# A Trusted Remote Data Trading Scheme in Hybrid SDN for Intelligent Internet of Things

Authors: Yu Zhang; Bei Gong; Yong Wu; Guiping Zheng; Zipeng Diao
Journal: Wireless Communications and Mobile Computing
 (2023)

---

## Abstract

Intelligent internet of things (IIoTs) have these features: heterogeneous network patterns, significant differences in devices, dynamic variability of network topologies, etc. In the complex security situation, it is necessary to reject data from untrusted devices to guarantee the security data trading of IIoTs. In this paper, we focus on the trustworthiness and authentication in a hybrid SDN scenario of IIoTs. For the process of the trusted judgment, we firstly implement the standardized model for the nodes with the device attributes, network states, and operation behaviors. Based on the standardized model, we propose feature evaluation functions in SDN and IP domains, respectively, to calculate the intradomain node trust values to achieve the trusted judgment. To consider the demand for secure data trading for cross-domain devices, we propose a remote data trading scheme in which the data transmitter signs the node identity and its trust value by a group signature and the data receiver verifies the signature. The group signature is not only to protect the privacy of the group members but also to support the dynamic accession and revocation of group members, so it is more suitable for IIoTs where the nodes frequently access/exit. The security is proved under the standard model. We conduct the simulation experiments to evaluate the correctness of the trusted judgment mechanism. The evaluation shows that the scheme has lower computational cost and the higher efficiency of the group signature scheme.


---

## Body

## 1. Introduction

According to IoT analytics, the number of connected IoT devices worldwide is expected to reach 14.5 billion by the end of 2022. Up to 2025, there will probably be more than 27 billion IoT connections [1]. As the explosive growth of network scale and business traffic, the drawbacks of the traditional switch-based network architecture are obvious, and the increasingly complex network protocols have made network operation and maintenance more complicated and more challenging in management and configuration. The emergence of software-defined networking (SDN) has changed the existing network infrastructure, shielding the underlying physical network differences and meeting the needs of IIoT security, management, applications and other requirements, thus becoming an innovative network architecture suitable for IIoT heterogeneous scenarios.Nowadays, it is very costly to complete the networkwide deployment of the SDN in a short period, so there will be the coexistence of the SDN network and the current mainstream IP network. Accordingly, the hybrid SDN model indicates the coexisting network architecture [2]. The hybrid SDN model inherits SDN security flaws such as topology poisoning attacks [3], new-flow attacks [4], blackhole attacks, grayhole attacks, Sybil attacks, and other security threats. In addition to internal and external attacks, devices in the hybrid SDN require the interaction of secure data trading. Therefore, we provide solid solutions for hybrid SDN to provide trusted judgment for intradomain nodes and remote attestation for cross-domain nodes, to ensure the security of the dynamic operating environment of IIoTs and the security of the data trading source.The legacy IP and SDN networks interconnect, and the data trading demands of intradomain or cross-domain devices exist in both network architectures. The data trading with untrusted devices is unsecured, so it is necessary to perform trust judgment for the data trading source, as illustrated in Figure1. Because of the heterogeneity of device nodes, the trusted judgment methods for devices are hard to unify [5]. The SDN control node as the manager of the SDN domain builds the trust chain for the trust measurement of the devices, as seen in Figure 1(a). However, there are no management nodes in the IP domain, and the nodes make trusted judgments by each other, as seen in Figure 1(b). Due to the SDN and IP domains cannot communicate directly, cross-domain devices must exchange their identity information and trust values to judge whether the other party is trusted or not, as seen in Figure 1(c). The trusted judgment of cross-domain devices exploits the remote attestation mechanism proposed by TCG [6]. In hybrid SDN, we adopt the remote attestation mechanism to prove the trusted transmitter by sending relevant information such as node identity information and trust value to the remote node for verification. It is necessary to propose a signature scheme to prevent falsifying the message.Figure 1
The process of trusted judgment for the intradomain or cross-domain nodes.
(a)
Trusted judgment in SDN domain(b)
Trusted judgment in IP domain(c)
Trusted judgment between SDN and IP domainsIn hybrid SDN, IP and SDN networks can be treated as two separate groups, so the remote attestation scheme is suited to exploit the group signature. The group signature scheme can only indicate that the signer is from the group, which does not expose the node privacy and trace the signer when it is questioned. Since IIoT is a dynamic changeable network, the node trust value is closely related to the changes in the surrounding environment, such as the business execution and the states of the neighboring nodes. If the node is untrusted, it will not be able to participate in the signature process as a group member. Nevertheless, most group signature models do not consider the member revocation operation [7]. As a result, the group signature scheme which supports dynamic joining and revocation of group members is more suitable for the dynamic operating environment of IIoT nodes.To ensure the security of data trading, it is necessary to confirm that the data trading source node is trusted. In this paper, we build the standardized description models of the intradomain nodes at first for the SDN and IP domains in the hybrid SDN architecture. Based on the standardized model, we calculate the trust value of the intradomain nodes by their respective feature evaluation functions. The cross-domain devices realize the remote attestation by a group signature to judge whether the data trading source node is trusted or not to enhance the security of IIoT data trading. Our paper makes the following contributions:(i)
By analyzing the operating environment of devices, tasks, and devices in hybrid SDN architecture, we build the standardized models using multidimensional attributes, network states, and interaction behaviors of the IIoT nodes in the SDN and IP domains(ii)
By setting the feature evaluation function, we propose the trusted judgment models of the intradomain nodes, complete the calculation of the node trust values, and verify the correctness of the trusted judgment process in simulation experiments(iii)
By using the remote attestation mechanism for cross-domain nodes, we propose a group signature scheme that supports dynamic joining and revocation of group members and has less computation and higher efficiency; meanwhile, the security of the scheme is proved under the standardized modelIn Section2, we describe the related work. Section 3 describes the hybrid SDN architecture and the standardized models in SDN domain and IP domain. We detail the implementation of the intradomain trusted judgment in Section 4. Section 5 realizes a group signature scheme and the security analysis. Section 6 is the simulation experiments for the trusted judgment and the group signature scheme. We conclude our work in Section 7.


## 2. Related Work

SDN is a novel network model; although SDN can be applied for IIoTs and dynamically perform different IIoT tasks in heterogeneous network scenarios, the openness of SDN leads to the possibility of serious security threats [8]. Liu et al. [9] proposed an SDN-based secure connectivity model for IIoTs, to safeguard the network by controlling the data flow and using a combination of channel and tag protocols to solve the routing security problem. But the security mechanism of the model is too complex, with poor real-time response and high energy consumption. Zhou et al. [10] combined trusted computing technology with the SDN network architecture to ensure the security and trust of the control domain in the SDN by using the SDN controller as the trusted root and measuring the device hardware, boot sequence, controller operating system, communication module, controller policy application, and other modules and network devices as the trusted chain transfer rules. The model relies on a security-trusted hardware platform and requires a costly reconstruction of the SDN controller.The abstract description of devices in IIoTs is the key to building a secure and trusted IIoTs. There are several standardized description models for IIoT scenarios. Chen et al. [11] proposed multidimensional attributes of the IIoT nodes in edge computing, and a comprehensive trust aggregation algorithm is implemented by the subject node for the trusted judgment using the unified quantification. The model realizes trust attributes in the edge computing environment as a domain and lacks the security for cross-domain nodes. Zheng et al. [12] proposed a trust management mechanism for the wireless sensor network by calculating the trust values to achieve dynamic adaptive adjustment. The model uses a distributed networking structure to realize local trust measurement and global trust measurement for the selection and update of management nodes. The model is applicable to wireless sensor network architectures and only considers the distributed IIoT scenario.The trusted IIoT data trading is built on the basis of the trusted data source. Yu et al. [13] discussed three IIoT data source security models and defined the security of each model, discussed the security challenges faced by different applications, and proposed security strategies for different attacks. However, the network models are from specific security threats and are less capable of dealing with unknown security threats. Gong et al. [14] proposed a trusted authentication scheme for IIoT data sources based on a trusted hierarchy, which uses a threshold group signature scheme to achieve trusted authentication of data sources. The group signature scheme lacks a revocation mechanism and is not applicable to the dynamic trusted judgment process. Liu et al. [15] proposed a distributed IIoT systems for smart cities, which builds a subdomain network by blockchain real-time reviewing of transaction nodes and adopts ring signature to ensure the privacy and security of data signature.In general, the existing trust models and remote attestation schemes are not suitable for hybrid SDN. Legacy IP and SDN are different in networking models, devices, and protocol configurations. Therefore, it is necessary to redefine the node attributes and operational behaviors for hybrid SDN and study the intradomain and cross-domain trusted judgment mechanism which is applicable to hybrid SDN.


## 3. The Standardized Models for Hybrid SDN

### 3.1. Hybrid SDN Architecture

SDN cannot connect directly with legacy IP network due to the difference in message exchange mode; the hybrid SDN architecture is to be formed. Hybrid SDN networks are divided into the SDN autonomous system (SAS) and IP autonomous system (IPAS). The SAS is a centralized framework by the SDN controller as the manager, while IPAS is a distributed framework, with SAS and IPAS bridged by a gateway, as shown in Figure2. The IP and SDN is hybrid in topology and divided into two domains, which face compatibility problems and security challenges in both domains [16].Figure 2
Hybrid SDN Architecture (left is the SAS domain, right is the IPAS domain, and the gateway connects two domains).The SAS contains an SDN controller, OpenFlow switches, legacy routers, legacy switches, middleware, agent, and IIoT devices. In Figure2, the yellow table is the flow table which indicates that the device is under SDN control, and the green table is the legacy routing table. There are several networking models for SDN and IP networks to coexist: (1) a networkwide SDN in which SDN controllers manage OpenFlow switches and IIoT nodes: the mode is simple to deploy as the SDN controller performs all the management roles in the network, but not all legacy devices support centralized management protocols. The SDN controller can execute the communication protocol by itself without protocol translation. A networkwide SDN mode is costly in the process of upgrading legacy network scenarios [17]. In terms of security, the problem of a single-point failure in the networkwide SDN controller is fatal, as illustrated by the red line in Figure 2. (2) Incremental deployment of SDN in legacy networks: the SDN controller uses the middleware to change the configuration of legacy devices by parsing the original IP legacy protocol to interact with the SDN switch in standard mode. The SDN switch does not need to support all OpenFlow features in the middleware mode. The middleware node is illustrated in the left diagram of Figure 2. (3) Legacy router/switch deployment in the SDN domain: an agent to implement the OpenFlow protocol is added to the legacy device to communicate with the controller without any changes applied to the controller. The bottleneck of the agent limits the scalability of the network, as illustrated by the agent node in the left diagram of Figure 2. A comparison of hybrid SDN networking models is shown in Table 1.Table 1
Comparison of hybrid SDN networking models.
Networking modelSDN componentsProtocol conversionCommunication scopeScalability & robustnessNetworkwide SDNController/switches/nodesN/ASDN internalImpacted by SDN controller performanceSDN middlewareController/middleware/nodesMiddleware parsing protocolAt least one SDN deviceRestricted by protocol parsingSDN agentController/legacy switches & agents/nodesAgent parsing protocolAll nodes limited by agentsLimited by controller loadsHybrid SDNController/switches/gateways/legacy switches & routers/nodesVLAN gatewayNetworkwideDependent on network architecture


### 3.2. The SAS Intradomain Standardized Model

The SDN architecture defined by the ONF organization is divided into three layers [18], as illustrated in Figure 3. The SDN network infrastructure consists of switches, routers, middleware, and SDN network protocols. The SDN control plane executes the protocols and software, including the southbound protocol, network operating system, northbound open interface, and application layer software. OpenFlow is the most widely used southbound interface standard in SDN, connecting the controller and forwarding devices to achieve separation of the control plane and data plane. The northbound interface is an open interface to business applications that connects the control plane and application plane. The SDN controller (SDN network operating system) is a centralized scheduler of various resources in the network to provide services for traffic engineering, mobile and wireless networks, network measurement and monitoring, network security, and data center networks. The SAS intradomain standardized model is proposed as follows.Figure 3
The SDN network architecture (the ONF organization defines three layers, including control plane, data plane, and application plane).


#### 3.2.1. SAS Device Attribute Description Vector

The core functions of the SDN controller include forwarding device management, forwarding rule calculation, and resource management, which realize the centralized management of SDN. A single-node controller architecture is illustrated in the middle of Figure3. SDN controller attributes are denoted by the 7-tuple DC=id,ds,im,cm,CS,CM,CA, where id indicates the controller identity (including network identification number, authentication key, and additional access information); ds indicates the digest value of the stored information component in the controller, which is used to store and manage all SDN information; and im is the digest value of the information processing component, which is used to configure various rules of the forwarding device, im=ft,gt,mt,pp. OpenFlow switches consist of ports and flow tables, group tables, and meter tables. The set of ports is denoted by pp. The flow table ft is the forwarding table digest value for data flow. A data flow corresponds with a flow table entry, and the mapping of the source and destination flow tables is configured by the specific forwarding device. The group table gt is defined as a set of action buckets that can be used by multiple flow table entries to achieve multicast, load balancing, disaster tolerant backup, and aggregation functions. The meter table mt provides QoS for OpenFlow switches by metering flows and setting speed limit rules. cm is the control management component, which represents the communication overhead of the controller. The component is responsible for connecting various forwarding devices of SDN networks and managing the flow table states. CS denotes the mapping relationship of the ith controller instance Xi and the w switches attached to it. If CS contains SDN middleware or agent in the hybrid SDN structure (see Figure 2), CM denotes the mapping relationship of Xi and the middleware which belongs to it, and CA denotes the mapping relationship of Xi and the agent which belongs to it.The other nodes must register their device attributes information to the SDN controller when they are first accessing to network. The network nodes and IIoT nodes consist of device identificationid, device type dt, device hardware information ho, basis software, and configuration protocol information hs, which are described by the 4-tuple WNN=id,dt,ho,hs.


#### 3.2.2. SAS Network Attribute Description Vector

In SDN networks, the bandwidth isbw, the trading delay is td, the flow table lifetime is tt, and the time delay is tl. Therefore, the following 4-tuple is defined to describe the network attributes NS=bw,td,tt,tl, where the trading delay td represents the time gap from the entry of the packet into processing to the end of being processed, assuming that the beginning time is t1 and the end time is t2, then td=t2−t1. The flow table lifetime tt indicates the flow table existence time, and the value tt impacts the switch forwarding speed; the larger means the longer occupied the switch time, the more load for the flow table to process. The time delay tl indicates the time that a packet is sent from the source to the destination and consists of the link trading delay, signal propagation time on the link, node queuing, and processing time, tl=∑i=1mp/bwi+tdi+∑j=1ntqj+tsj, where p is the packet group size, bwi is the bandwidth, tdi is the signal propagation delay, tqj is the node queuing time, and tsj is the node processing time.


