Internet of Things access authentication system capable of bidirectional authentication

Abstract

The invention discloses an Internet of Things access authentication system capable of bidirectional authentication, which comprises a key distribution center and an authentication information monitoring unit, and is characterized in that a group of output ends of the key distribution center are wirelessly connected with Internet of Things equipment a. According to the Internet of Things access authentication system capable of bidirectional authentication, when the Internet of Things equipment a and the Internet of Things equipment b are accessed, the key distribution center sends verification information and inputs the verification information into the information integration unit for integration, so that waiting time and processing time are reduced, the verification speed is accelerated, the bidirectional authentication platform can accept the verification information, and the verification efficiency is improved. The Internet of Things equipment a and the Internet of Things equipment b establish communication after verification succeeds, the encryption communication unit can encrypt the information during communication, the dynamic firewall can adapt to dynamic address changes in a large-scale network, and the security of the Internet of Things equipment a and the Internet of Things equipment b is improved. And protection is carried out through the API protection module after dangerous information is found.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things access authentication systems, and in particular to an Internet of Things access authentication system capable of two-way authentication. Background Art

[0002] The two-way authentication IoT access authentication system is an important mechanism to ensure the secure access and communication of IoT devices. The system provides a unique identity for each IoT device and ensures the authenticity and integrity of the device through two-way authentication services to prevent the device from being tampered with or counterfeited.

[0003] For example, the method for secure access authentication of terminal devices in an Internet of Things system, as disclosed in announcement number CN109936438A, uses the AES symmetric encryption algorithm, which is one of the most popular algorithms in symmetric key encryption. AES can quickly encrypt and decrypt in both software and hardware, is relatively easy to implement, and requires very little memory. The unique serial number of the device is a set of unique serial numbers carried by the device when it is accessed, which ensures the uniqueness of the device. The advantages are that this method is simple to implement, has secure encryption, fast calculation speed, occupies less device resources, and can realize secure device access to the platform server.

[0004] When the IoT access authentication system in the above scheme is in use, it uses the AES symmetric encryption algorithm to encrypt the device when it is accessed, so as to achieve secure device access to the platform server. However, when verifying the key, signature and identity information, due to the large amount of information, it takes a long time to verify, which slows down the speed of IoT access authentication. Summary of the invention

[0005] The purpose of the present invention is to provide an Internet of Things access authentication system capable of two-way authentication, so as to solve the problem of slow authentication of the existing Internet of Things access authentication system proposed in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: an Internet of Things access authentication system capable of bidirectional authentication, comprising a key distribution center and an authentication information monitoring unit, wherein one group of output ends of the key distribution center is wirelessly connected to an Internet of Things device a, and another group of output ends of the key distribution center is wirelessly connected to an Internet of Things device b.

[0007] The output ends of the Internet of Things device a and the Internet of Things device b are both wirelessly connected to the input end of the information integration unit, the output port of the information integration unit sends the integrated information to the two-way authentication platform, the output port of the two-way authentication platform inputs the authenticated information into the authentication information monitoring unit for monitoring, the Internet of Things device a and the Internet of Things device b are wirelessly connected to each other, the Internet of Things device a and the Internet of Things device b respectively encrypt the authentication information and protect the information transmission through the encryption communication unit and the dynamic firewall, the information integration unit includes an information combination module and an information encapsulation module, the output end of the information combination module sends the combined information to the information encapsulation module, and the information encapsulation module is used to process the information.

[0008] Preferably, the authentication information monitoring unit includes an authentication information storage module for backing up identity information and an authentication information analysis module for comparing verification information.

[0009] Preferably, the output end of the authentication information storage module is wirelessly connected to the input end of the authentication information analysis module, and the authentication information storage module can send verification information to the authentication information analysis module.

[0010] Preferably, the encryption communication unit includes a data encryption module, an identity authentication module and an access control module, and the dynamic firewall includes an AI intelligent monitoring module, a dangerous information collection module, a dynamic tunnel establishment module and an API protection module.

[0011] Preferably, the output end of the AI ​​intelligent monitoring module is wirelessly connected to a danger information collection module, the output end of the danger information collection module is wirelessly connected to a dynamic tunnel establishment module, and the dynamic tunnel establishment module is wirelessly connected to the output port of the API protection module.

[0012] Preferably, the output ends of the Internet of Things device a and the Internet of Things device b are both wirelessly connected to a node selection unit, and the node selection unit includes a node detection unit and a node analysis module.

[0013] Preferably, the node detection unit is used to detect node information, and the output end of the node detection unit can input the node information into the input end of the node analysis module, and the output ends of the Internet of Things device a and the Internet of Things device b are both wirelessly connected to the pre-signature unit.

[0014] Preferably, the pre-signature unit includes a signature data generation module and a signature calling module, and the signature data generation module can send the generated signature data to the signature calling module through an output port.

