基于工业物联网的分层多设备认证密钥协商协议

吴毅; 冯涛; 柳春岩; 苏春华

doi:10.11959/j.issn.2096-109x.2025044

您当前的位置：

首页 >

文章列表页 >

基于工业物联网的分层多设备认证密钥协商协议

专题：新型工业化网络安全 | 更新时间：2025-09-12

- 基于工业物联网的分层多设备认证密钥协商协议
- Hierarchical multi-device authentication and key agreement protocol for industrial IoT
- 网络与信息安全学报 2025年11卷第4期页码：86-106
- 作者机构：
  
  1.兰州理工大学计算机与通信学院，甘肃兰州 730050
  2.兰州理工大学经济与管理学院，甘肃兰州 730050
  3.日本会津大学计算机科学系，福岛会津若松 965-8580
- 作者简介：
  
  [ "吴毅（1999- ），男，甘肃景泰人，兰州理工大学博士生，主要研究方向为工业物联网安全、工控协议安全。" ]
  [ "冯涛（1970- ），男，甘肃临洮人，博士，兰州理工大学研究员、博士生导师，主要研究方向为网络与信息安全、区块链、工业互联网安全。" ]
  [ "柳春岩（1971- ），女，甘肃永靖人，兰州理工大学硕士生导师，主要研究方向为供应链管理。" ]
  [ "苏春华（1981- ），男，广西钦州人，博士，日本会津大学高级副教授、博士生导师，主要研究方向为密码分析、机器学习中的隐私保护技术和物联网安全与隐私。" ]
- 基金信息：
  
  国家自然科学基金(62162039);甘肃省重点研发计划(24YFFA016)
- DOI：10.11959/j.issn.2096-109x.2025044
  中图分类号： TP393
- 收稿：2025-01-09，
  
  修回：2025-05-16，
  
  纸质出版：2025-08-25
- 稿件说明：
移动端阅览
吴毅, 冯涛, 柳春岩, 等. 基于工业物联网的分层多设备认证密钥协商协议[J]. 网络与信息安全学报, 2025, 11(4): 86-106.

Format: WU Y, FENG T, LIU C Y, et al. Hierarchical multi-device authentication and key agreement protocol for industrial IoT[J]. Chinese Journal of Network and Information Security, 2025, 11(4): 86-106.
吴毅, 冯涛, 柳春岩, 等. 基于工业物联网的分层多设备认证密钥协商协议[J]. 网络与信息安全学报, 2025, 11(4): 86-106. DOI： 10.11959/j.issn.2096-109x.2025044.

Format: WU Y, FENG T, LIU C Y, et al. Hierarchical multi-device authentication and key agreement protocol for industrial IoT[J]. Chinese Journal of Network and Information Security, 2025, 11(4): 86-106. DOI： 10.11959/j.issn.2096-109x.2025044.

摘要

安全的认证密钥协商协议对确保工业物联网中设备节点及管理者身份的合法性、数据的机密性至关重要。然而，现有的认证密钥协商协议大多数只支持设备管理者与设备节点间一对一的密钥协商，当设备管理者需要与多个设备节点进行认证密钥协商时，此类一对一的认证密钥协商协议需要管理员重复与目标设备节点进行认证密钥协商操作，从而消耗大量的计算和通信资源。针对上述问题，提出了一种分层多设备认证密钥协商协议。首先，该协议利用椭圆曲线密码学和中国剩余定理，保证设备管理者能够一次性建立与多个设备节点间不同的会话密钥。其次，该协议采用对称同态加密技术，保证边缘节点在不知道秘密信息的前提下，帮助通信双方计算会话密钥。最后，基于随机谕言机模型和有色Petri网形式化方法对所提协议进行了安全性证明，并借助NS-3网络仿真软件模拟其在大规模设备接入场景下的通信过程，以评估其可扩展性。仿真结果表明，所提协议在保障高安全性的同时，面对大规模设备接入仍表现出良好的可扩展性与稳定性。

