A cross-domain access authentication method for industrial complex product terminals based on identity identification

Abstract

The present invention relates to a cross-domain access authentication method for industrial complex product terminals based on identity identification, which belongs to the field of information security. It is divided into two stages. In stage one, the industrial complex product terminal is registered in the security domain, but has not been accessed and authenticated, and then moves to the external domain for cross-domain access request authentication; in stage two, the industrial complex product terminal is registered in the security domain and passes the access authentication, and then moves to the external domain for cross-domain access request authentication. This method avoids the need for industrial complex product terminals to re-register when accessing and authenticating in different security domains, greatly saves resource consumption and time during inter-domain access authentication of industrial complex product terminals, improves access authentication efficiency, and makes industrial complex product access authentication more convenient, efficient, and fast; compared with other cross-domain authentication schemes, the cross-domain access authentication of industrial complex product terminals proposed by the present invention under the industrial Internet platform system is more secure and efficient.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to an IBC identity-based cross-domain access authentication technology for industrial complex product terminals. Background Art

[0002] With the development of science and technology, the global industry has ushered in a profound transformation with digitalization, networking and intelligence as the development direction. Intelligent manufacturing, which is characterized by the deep integration of new generation information technology and advanced manufacturing technology, has become the core driving force of this new industrial revolution. As an important hub connecting enterprises, users, products, raw materials, etc., the industrial Internet cloud platform, with a huge number of terminal devices connected to the network system, in order to ensure the safe and efficient operation of the system, the first thing to face is the risk of malicious terminal device intrusion.

[0003] Industrial complex product terminals are characterized by large numbers and wide distribution. With the introduction of the concept of flexible production, new and old production lines are constantly combined, and there are mobility problems in the access authentication of complex products, which is particularly prominent in the discrete industry. Complex products are of various types, with large structural differences, and network access / revocation is random. All of these characteristics increase the difficulty of trusted access to complex products. In order to reduce the security risks of the system, a reasonable identity authentication mechanism becomes the technical basis for ensuring the secure access of industrial complex product terminal equipment. However, due to the large number and strong mobility of industrial terminals and the high efficiency and flexibility required for industrial equipment authentication, traditional authentication schemes are not applicable. To this end, an efficient and secure access authentication scheme is proposed to achieve trusted access to industrial complex product terminals, while solving the cross-domain access authentication problem caused by the rapid movement of terminals. Summary of the invention

[0004] Technical issues to be solved

[0005] The access authentication of terminal equipment of industrial complex products adopts identification password technology. When the terminal moves from one edge device to another, since the two edge devices belong to different security domains PKG, in the identity authentication system based on identification, the difference in PKG master key and some parameters will lead to the inability to securely interact with the terminal in the domain and the edge device in the external domain for authentication information; secondly, two edge devices belonging to different security domains cannot authenticate each other through identification password technology. When the terminal of industrial complex products moves due to application requirements, in order to ensure the continuity and stability of the service, corresponding cross-domain authentication needs to be considered.

[0006] In order to solve the cross-domain authentication problem caused by the movement of industrial complex product terminal equipment between different security domains, the present invention proposes an industrial complex product terminal cross-domain access authentication method based on identity identification.

[0007] Technical Solution

[0008] An industrial complex product terminal cross-domain access authentication method based on identity identification, characterized by comprising two stages:

[0009] Phase 1: The first cross-domain access authentication of a terminal of a complex industrial product after it is registered in a security domain

[0010] Step 1: Send a cross-domain access request after the terminal moves

[0011] The terminal of industrial complex products is registered in the PKG1 security domain to obtain the identification ID, private key and public parameters of the security domain; the terminal ID T If the access authentication is not completed in the PKG1 security domain, quickly move to the edge node ID in the PKG1 security domain E2 , and send ID E2 Send an access authentication request message to start cross-domain access authentication; the request message includes the terminal's own identity, the domain central authentication server identity, the random number and the signature result of the timestamp m T and s its hash operation result c T ;

[0012] ID T →ID E2 :Req||(ID T ||ID E2 ||c T ||m T ) Formula (1.1)

[0013] c T =h2(r T ||t T ) Formula (1.2)

[0014] m T =(r T ||t T )sk T Formula (1.3)

[0015] Formula (1.1) means: ID T ID E2 Sending access request related messages;

[0016] Where Req||(ID T ||ID E2 ||c T ||m T ) represents a data packet consisting of an access request, a terminal device identifier, an edge device identifier requesting access, a hash calculation value, and a private key signature result;

[0017] Where ID TIndicates the terminal device identification, ID E2 Indicates the edge device identifier requesting access;

[0018] Formula (1.2) means: The random number r is obtained through the hash function h2 T The hash calculation result of the sum c T ;

[0019] Where h2 represents the hash function, r T represents a random number, t T Indicates a timestamp;

[0020] Formula (1.3) means: Generate a random number and timestamp signature using the terminal's private key;

[0021] Where m T Represents a random number r T and timestamp t T The signature result, sk T Indicates the private key of the terminal;

[0022] Step 2: Edge Node ID E2 Request the terminal registration domain to verify the terminal identity

[0023] Edge Device ID E2 After receiving the cross-domain access authentication request from the terminal device of the industrial complex product, check the terminal device that does not belong to this domain. Since it does not belong to the same security domain, it cannot be decrypted to obtain m T 、c T ; Edge node ID E2 Check whether there is a central authentication server ID in the authentication list G1 If not, then first perform ID E2 and ID G1 The CAs between the two parties perform mutual authentication and negotiate the session key Key G1-E1 If the authentication is successful, the authentication request will be forwarded to the central authentication server ID G1 Processing, otherwise the authentication fails;

[0024] ID E2 →ID G1 :(ID T ||ID E2 ||c T ||m T )Pub G1 Formula (1.4)

[0025] Formula (1.4) meaning: Edge device ID E2 Authenticate the server ID to the center G1 Send by ID G1 Public key encrypted data packets;

[0026] Where ID T Indicates the terminal equipment identification of industrial complex products, ID G1 Indicates the central authentication server of the terminal PKG1 domain, Pub G1 Indicates the central authentication server ID G1 CA public key;

[0027] Step 3: Register the domain center authentication server ID G1 Verify terminal identity

[0028] Central authentication server ID of the PKG1 domain G1 Receive ID E2 Forwarded terminal cross-domain request, due to ID E If the authentication is confirmed to be credible, only the ID G1 Terminal ID T One-way authentication; that is, calculating the terminal ID T The public key is decrypted to obtain the random number and timestamp. First, verify the timestamp t T The validity of the timestamp is determined by the h2 hash function. T Compare, if they are not equal, discard the message; if they are equal, use the bilinear pairing property to verify whether the equality holds:

[0029] Q T =h1(ID T ) Formula (1.5)

[0030]

[0031] e(m T ,-(r T +t T )P)=e(Q T ,P pub )Formula (1.7)

[0032] Formula (1.5) means: The public key Q of the terminal is calculated by function h1 T ;

[0033] Formula (1.6) means: Using ID T The public key of the identity decrypts m T Get a random number and timestamp;

[0034] Where m T Represents a random number r T and timestamp t T The signature result, Q T Indicates the public key of the terminal;

[0035] Formula (1.7) meaning: Central authentication server IDG1 Use bilinear equivalence to verify the legitimacy of the public and private keys of the terminal, that is, the legitimacy of the identity of the terminal;

[0036] Where P is a generator of any one of the additive cyclic groups, P pub is the system public key of the security domain;

[0037] Step 4: ID G1 With ID E2 Negotiate terminal session key

[0038] If the equation does not hold, it means that ID G1 ID T If the authentication fails, the terminal device of the industrial complex product is considered to be illegal, and a Failure frame is returned to the external domain ID. E1 , reject ID T Connect and disconnect; otherwise, indicate ID G2 ID T Authentication successful; in ID G1 With ID E2 Jointly negotiate the terminal session key K key , K key Sent to ID together with the Success message E2 ;

[0039] ID G1 →ID E2 :(Success||ID T ||ID E2 ||K key ||Q T (ID E2 ||K key ||Success))Key E-G1 Formula (1.8)

