Iot device offline session method, apparatus, and storage medium

Abstract

The application discloses an offline session method of an Internet of Things device, and is applied to an Internet of Things system and relates to an edge gateway, and comprises the following steps: when receiving a device identifier sent by an Internet of Things device to the edge gateway, generating a first random number according to a random number creation function; performing point multiplication operation in an elliptic curve based on the first random number to generate a first random point; sending the first random point to the Internet of Things device, and performing offline authentication with the Internet of Things device based on the first random point. Therefore, since the device authentication and communication encryption function are realized through the elliptic curve password improvement algorithm of the identifier, the device calculation only needs one elliptic curve point multiplication operation, the storage function can be completed by requiring only a small amount of storage space, the lightweight algorithm is realized, the identity security and credibility of the Internet of Things device can be ensured, and the data transmission security can be protected.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to an Internet of Things device offline session method, device and storage medium. BACKGROUND

[0002] With the rapid development of Internet of Things technology and application, a large number of Internet of Things devices access the Internet. Figure 1 A large number of low-cost, low-power and small storage Internet of Things devices access edge devices; edge devices collect data of the accessed Internet of Things devices as gateways; the access end forwards the Internet of Things device data collected and sent by the edge end to the platform end. In this architecture, if there is a lack of device authentication and encryption mechanism, malicious attackers can fake devices and intercept device data, resulting in dirty data / false data, affecting the accuracy of data, and causing information leakage. Therefore, how to effectively block malicious attackers is an urgent problem for researchers to solve.

[0003] In the prior art, Internet of Things secure communication mainly consists of a device authentication scheme and an encryption communication scheme. There are mainly two ways for traditional Internet of Things device authentication: one is to use a public key cryptography-based method, which can solve device authentication and encryption communication at the same time, but device communication needs a certificate management center to issue certificates, which is not suitable for offline environments. The other is to use a password method, in which device passwords are uniformly preset. The authentication mechanism of this method is weak, and a separate encryption communication scheme is needed to ensure communication security. If symmetric encryption is used, the key needs to be uniformly preset in the device, and once the key is leaked, all devices will be affected. If a public key cryptography system is used, the same problem as the first method is faced. The existing scheme based on the national encryption algorithm can solve the above problems, but the required storage space and computing amount are large, which is not suitable for resource-limited Internet of Things devices. SUMMARY

[0004] The present application provides an Internet of Things device offline session method, device and storage medium. In order to have a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This part is not a general review, nor does it determine the key / important elements or describe the protection scope of these embodiments. The only purpose is to present some concepts in a simple form as a preface to the detailed description that follows.

[0005] In a first aspect, the present application provides an Internet of Things device offline session method, applied to an edge gateway, the method comprising:

[0006] When receiving a device identifier sent by an Internet of Things device to the edge gateway, a first random number is generated according to a random number creation function;

[0007] performing a point multiplication operation in an elliptic curve based on the first random number to generate a first random point;

[0008] sending the first random point to the Internet of Things device and performing offline authentication with the Internet of Things device based on the first random point.

[0009] Optionally, performing offline authentication with the Internet of Things device based on the first random point comprises:

[0010] when receiving the first authentication point sent by the Internet of Things device to the edge gateway, calculating the public key of the Internet of Things device based on the device identifier;

[0011] calculating a second authentication point according to the first random number and the public key of the Internet of Things device;

[0012] determining whether the Internet of Things device passes the authentication according to the first authentication point and the second authentication point.

[0013] Optionally, calculating the public key of the Internet of Things device based on the device identifier comprises:

[0014] obtaining a first master public key and a second master public key sent by a platform key generation center to the edge gateway;

[0015] obtaining a preset string;

[0016] concatenating the device identifier and the preset string to generate a concatenated field;

[0017] calculating a hash value of the concatenated field according to a secure hash function;

[0018] performing point multiplication on the hash value and the first master public key, and generating the public key of the Internet of Things device by performing addition on the value after point multiplication and the second master public key;

[0019] wherein the calculation formula of the public key of the Internet of Things device is: PK = [HASH(ID||0x01)]PubKey1+PubKey2; wherein HASH is a secure hash function, ID is the Internet of Things device, 0x01 is a preset string, PubKey1 is the first master public key, and PubKey2 is the second master public key.

[0020] Optionally, determining whether the Internet of Things device passes the authentication according to the first authentication point and the second authentication point comprises:

[0021] when the first authentication point and the second authentication point are the same, determining that the Internet of Things device passes the authentication;

[0022] or,

[0023] when the first authentication point and the second authentication point are not the same, determining that the Internet of Things device does not pass the authentication.

