Witness-based authentication and confidential communication method and system for the Internet of Things

Abstract

This patent discloses a witness-based authentication and confidential communication method and system for the Internet of Things, which combines a mobile terminal and authentication parameters obtained from a witness. The authentication parameters are stored in the memory of the mobile terminal and will be lost after power failure. There are certain restrictions on the period of use and the location of use. In the extreme case where the mobile terminal is lost or stolen, the security of the Internet of Things can still be guaranteed because the enemy cannot obtain the authentication parameters or obtains invalid authentication parameters. The audit requirements for various control instructions of the Internet of Things are met, and the user terminal corresponding to the control instruction and its user's personal information are recorded by the witness user terminal, making the Internet of Things authentication system more secure. This patent can be applied to the authentication and confidential communication between mobile terminals and the Internet of Things in smart home Internet of Things, industrial Internet of Things in factories, military Internet of Things in military camps, etc.

Description

Technical Field

[0001] The present invention relates to the field of quantum computing resistance, and in particular to a witness-based Internet of Things authentication and confidentiality communication method and system. Background Art

[0002] Since the 1980s, due to the rapid development of Internet technology, information has been greatly opened up both internally and externally, and the information security issues generated by the Internet have spanned time and space. Therefore, the focus of information security is no longer just the traditional three principles of confidentiality, integrity and availability. Other principles and goals such as controllability, non-repudiation, and authenticity have been derived from this. Information security has also transformed into an information assurance stage that considers its system construction from a holistic perspective.

[0003] In the 21st century, information security has now developed from host security technology to network security, from single-level security to multi-level three-dimensional security, and from personal information security to national information security.

[0004] The Internet of Things (IOT) refers to the use of various information sensors, radio frequency identification technology, global positioning system, infrared sensors, laser scanners and other devices and technologies to collect any objects or processes that need to be monitored, connected, and interacted in real time, collect their sound, light, heat, electricity, mechanics, chemistry, biology, location and other required information, and realize ubiquitous connection between objects and objects, objects and people through various possible network access, and realize intelligent perception, identification and management of objects and processes. The Internet of Things is an information carrier based on the Internet, traditional telecommunications networks, etc. It allows all ordinary physical objects that can be independently addressed to form an interconnected network.

[0005] The Internet of Things is an important part of the new generation of information technology. The IT industry also calls it: pan-interconnection, which means that everything is connected and everything is connected. Therefore, "the Internet of Things is the Internet of Things that connects everything". This has two meanings: first, the core and foundation of the Internet of Things is still the Internet, which is an extension and expansion of the Internet; second, its user end extends and expands to any object to exchange information and communicate. Therefore, the definition of the Internet of Things is a network that connects any object to the Internet through information sensing devices such as radio frequency identification, infrared sensors, global positioning systems, laser scanners, etc., according to the agreed protocol, to exchange information and communicate, so as to realize the intelligent identification, positioning, tracking, monitoring and management of objects.

[0006] The application areas of the Internet of Things involve all aspects. Its application in the fields of industry, agriculture, environment, transportation, logistics, security and other infrastructure has effectively promoted the intelligent development of these areas, making limited resources more reasonably used and allocated, thereby improving industry efficiency and benefits. In the fields of home, medical health, education, finance and services, tourism and other fields closely related to life, there have been great improvements in terms of service scope, service methods and service quality, which has greatly improved people's quality of life; in the field of national defense and military, although it is still in the research and exploration stage, the impact of the application of the Internet of Things cannot be underestimated. From large equipment systems such as satellites, missiles, aircraft, submarines, to small single-soldier combat equipment, the embedding of Internet of Things technology has effectively improved the military intelligence, informationization and precision, greatly improved military combat effectiveness, and is the key to future military changes.

[0007] There are still some problems with the existing technology:

[0008] 1. In the prior art, the IoT APP and its account in the mobile terminal may be lost or stolen. Once lost or stolen, the security of the IoT is threatened;

[0009] 2. In the prior art, there is a need to audit various control instructions of the Internet of Things, but generally only the user end and its account information corresponding to the control instruction are recorded, but it is difficult to determine the user's own information. Summary of the invention

[0010] In view of the problems in the related technology, the present invention proposes a witness-based Internet of Things authentication confidential communication method and system to overcome the above-mentioned technical problems existing in the existing related technology.

[0011] To this end, the specific technical solution adopted by the present invention is as follows:

[0012] A witness-based Internet of Things authentication and confidential communication method includes a smart home service station, a witness service station, an Internet of Things member, a witness user terminal and a common user terminal; and includes the following steps:

[0013] S1. The witness client performs two-way authentication with the witness service station and generates a first session key through key negotiation;

[0014] S2, the smart home service station and the witness service station perform two-way authentication and generate a second session key through key negotiation;

[0015] S3. The common client sends an authentication parameter request to the witness client.