[0040] Formula (1.8) means: ID G1 ID E2 Send the terminal identity authentication result and the terminal session key;

[0041] Success means the authentication is successful, K key Indicates the terminal ID T With edge device ID E2 The session key, Key E-G1 Indicates the edge device ID E2 and central authentication server ID G1 The temporary session key of

[0042] Step 5: ID E2 Send the authenticated message and its terminal session key to the terminal

[0043] Edge node ID E2 After receiving the authentication success message, decrypt it to get the session key with the industrial complex product terminal, and send the cross-domain authentication success message to the terminal ID T ;

[0044] ID E2 →ID T :(Success||ID T )K key ||(ID E2 ||K key ||Success)Q T Formula (1.9)

[0045] Formula (1.9) means: ID E2 ID T Send the authentication message and its terminal session key;

[0046] Success means the authentication is successful, K key Indicates the terminal ID T With edge device ID E2 The session key;

[0047] Step 6: The terminal responds to the edge node with the new session key

[0048] Industrial complex product terminal ID T Received in ID E2 The message is decrypted with the private key to obtain the session key K key The terminal ID with which the session is communicating E2 , using K key The decrypted message from the edge device indirectly proves the authenticity of the edge device. Finally, the terminal ID T Reply to edge node ID with new session key encrypted message E2 , cross-domain access authentication is successful;

[0049]

[0050]

[0051] Formula (1.10) means: Use the private key to decrypt the message to obtain the authentication success message and session key;

[0052] Formula (1.11) means: Use the session key to decrypt the message to verify the consistency of the message;

[0053] In summary, ID T Completed cross-domain access authentication of edge devices in different security domains, successfully accessed the external domain edge device IDE2 and established a new session key with it;

[0054] Phase 2: Industrial complex product terminals are registered in the security domain and cross-domain authentication after passing authentication

[0055] Case 1: When the terminal crosses domains, it carries the information signature of the edge device of the registered domain. The edge device of the foreign domain first verifies the authenticity of the information, and then forwards it to the edge device of the registered domain for further verification to prevent replay attacks. The specific implementation steps are as follows:

[0056] Step 1: Terminal registration and edge node access authentication

[0057] Terminal ID T Register in the PKG1 security domain and complete the registration domain edge node ID E1 Access authentication, and obtain ID E1 The CA-signed authentication information Mes contains the terminal ID, the authenticated edge device ID, and access completion information.

[0058] Step 2: The terminal sends a cross-domain access request after moving across domains

[0059] When discovery moves to a new edge device ID E2 If the device is not in the same security domain as itself, it will send a cross-domain authentication request to the edge device, including its own identity ID. T , the original ID of the edge device E1 And the signature information Mes of the access authentication completed by the original edge device; encrypt the request information with the original session key and send it to the edge device ID E2 ;

[0060] C T =K old (ID T ||ID E1 ||Mes||t T ||r T ) Formula (2.1)

[0061] ID T →ID E2 :Req||ID T ||C T ||ID E1 ||Mes||r T ||t T Formula (2.2)

[0062] Formula (2.1) means: Use the old session key to encrypt related data;

[0063] Where ID T Indicates the terminal device identification, IDE1 Indicates the edge device identity that has passed the authentication, Mes indicates the signature information authenticated by the original edge device, r T represents a random number, t T Indicates a timestamp;

[0064] Formula (2.2) means: ID T ID E2 Send a data packet for a cross-domain access request;

[0065] Among them C T Indicates that the terminal has passed the ID E1 Authentication proof information, Req represents access request;

[0066] Step 3: The edge device verifies the terminal identity for the first time

[0067] Edge Device ID E2 After receiving the cross-domain access authentication request from the terminal device, first query the CA center to obtain the ID E1 Decrypt the certificate to get the ID T 、ID E1 And the terminal is authenticated. Compare and decrypt to get ID T and the ID in the request T If they are consistent, authentication fails; if they are consistent, information is sent to the edge node ID. E2 Request verification of the terminal's identity;

[0068]

[0069] Formula (2.3) means: Decrypt Mes to obtain the terminal and authenticated edge device information;

[0070] Among them, Succeed means that the terminal has passed the edge device ID E1 Certification;

[0071] Step 4: Edge node IDE2 requests the terminal to register with the domain edge node IDE1 to verify the terminal identity

[0072] Edge node ID E2 Determine whether there is an edge node ID in the authentication list E1 If not, then first perform CA bidirectional authentication between edge nodes and negotiate the session key Key E1-E2 ; If the authentication is passed, the C in the terminal's cross-domain request will be T Send to ID E1 Request verification of the terminal's identity;

[0073] ID E2 →ID E1 :(C T ||IDT )Key E1-E2 Formula (2.4)

[0074] Formula (2.4) means: ID E2 ID E1 Sending terminal request information to verify authenticity;

[0075] Among them C T Indicates that the terminal has passed the ID E1 Certification information;

[0076] Step 5: IDE1 verifies the terminal identity and returns the result to IDE2

[0077] ID E1 Received from ID E2 The request information is verified and the result is sent to ID E2 ;

[0078]

[0079] ID E1 →ID E2 :(true||ID T )Key E1-E2 Formula (2.6)

[0080] Formula (2.5) means: ID E1 Decryption C T Get authentication information from edge devices;

[0081] Formula (2.6) means: ID E1 ID E2 Send the authenticity result of the terminal passing the authentication;

[0082] Among them, true means that the information of the terminal is true, Key E1-E2 Representation ID E1 and ID E2 The session key;

[0083] Step 6: IDE1 and IDE2 negotiate a new terminal session key

[0084] Edge node ID E2 Received the decrypted information, verified the cross-domain authentication of the terminal, and E1 Negotiate and obtain the new session key K of the terminal key ; Use the original session key of the terminal to encrypt the new session key, build a response data packet, encrypt it with the temporary session key and send it to the ID E2 ;

[0085] ID E1→ID E2 :(ID T ||K old (K key ||success||ID E2 ))Key E1-E2 Formula (2.7)

[0086] Formula (2.7) means: ID E1 ID E2 Send the authentication success message and the new terminal session key;

[0087] Where K old Indicates the old terminal session key, K key Represents the new terminal session key, K old (K key ||success||ID E2 ) indicates that the new session key is encrypted with the old session key of the terminal;

[0088] Step 7: IDE2 sends the authentication success message and its new terminal session key to the terminal

[0089] Edge node ID E2 After receiving the message that the terminal identity authentication is passed and verifying the access authentication status of the terminal, the authentication result and the new session key are sent to the terminal of the cross-domain request;

[0090] ID E2 →ID T :K old (K key ||success||ID E2 )||K key (Success) formula (2.8)

[0091] Formula (2.8) means: ID E2 ID T Send the authentication success message and the new terminal session key;

[0092] Step 8: The terminal responds to the edge node with the new session key

[0093] Terminal ID T Received in ID E2 The message is decrypted with the private key to obtain the session key K key and the ID of the edge device accessed across domains E2 , using K key Decrypt the message from the edge device; finally, the terminal ID T Reply to edge node ID with new session key encrypted message E2, cross-domain access authentication is successful;

[0094]

[0095] Formula (2.9) means: Terminal decryption comes from ID E2 The information obtained is the result of successful access and the new session key;

[0096] In summary, ID T Completed cross-domain access authentication of edge devices in different security domains, and successfully accessed the external domain edge device ID E2 and established a new session key with it;

[0097] In this process, IoT terminal devices do not need complex calculations and communications, and authentication and key negotiation are completed between edge devices, effectively reducing the calculation and communication overhead of terminal devices;

[0098] Case 2: When the terminal of a complex industrial product crosses domains, it carries the domain trusted token issued by the edge device. The edge device in the external domain receives the cross-domain request information of the terminal and sends it to the central authentication server of the domain first. The central authentication server then sends it to the central authentication server of the terminal registration domain to verify the domain trusted token. The specific implementation steps are as follows:

[0099] Step 1: Terminal registration and edge node access authentication

[0100] The terminal is registered in the PKG1 security domain, obtains the identification ID, private key and public parameters of the security domain, and passes the edge node ID E1 Access authentication and obtain the domain trusted token issued by the edge node;

[0101] Step 2: Move the terminal to ID E2 Then send a cross-domain access request

[0102] The terminal quickly moves to the edge node ID in the PKG2 security domain E2 Nearby, terminal device connected to ID E2 , and send an access authentication request message, which includes the terminal ID, ID E1 After successful authentication, the edge node issues a trusted token to start cross-domain access authentication;

[0103] m T =(ID E2 ||ID T ||t T ||r T )sk T Formula (3.1)

[0104] ID T →ID E2:Req||(ID T ||Token||t T ||r T )||m T Formula (3.2)

[0105] Formula (3.1) Meaning: Sign the terminal and edge device identification, timestamp and random number;

[0106] Where ID T Indicates the terminal device identification, ID E2 Indicates the edge device identifier for requesting cross-domain access, r T represents a random number, t T Indicates a timestamp;

[0107] Formula (3.2) means: ID T ID E2 Send cross-domain access request data;

[0108] Req represents a cross-domain access request, and Token represents a domain trusted token issued by an authenticated edge node.