[0024] Optionally, the method further comprises:

[0025] When the Internet of Things device authentication is passed, a second random number is generated according to a random number creation function;

[0026] Point multiplication operation in an elliptic curve is performed based on the second random number to generate a second random point;

[0027] The second random point is sent to the Internet of Things device;

[0028] A first secret public point is calculated according to the second random number and the public key of the Internet of Things device;

[0029] The abscissa in the first secret public point is extracted as a negotiation key;

[0030] Encrypted communication is performed with the Internet of Things device according to the negotiation key, a symmetric encryption algorithm, and the Internet of Things device.

[0031] In a second aspect, an embodiment of the present application provides an Internet of Things device offline session method applied to an Internet of Things device, and the method comprises the following steps:

[0032] A first random point sent by an edge gateway to the Internet of Things device is received;

[0033] A device private key sent by a platform key generation center to the Internet of Things device is obtained;

[0034] A first authentication point is calculated according to the device private key and the first random point;

[0035] The first authentication point is sent to the edge gateway.

[0036] Optionally, the method further comprises the following steps:

[0037] A second random point sent by the edge gateway to the Internet of Things device is received;

[0038] A second secret public point is calculated according to the device private key and the second random point;

[0039] The abscissa in the second secret public point is extracted as a negotiation key;

[0040] Encrypted communication is performed with the edge gateway according to the negotiation key, a symmetric encryption algorithm, and the edge gateway.

[0041] In a third aspect, an embodiment of the present application provides an Internet of Things device offline session method applied to a platform key generation center, and the method comprises the following steps:

[0042] When an Internet of Things system is initialized, a first master private key and a second master private key are generated according to a random number creation function;

[0043] Point multiplication operation in an elliptic curve is performed according to the first master private key and the second master private key to generate a first master public key and a second master public key;

[0044] When a new Internet of Things device joins, a device identity is generated for the Internet of Things device;

[0045] The device private key is calculated according to the device identity, the first master private key and the second master private key;

[0046] The first master public key, the second master public key and the device private key are sent to the Internet of Things device through a preset secure channel;

[0047] The first master public key and the second master public key are sent to the edge gateway.

[0048] In a fourth aspect, an embodiment of the present application provides an Internet of Things device offline session device applied to an edge gateway, and the device comprises:

[0049] A random number creation module is configured to generate a first random number according to a random number creation function when receiving a device identity sent by an Internet of Things device to an edge gateway;

[0050] A random point generation module is configured to perform point multiplication operation in an elliptic curve based on the first random number to generate a first random point;

[0051] An offline authentication module is configured to send the first random point to the Internet of Things device and perform offline authentication with the Internet of Things device based on the first random point.

[0052] In a fourth aspect, an embodiment of the present application provides a computer storage medium, which stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and performing the method steps described above.

[0053] The technical scheme provided by the embodiment of the present application can have the following beneficial effects:

[0054] In the embodiment of the present application, the edge gateway first generates a first random number according to a random number creation function when receiving a device identity sent by an Internet of Things device to an edge gateway, then performs point multiplication operation in an elliptic curve based on the first random number to generate a first random point, and finally sends the first random point to the Internet of Things device and performs offline authentication with the Internet of Things device based on the first random point. Therefore, since the device authentication and communication encryption function is realized by the elliptic curve cryptography improvement algorithm of the identity in the present application, the device calculation only needs one elliptic curve point multiplication operation, and the storage function can be completed with only a small amount of storage space, so that the lightweight algorithm is realized, and the identity security and credibility of the Internet of Things device can be ensured, and the security of data transmission can be protected.

[0055] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0056] The accompanying drawings, which are incorporated herein and constitute part of this specification, illustrate embodiments consistent with the application and, together with the description, further serve to explain the principles of the application.

[0057] Figure 1 is a system architecture diagram of an Internet of Things device session provided by an embodiment of the present application;

[0058] Figure 2 is a flowchart of an Internet of Things device offline session method applied to an edge gateway provided by an embodiment of the present application;

[0059] Figure 3 is a device authentication flowchart provided by the present application;

[0060] Figure 4 is a key negotiation flowchart provided by the present application;

[0061] Figure 5 is a flowchart of an Internet of Things device offline session method applied to an Internet of Things device provided by an embodiment of the present application;

[0062] Figure 6 is a flowchart of an Internet of Things device offline session method of a platform-side key generation center provided by the present application;

[0063] Figure 7 is a device diagram of an Internet of Things device offline session device applied to an edge gateway provided by the present application;

[0064] Figure 8 is a structural diagram of a gateway device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0065] The following description and drawings are illustrative of specific embodiments of the present application and are not intended to be limiting of the present application as a whole.