#### 3.2.3. SAS Link State Description Vector

The SDN link states include the node addition and deletion, link alteration, and the topology states. The SDN network topology is represented by a 3-tupleTopo=N,P,L,where N denote the set of nodes, P denotes the set of ports, and L denotes the set of links in topology. Lp1,p2 denotes the data flow from port p1 to port p2, p1,p2∈P. When p1,p2 belong to the same node, L indicates a data link from port p1 in to port p2 out in a node; when p1,p2 belong to different nodes, L indicates a data link through port p1 to port p2. Then, Topoi=Ni,Pi,Li and Topoj=Nj,Pj,Lj denote the network topology states at the ith moment and the jth moment. ΔTopoi⟶j denotes the topology changes, ΔTopoj=ΔNi⟶j,ΔPi⟶j,ΔLi⟶j, where ΔNi⟶j denotes the set of node changes from the ith to the jth moment, ΔNi⟶j=∑k∈1,2⋯±nvk, where nv∈N means nodes, ± means add/delete nv nodes by device management module in controller, if ΔNi⟶j=NULL means no change in device nodes. ΔPi⟶j denotes the set of port changes from the ith to the jth moment, ΔPi⟶j=∑±pnvu, where pnvu denotes the uth port of node nv, ± denotes port enabled/disabled, and the port addition/deletion depends on the data forwarding rule ΔLi⟶j. ΔLi⟶j denotes the changes of data links from the ith to the jth moment, ΔLi⟶j=∑±Lpu1na,pu2nb, where ±Lpu1na,pu2nb indicates the link change from the port u1 of node na into the port u2 output of node nb, na,nb∈N, pu1na,pu2nb∈P. If there is no change in the device node, topology switching is performed based on the data of ΔLi⟶j in ΔTopoi⟶j.


#### 3.2.4. SAS Application Task Description Vector

Given that the set ofk tenants in SAS is O=o1,o2,⋯,ok, n applications represented the set A=a1,a2,⋯,an; each application runs m tasks represented by the set S=s1,s2,⋯,sm; the mapping relationship between controller and switches is CS; the w×n mapping relationship is constructed between w switches and n applications, represented by SA; the k×n mapping relationship is constructed between k tenants and n applications as TA; and the n×m mapping relationship is constructed between n applications and m tasks as OA; then, the SDN application tasks can be described by the 4-tuple AT=CS,SA,TA,OA.The SAS standardized model can be composed of device attributes description vectorDC, network attributes description vector NS, link states description vector Topo, and application tasks description vector AT; thus, the SDN single-controller mapping model is represented by the 5-tuple NSC=DC,WNN,NS,Topo,AT.


### 3.3. The IPAS Intradomain Standardized Model

There are some heterogeneous networks in IIoT scenarios, with the difference in hardware and software attributes, deployment locations, task states, computing capabilities, and network data trading capabilities of the nodes. Building a mapping model of IIoT nodes is critical to complete IIoT security and trust. A unified mapping model for IIoT devices in IPAS is shown as follows.


#### 3.3.1. IIoT Device Raw Attribute Description Vector

The IIoT devices are identified by attributes solidified in devices, such as the device profile information about the device hardware type, vendor, product name, version number, and device verification information. The software attributes consist of firmware, communication protocols, third-party libraries, and operating system information. Firmware is a software module to accomplish the communication between various types of devices in order to overcome the problem of heterogeneous communication protocols. The device identification isid, the hardware device information digest value is denoted by hn, and the basic software digest value is denoted by hs; then, the 3-tuple NN=id,hn,hs is used as the identification information of the IIoT heterogeneous node entity.


#### 3.3.2. IIoT Network Attribute Description Vector

A set of network addresses is present by the node source address, destination address, and MAC address asna, np is present as the set of ports, network bandwidth as nb, the selected channel as nc, the requested data as nq, the actual sending data as nd, the response time as nt, the IIoT heterogeneous network environment can be represented by the 7-tuple NS=na,np,nb,nc,nq,nd,nt.


#### 3.3.3. IIoT Link State Description Vector

The IP network routers are interconnected through links, usually indicated by the unweighted undirected connectivity diagram [17]. Topo=V,E is present the state of links, where V denotes the set of routers, switches, and IIoT nodes and E denotes the set of links. There are two link instances Topoi and Topoj, and the change of nodes ΔVi⟶j using the intersection of two-node sets is presented by ΔVi⟶j=Vi⋂Vj, and the change of links is presented by ΔEi⟶j=Ei⋂Ej.


#### 3.3.4. IIoT Application Task Description Vector

IIoT nodes collect data, forward the data, and even provide services. The composite tasks execute in multiapplication multitasking scenarios. InΔt, NA=na1,na2,⋯,nan denotes the set of all applications running at a node instance, and the subtasks set running at an application instance is presented by NT=nt1,nt2,⋯,ntm. Each subtask can only connect one channel in a time period, and the channel set is presented by NC=nc1,nc2,⋯,nck. The application tasks of the node are presented as the 3-tuple NAT=NA,NT,NC.The IIoT devices in IPAS are interconnected using IP protocols. The IPAS node is mapped by building multidimensional attributes such as raw attributesNN, network attributes NS, link states Topo, and application tasks NAT. Thus, the IPAS node can be represented by the 4-tuple NIP=NN,NS,Topo,NAT.


## 3.1. Hybrid SDN Architecture

SDN cannot connect directly with legacy IP network due to the difference in message exchange mode; the hybrid SDN architecture is to be formed. Hybrid SDN networks are divided into the SDN autonomous system (SAS) and IP autonomous system (IPAS). The SAS is a centralized framework by the SDN controller as the manager, while IPAS is a distributed framework, with SAS and IPAS bridged by a gateway, as shown in Figure2. The IP and SDN is hybrid in topology and divided into two domains, which face compatibility problems and security challenges in both domains [16].Figure 2
Hybrid SDN Architecture (left is the SAS domain, right is the IPAS domain, and the gateway connects two domains).The SAS contains an SDN controller, OpenFlow switches, legacy routers, legacy switches, middleware, agent, and IIoT devices. In Figure2, the yellow table is the flow table which indicates that the device is under SDN control, and the green table is the legacy routing table. There are several networking models for SDN and IP networks to coexist: (1) a networkwide SDN in which SDN controllers manage OpenFlow switches and IIoT nodes: the mode is simple to deploy as the SDN controller performs all the management roles in the network, but not all legacy devices support centralized management protocols. The SDN controller can execute the communication protocol by itself without protocol translation. A networkwide SDN mode is costly in the process of upgrading legacy network scenarios [17]. In terms of security, the problem of a single-point failure in the networkwide SDN controller is fatal, as illustrated by the red line in Figure 2. (2) Incremental deployment of SDN in legacy networks: the SDN controller uses the middleware to change the configuration of legacy devices by parsing the original IP legacy protocol to interact with the SDN switch in standard mode. The SDN switch does not need to support all OpenFlow features in the middleware mode. The middleware node is illustrated in the left diagram of Figure 2. (3) Legacy router/switch deployment in the SDN domain: an agent to implement the OpenFlow protocol is added to the legacy device to communicate with the controller without any changes applied to the controller. The bottleneck of the agent limits the scalability of the network, as illustrated by the agent node in the left diagram of Figure 2. A comparison of hybrid SDN networking models is shown in Table 1.Table 1
Comparison of hybrid SDN networking models.
Networking modelSDN componentsProtocol conversionCommunication scopeScalability & robustnessNetworkwide SDNController/switches/nodesN/ASDN internalImpacted by SDN controller performanceSDN middlewareController/middleware/nodesMiddleware parsing protocolAt least one SDN deviceRestricted by protocol parsingSDN agentController/legacy switches & agents/nodesAgent parsing protocolAll nodes limited by agentsLimited by controller loadsHybrid SDNController/switches/gateways/legacy switches & routers/nodesVLAN gatewayNetworkwideDependent on network architecture


## 3.2. The SAS Intradomain Standardized Model

The SDN architecture defined by the ONF organization is divided into three layers [18], as illustrated in Figure 3. The SDN network infrastructure consists of switches, routers, middleware, and SDN network protocols. The SDN control plane executes the protocols and software, including the southbound protocol, network operating system, northbound open interface, and application layer software. OpenFlow is the most widely used southbound interface standard in SDN, connecting the controller and forwarding devices to achieve separation of the control plane and data plane. The northbound interface is an open interface to business applications that connects the control plane and application plane. The SDN controller (SDN network operating system) is a centralized scheduler of various resources in the network to provide services for traffic engineering, mobile and wireless networks, network measurement and monitoring, network security, and data center networks. The SAS intradomain standardized model is proposed as follows.Figure 3
The SDN network architecture (the ONF organization defines three layers, including control plane, data plane, and application plane).


### 3.2.1. SAS Device Attribute Description Vector

The core functions of the SDN controller include forwarding device management, forwarding rule calculation, and resource management, which realize the centralized management of SDN. A single-node controller architecture is illustrated in the middle of Figure3. SDN controller attributes are denoted by the 7-tuple DC=id,ds,im,cm,CS,CM,CA, where id indicates the controller identity (including network identification number, authentication key, and additional access information); ds indicates the digest value of the stored information component in the controller, which is used to store and manage all SDN information; and im is the digest value of the information processing component, which is used to configure various rules of the forwarding device, im=ft,gt,mt,pp. OpenFlow switches consist of ports and flow tables, group tables, and meter tables. The set of ports is denoted by pp. The flow table ft is the forwarding table digest value for data flow. A data flow corresponds with a flow table entry, and the mapping of the source and destination flow tables is configured by the specific forwarding device. The group table gt is defined as a set of action buckets that can be used by multiple flow table entries to achieve multicast, load balancing, disaster tolerant backup, and aggregation functions. The meter table mt provides QoS for OpenFlow switches by metering flows and setting speed limit rules. cm is the control management component, which represents the communication overhead of the controller. The component is responsible for connecting various forwarding devices of SDN networks and managing the flow table states. CS denotes the mapping relationship of the ith controller instance Xi and the w switches attached to it. If CS contains SDN middleware or agent in the hybrid SDN structure (see Figure 2), CM denotes the mapping relationship of Xi and the middleware which belongs to it, and CA denotes the mapping relationship of Xi and the agent which belongs to it.The other nodes must register their device attributes information to the SDN controller when they are first accessing to network. The network nodes and IIoT nodes consist of device identificationid, device type dt, device hardware information ho, basis software, and configuration protocol information hs, which are described by the 4-tuple WNN=id,dt,ho,hs.


### 3.2.2. SAS Network Attribute Description Vector

In SDN networks, the bandwidth isbw, the trading delay is td, the flow table lifetime is tt, and the time delay is tl. Therefore, the following 4-tuple is defined to describe the network attributes NS=bw,td,tt,tl, where the trading delay td represents the time gap from the entry of the packet into processing to the end of being processed, assuming that the beginning time is t1 and the end time is t2, then td=t2−t1. The flow table lifetime tt indicates the flow table existence time, and the value tt impacts the switch forwarding speed; the larger means the longer occupied the switch time, the more load for the flow table to process. The time delay tl indicates the time that a packet is sent from the source to the destination and consists of the link trading delay, signal propagation time on the link, node queuing, and processing time, tl=∑i=1mp/bwi+tdi+∑j=1ntqj+tsj, where p is the packet group size, bwi is the bandwidth, tdi is the signal propagation delay, tqj is the node queuing time, and tsj is the node processing time.


### 3.2.3. SAS Link State Description Vector

The SDN link states include the node addition and deletion, link alteration, and the topology states. The SDN network topology is represented by a 3-tupleTopo=N,P,L,where N denote the set of nodes, P denotes the set of ports, and L denotes the set of links in topology. Lp1,p2 denotes the data flow from port p1 to port p2, p1,p2∈P. When p1,p2 belong to the same node, L indicates a data link from port p1 in to port p2 out in a node; when p1,p2 belong to different nodes, L indicates a data link through port p1 to port p2. Then, Topoi=Ni,Pi,Li and Topoj=Nj,Pj,Lj denote the network topology states at the ith moment and the jth moment. ΔTopoi⟶j denotes the topology changes, ΔTopoj=ΔNi⟶j,ΔPi⟶j,ΔLi⟶j, where ΔNi⟶j denotes the set of node changes from the ith to the jth moment, ΔNi⟶j=∑k∈1,2⋯±nvk, where nv∈N means nodes, ± means add/delete nv nodes by device management module in controller, if ΔNi⟶j=NULL means no change in device nodes. ΔPi⟶j denotes the set of port changes from the ith to the jth moment, ΔPi⟶j=∑±pnvu, where pnvu denotes the uth port of node nv, ± denotes port enabled/disabled, and the port addition/deletion depends on the data forwarding rule ΔLi⟶j. ΔLi⟶j denotes the changes of data links from the ith to the jth moment, ΔLi⟶j=∑±Lpu1na,pu2nb, where ±Lpu1na,pu2nb indicates the link change from the port u1 of node na into the port u2 output of node nb, na,nb∈N, pu1na,pu2nb∈P. If there is no change in the device node, topology switching is performed based on the data of ΔLi⟶j in ΔTopoi⟶j.


### 3.2.4. SAS Application Task Description Vector

Given that the set ofk tenants in SAS is O=o1,o2,⋯,ok, n applications represented the set A=a1,a2,⋯,an; each application runs m tasks represented by the set S=s1,s2,⋯,sm; the mapping relationship between controller and switches is CS; the w×n mapping relationship is constructed between w switches and n applications, represented by SA; the k×n mapping relationship is constructed between k tenants and n applications as TA; and the n×m mapping relationship is constructed between n applications and m tasks as OA; then, the SDN application tasks can be described by the 4-tuple AT=CS,SA,TA,OA.The SAS standardized model can be composed of device attributes description vectorDC, network attributes description vector NS, link states description vector Topo, and application tasks description vector AT; thus, the SDN single-controller mapping model is represented by the 5-tuple NSC=DC,WNN,NS,Topo,AT.


## 3.2.1. SAS Device Attribute Description Vector

The core functions of the SDN controller include forwarding device management, forwarding rule calculation, and resource management, which realize the centralized management of SDN. A single-node controller architecture is illustrated in the middle of Figure3. SDN controller attributes are denoted by the 7-tuple DC=id,ds,im,cm,CS,CM,CA, where id indicates the controller identity (including network identification number, authentication key, and additional access information); ds indicates the digest value of the stored information component in the controller, which is used to store and manage all SDN information; and im is the digest value of the information processing component, which is used to configure various rules of the forwarding device, im=ft,gt,mt,pp. OpenFlow switches consist of ports and flow tables, group tables, and meter tables. The set of ports is denoted by pp. The flow table ft is the forwarding table digest value for data flow. A data flow corresponds with a flow table entry, and the mapping of the source and destination flow tables is configured by the specific forwarding device. The group table gt is defined as a set of action buckets that can be used by multiple flow table entries to achieve multicast, load balancing, disaster tolerant backup, and aggregation functions. The meter table mt provides QoS for OpenFlow switches by metering flows and setting speed limit rules. cm is the control management component, which represents the communication overhead of the controller. The component is responsible for connecting various forwarding devices of SDN networks and managing the flow table states. CS denotes the mapping relationship of the ith controller instance Xi and the w switches attached to it. If CS contains SDN middleware or agent in the hybrid SDN structure (see Figure 2), CM denotes the mapping relationship of Xi and the middleware which belongs to it, and CA denotes the mapping relationship of Xi and the agent which belongs to it.The other nodes must register their device attributes information to the SDN controller when they are first accessing to network. The network nodes and IIoT nodes consist of device identificationid, device type dt, device hardware information ho, basis software, and configuration protocol information hs, which are described by the 4-tuple WNN=id,dt,ho,hs.


