本发明实施方案中的无线多跳网密钥管理方法流程图；
图 5是本发明实施方案中的无线多跳网络的认证接入系统结构示意图。 附图中：
"· "协调器， "o"为终端设备， 为通信信道。
A为请求认证接入的终端设备， B是 A所关联的协调器， S是该无线多 跳网络的可信中心。 具体实施方式
本发明提供的技术方案适用于 WAPI框架方法（ TePA, 基于三元对等鉴 别的访问控制方法）在包括无线局域网、 无线城域网在内的具体网络上应用 时的安全应用协议。
无线多跳网络包括低速率无线个域网、 高速率无线个域网和无线传感器 网等， 这种密钥管理方法可适用于这些网络。
本发明提供的无线多跳网络密钥管理主要包括基于 ID的密钥的产生、 分发、 存储、 更改和撤销。
参照图 4， 基于 ID的无线多跳网密钥管理方法的具体实现如下： S01、 密钥产生：
在基于 ID的密码体制中 , 由于基于 ID的私钥等于主密钥和基于 ID的 公钥的标量乘，所以主密钥的安全非常重要，可采取多个可信中心共同分享， 即： 每一个可信中心拥有该主密钥的一部分， 可称为部分主密钥。 类似地， 公钥的每一个部分可称为部分公钥 , 私钥的每一个部分可称为部分私钥。
当用于产生本发明实施例中注册设备基于 ID的私钥的主密钥由上一层 可信中心群共同分享时， 该无线多跳网络中的可信中心首先 据注册设备的 身份标识构造注册设备基于 ID的公钥 , 然后采用密码学中的门 P艮机制向上 一层可信中心群的 k个可信中心提交注册设备的基于 ID的公钥， 接着该 k 个可信中心利用所拥有的部分主密钥产生注册设备基于 ID的部分私钥并发 送给该无线多跳网络中的可信中心， 最后该可信中心利用注册设备基于 ID 的部分私钥合成为该注册设备基于 ID的私钥。
本发明实施例中 ,参照如图 5所示的系统， 当用于产生注册设备基于 ID 的私钥的主密钥存储于该无线多跳网络的可信中心时， 该无线多跳网络中的 可信中心根据注册设备的身份标识构造注册设备基于 ID的公钥， 然后利用 存储于本地的主密钥产生该注册设备基于 ID的私钥。
注册设备基于 ID的公钥可为无线多跳网络中可信中心的 CA证书身份、 无线多跳网络标识、 注册设备的身份标识和公钥的时限的级联值。
密钥产生， 具体包括以下步骤：
步骤 11 ,无线多跳网络中的可信中心根据注册设备的身份标识构造基于 ID的公钥， 如： 注册设备基于 ID的公钥为注册设备的身份标识和公钥的时 限的级联值；
步骤 12, 无线多跳网络中的可信中心产生注册设备的基于 ID的私钥。
502、 密钥分发：
注册设备在向该无线多跳网络的可信中心提交注册设备的身份标识之 后， 从该可信中心获得注册设备基于 ID的公私钥对。 其中， 基于 ID的私钥 需要采用加密措施传输给注册设备， 以保证私钥的安全。
密钥分发， 具体包括以下步骤：
步骤 21 , 注册设备向无线多跳网络的可信中心提交自身的身份标识，如 设备 ID;
步骤 22, 注册设备从该无线多跳网络的可信中心安全获得基于 ID的公 私钥对。
503、 密钥存储：