[0109] Step 3: ID E2 Forward the terminal authentication request to the central authentication server in this domain

[0110] Edge Device ID E2 After receiving the cross-domain access authentication request from the terminal device, it is found that the terminal device is not in this domain, and its terminal cross-domain information and trusted token are forwarded to the central authentication server ID of this domain. G2 ;

[0111] ID E2 →ID G2 :((ID T ||Token||t E2 ||r E2 )||m T )Pub G2 Formula (3.3)

[0112] Formula (3.3) means: ID E2 ID G2 Send terminal cross-domain information and domain trusted token to request verification;

[0113] where t E2 Representation ID E2 The timestamp, r E2 Representation ID E2 Random numbers, Pub G2 Indicates the central authentication server ID G2 CA public key;

[0114] Step 4: The central authentication server sends an identity verification request to the terminal registration domain

[0115] The central authentication server of this domain receives the ID from the edge device of the external domain E2 The message is decrypted to obtain the terminal's identity, the trusted token, and the signature of the terminal's identity. According to the security domain information on the trusted token, the central authentication server ID of the domain where the terminal is located is obtained. G1 , ID G1 Check whether there is a central authentication server ID in the authentication list G2 If there is one, proceed directly to the next step. If there is no one in the list, then ID G1 and ID G2 First perform CA two-way identity authentication; ID G1 and ID G2 After the devices become mutually trusted, ID G2 Send the authentication request with ID G2 The CA public key is encrypted and then forwarded to the central authentication server ID of PKG1. G1 Requesting verification of the authenticity of the terminal's trusted token;

[0116] ID G2 →ID G1 :((ID T ||Token||ID E2 ||t G2 ||r G2 ||m T )SK G1 )Pub G1 Formula (3.4)

[0117] Formula (3.4) means: ID G2 ID G1 Send terminal cross-domain information and domain trusted token to request verification;

[0118] where t G2 Representation ID G2 The timestamp, r G2 Representation ID G2 The random number, SK G2 Representation ID G2 CA private key, Pub G1 Indicates the central authentication server ID G1 CA public key;

[0119] Step 5: PKG1's central authentication server verifies the domain trusted token Token

[0120] The central authentication server in domain PKG1 receives the request and decrypts it to obtain the terminal's ID. T, through the terminal's ID T Calculate its public key and decrypt the identity signature information m T , verify the identity of the terminal and the authenticity of the token held by the terminal. If the trusted token of the terminal is authentic, then the ID G1 With ID G2 Jointly negotiate the terminal session key K key , then K key The central authentication server ID sent to the PKG2 domain together with the verification result G2 ;

[0121] s T =(Success||K key ||ID E2 )Q T Formula (3.5)

[0122] ID G1 →ID G2 :((Success||K key ||s T )SK G1 )Pub G2 Formula (3.6)

[0123] Formula (3.5) means: The new session key related data is encrypted by the terminal's public key;

[0124] Success means the terminal identity has passed the verification. E2 Indicates that the identity of the edge device accessed across domains is credible. T Indicates the public key of the terminal;

[0125] Formula (3.6) means: ID G1 ID G2 Sending the result information of the terminal identity verification;

[0126] Where K key Represents a new terminal session key;

[0127] Step 6: The central authentication server of the PKG2 domain returns the ID E1 Verify the results

[0128] After receiving the verification result, the central authentication server of the PKG2 domain decrypts it and forwards the result to the edge node ID E2 ;

[0129] ID G2 →ID E1 :((Success||K key ||s T )SK G2 )PubE1 Formula (3.7)

[0130] Formula (3.7) means: ID G1 ID E1 Send the trusted result of the terminal identity verification and the new terminal session key;

[0131] Among them, SK G2 Representation ID G2 CA private key, Pub E2 Indicates the edge node ID E2 CA public key;

[0132] Step 7: ID E2 Send the authentication message and its new terminal session key to the terminal

[0133] ID E2 After receiving the decrypted message, it is found that the terminal's cross-domain request information is true. Then the terminal's cross-domain authentication request is approved and the terminal is notified that the authentication is successful.

[0134] ID E2 →ID T :(ID E2 ||Success)K key ||s T Formula (3.8)

[0135] Formula (3.8) means: ID E2 Terminal ID T Send the authentication success message and its new terminal session key to the terminal.

[0136] where s T Indicates that the new session key related data is encrypted by the public key of the terminal;

[0137] Step 8: The terminal responds to the edge node ID with a new session key E2

[0138] Terminal ID T Received from ID E2 The message is decrypted with the private key to obtain the session key K key , using K key Decrypt the message from the edge device, that is, the object ID through authentication and session key E2 ; Terminal ID T Send confirmation message to edge device, edge node ID E2 After receiving the message, the terminal passes the cross-domain authentication;

[0139]

[0140]

[0141] Formula (3.9) means: The terminal uses the private key to decrypt s T Get the new session key K key and the edge devices that are talking to it;

[0142] Formula (3.10) means: The terminal uses the session key to decrypt and obtain the result passed by the edge device for cross-domain access;

[0143] Where K key Indicates the terminal ID T and edge device ID E2 The session key;

[0144] In summary, ID T Completed cross-domain access authentication of edge devices in different security domains, and successfully accessed the external domain edge device ID E2 And established a new session key with it.

[0145] A computer system, characterized in that it comprises: one or more processors, and a computer-readable storage medium for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned method.

[0146] A computer-readable storage medium, characterized in that it stores computer-executable instructions, which are used to implement the above method when executed.

[0147] A computer program, characterized by comprising computer executable instructions, which are used to implement the above method when executed.

[0148] Beneficial Effects

[0149] The present invention proposes a cross-domain access authentication method for industrial complex product terminals based on identity identification, which avoids the need for industrial complex product terminals to re-register when accessing and authenticating in different security domains, greatly saves resource consumption and time during inter-domain access authentication of industrial complex product terminals, improves access authentication efficiency, and makes industrial complex product access authentication more convenient, efficient, and fast; compared with other cross-domain authentication schemes, the cross-domain access authentication of industrial complex product terminals proposed by the present invention under the industrial Internet platform system is more secure and efficient. Specifically, it is manifested in:

[0150] (1) Each edge device uses secure communication technology with an identification password system for industrial complex product terminals in the same domain to ensure the security of access authentication information communication;

[0151] (2) In view of the large number and mobility of terminal devices of complex industrial products, a security domain center authentication server is deployed to process terminal information verification requests between different domains, omitting the two-way authentication step between edge devices in cross-domain authentication, reducing the authentication time and improving the efficiency and security of cross-domain authentication;

[0152] (3) After the industrial complex product terminal is registered in the security domain and passes the authentication, the cross-domain authentication technology improves different solutions for different application scenarios, which is more targeted and makes the cross-domain access authentication efficiency of complex product terminal devices more efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0153] The drawings are only for the purpose of illustrating particular embodiments and are not to be considered limiting of the present invention. Like reference symbols denote like components throughout the drawings.

