CN111918229A - Method, device and storage medium for transmitting information by wireless sensor - Google Patents

Abstract

The present application discloses a method, device and storage medium for wireless sensors to transmit information. Specifically, a multivariate key generation function is randomly configured for each sensor node, and a single-variable key generation function is randomly configured for each base station; The current pairwise key is generated between two adjacent sensor nodes according to the exchanged node identifier and the multivariate key generation function; according to the univariate key generation function, a broadcast message containing the current session key is generated at the base station side, Send the broadcast message to each sensor node to parse out the current session key; according to the current pairwise key and the current session key, generate a message encryption key and a message authentication key in the sensor node, and encrypt the message through the message encryption key The key and the message authentication key encrypt the service message to be sent. The embodiments of the present application use a lightweight key distribution method to generate corresponding keys at the sensor nodes and base stations with low processing capabilities, thereby improving security.

Description

A method, device and storage medium for wireless sensor to transmit information

technical field

The present application relates to the field of communication technologies, and in particular, to a method, a device and a storage medium for transmitting information by a wireless sensor.

Background technique

Wireless Sensor Networks (WSN) is a distributed sensor network whose extremities are sensors that can sense and inspect the outside world. Sensors in WSN communicate wirelessly, so network settings are flexible, device locations can be changed at any time, and wired or wireless connections to the Internet are possible. A multi-hop self-organizing network formed by wireless communication.

As a promising solution, WSN is widely used in security monitoring, intelligent transportation, smart home, environmental monitoring and other occasions that require multimedia information. With the increase of sensor nodes deployed in the WSN network, a base station cannot guarantee the network service quality well. Therefore, by deploying multiple base stations in the WSN network to reduce the distance between sensor nodes and base stations, reduce the energy consumption of sensor nodes, and improve the performance of sensor networks. However, in the case of multiple base stations and multiple sensor nodes, the currently used key management protocol cannot be used directly and cannot guarantee the security of the WSN network. At the same time, the existing algorithms for generating keys are relatively complex and cannot be used on sensor nodes with low processing capabilities.

SUMMARY OF THE INVENTION

The embodiment of the present application provides a method for transmitting information by a wireless sensor. The method generates a pairwise key and a session key at each sensor node and a base station through a preset lightweight key distribution method, and generates a pair key and a session key according to the The key and session key are encrypted for the service information to be transmitted, which improves the security of information transmission in the WSN network.

The method includes:

Before each transmission of service information, randomly configure a multivariate key generation function for each sensor node, and randomly configure a univariate key generation function for each base station;

The respective node identifiers are exchanged between any two adjacent sensor nodes, and according to the exchanged node identifiers and the multi-variable key generation function, a shared applicability between the any two sensor nodes is generated. The current paired key for this service information transmission, wherein the current paired key is used to encrypt the corresponding service message transmitted between the two sensors;

According to the univariate key generation function, a broadcast message containing the current session key suitable for this service information transmission is generated at the base station, and the broadcast message is sent to each of the sensor nodes to The current session key is parsed out of the sensor node;

Generate a message encryption key and a message authentication key in the sensor node according to the current pairwise key and the current session key, and use the message encryption key and the message authentication key to be sent business messages are encrypted.

Optionally, the current session key is generated based on the group key shared by each of the base stations, wherein the session key is generated by a first univariate key generation function and a second univariate key generation function composition;

The broadcast message is generated according to the first univariate key generation function and the second univariate key generation function.

Optionally, a revocation function is pre-configured for each base station, wherein the revocation function is used to determine whether the sensor node is revoked;

The broadcast message is composed of the product of the revocation function and the first variable key generation function, and the product of the revocation function and the second variable key generation function.

Optionally, based on the revocation function, the current session encryption composed of the first univariate key generation function and the second univariate key generation function is parsed in the unrevoked sensor node. key.

Optionally, count the number of the same current session keys parsed in the sensor node, and determine the same current session keys whose number exceeds a preset value as the valid current session keys.

Optionally, in the sensor node, the service message to be sent is encrypted according to the message encryption key to generate a ciphertext to be sent;

generating, in the sensor node, a message authentication code for the ciphertext to be sent according to the message authentication key;

The to-be-sent ciphertext carrying the message authentication code and a sending timestamp identifying the sending time of the ciphertext is sent to the target sensor node.

Optionally, after receiving the ciphertext carrying the message authentication code and the sending timestamp, the target sensor node generates the message authentication code based on the message authentication key, and passes the The message authentication code performs integrity authentication on the ciphertext;

Calculate the difference between the sending timestamp of the ciphertext that has passed the integrity authentication and the current time, and when the difference is less than a preset threshold, decrypt the ciphertext based on the encryption key, and obtain the business message.