当用于产生注册设备基于 ID 的私钥的主密钥由上一层可信中心群共同 分享时， 该主密钥经多项式函数分成 n个部分后， 将该 n个部分存储于上一 层可信中心群的 n个可信中心中。 每个可信中心存储主密钥的一部分。
用于产生注册设备基于 ID 的私钥的主密钥也可存储于该无线多跳网络 的可信中心。
无线多跳网络的可信中心完成注册设备基于 ID的公私钥对分发后就删 除注册设备基于 ID的公私钥对， 仅存储自身的基于 ID的公私钥对。 注册设 备存储从无线多跳网络的可信中心获得的注册设备基于 ID的公私钥对。 其 中， 基于 ID的私钥需要进行安全存储。
密钥存储， 具体包括以下步骤：
步骤 31 , 获取并存储用于产生注册设备基于 ID的私钥的主密钥； 步骤 32, 存储注册设备的基于 ID的公私钥对。
504、 密钥撤销：
为便于管理公钥， 无线多跳网络的可信中心中维护一个公钥撤销表， 用 于记录被撤销的公钥， 使注册设备可以查询基于 ID公钥是否被撤销。
当注册设备基于 ID的私钥发生泄漏时， 该注册设备以离线形式向该无 线多跳网络中的可信中心申请撤销注册设备基于 ID的公钥， 可信中心收到 该申请后 , 将该注册设备基于 ID的公钥加入公钥撤销表；
当注册设备基于 ID的私钥不再使用时， 该注册设备利用与该无线多跳 网络中可信中心之间的会话密钥的安全保护向该可信中心申请撤销注册设 备基于 ID的公钥，可信中心收到该申请后将该注册设备基于 ID的公钥加入 公钥撤销表。
505、 密钥更改:
当注册设备基于 ID的公私钥对需要更改时， 该注册设备利用与该无线 多跳网络中可信中心之间的会话密钥向该可信中心申请更改注册设备基于 ID的公私钥对，可信中心收到该申请后重新构造该注册设备基于 ID的公钥 , 然后从上层可信中心群获得（或本地产生）该注册设备基于 ID的公钥对应 的注册设备基于 ID的私钥， 最后该可信中心利用与该注册设备之间的会话 密钥传输重新产生的注册设备基于 ID的公私钥对， 同时将原来的注册设备 基于 ID的公钥加入公钥撤销表。
综上所述， 本发明提出的密钥管理方案， 采用基于 ID的公钥体制， 每 个设备利用基于自身 ID的公私钥可以在无线多跳网络中进行安全通信， 从 而提高了无线多跳网络的安全性和性能。 由于基于 ID的公钥本身具有撤销 特性且基于 ID的公钥长度较短， 这样不仅可以减少了公钥有效性查询的次 数， 而且还减少了传输的负荷， 从而提高了无线多跳网络的性能。 而且采用 了类似于中国无线局域网标准中所述的三元结构，在认证接入过程中设备和 协调器都可以根据可信中心的公钥撤销表知道其基于 ID的公钥有效性， 从 而提高了无线多跳网络认证接入的安全性； 利用基于 ID的公私钥对， 可以 非交互式地进行密钥协商， 从而提高了无线多跳网络的性能。
以上举较佳实施例， 对本发明的目的、 技术方案和优点进行了进一步详 细说明， 所应理解的是， 以上所述仅为本发明的较佳实施例而已， 并不用以 限制本发明， 凡在本发明的精神和原则之内， 所作的任何修改、 等同替换、 改进等， 均应包含在本发明的保护范围之内。

