CN108600240B - Communication system and communication method thereof - Google Patents

Abstract

The present invention provides a communication system and a communication method thereof, comprising: at least one vehicle and at least one fog node; the vehicle is used for signing the first service request with an asymmetric vehicle private key when receiving the first service request sent by the user , send the vehicle digital certificate and the signed first service request to the fog node; receive and verify the fog node digital certificate sent by the fog node and the signed first receipt information; when the verification is passed, obtain the decrypted first receipt information; The fog node is used to receive and verify the vehicle digital certificate sent by the vehicle and the first service request after the signature. When the verification is passed, the first receipt information is generated, and the pre-acquired private key of the asymmetric fog node is used to sign the first receipt information. The fog node digital certificate and the signed first receipt information are sent to the vehicle. This solution can improve the safety of communication between vehicles and fog nodes.

Description

A communication system and communication method thereof

technical field

The invention relates to the field of fog computing and Internet of Vehicles security, in particular to a communication system and a communication method thereof

Background technique

As a part of smart transportation, the Internet of Vehicles provides a development direction for solving urban traffic problems. In recent years, with the explosive growth of the number of vehicles and the data of the Internet of Vehicles, cloud computing network bandwidth resources will be seriously insufficient, and the mobility and low-latency characteristics of the Internet of Vehicles cannot be met. The emergence of fog nodes has greatly improved this situation.

At present, fog nodes are deployed at the edge of the network and have the characteristics of location awareness and low latency, making them better applicable to the Internet of Vehicles. However, as a mobile node in the Internet of Vehicles, the vehicle can only communicate with the fog node through the wireless mobile network. Compared with the traditional network channel, the security is worse and it is more vulnerable to attack. If the vehicle end receives a malicious attack, it is easy to leak its own privacy. After the fog node is attacked, other vehicles it serves will face the threat of information leakage, and even the upper cloud environment connected to the fog node will be affected, resulting in low security of communication between the vehicle and the fog node.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a communication system and a communication method thereof, which can improve the safety of communication between vehicles and fog nodes.

In a first aspect, an embodiment of the present invention provides a communication system, including:

at least one vehicle and at least one fog node;

Each of the vehicles is configured to, when receiving the first service request sent by the user, use the pre-acquired asymmetric vehicle private key to sign the first service request, and sign the pre-acquired vehicle digital certificate and the signed first service request. The service request is sent to the fog node; when receiving the fog node digital certificate and the signed first receipt information sent by the fog node, verify the fog node digital certificate and the signed first receipt information; when the verification passes , obtain the decrypted first receipt information;

Each fog node is configured to, when receiving the vehicle digital certificate and the signed first service request sent by the vehicle, verify the vehicle digital certificate and the signed first service request, and when the verification passes When generating the first receipt information, use the pre-obtained asymmetric fog node private key to sign the first receipt information, and send the pre-acquired fog node digital certificate and the signed first receipt information to the vehicle .

Preferably, it further includes: a certificate authority CA center;

The vehicle is used to send a vehicle certificate application carrying vehicle identity information to the CA center in advance, and receive the vehicle digital certificate and the asymmetric vehicle private key sent by the CA center;

The fog node is used to send the fog node certificate application carrying the fog node identity information to the CA center in advance, and receive the fog node digital certificate and the asymmetric fog node private key sent by the CA center;

The CA center is used to generate the vehicle digital certificate and the asymmetric vehicle private information by using the vehicle identity information according to the preset encryption rules when receiving the vehicle certificate application carrying the vehicle identity information sent by the vehicle. send the vehicle digital certificate and the asymmetric vehicle private key to the vehicle; when receiving the fog node certificate application carrying the fog node identity information sent by the fog node, according to the encryption rules, use the The fog node identity information generates the fog node digital certificate and the asymmetric fog node private key, and sends the fog node digital certificate and the asymmetric fog node private key to the fog node.

Preferably, the CA center is further configured to publish a pre-generated center public key;

The vehicle is used to determine whether the central public key can decrypt the fog node digital certificate, and if so, obtain the fog node public key in the decrypted fog node digital certificate; decrypt using the fog node public key The first receipt information after signing;

The fog node is used to determine whether the central public key can decrypt the vehicle digital certificate, and if so, obtain the vehicle public key in the decrypted vehicle digital certificate; use the vehicle public key to decrypt the signed vehicle public key. the first service request.

Preferably, the vehicle is further configured to generate a symmetric root key according to a preset key rule when receiving a re-service request sent by the user; and use the asymmetric vehicle private key to generate a symmetric root key for the symmetric root key. encrypt the key and the re-service request to generate key agreement information; send the key agreement information to the fog node; when receiving the encrypted re-receipt information sent by the fog node, use the symmetric The root key decrypts the encrypted re-receipt information, and obtains the decrypted re-receipt information;

The fog node is further configured to decrypt the key agreement information by using the vehicle public key when receiving the key agreement information of the vehicle, and obtain the symmetric root key and the re-service request; generating re-receipt information corresponding to the re-service request; encrypting the re-receipt information by using the symmetric root key; and sending the encrypted re-receipt information to the vehicle.