Optionally, based on the revocation function, the node identifier of the sensor node determined to be revoked and the base station identifier of the base station end are added to a revocation list, and the revocation list is broadcast to the entire network.

In another embodiment of the present invention, an apparatus for transmitting information from a wireless sensor is provided, the apparatus comprising:

The configuration module is used to randomly configure a multivariate key generation function for each sensor node before each transmission of service information, and randomly configure a single variable key generation function for each base station;

The first generation module is used for exchanging the respective node identifiers between any two adjacent sensor nodes, and generating the any two according to the exchanged node identifiers and the multivariate key generation function The current pairwise key that is shared between the sensor nodes and is suitable for this service information transmission, wherein the current pairwise key is used to encrypt the corresponding service messages transmitted between the two sensors;

The second generation module is configured to generate a broadcast message including the current session key suitable for this service information transmission at the base station according to the univariate key generation function, and send the broadcast message to each of the a sensor node, to resolve the current session key in the sensor node;

an encryption module, configured to generate a message encryption key and a message authentication key in the sensor node according to the current pairwise key and the current session key, and use the message encryption key and the message The authentication key encrypts the service message to be sent.

Optionally, the second generation module includes:

The first generating unit is configured to generate the current session key based on the group key shared by each of the base stations, wherein the session key is composed of a first univariate key generation function and a second univariate encryption function. The key generation function consists of;

A second generating unit, configured to generate the broadcast message according to the first univariate key generation function and the second univariate key generation function.

Optionally, the second generating unit includes:

a configuration subunit, configured to preconfigure a revocation function for each base station, wherein the revocation function is used to determine whether the sensor node is revoked;

A subunit is constructed, configured to form the broadcast message by the product of the revocation function and the first variable key generation function, and the product of the revocation function and the second variable key generation function.

Optionally, the second generation module is further used for:

Based on the revocation function, the current session key composed of the first univariate key generation function and the second univariate key generation function is parsed in the sensor node that is not revoked.

Optionally, the device further includes:

A determination module, configured to count the number of the same current session keys parsed out in the sensor node, and determine the same current session keys whose number exceeds a preset value as the legal current session keys.

Optionally, the encryption module includes:

a third generating unit, configured to encrypt the service message to be sent in the sensor node according to the message encryption key, and generate a ciphertext to be sent;

a fourth generating unit, configured to generate a message authentication code for the ciphertext to be sent in the sensor node according to the message authentication key;

A sending unit, configured to send the ciphertext to be sent carrying the message authentication code and a sending time stamp identifying the sending time of the ciphertext to a target sensor node.

Optionally, the device further includes:

an authentication module, used for the target sensor node to generate the message authentication code based on the message authentication key after receiving the ciphertext carrying the message authentication code and the sending time stamp, and pass The message authentication code performs integrity authentication on the ciphertext;

A decryption module, configured to calculate the difference between the sending timestamp of the ciphertext that has passed the integrity authentication and the current time, and when the difference is less than a preset threshold, perform a decryption process on the ciphertext based on the encryption key. Decrypt to obtain the service message.

Optionally, the device further includes:

The adding module is configured to add the node identifier of the sensor node determined to be revoked and the base station identifier of the base station to a revocation list based on the revocation function, and broadcast the revocation list to the whole network.

In another embodiment of the present invention, a non-transitory computer-readable storage medium is provided, the non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to perform the above-described Steps in a method for a wireless sensor to transmit information.

In another embodiment of the present invention, a terminal device is provided, which includes a processor, and the processor is configured to execute each step in the above-mentioned method for transmitting information by a wireless sensor.

As can be seen above, based on the above embodiment, first, before each transmission of service information, a multi-variable key generation function is randomly configured for each sensor node, and a single-variable key generation function is randomly configured for each base station. The respective node identifiers are exchanged between the two adjacent sensor nodes, and according to the exchanged node identifiers and the multivariate key generation function, the current data shared between any two sensor nodes and suitable for this service information transmission is generated. Paired keys, where the current paired key is used to encrypt the business message transmitted between the corresponding two sensors, and then, according to the univariate key generation function, the base station generates information including information applicable to this business. The broadcast message of the current session key is transmitted, and the broadcast message is sent to each sensor node to resolve the current session key in the sensor node. Finally, according to the current pairwise key and the current session key, at the sensor node The message encryption key and the message authentication key are generated in the message encryption key and the message authentication key, and the service message to be sent is encrypted by the message encryption key and the message authentication key. In this embodiment of the present application, a lightweight key distribution method is used to generate pairwise keys and session keys at the sensor node and base station, respectively, and generate message encryption keys and message authentication keys according to the paired keys and session keys. , and encrypt the service message to be sent, which improves the security of information transmission in the WSN network. At the same time, a simple key generation method is used to generate corresponding keys at the sensor nodes and base stations with low processing capabilities, which saves costs.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present application more clearly, the following drawings will briefly introduce the drawings that need to be used in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore do not It should be regarded as a limitation of the scope, and for those of ordinary skill in the art, other related drawings can also be obtained according to these drawings without any creative effort.