[0016] S4. After receiving the request, the witness client collects information, including information of the common client and its user, and transmits the information confidentially to the witness service station;

[0017] S5. The witness service station saves the information locally and verifies the details in the information. If the verification fails, the witness client is notified to end the subsequent process. If the verification succeeds, a random number is generated, and the authentication parameter is encrypted with the first session key to obtain a ciphertext that is sent to the witness client and saved in the witness service station. The witness client decrypts the ciphertext with the first session key and sends the authentication parameter to the ordinary client via short-range communication.

[0018] S6. After receiving the authentication parameter message sent by the witness user terminal, the ordinary user terminal stores the authentication parameters in the memory;

[0019] S7, the common user terminal and the smart home service station perform two-way authentication and generate a third session key through key negotiation;

[0020] S8, the smart home service station uses the identity information of the ordinary user terminal to request the witness service station for the corresponding authentication parameters of the user terminal. After obtaining the authentication parameters, the smart home service station and the ordinary user terminal use the third session key to calculate the authentication parameters to obtain the fourth session key;

[0021] S9. The fourth session key is used for confidential communication between the ordinary user terminal and the smart home service station.

[0022] The fourth session key is obtained by calculating the random number in the authentication parameter using the third session key through a message authentication code algorithm.

[0023] Preferably, the authentication parameters include identity information of the authentication parameters, identity information of the common user terminal, a random number, a validity period, a valid positioning area and a signature of the witness service station.

[0024] Preferably, the authentication parameters are lost when the ordinary user terminal loses power, and restrictions are imposed on the period of use and location of use.

[0025] Optionally, the restriction may be valid for 1 hour, 1 day, or only valid when the mobile terminal is located in a legal positioning area.

[0026] Preferably, the two-way authentication method is TLS two-way authentication.

[0027] Preferably, when the ordinary user terminal communicates confidentially with members of the Internet of Things, the smart home service station implements message forwarding for the ordinary user terminal and members of the Internet of Things within its jurisdiction.

[0028] A witness-based Internet of Things authentication and confidentiality communication system is used to implement the steps of the above-mentioned witness-based Internet of Things authentication and confidentiality communication method, including a smart home service station, a witness service station, a witness user terminal and an ordinary user terminal; the smart home service station is a smart home control center, which is built in the user's home; the ordinary user terminal is a mobile terminal held by the user; the witness user terminal is used to cooperate with the ordinary user terminal to authenticate with the witness service station; the witness service station is deployed in the smart home, in the building where the smart home is located, or in the community where the smart home is located; the witness user terminal is a user terminal deployed at a fixed position, which can be deployed at the gate position and can authenticate independently with the witness service station; the witness user terminal can communicate with the ordinary user terminal in close range, and the communication content includes the witness user terminal collecting the ordinary user terminal and its user information; the witness user terminal sends authentication parameters to the ordinary user terminal.

[0029] The beneficial effects of the invention are:

[0030] 1. This patent combines the mobile terminal and the authentication parameters obtained from the witness. The authentication parameters are stored in the memory of the mobile terminal and will be lost after power failure. There are certain restrictions on the period of use and the location of use. In the extreme case that the mobile terminal is lost or stolen, the security of the Internet of Things can still be guaranteed because the enemy cannot obtain the authentication parameters or obtains invalid authentication parameters;

[0031] 2. This patent targets the auditing needs of various control instructions of the Internet of Things. By recording the user terminal and the user's personal information corresponding to the control instruction through the witness user terminal, the Internet of Things authentication system is made more secure. This patent can be applied to the authentication and confidential communication between mobile terminals and the Internet of Things in smart home Internet of Things, industrial Internet of Things in factories, military Internet of Things in military camps, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 An exemplary schematic diagram of the smart home system described in the embodiment. DETAILED DESCRIPTION

[0034] To further illustrate each embodiment, the present invention provides drawings, which are part of the disclosure of the present invention and are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these contents, ordinary technicians in the field should be able to understand other possible implementations and advantages of the present invention. The components in the figures are not drawn to scale, and similar component symbols are generally used to represent similar components.

[0035] The present invention is further described in conjunction with the accompanying drawings and specific embodiments, taking the Internet of Things system of a smart home as an example. Figure 1 As shown, the system includes a smart home service station, a witness service station, a witness user terminal and a common user terminal.

[0036] The smart home service station is the smart home control center and is built in the user's home.

[0037] The ordinary user terminal is a mobile terminal held by the user and is the control terminal of the smart home system. The ordinary user terminal may be lost or stolen; the cooperation of the witness user terminal is required when authenticating with the witness service station.

[0038] A witness service station is built in the smart home, in the building where the smart home is located, or in the community where the smart home is located. The witness service station is the authentication center in the smart home system of the present invention.