## 3.2.2. SAS Network Attribute Description Vector

In SDN networks, the bandwidth isbw, the trading delay is td, the flow table lifetime is tt, and the time delay is tl. Therefore, the following 4-tuple is defined to describe the network attributes NS=bw,td,tt,tl, where the trading delay td represents the time gap from the entry of the packet into processing to the end of being processed, assuming that the beginning time is t1 and the end time is t2, then td=t2−t1. The flow table lifetime tt indicates the flow table existence time, and the value tt impacts the switch forwarding speed; the larger means the longer occupied the switch time, the more load for the flow table to process. The time delay tl indicates the time that a packet is sent from the source to the destination and consists of the link trading delay, signal propagation time on the link, node queuing, and processing time, tl=∑i=1mp/bwi+tdi+∑j=1ntqj+tsj, where p is the packet group size, bwi is the bandwidth, tdi is the signal propagation delay, tqj is the node queuing time, and tsj is the node processing time.


## 3.2.3. SAS Link State Description Vector

The SDN link states include the node addition and deletion, link alteration, and the topology states. The SDN network topology is represented by a 3-tupleTopo=N,P,L,where N denote the set of nodes, P denotes the set of ports, and L denotes the set of links in topology. Lp1,p2 denotes the data flow from port p1 to port p2, p1,p2∈P. When p1,p2 belong to the same node, L indicates a data link from port p1 in to port p2 out in a node; when p1,p2 belong to different nodes, L indicates a data link through port p1 to port p2. Then, Topoi=Ni,Pi,Li and Topoj=Nj,Pj,Lj denote the network topology states at the ith moment and the jth moment. ΔTopoi⟶j denotes the topology changes, ΔTopoj=ΔNi⟶j,ΔPi⟶j,ΔLi⟶j, where ΔNi⟶j denotes the set of node changes from the ith to the jth moment, ΔNi⟶j=∑k∈1,2⋯±nvk, where nv∈N means nodes, ± means add/delete nv nodes by device management module in controller, if ΔNi⟶j=NULL means no change in device nodes. ΔPi⟶j denotes the set of port changes from the ith to the jth moment, ΔPi⟶j=∑±pnvu, where pnvu denotes the uth port of node nv, ± denotes port enabled/disabled, and the port addition/deletion depends on the data forwarding rule ΔLi⟶j. ΔLi⟶j denotes the changes of data links from the ith to the jth moment, ΔLi⟶j=∑±Lpu1na,pu2nb, where ±Lpu1na,pu2nb indicates the link change from the port u1 of node na into the port u2 output of node nb, na,nb∈N, pu1na,pu2nb∈P. If there is no change in the device node, topology switching is performed based on the data of ΔLi⟶j in ΔTopoi⟶j.


## 3.2.4. SAS Application Task Description Vector

Given that the set ofk tenants in SAS is O=o1,o2,⋯,ok, n applications represented the set A=a1,a2,⋯,an; each application runs m tasks represented by the set S=s1,s2,⋯,sm; the mapping relationship between controller and switches is CS; the w×n mapping relationship is constructed between w switches and n applications, represented by SA; the k×n mapping relationship is constructed between k tenants and n applications as TA; and the n×m mapping relationship is constructed between n applications and m tasks as OA; then, the SDN application tasks can be described by the 4-tuple AT=CS,SA,TA,OA.The SAS standardized model can be composed of device attributes description vectorDC, network attributes description vector NS, link states description vector Topo, and application tasks description vector AT; thus, the SDN single-controller mapping model is represented by the 5-tuple NSC=DC,WNN,NS,Topo,AT.


## 3.3. The IPAS Intradomain Standardized Model

There are some heterogeneous networks in IIoT scenarios, with the difference in hardware and software attributes, deployment locations, task states, computing capabilities, and network data trading capabilities of the nodes. Building a mapping model of IIoT nodes is critical to complete IIoT security and trust. A unified mapping model for IIoT devices in IPAS is shown as follows.


### 3.3.1. IIoT Device Raw Attribute Description Vector

The IIoT devices are identified by attributes solidified in devices, such as the device profile information about the device hardware type, vendor, product name, version number, and device verification information. The software attributes consist of firmware, communication protocols, third-party libraries, and operating system information. Firmware is a software module to accomplish the communication between various types of devices in order to overcome the problem of heterogeneous communication protocols. The device identification isid, the hardware device information digest value is denoted by hn, and the basic software digest value is denoted by hs; then, the 3-tuple NN=id,hn,hs is used as the identification information of the IIoT heterogeneous node entity.


### 3.3.2. IIoT Network Attribute Description Vector

A set of network addresses is present by the node source address, destination address, and MAC address asna, np is present as the set of ports, network bandwidth as nb, the selected channel as nc, the requested data as nq, the actual sending data as nd, the response time as nt, the IIoT heterogeneous network environment can be represented by the 7-tuple NS=na,np,nb,nc,nq,nd,nt.


### 3.3.3. IIoT Link State Description Vector

The IP network routers are interconnected through links, usually indicated by the unweighted undirected connectivity diagram [17]. Topo=V,E is present the state of links, where V denotes the set of routers, switches, and IIoT nodes and E denotes the set of links. There are two link instances Topoi and Topoj, and the change of nodes ΔVi⟶j using the intersection of two-node sets is presented by ΔVi⟶j=Vi⋂Vj, and the change of links is presented by ΔEi⟶j=Ei⋂Ej.


### 3.3.4. IIoT Application Task Description Vector

IIoT nodes collect data, forward the data, and even provide services. The composite tasks execute in multiapplication multitasking scenarios. InΔt, NA=na1,na2,⋯,nan denotes the set of all applications running at a node instance, and the subtasks set running at an application instance is presented by NT=nt1,nt2,⋯,ntm. Each subtask can only connect one channel in a time period, and the channel set is presented by NC=nc1,nc2,⋯,nck. The application tasks of the node are presented as the 3-tuple NAT=NA,NT,NC.The IIoT devices in IPAS are interconnected using IP protocols. The IPAS node is mapped by building multidimensional attributes such as raw attributesNN, network attributes NS, link states Topo, and application tasks NAT. Thus, the IPAS node can be represented by the 4-tuple NIP=NN,NS,Topo,NAT.


## 3.3.1. IIoT Device Raw Attribute Description Vector

The IIoT devices are identified by attributes solidified in devices, such as the device profile information about the device hardware type, vendor, product name, version number, and device verification information. The software attributes consist of firmware, communication protocols, third-party libraries, and operating system information. Firmware is a software module to accomplish the communication between various types of devices in order to overcome the problem of heterogeneous communication protocols. The device identification isid, the hardware device information digest value is denoted by hn, and the basic software digest value is denoted by hs; then, the 3-tuple NN=id,hn,hs is used as the identification information of the IIoT heterogeneous node entity.


## 3.3.2. IIoT Network Attribute Description Vector

A set of network addresses is present by the node source address, destination address, and MAC address asna, np is present as the set of ports, network bandwidth as nb, the selected channel as nc, the requested data as nq, the actual sending data as nd, the response time as nt, the IIoT heterogeneous network environment can be represented by the 7-tuple NS=na,np,nb,nc,nq,nd,nt.


## 3.3.3. IIoT Link State Description Vector

The IP network routers are interconnected through links, usually indicated by the unweighted undirected connectivity diagram [17]. Topo=V,E is present the state of links, where V denotes the set of routers, switches, and IIoT nodes and E denotes the set of links. There are two link instances Topoi and Topoj, and the change of nodes ΔVi⟶j using the intersection of two-node sets is presented by ΔVi⟶j=Vi⋂Vj, and the change of links is presented by ΔEi⟶j=Ei⋂Ej.


## 3.3.4. IIoT Application Task Description Vector

IIoT nodes collect data, forward the data, and even provide services. The composite tasks execute in multiapplication multitasking scenarios. InΔt, NA=na1,na2,⋯,nan denotes the set of all applications running at a node instance, and the subtasks set running at an application instance is presented by NT=nt1,nt2,⋯,ntm. Each subtask can only connect one channel in a time period, and the channel set is presented by NC=nc1,nc2,⋯,nck. The application tasks of the node are presented as the 3-tuple NAT=NA,NT,NC.The IIoT devices in IPAS are interconnected using IP protocols. The IPAS node is mapped by building multidimensional attributes such as raw attributesNN, network attributes NS, link states Topo, and application tasks NAT. Thus, the IPAS node can be represented by the 4-tuple NIP=NN,NS,Topo,NAT.


## 4. A Trusted Judgment Model for Hybrid SDN

### 4.1. The Definition of the Trusted Judgment Model

In the hybrid SDN scenario, the trusted judgment methods are different based on the networking models of SAS and IPAS. Because of the centralized networking in SAS, the controller as the manager evaluates other nodes according to the feature evaluation function to judge whether they are trusted. In IPAS, there is no management node; hence, the nodes are equal to each other; thus, the feature evaluation function needs to be developed by the collaboration of the nodes and then judge which nodes are trusted by the feature evaluation function. All operations of the abnormal nodes in domains will be strictly restricted. The definition of trusted judgment is shown as follows.Proposition 1 (SAS feature evaluation function).
Suppose there exists a groupGs, the mapping model of nodes in SAS is NSC, the SDN controller is the management node, the node rule calculation function is Gs is FV, and the trust value of node Xi is calculated by the feature evaluation function MSAS·, then the node trust value is calculate as TrustXi=MSASNSC,FV.Proposition 2 (IPAS feature evaluation function).
Suppose there exists a groupGs, the mapping of nodes in IPAS is NIP, the node rule calculation function is FV′, and the trust value of node Xi is calculated by the feature evaluation function MIP·, then the node trust value is calculate as TrustXi=MIPNIP,FV′.Proposition 3 (Trusted judgment).
Set a trust value boundary thresholdHt at each autonomous system; if the node trust value TrustXi<Ht, the node is judged to be abnormal and all the operations of the node are restricted.


### 4.2. The SAS Intradomain Trusted Judgment Model

The trusted judgment model is realized based on the standardized model in Section3, and the following logically describes the process of trusted judgment for nodes in SAS and IPAS. Assuming that the SDN controller as the management node in SAS is trusted, it is necessary to perform the trusted judgment for the connected devices, as described in Section 3, the control node measures the network nodes such as router, switch, middleware and the common IIoT nodes to ensure the global trust value in the SAS domain, as demonstrated in Figure 4.Figure 4
The trusted judgment model in SAS (including the trusted judgment of SDN controller, network nodes, and IIoT nodes).


#### 4.2.1. Node Device Metric

In SAS, the IIoT devices request to access the network for the first time or the global trust value is lower than the threshold that needs to evaluate, based on the device attributes description vectorWNN=dt,id,ho,hf of the nodes as input. The digest value of the node hardware and software is judged by the feature evaluation function MSAS· whether the IIoT node is trusted, and the IIoT node trusted evaluation is performed by the network node. In case x is the superior node and x.dt,x.ho,x.hs denotes the device type, hardware, and software information submitted at the first registration period to x; the device trust value of the nodes MSAS1WNN,∧ in SAS is calculated by
(1)MSAS1WNN,∧=x.id∧idx.dt∧dtx.ho∧hox.hs∧hs.IIoT node submits attributes such as device information when it is registered, and the superior node will compare the submitted information with the one registered to judge whether the node is a fake or not. AndMSAS1WNN,∧=1 indicates that basic information such as node software and hardware is not forged.


#### 4.2.2. Dynamic Behavior Metric

The node device metric is only a verification of the identity, and the dynamic behavior metric of the node is also necessary. The node network attributesNS=bw,td,tt,tl reflect the network quality level. Assuming the network state expectation set by the SDN controller at time t is ENS, the cosine similarity is used to calculate the network state similarity function to decide the network environment similarity fNS=ENS·NS/ENSNS. The data trading latency td must be in the tolerable range, with a threshold value of θ. If td>θ, the probability of the attacked node is increased and the data trading delay metric value is Ttd=tdtd−θ/θ,td>θtd,otherwise. The malicious node drops specific packets by probabilistic forwarding or by spoofing, tampering, or retransmitting routing information through routing loops. Therefore, the data forwarding amount and the repetition rate can be used to detect the abnormal behavior of the node. The data forwarding of the node can be obtained from the flow table for the requested data forwarding amount fq and the actual data forwarding amount fs and the data repetition rate φ; then, the actual forwarding ratio value of the node is Tfs=fs·log21+fs/fq+1. The threshold value of data forwarding repetition rate is δ, if φ>δ; it is possible to occur the blackhole attack and the repetition rate for forwarding behavior is Tφ=fq1−δφ,φ<δ0,otherwise.In summary, the node dynamic metric can reflect the impact of the anomalous nodes. The node dynamic behavior trust valueMSAS2NS,fNS is defined by the network environment similarity, data trading delay metric, the actual forwarding ratio value, and the data repetition rate. Thus, MSAS2NS,fNS is calculated by
(2)MSAS2NS,fNS=fNSεtd·Ttd+εfs·Tfs+εφ·Tφ,where εtd, εfs, and εφ denotes the weights, and εtd+εfs+εφ=1.


#### 4.2.3. Task Execution Environment Metric

The node operational state is dynamic, and the node task execution is used to evaluate whether the node operation is as expected. The accuracy and dynamics of the node metric require checking the node behavior change in the time windowΔt. And the node behavior change is denoted by BN=ΔTopoi⟶j,AT, the expected behavior of the node is presented by BN⟶=ΔTopoi⟶j,AT, and the Jaccard similarity coefficient is used to calculate the execution environment trust value MSAS3BN,BN⟶ by
(3)MSAS3BN,BN⟶=JaccardBN,BN⟶1+JaccardBN,BN⟶·BN+BN⟶,whereJaccardBN,BN⟶=BN⋂BN⟶/BN⋃BN⟶ denotes the Jaccard similarity coefficient of the set BN with BN⟶. The larger the MSAS3BN,BN⟶ value, the more similar to the actual operational behavior of the node and the expected behavior, as well as the higher the dynamic behavior trust value. Jaccard similarity coefficient can be used to quickly estimate the similarity of two sets using the MinHash algorithm [19].


#### 4.2.4. Global Trust Value of the Node

The node global trust value is aggregated by the node device trust valueMSAS1WNN,∧, the node dynamic behavior trust value MSAS2NS,fNS, and the node task environment trust value MSAS3BN,BN⟶. If the node device trust value is 0, the node is faked. The global trust value of the node TrustXi is calculated by
(4)TrustXi=MSAS1WNN,∧α·MSAS2NS,fNS+β·MSAS3BN,BN⟶,where α and β denote the weights, α+β=1.In SAS, the controller performs the security situation assessment of each node, including initial integrity verification and dynamic behavior verification. If the trust value of the node is higher than the given trusted threshold, the node is considered trusted; otherwise, the node is untrusted to restrict the node operation to ensure the SAS domain is trusted.


### 4.3. The IPAS Intradomain Trusted Judgment Model

In IPAS, the security situation assessment of the node in the distributed network is realized by its neighbor nodes. The node using store-and-forward messages can obtain the recommendation trust value by the neighbor nodes, as illustrated in Figure5.Figure 5
The distributed networking and trusted judgment model in IPAS (including direct recommendation trust and indirect recommendation trust).