[0066] It should be noted that the described embodiments are merely a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0067] The following description refers to the accompanying drawings, which are incorporated in and constitute part of this specification. Unless otherwise indicated, the same numbers in different drawings indicate the same or similar elements. The implementations described in the following example embodiments are illustrative of one or more aspects of the present application and are not meant to limit the scope of the application as encompassed by the claims.

[0068] In the description of the present application, it should be understood that the terms "first", "second" and the like are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. The above terms can be understood in the specific meaning in the present application according to the specific circumstances for those skilled in the art. In addition, in the description of the present application, "a plurality of" means two or more, unless otherwise specified. The association relationship of the associated objects is described, which means that there can be three relationships, for example, A and / or B can represent the following three cases: A exists alone, A and B exist together, and B exists alone. The character " / " generally represents an "or" relationship between the associated objects before and after it.

[0069] The present application provides an Internet of Things device offline session method, device and storage medium to solve the above-mentioned related technical problems. In the technical scheme provided by the present application, the device authentication and communication encryption function is realized by the elliptic curve password improvement algorithm of the identifier, so that the device calculation only needs one elliptic curve point multiplication operation, and the storage function can be completed with only a small amount of storage space, which can guarantee the identity security and credibility of the Internet of Things device, protect the security of data transmission, and realize the lightweight algorithm. The following will be described in detail by way of example.

[0070] The following will be described in detail by way of example. Figures 1-6 The Internet of Things device offline session method provided by the embodiment of the present application is described in detail. The method can be realized by relying on a computer program and can be run on an Internet of Things device offline session device based on the von Neumann system. The computer program can be integrated in an application or run as an independent tool application.

[0071] Please refer to Figure 1 A flowchart of an Internet of Things device offline session method provided by the embodiment of the present application is provided, which is applied to an edge gateway. As Figure 1 The method of the embodiment of the present application can include the following steps:

[0072] S101, when receiving the device identifier sent by the Internet of Things device to the edge gateway, generating a first random number according to a random number creation function;

[0073] In the embodiment of the present application, the calculation formula P' = [n]P represents the point multiplication operation in the elliptic curve; Hash() represents a secure hash function, and the output is converted into a large integer; || represents the string concatenation operation.

[0074] Generally, before receiving the device identity, when the Internet of Things system is initialized, the platform-side key generation center generates random numbers k1 and k2 as master private keys according to a random number creation function, k1 is a first master private key, and k2 is a second master private key. The platform-side key generation center performs point multiplication operation in an elliptic curve according to the first master private key k1 and the second master private key k2 to generate a first master public key and a second master public key. The calculation formula of the first master public key is PubKey1=[k1]P, and the calculation formula of the second master public key is PubKey2=[k2]P. At this time, the initialization is completed.

[0075] When a new Internet of Things device is added, the platform-side key generation center generates a device identity ID for the Internet of Things device. The platform-side key generation center calculates a device private key sk according to the device identity ID, the first master private key, and the second master private key. The calculation formula of the device private key sk is:

[0076] sk=Hash(ID||0x01)·k1+k2 mod N.

[0077] The platform-side key generation center sends the first master public key, the second master public key, and the device private key to the Internet of Things device through a preset secure channel, and sends the first master public key and the second master public key to the edge-side gateway.

[0078] Further, the Internet of Things device discovers the gateway through a preset authentication gateway IP. The Internet of Things device sends its own device identity ID to the edge-side gateway.

[0079] In a possible implementation manner, the edge-side gateway receives the device identity sent by the Internet of Things device for the edge-side gateway, and generates a first random number r according to a random number creation function.

[0080] S102, performing point multiplication operation in an elliptic curve based on the first random number to generate a first random point;

[0081] In a possible implementation manner, after generating the first random number r, the edge-side gateway performs point multiplication operation in an elliptic curve based on the first random number to generate a first random point. The calculation formula of the first random point is RP=[r]P.

[0082] S103, sending the first random point to the Internet of Things device, and performing offline authentication with the Internet of Things device based on the first random point.

[0083] In a possible implementation manner, the edge-side gateway sends the first random point RP to the Internet of Things device, and performs offline authentication with the Internet of Things device based on the first random point.

[0084] Further, the Internet of Things device receives the first random point RP, and then obtains the device private key sk sent by the platform key generation center for the Internet of Things device, and then calculates the first authentication point AP according to the device private key sk and the first random point RP, and finally sends the first authentication point AP to the edge gateway. The calculation formula of the first authentication point AP is: AP = [sk] RP.

[0085] Specifically, when performing offline authentication based on the first random point and the Internet of Things device, the edge gateway first receives the first authentication point AP sent by the Internet of Things device for the edge gateway, and calculates the public key of the Internet of Things device based on the device identifier ID, and then calculates the second authentication point AP' according to the first random number r and the public key of the Internet of Things device, and finally determines whether the Internet of Things device is authenticated based on the first authentication point AP and the second authentication point AP'.