[0154] Figure 1 Schematic diagram of cross-domain access authentication for industrial complex product terminals;

[0155] Figure 2 First terminal cross-domain model;

[0156] Figure 3 Second terminal cross-domain model;

[0157] Figure 4 Third terminal cross-domain model. DETAILED DESCRIPTION

[0158] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0159] The present invention is described and implemented in two stages according to the specific conditions of registration and authentication before and after the terminal moves across domains:

[0160] Phase 1: The terminal of industrial complex products is registered in the security domain, but is not authenticated, and then moves to the external domain for cross-domain access authentication.

[0161] Phase 2: The terminal of industrial complex products is registered in the security domain and passes the access authentication, and then moves to the external domain for cross-domain request access authentication.

[0162] In stage one, the terminal of the industrial complex product is registered in the security domain but not connected, so the terminal cannot obtain a feasible connection with the edge device in the registration domain. When it moves to the external domain, it sends a cross-domain request. The external domain edge node forwards its request information to the central authentication server of the terminal registration domain to request verification of the terminal identity. After the central authentication server calculates its public key, it decrypts the information signed by the terminal private key and verifies the terminal's registration identity in the security domain through a bilinear pairing mapping relationship, and then informs the external domain edge node of the verification result. The edge node itself does not verify the terminal identity.

[0163] In the second stage, the terminal of the industrial complex product is registered in the security domain and authenticated by the edge device of the domain. When it moves to the external domain, it sends a cross-domain request. After receiving the cross-domain request of the terminal, the edge node of the external domain verifies the identity of the terminal. Here, the present invention is described in two cases. Case 1: When the terminal crosses the domain, it carries the signature of the information authenticated by the edge device of the registration domain. The edge device of the external domain first verifies the authenticity of the information, and then forwards it to the edge device of the registration domain for further verification to prevent replay attacks. That is, this scheme is mainly the information interaction between edge devices in two security domains. Case 2: When the terminal of the industrial complex product crosses the domain, it carries the domain trusted token issued by the edge device. The edge device of the external domain receives the cross-domain request information of the terminal, first sends it to the central authentication server of the domain, and then the central authentication server sends it to the central authentication server of the terminal registration domain to verify the domain trusted token. This avoids mutual authentication between edge devices that are different from the security domain. When the terminal crosses the domain, the information interaction between domains is handed over to the central authentication server of each security domain. The edge device only needs to wait for the verification result from the central authentication server.

[0164] The symbols and their meanings used in the cross-domain access authentication technology for industrial complex product terminals based on identity identification are shown in Table 1.

[0165] Table 1 Meaning of symbols in terminal access certification for industrial complex products

[0166]

[0167]

[0168] Phase 1: The first cross-domain access authentication of a terminal of a complex industrial product after it is registered in a security domain

[0169] After the industrial complex product terminal IDT completes registration in a security domain (PKG1), it moves to another security domain (PKG2) due to production or business needs to implement the first cross-domain access authentication. The working principle diagram is as follows Figure 2 shown.

[0170] The specific steps for the first cross-domain access authentication after the industrial complex product terminal security domain is registered are as follows.

[0171] Step 1: Send a cross-domain access request after the terminal moves

[0172] The industrial complex product terminal is registered in the PKG1 security domain to obtain the identification ID, private key and public parameters of the security domain. T If the access authentication is not completed in the PKG1 security domain, quickly move to the edge node ID in the PKG1 security domain E2 , and send ID E2 Send an access authentication request message to start cross-domain access authentication; the request message includes the terminal's own identity, the domain central authentication server identity, the random number and the signature result of the timestamp m T and s its hash result c T ;

[0173] ID T →ID E2 :Req||(ID T ||ID E2 ||c T ||m T ) Formula (1.1)

[0174] c T =h2(r T ||t T ) Formula (1.2)

[0175] m T =(r T ||t T )sk T Formula (1.3)

[0176] Formula (1.1) means: ID T ID E2 Send a message requesting access.

[0177] Where Req||(ID T ||ID E2 ||c T ||m T ) represents a data packet consisting of an access request, a terminal device identifier, an edge device identifier requesting access, a hash calculation value, and a private key signature result.

[0178] Where ID T Indicates the terminal device identification, ID E2 Indicates the ID of the edge device requesting access.

[0179] Formula (1.2) means: The random number r is obtained through the hash function h2 T The hash calculation result of the sum c T .

[0180] Where h2 represents the hash function, r T represents a random number, t T Indicates a timestamp.

[0181] Formula (1.3) means: Generate a random number and timestamp signature using the private key of the terminal.

[0182] Where m T Represents a random number r T and timestamp t T The signature result, sk T Indicates the private key of the terminal.

[0183] Step 2: Edge Node ID E2 Request the terminal registration domain to verify the terminal identity

[0184] Edge Device ID E2 After receiving the cross-domain access authentication request from the terminal device of the industrial complex product, check the terminal device that does not belong to this domain. Since it does not belong to the same security domain, it cannot be decrypted to obtain m T 、c T . Edge node ID E2 Check whether there is a central authentication server ID in the authentication list G1 If not, then first perform ID E2 and ID G1 The CAs between the two parties perform mutual authentication and negotiate the session key Key G1-E1 If the authentication is successful, the authentication request will be forwarded to the central authentication server ID G1 Processing, otherwise the authentication fails;

[0185] ID E2 →ID G1 :(ID T ||ID E2 ||c T ||m T )Pub G1 Formula (1.4)

[0186] Formula (1.4) meaning: Edge device ID E2 Authenticate the server ID to the center G1 Send by ID G1 Public key encrypted data packets.

[0187] Where ID T Indicates the terminal equipment identification of industrial complex products, ID G1 Indicates the central authentication server of the terminal PKG1 domain, Pub G1 Indicates the central authentication server ID G1 The CA public key.

[0188] Step 3: Register the domain center authentication server ID G1 Verify terminal identity

[0189] Central authentication server ID of the PKG1 domain G1 Receive ID E2 Forwarded terminal cross-domain request, due to ID E If the authentication is confirmed to be credible, only the ID G1 Terminal ID T One-way authentication. That is, calculate the terminal ID T The public key is decrypted to obtain the random number and timestamp. First, verify the timestamp t T The validity of the timestamp is determined by the h2 hash function. T Compare, if they are not equal, discard the message; if they are equal, use the bilinear pairing property to verify whether the equality holds:

[0190] Q T =h1(ID T ) Formula (1.5)

[0191]

[0192] e(m T ,-(r T +t T )P)=e(Q T ,P pub ) Formula (1.7)

[0193] Formula (1.5) means: The public key Q of the terminal is calculated by function h1 T .

[0194] Formula (1.6) means: Using ID T The public key of the identity decrypts m T Get a random number and a timestamp.

[0195] Where m T Represents a random number r T and timestamp t T The signature result, Q T Indicates the public key of the endpoint.

[0196] Formula (1.7) meaning: Central authentication server ID G1 Bilinear equivalence is used to verify the legitimacy of the public and private keys of the terminal, that is, the legitimacy of the identity of the terminal.

[0197] Where P is a generator of any one of the additive cyclic groups, P pub Is the system public key of the security domain.

[0198] Step 4: ID G1 With ID E2 Negotiate terminal session key

[0199] If the equation does not hold, it means that ID G1 ID T If the authentication fails, the terminal device of the industrial complex product is considered to be illegal, and a Failure frame is returned to the external domain ID. E1 , reject ID T Connect and disconnect; otherwise, indicate ID G2 ID T Authentication successful. G1 With ID E2 Jointly negotiate the terminal session key K key , K key Sent to ID together with the Success message E2 .

[0200] ID G1 →ID E2 :(Success||ID T ||ID E2 ||K key ||Q T (ID E2 ||K key ||Success))Key E-G1 Formula (1.8)

[0201] Formula (1.8) means: ID G1 ID E2 Send the terminal authentication result and the terminal session key.

[0202] Success means the authentication is successful, K key Indicates the terminal ID T With edge device ID E2 The session key, Key E-G1 Indicates the edge device ID E2 and central authentication server ID G1 The temporary session key.