FIG. 1 shows a schematic flowchart of a method for a wireless sensor to transmit information provided in Embodiment 10 of the present application;

2 shows a schematic diagram of a specific flow of a method for a wireless sensor to transmit information provided in Embodiment 20 of the present application;

FIG. 3 shows a schematic diagram of an apparatus for transmitting information by a wireless sensor according to Embodiment 30 of the present application;

FIG. 4 shows a schematic diagram of a terminal device provided by Embodiment 40 of the present application.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present application clearer, the present invention will be described in further detail below with reference to the accompanying drawings and embodiments.

Security is the main problem facing the WSN network at present, and among all the security problems of the WSN network, key management is the core mechanism to ensure the security of network services, and it is responsible for ensuring the security of the WSN network. Existing wireless sensor network key management protocols all assume that the base station is trusted. At the same time, it is assumed that each sensor node is preloaded with a master key, shared by all nodes in the sensor network, and loaded with a pairwise key shared with the base station. When considering the security of a WSN network based on multiple base stations, the currently proposed key management protocol cannot be used directly. Assuming that all base stations use the same master key or the same pairwise key, the base station can verify the messages from the sensor nodes, however, the sensor nodes cannot verify the messages from the base station. In addition, when a base station is captured or compromised, the master key and pairwise key of the entire WSN network will be exposed, and any attacker with this key set can access the WSN network.

Based on the problems in the prior art, the embodiments of the present application provide a method for wireless sensors to transmit information, by configuring a lightweight key generation function for the sensor node and the base station, and before each transmission of service information, through The key generation function generates a pair key and a session key respectively, and generates a message encryption key and a message authentication key according to the pair key and the session key, and encrypts the service message to be sent.

The application field of this application is mainly in the field of communication technology. As shown in FIG. 1 , it is a schematic flowchart of a method for transmitting information by a wireless sensor according to Embodiment 10 of the present application. The detailed steps are as follows:

S11, before each transmission of service information, randomly configure a multivariate key generation function for each sensor node, and randomly configure a single-variable key generation function for each base station.

In this step, the WSN network is generally composed of multiple base stations and multiple sensor nodes. The number of base stations is far less than the number of sensor nodes. For example, there are M base stations and N sensor nodes in the WSN network. composition, and M is much smaller than N. Each sensor node is reachable by at least γ (γ<M) base stations in a single hop.

其中，f(x,y)＝f(y,x)。另外，为基站端随机配置单变量密钥生成函数。具体的，单变量密钥生成函数为随机配置的t阶多项式p_j(x)。Before deploying a sensor node, the configuration server randomly generates a multivariate key generation function. Specifically, the multivariate key generation function is an element-t-order polynomial over a finite field F _q

where f(x,y)=f(y,x). In addition, a univariate key generation function is randomly configured for the base station. Specifically, the univariate key generation function is a randomly configured t-order polynomial p _j (x).

Before each transmission of service information, the univariate key generation function and the multivariate key generation function are re-randomly reconfigured on each base station and each sensor node respectively.

S12: Exchange respective node identifiers between any two adjacent sensor nodes, and generate a shared node identifier shared between any two sensor nodes suitable for this service according to the exchanged node identifiers and the multivariate key generation function The current paired key for information transmission, where the current paired key is used to encrypt the service message transmitted between the corresponding two sensors.

In this step, the node identifier is the unique identity information of each sensor node. In addition, the pairwise key is a key shared between each sensor node and one of its neighboring sensor nodes. Before each service information transmission, the current pairwise key for this service information transmission between adjacent sensor nodes is generated according to the multivariable key generation function reconfigured by the configuration server for the sensor nodes. Specifically, for any sensor i, the configuration server calculates f(i, y) according to the multivariate key generation function f(x, y), and loads the univariate polynomial f(i, y) into the sensor i. For any sensor node i and its adjacent sensor node j, the sensor node i can calculate the shared key with sensor node j through the univariate polynomial f(i, y) as f(i, j); similarly, By exchanging node identifiers, sensor node j can calculate the shared key with sensor node i as f(j, i) through the univariate polynomial f(j, y). Since f(i, j)=f(j, i), the pairwise key is shared between sensor nodes i and j.

