Device authentication method and system, Internet of Things device and authentication server

Abstract

The present disclosure relates to a device authentication method and system, an Internet of Things device, and an authentication server. The method includes: obtaining random data; obtaining a common input parameter including the random data, generating an authentication certificate according to preset authentication parameters and the common input parameters; sending the authentication certificate to an authentication server, so that the authentication server verifies the authentication certificate according to preset verification parameters to obtain an authentication result; and obtaining the authentication result returned by the authentication server. This embodiment can utilize the authentication certificate without utilizing the key information of the device for authentication, thereby improving authentication security; and the authentication server cannot restore the key information of the device based on the above authentication certificate, thereby further avoiding leakage of the key information of the device and improving information security.

Description

Technical Field

[0001] The present disclosure relates to the field of authentication technology, and in particular to a device authentication method and system, an Internet of Things device, and an authentication server. Background Art

[0002] With the development of IoT related technologies, the number of IoT devices connected to IoT platforms has increased dramatically, and their identities have become more complex. Therefore, in related technologies, IoT devices are managed in a trusted manner. For example, the IoT platform can obtain key information (such as keys) of the device and / or user sent by the IoT device, and then authenticate the IoT device based on the key information.

[0003] However, the authentication method in the related art requires the IoT device to send its key information to the authentication server of the IoT platform. Since the IoT device and the authentication server are connected through the Internet (i.e., the public network), the above-mentioned key information may be leaked during the transmission or interaction process. Summary of the invention

[0004] The present disclosure provides a device authentication method and system, an Internet of Things device, and an authentication server to address the deficiencies of related technologies.

[0005] According to a first aspect of an embodiment of the present disclosure, a device authentication method is provided, which is applied to an Internet of Things device, and the method includes:

[0006] Get random data;

[0007] Obtaining a public input parameter including the random data, and generating an authentication certificate according to a preset certification parameter and the public input parameter;

[0008] Sending the authentication certificate to an authentication server so that the authentication server verifies the authentication certificate according to preset verification parameters to obtain an authentication result;

[0009] Obtain the authentication result returned by the authentication server.

[0010] Optionally, the obtaining of random data includes:

[0011] Generate a first random data and send the first random data to the authentication server, so that the authentication server encrypts the first random data using a preset encryption algorithm to generate encrypted data, and sends the encrypted data to the Internet of Things device;

[0012] Acquire the encrypted data and decrypt the encrypted data using a preset decryption algorithm to obtain second random data;

[0013] When the second random data is consistent with the first random data, the second random data is used as the obtained random data; otherwise, it is determined that the random data is not received.

[0014] Optionally, the acquiring of the public input parameters including the random data, and generating the authentication certificate according to the preset certification parameters and the public input parameters, comprises:

[0015] Obtain the device number and device certificate of the IoT device;

[0016] Using the device number, the device certificate and the random data as the public input parameters, and inputting the public input parameters into a preset zero-knowledge proof circuit to obtain a solution vector of the zero-knowledge proof circuit;

[0017] The solution vector and the proof parameter are input into a preset zero-knowledge proof algorithm to obtain the authentication proof output by the zero-knowledge proof algorithm.

[0018] Optionally, the method further includes a step of obtaining the preset certification parameters, specifically including:

[0019] Sending a build request including key information of the device to a build server, so that the build server generates a device certificate and a certification parameter corresponding to the device certificate according to the key information of the device; the key information of the device includes a device number, a key and a device type;

[0020] Acquire the proof parameters sent by the construction server to obtain the preset proof parameters.

[0021] According to a second aspect of an embodiment of the present disclosure, there is provided a device authentication method, which is applied to a construction server, and the method includes:

[0022] Obtain a construction request including key information of the device sent by the IoT device; the key information of the device includes a device number sn, a key sk and a device type ct;

[0023] Obtaining proof parameters of a zero-knowledge proof circuit according to the key information of the device;

[0024] The proof parameters are sent to the IoT device, so that the IoT device generates an authentication certificate for authentication according to the proof parameters, the device key information and the zero-knowledge proof circuit.