[0203] Step 5: ID E2 Send the authenticated message and its terminal session key to the terminal

[0204] Edge node ID E2 After receiving the authentication success message, decrypt it to get the session key with the industrial complex product terminal, and send the cross-domain authentication success message to the terminal ID T ;

[0205] ID E2 →IDT :(Success||ID T )K key ||(ID E2 ||K key ||Success)Q T Formula (1.9)

[0206] Formula (1.9) means: ID E2 ID T Send the authenticated message and its terminal session key.

[0207] Success means the authentication is successful, K key Indicates the terminal ID T With edge device ID E2 The session key.

[0208] Step 6: The terminal responds to the edge node with the new session key

[0209] Industrial complex product terminal ID T Received in ID E2 The message is decrypted with the private key to obtain the session key K key The terminal ID with which the session is communicating E2 , using K key The decrypted message from the edge device indirectly proves the authenticity of the edge device. T Reply to edge node ID with new session key encrypted message E2 , cross-domain access authentication is successful.

[0210]

[0211]

[0212] Formula (1.10) means: Use the private key to decrypt the message to obtain the authentication success message and session key.

[0213] Formula (1.11) means: Use the session key to decrypt the message to verify the consistency of the message.

[0214] In summary, ID T The cross-domain access authentication of edge devices in different security domains was completed, and the external domain edge device IDE2 was successfully accessed and a new session key was established with it.

[0215] Phase 2: Industrial complex product terminals are registered in the security domain and cross-domain authentication after passing authentication

[0216] Case 1: When the terminal crosses domains, it carries the information signature of the edge device in the registered domain. The edge device in the foreign domain first verifies the authenticity of the information, and then forwards it to the edge device in the registered domain for further verification to prevent replay attacks. The working principle is as follows: Figure 3 shown.

[0217] The specific implementation steps are as follows:

[0218] Step 1: Terminal registration and edge node access authentication

[0219] Terminal ID T Register in the PKG1 security domain and complete the registration domain edge node ID E1 Access authentication, and obtain ID E1 The CA-signed authentication information Mes contains the terminal ID, the authenticated edge device ID, and access completion information.

[0220] Step 2: The terminal sends a cross-domain access request after moving across domains

[0221] When discovery moves to a new edge device ID E2 If the device is not in the same security domain as itself, it will send a cross-domain authentication request to the edge device, mainly including its own identity ID T , the original ID of the edge device E1 And the signature information Mes of the access authentication completed by the original edge device; encrypt the request information with the original session key and send it to the edge device ID E2 .

[0222] C T =K old (ID T ||ID E1 ||Mes||t T ||r T ) Formula (2.1)

[0223] ID T →ID E2 :Req||ID T ||C T ||ID E1 ||Mes||r T ||t T Formula (2.2)

[0224] Formula (2.1) means: Use the old session key to encrypt related data.

[0225] Where ID T Indicates the terminal device identification, ID E1Indicates the edge device identity that has passed the authentication, Mes indicates the signature information authenticated by the original edge device, r T represents a random number, t T Indicates a timestamp.

[0226] Formula (2.2) means: ID T ID E2 Send a data packet for cross-domain access request.

[0227] Among them C T Indicates that the terminal has passed the ID E1 Authentication proof information, Req indicates access request.

[0228] Step 3: The edge device verifies the terminal identity for the first time

[0229] Edge Device ID E2 After receiving the cross-domain access authentication request from the terminal device, first query the CA center to obtain the ID E1 Decrypt the certificate to get the ID T 、ID E1 And the terminal is authenticated. Compare and decrypt to get ID T and the ID in the request T If they are consistent, authentication fails. If they are consistent, information is sent to the edge node ID. E2 Request verification of the terminal's identity;

[0230]

[0231] Formula (2.3) means: Decrypt Mes to obtain the terminal and authenticated edge device information.

[0232] Among them, Succeed means that the terminal has passed the edge device ID E1 certification.

[0233] Step 4: Edge node IDE2 requests the terminal to register with the domain edge node IDE1 to verify the terminal identity

[0234] Edge node ID E2 Determine whether there is an edge node ID in the authentication list E1 If not, then first perform CA bidirectional authentication between edge nodes and negotiate the session key Key E1-E2 . If the authentication is passed, the C T Send to ID E1 Request to verify the identity of the terminal.

[0235] ID E2 →ID E1 :(C T ||ID T)Key E1-E2 Formula (2.4)

[0236] Formula (2.4) means: ID E2 ID E1 The sending terminal requests information to verify the authenticity.

[0237] Among them C T Indicates that the terminal has passed the ID E1 Certification information.

[0238] Step 5: IDE1 verifies the terminal identity and returns the result to IDE2

[0239] ID E1 Received from ID E2 The request information is verified and the result is sent to ID E2 .

[0240]

[0241] ID E1 →ID E2 :(true||ID T )Key E1-E2 Formula (2.6)

[0242] Formula (2.5) means: ID E1 Decryption C T Get the authentication information passed by the edge device.

[0243] Formula (2.6) means: ID E1 ID E2 Send the authenticity result of the terminal passing the authentication.

[0244] Among them, true means that the information of the terminal is true, Key E1-E2 Representation ID E1 and ID E2 The session key.

[0245] Step 6: IDE1 and IDE2 negotiate a new terminal session key

[0246] Edge node ID E2 Received the decrypted information, verified the cross-domain authentication of the terminal, and E1 Negotiate and obtain the new session key K of the terminal key The new session key is encrypted using the original session key of the terminal, a response data packet is constructed, and it is encrypted using the temporary session key and sent to the ID E2 .

[0247] ID E1 →IDE2 :(ID T ||K old (K key ||success||ID E2 ))Key E1-E2 Formula (2.7)

[0248] Formula (2.7) means: ID E1 ID E2 Send a successful authentication message and a new terminal session key.

[0249] Where K old Indicates the old terminal session key, K key Represents the new terminal session key, K old (K key ||success||ID E2 ) means to encrypt the new session key with the terminal's old session key.

[0250] Step 7: IDE2 sends the authentication success message and its new terminal session key to the terminal

[0251] Edge node ID E2 After receiving the message that the terminal identity authentication is passed and verifying the access authentication status of the terminal, the authentication result and its new session key are sent to the terminal of the cross-domain request.

[0252] ID E2 →ID T :K old (K key ||success||ID E2 )||K key (Success) formula (2.8)

[0253] Formula (2.8) means: ID E2 ID T Send a successful authentication message and a new terminal session key.

[0254] Step 8: The terminal responds to the edge node with the new session key

[0255] Terminal ID T Received in ID E2 The message is decrypted with the private key to obtain the session key K key and the ID of the edge device accessed across domains E2 , using K key Decrypt the message from the edge device. Finally, the terminal ID T Reply to edge node ID with new session key encrypted message E2, cross-domain access authentication is successful.

[0256]

[0257] Formula (2.9) means: Terminal decryption comes from ID E2 The information obtained is the result of successful access and the new session key.

[0258] In summary, ID T Completed cross-domain access authentication of edge devices in different security domains, and successfully accessed the external domain edge device ID E2 And established a new session key with it.

[0259] During this process, IoT terminal devices do not need complex calculations and communications, and authentication and key negotiation are completed between edge devices, effectively reducing the computing and communication overhead of terminal devices.

[0260] Case 2: When the terminal of a complex industrial product crosses domains, it carries a domain trusted token issued by an edge device. When the edge device in the external domain receives the cross-domain request information from the terminal, it first sends it to the central authentication server of the domain, and then the central authentication server sends it to the central authentication server of the terminal registration domain to verify the domain trusted token. This avoids mutual authentication between edge devices in different security domains. When the terminal crosses domains, the information exchange between domains is handed over to the central authentication server of each security domain. The edge device only needs to wait for the verification result from the central authentication server. Working principle Figure 4 shown.