S13, according to the univariate key generation function, generate a broadcast message containing the current session key suitable for the current service information transmission at the base station, and send the broadcast message to each sensor node, so as to parse out the current session key in the sensor node session key.

可通过伪随机函数ψ导出：

In this step, the session key is a global key shared by all sensor nodes in the WSN network. It is pre-determined that each base station shares the group key, and the session key can be derived from the group key and dynamically allocated to each sensor node. Determine the group key as K _g , the session key of the i-th session

It can be derived by the pseudorandom function ψ:

然后，基站端根据单变量密钥生成函数p_j(x)和q_j(x)生成包含适用于本次业务信息传输的当前会话密钥的广播消息，并将该广播消息共享给每个传感器节点。传感器节点在收到基站共享的广播消息后，对广播消息中携带的p_j(x)和q_j(x)进行计算，并解析出当前会话密钥。Further, according to the univariate key generation function p _j (x), determine

Then, the base station generates a broadcast message containing the current session key suitable for this service information transmission according to the univariate key generation functions p _j (x) and q _j (x), and shares the broadcast message with each sensor node. After receiving the broadcast message shared by the base station, the sensor node calculates p _j (x) and q _j (x) carried in the broadcast message, and parses out the current session key.

S14: Generate a message encryption key and a message authentication key in the sensor node according to the current pairwise key and the current session key, and encrypt the service message to be sent by using the message encryption key and the message authentication key.

In this step, after the current pairing key and the current session key are obtained, the sensor node will generate a message encryption key and a message authentication key for encrypting the service message to be sent this time according to the key. . The service messages can be encrypted and transmitted between the sensor nodes according to the generated message encryption key and message authentication key.

Based on the above embodiments of the present application, first, before each transmission of service information, a multivariate key generation function is randomly configured for each sensor node, and a single-variable key generation function is randomly configured for each base station. The respective node identifiers are exchanged between the two adjacent sensor nodes, and according to the exchanged node identifiers and the multivariate key generation function, the current data shared between any two sensor nodes and suitable for this service information transmission is generated. Paired keys, where the current paired key is used to encrypt the business message transmitted between the corresponding two sensors, and then, according to the univariate key generation function, the base station generates information including information applicable to this business. The broadcast message of the current session key is transmitted, and the broadcast message is sent to each sensor node to resolve the current session key in the sensor node. Finally, according to the current pairwise key and the current session key, at the sensor node The message encryption key and the message authentication key are generated in the message encryption key and the message authentication key, and the service message to be sent is encrypted by the message encryption key and the message authentication key. In this embodiment of the present application, a lightweight key distribution method is used to generate pairwise keys and session keys at the sensor node and base station, respectively, and generate message encryption keys and message authentication keys according to the paired keys and session keys. , and encrypt the service message to be sent, which improves the security of information transmission in the WSN network. At the same time, a simple key generation method is used to generate corresponding keys at the sensor nodes and base stations with low processing capabilities, which saves costs.

As shown in FIG. 2 , it is a schematic diagram of a specific flow of a method for transmitting information by a wireless sensor in Embodiment 20 provided by the present application. The detailed process of the specific process is as follows:

S201 , the configuration server randomly configures a multivariate key generation function for each sensor node, and randomly configures a univariate key generation function for each base station.

S202 , exchange respective node identifiers between any two adjacent sensor nodes, and generate a shared node identifier shared between any two sensor nodes suitable for this service according to the exchanged node identifiers and the multivariate key generation function The current pairwise key for the information transfer.

S203, based on the group key shared by each base station, generate a current session key composed of a first univariate key generation function and a second univariate key generation function.

可通过伪随机函数ψ导出：

同时根据第一单变量密钥生成函数p_j(x)，确定第二单变量函数

会话密钥由第一单变量密钥生成函数p_j(x)和第二单变量密钥生成函数q_j(x)组成。Here, it is pre-determined that each base station shares a group key, and the session key can be derived from the group key and dynamically allocated to each sensor node. Determine the group key as K _g , the session key of the i-th session

It can be derived by the pseudorandom function ψ:

At the same time, according to the first univariate key generation function p _j (x), the second univariate function is determined

The session key consists of a first univariate key generation function p _j (x) and a second univariate key generation function q _j (x).

In addition, this step and the subsequent steps to parse out the session key and the above-mentioned step S202 may be performed at the same time, and the sequence is not distinguished.

S204: Generate a broadcast message according to the first univariate key generation function and the second univariate key generation function.