[0086] Specifically, when the edge gateway calculates the public key of the Internet of Things device based on the device identifier ID, the edge gateway first obtains the first master public key PubKey1 and the second master public key PubKey2 sent by the platform key generation center for the edge gateway, and then obtains a preset string 0x01, and then splices the device identifier and the preset string to generate a splicing field, and then calculates the hash value of the splicing field according to a secure hash function, and finally performs point multiplication on the hash value and the first master public key, and performs addition on the value after point multiplication and the second master public key to generate the public key of the Internet of Things device.

[0087] The calculation formula of the public key PK of the Internet of Things device is: PK = [Hash(ID||0x01)] PubKey1 + PubKey2. Wherein, HASH is a secure hash function, ID is an Internet of Things device, 0x01 is a preset string, PubKey1 is a first master public key, and PubKey2 is a second master public key.

[0088] The calculation formula of the second authentication point is: AEP' = [r] PK.

[0089] Specifically, when the edge gateway determines whether the Internet of Things device is authenticated based on the first authentication point AP and the second authentication point AP', when the first authentication point AP and the second authentication point AP' are the same, the edge gateway determines that the Internet of Things device is authenticated; or when the first authentication point AP and the second authentication point AP' are different, the edge gateway determines that the Internet of Things device is not authenticated.

[0090] For example Figure 3 As shown, Figure 3is a device authentication process schematic diagram provided by the present application, the device discovers the gateway through the preset authentication gateway IP, the device sends its own device identifier ID to the gateway, the gateway receives the device identifier ID, the gateway generates a random number r and calculates a random point RP=[r]P, the gateway sends the random point RP to the device, the device calculates an authentication point AP=[sk]RP based on the device private key and sends it to the gateway, the gateway receives the authentication point AP, the gateway calculates a device public key based on the received device identifier ID

[0091] PK=[Hash(ID||0x01)]PubKey1+PubKey2, the gateway calculates an authentication comparison point AP'=[r]PK based on the random number r and the device public key PK, the gateway compares the authentication point AP and the authentication comparison point AP', and if they are the same, the authentication is passed, otherwise, it is not passed.

[0092] For example Figure 4 As shown, Figure 4 is a key negotiation process schematic diagram provided by the present application, the gateway generates a random number m and calculates a random point MP=[m]P, the gateway sends the random point MP to the device, the device receives the random point MP and calculates a secret public point SP=[sk]MP, taking the abscissa x of SP as the negotiation key key, the gateway calculates a secret public point SP'=[m]PK based on the random number m and the device public key PK, taking the abscissa x' of SP' as the negotiation key key, and the two parties perform encrypted communication based on the negotiation key key and the symmetric encryption algorithm.

[0093] Further, when the Internet of Things device authentication is passed, the edge gateway first generates a second random number m according to a random number creation function, then performs point multiplication operation in an elliptic curve based on the second random number to generate a second random point MP, then sends the second random point MP to the Internet of Things device, then calculates a first secret public point SP' according to the second random number m and the Internet of Things device public key PK, then extracts the abscissa x' in the first secret public point SP' as the negotiation key key, and finally performs encrypted communication with the Internet of Things device according to the negotiation key key, the symmetric encryption algorithm.

[0094] Wherein, the calculation formula of the second random point MP is: MP=[m]P.

[0095] Wherein, the calculation formula of the second secret public point is: SP'=[m]PK.

[0096] Further, the Internet of Things device first receives the second random point MP sent by the edge gateway for the Internet of Things device, then calculates the second secret public point SP according to the device private key and the second random point MP, extracts the abscissa x in the second secret public point as the negotiation key key, and finally performs encrypted communication with the edge gateway according to the negotiation key key and the symmetric encryption algorithm.

[0097] Optionally, in the case of extremely limited device resources, the negotiation key and plaintext can be used for exclusive OR operation for encryption.

[0098] In the embodiment of the present application, the edge gateway first generates a first random number according to a random number creation function when receiving the device identifier sent by the Internet of Things device for the edge gateway, then performs point multiplication operation in the elliptic curve based on the first random number to generate a first random point, and finally sends the first random point to the Internet of Things device and performs offline authentication with the Internet of Things device based on the first random point. Therefore, since the device authentication and communication encryption function is realized by the identification elliptic curve password improvement algorithm of the present application, the device calculation only needs one elliptic curve point multiplication operation, and the space requirement only needs a small amount of storage space to complete the storage function. While realizing the lightweight algorithm, the identity security and credibility of the Internet of Things device can be ensured, and the security of data transmission can be protected.