Preferably, the vehicle is further configured to determine whether the encrypted re-receipt information is received within a preset time limit, and if so, when a subsequent service request sent by the user is received, use the symmetric root The key encrypts the subsequent service request, generates new communication information, and sends the new communication information to the fog node; otherwise, when the subsequent service request is received, a new symmetric root key is generated according to the key rule , encrypt the new symmetric root key and the subsequent service request with the asymmetric vehicle private key, generate the new communication information, and send the new communication information to the fog node, so that the The fog node sends corresponding subsequent receipt information according to the new communication information.

Preferably, the fog node is further configured to preset a service user list, which includes the vehicle digital certificate, the vehicle public key, the last service time of the vehicle, the symmetric root key and the symmetric root key. The time limit of the key is recorded in the service user list; when the new communication information is received, execute:

S0: determine whether there is a symmetric root key corresponding to the vehicle in the service user list, if so, execute S1, otherwise, execute S3;

S1: According to the last service time and the time limit, determine whether the symmetric root key is valid, if so, execute S2, otherwise, execute S3;

S2: decrypt the new communication information by using the symmetric root key, and update the last service time in the service user list;

S3: Decrypt the new communication information by using the vehicle public key, and delete the symmetric root key and the time limit of the symmetric root key in the service user list.

Preferably, the CA center is further configured to publish a pre-generated certificate revocation list;

The fog node is further configured to, when receiving the vehicle digital certificate and the signed first service request sent by the vehicle, determine whether the vehicle digital certificate is in the certificate revocation list, and if so, cancel it This communication, otherwise, execute the first service request after verifying the vehicle digital certificate and the signature.

In a second aspect, an embodiment of the present invention provides a communication method based on any one of the communication systems described in the first aspect, including:

Each vehicle in the at least one vehicle, when receiving the first service request sent by the user, signs the first service request with the pre-acquired asymmetric vehicle private key, and converts the pre-acquired vehicle digital certificate and the signed said service request. The first service request is sent to the fog node; when receiving the fog node digital certificate and the signed first receipt information sent by the fog node, verify the fog node digital certificate and the signed first receipt information; when verifying When passed, obtain the decrypted first receipt information;

Each of the at least one fog node, when receiving the vehicle digital certificate and the signed first service request sent by the vehicle, verifies the vehicle digital certificate and the signed first service request. Service request, when the verification is passed, generate the first receipt information, use the pre-obtained asymmetric fog node private key to sign the first receipt information, and sign the pre-acquired fog node digital certificate and the signed first receipt. information is sent to the vehicle.

Preferably, before using the pre-acquired asymmetric vehicle private key to sign the first service request, the method further includes:

The vehicle sends a vehicle certificate application carrying vehicle identity information to the CA center in advance, and receives the vehicle digital certificate and asymmetric vehicle private key sent by the CA center;

Before using the pre-acquired private key of the asymmetric fog node to sign the first receipt information, the method further includes:

The fog node sends the fog node certificate application carrying the fog node identity information to the CA center in advance, and receives the fog node digital certificate and the asymmetric fog node private key sent by the CA center;

When the CA center receives the vehicle certificate application carrying the vehicle identity information sent by the vehicle, it generates the vehicle digital certificate and the asymmetric vehicle private key by using the vehicle identity information according to the preset encryption rules, and converts the The vehicle digital certificate and the asymmetric vehicle private key are sent to the vehicle; when the fog node certificate application carrying the fog node identity information sent by the fog node is received, the fog node is used according to the encryption rule. The identity information generates the fog node digital certificate and the asymmetric fog node private key, and sends the fog node digital certificate and the asymmetric fog node private key to the fog node.

Preferably, before the sending the vehicle digital certificate and the asymmetric vehicle private key to the vehicle, the method further includes:

The CA center publishes a pre-generated certificate revocation list;

When receiving the vehicle digital certificate and the signed first service request sent by the vehicle, the fog node determines whether the vehicle digital certificate is in the certificate revocation list, and if so, cancels this communication, Otherwise, the first service request after the verification of the vehicle digital certificate and the signature is performed.

In the embodiment of the present invention, before the vehicle interacts with the fog node, both parties in the communication need to obtain their respective digital certificates, so that when the fog node interacts with the vehicle, it can determine whether the identity of the vehicle is legal according to the vehicle digital certificate. , send the fog node digital certificate and the corresponding first receipt information to the vehicle, so that the vehicle can determine whether the identity of the fog node is legal according to the fog node digital certificate, and if and only when the identity of the fog node is determined to be legal, obtain the first time sent by the fog node. Receipt information. To sum up, it can be seen that sending the vehicle digital certificate to the external fog node and receiving the fog node digital certificate sent by the external fog node can enable both parties to use the digital certificate as a credential for the identity authentication of both parties to determine the legitimacy of the identities of the two parties in communication, thereby improving the vehicle quality. The security of communicating with fog nodes.