[0015] Preferably, the output end of the two-way authentication platform is wirelessly connected to a certificate storage module, and the certificate storage module includes a certificate storage module, a certificate query path and a certificate query module.

[0016] Preferably, the output end of the certificate storage module is wirelessly connected to a certificate query path, and the certificate query module can query the certificate information stored in the certificate storage module through the certificate query path.

[0017] Compared with the prior art, the present invention has the following beneficial effects:

[0018] 1. In the IoT access authentication system capable of two-way authentication, when IoT device a and IoT device b are connected, the key distribution center will send verification information to the information integration unit for integration, thereby reducing waiting time and processing time, thereby speeding up the verification process. The two-way authentication platform can accept the verification information and input the verification information into the authentication information monitoring unit to facilitate subsequent traceability inquiries. After successful verification, IoT device a and IoT device b will establish communication. During communication, the encryption communication unit can encrypt the information. The dynamic firewall can adapt to dynamic address changes in large networks. After dangerous information is discovered, it will be protected through the API protection module. In this way, the above operations can improve the verification speed of the IoT access authentication system, and after the verification is completed, the information transmission of the connected devices can be protected.

[0019] 2. When a new node joins the network, the IoT access authentication system capable of two-way authentication can detect the node through the node detection unit in the node selection unit, and analyze these nodes through the node analysis module to select relatively unobstructed nodes for authentication, thereby reducing the load of fixed nodes, so that each node can participate in authentication as a reference node, reducing the pressure on a single node, and improving overall flexibility and anti-attack capabilities. The pre-signature unit can generate some temporary signature data, store them for backup, call the pre-signature data when formally signing, and quickly generate a complete signature, greatly shortening the time for real-time signature generation. The digital certificate of the device is stored in the leaf node of the MPT in the form of a key-value pair through the certificate storage module in the certificate verification unit, and the generated MPT root value is stored in the block header, and a certificate query path is set. The certificate query module can quickly call the verification certificate through the certificate query path to complete the verification of the validity of the certificate, reducing the storage space requirement and query time. In this way, the authentication speed of the IoT access authentication system can be further improved through the above operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a schematic diagram of the system of the present invention;

[0021] Figure 2 It is a schematic diagram of the information integration unit of the present invention;

[0022] Figure 3 This is a schematic diagram of an authentication information monitoring unit of the present invention;

[0023] Figure 4 This is a schematic diagram of an encryption communication unit of the present invention;

[0024] Figure 5 This is a schematic diagram of the dynamic firewall of the present invention;

[0025] Figure 6 A schematic diagram of a node selection unit of the present invention;

[0026] Figure 7 This is a schematic diagram of the pre-signature unit of the present invention;

[0027] Figure 8 Schematic diagram of the certificate verification unit of the present invention.

[0028] In the figure: 1. Key distribution center; 2. IoT device a; 3. IoT device b; 4. Information integration unit; 41. Information combination module; 42. Information encapsulation module; 5. Bidirectional authentication platform; 6. Authentication information monitoring unit; 61. Authentication information storage module; 62. Authentication information analysis module; 7. Encrypted communication unit; 71. Data encryption module; 72. Identity authentication module; 73. Access control module; 8. Dynamic firewall; 81. AI intelligent monitoring module; 82. Dangerous information collection module; 83. Dynamic tunnel establishment module; 84. API protection module; 9. Node selection unit; 91. Node detection unit; 92. Node analysis module; 10. Pre-signature unit; 101. Signature data generation module; 102. Signature call module; 11. Certificate verification unit; 111. Certificate storage module; 112. Certificate query path; 113. Certificate query module. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] See also Figure 1-Figure 5 The present invention provides a technical solution: an Internet of Things access authentication system capable of bidirectional authentication, comprising a key distribution center 1 and an authentication information monitoring unit 6, wherein a group of output terminals of the key distribution center 1 is wirelessly connected to an Internet of Things device a2, and another group of output terminals of the key distribution center 1 is wirelessly connected to an Internet of Things device b3,

[0031] The output ends of the IoT device a2 and the IoT device b3 are both wirelessly connected to the input end of the information integration unit 4. The output port of the information integration unit 4 sends the integrated information to the two-way authentication platform 5. The output port of the two-way authentication platform 5 inputs the authenticated information into the authentication information monitoring unit 6 for monitoring. The IoT device a2 and the IoT device b3 are wirelessly connected to each other. The IoT device a2 and the IoT device b3 perform authentication information encryption and information transmission protection through the encryption communication unit 7 and the dynamic firewall 8 respectively. The information integration unit 4 includes an information combination module 41 and an information encapsulation module 42. The output end of the information combination module 41 sends the combined information to the information encapsulation module 42, and the information encapsulation module 42 is used to process the information.