[0099] Please refer to Figure 5 A flowchart of an Internet of Things device offline session method is provided for the embodiment of the present application, which is applied to an Internet of Things device. As shown in Figure 5 The method of the embodiment of the present application can include the following steps:

[0100] S201, receiving the first random point sent by the edge gateway for the Internet of Things device;

[0101] S202, obtaining the device private key sent by the platform end key generation center for the Internet of Things device;

[0102] S203, calculating the first authentication point according to the device private key and the first random point;

[0103] S204, sending the first authentication point to the edge gateway.

[0104] S205, receiving the second random point sent by the edge gateway for the Internet of Things device;

[0105] S206, calculating the second secret public point according to the device private key and the second random point;

[0106] S207, extracting the abscissa in the second secret public point as the negotiation key;

[0107] S208, the edge gateway is communicated according to the negotiation key, the symmetric encryption algorithm and the edge gateway.

[0108] In the device authentication, when an edge gateway (hereinafter referred to as a gateway) needs to authenticate a device, first, the device sends its own identifier ID to the gateway, the gateway generates a random number r, calculates a random point RP=[r]P, and sends the point RP to the device; after the device receives the point RP, it calculates an authentication point AP=[sk]SP, and sends the point AP to the gateway; the gateway calculates the public key PK of the ECC public key cryptosystem based on the identifier ID of the device:

[0109] PK=[Hash(ID||0x01)]PubKey1+PubKey2, and then calculates an authentication point AP'=[r]PK based on the public key PK of the device, and compares the received authentication point AP. If the two points are the same, the authentication is passed, otherwise, it is not passed.

[0110] In the key negotiation, after the gateway authenticates the device, it generates a random number m, calculates a random point MP=[m]P, and sends the random point MP to the device, and then calculates a secret public point SP=[m]PK based on the public key PK of the device, and serializes the abscissa x of the secret public point SP to obtain the negotiation key key; after the device receives the random point MP, it generates a secret public point SP'=[sk]MP using its own device private key sk, and also serializes the abscissa x' of the public point SP' to obtain the negotiation key key.

[0111] In the embodiment of the application, the edge gateway first receives the device identifier sent by the Internet of Things device to the edge gateway, generates a first random number according to a random number creation function, then performs point multiplication operation in an elliptic curve based on the first random number to generate a first random point, and finally sends the first random point to the Internet of Things device and performs offline authentication with the Internet of Things device based on the first random point. Therefore, since the device authentication and communication encryption function are realized by the identification elliptic curve cryptography improvement algorithm of the application, the device calculation only needs one elliptic curve point multiplication operation, and the space requirement only needs a little storage space to complete the storage function, while realizing the lightweight algorithm, the identity security and credibility of the Internet of Things device can be guaranteed, and the security of data transmission can be protected.

[0112] Please refer to Figure 6 , a flowchart of an offline session method of an Internet of Things device is provided for the embodiment of the application, which is applied to a platform key generation center. As shown in Figure 6 , the method of the embodiment of the application can include the following steps:

[0113] S301, when the Internet of Things system is initialized, a first master private key and a second master private key are generated according to a random number creation function;

[0114] S302, performing point multiplication operation in an elliptic curve according to the first master private key and the second master private key to generate a first master public key and a second master public key;

[0115] S303, when a new Internet of Things device joins, generating a device identifier for the Internet of Things device;

[0116] S304, calculating a device private key according to the device identifier, the first master private key and the second master private key;

[0117] S305, sending the first master public key, the second master public key and the device private key to the Internet of Things device through a preset secure channel;

[0118] S306, sending the first master public key and the second master public key to the edge gateway.

[0119] In a possible implementation, the platform-side key generation center first selects a secure elliptic curve and generates related public parameters, including parameters a, b, q of the elliptic curve, and a base point P and an order N. Then, random numbers k1 and k2 are generated as master private keys, and points PubKey1 = [k1]P and PubKey2 = [k2]P are calculated as master public keys.

[0120] For a device, a device identifier ID is first generated for the device; a private key sk of the device is generated according to the device identifier ID: sk = Hash(D||0x01)·k1+k2 mod N; in an ECC public key cryptography system, a public key of the device is PK = [sk]P, and the identifier ID and the private key of the device are pre-stored in the device.

[0121] In the embodiment of the application, when the edge gateway receives the device identifier sent by the Internet of Things device to the edge gateway, the edge gateway first generates a first random number according to a random number creation function, then performs point multiplication operation in an elliptic curve based on the first random number to generate a first random point, and finally sends the first random point to the Internet of Things device and performs offline authentication with the Internet of Things device based on the first random point. Therefore, since the device authentication and communication encryption function are realized by the identification elliptic curve cryptography improvement algorithm of the application, the calculation of the device only needs one elliptic curve point multiplication operation, and the storage function can be completed with only a small amount of storage space, so that the lightweight algorithm is realized while the identity security and credibility of the Internet of Things device are guaranteed and the security of data transmission is protected.