[0039] The witness client is an important client deployed at a fixed location, such as a gateway, server or trusted terminal similar to an ATM machine in a local area network. It can be deployed in public locations such as the gate of a smart home, the gate of the building where the smart home is located, and the gate of the community where the smart home is located. Due to its high level of security protection, its main body, internal services and keys are unlikely to be stolen. It can be independently authenticated with the witness service station. It can communicate with ordinary clients at close range, such as wired connection, QR code communication, WIFI hotspot communication, NFC communication, infrared communication, Bluetooth communication, etc. The communication content is that the witness client collects information about the ordinary client and its user (the model and device code of the ordinary client, the user's photo, biological information, ID card information, etc.), and the witness client sends authentication parameters to the ordinary client.

[0040] This patent can also be applied to the mobile terminal management of industrial Internet of Things in factories, military Internet of Things in military camps, etc. If it is industrial Internet of Things, the witness user terminal can be deployed in public locations such as workshop gates, factory gates, and factory gates; if it is military Internet of Things in military camps, the witness user terminal can be deployed in public locations such as warehouse gates, building gates, and camp gates.

[0041] This embodiment is an explanation of the communication relationship between the various device terminals in the smart home system and ultimately realizes confidential communication between the ordinary user terminal and the smart home service station, and finally realizes confidential communication with the IoT members within its jurisdiction through the smart home service station. The smart home service station realizes a confidential communication mechanism between the IoT members within its jurisdiction that has been implemented by the existing technology, such as achieving a secure connection through WIFI, Bluetooth or ZIGBEE and other technologies, which is not limited by this patent. The steps for the ordinary user terminal to realize identity authentication with the smart home service station are as follows:

[0042] 1. The witness client and the witness service station realize authentication, that is Figure 1 Events in

[0043] The witness client and the witness service station perform TLS (Transport Layer Security) two-way authentication.

[0044] The witness client and the witness service station complete authentication and negotiate to obtain the session key between the two parties. Here, the session key is set to KS1.

[0045] 2. The smart home service station and the witness service station are authenticated, that is Figure 1 Events in

[0046] The smart home service station and the witness service station perform TLS two-way authentication. The smart home service station and the witness service station complete the authentication and generate a session key KS2 between the two parties.

[0047] 3. The ordinary user obtains the authentication parameters, that is, Figure 1 Events in ③

[0048] 3.1 The ordinary client initiates an authentication parameter request to the witness client;

[0049] 3.2 After receiving the request, the witness client collects the information of the general client and its users through the corresponding module of the device, and transmits the information confidentially to the witness service station. The witness service station saves the information locally and verifies the details in the information. If the verification fails, the witness client is notified to end the subsequent process;

[0050] If the verification is successful, a random number KR is generated, and the session key KS1 is used to encrypt the authentication parameter PR (the PR contains PRID (authentication parameter ID), ordinary user terminal ID, random number KR, validity period, valid positioning area and signature of the witness service station) and send it to the witness user terminal and save it in the witness service station. The witness user terminal decrypts the authentication parameter PR with KS1 and sends it to the ordinary user terminal via short-range communication;

[0051] 3.3 After receiving the authentication parameter message sent by the witness client, the ordinary user terminal stores the authentication parameters in the memory. The ordinary user terminal loses the authentication parameter after power failure, and has certain usage period and usage location restrictions: for example, it is valid for 1 hour or 1 day, and will be destroyed after the timeout; for example, the key is only in an activated state when the mobile terminal is in a legal positioning area, otherwise it is in an invalid state.

[0052] 4. The general user terminal completes the authentication with the smart home service station, that is Figure 1 Events in

[0053] The ordinary user terminal and the smart home service station perform TLS two-way authentication. The ordinary user terminal and the smart home service station complete the authentication and generate the primary session key KS3 between the two parties.

[0054] The smart home service station uses the device information such as the ID of the ordinary user terminal to request the witness service station for the corresponding authentication parameter PR of the user terminal. After obtaining the authentication parameter PR, the smart home service station uses the session key KS3 with the ordinary user terminal to perform MAC algorithm calculation on the random number KR in the authentication parameter to obtain KS4=MAC(KR,KS3), where MAC(m,k) represents the result of the MAC algorithm calculation on the content m using the key k. The ordinary user terminal uses the same method to calculate KS4.

[0055] The ordinary user terminal and the smart home service station use KS4 as the final session key, and both parties communicate confidentially through KS4. If the ordinary user terminal does not have the random number KR issued by the witness user terminal, it cannot communicate normally with the smart home service station.

[0056] The smart home service station transfers messages between ordinary users and IoT members within its jurisdiction, thereby achieving confidential communication between ordinary users and IoT members. For example, ordinary users send control instructions to IoT members, and IoT members send notification messages to ordinary users.