[0032] The authentication information monitoring unit 6 includes an authentication information storage module 61 for backing up identity information and an authentication information analysis module 62 for comparing verification information; the output end of the authentication information storage module 61 is wirelessly connected to the input end of the authentication information analysis module 62, and the authentication information storage module 61 can send verification information to the authentication information analysis module 62; the encryption communication unit 7 includes a data encryption module 71, an identity authentication module 72 and an access control module 73, and the dynamic firewall 8 includes an AI intelligent monitoring module 81, a dangerous information collection module 82, a dynamic tunnel establishment module 83 and an API protection module 84; the output end of the AI ​​intelligent monitoring module 81 is wirelessly connected to the dangerous information collection module 82, the output end of the dangerous information collection module 82 is wirelessly connected to the dynamic tunnel establishment module 83, and the dynamic tunnel establishment module 83 is wirelessly connected to the output port of the API protection module 84.

[0033] In specific implementation, in the bidirectionally authenticated IoT access authentication system, when IoT device a2 and IoT device b3 are connected, the key distribution center 1 will send verification information to the information integration unit 4. The information integration unit 4 can combine and package the public key, signature, and identity information to ensure that all necessary authentication steps can be completed in one transmission. The information encapsulation module 42 can design an efficient encoding mechanism to ensure the rapid transmission of large amounts of data, reduce waiting time and processing time, and thus speed up the verification process. The bidirectional authentication platform 5 can accept the verification information and input the verification information into the authentication information monitoring unit 6. The authentication information monitoring unit 6 can store the verification information through the authentication information storage module 61, and then analyze and classify the verification information through the authentication information analysis module 62 to facilitate subsequent searches. By storing these authentication records, subsequent traceability inquiries can be facilitated.

[0034] After successful verification, the IoT device a2 and the IoT device b3 will establish communication. During communication, the data encryption module 71 in the encrypted communication unit 7 can encrypt the information, and the identity authentication module 72 can perform secondary verification to improve the security of the verification. The access control module 73 can set access permissions to ensure that the data is not stolen or tampered with during transmission. The AI ​​intelligent monitoring module 81 in the dynamic firewall 8 can identify and prevent potential security threats based on real-time data and network behavior. The dangerous information collection module 82 can collect various dangerous information, and cooperate with the AI ​​intelligent monitoring module 81 to fully identify various attacks, and has extremely low omission and false alarm rates. The dynamic tunnel establishment module 83 can automatically adjust its protection strategy according to changes in the network environment, and use technologies such as MGRE and NHRP to dynamically establish tunnels to solve the problem of branch dynamic IP and adapt to dynamic address changes in large networks. After dangerous information is discovered, it is protected through the API protection module 84. In this way, the above operations can improve the verification speed of the IoT access authentication system, and after the verification is completed, the information transmission of the connected device can be protected.

[0035] See also Figure 1 , Figure 6 , Figure 7 and Figure 8 The output ends of the IoT device a2 and the IoT device b3 are both wirelessly connected to a node selection unit 9, and the node selection unit 9 includes a node detection unit 91 and a node analysis module 92; the node detection unit 91 is used to detect node information, and the output end of the node detection unit 91 can input the node information to the input end of the node analysis module 92, and the output ends of the IoT device a2 and the IoT device b3 are both wirelessly connected to a pre-signature unit 10; the pre-signature unit 10 includes a signature data generation module 101 and a signature call module 102, and the signature data generation module 101 can send the generated signature data to the signature call module 102 through the output port; the output end of the two-way authentication platform 5 is wirelessly connected to a certificate storage module 111, and the certificate storage module 111 includes a certificate storage module 111, a certificate query path 112 and a certificate query module 113; the output end of the certificate storage module 111 is wirelessly connected to a certificate query path 112, and the certificate query module 113 can query the certificate information stored in the certificate storage module 111 through the certificate query path 112.

[0036] In specific implementation, the bidirectionally authenticated IoT access authentication system can detect nodes through the node detection unit 91 in the node selection unit 9 when a new node joins the network, and analyze these nodes through the node analysis module 92 to select relatively unobstructed nodes for authentication, thereby reducing the load of fixed nodes, so that each node can participate in authentication as a reference node, reducing the pressure on a single node, and improving overall flexibility and anti-attack. The signature data generation module 101 in the pre-signature unit 10 can generate some temporary signature data before formal authentication, and store them for backup. When formally signing, the signature calling module 102 can call the pre-signature Data, combined with the current timestamp and other information, quickly generates a complete signature, greatly shortening the time for real-time signature generation. In order to speed up the certificate verification, the digital certificate of the device is stored in the leaf node of the MPT in the form of a key-value pair through the certificate storage module 111 in the certificate verification unit 11, and the generated MPT root value is stored in the block header, and a certificate query path 112 is set. The certificate query module 113 can quickly call the verification certificate through the certificate query path 112 to complete the verification of the validity of the certificate, reduce the storage space requirement and query time, and thus the authentication speed of the IoT access authentication system can be further improved through the above operations.