#### 4.3.1. Direct Recommendation Trust Value

In IPAS, the node is connected to the network and exchanges identity information with neighbor nodes to be evaluated, moreover, let nodeXj evaluate node Xi has a times normal interaction and b times abnormal interaction. The interaction result obeys the betapa,b distribution, and p is the posterior probability of a,b [20]. According to the Bayesian trust model, the expectation is used as the trust value, the directly recommendation trust value MIP1a,b can be calculated by
(5)MIP1a,b=Ebetapa,b=a+1a+b+2.The Bayesian trust model only considers the interaction among nodes and does not consider the effect of the recommendation trust value on the current nodes, such as the decline of trust value with the increase of time. Assume in the time windowΔt, for the node Xi, the sequence of n directly recommendation trust values is M1,M2,⋯,Mn. Let M1 be a trust value of node Xi with the longest time, and Mn is the trust value at the current time. The decay function exhibits that the node trust value decays according to the changes of the execution times n, so the decay function is defined as Hi=1i=nHi−1=Hi−1/n,1≤i≤n, where Hi∈0,1.A reward/punishment factor is used to evaluate the successful/failed interaction behavior of nodes, then the reward/punishment factor is set toFx=Nx/Na+Nb, where x=a,b indicates successful interaction or failed interaction behavior, Na is the number of successful interactions, and Nb is the number of failed interactions. The reward value Ri of the current node is related to the times i that the node is judged to be trusted and the reward value Ri−1 of the previous time. The node reward factor is FxR and the punishment factor is FxF, so the node reward/punishment value can be calculated by RiFx=Ri−1∗1+FxRi−1Ri−1∗1−FxPi−1. The trust value is decayed with time while the reward/punishment factor needs to be updated. When a node completes an interaction, if the interaction behavior is a successful interaction, it is counted in the sequence Maij, then aij=∑i=1nRi·Hi·Maij. If the interaction is failed, it is counted in the sequence Mbij, then bij=∑i=1nRi·Hi·Mbij. aij and bij are substituted into the Bayesian trust model (Equation (5)); then, the direct recommendation trust value MIP1 of the node is calculated in
(6)MIP1aij,bij=aij+1aij+bij+2.


#### 4.3.2. Indirect Recommendation Trust Value

For the distributed networking model, the neighbor nodes need to be evaluated comprehensively, as shown by the blue line in Figure4, where malicious nodes may raise or devalue the trust value of the evaluated node. Let the initial recommendation trust value sequence for the node Xi be mr1,mr2,⋯,mrk, and the direct recommendation trust mathematical expectation is Emr=1/k∑i=1kmri, and calculate the recommendation trust and its mathematical expectation trust similarity as the deviation of the trust data; the further away from the expected value the smaller the weight, the more likely it is to be malicious and defamatory. The Euclidean distance similarity discrimination is used to calculate the trust data evaluation dispersion as fmri=Emr−mri/∑i=1kEmr−mri2. According to the indirect recommendation trust value and its weight, the indirect recommendation trust value is MIP2, as shown by
(7)MIP2mri,fmri=∑i=1k1−fmri·mri.


#### 4.3.3. Global Trust Value of the Node

With the distributed networking model of IPAS, the global trust value of the evaluated nodeXi at the moment t merges the direct recommendation trust value and the indirect recommendation trust value, and the global trust value TrustXi is calculated by
(8)TrustXi=α·MIP1aij,bij·+β·MIP2Xi,fmri,whereα and β are the adaptive weight of direct recommendation trust and indirect recommendation trust, and α+β=1. The information entropy HMIP1,HMIP2 is used to determine the weights corresponding to each indicator to overcome the limitations of empirically weights [20]; then α and β are calculated as follows:
(9)α=1−HMIP1/log2MIP11−HMIP1/log2MIP1+1−HMIP2/log2MIP2,β=1−HMIP2/log2MIP21−HMIP1/log2MIP1+1−HMIP2/log2MIP2.The security situation assessment of IIoT nodes in IPAS, if the trust value of the node is larger than the threshold value, the node is considered to be trusted; otherwise, the node is untrusted, and the node operation is restricted to ensure the IPAS domain is trusted.


## 4.1. The Definition of the Trusted Judgment Model

In the hybrid SDN scenario, the trusted judgment methods are different based on the networking models of SAS and IPAS. Because of the centralized networking in SAS, the controller as the manager evaluates other nodes according to the feature evaluation function to judge whether they are trusted. In IPAS, there is no management node; hence, the nodes are equal to each other; thus, the feature evaluation function needs to be developed by the collaboration of the nodes and then judge which nodes are trusted by the feature evaluation function. All operations of the abnormal nodes in domains will be strictly restricted. The definition of trusted judgment is shown as follows.Proposition 1 (SAS feature evaluation function).
Suppose there exists a groupGs, the mapping model of nodes in SAS is NSC, the SDN controller is the management node, the node rule calculation function is Gs is FV, and the trust value of node Xi is calculated by the feature evaluation function MSAS·, then the node trust value is calculate as TrustXi=MSASNSC,FV.Proposition 2 (IPAS feature evaluation function).
Suppose there exists a groupGs, the mapping of nodes in IPAS is NIP, the node rule calculation function is FV′, and the trust value of node Xi is calculated by the feature evaluation function MIP·, then the node trust value is calculate as TrustXi=MIPNIP,FV′.Proposition 3 (Trusted judgment).
Set a trust value boundary thresholdHt at each autonomous system; if the node trust value TrustXi<Ht, the node is judged to be abnormal and all the operations of the node are restricted.


## 4.2. The SAS Intradomain Trusted Judgment Model

The trusted judgment model is realized based on the standardized model in Section3, and the following logically describes the process of trusted judgment for nodes in SAS and IPAS. Assuming that the SDN controller as the management node in SAS is trusted, it is necessary to perform the trusted judgment for the connected devices, as described in Section 3, the control node measures the network nodes such as router, switch, middleware and the common IIoT nodes to ensure the global trust value in the SAS domain, as demonstrated in Figure 4.Figure 4
The trusted judgment model in SAS (including the trusted judgment of SDN controller, network nodes, and IIoT nodes).


### 4.2.1. Node Device Metric

In SAS, the IIoT devices request to access the network for the first time or the global trust value is lower than the threshold that needs to evaluate, based on the device attributes description vectorWNN=dt,id,ho,hf of the nodes as input. The digest value of the node hardware and software is judged by the feature evaluation function MSAS· whether the IIoT node is trusted, and the IIoT node trusted evaluation is performed by the network node. In case x is the superior node and x.dt,x.ho,x.hs denotes the device type, hardware, and software information submitted at the first registration period to x; the device trust value of the nodes MSAS1WNN,∧ in SAS is calculated by
(1)MSAS1WNN,∧=x.id∧idx.dt∧dtx.ho∧hox.hs∧hs.IIoT node submits attributes such as device information when it is registered, and the superior node will compare the submitted information with the one registered to judge whether the node is a fake or not. AndMSAS1WNN,∧=1 indicates that basic information such as node software and hardware is not forged.


### 4.2.2. Dynamic Behavior Metric

The node device metric is only a verification of the identity, and the dynamic behavior metric of the node is also necessary. The node network attributesNS=bw,td,tt,tl reflect the network quality level. Assuming the network state expectation set by the SDN controller at time t is ENS, the cosine similarity is used to calculate the network state similarity function to decide the network environment similarity fNS=ENS·NS/ENSNS. The data trading latency td must be in the tolerable range, with a threshold value of θ. If td>θ, the probability of the attacked node is increased and the data trading delay metric value is Ttd=tdtd−θ/θ,td>θtd,otherwise. The malicious node drops specific packets by probabilistic forwarding or by spoofing, tampering, or retransmitting routing information through routing loops. Therefore, the data forwarding amount and the repetition rate can be used to detect the abnormal behavior of the node. The data forwarding of the node can be obtained from the flow table for the requested data forwarding amount fq and the actual data forwarding amount fs and the data repetition rate φ; then, the actual forwarding ratio value of the node is Tfs=fs·log21+fs/fq+1. The threshold value of data forwarding repetition rate is δ, if φ>δ; it is possible to occur the blackhole attack and the repetition rate for forwarding behavior is Tφ=fq1−δφ,φ<δ0,otherwise.In summary, the node dynamic metric can reflect the impact of the anomalous nodes. The node dynamic behavior trust valueMSAS2NS,fNS is defined by the network environment similarity, data trading delay metric, the actual forwarding ratio value, and the data repetition rate. Thus, MSAS2NS,fNS is calculated by
(2)MSAS2NS,fNS=fNSεtd·Ttd+εfs·Tfs+εφ·Tφ,where εtd, εfs, and εφ denotes the weights, and εtd+εfs+εφ=1.


### 4.2.3. Task Execution Environment Metric

The node operational state is dynamic, and the node task execution is used to evaluate whether the node operation is as expected. The accuracy and dynamics of the node metric require checking the node behavior change in the time windowΔt. And the node behavior change is denoted by BN=ΔTopoi⟶j,AT, the expected behavior of the node is presented by BN⟶=ΔTopoi⟶j,AT, and the Jaccard similarity coefficient is used to calculate the execution environment trust value MSAS3BN,BN⟶ by
(3)MSAS3BN,BN⟶=JaccardBN,BN⟶1+JaccardBN,BN⟶·BN+BN⟶,whereJaccardBN,BN⟶=BN⋂BN⟶/BN⋃BN⟶ denotes the Jaccard similarity coefficient of the set BN with BN⟶. The larger the MSAS3BN,BN⟶ value, the more similar to the actual operational behavior of the node and the expected behavior, as well as the higher the dynamic behavior trust value. Jaccard similarity coefficient can be used to quickly estimate the similarity of two sets using the MinHash algorithm [19].


### 4.2.4. Global Trust Value of the Node

The node global trust value is aggregated by the node device trust valueMSAS1WNN,∧, the node dynamic behavior trust value MSAS2NS,fNS, and the node task environment trust value MSAS3BN,BN⟶. If the node device trust value is 0, the node is faked. The global trust value of the node TrustXi is calculated by
(4)TrustXi=MSAS1WNN,∧α·MSAS2NS,fNS+β·MSAS3BN,BN⟶,where α and β denote the weights, α+β=1.In SAS, the controller performs the security situation assessment of each node, including initial integrity verification and dynamic behavior verification. If the trust value of the node is higher than the given trusted threshold, the node is considered trusted; otherwise, the node is untrusted to restrict the node operation to ensure the SAS domain is trusted.


## 4.2.1. Node Device Metric

In SAS, the IIoT devices request to access the network for the first time or the global trust value is lower than the threshold that needs to evaluate, based on the device attributes description vectorWNN=dt,id,ho,hf of the nodes as input. The digest value of the node hardware and software is judged by the feature evaluation function MSAS· whether the IIoT node is trusted, and the IIoT node trusted evaluation is performed by the network node. In case x is the superior node and x.dt,x.ho,x.hs denotes the device type, hardware, and software information submitted at the first registration period to x; the device trust value of the nodes MSAS1WNN,∧ in SAS is calculated by
(1)MSAS1WNN,∧=x.id∧idx.dt∧dtx.ho∧hox.hs∧hs.IIoT node submits attributes such as device information when it is registered, and the superior node will compare the submitted information with the one registered to judge whether the node is a fake or not. AndMSAS1WNN,∧=1 indicates that basic information such as node software and hardware is not forged.


## 4.2.2. Dynamic Behavior Metric

The node device metric is only a verification of the identity, and the dynamic behavior metric of the node is also necessary. The node network attributesNS=bw,td,tt,tl reflect the network quality level. Assuming the network state expectation set by the SDN controller at time t is ENS, the cosine similarity is used to calculate the network state similarity function to decide the network environment similarity fNS=ENS·NS/ENSNS. The data trading latency td must be in the tolerable range, with a threshold value of θ. If td>θ, the probability of the attacked node is increased and the data trading delay metric value is Ttd=tdtd−θ/θ,td>θtd,otherwise. The malicious node drops specific packets by probabilistic forwarding or by spoofing, tampering, or retransmitting routing information through routing loops. Therefore, the data forwarding amount and the repetition rate can be used to detect the abnormal behavior of the node. The data forwarding of the node can be obtained from the flow table for the requested data forwarding amount fq and the actual data forwarding amount fs and the data repetition rate φ; then, the actual forwarding ratio value of the node is Tfs=fs·log21+fs/fq+1. The threshold value of data forwarding repetition rate is δ, if φ>δ; it is possible to occur the blackhole attack and the repetition rate for forwarding behavior is Tφ=fq1−δφ,φ<δ0,otherwise.In summary, the node dynamic metric can reflect the impact of the anomalous nodes. The node dynamic behavior trust valueMSAS2NS,fNS is defined by the network environment similarity, data trading delay metric, the actual forwarding ratio value, and the data repetition rate. Thus, MSAS2NS,fNS is calculated by
(2)MSAS2NS,fNS=fNSεtd·Ttd+εfs·Tfs+εφ·Tφ,where εtd, εfs, and εφ denotes the weights, and εtd+εfs+εφ=1.


## 4.2.3. Task Execution Environment Metric

The node operational state is dynamic, and the node task execution is used to evaluate whether the node operation is as expected. The accuracy and dynamics of the node metric require checking the node behavior change in the time windowΔt. And the node behavior change is denoted by BN=ΔTopoi⟶j,AT, the expected behavior of the node is presented by BN⟶=ΔTopoi⟶j,AT, and the Jaccard similarity coefficient is used to calculate the execution environment trust value MSAS3BN,BN⟶ by
(3)MSAS3BN,BN⟶=JaccardBN,BN⟶1+JaccardBN,BN⟶·BN+BN⟶,whereJaccardBN,BN⟶=BN⋂BN⟶/BN⋃BN⟶ denotes the Jaccard similarity coefficient of the set BN with BN⟶. The larger the MSAS3BN,BN⟶ value, the more similar to the actual operational behavior of the node and the expected behavior, as well as the higher the dynamic behavior trust value. Jaccard similarity coefficient can be used to quickly estimate the similarity of two sets using the MinHash algorithm [19].


## 4.2.4. Global Trust Value of the Node

The node global trust value is aggregated by the node device trust valueMSAS1WNN,∧, the node dynamic behavior trust value MSAS2NS,fNS, and the node task environment trust value MSAS3BN,BN⟶. If the node device trust value is 0, the node is faked. The global trust value of the node TrustXi is calculated by
(4)TrustXi=MSAS1WNN,∧α·MSAS2NS,fNS+β·MSAS3BN,BN⟶,where α and β denote the weights, α+β=1.In SAS, the controller performs the security situation assessment of each node, including initial integrity verification and dynamic behavior verification. If the trust value of the node is higher than the given trusted threshold, the node is considered trusted; otherwise, the node is untrusted to restrict the node operation to ensure the SAS domain is trusted.


## 4.3. The IPAS Intradomain Trusted Judgment Model

In IPAS, the security situation assessment of the node in the distributed network is realized by its neighbor nodes. The node using store-and-forward messages can obtain the recommendation trust value by the neighbor nodes, as illustrated in Figure5.Figure 5
The distributed networking and trusted judgment model in IPAS (including direct recommendation trust and indirect recommendation trust).