[0025] Optionally, the acquiring a proof parameter of a zero-knowledge proof circuit according to the device key information includes:

[0026] Generate a device certificate of the IoT device according to the device key information; the device certificate is represented by a first polynomial C(sn, sk, ct);

[0027] Based on a preset random data generation algorithm, obtain a second polynomial F(sn, sk, ct, r) matching the first polynomial;

[0028] The second polynomial is compiled into a zero-knowledge proof circuit, and a proof parameter of the zero-knowledge proof circuit is obtained.

[0029] Optionally, after compiling the second polynomial into a zero-knowledge proof circuit, the method further includes:

[0030] Obtaining verification parameters of the zero-knowledge proof circuit;

[0031] The verification parameters and the device certificate are sent to an authentication server, so that the authentication server authenticates the IoT device according to the verification parameters, the device certificate and the authentication certificate sent by the IoT device.

[0032] According to a third aspect of an embodiment of the present disclosure, a device authentication method is provided, which is applied to an authentication server, and the method includes:

[0033] Obtaining an authentication certificate sent by an IoT device; the authentication certificate is generated by the IoT device based on random data;

[0034] Generate a verification certificate according to preset verification parameters, the device certificate of the IoT device and the random data;

[0035] The Internet of Things device is authenticated according to the verification certificate and the authentication certificate to obtain an authentication result.

[0036] Optionally, before obtaining the authentication certificate sent by the IoT device, the method further includes:

[0037] Obtaining first random data sent by the Internet of Things device;

[0038] Encrypting the first random data using a preset encryption algorithm to generate encrypted data;

[0039] The encrypted data is sent to the IoT device so that the IoT device decrypts the encrypted data to verify whether the authentication server is legitimate.

[0040] According to a fourth aspect of an embodiment of the present disclosure, there is provided a device authentication system, the system comprising: at least one IoT device, a construction server, an authentication server, and a management server;

[0041] The management server is used to generate a key according to the registration request of the Internet of Things device to register the Internet of Things device;

[0042] The construction server is used to generate proof parameters and verification parameters corresponding to the zero-knowledge proof circuit according to the construction request of the Internet of Things device, and send the proof parameters to the Internet of Things device and the authentication server;

[0043] The IoT device is used to generate an authentication certificate based on random data and preset authentication parameters and send the authentication certificate to the authentication server;

[0044] The authentication server is used to authenticate the Internet of Things device according to the verification certificate and the authentication certificate to obtain an authentication result.

[0045] According to a fifth aspect of an embodiment of the present disclosure, there is provided an Internet of Things device, including:

[0046] processor;

[0047] a memory for storing a computer program executable by the processor;

[0048] The processor is configured to execute the computer program in the memory to implement the above method.

[0049] According to a sixth aspect of an embodiment of the present disclosure, a server is provided, including:

[0050] processor;

[0051] a memory for storing a computer program executable by the processor;

[0052] The processor is configured to execute the computer program in the memory to implement the above method.

[0053] According to a seventh aspect of an embodiment of the present disclosure, a computer non-volatile readable storage medium is provided, and when an executable computer program in the storage medium is executed by a processor, the above-mentioned method can be implemented.

[0054] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0055] It can be seen from the above embodiments that the scheme provided by the embodiments of the present disclosure can obtain random data; obtain public input parameters including the random data, generate authentication proof according to preset authentication parameters and the public input parameters; send the authentication proof to the authentication server, so that the authentication server verifies the authentication proof according to the preset verification parameters to obtain the authentication result; obtain the authentication result returned by the authentication server. In this way, the present embodiment can use the authentication proof without using the key information of the device for authentication, thereby improving the authentication security; and the authentication server cannot restore the key information of the device according to the above authentication proof, thereby further avoiding the leakage of the key information of the device and improving information security.

[0056] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0058] Figure 1 The invention is a block diagram of a device authentication system according to an exemplary embodiment.

[0059] Figure 2 The present invention is a flowchart showing the interaction between devices in a device authentication system according to an exemplary embodiment.

[0060] Figure 3 The present invention is a flowchart of a device authentication method according to an exemplary embodiment.

[0061] Figure 4 The invention is a flowchart showing a method of obtaining certification parameters and a device certificate according to an exemplary embodiment.

[0062] Figure 5 The present invention is a flowchart of obtaining an authentication certificate according to an exemplary embodiment.

[0063] Figure 6 The figure is a flow chart of another device authentication method according to an exemplary embodiment.

[0064] Figure 7 The figure is a flowchart of another device authentication method according to an exemplary embodiment.