[0261] The specific implementation steps are as follows:

[0262] Step 1: Terminal registration and edge node access authentication

[0263] The terminal is registered in the PKG1 security domain, obtains the identification ID, private key and public parameters of the security domain, and passes the edge node ID E1 Access authentication and obtain the domain trusted token issued by the edge node;

[0264] Step 2: Move the terminal to ID E2 Then send a cross-domain access request

[0265] The terminal quickly moves to the edge node ID in the PKG2 security domain E2 Nearby, terminal device connected to ID E2 , and send an access authentication request message, which includes the terminal ID, ID E1 After successful authentication, the edge node issues a trusted token to start cross-domain access authentication;

[0266] m T =(ID E2 ||IDT ||t T ||r T )sk T Formula (3.1)

[0267] ID T →ID E2 :Req||(ID T ||Token||t T ||r T )||m T Formula (3.2)

[0268] Formula (3.1) means: Sign the terminal and edge device identification as well as the timestamp and random number.

[0269] Where ID T Indicates the terminal device identification, ID E2 Indicates the edge device identifier for requesting cross-domain access, r T represents a random number, t T Indicates a timestamp.

[0270] Formula (3.2) means: ID T ID E2 Send cross-domain access request data.

[0271] Req represents a cross-domain access request, and Token represents a domain trusted token issued by an authenticated edge node.

[0272] Step 3: ID E2 Forward the terminal authentication request to the central authentication server in this domain

[0273] Edge Device ID E2 After receiving the cross-domain access authentication request from the terminal device, it is found that the terminal device is not in this domain, and its terminal cross-domain information and trusted token are forwarded to the central authentication server ID of this domain. G2 ;

[0274] ID E2 →ID G2 :((ID T ||Token||t E2 ||r E2 )||m T )Pub G2 Formula (3.3)

[0275] Formula (3.3) means: ID E2 ID G2 Send terminal cross-domain information and domain trusted token request verification.

[0276] where tE2 Representation ID E2 The timestamp, r E2 Representation ID E2 Random numbers, Pub G2 Indicates the central authentication server ID G2 The CA public key.

[0277] Step 4: The central authentication server sends an identity verification request to the terminal registration domain

[0278] The central authentication server of this domain receives the ID from the edge device of the external domain E2 The message is decrypted to obtain the terminal's identity, the trusted token, and the signature of the terminal's identity. According to the security domain information on the trusted token, the central authentication server ID of the domain where the terminal is located is obtained. G1 , ID G1 Check whether there is a central authentication server ID in the authentication list G2 If there is one, proceed directly to the next step. If there is no one in the list, then ID G1 and ID G2 First, perform CA two-way identity authentication. G1 and ID G2 After the devices become mutually trusted, ID G2 Send the authentication request with ID G2 The CA public key is encrypted and then forwarded to the central authentication server ID of PKG1. G1 Requesting verification of the authenticity of the terminal's trusted token;

[0279] ID G2 →ID G1 :((ID T ||Token||ID E2 ||t G2 ||r G2 ||m T )SK G1 )Pub G1 Formula (3.4)

[0280] Formula (3.4) means: ID G2 ID G1 Send terminal cross-domain information and domain trusted token request verification.

[0281] where t G2 Representation ID G2 The timestamp, r G2 Representation ID G2 The random number, SK G2 Representation ID G2 CA private key, Pub G1 Indicates the central authentication server ID G1 The CA public key.

[0282] Step 5: PKG1's central authentication server verifies the domain trusted token Token

[0283] The central authentication server in domain PKG1 receives the request and decrypts it to obtain the terminal's ID. T , through the terminal's ID T Calculate its public key and decrypt the identity signature information m T , verify the identity of the terminal and the authenticity of the token held by the terminal. If the trusted token of the terminal is authentic, then the ID G1 With ID G2 Jointly negotiate the terminal session key K key , then K key The central authentication server ID sent to the PKG2 domain together with the verification result G2 ;

[0284] s T =(Success||K key ||ID E2 )Q T Formula (3.5)

[0285] ID G1 →ID G2 :((Success||K key ||s T )SK G1 )Pub G2 Formula (3.6)

[0286] Formula (3.5) means: The new session key related data is encrypted by the terminal's public key.

[0287] Success means the terminal identity has passed the verification. E2 Indicates that the identity of the edge device accessed across domains is credible. T Indicates the public key of the endpoint.

[0288] Formula (3.6) means: ID G1 ID G2 Send the result information of terminal identity verification.

[0289] Where K key Indicates a new terminal session key.

[0290] Step 6: The central authentication server of the PKG2 domain returns the ID E1 Verify the results

[0291] After receiving the verification result, the central authentication server of the PKG2 domain decrypts it and forwards the result to the edge node ID E2 ;

[0292] ID G2 →ID E1 :((Success||K key ||s T )SK G2 )Pub E1 Formula (3.7)

[0293] Formula (3.7) means: ID G1 ID E1 Send the trusted result of the terminal identity verification and the new terminal session key.

[0294] Among them, SK G2 Representation ID G2 CA private key, Pub E2 Indicates the edge node ID E2 The CA public key.

[0295] Step 7: ID E2 Send the authentication message and its new terminal session key to the terminal

[0296] ID E2 After receiving the decrypted message, it is found that the terminal's cross-domain request information is true. Then the terminal's cross-domain authentication request is approved and the terminal is notified that the authentication is successful.

[0297] ID E2 →ID T :(ID E2 ||Success)K key ||s T Formula (3.8)

[0298] Formula (3.8) means: ID E2 To terminal ID T Send the authentication success message and its new terminal session key to the terminal.

[0299] where s T Indicates that the new session key-related data is encrypted by the terminal's public key.

[0300] Step 8: The terminal responds to the edge node ID with a new session key E2

[0301] Terminal ID T Received from ID E2 The message is decrypted with the private key to obtain the session key K key , using K key Decrypt the message from the edge device, that is, the object ID through authentication and session key E2 Terminal ID TSend confirmation message to edge device, edge node ID E2 After receiving the message, the terminal passes the cross-domain authentication.

[0302]

[0303]

[0304] Formula (3.9) means: The terminal uses the private key to decrypt s T Get the new session key K key and the edge devices that talk to it.

[0305] Formula (3.10) means: The terminal uses the session key to decrypt and obtain the result passed by the edge device for cross-domain access.

[0306] Where K key Indicates the terminal ID T and edge device ID E2 The session key.

[0307] In summary, ID T Completed cross-domain access authentication of edge devices in different security domains, and successfully accessed the external domain edge device ID E2 And established a new session key with it.

[0308] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should be included in the protection scope of the present invention.