### 4.3.1. Direct Recommendation Trust Value

In IPAS, the node is connected to the network and exchanges identity information with neighbor nodes to be evaluated, moreover, let nodeXj evaluate node Xi has a times normal interaction and b times abnormal interaction. The interaction result obeys the betapa,b distribution, and p is the posterior probability of a,b [20]. According to the Bayesian trust model, the expectation is used as the trust value, the directly recommendation trust value MIP1a,b can be calculated by
(5)MIP1a,b=Ebetapa,b=a+1a+b+2.The Bayesian trust model only considers the interaction among nodes and does not consider the effect of the recommendation trust value on the current nodes, such as the decline of trust value with the increase of time. Assume in the time windowΔt, for the node Xi, the sequence of n directly recommendation trust values is M1,M2,⋯,Mn. Let M1 be a trust value of node Xi with the longest time, and Mn is the trust value at the current time. The decay function exhibits that the node trust value decays according to the changes of the execution times n, so the decay function is defined as Hi=1i=nHi−1=Hi−1/n,1≤i≤n, where Hi∈0,1.A reward/punishment factor is used to evaluate the successful/failed interaction behavior of nodes, then the reward/punishment factor is set toFx=Nx/Na+Nb, where x=a,b indicates successful interaction or failed interaction behavior, Na is the number of successful interactions, and Nb is the number of failed interactions. The reward value Ri of the current node is related to the times i that the node is judged to be trusted and the reward value Ri−1 of the previous time. The node reward factor is FxR and the punishment factor is FxF, so the node reward/punishment value can be calculated by RiFx=Ri−1∗1+FxRi−1Ri−1∗1−FxPi−1. The trust value is decayed with time while the reward/punishment factor needs to be updated. When a node completes an interaction, if the interaction behavior is a successful interaction, it is counted in the sequence Maij, then aij=∑i=1nRi·Hi·Maij. If the interaction is failed, it is counted in the sequence Mbij, then bij=∑i=1nRi·Hi·Mbij. aij and bij are substituted into the Bayesian trust model (Equation (5)); then, the direct recommendation trust value MIP1 of the node is calculated in
(6)MIP1aij,bij=aij+1aij+bij+2.


### 4.3.2. Indirect Recommendation Trust Value

For the distributed networking model, the neighbor nodes need to be evaluated comprehensively, as shown by the blue line in Figure4, where malicious nodes may raise or devalue the trust value of the evaluated node. Let the initial recommendation trust value sequence for the node Xi be mr1,mr2,⋯,mrk, and the direct recommendation trust mathematical expectation is Emr=1/k∑i=1kmri, and calculate the recommendation trust and its mathematical expectation trust similarity as the deviation of the trust data; the further away from the expected value the smaller the weight, the more likely it is to be malicious and defamatory. The Euclidean distance similarity discrimination is used to calculate the trust data evaluation dispersion as fmri=Emr−mri/∑i=1kEmr−mri2. According to the indirect recommendation trust value and its weight, the indirect recommendation trust value is MIP2, as shown by
(7)MIP2mri,fmri=∑i=1k1−fmri·mri.


### 4.3.3. Global Trust Value of the Node

With the distributed networking model of IPAS, the global trust value of the evaluated nodeXi at the moment t merges the direct recommendation trust value and the indirect recommendation trust value, and the global trust value TrustXi is calculated by
(8)TrustXi=α·MIP1aij,bij·+β·MIP2Xi,fmri,whereα and β are the adaptive weight of direct recommendation trust and indirect recommendation trust, and α+β=1. The information entropy HMIP1,HMIP2 is used to determine the weights corresponding to each indicator to overcome the limitations of empirically weights [20]; then α and β are calculated as follows:
(9)α=1−HMIP1/log2MIP11−HMIP1/log2MIP1+1−HMIP2/log2MIP2,β=1−HMIP2/log2MIP21−HMIP1/log2MIP1+1−HMIP2/log2MIP2.The security situation assessment of IIoT nodes in IPAS, if the trust value of the node is larger than the threshold value, the node is considered to be trusted; otherwise, the node is untrusted, and the node operation is restricted to ensure the IPAS domain is trusted.


## 4.3.1. Direct Recommendation Trust Value

In IPAS, the node is connected to the network and exchanges identity information with neighbor nodes to be evaluated, moreover, let nodeXj evaluate node Xi has a times normal interaction and b times abnormal interaction. The interaction result obeys the betapa,b distribution, and p is the posterior probability of a,b [20]. According to the Bayesian trust model, the expectation is used as the trust value, the directly recommendation trust value MIP1a,b can be calculated by
(5)MIP1a,b=Ebetapa,b=a+1a+b+2.The Bayesian trust model only considers the interaction among nodes and does not consider the effect of the recommendation trust value on the current nodes, such as the decline of trust value with the increase of time. Assume in the time windowΔt, for the node Xi, the sequence of n directly recommendation trust values is M1,M2,⋯,Mn. Let M1 be a trust value of node Xi with the longest time, and Mn is the trust value at the current time. The decay function exhibits that the node trust value decays according to the changes of the execution times n, so the decay function is defined as Hi=1i=nHi−1=Hi−1/n,1≤i≤n, where Hi∈0,1.A reward/punishment factor is used to evaluate the successful/failed interaction behavior of nodes, then the reward/punishment factor is set toFx=Nx/Na+Nb, where x=a,b indicates successful interaction or failed interaction behavior, Na is the number of successful interactions, and Nb is the number of failed interactions. The reward value Ri of the current node is related to the times i that the node is judged to be trusted and the reward value Ri−1 of the previous time. The node reward factor is FxR and the punishment factor is FxF, so the node reward/punishment value can be calculated by RiFx=Ri−1∗1+FxRi−1Ri−1∗1−FxPi−1. The trust value is decayed with time while the reward/punishment factor needs to be updated. When a node completes an interaction, if the interaction behavior is a successful interaction, it is counted in the sequence Maij, then aij=∑i=1nRi·Hi·Maij. If the interaction is failed, it is counted in the sequence Mbij, then bij=∑i=1nRi·Hi·Mbij. aij and bij are substituted into the Bayesian trust model (Equation (5)); then, the direct recommendation trust value MIP1 of the node is calculated in
(6)MIP1aij,bij=aij+1aij+bij+2.


## 4.3.2. Indirect Recommendation Trust Value

For the distributed networking model, the neighbor nodes need to be evaluated comprehensively, as shown by the blue line in Figure4, where malicious nodes may raise or devalue the trust value of the evaluated node. Let the initial recommendation trust value sequence for the node Xi be mr1,mr2,⋯,mrk, and the direct recommendation trust mathematical expectation is Emr=1/k∑i=1kmri, and calculate the recommendation trust and its mathematical expectation trust similarity as the deviation of the trust data; the further away from the expected value the smaller the weight, the more likely it is to be malicious and defamatory. The Euclidean distance similarity discrimination is used to calculate the trust data evaluation dispersion as fmri=Emr−mri/∑i=1kEmr−mri2. According to the indirect recommendation trust value and its weight, the indirect recommendation trust value is MIP2, as shown by
(7)MIP2mri,fmri=∑i=1k1−fmri·mri.


## 4.3.3. Global Trust Value of the Node

With the distributed networking model of IPAS, the global trust value of the evaluated nodeXi at the moment t merges the direct recommendation trust value and the indirect recommendation trust value, and the global trust value TrustXi is calculated by
(8)TrustXi=α·MIP1aij,bij·+β·MIP2Xi,fmri,whereα and β are the adaptive weight of direct recommendation trust and indirect recommendation trust, and α+β=1. The information entropy HMIP1,HMIP2 is used to determine the weights corresponding to each indicator to overcome the limitations of empirically weights [20]; then α and β are calculated as follows:
(9)α=1−HMIP1/log2MIP11−HMIP1/log2MIP1+1−HMIP2/log2MIP2,β=1−HMIP2/log2MIP21−HMIP1/log2MIP1+1−HMIP2/log2MIP2.The security situation assessment of IIoT nodes in IPAS, if the trust value of the node is larger than the threshold value, the node is considered to be trusted; otherwise, the node is untrusted, and the node operation is restricted to ensure the IPAS domain is trusted.


## 5. Group Signature Scheme and Security Analysis

### 5.1. Difficult Problems and Assumptions of the Group Signature

In hybrid IP/SDN architecture, a node in SAS transmits data to a remote node in IPAS, the sending node needs to show it is trusted to the remote node firstly, and then the remote node verifies the identity of the sending node and verifies the sending node is trusted to the superior node based on its trust value. We propose a remote attestation scheme using group signature that any member in the group can sign on behalf of it. Our group signature scheme is based on the q-SDH assumption and the concept is defined as follows.Theorem 4 (Bilinear mapping).
LetG1,G2, and GT are multiplicative cyclic groups of order prime p and g1,g2 are the generating elements of the group G1,G2. Given a mapping e:G1×G2⟶GT, for any a,b∈Rℤp∗, there exists eg1a,g2b=eg1,g2ab.Theorem 5 (Computational Diffie-Hellman problem, CDH).
Let there exista,b∈Rℤp∗ and g,ga,gb∈G. Given the tuple <g,ga,gb> under the unknown a,b condition, it is difficult to compute gab.Theorem 6 (q-strong Diffie-Hellman, q-SDH assumption).
Leta∈Rℤp. Given as input a q+1-tuple g,ga,ga2,⋯,gaq∈Gt+1, for every adversary Aq−SDH, the probability PrAq−SDHg,ga,ga2,⋯,gaq=x,g1/x+a≥ε for any value of x∈ℤp, ε is the negligible quantity.


### 5.2. The Scheme of the Group Signature

The group signature scheme is firstly required to construct a group, consisting of a group managerGM and several group members Ui. In hybrid SDN, the SDN controller and IP gateway act as GM of their separate group, and the IIoT node as group member Ui to sign for external signatures, and the signed message is the global trust value of the node. GM generates the group public key Gpk and private key Gsk, Ui negotiates with GM the signature private key Uski, and GM adds the registration information item about Ui to the group registry Regi. The node trust value TrustXi is signed by group public key Gpk and user private key Uski to group signature Si. The verification of the signature is implemented by the group public key Gpk, the message TrustXi, and the group signature Si. If Si is the group signature of message TrustXi, the node is the trusted source of data trading and submits the trust value TrustXi to the superior node to judge whether the trust value is higher than the threshold value to judge whether secure data trading can be realized or not. If the identity of the signer is questioned, the signature can be opened to find out the identity of the group member based on the group signature Si and the GM private key Gsk and the registry entry Regi. When a group member revokes its signature from the group, GM gets a new revocation item by using the group public key Gpk, private key Gsk, and Regi as input and adds it to the revocation list (RL). After the revocation, the new signature private key Usk′i is calculated based on the member private key Uski in RL. The group signature scheme includes system parameter creation setup, signature, verification, and signature open and signature revoke processes.


#### 5.2.1. Setup

Randomly select three bilinear mapping cyclic groupsG1,G2,GT of order large prime p, where the bilinear mapping of G1,G2,GT satisfies e:G1×G2⟶GT, given Hu:0,1∗⟶0,1nu and Hm:0,1∗⟶0,1nm are collision-free Hash function that maps the message to the required length. The group manager GM selects the generation element of G1, G2 is g1,g2, then randomly selected the secret value y∈Rℤp∗, the group public key is Gpk=g1y, the group private key is Gsk=y, and the system parameters are g1,g2,p,Gpk,Hu,Hm.GM selects xi∈Rℤp∗ and computes g11/xi+y to send to group member Ui, and the user public key is Upki=g1xi, and the user private key is Uski=σ=g11/xi+y. Ui uses Upki to interact with GM when joining the group. The ID of user Ui is a bit string of length nm, ID⊆1,2,⋯,nu. GM needs to authenticate the user Ui, using the group private key Gsk to sign the ID. Then, GM selects u∈G2, the identity information is R=g2y·u∏j∈IDuj, using the user private key Uski to sign R as π=Ry1/xi+y. We send the signature R,π,u∏j∈IDuj to GM for verification and use the public key Gpk and Upki to decrypt. If eπ,Upki·Gpk=eR,g1, the signature is valid, and Ui is a legal member of the group, and GM adds the registry entry Regi=Upki,Uski,xi,π. Otherwise, the signature is invalid, and the user is rejected as a member of the group.


#### 5.2.2. Signature

The group memberUi chooses α1,α2,δ1,δ2,γ1,γ2,γ3∈Rℤp∗, α=α1+α2, and η=g1=g2 to compute λ1=g1α1, λ2=g2α2, and λ3=σ·ηα with its private key and computes d1=λ1δ1g1−γ1, d2=λ2δ1g2−γ2, and d3=eλ3,g2δ1·eη,g1δ2·eη,g2−γ1+γ2·eg1,g2γ3. By calculating the trust value in the previous section, the global trust value Trusti of the device node i is calculated to map it to a bit string m∏j∈Trustmj of length nm; then, the digest value c=Hmλ1λ2λ3d1d2d3m∏j∈Trustmj is calculated for the corresponding group member Ui. Let ω1=δ1+c, ω2=δ2−c·α, ω3=γ3+c, ω4=γ1+c·α1, and ω5=γ2+c·α2, and the signature of group member Ui is Si=λ1,λ2,λ3,c,ω1,ω2,ω3,ω4,ω5.


#### 5.2.3. Verification

Firstly, the identities of the sending nodeUi and the remote node Vi of the two groups are verified. The remote verifier Vi receives the signature Si=λ1,λ2,λ3,c,ω1,ω2,ω3,ω4,ω5 and trust value Trusti from the group member Ui, and the remote verifier needs to verify the signature, and calculate d1~≟λ1ω1g1−ω4, d2~≟λ2ω1g2−ω5, d3~≟eλ3,g2ω1·eη,g1ω2·eη,g2−ω4+ω5·eg1,g2ω3·eλ3,ηc·eg1,g2−c, and c~≟Huλ1λ2λ3d1~d2~d3~m∏j∈Trustm′. If c~ is equal to c, it indicates that Si is a valid signature and the verifier queries GM whether the trust value is trusted. If the trust value is higher than the threshold value, it means that the source of the data sending node is trusted. Otherwise, the data trading is rejected.


#### 5.2.4. Open

For traceability of signature,GM can open the signature and find the identifier of the signer i. Firstly, verify the signature Si as a valid signature, then get λ1,λ2,andλ3 from Si=λ1,λ2,λ3,c,ω1,ω2,ω3,ω4,ω5, and get the private key of group member Ui by computing λ3/λ1·λ2=σ·ηα/g1α1·g2α2=σ·ηα/ηα=σ. GM query σ at Regi. GM searches σ at Regi and tracks the identity i corresponding to Uski.


#### 5.2.5. Revoke

If the node in hybrid SDN is untrusted, it cannot participate in the group signature. Let the group member who is revoked byGM is Uj, and after the revocation, there are t group members left in the group; then, GM needs to regenerate the group public key Gpk=g1ty1t and update the group private key to Gsk=y1t=∏t=1tyjt, update the member private key to Uski=σ=g1t1/xi+y1t, and renew Regi.


### 5.3. Security Analysis under the Standard Model

The group signature scheme meets the security requirements such as correctness, indistinguishability, anonymity, traceability, forward security, and unforgeability. Security proof under the standard model can provide better guarantees for the design of the group signature scheme [21].