[0065] Figure 8 It is a block diagram of a server according to an exemplary embodiment. DETAILED DESCRIPTION

[0066] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described exemplarily below do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices consistent with some aspects of the present disclosure as detailed in the attached claims. It should be noted that the features in the following embodiments and implementations may be combined with each other without conflict.

[0067] With the development of IoT related technologies, the number of IoT devices connected to IoT platforms has increased dramatically, and their identities have become more complex. Therefore, in related technologies, IoT devices are managed in a trusted manner. For example, the IoT platform can obtain key information (such as keys) of the device and / or user sent by the IoT device, and then authenticate the IoT device based on the key information.

[0068] However, the authentication method in the related art requires the IoT device to send its key information to the authentication server of the IoT platform. Since the IoT device and the authentication server are connected through the Internet (i.e., the public network), the above-mentioned key information may be leaked during the transmission or interaction process.

[0069] To solve the above technical problems, the present disclosure provides a device authentication method and a device authentication system. Figure 1 The device authentication system may include at least one IoT device, a build server, an authentication server, and a management server. Each IoT device is connected to the build server, the authentication server, and the management server, and the build server, the authentication server, and the management server communicate with each other.

[0070] The management server is used to generate a key according to the registration request of the Internet of Things device to register the Internet of Things device; the construction server is used to generate proof parameters and verification parameters corresponding to the zero-knowledge proof circuit according to the construction request of the Internet of Things device, and send the proof parameters to the Internet of Things device and the authentication server; the Internet of Things device is used to generate an authentication certificate according to random data and preset proof parameters and send it to the authentication server; the authentication server is used to authenticate the Internet of Things device according to the verification certificate and the authentication certificate to obtain an authentication result.

[0071] Considering that the above device authentication method is implemented based on the above device authentication system, the following embodiments will describe the working process of the device authentication system according to the role of each device and server in the device authentication system during the device authentication process.

[0072] In actual applications, the construction server and the management server can be implemented using the same server, the authentication server can be a third-party server, and IoT devices can include various smart devices, such as smart watches, smart bracelets, smart glasses and other smart wearable devices, air purifiers, sweeping robots, smart lamps and other smart home appliances, and so on.

[0073] Figure 2 is a flowchart showing the interaction of various devices in a device authentication system according to an exemplary embodiment. Figure 3 is a flowchart of a device authentication method according to an exemplary embodiment. Figure 2 and Figure 3 , a device authentication method can be applied to Internet of Things devices, including steps 31 to 34.

[0074] In step 31, random data is obtained.

[0075] In this embodiment, the IoT device can obtain random data, and the random data comes from the authentication server.

[0076] When there is a need for authentication, the IoT device can send an authentication request to the authentication server, which is used to request the authentication server to authenticate the IoT device. It is understandable that in addition to the device information required for the authentication process, the authentication request in this example also includes random data (hereinafter referred to as the first random data for distinction), which is generated by the IoT device using a preset random number generation algorithm.

[0077] In this example, after receiving the above authentication request, the authentication server can obtain the first random data in the authentication request. Then, the authentication server can use a preset encryption algorithm (such as MD5, SHA1, HMAC algorithm, etc.) to encrypt the first random data to obtain encrypted data, and send the encrypted data to the IoT device. The IoT device can use a preset decoding algorithm (such as MD5, SHA1, HMAC algorithm, etc.) to decrypt the encrypted data to obtain the second random data.

[0078] It should be noted that the above encryption algorithm and decoding algorithm can appear in pairs, that is, the data encrypted by the preset encryption algorithm can be decoded by the same pair of decoding algorithms to obtain the original data, thereby ensuring the security of data transmission. The technicians can select the appropriate encryption algorithm and decryption algorithm according to the specific scenario, which is not limited here.

[0079] It should be noted that, since not all authentication servers are legitimate, not all random data decrypted by them are first random data, so they are called second random data to distinguish them from the first random data.

[0080] Afterwards, the IoT device can compare the first random data and the second random data. When the second random data is consistent with the first random data, the IoT device can determine that the above-mentioned authentication server is legal, and the second random data can be used as the obtained random data; otherwise, it can be determined that the authentication server is illegal, and the IoT device can determine that the random data has not been received.