Here, a revocation function is preconfigured for each base station, wherein the revocation function is used to determine whether the sensor node is revoked. Specifically, the undo function can be a polynomial g(x)=(xr ₁ )(xr ₂ )...(xr _v ). Based on the revocation function, the node identifier of the sensor node determined to be revoked and the base station identifier of the base station side are added to the revocation list, and the revocation list is broadcast to the whole network.

In addition, the product of the revocation function and the first variable key generation function, and the product of the revocation function and the second variable key generation function constitute a broadcast message. Specifically, in the pre-allocation phase, the configuration server randomly selects a 2t-order polynomial h _j (x)=h _j,0 +h _j,1 x+...+h _j,2t x ^2t ,1 on the finite field F _q ≤j≤m. At the same time, each sensor node u is preloaded with a personal secret S _u ={h _j (u)|1≤j≤m}, and each base station b _j is preloaded with a polynomial h _j (x).

When given a set of revoked sensor nodes R={r ₁ , r ₂ ,...,r _v }, v≤t, the base station shares p _j (x) and q _j (x) with the unrevoked sensor nodes The sensor node of , generates a broadcast message M as follows:

M={R}∪{P _j (x)=g(x)p _j (x)+h _j (x)}∪{Q _j (x)=g(x)q _j (x)+h _j ( x)}

S205, the current session key is parsed at the sensor node.

最后，S_u可以得到新的会话密钥

对于撤销的传感器节点，由于g(x)＝0，因此，无法恢复出会话密钥。In this step, based on the revocation function, the current session key composed of the first univariate key generation function and the second univariate key generation function is parsed in the sensor nodes that are not revoked. Specifically, if any _unrevoked sensor node Su receives the broadcast message M. The sensor node obtains P _j (u)=g(u)p _j (u)+h _j (u) by calculating the polynomials P _j (x) and Q _j (x) in M, and Q _j (u)=g (u) _qj (u)+ _hj (u). Since the sensor node S _u knows h _j (u) and g(u)≠0, it can be calculated

Finally, _Su can get the new session key

For the revoked sensor node, since g(x)=0, the session key cannot be recovered.

S206: Count the number of the same current session keys parsed in the sensor node, and determine the same current session keys whose number exceeds a preset value as legal current session keys.

In this step, since each sensor node is at least reachable by a single hop of γ(γ<m) base station, an unrevoked sensor node can recover multiple session key copies, only when the sensor node obtains the preset value of the number There must be at least γ copies of the session key before the session key can be determined to be a valid current session key.

S207: Generate a message encryption key and a message authentication key in the sensor node according to the current pairwise key and the current session key, and encrypt the service message to be sent by using the message encryption key and the message authentication key.

是当前会话密钥，那么消息加密密钥K_enc和消息认证密钥K_mac可以通过如下公式求得：In this step, in the sensor node, the service message to be sent is encrypted according to the message encryption key to generate the ciphertext to be sent, and then according to the message authentication key, the sensor node generates a message authentication code for the ciphertext to be sent , and finally send the ciphertext to be sent carrying the message authentication code and the sending timestamp identifying the sending time of the ciphertext to the target sensor node. Specifically, it is assumed that K _{A, B} is a pairwise key shared between sensor node A and target sensor B node,

is the current session key, then the message encryption key K _enc and the message authentication key K _mac can be obtained by the following formulas:

消息M和发送时间的发送时间戳T_s由消息加密密钥K_enc加密，再附上由消息认证密钥K_mac对待发送密文

形成的消息认证码。The complete information sent by sensor A to sensor B is:

The message M and the sending time stamp T _s of the sending time are encrypted by the message encryption key K _enc , and then the ciphertext to be sent by the message authentication key K _mac is attached.

The formed message authentication code.

S208, the target sensor node parses the received ciphertext to obtain service messages.

进行完整性认证，认证通过后，再用产生的消息加密密钥K_enc对密文

进行解密得到业务消息M。Here, after receiving the ciphertext carrying the message authentication code and the sending time stamp, the target sensor node generates the message authentication code based on the message authentication key, and performs integrity authentication on the ciphertext through the message authentication code. Specifically, the message authentication code generated by the target sensor node itself is compared with the message authentication code of the received ciphertext, and when the two message authentication codes are the same, the integrity verification is deemed to be passed. Second, the difference between the sending timestamp of the ciphertext that has passed the integrity authentication and the current time is calculated, and when the difference is less than the preset threshold, the ciphertext is decrypted based on the encryption key to obtain the service message. Specifically, after receiving the complete message, the target sensor node B first uses the message authentication key K _mac generated by itself to verify the ciphertext

Perform integrity authentication. After the authentication is passed, use the generated message encryption key K _enc to encrypt the ciphertext.