Description of drawings

In order to illustrate the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are For some embodiments of the present invention, for those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

1 is a schematic structural diagram of a communication system according to an embodiment of the present invention;

FIG. 2 is a schematic structural diagram of another communication system provided by an embodiment of the present invention;

3 is a schematic structural diagram of another communication system provided by an embodiment of the present invention;

FIG. 4 is a flowchart of a communication method of a communication system provided by an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work are protected by the present invention. scope.

As shown in FIG. 1, an embodiment of the present invention provides a communication system, including: at least one vehicle 101 and at least one fog node 102;

Each of the vehicles 101 is configured to, when receiving the first service request sent by the user, sign the first service request with a pre-acquired asymmetric vehicle private key, and sign the pre-acquired vehicle digital certificate and the signed The first service request is sent to the fog node 102; when receiving the fog node digital certificate and the signed first receipt information sent by the fog node 102, verify the fog node digital certificate and the signed first receipt information; When the verification is passed, obtain the decrypted first receipt information;

Each fog node 102 is configured to, when receiving the vehicle digital certificate and the signed first service request sent by the vehicle 101, verify the vehicle digital certificate and the signed first service request, when When the verification is passed, generate the first receipt information, use the pre-acquired private key of the asymmetric fog node to sign the first receipt information, and send the pre-acquired fog node digital certificate and the signed first receipt information to the Described vehicle 101.

In the embodiment of the present invention, before the vehicle interacts with the fog node, both parties in the communication need to obtain their respective digital certificates, so that when the fog node interacts with the vehicle, it can determine whether the identity of the vehicle is legal according to the vehicle digital certificate. , send the fog node digital certificate and the corresponding first receipt information to the vehicle, so that the vehicle can determine whether the identity of the fog node is legal according to the fog node digital certificate, and if and only when the identity of the fog node is determined to be legal, obtain the first time sent by the fog node. Receipt information. To sum up, it can be seen that sending the vehicle digital certificate to the external fog node and receiving the fog node digital certificate sent by the external fog node can enable both parties to use the digital certificate as a credential for the identity authentication of both parties to determine the legitimacy of the identities of the two parties in communication, thereby improving the vehicle quality. The security of communicating with fog nodes.

Based on the communication system shown in FIG. 1, as shown in FIG. 2, in an embodiment of the present invention, the communication system further includes: a certificate authority CA center 201;

The vehicle 101 is used to send a vehicle certificate application carrying vehicle identity information to the CA center 201 in advance, and receive the vehicle digital certificate and asymmetric vehicle private key sent by the CA center 201;

The fog node 102 is configured to send the fog node certificate application carrying the fog node identity information to the CA center 201 in advance, and receive the fog node digital certificate and the asymmetric fog node private key sent by the CA center 201;

The CA center 201 is configured to, when receiving a vehicle certificate application carrying vehicle identity information sent by the vehicle 101, use the vehicle identity information to generate the vehicle digital certificate and the asymmetric vehicle according to a preset encryption rule. vehicle private key, send the vehicle digital certificate and the asymmetric vehicle private key to the vehicle 101; when receiving the fog node certificate application carrying the fog node identity information sent by the fog node 102, according to the encryption According to the rules, the fog node digital certificate and the asymmetric fog node private key are generated by using the fog node identity information, and the fog node digital certificate and the asymmetric fog node private key are sent to the fog node 102 .

In the embodiment of the present invention, before the vehicle and the fog node interact, respectively apply for a certificate application to the trusted CA center, so that the CA center can issue their own digital certificates for the vehicle and the fog node respectively, so that both parties in the communication use the digital certificate as the digital certificate. Credentials for identity authentication of both parties in communication, so as to achieve the purpose of improving the security of communication between vehicles and fog nodes.

In an embodiment of the present invention, the CA center is further configured to publish a pre-generated center public key;

The vehicle is used to determine whether the central public key can decrypt the fog node digital certificate, and if so, obtain the fog node public key in the decrypted fog node digital certificate; decrypt using the fog node public key The first receipt information after signing;

The fog node is used to determine whether the central public key can decrypt the vehicle digital certificate, and if so, obtain the vehicle public key in the decrypted vehicle digital certificate; use the vehicle public key to decrypt the signed vehicle public key. the first service request.

In the embodiment of the present invention, since the private key of the asymmetric vehicle is at the vehicle and the private key of the asymmetric fog node is at the fog node, others cannot obtain the private key of the asymmetric vehicle and the private key of the asymmetric fog node. When the nodes exchange information, the asymmetric vehicle private key is used to sign the interaction information, and when the fog node exchanges information with the vehicle, the asymmetric fog node private key is used to sign the interaction information, so that others cannot forge the signed interaction information. When both parties of the communication determine that the corresponding interaction information can be decrypted, the identity of the other party can be determined to be legal. When the other party is determined to be legal, the interaction can prevent the information of the two parties from being stolen, thereby improving the security of the communication between the vehicle and the fog node. .