[0081] It should be noted that the first random data and the second random data are consistent in that they are the same or match each other, wherein matching means that the second random data is generated by a certain rule (for example, a random number generation algorithm R(r) that appears later) for the first random data, and the second random data is mapped one-to-one to the first random data. For example, the random number r that appears later is regarded as the first random data and the value R(r) of the random number generation algorithm R is regarded as the second random data, and r is consistent with R(r).

[0082] In step 32, a public input parameter including the random data is obtained, and an authentication certificate is generated according to a preset certification parameter and the public input parameter.

[0083] In this embodiment, the IoT device may store preset authentication parameters, see Figure 4 , including step 41 and step 42. In step 41, the IoT device may send a build request including device key information to the build server, so that the build server generates a device certificate and a certification parameter corresponding to the device certificate according to the device key information.

[0084] Taking the example that the key device information may include the device number (sn), the device key (sk) and the device type (ct), the build server may define the polynomial C(sn, sk, ct) for generating the device certificate (cert) of the IoT device. In addition, the build server may define a random number generation algorithm R(r), whose input parameter is the random data (r). The random data r comes from the IoT device, i.e., the first random data illustrated in step 31. The build server may convert the device authentication problem into the following polynomial:

[0085] F(sn,sk,ct,r)=C(sn,sk,ct)R(r).

[0086] Then, the build server can compile the polynomial F(sn, sk, ct, r) into a circuit, namely a zero-knowledge proof circuit. Among them, the zero-knowledge proof circuit can be composed of several gates, such as addition gates and multiplication gates, each gate has several input pins and several output pins; each gate can perform an addition or multiplication operation. Then, in each proof process, the value on the connection line of each gate can be obtained, and by verifying whether the input and output values ​​of each gate satisfy the addition or multiplication equation, it can be determined that a certain object (such as an IoT device) participates in the proof process. In practical applications, the above zero-knowledge proof circuit can be a library or an executable program, which is convenient for porting to IoT devices.

[0087] Afterwards, the build server can use the device number sn, device certificate cert and random data r as public input parameters to generate the proof parameter pk and verification parameter vk of the above zero-knowledge proof circuit. Among them, the proof parameter pk can be sent to the IoT device. The verification parameter vk and the device certificate are sent to the management server, and forwarded by the management server to the authentication server.

[0088] It should be noted that the device certificate of the IoT device can be obtained from the construction server, or can be generated by the IoT device itself according to the key sk, the device number sn and the device type ct, which is not limited in this disclosure. In this disclosure, the scheme of each embodiment is described by taking the IoT device itself generating the device certificate as an example.

[0089] In step 42, the IoT device may obtain the certification parameters sent by the construction server. That is, the IoT device obtains the preset certification parameters and stores them in a designated location (such as a local memory or cache).

[0090] In this embodiment, after obtaining the certification parameters and random data, the IoT device can obtain the authentication certificate, see Figure 5 , including steps 51 to 53. In step 51, the IoT device can obtain the device number and device certificate of the IoT device. In step 52, the IoT device can input the device number, device certificate and random data into a preset zero-knowledge proof circuit to obtain a solution vector of the zero-knowledge proof circuit. The solution vector is the intermediate data of the proof process, which may include public input parameters and private input parameters. In step 53, the IoT device can input the solution vector (or the private input parameters in the solution vector) and the proof parameters into a preset zero-knowledge proof algorithm (such as a ZKP algorithm or a zk-SNARK algorithm), and obtain the output data of the preset zero-knowledge proof algorithm, and use the output data as an authentication proof. In this way, in this example, the authentication proof can be used to replace the device key information of the IoT device, so as not to cause information leakage and ensure the security of the device key equipment.

[0091] In step 33, the authentication certificate is sent to an authentication server, so that the authentication server verifies the authentication certificate according to preset verification parameters to obtain an authentication result.

[0092] In this embodiment, the IoT device can send the above-mentioned authentication certificate to the authentication server. The authentication server stores a zero-knowledge proof algorithm. At this time, the device number, device certificate, verification parameters and random data (such as the above-mentioned first random data or random data consistent with the first random data) can be input into the above-mentioned zero-knowledge proof algorithm, and the verification data output by the zero-knowledge proof algorithm can be obtained. The authentication server can then authenticate the IoT device based on the verification certificate and the authentication certificate. For example, when the verification certificate is the same as the authentication certificate, the authentication result is determined to be true, indicating that the authentication is successful; when the verification certificate is different from the authentication certificate, the authentication result is determined to be false, indicating that the authentication failed. That is, the authentication server can determine the authentication result of success or failure.