Decryption is performed to obtain the service message M.

In addition, the embodiment of the present application also involves three situations of key revocation: the base station is damaged, the sensor node is damaged, and both the base station and the sensor node are damaged. Each sensor node maintains a node revocation list, and the node revocation list includes the identifiers of all failed entities (base stations or sensor nodes) in the WSN network. The revocation list is initially empty and grows over time. Specifically, when the base station is damaged, the base station needs to be deleted from the WSN network. The security of communication in the WSN network is guaranteed by the message encryption key and the message authentication key, and both the message encryption key and the message authentication key are generated by the session key. If the damaged base station cannot generate the current session encryption key key, will be removed from the WSN network. For this reason, the damaged base station will be forced to leave the group and generate a new group key, and then generate a new current session key from the new group key. Because a sensor node can only accept the current session key if it obtains at least a preset value such as γ copies of the session key, an attacker must control γ base stations at the same time to launch an attack.

If the sensor node is found to be damaged, the session key distribution scheme can be used to delete the damaged sensor node. For a compromised sensor node, its node identifier will be added to the node revocation list. Since g(x)=0, the revoked sensor node cannot recover the current session key. Therefore, the revoked sensor node cannot resolve the new message encryption key and message authentication key. Although a revoked sensor node still has pairwise keys with neighboring sensor nodes, it cannot decrypt and authenticate all traffic messages in the network.

Once the base station and the sensor node are destroyed, the base station needs to be deactivated first, and then the sensor node needs to be deactivated. The detailed steps are the same as above.

A method for transmitting information from a wireless sensor proposed by an embodiment of the present application generates a pairwise key and a session key at each sensor node and a base station through a preset lightweight key distribution method, and generates a pairwise key and a session key according to the paired key distribution method. The key and session key encrypt the service information that needs to be transmitted, which improves the security of information transmission in the WSN network. At the same time, a simple key generation method is used to generate corresponding keys at the sensor nodes and base stations with low processing capabilities, which saves costs. In addition, through the above key generation, distribution and revocation methods, the base station and sensor nodes can verify each other's identity information, so that any base station or any sensor node is captured or destroyed without affecting the security of the entire sensor network.

Based on the same inventive concept, Embodiment 30 of the present application further provides an apparatus for transmitting information by a wireless sensor, wherein, as shown in FIG. 3 , the apparatus includes:

The configuration module 31 is used to randomly configure a multivariate key generation function for each sensor node before each transmission of service information, and randomly configure a single-variable key generation function for each base station;

The first generation module 32 is used for exchanging respective node identifiers between any two adjacent sensor nodes, and generating a shared between any two sensor nodes according to the exchanged node identifiers and the multivariate key generation function. The current paired key that is applicable to this business information transmission, wherein the current paired key is used to encrypt the business message transmitted between the corresponding two sensors;

The second generation module 33 is configured to generate a broadcast message including the current session key suitable for this service information transmission at the base station according to the univariate key generation function, and send the broadcast message to each sensor node to The current session key is parsed from the sensor node;

The encryption module 34 is used to generate a message encryption key and a message authentication key in the sensor node according to the current paired key and the current session key, and perform the operation on the service message to be sent by the message encryption key and the message authentication key. encryption.

In this embodiment, the specific functions and interaction methods of the configuration module 31 , the first generation module 32 , the second generation module 33 , and the encryption module 34 can be referred to the description of the embodiment corresponding to FIG. 1 , which will not be repeated here.

Optionally, the second generation module 33 includes:

a first generating unit, configured to generate a current session key based on the group key shared by each base station, wherein the session key is composed of a first univariate key generation function and a second univariate key generation function;

The second generating unit is configured to generate a broadcast message according to the first univariate key generation function and the second univariate key generation function.

Optionally, the second generating unit includes:

a configuration subunit, configured to preconfigure a revocation function for each base station, wherein the revocation function is used to determine whether the sensor node is revoked;

A subunit is constructed for composing a broadcast message with the product of the revocation function and the first variable key generation function, and the product of the revocation function and the second variable key generation function.

Optionally, the second generation module is further used for:

Based on the revocation function, the current session key composed of the first univariate key generation function and the second univariate key generation function is parsed in the sensor nodes that are not revoked.

Optionally, the device further includes:

The determining module 35 is configured to count the number of the same current session keys parsed in the sensor node, and determine the same current session keys whose number exceeds a preset value as legal current session keys.