In an embodiment of the present invention, the vehicle is further configured to generate a symmetric root key according to a preset key rule when receiving a re-service request sent by the user; using the asymmetric vehicle private key pair encrypting the symmetric root key and the re-service request to generate key agreement information; sending the key agreement information to the fog node; when receiving the encrypted re-receipt information sent by the fog node , using the symmetric root key to decrypt the encrypted re-receipt information to obtain the decrypted re-receipt information;

The fog node is further configured to decrypt the key agreement information by using the vehicle public key when receiving the key agreement information of the vehicle, and obtain the symmetric root key and the re-service request; generating re-receipt information corresponding to the re-service request; encrypting the re-receipt information by using the symmetric root key; and sending the encrypted re-receipt information to the vehicle.

In the embodiment of the present invention, after the mutual authentication of the digital certificate between the two communicating parties, the vehicle needs to perform key negotiation with the fog node, so that the negotiated symmetric root key is used to encrypt the mutual information. Using the symmetric root key to encrypt the interactive information can not only improve the security of the communication between the vehicle and the fog node, but also improve the speed of encrypting the interactive information.

In an embodiment of the present invention, the vehicle is further configured to determine whether the encrypted re-receipt information is received within a preset time limit, and if so, when receiving a follow-up service request sent by the user, Use the symmetric root key to encrypt the subsequent service request, generate new communication information, and send the new communication information to the fog node; otherwise, when the subsequent service request is received, generate new communication information according to the key rule a new symmetric root key, encrypting the new symmetric root key and the subsequent service request with the asymmetric vehicle private key, generating the new communication information, and sending the new communication information to the fog node , so that the fog node sends the corresponding subsequent receipt information according to the new communication information.

In the embodiment of the present invention, after the vehicle receives the encrypted re-receipt information sent by the fog node, the vehicle needs to determine whether to use the symmetric root key for authentication within the preset time limit. The fog node public key renegotiates a new symmetric root key to improve the security of the communication between the vehicle and the fog node.

In an embodiment of the present invention, the fog node is further configured to preset a service user list, which includes the vehicle digital certificate, the vehicle public key, the last service time of the vehicle, the symmetric root key and the The time limit of the symmetric root key is recorded in the service user list; when the new communication information is received, execute:

S0: determine whether there is a symmetric root key corresponding to the vehicle in the service user list, if so, execute S1, otherwise, execute S3;

S1: According to the last service time and the time limit, determine whether the symmetric root key is valid, if so, execute S2, otherwise, execute S3;

S2: decrypt the new communication information by using the symmetric root key, and update the last service time in the service user list;

S3: Decrypt the new communication information by using the vehicle public key, and delete the symmetric root key and the time limit of the symmetric root key in the service user list.

In the embodiment of the present invention, after determining that the identity of the vehicle is legal, the fog node needs to record the identity information of the vehicle, for example, the vehicle ID, the vehicle digital certificate, and the vehicle public key into the preset service user list, so that it can be used again with the vehicle. When the vehicle interacts, the legality of the vehicle identity is determined again according to the information recorded in the service user list.

In an embodiment of the present invention, the CA center is further configured to publish a pre-generated certificate revocation list;

The fog node is further configured to, when receiving the vehicle digital certificate and the signed first service request sent by the vehicle, determine whether the vehicle digital certificate is in the certificate revocation list, and if so, cancel it This communication, otherwise, execute the first service request after verifying the vehicle digital certificate and the signature.

In the embodiment of the present invention, when the fog node determines that the vehicle digital certificate of the vehicle is legal, it also needs to determine whether the vehicle digital certificate is valid according to the certificate revocation list. When it is determined that the identity of the vehicle is both legal and valid, information interaction with the vehicle can reduce the probability of the fog node being attacked, thereby improving the security of the communication between the fog node and the vehicle.

In order to more clearly illustrate the technical solutions and advantages of the present invention, a communication system provided by an embodiment of the present invention is described in detail, as shown in FIG. 3 , including:

The vehicle 301 is used to send the vehicle certificate application carrying the vehicle identity information to the CA center 302 in advance, and receive the vehicle digital certificate and the asymmetric vehicle private key sent by the CA center 302 according to the vehicle certificate application.

Specifically, before the vehicle interacts with the fog node, it needs to apply for a vehicle digital certificate from the CA center, so that when interacting with the fog node, the fog node can determine whether the identity of the vehicle is legal through the vehicle digital certificate. When it is legal, it will interact with the fog node, so as to achieve the purpose of improving the security of the communication between the vehicle and the fog node.

The fog node 303 is configured to send the fog node certificate application carrying the fog node identity information to the CA center 302 in advance, and receive the fog node digital certificate and the asymmetric fog node private key sent by the CA center 302 according to the fog node certificate application.

Specifically, before the fog node interacts with the vehicle, it needs to apply to the CA center for a fog node digital certificate, so that when interacting with the vehicle, the vehicle can determine whether the identity of the fog node is legal through the fog node digital certificate. Interacting with the vehicle when it is legal can improve the security of the communication between the vehicle and the fog node.