[0093] In step 34, the authentication result returned by the authentication server is obtained.

[0094] In this embodiment, the IoT device can obtain the authentication result returned by the authentication server and perform corresponding operations based on the above authentication results, such as accessing the IoT platform, communicating with the IoT platform, etc. The corresponding operations can be set according to the specific scenario, which is not limited here.

[0095] So far, the scheme provided by the embodiment of the present disclosure can obtain random data; obtain public input parameters including the random data, generate authentication proof according to preset authentication parameters and the public input parameters; send the authentication proof to the authentication server, so that the authentication server verifies the authentication proof according to the preset verification parameters to obtain the authentication result; obtain the authentication result returned by the authentication server. In this way, the present embodiment can use the authentication proof without using the key information of the device for authentication, thereby improving the authentication security; and the authentication server cannot restore the key information of the device according to the above authentication proof, further avoiding the leakage of the key information of the device and improving information security.

[0096] Figure 6 is a flowchart of a device authentication method according to an exemplary embodiment. Figure 6 , a device authentication method can be applied to build a server, including steps 61 to 63.

[0097] In step 61, a construction request including key information of a device sent by an IoT device is obtained; the key information of the device includes a device number sn, a key sk and a device type ct.

[0098] In this embodiment, the build server can communicate with the IoT device to obtain a build request sent by the IoT device, and the build request can include key device information, including device number sn, key sk, and device type ct.

[0099] In step 62, the proof parameters of the zero-knowledge proof circuit are obtained according to the key information of the device.

[0100] In this embodiment, the construction server can obtain the proof parameters of the zero-knowledge proof circuit based on the device key information. Taking the device key information including the device number (sn), the device key (sk) and the device type (ct) as an example, the construction server can define a first polynomial C(sn, sk, ct) for generating a device certificate (cert) for the IoT device. In addition, the construction server can define a random number generation algorithm R(r), whose input parameter is random data (r). Among them, the above random data r comes from the IoT device, that is, the first random data shown in step 31. The construction server can convert the device authentication problem into the following second polynomial F(sn, sk, ct, r):

[0101] F(sn,sk,ct,r)=C(sn,sk,ct)R(r).

[0102] Then, the build server can compile the second polynomial F(sn, sk, ct, r) into a circuit, namely, a zero-knowledge proof circuit. Among them, the zero-knowledge proof circuit can be composed of several gates, such as addition gates and multiplication gates, each gate has several input pins and several output pins; each gate can perform an addition or multiplication operation. Then, in each proof process, the value on the connection line of each gate can be obtained, and by verifying whether the input and output values ​​of each gate satisfy the addition or multiplication equation, it can be determined that a certain object (such as an IoT device) participates in the proof process. In practical applications, the above zero-knowledge proof circuit can be a library or an executable program, which is convenient for porting to IoT devices.

[0103] Afterwards, the construction server can use the device number sn, device certificate cert and random data r as public input parameters to generate the proof parameter pk and verification parameter vk of the above zero-knowledge proof circuit. Among them, the proof parameter pk can be sent to the IoT device. The verification parameter vk and the device certificate are sent to the authentication server, so that the authentication server authenticates the IoT device according to the verification parameter, device certificate and the authentication certificate sent by the IoT device.

[0104] In step 63, the proof parameters are sent to the IoT device, so that the IoT device generates an authentication certificate for authentication according to the proof parameters, the device key information and the zero-knowledge proof circuit.

[0105] At this point, in this embodiment, the construction server can convert the device key information (device number sn, key sk and device type ct) into a device certificate and verification parameters and send them to the authentication server, thereby preventing the authentication server from obtaining information such as the key sk, avoiding key information leakage, and improving information security.

[0106] Figure 7 is a flowchart of a device authentication method according to an exemplary embodiment. Figure 7 , a device authentication method can be applied to an authentication server, including steps 71 to 73.

[0107] In step 71, an authentication certificate sent by the IoT device is obtained; the authentication certificate is generated by the IoT device based on random data.

