Lightweight autonomous and controllable Internet of Things secure access method, terminal and storage medium

Abstract

The present invention provides a lightweight autonomous and controllable IoT security access method, terminal and storage medium, the method includes: S1. The device to be accessed requests to access the terminal intranet, and the device to be accessed performs multi-factor identity authentication through the network access authentication module and performs network access authentication; S2. After the device to be accessed is successfully authenticated, the encryption chip creates a thread pool; S3. Before data interaction, the sent data message is encrypted by the sub-thread in the thread pool using the national secret algorithm, which is used to strengthen the access terminal's ability to resist active and passive attacks; S4. The encrypted data message is sent to a bidirectional FIFO isolation component after adding a fixed frame header and a fixed frame tail through the interactive gateway, and is decrypted after matching the fixed frame header and checking the integrity of the fixed frame tail. The device to be accessed accesses the terminal intranet to perform data security interaction. The present invention can ensure the security and privacy of data transmission and improve the ability to resist active and passive attacks.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial Internet of Things, and specifically relates to a lightweight, autonomous and controllable Internet of Things security access method, terminal and storage medium. Background Art

[0002] With the introduction of the concept of "Industry 4.0", industrial interconnection is being gradually realized. Industrial interconnection means that organizations can connect multiple different devices, including legacy devices, and let them "talk" to each other. By collecting, analyzing and utilizing data from new and legacy devices, organizations can improve efficiency and gain competitive advantage.

[0003] In the prior art, the privacy and security requirements of data transmission in industrial interconnection are high. If important data parameters are leaked, it will cause huge and irreparable losses to the entire industrial control system. For example, the patent with authorization announcement number CN112218294B discloses a 5G-based Internet of Things device access method, system and storage medium. The method includes an Internet of Things access platform generating an authentication identifier of the Internet of Things device to be accessed according to the device identifier of the Internet of Things device to be accessed, and performing identity authentication on the Internet of Things device to be accessed through the authentication identifier, so as to feed back the identity authentication result to the Internet of Things device to be accessed, so that when the identity authentication result received by the Internet of Things device to be accessed is that the identity authentication is passed, the Internet of Things device to be accessed accesses the Internet of Things access platform and performs encrypted data communication. The device fingerprint is used as an authentication identifier to verify the legal identity of the Internet of Things device to be accessed, and the access authentication is performed to ensure the data integrity of the Internet of Things device to be accessed, thereby preventing illegal terminals from accessing the Internet of Things access platform and providing data transmission security. However, the authentication identifier is single, and the data encryption algorithm is easy to be cracked, and the security and privacy of data transmission cannot be ensured. Summary of the invention

[0004] The purpose of the present invention is to provide a lightweight, autonomous and controllable IoT security access method, terminal and storage medium to ensure the security and privacy of data transmission and improve the ability to resist active and passive attacks.

[0005] The present invention provides the following technical solutions:

[0006] This application proposes a lightweight autonomous and controllable IoT secure access method, including the following steps:

[0007] S1. The access device requests to access the terminal intranet, and the access device performs multi-factor identity authentication through the network authentication module for network authentication;

[0008] S2. After the access device is successfully authenticated, the encryption chip creates a thread pool;

[0009] S3. Before data interaction, the sent data message is encrypted by the sub-thread in the thread pool using the national secret algorithm to strengthen the access terminal's ability to resist active and passive attacks;

[0010] S4. The encrypted data message is added with a fixed frame header and a fixed frame trailer by the interactive gateway and sent to the bidirectional FIFO isolation component. After matching the fixed frame header and checking the integrity of the fixed frame trailer, it is decrypted and the access device is connected to the terminal intranet for secure data interaction.

[0011] Preferably, in step S1, the multi-factor identity authentication includes a cognitive factor. In addition to the cognitive factor, the multi-factor identity authentication also includes at least one of a possession factor, a characteristic factor, a location factor and a time factor. The cognitive factor includes a password, a PIN code, and a shared key. The possession factor includes an ID card, a security token, and a smart device. The characteristic factor includes fingerprint features, facial features, voice features, keystroke strength, and typing speed. The location factor is used to limit authentication according to devices at specific locations. The time factor is used to limit authentication of devices to be accessed within a specific time window, and authentication is rejected outside the specific time window.