Abstract

A secure authentication key negotiation protocol was considered to be of vital importance for ensuring the legitimacy of device nodes and managers

as well as the confidentiality of data in the Industrial Internet of Things. However

most existing authentication key negotiation protocols were found to support only one-to-one key negotiation between device managers and device nodes. When a device manager needed to conduct authentication key negotiation with multiple device nodes

such one-to-one protocols required the administrator to repeatedly perform authentication and key negotiation operations with each target device node

thereby consuming substantial computing and communication resources. To overcome these challenges

a hierarchical multi-device authentication and key agreement protocol was proposed for industrial IoT environments. In the proposed protocol

the Chinese Remainder Theorem was employed to allow a device manager to establish multiple session keys simultaneously with different device nodes. In addition

symmetric homomorphic encryption was utilized to enable edge nodes to participate in session key computation without gaining access to the complete session key

thereby significantly reducing the risk of key exposure even if edge nodes were compromised. The security of the proposed protocol was formally analyzed using the random oracle model in conjunction with the Colored Petri Net method. Furthermore

the communication process of the protocol under large-scale device access scenarios was simulated using the NS-3 network simulation tool to assess its scalability. Simulation results demonstrate that the proposed protocol provides a high level of security and exhibits strong scalability and stability under large-scale device access conditions.

关键词

Keywords

references

陈曦 , 姜亚光 , 林昕 , 等 . 工业互联网蜜网技术综述 [J ] . 网络与信息安全学报 , 2024 , 10 ( 5 ): 23 - 38 .

CHEN X , JIANG Y G , LIN X , et al . Overview on industrial Internet honeynet technology [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 5 ): 23 - 38 .

XU H S , WU J , PAN Q Q , et al . A survey on digital twin for industrial Internet of things: applications, technologies and tools [J ] . IEEE Communications Surveys & Tutorials , 2023 , 25 ( 4 ): 2569 - 2598 .

BEHNKE I , AUSTAD H . Real-time performance of industrial IoT communication technologies: a review [J ] . IEEE Internet of Things Journal , 2024 , 11 ( 5 ): 7399 - 7410 .

AHMED S F , BIN ALAM M S , HOQUE M , et al . Industrial Internet of things enabled technologies, challenges, and future directions [J ] . Computers and Electrical Engineering , 2023 , 110 : 108847 .

CHAUDHARY S , MISHRA P K . DDoS attacks in industrial IoT: a survey [J ] . Computer Networks , 2023 , 236 : 110015 .

董裕民 , 张静 , 谢昌佐 , 等 . 云边端架构下边缘智能计算关键问题综述: 计算优化与计算卸载 [J ] . 电子与信息学报 , 2024 , 46 ( 3 ): 765 - 776 .

DONG Y M , ZHANG J , XIE C Z , et al . A survey of key issues in edge intelligent computing under cloud-edge-terminal architecture: computing optimization and computing offloading [J ] . Journal of Electronics & Information Technology , 2024 , 46 ( 3 ): 765 - 776 .

YOUNAN M , HOUSSEIN E H , ELHOSENY M , et al . Challenges and recommended technologies for the industrial Internet of things: a comprehensive review [J ] . Measurement , 2020 , 151 : 107198 .

TANGE K , DE DONNO M , FAFOUTIS X , et al . A systematic survey of Industrial Internet of things security: requirements and fog computing opportunities [J ] . IEEE Communications Surveys & Tutorials , 2020 , 22 ( 4 ): 2489 - 2520 .

伍高飞 , 袁紫依 , 孙思贤 , 等 . 云数据安全去重技术研究综述 [J ] . 密码学报 , 2023 , 10 ( 6 ): 1099 - 1117 .

WU G F , YUAN Z Y , SUN S X , et al . A survey on secure data deduplication techniques in cloud [J ] . Journal of Cryptologic Research , 2023 , 10 ( 6 ): 1099 - 1117 .

PATEL C , BASHIR A K , ALI ALZUBI A , et al . EBAKE-SE: a novel ECC-based authenticated key exchange between industrial IoT devices using secure element [J ] . Digital Communications and Networks , 2023 , 9 ( 2 ): 358 - 366 .

DIFFIE W , HELLMAN M E . New directions in cryptography [M ] // Democratizing Cryptography . New York : ACM , 2022 : 365 - 390 .