#### 5.3.1. Correctness

The challenger needs to verify the correctness of the signature when a signature is received. Verify whether the identity information is satisfied.(10)eπ,Upki·Gpk=eRy1/xi+y,g11/xi+y·g1y=eR,g1.The challenger selectsα1,α2,δ1,δ2,γ1,γ2,γ3∈ℤRp∗ and sends it to the verifier, the challenger calculates λ1,λ2,λ3,d1,d2,d3, the verifier selects c as the challenge value, and the challenger calculates ω1,ω2,ω3,ω4,ω5. Then,
(11)d~1=λ1ω1·g1−ω4=g1α1δ1+c·g1−γ1+c·α1=g1α1·δ1·g1−γ1=d1,d~2=λ2ω1g2−ω5=g2α2δ1+c·g2−γ2+c·α2=g2α2·δ1g2−γ2=d2,d~3=eλ3,g2ω1·eη,g1ω2·eg1,g2ω3·eη,g2−ω4+ω5·eλ3,η−c·eg1,g2−c=eλ3,g2δ1+c·eη,g1δ2−c·α·eg1,g2γ3+c·eη,g2−γ1+c·α1+γ2+c·α2·eλ3,η−c·eg1,g2−c=eλ3,g2δ1·eη,g1δ2·eg1,g2γ3·eη,g2−γ1+γ2·eλ3,g2c·eη,g1−c·α·eg1,g2c·eη,g2−c·α1+c·α2·eλ3,η−c·eg1,g2−c=d3·eλ3,g2c·eη,g1−c·α·eg1,g2c·eη,g2−c·α·eλ3,η−c·eg1,g2−c=d3.The verification equationsd1=d1~, and d2=d2~, and d3=d3~ are verified, and the group signature scheme is proved to be correct by the above derivation process.


#### 5.3.2. Indistinguishability

Under the standard model, the challenger gets the system parameters and sends them to the attacker. The challenger can generate the group public keyGpk and the member private key Uski. The challenger selects the designcrypt oracle Hm from the private key σi0,σi1 of Ui0,Ui1 based on the given message Trusti. If the challenger learns σ and chooses α1,α2 randomly, and computes the values of λ1=g1α1, λ2=g2α2, and λ3=σ·ηα, λ1,λ2,λ3 is solved using a linear encryption scheme and generated by the simulator is indistinguishable from the actual distribution. The adversary randomly selects λ1,λ2,λ3, due to ω1=δ1+c, when c,ω1 is fixed, then δ1 is fixed, when α1 is fixed, then λ1=g1α1 is fixed, and the value of d1 in d1=λ1δ1g1−γ1 is consistent with the γ1 distribution. Randomly selects c,ω2, in ω2=δ2+c·α, when c,ω2 is fixed, and α2 is fixed, then λ2=g2α2 is fixed, due to α=α1+α2, then δ2 is fixed, so in d2=λ2δ1g2−γ2, the value of d2 is consistent with the γ2 distribution. Similarly, the value of d3 is consistent with the γ3 distribution. Therefore, it is difficult to distinguish the values obtained by the simulator from the actual values; therefore, the group signature algorithm satisfies indistinguishability.


#### 5.3.3. Anonymity

The attacker is given the valueλ1,λ2,λ3 to d1,d2,d3, and the message Trusti is known to get c=Hmλ1λ2λ3d1d2d3trusti. Hm:0,1∗⟶0,1nm is a collision-free Hash function; then, the attacker is able to correctly return the group signature Si=λ1,λ2,λ3,c,ω1,ω2,ω3,ω4,ω5 to the challenger. The challenger can output the guessed value based on the returned signature and send the guessed value to the attacker. The attacker will give a reply with the guessed result. λ1,λ2,λ3 is the guessed result of one of the σi0,σi1. If the challenger can attack the anonymity of the group signature with the advantage of ε, the attacker can also attack the linear encryption scheme with the advantage of ε. Therefore, the group signature scheme satisfies anonymity.


#### 5.3.4. Traceability

Givenλ1,λ2, and λ3, the challenger is able to select α1,α2,δ1,δ2,γ1,γ2,γ3∈Rℤp∗ and calculate λ1,λ2,λ3,d1,d2,d3,c,ω1,ω2,ω3,ω4,ω5. It is known from λ3/λ1·λ2=σ·ηα/g1α1·g2α2=σ·ηα/ηα=σ that even if α,α1, and α2 is unknowable, the private key of group member Ui can still be traced, which satisfies full traceability.


#### 5.3.5. Unforgeability

The group signature is a double-layer signature, assuming that the challenger and the attacker forge the signature with each other, then the attacker first uses the group private keyGsk to sign ID, the signature is completed by the group manager GM, and the group member Ui, and the signature is judged to be valid for the legitimate members of the group, and then, the message Trusti is signed by Si. In case the challenger sends a signature request to get a forged group signature Si∗=λ1,λ2,λ3,d1,d2,d3,c,ω1,ω2,ω3,ω4,ω5, when the signature is challenged, GM opens the signature to get σi∗, that is, the attacker forges a signature that can be traced to the identity. If σi∗=σi, q−1σi,xi pairs are obtained according to the q-SDH assumption. When the signature is tracked with probability ε/n and no questions are asked by the challenger for i to the designcrypt oracle, the group signature algorithm satisfies unforgeability.


#### 5.3.6. Resistance to Joint Attack

The group signature scheme is traceability and unforgeability, the only way to get the private keyUski of the group member is to sign legitimately, and GM can open the signature to trace the signer Ui by the registry entry Regi. In case multiple group members collude to forge a signature, GM traces the signature to discover the forger, so the group signature can resist joint attacks.


#### 5.3.7. Forward Security

The signature key of any group memberUi is obtained Upki and Uski by selecting the secret value xi∈Rℤp∗. In case the signature key at the t moment is Uskt, if Upki and Uski before the t moment are obtained, each time the selected secret value is destroyed after use; hence, the attacker cannot deduce the previous signature key based on the key at the moment, and the group signature scheme has forward security.


## 5.1. Difficult Problems and Assumptions of the Group Signature

In hybrid IP/SDN architecture, a node in SAS transmits data to a remote node in IPAS, the sending node needs to show it is trusted to the remote node firstly, and then the remote node verifies the identity of the sending node and verifies the sending node is trusted to the superior node based on its trust value. We propose a remote attestation scheme using group signature that any member in the group can sign on behalf of it. Our group signature scheme is based on the q-SDH assumption and the concept is defined as follows.Theorem 4 (Bilinear mapping).
LetG1,G2, and GT are multiplicative cyclic groups of order prime p and g1,g2 are the generating elements of the group G1,G2. Given a mapping e:G1×G2⟶GT, for any a,b∈Rℤp∗, there exists eg1a,g2b=eg1,g2ab.Theorem 5 (Computational Diffie-Hellman problem, CDH).
Let there exista,b∈Rℤp∗ and g,ga,gb∈G. Given the tuple <g,ga,gb> under the unknown a,b condition, it is difficult to compute gab.Theorem 6 (q-strong Diffie-Hellman, q-SDH assumption).
Leta∈Rℤp. Given as input a q+1-tuple g,ga,ga2,⋯,gaq∈Gt+1, for every adversary Aq−SDH, the probability PrAq−SDHg,ga,ga2,⋯,gaq=x,g1/x+a≥ε for any value of x∈ℤp, ε is the negligible quantity.


## 5.2. The Scheme of the Group Signature

The group signature scheme is firstly required to construct a group, consisting of a group managerGM and several group members Ui. In hybrid SDN, the SDN controller and IP gateway act as GM of their separate group, and the IIoT node as group member Ui to sign for external signatures, and the signed message is the global trust value of the node. GM generates the group public key Gpk and private key Gsk, Ui negotiates with GM the signature private key Uski, and GM adds the registration information item about Ui to the group registry Regi. The node trust value TrustXi is signed by group public key Gpk and user private key Uski to group signature Si. The verification of the signature is implemented by the group public key Gpk, the message TrustXi, and the group signature Si. If Si is the group signature of message TrustXi, the node is the trusted source of data trading and submits the trust value TrustXi to the superior node to judge whether the trust value is higher than the threshold value to judge whether secure data trading can be realized or not. If the identity of the signer is questioned, the signature can be opened to find out the identity of the group member based on the group signature Si and the GM private key Gsk and the registry entry Regi. When a group member revokes its signature from the group, GM gets a new revocation item by using the group public key Gpk, private key Gsk, and Regi as input and adds it to the revocation list (RL). After the revocation, the new signature private key Usk′i is calculated based on the member private key Uski in RL. The group signature scheme includes system parameter creation setup, signature, verification, and signature open and signature revoke processes.


### 5.2.1. Setup

Randomly select three bilinear mapping cyclic groupsG1,G2,GT of order large prime p, where the bilinear mapping of G1,G2,GT satisfies e:G1×G2⟶GT, given Hu:0,1∗⟶0,1nu and Hm:0,1∗⟶0,1nm are collision-free Hash function that maps the message to the required length. The group manager GM selects the generation element of G1, G2 is g1,g2, then randomly selected the secret value y∈Rℤp∗, the group public key is Gpk=g1y, the group private key is Gsk=y, and the system parameters are g1,g2,p,Gpk,Hu,Hm.GM selects xi∈Rℤp∗ and computes g11/xi+y to send to group member Ui, and the user public key is Upki=g1xi, and the user private key is Uski=σ=g11/xi+y. Ui uses Upki to interact with GM when joining the group. The ID of user Ui is a bit string of length nm, ID⊆1,2,⋯,nu. GM needs to authenticate the user Ui, using the group private key Gsk to sign the ID. Then, GM selects u∈G2, the identity information is R=g2y·u∏j∈IDuj, using the user private key Uski to sign R as π=Ry1/xi+y. We send the signature R,π,u∏j∈IDuj to GM for verification and use the public key Gpk and Upki to decrypt. If eπ,Upki·Gpk=eR,g1, the signature is valid, and Ui is a legal member of the group, and GM adds the registry entry Regi=Upki,Uski,xi,π. Otherwise, the signature is invalid, and the user is rejected as a member of the group.


### 5.2.2. Signature

The group memberUi chooses α1,α2,δ1,δ2,γ1,γ2,γ3∈Rℤp∗, α=α1+α2, and η=g1=g2 to compute λ1=g1α1, λ2=g2α2, and λ3=σ·ηα with its private key and computes d1=λ1δ1g1−γ1, d2=λ2δ1g2−γ2, and d3=eλ3,g2δ1·eη,g1δ2·eη,g2−γ1+γ2·eg1,g2γ3. By calculating the trust value in the previous section, the global trust value Trusti of the device node i is calculated to map it to a bit string m∏j∈Trustmj of length nm; then, the digest value c=Hmλ1λ2λ3d1d2d3m∏j∈Trustmj is calculated for the corresponding group member Ui. Let ω1=δ1+c, ω2=δ2−c·α, ω3=γ3+c, ω4=γ1+c·α1, and ω5=γ2+c·α2, and the signature of group member Ui is Si=λ1,λ2,λ3,c,ω1,ω2,ω3,ω4,ω5.


### 5.2.3. Verification

Firstly, the identities of the sending nodeUi and the remote node Vi of the two groups are verified. The remote verifier Vi receives the signature Si=λ1,λ2,λ3,c,ω1,ω2,ω3,ω4,ω5 and trust value Trusti from the group member Ui, and the remote verifier needs to verify the signature, and calculate d1~≟λ1ω1g1−ω4, d2~≟λ2ω1g2−ω5, d3~≟eλ3,g2ω1·eη,g1ω2·eη,g2−ω4+ω5·eg1,g2ω3·eλ3,ηc·eg1,g2−c, and c~≟Huλ1λ2λ3d1~d2~d3~m∏j∈Trustm′. If c~ is equal to c, it indicates that Si is a valid signature and the verifier queries GM whether the trust value is trusted. If the trust value is higher than the threshold value, it means that the source of the data sending node is trusted. Otherwise, the data trading is rejected.


### 5.2.4. Open

For traceability of signature,GM can open the signature and find the identifier of the signer i. Firstly, verify the signature Si as a valid signature, then get λ1,λ2,andλ3 from Si=λ1,λ2,λ3,c,ω1,ω2,ω3,ω4,ω5, and get the private key of group member Ui by computing λ3/λ1·λ2=σ·ηα/g1α1·g2α2=σ·ηα/ηα=σ. GM query σ at Regi. GM searches σ at Regi and tracks the identity i corresponding to Uski.


### 5.2.5. Revoke

If the node in hybrid SDN is untrusted, it cannot participate in the group signature. Let the group member who is revoked byGM is Uj, and after the revocation, there are t group members left in the group; then, GM needs to regenerate the group public key Gpk=g1ty1t and update the group private key to Gsk=y1t=∏t=1tyjt, update the member private key to Uski=σ=g1t1/xi+y1t, and renew Regi.


## 5.2.1. Setup

Randomly select three bilinear mapping cyclic groupsG1,G2,GT of order large prime p, where the bilinear mapping of G1,G2,GT satisfies e:G1×G2⟶GT, given Hu:0,1∗⟶0,1nu and Hm:0,1∗⟶0,1nm are collision-free Hash function that maps the message to the required length. The group manager GM selects the generation element of G1, G2 is g1,g2, then randomly selected the secret value y∈Rℤp∗, the group public key is Gpk=g1y, the group private key is Gsk=y, and the system parameters are g1,g2,p,Gpk,Hu,Hm.GM selects xi∈Rℤp∗ and computes g11/xi+y to send to group member Ui, and the user public key is Upki=g1xi, and the user private key is Uski=σ=g11/xi+y. Ui uses Upki to interact with GM when joining the group. The ID of user Ui is a bit string of length nm, ID⊆1,2,⋯,nu. GM needs to authenticate the user Ui, using the group private key Gsk to sign the ID. Then, GM selects u∈G2, the identity information is R=g2y·u∏j∈IDuj, using the user private key Uski to sign R as π=Ry1/xi+y. We send the signature R,π,u∏j∈IDuj to GM for verification and use the public key Gpk and Upki to decrypt. If eπ,Upki·Gpk=eR,g1, the signature is valid, and Ui is a legal member of the group, and GM adds the registry entry Regi=Upki,Uski,xi,π. Otherwise, the signature is invalid, and the user is rejected as a member of the group.


## 5.2.2. Signature

The group memberUi chooses α1,α2,δ1,δ2,γ1,γ2,γ3∈Rℤp∗, α=α1+α2, and η=g1=g2 to compute λ1=g1α1, λ2=g2α2, and λ3=σ·ηα with its private key and computes d1=λ1δ1g1−γ1, d2=λ2δ1g2−γ2, and d3=eλ3,g2δ1·eη,g1δ2·eη,g2−γ1+γ2·eg1,g2γ3. By calculating the trust value in the previous section, the global trust value Trusti of the device node i is calculated to map it to a bit string m∏j∈Trustmj of length nm; then, the digest value c=Hmλ1λ2λ3d1d2d3m∏j∈Trustmj is calculated for the corresponding group member Ui. Let ω1=δ1+c, ω2=δ2−c·α, ω3=γ3+c, ω4=γ1+c·α1, and ω5=γ2+c·α2, and the signature of group member Ui is Si=λ1,λ2,λ3,c,ω1,ω2,ω3,ω4,ω5.


## 5.2.3. Verification

Firstly, the identities of the sending nodeUi and the remote node Vi of the two groups are verified. The remote verifier Vi receives the signature Si=λ1,λ2,λ3,c,ω1,ω2,ω3,ω4,ω5 and trust value Trusti from the group member Ui, and the remote verifier needs to verify the signature, and calculate d1~≟λ1ω1g1−ω4, d2~≟λ2ω1g2−ω5, d3~≟eλ3,g2ω1·eη,g1ω2·eη,g2−ω4+ω5·eg1,g2ω3·eλ3,ηc·eg1,g2−c, and c~≟Huλ1λ2λ3d1~d2~d3~m∏j∈Trustm′. If c~ is equal to c, it indicates that Si is a valid signature and the verifier queries GM whether the trust value is trusted. If the trust value is higher than the threshold value, it means that the source of the data sending node is trusted. Otherwise, the data trading is rejected.