The CA center 302 is used to publish the pre-generated public key of the center. When receiving the vehicle certificate application sent by the vehicle 301, according to the preset encryption rules, use the vehicle identity information in the vehicle certificate application to generate the vehicle digital certificate and the asymmetric vehicle private key, send the vehicle digital certificate and the asymmetric vehicle private key to the vehicle 301; when receiving the fog node certificate application sent by the fog node 303, according to the encryption rules, use the fog node identity information in the fog node certificate application to generate the fog node The digital certificate and the private key of the asymmetric fog node, the fog node digital certificate and the private key of the asymmetric fog node are sent to the fog node 303 .

Specifically, the CA center sends the fog node digital certificate and the asymmetric fog node private key to the fog node, and sends the vehicle digital certificate and the asymmetric vehicle private key to the vehicle, which can not only improve the security of communication when the two communicating parties exchange information It can also make the communication parties use the digital certificate as the credential for the authentication of the two parties.

The vehicle 301 is configured to encrypt the first service request with the asymmetric vehicle private key when receiving the first service request sent by the user, and send the encrypted first service request and the vehicle digital certificate to the fog node 303 .

Specifically, using the asymmetric vehicle private key to encrypt the first service request can improve the security of transmitting the first service request, and sending the vehicle digital certificate can enable the fog node to determine whether the vehicle's identity is legal through the digital certificate.

The fog node 303 is used to determine whether the central public key can decrypt the vehicle digital certificate when receiving the encrypted first service request and the vehicle digital certificate sent by the vehicle 301, and if so, obtain the vehicle public key in the decrypted vehicle digital certificate. According to the certificate revocation list pre-published by the CA center 302, determine whether the vehicle digital certificate is revoked, if so, cancel this communication, otherwise, use the vehicle public key to decrypt the signed first service request, and generate and first service request For the corresponding first receipt information, use the private key of the asymmetric fog node to sign the first receipt information, and send the signed first receipt information and the public key of the fog node to the vehicle 301 .

Specifically, after receiving the vehicle digital certificate, the fog node verifies the authenticity of the vehicle digital certificate, and can determine whether the identity of the vehicle is legal, and then interacts with the vehicle if and only when the identity of the vehicle is legal. Sending the fog node digital certificate to the vehicle can enable the vehicle to verify whether the identity of the fog node is legal through the fog node digital certificate, thereby achieving the purpose of improving the security of the communication between the fog node and the vehicle.

The vehicle 301 is used to determine whether the central public key can decrypt the fog node digital certificate when receiving the signed first receipt information and the fog node digital certificate sent by the fog node 303, and if so, obtain the decrypted fog node digital certificate. the public key of the fog node, decrypt the signed first receipt information with the fog node public key, obtain the decrypted first receipt information, and execute the first receipt information; when receiving the re-service request sent by the user, according to the preset key The rules generate a symmetric root key, use the asymmetric vehicle private key to encrypt the symmetric root key and the re-service request, generate key negotiation information, and send the key negotiation information to the fog node 303 .

Specifically, when the vehicle determines that the identity of the fog node is legal, it needs to generate a symmetric root key, and send the symmetric root key to the fog node, so that both parties can complete the key negotiation and improve the communication security between the vehicle and the fog node. On the basis, improve the speed when encrypting interactive information.

The fog node 303 is configured to decrypt the key negotiation information by using the vehicle public key when receiving the key negotiation information sent by the vehicle 301, and obtain the symmetric root key in the decrypted key negotiation and the service request again; For the re-receipt information corresponding to the service request, the re-receipt information is encrypted by using the symmetric root key, and the encrypted re-receipt information is sent to the vehicle 301 .

Specifically, after completing the key negotiation with the vehicle, the fog node encrypts the re-receipt information with the symmetric root key obtained through the key negotiation, so as to improve the encryption speed on the basis of improving the security of communication with the vehicle.

The vehicle 301 is configured to, when receiving the encrypted re-receipt information sent by the fog node 303, use the symmetric root key to decrypt the encrypted re-receipt information, obtain the decrypted re-receipt information, execute the re-receipt information, and execute the :

Determine whether the encrypted re-receipt information is received within a preset time limit;

If yes, when receiving the subsequent service request sent by the user, encrypt the subsequent service request with the symmetric root key, and send the encrypted subsequent service request to the fog node 303;

Otherwise, when subsequent service requests are made, a new symmetric root key is generated according to the key rules, and the new symmetric root key and subsequent service requests are encrypted with the asymmetric vehicle private key to generate communication information, and send the communication information to the fog node 303.

Specifically, after the vehicle completes the key negotiation with the fog node, it needs to determine whether to use the symmetric root key for authentication within a preset time limit, that is, use the symmetric root key to decrypt the exchanged information, and if so, continue to use the symmetric root key for authentication. Otherwise, in order to prevent the symmetric root key from being acquired by others, a new symmetric root key needs to be created and a new key negotiation is performed.