[0012] Preferably, in step S3, the encryption step using the national secret encryption algorithm includes the following steps:

[0013] S31. Use SM4 algorithm to group data packets;

[0014] S32. The operation module generates a random number for each packet of data packets, and each random number corresponds to an operation, and the packet of data packets is aggregated;

[0015] S33. After converting multiple random numbers into binary sequences, they are arranged in order to generate a CRC check code.

[0016] Preferably, in step S4, the framing header includes a magic string and a message length, which are used to determine the length of the data message, and the CRC checksum in step S33 forms a framing tail, which is used to verify the integrity of the data message and restore the random number sequence.

[0017] Based on the above-mentioned lightweight autonomous and controllable IoT security access method, the present application also proposes an IoT security access terminal, including:

[0018] The network access authentication module includes an interface group, an identity authentication module and an encryption chip, wherein the two ends of the interface group are respectively connected to the device to be connected and the identity authentication module, and the identity authentication module is connected to the encryption chip;

[0019] An interactive gateway, electrically connected to the encryption chip, for interacting with data after successful authentication;

[0020] The bidirectional FIFO isolation component is electrically connected to the interactive gateway and is used for independent internal and external networks to realize data interaction between the device under test and the terminal intranet.

[0021] Preferably, the bidirectional FIFO isolation component includes an external network module, a mutually exclusive logic unit and an internal network module. The mutually exclusive logic unit is arranged between the external network module and the internal network module to prevent the external network module and the internal network module from operating simultaneously on the same data channel. Both the external network module and the internal network module are connected to a storage module.

[0022] Preferably, the mutually exclusive logic unit includes two mutually exclusive NAND gates.

[0023] Preferably, it also includes a processor, which is used to execute the above-mentioned lightweight autonomous and controllable Internet of Things security access method during operation.

[0024] Based on the above-mentioned IoT security access terminal, the present application also proposes a computer-readable storage medium, in which a computer program is stored. The computer program is executed by a processor to implement the above-mentioned lightweight, autonomous and controllable IoT security access method.

[0025] The beneficial effects of the present invention are:

[0026] 1. The access device undergoes multi-factor identity authentication and national secret algorithm group encryption operation to ensure the security and privacy of data transmission and enhance the access terminal's ability to resist active and passive attacks;

[0027] 2. Create a thread pool in the encryption chip, and start sub-threads for encryption according to the number of times the device to be connected sends data. Parallel operations can be performed to improve encryption efficiency and further achieve data transmission integrity;

[0028] 3. The bidirectional FIFO isolation component makes the internal network module and the external network module independent, realizes the data interaction between the device under test and the terminal internal network, and prevents the external network module and the internal network module from operating simultaneously in the same data channel through the mutual exclusion logic unit. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0030] In the attached picture:

[0031] Figure 1 It is a schematic diagram of the process of the lightweight autonomous controllable IoT secure access method of the present invention;

[0032] Figure 2 It is a schematic diagram of the connection of the IoT security access terminal of the present invention;

[0033] Figure 3 It is a schematic diagram of the mutually exclusive logic unit of the present invention. DETAILED DESCRIPTION

[0034] The technical content of the present invention is further described in detail below in conjunction with the accompanying drawings:

[0035] like Figure 1 and Figure 2 As shown, the present application proposes a lightweight autonomous and controllable IoT secure access method, comprising the following steps:

[0036] S1. The device 2 to be connected requests to access the terminal intranet, and the device 2 to be connected performs multi-factor identity authentication through the network authentication module 1 to perform network authentication. In step S1, the multi-factor identity authentication includes cognitive factors, and also includes any one or more of the factors of possession, characteristic factors, location factors and time factors. The cognitive factors include passwords, PIN codes, and shared keys. The factors of possession include identity cards, security tokens, and smart devices. The characteristic factors include fingerprint features, facial features, voice features, keystroke strength, and typing speed. The location factor is used to limit the authentication according to the device at a specific location. The time factor is used to limit the authentication of the device 2 to be connected within a specific time window, and the authentication is rejected outside the specific time window.

[0037] S2. After the access device 2 is successfully authenticated, the encryption chip 13 creates a thread pool; if unsuccessful, it will feedback that the authentication failed and continue the authentication. If it fails three times, the access device will be locked and forced to be ejected.