[0122] The following is an apparatus embodiment of the application, which can be used to execute the method embodiment of the application. For details not disclosed in the apparatus embodiment of the application, please refer to the method embodiment of the application.

[0123] Please refer to Figure 7Fig. 1 is a structural schematic diagram of an offline session device of an Internet of Things device according to an example embodiment of the present application, which is applied to an edge gateway. The offline session device of the Internet of Things device can be realized by software, hardware or a combination of both to become all or part of the gateway device. The device 1 includes a random number creation module 10, a random point generation module 20 and an offline authentication module 30.

[0124] The random number creation module 10 is configured to generate a first random number according to a random number creation function when receiving a device identifier sent by the Internet of Things device to the edge gateway.

[0125] The random point generation module 20 is configured to perform point multiplication operation in an elliptic curve based on the first random number to generate a first random point.

[0126] The offline authentication module 30 is configured to send the first random point to the Internet of Things device and perform offline authentication with the Internet of Things device based on the first random point.

[0127] It should be noted that the offline session device of the Internet of Things device provided in the above example is only used as an example to divide the above functions, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the above described functions. In addition, the offline session device of the Internet of Things device and the offline session method of the Internet of Things device provided in the above example belong to the same concept, and the implementation process is detailed in the method embodiment, which will not be repeated here.

[0128] The above sequence numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0129] In the embodiments of the present application, the edge gateway first generates a first random number according to a random number creation function when receiving a device identifier sent by the Internet of Things device to the edge gateway, then performs point multiplication operation in an elliptic curve based on the first random number to generate a first random point, and finally sends the first random point to the Internet of Things device and performs offline authentication with the Internet of Things device based on the first random point. Therefore, since the device authentication and communication encryption function is realized by the elliptic curve cryptography improvement algorithm of the identifier in the present application, the device calculation only needs one elliptic curve point multiplication operation, and the storage function can be completed with only a small amount of storage space, which can realize a lightweight algorithm while ensuring the security and trustworthiness of the identity of the Internet of Things device and protecting the security of data transmission.

[0130] The present invention also provides a computer-readable medium storing program instructions that, when executed by a processor, implement the offline session methods for IoT devices provided in each of the aforementioned method embodiments. The present invention also provides a computer program product containing instructions that, when executed on a computer, causes the computer to perform the offline session methods for IoT devices provided in each of the aforementioned method embodiments.

[0131] See Figure 8 , is a schematic diagram of the internal structure of a gateway device in one embodiment. Figure 8 As shown, the gateway device includes a processor, a non-volatile storage medium, a memory and a network interface connected via a system bus. Among them, the non-volatile storage medium of the gateway device stores an operating system, a database and computer-readable instructions, and the database may store a control information sequence. When the computer-readable instructions are executed by the processor, the processor can implement a data transmission method. The processor of the gateway device is used to provide computing and control capabilities to support the operation of the entire gateway device. The memory of the gateway device may store computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor can execute a data transmission method. The network interface of the gateway device is used to connect and communicate with the terminal. Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the gateway device to which the solution of the present application is applied. The specific gateway device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0132] In one embodiment, a gateway device is provided. The gateway device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are performed:

[0133] When receiving a device identifier sent by the IoT device to the edge gateway, generating a first random number according to a random number creation function;

[0134] Performing a point multiplication operation on an elliptic curve based on the first random number to generate a first random point;

[0135] The first random point is sent to the IoT device, and offline authentication is performed with the IoT device based on the first random point.

[0136] In one embodiment, when the processor performs offline authentication with the IoT device based on the first random point, the processor specifically performs the following steps:

[0137] When receiving a first authentication point sent by the IoT device to the edge gateway, calculating a public key of the IoT device based on the device identifier;

[0138] calculating a second authentication point according to the first random number and the public key of the Internet of Things device;

[0139] determining whether the Internet of Things device passes authentication according to the first authentication point and the second authentication point.

[0140] In one embodiment, when the processor calculates the public key of the Internet of Things device based on the device identifier, the following steps are specifically performed:

[0141] obtaining a first master public key and a second master public key sent by the platform-side key generation center to the edge-side gateway;

[0142] obtaining a preset string;

[0143] concatenating the device identifier and the preset string to generate a concatenated field;

[0144] calculating a hash value of the concatenated field according to a secure hash function;

[0145] point-multiplying the hash value with the first master public key, and generating the public key of the Internet of Things device by summing the value after point multiplication with the second master public key;

[0146] wherein the calculation formula of the public key of the Internet of Things device is: PK = [HASH (ID || 0x01)] PubKey1 + PubKey2; wherein HASH is a secure hash function, ID is the Internet of Things device, 0x01 is a preset string, PubKey1 is the first master public key, and PubKey2 is the second master public key.