Claims

权 利 要 求
1、 一种无线多跳网络密钥管理方法， 其特征在于， 包括：
密钥产生步骤：
可信中心根据注册设备的身份标识构造基于 ID的公钥；
可信中心利用所述公钥和主密钥产生该注册设备的基于 ID的私钥； 密钥分发步骤：
注册设备向无线多跳网络的可信中心提交自身的身份标识；
注册设备从该无线多跳网络的可信中心安全获得基于 ID的公私钥对； 密钥存储步骤：
存储用于产生注册设备基于 ID的私钥的主密钥及基于 ID的公私钥对。 存储注册设备的基于 ID的公私钥对。
2、 根据权利要求 1所述的密钥管理方法， 其特征在于， 当用于产生注册 设备基于 ID的私钥的主密钥由至少两个上一层可信中心共同分享时， 密钥产 生的步骤具体包括：
无线多跳网络中的可信中心向所述至少两个上一层可信中心提交注册 设备的基于 ID的公钥 , 获得该注册设备基于 ID的私钥的部分私钥；
利用所获得的注册设备基于 ID的部分私钥构成注册设备基于 ID的私 钥。
3、 根据权利要求 1 所述的密钥管理方法， 其特征在于， 当用于产生注 册设备基于 ID的私钥的主密钥由至少两个上一层可信中心共同分享时， 密 钥存储步骤具体包括：
无线多跳网络的可信中心完成注册设备基于 ID的公私钥对分发后， 删 除该注册设备基于 ID的公私钥对， 存储自身基于 ID的公私钥对； 将从无线 多跳网络的可信中心获得的基于 ID的公私钥对保存在所述注册设备。
4、 根据权利要求 1所述的密钥管理方法， 其特征在于，
当所述主密钥存储于该无线多跳网络的可信中心时，
密钥存储步骤具体包括：
无线多跳网络的可信中心完成注册设备基于 ID的公私钥对分发后，删 除该注册设备基于 ID的公私钥对， 保存自身基于 ID的公私钥对； 将从所述可信中心获得的基于 ID的公私钥对保存在所述注册设备。
5、 根据权利要求 1至 4中任一项所述的密钥管理方法， 其特征在于， 还 包括：
更改密钥的步骤：
若需要更改注册设备基于 ID的公私钥对，则注册设备利用与该无线多跳 网络的可信中心之间的会话密钥的安全保护向该可信中心申请更改注册设 备基于 ID的公私钥对；
可信中心收到所述注册设备发送的申请后 ,构造注册设备新的基于 ID的 公钥；
利用所述注册设备新的基于 ID的公钥 ,可信中心生成注册设备新的基于 ID的私钥， 得到注册设备新的基于 ID公私钥对；
可信中心利用与注册设备之间的会话密钥的安全保护传输新的基于 ID 的公私钥对， 并将原来的基于 ID的公钥加入公钥撤销表。
6、 根据权利要求 1至 4中任一项所述的密钥管理方法， 其特征在于， 还包括
撤销密钥的步骤：
接收注册设备向无线多跳网络中的可信中心发送撤销申请；
将注册设备基于 ID的公钥添加到公钥撤销表。
7、 根据权利要求 6所述的密钥管理方法， 其特征在于， 所述撤销密钥 的步骤还包括：
当注册设备基于 ID的私钥发生泄漏时， 注册设备以离线形式向无线多 跳网络中的可信中心申请撤销注册设备基于 ID的公钥；
当注册设备基于 ID的私钥不再使用时， 注册设备向该可信中心申请撤 销注册设备基于 ID的公钥。
8、 根据权利要求 1至 4中任一项所述的密钥管理方法， 其特征在于， 还包括：
密钥撤销步骤： 若需要撤销注册设备基于 ID的公钥， 则注册设备向无线多跳网络中的 可信中心申请撤销注册设备基于 ID的公钥；
可信中心收到注册设备发送的申请后将注册设备基于 ID的公钥加入公 钥撤销表。
9、 根据权利要求 8所述的密钥管理方法， 其特征在于，
当注册设备基于 ID的私钥发生泄漏时， 注册设备以离线形式向无线多 跳网络中的可信中心申请撤销注册设备基于 ID的公钥。
10、 根据权利要求 8所述的密钥管理方法， 其特征在于， 当注册设备基 于 ID的私钥没有被泄漏但不再使用时， 注册设备利用与无线多跳网络中可 信中心之间的会话密钥的安全保护向该可信中心申请撤销注册设备基于 ID 的公钥。
PCT/CN2009/070255 2008-01-23 2009-01-21 Method for managing wireless multi-hop network key Ceased WO2009094938A1 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
KR1020107018359A KR101173770B1 (ko) 2008-01-23 2009-01-21 무선 멀티?홉 네트워크 키를 관리하는 방법
US12/864,317 US8688974B2 (en) 2008-01-23 2009-01-21 Method for managing wireless multi-hop network key
EP09706489.3A EP2247130B1 (en) 2008-01-23 2009-01-21 Method for managing wireless multi-hop network key

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200810017387A CN101222325B (zh) 2008-01-23 2008-01-23 一种基于id的无线多跳网络密钥管理方法
CN200810017387.6 2008-01-23

Publications (1)

Publication Number Publication Date
WO2009094938A1 true WO2009094938A1 (en) 2009-08-06

Family

ID=39631923

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2009/070255 Ceased WO2009094938A1 (en) 2008-01-23 2009-01-21 Method for managing wireless multi-hop network key

Country Status (5)

Country Link
US (1) US8688974B2 (zh)
EP (1) EP2247130B1 (zh)
KR (1) KR101173770B1 (zh)
CN (1) CN101222325B (zh)
WO (1) WO2009094938A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102098672A (zh) * 2011-03-16 2011-06-15 北京邮电大学 密钥信息的传递方法与系统、发送端及接收端