Claims

1. A cross-domain access authentication method for industrial complex product terminals based on identity identification, characterized in that It consists of two stages: Phase 1: The first cross-domain access authentication of a terminal of an industrial complex product after registration in a security domain Step 1: Send a cross-domain access request after the terminal moves Industrial complex product terminals are registered in the PKG1 security domain and obtain identification IDs T , private key and public parameters of the security domain; terminal ID T If the access authentication is not completed in the PKG1 security domain, quickly move to the edge device ID in the PKG1 security domain E2 , and send ID E2 Send an access authentication request message to start cross-domain access authentication; the request message includes the terminal's own identity, the domain central authentication server identity, the random number and the signature result of the timestamp m T and its hash result c T ; ID T →ID E2 :Req||(ID T ||ID E2 ||c T ||m T ) Formula (1.1) c T =h2(r T ||t T )Formula (1.2) m T =(r T ||t T )sk T Formula (1.3) Formula (1.1) means: ID T ID E2 Sending access request related messages; Where Req||(ID T ||ID E2 ||c T ||m T ) represents a data packet consisting of an access request, a terminal device identifier, an edge device identifier requesting access, a hash calculation value, and a private key signature result; Where ID T Indicates the terminal device identification, ID E2 Indicates the edge device identifier requesting access; Formula (1.2) means: The random number r is obtained through the hash function h2 T The hash calculation result of the sum c T ; Where h2 represents the hash function, r T represents a random number, t T Indicates a timestamp; Formula (1.3) means: Generate a random number and timestamp signature using the terminal's private key; Where m T Represents a random number r T and timestamp t T The signature result, sk T Indicates the private key of the terminal; Step 2: Edge device ID E2 Request the terminal registration domain to verify the terminal identity Edge Device ID E2 After receiving the cross-domain access authentication request from the terminal device of the industrial complex product, check the terminal device that does not belong to this domain. Since it does not belong to the same security domain, it cannot be decrypted to obtain m T 、c T ;Edge device ID E2 Check whether there is a central authentication server ID in the authentication list G1 If not, then first perform ID E2 and ID G1 The CAs between the two parties perform mutual authentication and negotiate the session key Key G1-E2 If the authentication is successful, the authentication request will be forwarded to the central authentication server ID G1 Processing, otherwise the authentication fails; ID E2 →ID G1 :(ID T ||ID E2 ||c T ||m T )Pub G1 Formula (1.4) Formula (1.4) meaning: Edge device ID E2 Authenticate the server ID to the center G1 Send by ID G1 Public key encrypted data packets; Where ID T Indicates the terminal equipment identification of industrial complex products, ID G1 Indicates the central authentication server of the terminal PKG1 security domain, Pub G1 Indicates the central authentication server ID G1 CA public key; Step 3: Register the domain center authentication server ID G1 Verify terminal identity Central authentication server ID of PKG1 security domain G1 Receive ID E2 Forwarded terminal cross-domain request, due to ID E2 If the authentication is confirmed to be credible, only the ID G1 Terminal ID T One-way authentication; That is: calculate the terminal ID T The public key is decrypted to obtain the random number and timestamp. First, verify the timestamp t T The validity of the timestamp is determined by the h2 hash function. T Compare, if they are not equal, discard the message; if they are equal, use the bilinear pairing property to verify whether the equality holds: Q T =h1(ID T )Formula (1.5) e(m T ,-(r T +t T )P) = e(Q T ,P pub ) Equation (1.7) Formula (1.5) means: The public key Q of the terminal is calculated by function h1 T ; Formula (1.6) means: Using ID T The public key of the identity decrypts m T Get a random number and timestamp; Where m T Represents a random number r T and timestamp t T The signature result, Q T Indicates the public key of the terminal; Formula (1.7) meaning: Central authentication server ID G1 Use bilinear equivalence to verify the legitimacy of the public and private keys of the terminal, that is, the legitimacy of the identity of the terminal; Where P is a generator of any one of the additive cyclic groups, P pub is the system public key of the security domain; Step 4: ID G1 With ID E2 Negotiate terminal session key If the equation does not hold, it means that ID G1 ID T If the authentication fails, the terminal device of the industrial complex product is considered to be illegal, and a Failure frame is returned to the external domain ID. E1 , reject ID T Connect and disconnect; otherwise, indicate ID G1 ID T Authentication successful; in ID G1 With ID E2 Jointly negotiate the terminal session key K key , K key Sent to ID together with the Success message E2 ; ID G1 →ID E2 :(Success||ID T ||ID E2 ||K key ||Q T (ID E2 ||K key ||Success))Key E-G1 Formula (1.8) Formula (1.8) Meaning: ID G1 ID E2 Send the terminal identity authentication result and the terminal session key; Success means the authentication is successful, K key Indicates the terminal ID T With edge device ID E2 The session key, Key E-G1 Indicates the edge device ID E2 and central authentication server ID G1 The temporary session key of Step 5: ID E2 Send the authenticated message and its terminal session key to the terminal Edge Device ID E2 After receiving the authentication success message, decrypt it to get the session key with the industrial complex product terminal, and send the cross-domain authentication success message to the terminal ID T ; ID E2 →ID T :(Success||ID T )K key ||(ID E2 ||K key ||Success)Q T Formula (1.9) Formula (1.9) means: ID E2 ID T Send the authentication message and its terminal session key; Success means the authentication is successful, K key Indicates the terminal ID T With edge device ID E2 The session key; Step 6: The terminal responds to the edge node with the new session key Industrial complex product terminal ID T Received in ID E2 The message is decrypted with the private key to obtain the session key K key The terminal ID with which the session is communicating E2 , using K key The decrypted message from the edge device indirectly proves the authenticity of the edge device; finally, the terminal ID T Reply with the edge device ID using the new session key to encrypt the message E2 , cross-domain access authentication is successful; Formula (1.10) means: Use the private key to decrypt the message to obtain the authentication success message and session key; Formula (1.11) means: Use the session key to decrypt the message to verify the consistency of the message; In summary, ID T Completed cross-domain access authentication of edge devices in different security domains, successfully accessed the external domain edge device IDE2 and established a new session key with it; Phase 2: Industrial complex product terminals are registered in the security domain and cross-domain authentication after passing authentication Case 1: When the terminal crosses domains, it carries the information signature of the edge device of the registered domain. The edge device of the foreign domain first verifies the authenticity of the information, and then forwards it to the edge device of the registered domain for further verification to prevent replay attacks. The specific implementation steps are as follows: Step 1: Terminal registration and edge node access authentication Terminal ID T Register in the PKG1 security domain and complete the registration domain edge device ID E1 Access authentication, and obtain ID E1 The CA-signed authentication information Mes contains the terminal ID, the authenticated edge device ID, and access completion information. Step 2: The terminal sends a cross-domain access request after moving across domains When ID E1 Discovery moves to new edge device IDs E2 If the device is not in the same security domain as itself, it will send a cross-domain authentication request to the edge device, including its own identity ID. T , the original ID of the edge device E1 And the signature information Mes of the access authentication completed by the original edge device; encrypt the request information with the original session key and send it to the edge device ID E2 ; C T =K old (ID T ||ID E1 ||Mes||t T ||r T ) Formula (2.1) ID T →ID E2 :Req||ID T ||C T ||ID E1 ||Mes||r T ||t T Formula (2.2) Formula (2.1) means: Use the old session key to encrypt related data; Where ID T Indicates the terminal device identification, ID E1 Indicates the edge device identity that has passed the authentication, Mes indicates the signature information authenticated by the original edge device, r T represents a random number, t T Indicates a timestamp; Formula (2.2) means: ID T ID E2 Send a data packet for a cross-domain access request; Among them C T Indicates that the terminal has passed the ID E1 Authentication proof information, Req represents access request; Step 3: The edge device verifies the terminal identity for the first time Edge Device ID E2 After receiving the cross-domain access authentication request from the terminal device, first query the CA center to obtain the ID E1 Decrypt the certificate to get the ID T 、ID E1 And the message that the terminal has passed the authentication; Compare and decrypt to get ID T and the ID in the request T Are they consistent? If not, authentication fails. If they match, the information is sent to the edge device ID E2 Request verification of the terminal's identity; Formula (2.3) means: Decrypt Mes to obtain the terminal and authenticated edge device information; Among them, Succeed means that the terminal has passed the edge device ID E1 Certification; Step 4: Edge Device ID E2 Request the terminal to register the domain edge device ID E1 Verify terminal identity Edge Device ID E2 Determine whether there is an edge device ID in the authentication list E1 If not, then first perform CA bidirectional authentication between edge nodes and negotiate the session key Key E1-E2 ; If the authentication is passed, the C in the terminal's cross-domain request will be T Send to ID E1 Request verification of the terminal's identity; ID E2 →ID E1 :(C T ||ID T )Key E1-E2 Formula (2.4) Formula (2.4) means: ID E2 ID E1 Sending terminal request information request to verify authenticity; Among them C T Indicates that the terminal has passed the ID E1 Certification information; Step 5: ID E1 Verify the terminal identity and return the ID E2 result ID E1 Received from ID E2 The request information is verified and the result is sent