郑路 , 冯涛 , 苏春华 . 基于CPN的车载网络无证书匿名认证和密钥协商方案研究 [J ] . 通信学报 , 2024 , 45 ( 6 ): 101 - 116 .

ZHENG L , FENG T , SU C H . Research on certificateless anonymous authentication and key agreement scheme of vehicle network based on CPN [J ] . Journal on Communications , 2024 , 45 ( 6 ): 101 - 116 .

OLAKANMI O O , ODEYEMI K O . Faster and efficient cloud-server-aided data de-duplication scheme with an authenticated key agreement for industrial Internet-of-things [J ] . Internet of Things , 2021 , 14 : 100376 .

胡向东 , 唐玲玲 . 基于轻量级梯度提升机优化的工业互联网入侵检测方法 [J ] . 网络与信息安全学报 , 2023 , 9 ( 2 ): 46 - 55 .

HU X D , TANG L L . Method on intrusion detection for industrial Internet based on light gradient boosting machine [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 2 ): 46 - 55 .

LI X , NIU J W , BHUIYAN M Z A , et al . A robust ECC-based provable secure authentication protocol with privacy preserving for industrial Internet of things [J ] . IEEE Transactions on Industrial Informatics , 2018 , 14 ( 8 ): 3599 - 3609 .

LI X , PENG J Y , NIU J W , et al . A robust and energy efficient authentication protocol for industrial Internet of things [J ] . IEEE Internet of Things Journal , 2018 , 5 ( 3 ): 1606 - 1615 .

JIANG Q , ZHANG N , NI J B , et al . Unified biometric privacy preserving three-factor authentication and key agreement for cloud-assisted autonomous vehicles [J ] . IEEE Transactions on Vehicular Technology , 2020 , 69 ( 9 ): 9390 - 9401 .

ELDEFRAWY M H , PEREIRA N , GIDLUND M . Key distribution protocol for industrial Internet of things without implicit certificates [J ] . IEEE Internet of Things Journal , 2019 , 6 ( 1 ): 906 - 917 .

PATONICO S , BRAEKEN A , STEENHAUT K . Identity-based and anonymous key agreement protocol for fog computing resistant in the Canetti-Krawczyk security model [J ] . Wireless Networks , 2023 , 29 ( 3 ): 1017 - 1029 .

LEE T F , CHEN W Y . Lightweight fog computing-based authentication protocols using physically unclonable functions for Internet of medical things [J ] . Journal of Information Security and Applications , 2021 , 59 : 102817 .

TANVEER M , ZAHID A H , AHMAD M , et al . LAKE-IoD: lightweight authenticated key exchange protocol for the Internet of drone environment [J ] . IEEE Access , 2020 , 8 : 155645 - 155659 .

SRINIVAS J , DAS A K , WAZID M , et al . Designing secure user authentication protocol for big data collection in IoT-based intelligent transportation system [J ] . IEEE Internet of Things Journal , 2021 , 8 ( 9 ): 7727 - 7744 .

TANVEER M , KHAN A U , KUMAR N , et al . RAMP-IoD: a robust authenticated key management protocol for the Internet of drones [J ] . IEEE Internet of Things Journal , 2022 , 9 ( 2 ): 1339 - 1353 .

KHAN A A , KUMAR V , AHMAD M , et al . PALK: password-based anonymous lightweight key agreement framework for smart grid [J ] . International Journal of Electrical Power & Energy Systems , 2020 , 121 : 106121 .

CHAUDHRY S A . Correcting PALK: password-based anonymous lightweight key agreement framework for smart grid [J ] . International Journal of Electrical Power & Energy Systems , 2021 , 125 : 106529 .

XU H , HSU C , HARN L , et al . Three-factor anonymous authentication and key agreement based on fuzzy biological extraction for industrial Internet of things [J ] . IEEE Transactions on Services Computing , 2023 , 16 ( 4 ): 3000 - 3013 .

WANG D , CAO Y , LAM K Y , et al . Authentication and key agreement based on three factors and PUF for UAV-assisted post-disaster emergency communication [J ] . IEEE Internet of Things Journal , 2024 , 11 ( 11 ): 20457 - 20472 .