[0108] In this embodiment, the authentication server can communicate with the IoT device to obtain the authentication certificate sent by the IoT device. Figure 3 The contents of the illustrated embodiment will not be repeated here.

[0109] In step 72, a verification certificate is generated according to the preset verification parameters, the device certificate of the IoT device and the random data.

[0110] In this embodiment, the authentication server can generate a verification certificate based on the preset verification parameters, the device certificate of the IoT device, the device number and random data, where the device number, random data and device certificate are the common input parameters mentioned above. Figure 3 The content of step 33 in the illustrated embodiment will not be repeated here.

[0111] In step 73, the IoT device is authenticated according to the verification certificate and the authentication certificate to obtain an authentication result. For details, please refer to the content of step 33, which will not be repeated here.

[0112] At this point, in this embodiment, the authentication server only needs to obtain the device number and authentication certificate of the IoT device to authenticate it, without the need for key information such as a key, thereby avoiding information leakage and improving information security.

[0113] In an exemplary embodiment, an Internet of Things device is also provided, including:

[0114] processor;

[0115] a memory for storing a computer program executable by the processor;

[0116] The processor is configured to execute the computer program in the memory to implement the following Figure 3 The method described.

[0117] In an exemplary embodiment, a server is also provided, which may be Figure 1 Management Server, Authentication Server, or Build Server as shown in Figure 8 ,include:

[0118] Processor 81;

[0119] a memory 82 for storing a computer program executable by the processor;

[0120] The processor is configured to execute the computer program in the memory to implement the following Figure 6 and Figure 7 The method described.

[0121] In an exemplary embodiment, a computer non-transitory readable storage medium is also provided, such as a memory including an executable computer program, and the executable computer program can be executed by a processor to implement the following Figure 3 , Figure 6 and Figure 7 The method of the embodiment shown. The readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like.

[0122] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the disclosure disclosed herein. The present disclosure is intended to cover any variations, uses, or adaptations that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0123] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A device authentication method, characterized in that: Applied to an IoT device, the method comprises: Get random data; Obtain a public input parameter including the random data, and generate an authentication certificate according to the preset proof parameters and the public input parameters; the preset proof parameters are obtained by the following steps of the construction server, including: generating a device certificate of the Internet of Things device according to the device key information; the device key information is included in the construction request sent by the Internet of Things device; the device key information includes the device number sn, the key sk and the device type ct; the device certificate is represented by a first polynomial C (sn, sk, ct); based on a preset random data generation algorithm, obtain a second polynomial F (sn, sk, ct, r) matching the first polynomial, where r is random data; compile the second polynomial into a zero-knowledge proof circuit, and obtain the proof parameters of the zero-knowledge proof circuit; Sending the authentication certificate to an authentication server so that the authentication server verifies the authentication certificate according to preset verification parameters to obtain an authentication result; Obtain the authentication result returned by the authentication server.

2. The method according to claim 1, characterized in that The obtaining of random data comprises: Generate a first random data and send the first random data to the authentication server, so that the authentication server encrypts the first random data using a preset encryption algorithm to generate encrypted data, and sends the encrypted data to the Internet of Things device; Acquire the encrypted data and decrypt the encrypted data using a preset decryption algorithm to obtain second random data; When the second random data is consistent with the first random data, the second random data is used as the obtained random data; otherwise, it is determined that the random data is not received.

3. The method according to claim 1, characterized in that The obtaining of the public input parameter including the random data and generating the authentication certificate according to the preset certification parameter and the public input parameter comprises: Obtain the device number and device certificate of the IoT device; Taking the device number, the device certificate and the random data as the public input parameters, and inputting the public input parameters into the zero-knowledge proof circuit, to obtain a solution vector of the zero-knowledge proof circuit; The solution vector and the proof parameter are input into a preset zero-knowledge proof algorithm to obtain the authentication proof output by the zero-knowledge proof algorithm.

4. The method according to any one of claims 1 to 3, characterized in that: The method further includes a step of obtaining the preset certification parameters, specifically including: Sending a build request including key information of the device to a build server, so that the build server generates a device certificate and a certification parameter corresponding to the device certificate according to the key information of the device; the key information of the device includes a device number, a key and a device type; Acquire the proof parameters sent by the construction server to obtain the preset proof parameters.

