基于线性同态签名的敏感物联网设备后量子安全接入认证

Post-Quantum Secure Access Authentication for Sensitive IoT Devices Based on Linear Homomorphic Signature

摘要: 当敏感设备批量请求接入物联网时，对其接入认证过程的安全性与效率提出了更高要求。一方面，设备接入认证方案需具备抵御量子计算攻击的能力，以适应后量子时代的安全需求；另一方面，还需高效处理海量终端设备的并发认证请求，高效处理批量设备请求验证。本文提出一种基于线性同态签名的物联网设备接入认证方案，旨在实现批量设备的安全接入和高效认证。该方案首先基于NTRU密码签名体制与格理论困难问题，设计一种新型线性同态签名算法，使其不仅具备抗量子安全性，还能够支持对多个签名进行线性聚合与高效验证，将该算法嵌入认证服务中心与网关，实现对设备身份与传输数据的联合批量验证；再次，设计了高效的分层认证故障设备定位协议，并利用PUF技术实现密钥管控，提高了方案的可行性。安全性分析表明，该方案可有效抵御量子计算环境下的伪造与篡改攻击；性能评估显示，在千级设备规模下，在存储开销保持可行范围内，实现高效批量验证。

Abstract: When a large number of sensitive devices request access to the Internet of Things (IoT) in batches, higher requirements are put forward for the security and efficiency of their access authentication process. On the one hand, device access authentication schemes need to have the ability to resist quantum computing attacks to meet the security needs of the post-quantum era; on the other hand, they also need to efficiently handle concurrent authentication requests from massive terminal devices and verify batch device access requests. This paper proposes an IoT device access authentication scheme based on linear homomorphic signatures, aiming to achieve secure access and efficient authentication of batch devices. First, based on the NTRU cryptographic signature scheme and hard problems in lattice theory, the scheme designs a new linear homomorphic signature algorithm. This algorithm not only has post-quantum security, but also supports linear aggregation and efficient verification of multiple signatures. It is embedded in the authentication service center (ASC) and gateways to realize the joint batch verification of device identities and transmitted data. Second, an efficient hierarchical authentication protocol for faulty device localization is designed, and Physical Unclonable Function (PUF) technology is used to realize key management and control, which improves the feasibility of the scheme. Security analysis shows that the scheme can effectively resist forgery and tampering attacks in the quantum computing environment; performance evaluation indicates that under the scale of thousands of devices, efficient batch verification is achieved while the storage overhead remains within a feasible range.