To sum up, the identity process of fog node authentication vehicle is as follows:

A: When the vehicle sends identity information to the fog node, the identity information includes the vehicle digital certificate or symmetric root key.

B: When the fog node receives the identity information, it determines whether the vehicle is in the service user list. If the vehicle is in the service user list:

Determine if the symmetric root key in the service user list is still valid

If valid, authenticate the vehicle with the symmetric root key, and execute D.

If invalid, use the vehicle public key in the service user list to authenticate the vehicle, and execute D.

C: If the vehicle is not in the service user list, authenticate the vehicle digital certificate through the central public key.

D: Query the certificate revocation list to determine the validity of the vehicle digital certificate.

E: The authentication is over, and the fog node updates the service user list.

As shown in FIG. 4 , an embodiment of the present invention provides a communication method for a communication system as described in any of the foregoing embodiments, and the method may include the following steps:

Step 401: Each vehicle in at least one vehicle, when receiving the first service request sent by the user, signs the first service request with the pre-acquired asymmetric vehicle private key, and signs the pre-acquired vehicle digital certificate and the signed service request. The first service request is sent to the fog node; when receiving the fog node digital certificate and the signed first receipt information sent by the fog node, verify the fog node digital certificate and the signed first receipt information. ; When the verification is passed, obtain the decrypted first receipt information;

Step 402: Each of the at least one fog node, when receiving the vehicle digital certificate and the signed first service request sent by the vehicle, verifies the vehicle digital certificate and the signed service request. For the first service request, when the verification is passed, the first receipt information is generated, the first receipt information is signed with the pre-acquired private key of the asymmetric fog node, and the pre-acquired fog node digital certificate and the signed all information are signed. The first receipt information is sent to the vehicle.

In the embodiment of the present invention, before the vehicle interacts with the fog node, both parties in the communication need to obtain their respective digital certificates, so that when the fog node interacts with the vehicle, it can determine whether the identity of the vehicle is legal according to the vehicle digital certificate. , send the fog node digital certificate and the corresponding first receipt information to the vehicle, so that the vehicle can determine whether the identity of the fog node is legal according to the fog node digital certificate, and if and only when the identity of the fog node is determined to be legal, obtain the first time sent by the fog node. Receipt information. To sum up, it can be seen that sending the vehicle digital certificate to the external fog node and receiving the fog node digital certificate sent by the external fog node can enable both parties to use the digital certificate as a credential for the identity authentication of both parties to determine the legitimacy of the identities of the two parties in communication, thereby improving the vehicle quality. The security of communicating with fog nodes.

In an embodiment of the present invention, before using the pre-acquired asymmetric vehicle private key to sign the first service request, the method further includes:

The vehicle sends a vehicle certificate application carrying vehicle identity information to the CA center in advance, and receives the vehicle digital certificate and asymmetric vehicle private key sent by the CA center;

Before using the pre-acquired private key of the asymmetric fog node to sign the first receipt information, the method further includes:

The fog node sends the fog node certificate application carrying the fog node identity information to the CA center in advance, and receives the fog node digital certificate and the asymmetric fog node private key sent by the CA center;

When the CA center receives the vehicle certificate application carrying the vehicle identity information sent by the vehicle, it generates the vehicle digital certificate and the asymmetric vehicle private key by using the vehicle identity information according to the preset encryption rules, and converts the The vehicle digital certificate and the asymmetric vehicle private key are sent to the vehicle; when the fog node certificate application carrying the fog node identity information sent by the fog node is received, the fog node is used according to the encryption rule. The identity information generates the fog node digital certificate and the asymmetric fog node private key, and sends the fog node digital certificate and the asymmetric fog node private key to the fog node.

In an embodiment of the present invention, before the sending the vehicle digital certificate and the asymmetric vehicle private key to the vehicle, the method further includes:

The CA center publishes a pre-generated certificate revocation list;

When receiving the vehicle digital certificate and the signed first service request sent by the vehicle, the fog node determines whether the vehicle digital certificate is in the certificate revocation list, and if so, cancels this communication, Otherwise, the first service request after the verification of the vehicle digital certificate and the signature is performed.

Each embodiment of the present invention has at least the following beneficial effects:

1. In the first embodiment of the present invention, before the vehicle interacts with the fog node, both parties in the communication need to obtain their respective digital certificates, so that when the fog node interacts with the vehicle, it can determine whether the identity of the vehicle is legal according to the vehicle digital certificate, When it is determined to be legal, the fog node digital certificate and the corresponding first receipt information are sent to the vehicle, so that the vehicle can determine whether the identity of the fog node is legal according to the fog node digital certificate. The first receipt information sent by the node. To sum up, it can be seen that sending the vehicle digital certificate to the external fog node and receiving the fog node digital certificate sent by the external fog node can enable both parties to use the digital certificate as a credential for the identity authentication of both parties to determine the legitimacy of the identities of the two parties in communication, thereby improving the vehicle quality. The security of communicating with fog nodes.