Optionally, encryption module 34 includes:

a third generating unit, configured to encrypt the service message to be sent according to the message encryption key in the sensor node, to generate the ciphertext to be sent;

a fourth generating unit, configured to generate a message authentication code for the ciphertext to be sent in the sensor node according to the message authentication key;

The sending unit is configured to send the ciphertext to be sent carrying the message authentication code and the sending timestamp identifying the sending time of the ciphertext to the target sensor node.

Optionally, the device further includes:

The authentication module 36 is used for the target sensor node to generate a message authentication code based on the message authentication key after receiving the ciphertext carrying the message authentication code and the sending time stamp, and to perform integrity authentication on the ciphertext through the message authentication code;

The decryption module 37 is configured to calculate the difference between the sending timestamp of the ciphertext that has passed the integrity authentication and the current time, and when the difference is less than a preset threshold, decrypt the ciphertext based on the encryption key to obtain the service message.

Optionally, the device further includes:

The adding module 38 is configured to add the node identifier of the sensor node determined to be revoked and the base station identifier of the base station to the revocation list based on the revocation function, and broadcast the revocation list to the whole network.

As shown in FIG. 4 , another embodiment 40 of the present application further provides a terminal device, including a processor 40, wherein the processor 40 is configured to execute the steps of the above-mentioned method for transmitting information by a wireless sensor.

It can also be seen from FIG. 4 that the terminal device provided in the above embodiment further includes a non-transitory computer-readable storage medium 41 , and a computer program is stored on the non-transitory computer-readable storage medium 41 , and the computer program is executed by the processor 40 . When executing the steps of the above method for transmitting information by a wireless sensor.

Specifically, the storage medium can be a general storage medium, such as a removable disk, a hard disk, and a FLASH, etc. When the computer program on the storage medium is run, the above-mentioned method for transmitting information by a wireless sensor can be executed.

Finally, it should be noted that the above-mentioned embodiments are only specific implementations of the present application, and are used to illustrate the technical solutions of the present application, rather than limit them. The embodiments describe the application in detail, and those of ordinary skill in the art should understand that: any person skilled in the art can still modify the technical solutions described in the foregoing embodiments within the technical scope disclosed in the application. Or can easily think of changes, or equivalently replace some of the technical features; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions in the embodiments of the application, and should be covered in this application. within the scope of protection. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims (18)