[0038] S3. Before data interaction, the sent data message is encrypted by the sub-thread in the thread pool using the national secret algorithm to enhance the access terminal's ability to resist active and passive attacks. In step S3, the national secret encryption algorithm encryption step includes the following steps:

[0039] S31. Use SM4 algorithm to group data packets;

[0040] S32. The operation module generates a random number for each grouped data message, and each random number corresponds to an operation, and the grouped data messages are aggregated; the operations include XOR, modulo, modulo addition, shift, AND, OR, and NOT operations, a total of seven operations, corresponding to decimal numbers 1-7 respectively.

[0041] S33. After the multiple random numbers are converted into binary sequences, they are arranged in order to generate a CRC check code. Specifically, after the random numbers are converted into binary numbers, the numbers less than three digits are supplemented with 0, a divisor is selected to perform a modulo 2 division operation, and the remainder generated is added to the binary sequence converted from the random numbers to generate a CRC check code.

[0042] S4. The encrypted data message is sent to the bidirectional FIFO isolation component 4 after adding the frame header and frame tail by the interactive gateway 3. After the frame header is matched and the frame tail is checked for integrity, it is decrypted. The access device 2 is connected to the terminal intranet for data security interaction. In step S4, the frame header includes a magic string and a message length, which are used to determine the length of the data message. The CRC check code in step S33 forms a frame tail, which is used to verify the integrity of the data message and restore the random number sequence.

[0043] When matching the frame header, the SUNDAY algorithm is used to match the magic string of fixed length from front to back as the pattern string. When the match fails, the focus is on the next character of the last character in the main string that participates in the match. When the pattern string is found to be unmatched, the SUNDAY algorithm can skip as many characters as possible for the next step of matching, thereby improving the matching efficiency. The specific matching rules are as follows:

[0044] (1) If the character does not appear in the pattern string, it is skipped directly, that is, the number of shifted bits = pattern string length + 1;

[0045] (2) Otherwise, the number of shifted bits = pattern string length - the rightmost position of the character (starting with 0) = the distance from the rightmost position of the character in the pattern string to the tail + 1.

[0046] After the frame header matches, the integrity of the data message is verified by the CRC check code. If it is complete, the random number is recovered from the check code, and the aggregate data message is reversely decrypted and the packet message is decrypted to ensure the security of data transmission.

[0047] like Figure 2 As shown, based on the lightweight autonomous and controllable IoT security access method of the above-mentioned embodiment 1, the present application also proposes an IoT security access terminal, including:

[0048] The network access authentication module 1 comprises an interface group 11 , an identity authentication module 12 and an encryption chip 13 . The two ends of the interface group 11 are respectively connected to the device to be measured and the identity authentication module 12 , and the identity authentication module 12 is connected to the encryption chip 13 .

[0049] The interactive gateway 3 is electrically connected to the encryption chip 13 and is used to interact with the data after successful authentication.

[0050] The bidirectional FIFO isolation component 4 is electrically connected to the interactive gateway 3 and is used for independent internal and external networks to realize data interaction between the device under test and the terminal internal network.

[0051] The bidirectional FIFO isolation component 4 includes an external network module 41, a mutually exclusive logic unit 42 and an internal network module 43. The mutually exclusive logic unit 42 is arranged between the external network module 41 and the internal network module 43 to prevent the external network module 41 and the internal network module 43 from operating simultaneously in the same data channel. The external network module 41 and the internal network module 43 are both connected to a storage module 44.

[0052] like Figure 3 As shown, the mutually exclusive logic unit 42 includes two mutually exclusive NAND gates to avoid any logic errors caused by the simultaneous occurrence of request signals and reduce the probability of metastable state. Specifically, it includes: a first NAND gate Q1, a second NAND gate Q2, a first NAND gate K1 and a second NAND gate K2, the first input end Req of the first NAND gate Q1 is externally connected to the external network module 41, and the second input end is connected to the output end of the second NAND gate Q2, the output end of the first NAND gate Q1 is connected to the input end of the first NAND gate K1 and the first input end of the second NAND gate Q2, the second input end Req of the second NAND gate Q2 is internally connected to the internal network module 43, the output end of the second NAND gate Q2 is connected to the second NAND gate K2, and the output end G of the first NAND gate K1 is connected to the internal network module 43. 外 Connect to the external network module 41, the output terminal G of the second NOT gate K2 内 Connect to the intranet module 43, where G 内 and G 外 Both are enable signals.