to ID E2 ; ID E1 →ID E2 :(true||ID T )Key E1-E2 Formula (2.6) Formula (2.5) means: ID E1 Decryption C T Get authentication information from edge devices; Formula (2.6) means: ID E1 ID E2 Send the authenticity result of the terminal passing the authentication; Among them, true means that the information of the terminal is true, Key E1-E2 Representation ID E1 and ID E2 The session key; Step 6: ID E1 and ID E2 Negotiate a new terminal session key Edge Device ID E2 Received the decrypted information, verified the cross-domain authentication of the terminal, and E1 Negotiate and obtain the new session key K of the terminal key ; Use the original session key of the terminal to encrypt the new session key, build a response data packet, encrypt it with the temporary session key and send it to the ID E2 ; ID E1 →ID E2 :(ID T ||K old (K key1 ||success||ID E2 ))Key E1-E2 Formula (2.7) Formula (2.7) means: ID E1 ID E2 Send the authentication success message and the new terminal session key; Where K old Indicates the old terminal session key, K key1 Represents the new terminal session key, K old (K key ||success||ID E2 ) indicates that the new session key is encrypted with the old session key of the terminal; Step 7: ID E2 Send the authentication message and its new terminal session key to the terminal Edge Device ID E2 After receiving the message that the terminal identity authentication is passed and verifying the access authentication status of the terminal, the authentication result and the new session key are sent to the terminal of the cross-domain request; ID E2 →ID T :K old (K key ||success||ID E2 )||K key (Success)Formula (2.8) Formula (2.8) means: ID E2 ID T Send the authentication success message and the new terminal session key; Step 8: The terminal responds to the edge node with the new session key Terminal ID T Received in ID E2 The message is decrypted with the private key to obtain the session key K key and the ID of the edge device accessed across domains E2 , using K key Decrypt the message from the edge device; finally, the terminal ID T Reply with the edge device ID using the new session key to encrypt the message E2 , cross-domain access authentication is successful; Formula (2.9) means: Terminal decryption comes from ID E2 The information obtained is the result of successful access and the new session key; In summary, ID T Completed cross-domain access authentication of edge devices in different security domains, and successfully accessed the external domain edge device ID E2 and established a new session key with it; In this process, IoT terminal devices do not need complex calculations and communications, and authentication and key negotiation are completed between edge devices, effectively reducing the calculation and communication overhead of terminal devices; Case 2: When the terminal of a complex industrial product crosses domains, it carries the domain trusted token issued by the edge device. The edge device in the external domain receives the cross-domain request information of the terminal and sends it to the central authentication server of the domain first. The central authentication server then sends it to the central authentication server of the terminal registration domain to verify the domain trusted token. The specific implementation steps are as follows: Step 1: Terminal registration and edge node access authentication The terminal is registered in the PKG1 security domain, obtains the identification ID, private key and public parameters of the security domain, and passes the edge device ID E1 Access authentication and obtain the domain trusted token issued by the edge node; Step 2: Move the terminal to ID E2 Then send a cross-domain access request The terminal quickly moves to the edge device ID in the PKG2 security domain E2 Nearby, terminal device connected to ID E2 , and send an access authentication request message, which includes the terminal ID, ID E1 After successful authentication, the edge node issues a trusted token to start cross-domain access authentication; m T = (ID E2 ||ID T ||t T ||r T )sk T Formula (3.1) ID T →ID E2 :Req||(ID T ||Token||t T ||r T )||m T Formula (3.2) Formula (3.1) Meaning: Sign the terminal and edge device identification, timestamp and random number; Where ID T Indicates the terminal device identification, ID E2 Indicates the edge device identifier for requesting cross-domain access, r T represents a random number, t T Indicates a timestamp; Formula (3.2) means: ID T ID E2 Send data for cross-domain access request; Req represents a cross-domain access request, and Token represents a domain trusted token issued by an authenticated edge node. Step 3: ID E2 Forward the terminal authentication request to the central authentication server in this domain Edge Device ID E2 After receiving the cross-domain access authentication request from the terminal device, it is found that the terminal device is not in this domain, and its terminal cross-domain information and trusted token are forwarded to the central authentication server ID of this domain. G2 ; ID E2 →ID G2 :((ID T ||Token||t E2 ||r E2 )||m T )Pub G2 Formula (3.3) Formula (3.3) means: ID E2 ID G2 Send terminal cross-domain information and domain trusted token to request verification; where t E2 Representation ID E2 The timestamp, r E2 Representation ID E2 Random numbers, Pub G2 Indicates the central authentication server ID G2 CA public key; Step 4: The central authentication server sends an identity verification request to the terminal registration domain The central authentication server of this domain receives the ID from the edge device of the external domain E2 The message is decrypted to obtain the terminal's identity, the trusted token, and the signature of the terminal's identity. According to the security domain information on the trusted token, the central authentication server ID of the domain where the terminal is located is obtained. G1 , ID G1 Check whether there is a central authentication server ID in the authentication list G2 If there is one, proceed directly to the next step. If there is no one in the list, then ID G1 and ID G2 First perform CA two-way identity authentication; ID G1 and ID G2 After the devices become mutually trusted, ID G2 Send the authentication request with ID G2 The CA public key is encrypted and then forwarded to the central authentication server ID of the PKG1 security domain. G1 Requesting verification of the authenticity of the terminal's trusted token; ID G2 → ID G1 : ((ID T || Token || ID E2 || t G2 || r G2 || m T ) SK G1 ) Pub G1 Formula (3.4) Formula (3.4) means: ID G2 ID G1 Send terminal cross-domain information and domain trusted token to request verification; where t G2 Representation ID G2 The timestamp, r G2 Representation ID G2 The random number, SK G1 Representation ID G1 CA private key, Pub G1 Indicates the central authentication server ID G1 CA public key; Step 5: The central authentication server of the PKG1 security domain verifies the token The central authentication server of the PKG1 security domain receives the request and decrypts it to obtain the terminal's identification ID. T , through the terminal's ID T Calculate its public key and decrypt the identity signature information m T , verify the identity of the terminal and the authenticity of the token held by the terminal. If the trusted token of the terminal is authentic, then the ID G1 With ID G2 Jointly negotiate the terminal session key K key2 , then K key2 The central authentication server ID sent to the PKG2 domain together with the verification result G2 ; s T =(Success||K key2 ||ID E2 )Q T Formula (3.5) ID G1 →ID G2 :((Success||K key2 ||s T )SK G1 )Pub G2 Formula (3.6) Formula (3.5) means: The new session key-related data is encrypted by the terminal's public key; Success means the terminal identity has passed the verification. E2 Indicates that the identity of the edge device accessed across domains is credible. T Indicates the public key of the terminal; Formula (3.6) means: ID G1 ID G2 Sending the result information of the terminal identity verification; Where K key2 Represents a new terminal session key; Step 6: The central authentication server of the PKG2 domain returns the ID E1 Verify the results After receiving the verification result, the central authentication server in the PKG2 domain decrypts it and forwards the result to the edge device ID E2 ; ID G2 →ID E1 :((Success||K key ||s T )SK G2 )Pub E1 Formula (3.7) Formula (3.7) means: ID G1 ID E1 Send the trusted result of the terminal identity verification and the new terminal session key; Among them, SK G2 Representation ID G2 CA private key, Pub E1 Indicates the edge device ID E1 CA public key; Step 7: ID E2 Send the authentication message and its new terminal session key to the terminal ID E2 After receiving the decrypted message, it is found that the terminal cross-domain request information is true, so the terminal's cross-domain authentication request is approved and the terminal is notified that the authentication is successful; ID E2 →ID T :(ID E2 ||Success)K key ||s T Formula (3.8) Formula (3.8) means: ID E2 Terminal ID T Send the authentication success message and its new terminal session key to the terminal; where s T Indicates that the new session key related data is encrypted by the public key of the terminal; Step 8: The terminal responds to the edge device ID with a new session key E2 Terminal ID T Received from ID E2 The message is decrypted with the private key to obtain the session key K key , using K key Decrypt the message from the edge device, that is, the object ID through authentication and session key E2 ; Terminal ID T Send confirmation message to edge device, edge device ID E2 After receiving the message, the terminal passes the cross-domain authentication; Formula (3.9) means: The terminal uses the private key to decrypt s T Get the new session key K key and the edge devices that are talking to it; Formula (3.10) means: The terminal uses the session key to decrypt and obtain the result passed by the edge device for cross-domain access; Where K key Indicates the terminal ID T and edge device ID E2 The session key; In summary, ID T Completed cross-domain access authentication of edge devices in different security domains, and successfully accessed the external domain edge device ID E2 And established a new session key with it.

2. A computer system, characterized in that include: One or more processors, and a computer-readable storage medium for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method of claim 1.

3. A computer-readable storage medium, characterized in that Computer executable instructions are stored, and when the instructions are executed, they are used to implement the method of claim 1.

4. A computer program product, characterized in that The invention comprises computer executable instructions, which are used to implement the method of claim 1 when being executed.

Images