5. A device authentication method, characterized in that: Applied to building a server, the method comprises: Obtain a construction request including key information of the device sent by the IoT device; the key information of the device includes a device number sn, a key sk and a device type ct; Obtaining proof parameters of a zero-knowledge proof circuit according to the key information of the device; Sending the proof parameter to the IoT device so that the IoT device generates an authentication certificate for authentication according to the proof parameter, the device key information and the zero-knowledge proof circuit; The step of obtaining the proof parameter of the zero-knowledge proof circuit according to the key information of the device includes: Generate a device certificate for the IoT device according to the device key information; the device certificate is represented by a first polynomial C(sn, sk, ct); Based on a preset random data generation algorithm, a second polynomial F(sn, sk, ct, r) matching the first polynomial is obtained; r is random data; The second polynomial is compiled into a zero-knowledge proof circuit, and a proof parameter of the zero-knowledge proof circuit is obtained.

6. The method according to claim 5, characterized in that After compiling the second polynomial into a zero-knowledge proof circuit, the method further includes: Obtaining verification parameters of the zero-knowledge proof circuit; The verification parameters and the device certificate are sent to an authentication server, so that the authentication server authenticates the IoT device according to the verification parameters, the device certificate and the authentication certificate sent by the IoT device.

7. A device authentication method, characterized in that: Applied to an authentication server, the method comprises: Obtaining an authentication certificate sent by an IoT device; the authentication certificate is generated by the IoT device based on random data; Generate a verification certificate according to preset verification parameters, the device certificate of the Internet of Things device and the random data; the verification parameters and the proof parameters are generated by a construction server, and the proof parameters are obtained by the construction server using the following steps, including: generating a device certificate of the Internet of Things device according to device key information; the device key information is included in a construction request sent by the Internet of Things device; the device key information includes a device number sn, a key sk and a device type ct; the device certificate is represented by a first polynomial C (sn, sk, ct); based on a preset random data generation algorithm, obtain a second polynomial F (sn, sk, ct, r) matching the first polynomial, where r is random data; compile the second polynomial into a zero-knowledge proof circuit, and obtain the proof parameters of the zero-knowledge proof circuit; The Internet of Things device is authenticated according to the verification certificate and the authentication certificate to obtain an authentication result.

8. The method according to claim 7, characterized in that Before obtaining the authentication certificate sent by the IoT device, the method further includes: Obtaining first random data sent by the Internet of Things device; Encrypting the first random data using a preset encryption algorithm to generate encrypted data; The encrypted data is sent to the IoT device so that the IoT device decrypts the encrypted data to verify whether the authentication server is legitimate.

9. A device authentication system, characterized in that: The system includes: at least one IoT device, a build server, an authentication server, and a management server; The management server is used to generate a key according to the registration request of the Internet of Things device to register the Internet of Things device; The construction server is used to generate proof parameters and verification parameters corresponding to the zero-knowledge proof circuit according to the construction request of the Internet of Things device, and send the proof parameters to the Internet of Things device and the authentication server; the proof parameters are obtained by the construction server in the following steps, including: generating a device certificate of the Internet of Things device according to device key information; the device key information is included in the construction request sent by the Internet of Things device; the device key information includes a device number sn, a key sk and a device type ct; the device certificate is represented by a first polynomial C (sn, sk, ct); based on a preset random data generation algorithm, a second polynomial F (sn, sk, ct, r) matching the first polynomial is obtained, where r is random data; the second polynomial is compiled into a zero-knowledge proof circuit, and the proof parameters of the zero-knowledge proof circuit are obtained; The IoT device is used to generate an authentication certificate based on random data and preset authentication parameters and send the authentication certificate to the authentication server; The authentication server is used to authenticate the IoT device according to the verification certificate and the authentication certificate to obtain an authentication result.

10. An Internet of Things device, characterized in that: include: processor; a memory for storing a computer program executable by the processor; The processor is configured to execute the computer program in the memory to implement the method according to any one of claims 1 to 4.

11. A server, characterized in that: include: processor; a memory for storing a computer program executable by the processor; The processor is configured to execute the computer program in the memory to implement the method according to any one of claims 5 to 8.

12. A computer non-transitory readable storage medium, characterized in that: When the executable computer program in the storage medium is executed by a processor, the method according to any one of claims 1 to 8 can be implemented.

Images