[0147] In one embodiment, when the processor determines whether the Internet of Things device passes authentication according to the first authentication point and the second authentication point, the following steps are specifically performed:

[0148] when the first authentication point and the second authentication point are the same, determining that the Internet of Things device passes authentication;

[0149] or,

[0150] when the first authentication point and the second authentication point are different, determining that the Internet of Things device does not pass authentication.

[0151] In one embodiment, the processor further performs the following steps:

[0152] when the Internet of Things device passes authentication, generating a second random number according to a random number creation function;

[0153] performing point multiplication operation in an elliptic curve based on the second random number to generate a second random point;

[0154] sending the second random point to the Internet of Things device;

[0155] The first secret public point is calculated according to the second random number and the public key of the Internet of Things device;

[0156] The abscissa in the first secret public point is extracted as the negotiation key;

[0157] The Internet of Things device is encrypted and communicated according to the negotiation key, the symmetric encryption algorithm and the Internet of Things device.

[0158] In the embodiments of the present application, when the edge gateway receives the device identifier sent by the Internet of Things device to the edge gateway, the edge gateway first generates a first random number according to a random number creation function, then performs point multiplication operation in an elliptic curve based on the first random number to generate a first random point, and finally sends the first random point to the Internet of Things device and performs offline authentication with the Internet of Things device based on the first random point. Therefore, since the device authentication and communication encryption function is realized by the identification elliptic curve password improvement algorithm of the present application, the device calculation only needs one elliptic curve point multiplication operation, and the space requirement only needs a small amount of storage space to complete the storage function. In the meanwhile, the lightweight algorithm is realized, the identity security and credibility of the Internet of Things device are ensured, and the security of data transmission is protected.

[0159] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The program of the Internet of Things device offline session can be stored in a computer readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiments. The storage medium can be a magnetic disc, an optical disc, a read-only memory or a random access memory.

[0160] The above only describes the preferred embodiments of the present application, and of course cannot limit the scope of the rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope of the present application.

Claims

1. An Internet of Things device offline session method, applied to an edge gateway, characterized in that, The method comprises: When receiving a device identifier sent by an Internet of Things device to the edge gateway, generating a first random number r according to a random number creation function; Based on the first random number, point multiplication operation in an elliptic curve is performed to generate a first random point RP=[r]P; The first random point is sent to the Internet of Things device, and offline authentication is performed with the Internet of Things device based on the first random point; wherein The offline authentication with the Internet of Things device based on the first random point comprises: When receiving a first authentication point sent by the Internet of Things device to the edge gateway, an Internet of Things device public key is calculated based on the device identifier; the calculation formula of the first authentication point is: AP=[sk]RP; sk is an Internet of Things device private key; A second authentication point is calculated according to the first random number and the Internet of Things device public key; The calculation formula of the second authentication point is: AP'=[r]PK; PK is an Internet of Things device public key; Whether the Internet of Things device passes the authentication is determined according to the first authentication point and the second authentication point; Wherein, the calculation of the Internet of Things device public key based on the device identifier comprises: Obtaining a first master public key and a second master public key sent by a platform-side key generation center to the edge gateway; Obtaining a preset string; Splicing the device identifier and the preset string to generate a splicing field; Calculating the hash value of the splicing field according to a secure hash function; Point multiplication is performed on the hash value and the first master public key, and the value after point multiplication is added to the second master public key to generate an Internet of Things device public key; Wherein, the platform-side key generation center generates the first master public key, the second master public key and the device private key according to the following steps, comprising: When the Internet of Things system is initialized, a first master private key and a second master private key are generated according to a random number creation function; Point multiplication operation in an elliptic curve is performed according to the first master private key and the second master private key to generate a first master public key and a second master public key; When a new Internet of Things device is added, a device identifier is generated for the Internet of Things device, and a device private key is calculated according to the device identifier, the first master private key and the second master private key; Wherein, the calculation formula of the Internet of Things device public key is: PK=[Hash(ID||0x01)]PubKey1+PubKey2; the calculation formula of the Internet of Things device private key is: sk=Hash(ID||0x01)·k1+k2mod N; wherein, HASH is a secure hash function, ID is a device identifier of the Internet of Things device, 0x01 is a preset string, PubKey1 is a first master public key, PubKey2 is a second master public key, k1 is a first master private key, and k2 is a second master private key.