## 5.2.4. Open

For traceability of signature,GM can open the signature and find the identifier of the signer i. Firstly, verify the signature Si as a valid signature, then get λ1,λ2,andλ3 from Si=λ1,λ2,λ3,c,ω1,ω2,ω3,ω4,ω5, and get the private key of group member Ui by computing λ3/λ1·λ2=σ·ηα/g1α1·g2α2=σ·ηα/ηα=σ. GM query σ at Regi. GM searches σ at Regi and tracks the identity i corresponding to Uski.


## 5.2.5. Revoke

If the node in hybrid SDN is untrusted, it cannot participate in the group signature. Let the group member who is revoked byGM is Uj, and after the revocation, there are t group members left in the group; then, GM needs to regenerate the group public key Gpk=g1ty1t and update the group private key to Gsk=y1t=∏t=1tyjt, update the member private key to Uski=σ=g1t1/xi+y1t, and renew Regi.


## 5.3. Security Analysis under the Standard Model

The group signature scheme meets the security requirements such as correctness, indistinguishability, anonymity, traceability, forward security, and unforgeability. Security proof under the standard model can provide better guarantees for the design of the group signature scheme [21].


### 5.3.1. Correctness

The challenger needs to verify the correctness of the signature when a signature is received. Verify whether the identity information is satisfied.(10)eπ,Upki·Gpk=eRy1/xi+y,g11/xi+y·g1y=eR,g1.The challenger selectsα1,α2,δ1,δ2,γ1,γ2,γ3∈ℤRp∗ and sends it to the verifier, the challenger calculates λ1,λ2,λ3,d1,d2,d3, the verifier selects c as the challenge value, and the challenger calculates ω1,ω2,ω3,ω4,ω5. Then,
(11)d~1=λ1ω1·g1−ω4=g1α1δ1+c·g1−γ1+c·α1=g1α1·δ1·g1−γ1=d1,d~2=λ2ω1g2−ω5=g2α2δ1+c·g2−γ2+c·α2=g2α2·δ1g2−γ2=d2,d~3=eλ3,g2ω1·eη,g1ω2·eg1,g2ω3·eη,g2−ω4+ω5·eλ3,η−c·eg1,g2−c=eλ3,g2δ1+c·eη,g1δ2−c·α·eg1,g2γ3+c·eη,g2−γ1+c·α1+γ2+c·α2·eλ3,η−c·eg1,g2−c=eλ3,g2δ1·eη,g1δ2·eg1,g2γ3·eη,g2−γ1+γ2·eλ3,g2c·eη,g1−c·α·eg1,g2c·eη,g2−c·α1+c·α2·eλ3,η−c·eg1,g2−c=d3·eλ3,g2c·eη,g1−c·α·eg1,g2c·eη,g2−c·α·eλ3,η−c·eg1,g2−c=d3.The verification equationsd1=d1~, and d2=d2~, and d3=d3~ are verified, and the group signature scheme is proved to be correct by the above derivation process.


### 5.3.2. Indistinguishability

Under the standard model, the challenger gets the system parameters and sends them to the attacker. The challenger can generate the group public keyGpk and the member private key Uski. The challenger selects the designcrypt oracle Hm from the private key σi0,σi1 of Ui0,Ui1 based on the given message Trusti. If the challenger learns σ and chooses α1,α2 randomly, and computes the values of λ1=g1α1, λ2=g2α2, and λ3=σ·ηα, λ1,λ2,λ3 is solved using a linear encryption scheme and generated by the simulator is indistinguishable from the actual distribution. The adversary randomly selects λ1,λ2,λ3, due to ω1=δ1+c, when c,ω1 is fixed, then δ1 is fixed, when α1 is fixed, then λ1=g1α1 is fixed, and the value of d1 in d1=λ1δ1g1−γ1 is consistent with the γ1 distribution. Randomly selects c,ω2, in ω2=δ2+c·α, when c,ω2 is fixed, and α2 is fixed, then λ2=g2α2 is fixed, due to α=α1+α2, then δ2 is fixed, so in d2=λ2δ1g2−γ2, the value of d2 is consistent with the γ2 distribution. Similarly, the value of d3 is consistent with the γ3 distribution. Therefore, it is difficult to distinguish the values obtained by the simulator from the actual values; therefore, the group signature algorithm satisfies indistinguishability.


### 5.3.3. Anonymity

The attacker is given the valueλ1,λ2,λ3 to d1,d2,d3, and the message Trusti is known to get c=Hmλ1λ2λ3d1d2d3trusti. Hm:0,1∗⟶0,1nm is a collision-free Hash function; then, the attacker is able to correctly return the group signature Si=λ1,λ2,λ3,c,ω1,ω2,ω3,ω4,ω5 to the challenger. The challenger can output the guessed value based on the returned signature and send the guessed value to the attacker. The attacker will give a reply with the guessed result. λ1,λ2,λ3 is the guessed result of one of the σi0,σi1. If the challenger can attack the anonymity of the group signature with the advantage of ε, the attacker can also attack the linear encryption scheme with the advantage of ε. Therefore, the group signature scheme satisfies anonymity.


### 5.3.4. Traceability

Givenλ1,λ2, and λ3, the challenger is able to select α1,α2,δ1,δ2,γ1,γ2,γ3∈Rℤp∗ and calculate λ1,λ2,λ3,d1,d2,d3,c,ω1,ω2,ω3,ω4,ω5. It is known from λ3/λ1·λ2=σ·ηα/g1α1·g2α2=σ·ηα/ηα=σ that even if α,α1, and α2 is unknowable, the private key of group member Ui can still be traced, which satisfies full traceability.


### 5.3.5. Unforgeability

The group signature is a double-layer signature, assuming that the challenger and the attacker forge the signature with each other, then the attacker first uses the group private keyGsk to sign ID, the signature is completed by the group manager GM, and the group member Ui, and the signature is judged to be valid for the legitimate members of the group, and then, the message Trusti is signed by Si. In case the challenger sends a signature request to get a forged group signature Si∗=λ1,λ2,λ3,d1,d2,d3,c,ω1,ω2,ω3,ω4,ω5, when the signature is challenged, GM opens the signature to get σi∗, that is, the attacker forges a signature that can be traced to the identity. If σi∗=σi, q−1σi,xi pairs are obtained according to the q-SDH assumption. When the signature is tracked with probability ε/n and no questions are asked by the challenger for i to the designcrypt oracle, the group signature algorithm satisfies unforgeability.


### 5.3.6. Resistance to Joint Attack

The group signature scheme is traceability and unforgeability, the only way to get the private keyUski of the group member is to sign legitimately, and GM can open the signature to trace the signer Ui by the registry entry Regi. In case multiple group members collude to forge a signature, GM traces the signature to discover the forger, so the group signature can resist joint attacks.


### 5.3.7. Forward Security

The signature key of any group memberUi is obtained Upki and Uski by selecting the secret value xi∈Rℤp∗. In case the signature key at the t moment is Uskt, if Upki and Uski before the t moment are obtained, each time the selected secret value is destroyed after use; hence, the attacker cannot deduce the previous signature key based on the key at the moment, and the group signature scheme has forward security.


## 5.3.1. Correctness

The challenger needs to verify the correctness of the signature when a signature is received. Verify whether the identity information is satisfied.(10)eπ,Upki·Gpk=eRy1/xi+y,g11/xi+y·g1y=eR,g1.The challenger selectsα1,α2,δ1,δ2,γ1,γ2,γ3∈ℤRp∗ and sends it to the verifier, the challenger calculates λ1,λ2,λ3,d1,d2,d3, the verifier selects c as the challenge value, and the challenger calculates ω1,ω2,ω3,ω4,ω5. Then,
(11)d~1=λ1ω1·g1−ω4=g1α1δ1+c·g1−γ1+c·α1=g1α1·δ1·g1−γ1=d1,d~2=λ2ω1g2−ω5=g2α2δ1+c·g2−γ2+c·α2=g2α2·δ1g2−γ2=d2,d~3=eλ3,g2ω1·eη,g1ω2·eg1,g2ω3·eη,g2−ω4+ω5·eλ3,η−c·eg1,g2−c=eλ3,g2δ1+c·eη,g1δ2−c·α·eg1,g2γ3+c·eη,g2−γ1+c·α1+γ2+c·α2·eλ3,η−c·eg1,g2−c=eλ3,g2δ1·eη,g1δ2·eg1,g2γ3·eη,g2−γ1+γ2·eλ3,g2c·eη,g1−c·α·eg1,g2c·eη,g2−c·α1+c·α2·eλ3,η−c·eg1,g2−c=d3·eλ3,g2c·eη,g1−c·α·eg1,g2c·eη,g2−c·α·eλ3,η−c·eg1,g2−c=d3.The verification equationsd1=d1~, and d2=d2~, and d3=d3~ are verified, and the group signature scheme is proved to be correct by the above derivation process.


## 5.3.2. Indistinguishability

Under the standard model, the challenger gets the system parameters and sends them to the attacker. The challenger can generate the group public keyGpk and the member private key Uski. The challenger selects the designcrypt oracle Hm from the private key σi0,σi1 of Ui0,Ui1 based on the given message Trusti. If the challenger learns σ and chooses α1,α2 randomly, and computes the values of λ1=g1α1, λ2=g2α2, and λ3=σ·ηα, λ1,λ2,λ3 is solved using a linear encryption scheme and generated by the simulator is indistinguishable from the actual distribution. The adversary randomly selects λ1,λ2,λ3, due to ω1=δ1+c, when c,ω1 is fixed, then δ1 is fixed, when α1 is fixed, then λ1=g1α1 is fixed, and the value of d1 in d1=λ1δ1g1−γ1 is consistent with the γ1 distribution. Randomly selects c,ω2, in ω2=δ2+c·α, when c,ω2 is fixed, and α2 is fixed, then λ2=g2α2 is fixed, due to α=α1+α2, then δ2 is fixed, so in d2=λ2δ1g2−γ2, the value of d2 is consistent with the γ2 distribution. Similarly, the value of d3 is consistent with the γ3 distribution. Therefore, it is difficult to distinguish the values obtained by the simulator from the actual values; therefore, the group signature algorithm satisfies indistinguishability.


## 5.3.3. Anonymity

The attacker is given the valueλ1,λ2,λ3 to d1,d2,d3, and the message Trusti is known to get c=Hmλ1λ2λ3d1d2d3trusti. Hm:0,1∗⟶0,1nm is a collision-free Hash function; then, the attacker is able to correctly return the group signature Si=λ1,λ2,λ3,c,ω1,ω2,ω3,ω4,ω5 to the challenger. The challenger can output the guessed value based on the returned signature and send the guessed value to the attacker. The attacker will give a reply with the guessed result. λ1,λ2,λ3 is the guessed result of one of the σi0,σi1. If the challenger can attack the anonymity of the group signature with the advantage of ε, the attacker can also attack the linear encryption scheme with the advantage of ε. Therefore, the group signature scheme satisfies anonymity.


## 5.3.4. Traceability

Givenλ1,λ2, and λ3, the challenger is able to select α1,α2,δ1,δ2,γ1,γ2,γ3∈Rℤp∗ and calculate λ1,λ2,λ3,d1,d2,d3,c,ω1,ω2,ω3,ω4,ω5. It is known from λ3/λ1·λ2=σ·ηα/g1α1·g2α2=σ·ηα/ηα=σ that even if α,α1, and α2 is unknowable, the private key of group member Ui can still be traced, which satisfies full traceability.


## 5.3.5. Unforgeability

The group signature is a double-layer signature, assuming that the challenger and the attacker forge the signature with each other, then the attacker first uses the group private keyGsk to sign ID, the signature is completed by the group manager GM, and the group member Ui, and the signature is judged to be valid for the legitimate members of the group, and then, the message Trusti is signed by Si. In case the challenger sends a signature request to get a forged group signature Si∗=λ1,λ2,λ3,d1,d2,d3,c,ω1,ω2,ω3,ω4,ω5, when the signature is challenged, GM opens the signature to get σi∗, that is, the attacker forges a signature that can be traced to the identity. If σi∗=σi, q−1σi,xi pairs are obtained according to the q-SDH assumption. When the signature is tracked with probability ε/n and no questions are asked by the challenger for i to the designcrypt oracle, the group signature algorithm satisfies unforgeability.


## 5.3.6. Resistance to Joint Attack

The group signature scheme is traceability and unforgeability, the only way to get the private keyUski of the group member is to sign legitimately, and GM can open the signature to trace the signer Ui by the registry entry Regi. In case multiple group members collude to forge a signature, GM traces the signature to discover the forger, so the group signature can resist joint attacks.


## 5.3.7. Forward Security

The signature key of any group memberUi is obtained Upki and Uski by selecting the secret value xi∈Rℤp∗. In case the signature key at the t moment is Uskt, if Upki and Uski before the t moment are obtained, each time the selected secret value is destroyed after use; hence, the attacker cannot deduce the previous signature key based on the key at the moment, and the group signature scheme has forward security.


## 6. Experiments and Analysis

The experiments use Python to simulate the remote attestation scheme between nodes in the hybrid SDN architecture, including the trusted judgment of nodes and the group signature scheme. The trust value of the node is calculated according to Section3, and when the trust value is lower than the system setting threshold (0.8), the node is judged to be a malicious node, and its operation is restricted to communicate with other nodes. The efficiency comparison of the signature algorithm is completed according to Section 4.We simulate a hybrid SDN architecture about SAS and IPAS, including SDN controller nodes, forwarding nodes, and IIoT nodes. The experiment set 201 nodes distributed in an area range of2500m×1000m, the nodes can be classified as SAS and IPAS domains, where 101 nodes (including 1 control node, 20 forwarding nodes, and 80 IIoT nodes) in SAS and 100 nodes in IPAS. In SAS, centralized management is used, the forwarding nodes are connected to the controller nodes, and the IIoT nodes are connected to the forwarding nodes. In IPAS, distributed connectivity is used. The layout of the simulation experiment is illustrated in Figure 6.Figure 6
SAS and IPAS domain distribution and construction simulation (101 nodes and node centralized connection in SAS, 100 nodes and distributed connection in IPAS).


### 6.1. Analysis of the Correctness of Trusted Judgment

#### 6.1.1. Trusted Judgment in SAS Domain

The calculation of trust value in SAS depends on device attributes trust value, forwarding behavior trust value, and task execution trust value, if hardware and software attributes are judged to be forged, the global trust value is directly judged to be untrusted, as illustrated in Figure7, when device attributes trustvaluebluedots<0.8, the global trust value (purple dots) is directly judged to be untrusted. Figure 7(a) shows the trust value distribution when the number of malicious nodes accounts for 10%, and Figure 7(b) shows the trust value distribution when the number of malicious nodes accounts for 30%. The comparison shows that the more malicious nodes have a greater impact on the global trust value within the SAS domain.Figure 7
The process of calculating trust values in the SAS domain. (a) Distribution of each trust component when the number of malicious nodes accounts for 10%. (b) Distribution of each trust component when the number of malicious nodes accounts for 30%.
(a)
Node distribution(b)
Node distribution


#### 6.1.2. Trusted Judgment in IPAS Domain

In the IPAS domain, the node direct recommendation trust value is related to the reward/punishment factor and the decay factor, and the reward factorFa=0.6 and punishment factor Fb=0.6 are illustrated in Figure 8(a). With the increasing judgment times n, if the node is judged as a trusted node with the reward factor Fa>0.5, the initial value of the reward is 0.5 (untrusted threshold). If the reward value which is continuously judged as a trusted node is increased exponentially and reaches the threshold after n=4 times, and the reward value continues to be the same after the node is judged to be a trusted node again. If the node is an untrusted node with punishment factor Fb>0.5, the initial value of punishment is 0.8 (trust threshold); after the second judgment of untrusted, the punishment value is reduced to 0.5. And n=3 times, it is still judged as the untrusted node, then the punishment value drops to 0. If it is judged as untrusted again, the punishment value is always 0. The initial value of the decay function is 1. As the recommendation times increase, the current trust value decays according to Hi, as illustrated by the blue line in Figure 8(a).Figure 8
(a) Direct recommendation trust calculation component curves in the IPAS domain, including reward/punishment values and decay function values. (b) Indirect recommendation trust value calculation and distribution, judged by the distance function and direct recommendation trust.
(a)
n(b)
Node distributionThe indirect recommendation of trust in IPAS is based on the distance function to calculate the similarity, and the green dots in Figure8(b) show the distribution distance between the current node and the neighbor nodes; the closer the distance indicates the larger the indirect recommendation trust value. The distribution of the node trust value is similar to that of the direct recommendation trust values, with only a difference in the coefficients (judged by the distance function), so the indirect recommendation trust values overall overlap with the direct recommendation trust values. In the IPAS domain, the larger the direct recommendation trust value of the node, the larger the global trust value, and the closer the distance, the larger the global trust value.