Families Citing this family (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101222325B (zh) 2008-01-23 2010-05-12 西安西电捷通无线网络通信有限公司 一种基于id的无线多跳网络密钥管理方法
BRPI1006182B1 (pt) * 2009-03-19 2021-02-17 Koninklijke Philips N.V. método para comunicações seguras entre um primeiro nó e um segundo nó em uma rede, dispositivo de gerenciamento provido de material de geração de chave raiz e rede
EP2334138A1 (de) * 2009-12-10 2011-06-15 SMA Solar Technology AG Drahtloses Kommunikationsnetz über eine definierte Gruppe von Teilnehmern
CN101895388B (zh) * 2010-07-07 2015-09-16 中兴通讯股份有限公司 分布式动态密钥管理方法及装置
KR101083127B1 (ko) * 2010-08-25 2011-11-11 경희대학교 산학협력단 멀티홉 무선 통신 환경에서 센서 노드들의 비밀값 공유 방법
CN102043973B (zh) * 2010-12-13 2012-10-31 北京交通大学 一种基于半可信中心的电子标签拥有权转移方法
CN102170355A (zh) 2011-04-27 2011-08-31 北京深思洛克软件技术股份有限公司 信息安全设备中远程升级密钥管理方法
US8804964B2 (en) * 2012-06-18 2014-08-12 Htc Corporation Access control method and related wireless communication system
CN102868452B (zh) * 2012-09-06 2015-11-25 上海欣影电力科技发展有限公司 一种用于密集输电通道的混合组网系统
CN103138938B (zh) * 2013-03-22 2016-01-20 中金金融认证中心有限公司 基于csp的sm2证书申请及应用方法
KR102124413B1 (ko) * 2013-12-30 2020-06-19 삼성에스디에스 주식회사 아이디 기반 키 관리 시스템 및 방법
US8743758B1 (en) 2013-11-27 2014-06-03 M87, Inc. Concurrent uses of non-cellular interfaces for participating in hybrid cellular and non-cellular networks
CN111669842B (zh) 2013-12-13 2023-08-15 艾姆巴奇公司 用于连结混合的蜂窝网络和非蜂窝网络的方法和系统
GB2526367A (en) * 2014-05-23 2015-11-25 Ibm Password-based authentication
CN107800538B (zh) * 2016-09-01 2021-01-29 中电长城(长沙)信息技术有限公司 一种自助设备远程密钥分发方法
KR101776172B1 (ko) * 2017-02-14 2017-09-07 주식회사 유니온플레이스 사물 인터넷 장치
CN109218016B (zh) * 2017-07-06 2020-05-26 北京嘀嘀无限科技发展有限公司 数据传输方法及装置、服务器、计算机设备和存储介质
CN111600711A (zh) 2017-07-06 2020-08-28 北京嘀嘀无限科技发展有限公司 一种细粒度移动访问的加密、解密系统及加密、解密方法
CN109474913B (zh) * 2017-09-06 2021-01-15 中国移动通信有限公司研究院 一种多跳传输方法和装置
WO2019127145A1 (zh) * 2017-12-27 2019-07-04 福建联迪商用设备有限公司 一种公私钥对获取方法、系统和pos终端
CN108829539A (zh) * 2018-06-08 2018-11-16 中国联合网络通信集团有限公司 数据备份、数据恢复方法及设备
US11178540B2 (en) * 2018-10-31 2021-11-16 Cisco Technology, Inc. Enabling secure beacon telemetry broadcasts based on battery power state of a beacon device
CN109831799A (zh) * 2019-02-28 2019-05-31 中国科学院国家空间科学中心 一种高动态无线移动自组织网络组网方法
US11632672B2 (en) * 2019-12-30 2023-04-18 Texas Instruments Incorporated Systems and methods to support data privacy over a multi-hop network
CN119012189B (zh) * 2024-10-09 2025-08-08 北京中鼎昊硕科技有限责任公司 一种密钥管理方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060023887A1 (en) * 2004-04-02 2006-02-02 Agrawal Dharma P Threshold and identity-based key management and authentication for wireless ad hoc networks
JP2007208410A (ja) * 2006-01-31 2007-08-16 Hitachi Ltd Ｉｄベース暗号通信システム
CN101039182A (zh) * 2007-03-07 2007-09-19 广东南方信息安全产业基地有限公司 认证系统及用户标识证书发放方法
CN101222325A (zh) * 2008-01-23 2008-07-16 西安西电捷通无线网络通信有限公司 一种基于id的无线多跳网络密钥管理方法