2. In the first embodiment of the present invention, before the vehicle and the fog node interact, they apply for a certificate application to the trusted CA center respectively, so that the CA center can issue their own digital certificates for the vehicle and the fog node respectively, so that both parties can communicate with each other. The digital certificate is used as a credential for the identity authentication of both parties in the communication, so as to achieve the purpose of improving the security of the communication between the vehicle and the fog node.

3. In the first embodiment of the present invention, since the private key of the asymmetric vehicle is at the vehicle and the private key of the asymmetric fog node is at the fog node, others cannot obtain the private key of the asymmetric vehicle and the private key of the asymmetric fog node. Therefore, When the vehicle interacts with the fog node, the asymmetric vehicle private key is used to sign the interactive information, and when the fog node interacts with the vehicle, the asymmetric fog node private key is used to sign the interactive information, so that others cannot forge the signed information. Interaction information, when both parties of the communication determine that the corresponding interaction information can be decrypted, the identity of the other party can be determined to be legal. When the other party is determined to be legal, the interaction can prevent the information of the two parties from being stolen, thereby improving the efficiency of vehicles and fog nodes. Security of communications.

4. In the first embodiment of the present invention, after the mutual authentication of digital certificates between the two communicating parties, the vehicle needs to perform key negotiation with the fog node, so that the negotiated symmetric root key is used to encrypt the mutual information. Using the symmetric root key to encrypt the interactive information can not only improve the security of the communication between the vehicle and the fog node, but also improve the speed of encrypting the interactive information.

5. In the first embodiment of the present invention, after the vehicle receives the encrypted re-receipt information sent by the fog node, the vehicle needs to determine whether to use the symmetric root key for authentication within the preset time limit. , it is necessary to use the fog node public key to renegotiate a new symmetric root key, so as to improve the security of the communication between the vehicle and the fog node.

6. In the first embodiment of the present invention, after determining that the identity of the vehicle is legal, the fog node needs to record the identity information of the vehicle, for example, the vehicle ID, the vehicle digital certificate, and the vehicle public key into the preset service user list, So that when interacting with the vehicle again, the legality of the vehicle identity is determined again according to the information recorded in the service user list.

7. In the first embodiment of the present invention, when the fog node determines that the vehicle digital certificate of the vehicle is legal, it also needs to determine whether the vehicle digital certificate is valid according to the certificate revocation list. When it is determined that the identity of the vehicle is both legal and valid, information interaction with the vehicle can reduce the probability of the fog node being attacked, thereby improving the security of the communication between the fog node and the vehicle.

It should be noted that, in this document, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply a relationship between these entities or operations. There is no such actual relationship or sequence. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device that includes a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, the inclusion of an element by the phrase "comprising a..." does not preclude the presence of additional such elements in the process, method, article or apparatus that includes the element.

Finally, it should be noted that the above descriptions are only preferred embodiments of the present invention, and are only used to illustrate the technical solutions of the present invention, but not to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims (7)

1. A communication system, comprising: at least one vehicle and at least one fog node;

each vehicle is used for signing the first service request by using a pre-acquired asymmetric vehicle private key when receiving the first service request sent by a user, and sending a pre-acquired vehicle digital certificate and the signed first service request to a mist sending node; when a fog node digital certificate and signed first receipt information sent by the fog node are received, verifying the fog node digital certificate and the signed first receipt information; when the verification is passed, acquiring the decrypted first receipt information;

each fog node is used for verifying the vehicle digital certificate and the signed first service request when receiving the vehicle digital certificate and the signed first service request sent by the vehicle, generating the first receipt information when the verification is passed, signing the first receipt information by using a pre-obtained asymmetric fog node private key, and sending the pre-obtained fog node digital certificate and the signed first receipt information to the vehicle; further comprising: a Certificate Authority (CA) center;

the vehicle is used for sending a vehicle certificate application carrying vehicle identity information to the CA in advance, and receiving a vehicle digital certificate and an asymmetric vehicle private key sent by the CA;

the fog node is used for sending a fog node certificate application carrying fog node identity information to the CA center in advance and receiving a fog node digital certificate and an asymmetric fog node private key sent by the CA center;

the CA center is used for generating the vehicle digital certificate and the asymmetric vehicle private key by using the vehicle identity information according to a preset encryption rule when receiving a vehicle certificate application carrying vehicle identity information sent by the vehicle, and sending the vehicle digital certificate and the asymmetric vehicle private key to the vehicle; when a fog node certificate application carrying fog node identity information sent by the fog node is received, generating the fog node digital certificate and the asymmetric fog node private key by using the fog node identity information according to the encryption rule, and sending the fog node digital certificate and the asymmetric fog node private key to the fog node;

the CA center is further used for publishing a pre-generated center public key;

the vehicle is used for determining whether the central public key can decrypt the fog node digital certificate, and if so, acquiring a fog node public key in the decrypted fog node digital certificate; decrypting the signed first receipt information by using the fog node public key;