[0053] It also includes a processor, which is used to execute the above-mentioned lightweight autonomous and controllable Internet of Things security access method during operation.

[0054] Based on the IoT security access terminal of the above-mentioned embodiment 2, the present application also proposes a computer-readable storage medium, in which a computer program is stored, and the computer program is executed by a processor to implement the above-mentioned lightweight, autonomous and controllable IoT security access method.

[0055] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention is described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A lightweight, autonomous and controllable IoT secure access method, characterized by: The steps include: S1. The access device requests to access the terminal intranet, and the access device performs multi-factor identity authentication through the network authentication module for network authentication; S2. After the access device is successfully authenticated, the encryption chip creates a thread pool; S3. Before data interaction, the sent data message is encrypted by the sub-thread in the thread pool using the national encryption algorithm to strengthen the access terminal's ability to resist active and passive attacks; S4. The encrypted data message is added with a frame header and a frame tail by the interactive gateway and sent to the bidirectional FIFO isolation component. After the frame header is matched and the integrity of the frame tail is checked, it is decrypted and the access device is connected to the terminal intranet for data security interaction. In step S3, the encryption step of the national secret encryption algorithm includes the following steps: S31. Use SM4 algorithm to group data packets; S32. The operation module generates a random number for each packet of data packets, and each random number corresponds to an operation, and the packet of data packets is aggregated; S33. After converting multiple random numbers into binary sequences, they are arranged in order to generate a CRC check code.

2. The lightweight autonomous and controllable IoT secure access method according to claim 1 is characterized by: In step S1, the multi-factor identity authentication includes a cognitive factor, and in addition, it also includes at least one of a possession factor, a characteristic factor, a location factor and a time factor. The cognitive factor includes a password, a PIN code, and a shared key. The possession factor includes an ID card, a security token, and a smart device. The characteristic factor includes fingerprint features, facial features, voice features, keystroke strength, and typing speed. The location factor is used for device-limited authentication, and the time factor is used to limit the time window for authentication of the device to be accessed.

3. The lightweight autonomous and controllable IoT secure access method according to claim 1 is characterized by: In step S4, the framing header includes a magic string and a message length, which are used to determine the length of the data message. The CRC checksum in step S33 forms a framing tail, which is used to verify the integrity of the data message and restore the random number sequence.

4. A secure access terminal for Internet of Things, characterized in that: include: The network access authentication module includes an interface group, an identity authentication module and an encryption chip, wherein the two ends of the interface group are respectively connected to the device to be connected and the identity authentication module, and the identity authentication module is connected to the encryption chip; The interactive gateway is electrically connected to the encryption chip and is used to interact with the data after successful authentication; the bidirectional FIFO isolation component is electrically connected to the interactive gateway and is used for independent internal and external networks to realize data interaction between the device under test and the terminal intranet; The bidirectional FIFO isolation component includes an external network module, a mutual exclusion logic unit and an internal network module. The mutual exclusion logic unit is arranged between the external network module and the internal network module to prevent the external network module and the internal network module from operating simultaneously on the same data channel. The external network module and the internal network module are both connected to a storage module; The mutually exclusive logic unit includes a first NAND gate Q1, a second NAND gate Q2, a first NOT gate K1 and a second NOT gate K2, the first input end Req of the first NAND gate Q1 is externally connected to the external network module 41, and the second input end is connected to the output end of the second NAND gate Q2, the output end of the first NAND gate Q1 is connected to the input end of the first NOT gate K1 and the first input end of the second NAND gate Q2, the second input end Req of the second NAND gate Q2 is internally connected to the internal network module, the output end of the second NAND gate Q2 is connected to the second NOT gate K2, the output end G of the first NOT gate K1 is externally connected to the external network module, and the output end G of the second NOT gate K2 is internally connected to the internal network module, wherein Ginside and Goutside are both enable signals.

5. The IoT secure access terminal according to claim 4, characterized in that: It also includes a processor, which is used to execute the lightweight autonomous and controllable Internet of Things security access method as described in any one of claims 1-3 during operation.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the lightweight autonomous and controllable Internet of Things secure access method as described in any one of claims 1 to 3.

Images