2. The method of claim 1, wherein, The determination of whether the Internet of Things device passes the authentication according to the first authentication point and the second authentication point comprises: When the first authentication point and the second authentication point are the same, it is determined that the Internet of Things device passes the authentication; Or, When the first authentication point and the second authentication point are not the same, it is determined that the Internet of Things device does not pass the authentication.

3. The method of claim 2, wherein, The method further comprises: When the Internet of Things device authentication passes, a second random number m is generated according to a random number creation function; Point multiplication operation in an elliptic curve is performed based on the second random number to generate a second random point MP=[m]P; The second random point is sent to the Internet of Things device; A first secret public point SP'=[m]PK is calculated according to the second random number and the Internet of Things device public key; The abscissa in the first secret public point is extracted as a negotiation key; The negotiation key, a symmetric encryption algorithm and the Internet of Things device are used for encrypted communication.

4. An Internet of Things device offline session method, applied to an Internet of Things device, characterized in that, The method comprises: Receiving a first random point sent by an edge gateway for the Internet of Things device; Obtaining a device private key sent by a platform key generation center for the Internet of Things device; Calculating a first authentication point according to the device private key and the first random point; Sending the first authentication point to the edge gateway; The edge gateway performs the following operations: When receiving a device identifier sent by the Internet of Things device for the edge gateway, a first random number r is generated according to a random number creation function; Point multiplication operation in an elliptic curve is performed based on the first random number to generate a first random point RP=[r]P; The first random point is sent to the Internet of Things device and offline authentication is performed with the Internet of Things device based on the first random point; wherein, The offline authentication with the Internet of Things device based on the first random point comprises: When receiving a first authentication point sent by the Internet of Things device for the edge gateway, an Internet of Things device public key is calculated based on the device identifier; the calculation formula of the first authentication point is: AP=[sk]RP; sk is an Internet of Things device private key; A second authentication point is calculated according to the first random number and the Internet of Things device public key; the calculation formula of the second authentication point is: AP'=[r]PK; PK is an Internet of Things device public key; Whether the Internet of Things device authentication passes is determined according to the first authentication point and the second authentication point; Wherein, the Internet of Things device public key is calculated based on the device identifier, comprising: Obtaining a first master public key and a second master public key sent by a platform key generation center for the edge gateway; Obtaining a preset string; Concatenating the device identifier and the preset string to generate a concatenation field; Calculating the hash value of the concatenation field according to a secure hash function; Point multiplying the hash value with the first master public key, and generating an Internet of Things device public key after point multiplying the value with the second master public key and summing; Wherein, the platform key generation center generates the first master public key, the second master public key and the device private key according to the following steps, comprising: When the Internet of Things system is initialized, a first master private key and a second master private key are generated according to a random number creation function; Point multiplication operation in an elliptic curve is performed based on the first master private key and the second master private key to generate a first master public key and a second master public key; When a new Internet of Things device is added, a device identifier is generated for the Internet of Things device, and a device private key is calculated according to the device identifier, the first master private key and the second master private key; Wherein, the calculation formula of the Internet of Things device public key is: PK=[Hash(ID||0x01)]PubKey1+PubKey2; the calculation formula of the private key of the Internet of Things device is: sk=Hash(ID||0x01)·k1+k2 mod N; wherein, HASH is a secure hash function, ID is the device identifier of the Internet of Things device, 0x01 is a preset string, PubKey1 is the first main public key, PubKey2 is the second main public key, k1 is the first main private key, and k2 is the second main private key.

5. The method of claim 4, wherein, The method further comprises: receiving a second random point MP=[m]P sent by the edge gateway for the Internet of Things device, m being a second random number generated by the edge gateway according to a random number creation function when the Internet of Things device passes authentication; calculating a second secret public point SP=[sk]MP according to the device private key and the second random point; extracting the abscissa in the second secret public point as a negotiation key; performing encrypted communication with the edge gateway according to the negotiation key, a symmetric encryption algorithm, and the edge gateway.

6. An Internet of Things device offline session apparatus implemented using the method of claim 1, applied to an edge gateway, characterized in that, The device comprises: a random number creation module configured to generate a first random number according to a random number creation function when receiving a device identifier sent by an Internet of Things device for the edge gateway; a random point generation module configured to perform point multiplication operation in an elliptic curve based on the first random number to generate a first random point; an offline authentication module configured to send the first random point to the Internet of Things device and perform offline authentication with the Internet of Things device based on the first random point.

7. A computer storage medium, characterized in that The computer storage medium stores a plurality of instructions, which are suitable for being loaded and executed by the processor to perform the method of any one of claims 1-5.

Images