[0037] To summarize, the key distribution center 1 will send public keys and private keys to IoT devices a2 and b3. IoT device a2 hopes to construct a message through the RSA algorithm, sign the message with a private key, and then encrypt it with the public key of IoT device b3 and send it to IoT device b3. After receiving the message, IoT device b3 decrypts it with its own private key, and then verifies the signature with the public key of IoT device a2 to confirm the validity of the source of the message. IoT device b3 generates a random number and sends it back to IoT device a2 for secondary authentication using the same process. IoT device a2 decrypts and responds to the challenge to complete two-way authentication, establish a trust relationship, and complete two-way verification. The content not described in detail in this description belongs to the prior art known to professional and technical personnel in this field.

[0038] Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An Internet of Things access authentication system capable of bidirectional authentication, comprising a key distribution center (1) and an authentication information monitoring unit (6), wherein one group of output terminals of the key distribution center (1) is wirelessly connected to an Internet of Things device a (2), and another group of output terminals of the key distribution center (1) is wirelessly connected to an Internet of Things device b (3), characterized in that: The output ends of the Internet of Things device a (2) and the Internet of Things device b (3) are both wirelessly connected to the input end of the information integration unit (4); the output port of the information integration unit (4) sends the integrated information to the two-way authentication platform (5); the output port of the two-way authentication platform (5) inputs the authenticated information into the authentication information monitoring unit (6) for monitoring; the Internet of Things device a (2) and the Internet of Things device b (3) are wirelessly connected to each other; the Internet of Things device a (2) and the Internet of Things device b (3) perform authentication information encryption and information transmission protection through an encryption communication unit (7) and a dynamic firewall (8) respectively; the information integration unit (4) comprises an information combination module (41) and an information encapsulation module (42); the output end of the information combination module (41) sends the combined information to the information encapsulation module (42); and the information encapsulation module (42) is used to process the information.

2. According to claim 1, a two-way authentication system for Internet of Things access is characterized in that: The authentication information monitoring unit (6) comprises an authentication information storage module (61) for backing up identity information and an authentication information analysis module (62) for comparing verification information.

3. According to claim 2, a two-way authentication system for Internet of Things access is characterized in that: The output end of the authentication information storage module (61) is wirelessly connected to the input end of the authentication information analysis module (62), and the authentication information storage module (61) can send verification information to the authentication information analysis module (62).

4. The Internet of Things access authentication system capable of two-way authentication according to claim 3 is characterized in that: The encryption communication unit (7) includes a data encryption module (71), an identity authentication module (72) and an access control module (73), and the dynamic firewall (8) includes an AI intelligent monitoring module (81), a dangerous information collection module (82), a dynamic tunnel establishment module (83) and an API protection module (84).

5. According to claim 4, a two-way authentication system for Internet of Things access is characterized in that: The output end of the AI ​​intelligent monitoring module (81) is wirelessly connected to a dangerous information collection module (82), the output end of the dangerous information collection module (82) is wirelessly connected to a dynamic tunnel establishment module (83), and the dynamic tunnel establishment module (83) is wirelessly connected to an output port of an API protection module (84).

6. The Internet of Things access authentication system capable of two-way authentication according to claim 1, characterized in that: The output ends of the Internet of Things device a (2) and the Internet of Things device b (3) are both wirelessly connected to a node selection unit (9), and the node selection unit (9) includes a node detection unit (91) and a node analysis module (92).

7. The Internet of Things access authentication system capable of two-way authentication according to claim 6, characterized in that: The node detection unit (91) is used to detect node information, and the output end of the node detection unit (91) can input the node information to the input end of the node analysis module (92), and the output ends of the Internet of Things device a (2) and the Internet of Things device b (3) are both wirelessly connected to the pre-signature unit (10).

8. The Internet of Things access authentication system capable of two-way authentication according to claim 7, characterized in that: The pre-signature unit (10) comprises a signature data generation module (101) and a signature calling module (102); the signature data generation module (101) can send the generated signature data to the signature calling module (102) through an output port.

9. The Internet of Things access authentication system capable of two-way authentication according to claim 8, characterized in that: The output end of the two-way authentication platform (5) is wirelessly connected to a certificate storage module (111), and the certificate storage module (111) comprises a certificate storage module (111), a certificate query path (112) and a certificate query module (113).

10. The Internet of Things access authentication system capable of two-way authentication according to claim 9, characterized in that: The output end of the certificate storage module (111) is wirelessly connected to a certificate query path (112), and the certificate query module (113) can query the certificate information stored in the certificate storage module (111) through the certificate query path (112).

Images