1. a method for wireless sensor transmission information, is characterized in that, comprises: Before each transmission of service information, randomly configure a multivariate key generation function for each sensor node, and randomly configure a univariate key generation function for each base station; The respective node identifiers are exchanged between any two adjacent sensor nodes, and according to the exchanged node identifiers and the multi-variable key generation function, a shared applicability between the any two sensor nodes is generated. The current paired key for this service information transmission, wherein the current paired key is used to encrypt the corresponding service message transmitted between the two sensors; According to the univariate key generation function, a broadcast message containing the current session key suitable for this service information transmission is generated at the base station, and the broadcast message is sent to each of the sensor nodes to The current session key is parsed out of the sensor node; Generate a message encryption key and a message authentication key in the sensor node according to the current pairwise key and the current session key, and use the message encryption key and the message authentication key to be sent business messages are encrypted. 2. The method according to claim 1, wherein the step of generating a broadcast message containing a current session key suitable for this service information transmission at the base station side comprises: generating the current session key based on the group key shared by each of the base stations, wherein the session key is composed of a first univariate key generation function and a second univariate key generation function; The broadcast message is generated according to the first univariate key generation function and the second univariate key generation function. 3. The method according to claim 2, wherein the step of generating the broadcast message according to the first univariate key generation function and the second univariate key generation function comprises: Preconfiguring a revocation function for each base station, wherein the revocation function is used to determine whether the sensor node is revoked; The broadcast message is composed of the product of the revocation function and the first variable key generation function, and the product of the revocation function and the second variable key generation function. 4. The method according to claim 3, wherein the step of parsing out the current session key in each sensor node comprises: Based on the revocation function, the current session key composed of the first univariate key generation function and the second univariate key generation function is parsed in the sensor node that is not revoked. 5. The method according to claim 1, wherein the step of parsing out the current session key in the sensor node and the step of generating a message encryption key and a message authentication key in the sensor node In between, the method further includes: The number of the same current session keys parsed from the sensor node is counted, and the number of the same current session keys exceeding a preset value is determined as the legal current session keys. 6. The method according to claim 5, wherein the step of encrypting the service message to be sent by the message encryption key and the message authentication key comprises: In the sensor node, encrypt the service message to be sent according to the message encryption key, and generate a ciphertext to be sent; generating, in the sensor node, a message authentication code for the ciphertext to be sent according to the message authentication key; The to-be-sent ciphertext carrying the message authentication code and a sending timestamp identifying the sending time of the ciphertext is sent to the target sensor node. 7. The method according to claim 6, wherein after the step of encrypting the service message to be sent by the message encryption key and the message authentication key, the method further comprises: After receiving the ciphertext carrying the message authentication code and the sending time stamp, the target sensor node generates the message authentication code based on the message authentication key, and passes the message authentication code. Perform integrity authentication on the ciphertext; Calculate the difference between the sending timestamp of the ciphertext that has passed the integrity authentication and the current time, and when the difference is less than a preset threshold, decrypt the ciphertext based on the encryption key, and obtain the business message. 8. The method according to claim 4, wherein the step of parsing out the current session key in the sensor node and the step of generating a message encryption key and a message authentication key in the sensor node In between, the method further includes: Based on the revocation function, the node identifier of the sensor node determined to be revoked and the base station identifier of the base station side are added to a revocation list, and the revocation list is broadcast to the whole network. 9. A device for transmitting information from a wireless sensor, comprising: The configuration module is used to randomly configure a multivariate key generation function for each sensor node before each transmission of service information, and randomly configure a single variable key generation function for each base station; The first generation module is used for exchanging the respective node identifiers between any two adjacent sensor nodes, and generating the any two according to the exchanged node identifiers and the multivariate key generation function The current pairwise key that is shared between the sensor nodes and is suitable for this service information transmission, wherein the current pairwise key is used to encrypt the corresponding service messages transmitted between the two sensors; The second generation module is configured to generate a broadcast message including the current session key suitable for this service information transmission at the base station according to the univariate key generation function, and send the broadcast message to each of the a sensor node, to resolve the current session key in the sensor node; an encryption module, configured to generate a message encryption key and a message authentication key in the sensor node according to the current pairwise key and the current session key, and use the message encryption key and the message The authentication key encrypts the service message to be sent. 10. The apparatus according to claim 9, wherein the second generation module comprises: The first generating unit is configured to generate the current session key based on the group key shared by each of the base stations, wherein the session key is composed of a first univariate key generation function and a second univariate encryption function. The key generation function is composed; A second generating unit, configured to generate the broadcast message according to the first univariate key generation function and the second univariate key generation function. 11. The apparatus according to claim 10, wherein the second generating unit comprises: a configuration subunit, configured to preconfigure a revocation function for each base station, wherein the revocation function is used to determine whether the sensor node is revoked; A subunit is constructed, configured to form the broadcast message by the product of the revocation function and the first variable key generation function, and the product of the revocation function and the second variable key generation function. 12. The apparatus according to claim 11, wherein the second generation module is further configured to: Based on the revocation function, the current session key composed of the first univariate key generation function and the second univariate key generation function is parsed in the sensor node that is not revoked. 13. The apparatus of claim 9, wherein the apparatus further comprises: A determination module, configured to count the number of the same current session keys parsed out in the sensor node, and determine the same current session keys whose number exceeds a preset value as the legal current session keys. 14. The apparatus according to claim 13, wherein the encryption module comprises: a third generating unit, configured to encrypt the service message to be sent in the sensor node according to the message encryption key, and generate a ciphertext to be sent; a fourth generating unit, configured to generate a message authentication code for the ciphertext to be sent in the sensor node according to the message authentication key; A sending unit, configured to send the ciphertext to be sent carrying the message authentication code and a sending time stamp identifying the sending time of the ciphertext to a target sensor node. 15. The apparatus of claim 14, wherein the apparatus further comprises: an authentication module, used for the target sensor node to generate the message authentication code based on the message authentication key after receiving the ciphertext carrying the message authentication code and the sending time stamp, and pass The message authentication code performs integrity authentication on the ciphertext; A decryption module, configured to calculate the difference between the sending timestamp of the ciphertext that has passed the integrity authentication and the current time, and when the difference is less than a preset threshold, perform a decryption process on the ciphertext based on the encryption key. Decrypt to obtain the service message. 16. The apparatus of claim 12, wherein the apparatus further comprises: The adding module is configured to add the node identifier of the sensor node determined to be revoked and the base station identifier of the base station to a revocation list based on the revocation function, and broadcast the revocation list to the whole network. 17. A non-transitory computer-readable storage medium, characterized in that the non-transitory computer-readable storage medium stores instructions that, when executed by a processor, cause the processor to perform any one of claims 1 to 8. Various steps in a method for transmitting information of a wireless sensor. 18. A terminal device, characterized by comprising a processor, wherein the processor is configured to execute each step in the method for transmitting information by a wireless sensor according to any one of claims 1 to 8.

Images