the fog node is used for determining whether the central public key can decrypt the vehicle digital certificate, and if so, acquiring the vehicle public key in the decrypted vehicle digital certificate; decrypting the signed first service request using the vehicle public key;

the vehicle is further used for generating a symmetric root key according to a preset key rule when receiving a re-service request sent by the user; encrypting the symmetric root key and the re-service request by using the asymmetric vehicle private key to generate key negotiation information; sending the key negotiation information to the fog node; when encrypted receipt information sent by the fog node is received, decrypting the encrypted receipt information by using the symmetric root key to obtain the decrypted receipt information;

the fog node is further configured to decrypt the key agreement information by using the vehicle public key when receiving the key agreement information of the vehicle, and obtain the symmetric root key and the re-service request; generating re-receipt information corresponding to the re-service request; encrypting the receipt information again by using the symmetric root key; and sending the encrypted receipt information to the vehicle.

2. The communication system of claim 1,

the vehicle is further used for determining whether the encrypted receipt information is received again within a preset time limit, if so, when a subsequent service request sent by the user is received, the subsequent service request is encrypted by using the symmetric root key, new communication information is generated, and the new communication information is sent to the fog node; otherwise, when the subsequent service request is received, generating a new symmetric root key according to the key rule, encrypting the new symmetric root key and the subsequent service request by using the asymmetric vehicle private key to generate new communication information, and sending the new communication information to the fog node so that the fog node sends corresponding subsequent receipt information according to the new communication information.

3. The communication system of claim 2,

the fog node is further configured to preset a service user list, and record the vehicle digital certificate, the vehicle public key, the last service time of the vehicle, the symmetric root key, and the time limit of the symmetric root key in the service user list; when the new communication information is received, performing:

s0: determining whether a symmetric root key corresponding to the vehicle exists in the service user list, if so, performing S1, otherwise, performing S3;

s1: determining whether the symmetric root key is valid according to the last service time and the time limit, if so, executing S2, otherwise, executing S3;

s2: decrypting the new communication information by using the symmetric root key, and updating the last service time in the service user list;

s3: and decrypting the new communication information by using the vehicle public key, and deleting the symmetric root key and the time limit of the symmetric root key in the service user list.

4. The communication system according to any of claims 2 to 3,

the CA center is further used for publishing a certificate revocation list generated in advance;

the fog node is further configured to, when receiving the vehicle digital certificate and the signed first service request sent by the vehicle, determine whether the vehicle digital certificate is on the certificate revocation list, and if so, cancel the communication this time, otherwise, execute the first service request after verifying the vehicle digital certificate and the signature.

5. A communication method based on the communication system of any one of claims 1 to 4, comprising:

each vehicle in at least one vehicle signs the first service request by using a pre-acquired asymmetric vehicle private key when receiving the first service request sent by a user, and sends a pre-acquired vehicle digital certificate and the signed first service request to a mist giving node; when a fog node digital certificate and signed first receipt information sent by the fog node are received, verifying the fog node digital certificate and the signed first receipt information; when the verification is passed, acquiring the decrypted first receipt information;

each of the at least one fog node verifies the vehicle digital certificate and the signed first service request when receiving the vehicle digital certificate and the signed first service request sent by the vehicle, generates the first receipt information when the verification is passed, signs the first receipt information by using a pre-obtained asymmetric fog node private key, and sends the pre-obtained fog node digital certificate and the signed first receipt information to the vehicle.

6. The communication system of claim 5,

prior to said signing said first service request with said pre-obtained asymmetric vehicle private key, further comprising:

the vehicle sends a vehicle certificate application carrying vehicle identity information to a CA center in advance, and receives a vehicle digital certificate and an asymmetric vehicle private key sent by the CA center;

before the signing the first receipt information by using the pre-acquired asymmetric fog node private key, further comprising:

the fog node sends a fog node certificate application carrying fog node identity information to the CA center in advance, and receives a fog node digital certificate and an asymmetric fog node private key sent by the CA center;

when the CA center receives a vehicle certificate application carrying vehicle identity information sent by the vehicle, the CA center generates the vehicle digital certificate and the asymmetric vehicle private key by using the vehicle identity information according to a preset encryption rule, and sends the vehicle digital certificate and the asymmetric vehicle private key to the vehicle; and when a fog node certificate application carrying fog node identity information sent by the fog node is received, generating the fog node digital certificate and the asymmetric fog node private key by using the fog node identity information according to the encryption rule, and sending the fog node digital certificate and the asymmetric fog node private key to the fog node.

7. The communication system of claim 6,

prior to said sending said vehicle digital certificate and said asymmetric vehicle private key to said vehicle, further comprising:

the CA center publishes a pre-generated certificate revocation list;

and when receiving the vehicle digital certificate and the signed first service request sent by the vehicle, the fog node determines whether the vehicle digital certificate is in the certificate revocation list, if so, cancels the communication, and otherwise, executes the first service request after verifying the vehicle digital certificate and the signature.

Images