WANG C Y , WANG D , XU G A , et al . Efficient privacy-preserving user authentication scheme with forward secrecy for industry 4.0 [J ] . Science China Information Sciences , 2021 , 65 ( 1 ): 112301 .

VINOTH R , DEBORAH L J , VIJAYAKUMAR P , et al . Secure multifactor authenticated key agreement scheme for industrial IoT [J ] . IEEE Internet of Things Journal , 2021 , 8 ( 5 ): 3801 - 3811 .

WANG Q X , WANG D . Understanding failures in security proofs of multi-factor authentication for mobile devices [J ] . IEEE Transactions on Information Forensics and Security , 2022 , 18 : 597 - 612 .

DEEBAK B D , MEMON F H , CHENG X C , et al . Seamless privacy-preservation and authentication framework for IoT-enabled smart eHealth systems [J ] . Sustainable Cities and Society , 2022 , 80 : 103661 .

CUI J , ZHANG X Y , ZHONG H , et al . Extensible conditional privacy protection authentication scheme for secure vehicular networks in a multi-cloud environment [J ] . IEEE Transactions on Information Forensics and Security , 2019 , 15 : 1654 - 1667 .

MING Y , YANG P F , MAHDIKHANI H , et al . A secure one-to-many authentication and key agreement scheme for industrial IoT [J ] . IEEE Systems Journal , 2023 , 17 ( 2 ): 2225 - 2236 .

LUO F T , HUANG R W , XIE Y Q . Hybrid blockchain-based many-to-many cross-domain authentication scheme for smart agriculture IoT networks [J ] . Journal of King Saud University - Computer and Information Sciences , 2024 , 36 ( 2 ): 101946 .

PEI D , SALOMAA A , DING C . Chinese remainder theorem: applications in computing, coding, cryptography [M ] . Singapore : World Scientific , 1996 .

ACAR A , AKSU H , ULUAGAC A S , et al . A survey on homomorphic encryption schemes: theory and implementation [J ] . ACM Computing Surveys (Csur) , 2018 , 51 ( 4 ): 1 - 35 .

BRAKERSKI Z , GENTRY C , VAIKUNTANATHAN V . Fully homomorphic encryption without bootstrapping [J ] . ACM Transactions on Computation Theory , 2014 , 6 ( 3 ): 1 - 36 .

FAN J , VERCAUTEREN F . Somewhat practical fully homomorphic encryption [J ] . Cryptology ePrint Archive , 2012 .

CHEON J H , KIM A , KIM M , et al . Homomorphic encryption for arithmetic of approximate numbers [C ] // Proceedings of the 23rd International Conference on the Theory and Applications of Cryptology and Information Security . Berlin : Springer , 2017 : 409 - 437 .

DOLEV D , YAO A . On the security of public key protocols [J ] . IEEE Transactions on Information Theory , 1983 , 29 ( 2 ): 198 - 208 .

CANETTI R , KRAWCZYK H . Analysis of key-exchange protocols and their use for building secure channels [C ] // Proceedings of International Conference on the Theory and Applications of Cryptographic Techniques . Berlin : Springer , 2001 : 453 - 474 .

JENSEN K . An introduction to the practical use of coloured petri nets [J ] . Lectures on Petri Nets II: Applications: Advances in Petri Nets 3 , 1998 : 237 - 292 .

龚翔 , 冯涛 , 杜谨泽 . 基于CPN的安全协议形式化建模及安全分析方法 [J ] . 通信学报 , 2021 , 42 ( 9 ): 240 - 253 .

GONG X , FENG T , DU J Z . Formal modeling and security analysis method of security protocol based on CPN [J ] . Journal on Communications , 2021 , 42 ( 9 ): 240 - 253 .

LONG Y Y , PENG C G , TAN W J , et al . Blockchain-based anonymous authentication and key management for Internet of things with Chebyshev chaotic maps [J ] . IEEE Transactions on Industrial Informatics , 2024 , 20 ( 5 ): 7883 - 7893 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于双联盟链的工业物联网安全数据共享架构

RSSP-II的安全分析及安全增强新方案

基于通信顺序进程的Android程序复杂信息流分析方法

RSA-CRT密码防御算法的故障注入攻击