[0057] In summary, the present invention discloses a witness-based authentication and confidential communication method and system for the Internet of Things, which combines a mobile terminal and authentication parameters obtained from a witness. The authentication parameters are stored in the memory of the mobile terminal and will be lost after power failure. There are certain restrictions on the period of use and the location of use, so that in the extreme case where the mobile terminal is lost or stolen, the security of the Internet of Things can still be guaranteed because the enemy cannot obtain the authentication parameters or obtains invalid authentication parameters; the audit requirements for various control instructions of the Internet of Things are met, and the user terminal corresponding to the control instruction and its user's personal information are recorded by the witness user terminal, making the Internet of Things authentication system more secure. This patent can be applied to the authentication and confidential communication between mobile terminals and the Internet of Things in smart home Internet of Things, industrial Internet of Things in factories, military Internet of Things in military camps, etc.

[0058] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0059] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A witness-based authentication and confidential communication method for the Internet of Things, characterized in that: There are smart home service stations, witness service stations, IoT members, witness user terminals and common user terminals; the following steps are included: S1, the witness client and the witness service station perform two-way authentication and generate a first session key through key negotiation; S2, the smart home service station and the witness service station perform two-way authentication and generate a second session key through key negotiation; S3. The common client sends an authentication parameter request to the witness client. S4. After receiving the request, the witness client collects information, including information of the common client and its user, and transmits the information confidentially to the witness service station; S5. The witness service station stores the information locally and verifies the details in the information. If the verification fails, the witness client is notified to end the subsequent process. If the verification succeeds, a random number is generated, and the authentication parameter is encrypted with the first session key to obtain a ciphertext, which is sent to the witness client and stored in the witness service station. The witness client decrypts the ciphertext with the first session key and sends the authentication parameter to the ordinary client via short-distance communication. S6. After receiving the authentication parameter message sent by the witness user terminal, the ordinary user terminal stores the authentication parameters in the memory; S7, the common user terminal and the smart home service station perform two-way authentication and generate a third session key through key negotiation; S8, the smart home service station uses the identity information of the ordinary user terminal to request the witness service station for the corresponding authentication parameters of the user terminal; after obtaining the authentication parameters, the smart home service station and the ordinary user terminal use the third session key to calculate the authentication parameters to obtain a fourth session key; S9. The fourth session key is used for confidential communication between the ordinary user terminal and the smart home service station.

2. According to claim 1, a witness-based Internet of Things authentication and confidentiality communication method is characterized in that: The fourth session key is obtained by calculating the random number in the authentication parameter using the third session key through a message authentication code algorithm.

3. According to any one of the witness-based Internet of Things authentication and confidentiality communication methods described in claim 1, it is characterized in that: In step S5, the details in the information can be checked by calling the ID card authentication system of the Ministry of Public Security to check the ID card, or by calling the information pre-entered by the user at the witness service station for verification.

4. According to claim 1, a witness-based Internet of Things authentication and confidentiality communication method is characterized in that: The authentication parameters in step S5 include the identity information of the authentication parameters, the identity information of the common user terminal, a random number, a validity period, a valid positioning area and a signature of the witness service station.

5. According to the witness-based Internet of Things authentication and confidential communication method of claim 4, the authentication parameters in step S7 are lost after the ordinary user end loses power, and restrictions are imposed on the period of use and location of use.

6. According to the witness-based Internet of Things authentication and confidential communication method of claim 5, the restriction can be valid for 1 hour, 1 day, or only valid when the mobile terminal is in a legal positioning area.

7. According to claim 1, a witness-based authentication and confidential communication method for the Internet of Things, characterized in that: The two-way authentication method is a secure transport layer protocol two-way authentication.

8. According to claim 1, a witness-based authentication and confidential communication method for the Internet of Things, characterized in that: When the ordinary user terminal communicates confidentially with the members of the Internet of Things, the smart home service station realizes message forwarding for the ordinary user terminal and the members of the Internet of Things within its jurisdiction.

9. A witness-based Internet of Things authentication and confidentiality communication system, characterized in that: The steps for implementing the witness-based Internet of Things authentication and confidential communication method as described in any one of claims 1-8 include a smart home service station, a witness service station, a witness user terminal and an ordinary user terminal; the smart home service station is a smart home control center, which is built in the user's home; the ordinary user terminal is a mobile terminal held by the user; the witness user terminal is used to cooperate with the ordinary user terminal to authenticate with the witness service station; the witness service station is deployed in the smart home, in the building where the smart home is located, or in the community where the smart home is located; the witness user terminal is a user terminal deployed at a fixed position, which can be deployed at the gate position and can independently authenticate with the witness service station; the witness user terminal can communicate with the ordinary user terminal in close proximity, and the communication content includes the witness user terminal collecting the ordinary user terminal and its user information; the witness user terminal sends authentication parameters to the ordinary user terminal.

Images