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2000038392A2 (en) 1998-12-23 2000-06-29 Nortel Networks Limited Apparatus and method for distributing authentication keys to network devices in a multicast
JP2001320356A (ja) * 2000-02-29 2001-11-16 Sony Corp 公開鍵系暗号を使用したデータ通信システムおよびデータ通信システム構築方法
US7194622B1 (en) * 2001-12-13 2007-03-20 Cisco Technology, Inc. Network partitioning using encryption
US20030211842A1 (en) * 2002-02-19 2003-11-13 James Kempf Securing binding update using address based keys
CN1655498A (zh) * 2004-02-10 2005-08-17 管海明 一种多中心的基于身份的密钥管理方法
CN100373843C (zh) 2004-03-23 2008-03-05 中兴通讯股份有限公司 一种无线局域网中密钥协商方法
CN1225942C (zh) 2004-11-04 2005-11-02 西安西电捷通无线网络通信有限公司 一种改善无线ip系统移动终端越区切换性能的方法
CN1262087C (zh) * 2005-01-14 2006-06-28 南相浩 基于标识的密钥产生方法
KR20070048431A (ko) 2005-11-04 2007-05-09 삼성전자주식회사 무선 멀티-홉 네트워크에서 안정적 라우팅 장치 및 방법
US7499547B2 (en) * 2006-09-07 2009-03-03 Motorola, Inc. Security authentication and key management within an infrastructure based wireless multi-hop network
CN1921384A (zh) * 2006-09-12 2007-02-28 上海交通大学 一种公钥基础设施系统、局部安全设备及运行方法
CN101068143B (zh) 2007-02-12 2012-04-11 中兴通讯股份有限公司 一种网络设备认证方法
CN101056177B (zh) * 2007-06-01 2011-06-29 清华大学 基于无线局域网安全标准wapi的无线网状网重认证方法
US20100290622A1 (en) * 2008-01-18 2010-11-18 Koninklijke Philips Electronics N.V. Wireless communication system and method for automatic node and key revocation
CN101222772B (zh) 2008-01-23 2010-06-09 西安西电捷通无线网络通信有限公司 一种基于id的无线多跳网络认证接入方法
JP5589410B2 (ja) * 2010-01-29 2014-09-17 沖電気工業株式会社 通信システム及び通信装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060023887A1 (en) * 2004-04-02 2006-02-02 Agrawal Dharma P Threshold and identity-based key management and authentication for wireless ad hoc networks
JP2007208410A (ja) * 2006-01-31 2007-08-16 Hitachi Ltd Ｉｄベース暗号通信システム
CN101039182A (zh) * 2007-03-07 2007-09-19 广东南方信息安全产业基地有限公司 认证系统及用户标识证书发放方法
CN101222325A (zh) * 2008-01-23 2008-07-16 西安西电捷通无线网络通信有限公司 一种基于id的无线多跳网络密钥管理方法

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102098672A (zh) * 2011-03-16 2011-06-15 北京邮电大学 密钥信息的传递方法与系统、发送端及接收端

Also Published As

Publication number Publication date
KR20100113581A (ko) 2010-10-21
KR101173770B1 (ko) 2012-08-13
CN101222325B (zh) 2010-05-12
EP2247130A1 (en) 2010-11-03
EP2247130A4 (en) 2014-06-11
EP2247130B1 (en) 2018-09-19
US20100299519A1 (en) 2010-11-25
CN101222325A (zh) 2008-07-16
US8688974B2 (en) 2014-04-01

Similar Documents

Publication Publication Date Title
KR101173770B1 (ko) 무선 멀티?홉 네트워크 키를 관리하는 방법
RU2446606C1 (ru) Способ доступа с аутентификацией и система доступа с аутентификацией в беспроводной многоскачковой сети
CN101222772B (zh) 一种基于id的无线多跳网络认证接入方法
CN101222331B (zh) 一种认证服务器及网状网中双向认证的方法及系统
US7760885B2 (en) Method of distributing encryption keys among nodes in mobile ad hoc network and network device using the same
CN1977513B (zh) 用于有效认证医疗无线自组网节点的系统和方法
CN109428874B (zh) 基于服务化架构的注册方法及装置
WO2019183032A1 (en) Dynamic domain key exchange for authenticated device to device communications
JP2021519529A5 (zh)
WO2009103214A1 (zh) 网络认证通信方法及网状网络系统
WO2023246753A1 (zh) 通信方法和装置
CN101420686A (zh) 基于密钥的工业无线网络安全通信实现方法
CN103731819B (zh) 一种无线传感器网络节点的认证方法
Wang et al. Puncturable registered abe for vehicular social networks: Enhancing security and practicality
Daza et al. Cryptographic techniques for mobile ad-hoc networks
EP4250641A1 (en) Method, devices and system for performing key management
Hoeper et al. Pre-authentication and authentication models in ad hoc networks
CN1301608C (zh) 中心认证的对等无线局域网的实现方法
Cao Design issues in “a secure and efficient key agreement framework for critical energy infrastructure using mobile device”
Zhou et al. A novel group key establishment scheme for MANETs
WO2026098019A1 (zh) 访问权限管理方法、装置及存储介质
Li et al. A trust cluster based key management protocol for ad hoc networks
CN121511578A (zh) 一种用户级同态加密管理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09706489

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 12864317

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2009706489

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 20107018359

Country of ref document: KR

Kind code of ref document: A