### 6.2. Analysis of the Performance of the Group Signature Algorithm

We use group signature to realize remote attestation and compare it with other schemes in terms of performance and efficiency. The group signature must satisfy not only correctness but also the three security properties of anonymity, traceability, and unforgeability [22]. As shown in Table 2, our scheme can fully satisfy indistinguishability, anonymity, traceability, unforgeability, resistance to joint attack, forward security, and revocability. Our scheme and [22] satisfy the revocability of group members, and our scheme group public key and user private key are shorter and more suitable for IIoTs.Table 2
Performance comparison of signature schemes.
SchemeIndistinguishabilityAnonymityUnforgivabilityTraceabilityResistance to joint attackForward securityRevocability[23]√√√××××[24]√√√√×××[25]√√√√√××[26]√√√√√√×[22]√√√√√√√Ours√√√√√√√Our group signature scheme compares the performance by the computational overhead and communication overhead of the signature and verification processes.EE denotes the bilinear pair e operation, and Exp denotes the modular power operation. Since eg1,g2 can be precomputed, it can be neglected in the validation algorithm. Therefore, in our scheme signature algorithm, d1=λ1δ1·g1−γ1=g1α1·δ1·g1−γ1=g1α1·δ1−γ1 needs to perform 1 modulus power operation on g1, in the same way, d2=λ2δ1·g2−γ2=g2α2·δ2−γ2 performs 1 modulus power operation on g2. In d3 due to eλ3,g2δ2=eσ·ηα,g2δ2=eσ,g2·eη,g2α+δ2, if it is ignored for e operation, only 1 modulus power operation on g1 and 1 modulus power operation on g2 are required in d3. Simultaneously, the verification algorithm needs to perform only 4 modulus power operations and 1 e operation. Let the order in the group p be 170 bit, the length of the Hash algorithm Hu,Hm is 128 bit, and the length of the elements in the group G1,G2,GT is 171 bit. The comparison of the signature length and computational overhead of each scheme is shown in Table 3.Table 3
Comparison of computational overhead of signature schemes.
SchemeSignature lengthSignature algorithmVerification algorithm[27]2092 bit6Exp7Exp+EE[21]767 bit4ExpExp+2EE[28]1662 bit5Exp5Exp+EEOurs1491 bit4Exp4Exp+EEAs can be seen from Table3, [21] has the shortest signature length and the signature algorithm has the same computational overhead as our scheme. Comparing the validation algorithm, the computational overhead of the e operation is much greater than the modulus power operation, so our scheme verification algorithm has the least computational overhead, as illustrated in Figure 9. Therefore, our scheme has a short signature length and minimal computational overhead for the signature and verification algorithms.Figure 9
Computational performance comparison of signature and verification algorithms.


### 6.3. Analysis of Security Situation Assessment

The security situation assessment is available in SAS and IPAS to learn the security states in SAS and IPAS. Figure10 shows the variation of the trust value with malicious nodes. As the malicious nodes increase, the trust value reduces more and more. The domain’s initial trusted value is 1, and all the nodes in SAS or IPAS are trusted. When the number of malicious nodes reaches 20%, the global trust value of SAS or IPAS remains above the trust threshold (0.8). The SAS intradomain trust value is computed based on the device attributes trust value, and the malicious node is judged by the management node. There are 20 malicious nodes, and the SAS global trust value is directly reduced to 0.8. The IPAS domain global trust value is defined by the number of interactions of nodes, and malicious nodes may still interact with neighbor nodes with a global trust value greater than 0.8. Malicious nodes in the distributed IPAS domain need to combine the multiple nodes security situation assessment judgment including the malicious node discovery, repair, and exclusion process. When the number of malicious nodes is greater than 30%, both the SAS domain and IPAS domain are judged to be untrusted. Therefore, the domain security situation is represented by calculating the global trust value in a domain.Figure 10
SAS and IPAS domain trust values with malicious node variation.


## 6.1. Analysis of the Correctness of Trusted Judgment

### 6.1.1. Trusted Judgment in SAS Domain

The calculation of trust value in SAS depends on device attributes trust value, forwarding behavior trust value, and task execution trust value, if hardware and software attributes are judged to be forged, the global trust value is directly judged to be untrusted, as illustrated in Figure7, when device attributes trustvaluebluedots<0.8, the global trust value (purple dots) is directly judged to be untrusted. Figure 7(a) shows the trust value distribution when the number of malicious nodes accounts for 10%, and Figure 7(b) shows the trust value distribution when the number of malicious nodes accounts for 30%. The comparison shows that the more malicious nodes have a greater impact on the global trust value within the SAS domain.Figure 7
The process of calculating trust values in the SAS domain. (a) Distribution of each trust component when the number of malicious nodes accounts for 10%. (b) Distribution of each trust component when the number of malicious nodes accounts for 30%.
(a)
Node distribution(b)
Node distribution


### 6.1.2. Trusted Judgment in IPAS Domain

In the IPAS domain, the node direct recommendation trust value is related to the reward/punishment factor and the decay factor, and the reward factorFa=0.6 and punishment factor Fb=0.6 are illustrated in Figure 8(a). With the increasing judgment times n, if the node is judged as a trusted node with the reward factor Fa>0.5, the initial value of the reward is 0.5 (untrusted threshold). If the reward value which is continuously judged as a trusted node is increased exponentially and reaches the threshold after n=4 times, and the reward value continues to be the same after the node is judged to be a trusted node again. If the node is an untrusted node with punishment factor Fb>0.5, the initial value of punishment is 0.8 (trust threshold); after the second judgment of untrusted, the punishment value is reduced to 0.5. And n=3 times, it is still judged as the untrusted node, then the punishment value drops to 0. If it is judged as untrusted again, the punishment value is always 0. The initial value of the decay function is 1. As the recommendation times increase, the current trust value decays according to Hi, as illustrated by the blue line in Figure 8(a).Figure 8
(a) Direct recommendation trust calculation component curves in the IPAS domain, including reward/punishment values and decay function values. (b) Indirect recommendation trust value calculation and distribution, judged by the distance function and direct recommendation trust.
(a)
n(b)
Node distributionThe indirect recommendation of trust in IPAS is based on the distance function to calculate the similarity, and the green dots in Figure8(b) show the distribution distance between the current node and the neighbor nodes; the closer the distance indicates the larger the indirect recommendation trust value. The distribution of the node trust value is similar to that of the direct recommendation trust values, with only a difference in the coefficients (judged by the distance function), so the indirect recommendation trust values overall overlap with the direct recommendation trust values. In the IPAS domain, the larger the direct recommendation trust value of the node, the larger the global trust value, and the closer the distance, the larger the global trust value.


## 6.1.1. Trusted Judgment in SAS Domain

The calculation of trust value in SAS depends on device attributes trust value, forwarding behavior trust value, and task execution trust value, if hardware and software attributes are judged to be forged, the global trust value is directly judged to be untrusted, as illustrated in Figure7, when device attributes trustvaluebluedots<0.8, the global trust value (purple dots) is directly judged to be untrusted. Figure 7(a) shows the trust value distribution when the number of malicious nodes accounts for 10%, and Figure 7(b) shows the trust value distribution when the number of malicious nodes accounts for 30%. The comparison shows that the more malicious nodes have a greater impact on the global trust value within the SAS domain.Figure 7
The process of calculating trust values in the SAS domain. (a) Distribution of each trust component when the number of malicious nodes accounts for 10%. (b) Distribution of each trust component when the number of malicious nodes accounts for 30%.
(a)
Node distribution(b)
Node distribution


## 6.1.2. Trusted Judgment in IPAS Domain

In the IPAS domain, the node direct recommendation trust value is related to the reward/punishment factor and the decay factor, and the reward factorFa=0.6 and punishment factor Fb=0.6 are illustrated in Figure 8(a). With the increasing judgment times n, if the node is judged as a trusted node with the reward factor Fa>0.5, the initial value of the reward is 0.5 (untrusted threshold). If the reward value which is continuously judged as a trusted node is increased exponentially and reaches the threshold after n=4 times, and the reward value continues to be the same after the node is judged to be a trusted node again. If the node is an untrusted node with punishment factor Fb>0.5, the initial value of punishment is 0.8 (trust threshold); after the second judgment of untrusted, the punishment value is reduced to 0.5. And n=3 times, it is still judged as the untrusted node, then the punishment value drops to 0. If it is judged as untrusted again, the punishment value is always 0. The initial value of the decay function is 1. As the recommendation times increase, the current trust value decays according to Hi, as illustrated by the blue line in Figure 8(a).Figure 8
(a) Direct recommendation trust calculation component curves in the IPAS domain, including reward/punishment values and decay function values. (b) Indirect recommendation trust value calculation and distribution, judged by the distance function and direct recommendation trust.
(a)
n(b)
Node distributionThe indirect recommendation of trust in IPAS is based on the distance function to calculate the similarity, and the green dots in Figure8(b) show the distribution distance between the current node and the neighbor nodes; the closer the distance indicates the larger the indirect recommendation trust value. The distribution of the node trust value is similar to that of the direct recommendation trust values, with only a difference in the coefficients (judged by the distance function), so the indirect recommendation trust values overall overlap with the direct recommendation trust values. In the IPAS domain, the larger the direct recommendation trust value of the node, the larger the global trust value, and the closer the distance, the larger the global trust value.


## 6.2. Analysis of the Performance of the Group Signature Algorithm

We use group signature to realize remote attestation and compare it with other schemes in terms of performance and efficiency. The group signature must satisfy not only correctness but also the three security properties of anonymity, traceability, and unforgeability [22]. As shown in Table 2, our scheme can fully satisfy indistinguishability, anonymity, traceability, unforgeability, resistance to joint attack, forward security, and revocability. Our scheme and [22] satisfy the revocability of group members, and our scheme group public key and user private key are shorter and more suitable for IIoTs.Table 2
Performance comparison of signature schemes.
SchemeIndistinguishabilityAnonymityUnforgivabilityTraceabilityResistance to joint attackForward securityRevocability[23]√√√××××[24]√√√√×××[25]√√√√√××[26]√√√√√√×[22]√√√√√√√Ours√√√√√√√Our group signature scheme compares the performance by the computational overhead and communication overhead of the signature and verification processes.EE denotes the bilinear pair e operation, and Exp denotes the modular power operation. Since eg1,g2 can be precomputed, it can be neglected in the validation algorithm. Therefore, in our scheme signature algorithm, d1=λ1δ1·g1−γ1=g1α1·δ1·g1−γ1=g1α1·δ1−γ1 needs to perform 1 modulus power operation on g1, in the same way, d2=λ2δ1·g2−γ2=g2α2·δ2−γ2 performs 1 modulus power operation on g2. In d3 due to eλ3,g2δ2=eσ·ηα,g2δ2=eσ,g2·eη,g2α+δ2, if it is ignored for e operation, only 1 modulus power operation on g1 and 1 modulus power operation on g2 are required in d3. Simultaneously, the verification algorithm needs to perform only 4 modulus power operations and 1 e operation. Let the order in the group p be 170 bit, the length of the Hash algorithm Hu,Hm is 128 bit, and the length of the elements in the group G1,G2,GT is 171 bit. The comparison of the signature length and computational overhead of each scheme is shown in Table 3.Table 3
Comparison of computational overhead of signature schemes.
SchemeSignature lengthSignature algorithmVerification algorithm[27]2092 bit6Exp7Exp+EE[21]767 bit4ExpExp+2EE[28]1662 bit5Exp5Exp+EEOurs1491 bit4Exp4Exp+EEAs can be seen from Table3, [21] has the shortest signature length and the signature algorithm has the same computational overhead as our scheme. Comparing the validation algorithm, the computational overhead of the e operation is much greater than the modulus power operation, so our scheme verification algorithm has the least computational overhead, as illustrated in Figure 9. Therefore, our scheme has a short signature length and minimal computational overhead for the signature and verification algorithms.Figure 9
Computational performance comparison of signature and verification algorithms.


## 6.3. Analysis of Security Situation Assessment

The security situation assessment is available in SAS and IPAS to learn the security states in SAS and IPAS. Figure10 shows the variation of the trust value with malicious nodes. As the malicious nodes increase, the trust value reduces more and more. The domain’s initial trusted value is 1, and all the nodes in SAS or IPAS are trusted. When the number of malicious nodes reaches 20%, the global trust value of SAS or IPAS remains above the trust threshold (0.8). The SAS intradomain trust value is computed based on the device attributes trust value, and the malicious node is judged by the management node. There are 20 malicious nodes, and the SAS global trust value is directly reduced to 0.8. The IPAS domain global trust value is defined by the number of interactions of nodes, and malicious nodes may still interact with neighbor nodes with a global trust value greater than 0.8. Malicious nodes in the distributed IPAS domain need to combine the multiple nodes security situation assessment judgment including the malicious node discovery, repair, and exclusion process. When the number of malicious nodes is greater than 30%, both the SAS domain and IPAS domain are judged to be untrusted. Therefore, the domain security situation is represented by calculating the global trust value in a domain.Figure 10
SAS and IPAS domain trust values with malicious node variation.


## 7. Conclusion

The data in IIoTs is derived from different types of heterogeneous networks. A hybrid SDN architecture is used to realize the management of IIoT heterogeneous networks which are divided into different autonomous systems (SAS and IPAS). To guarantee IIoT data trading source is trusted, firstly, the standardized models are established about the attributes and interaction behaviors of nodes in SAS and IPAS for realizing the process of trusted judgment for nodes in the domain to calculate the trust value for the IIoT nodes. Secondly, the node identity and trust value are used in a revocable group signature scheme which can balance privacy and security, to complete the remote attestation of IIoT nodes and guarantee the secure data trading for different domains. Finally, the simulation experiment verifies the trusted judgment mechanism and the reward/punishment mechanism, decay function, and security situation assessment are correct which is capable to reflect the dynamic operation states of IIoT nodes. The performance and efficiency verification of the group signature scheme is analyzed by comparing the computational overhead of the signature algorithm and validation algorithm. Our scheme has good performance in trusted judgment, group signature, and verification process and can effectively confirm the security of the IIoT nodes.



---

*Source: 7463722-2023-02-09.xml*