Secure login methods, devices, computer equipment and storage media for Internet of Things (IoT) devices

Abstract

This application relates to a secure login method, apparatus, computer device, and storage medium for Internet of Things (IoT) devices. The method includes: responding to a device login request sent by an IoT device, returning target encrypted data to the IoT device; receiving a decryption result from the IoT device after decrypting the target encrypted data; and, if decryption is successful based on the decryption result, notifying the IoT device of successful decryption; if decryption is successful, receiving authentication information and a random number sent by the IoT device; the random number is generated by the IoT device; verifying the authentication information based on the random number; and, if verification is successful, allowing the IoT device to log in to the server. This method can improve the security of IoT device login.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a secure login method, apparatus, computer device, and storage medium for Internet of Things (IoT) devices. Background Technology

[0002] With the advancement of IoT technology, the application scenarios for IoT devices in smart homes are increasing. In many of these scenarios, IoT devices typically need to log in to a server. To improve login security, servers usually need to verify the identity of the IoT devices.

[0003] In traditional technologies, to improve login security, the password and device ID (Identity Document) of IoT devices are usually verified. Once the verification is successful, the IoT device is allowed to log in to the server.

[0004] However, simply verifying the password and device ID of IoT devices cannot guarantee the security of IoT device login, and therefore the security of IoT device login needs to be improved. Summary of the Invention

[0005] Therefore, it is necessary to provide a secure login method, apparatus, computer device, and storage medium for IoT devices that can improve the security of login for IoT devices, addressing the aforementioned technical problems.

[0006] Firstly, this application provides a secure login method for an Internet of Things (IoT) device. The method includes: responding to a device login request sent by the IoT device, returning target encrypted data to the IoT device; receiving a decryption result returned by the IoT device after decrypting the target encrypted data; and, if decryption is successful based on the decryption result, notifying the IoT device of successful decryption; if decryption is successful, receiving authentication information and a random number sent by the IoT device; the random number being generated by the IoT device; verifying the authentication information based on the random number; and, if verification is successful, allowing the IoT device to log in to the server.

[0007] Secondly, this application also provides a secure login device for IoT devices. The device includes: an encrypted data return module, configured to return target encrypted data to the IoT device in response to a device login request sent by the IoT device; a decryption result confirmation module, configured to receive a decryption result returned by the IoT device after decrypting the target encrypted data, and notify the IoT device of successful decryption if the decryption is successful based on the decryption result; an authentication information receiving module, configured to receive authentication information and a random number sent by the IoT device if decryption is successful; the random number is generated by the IoT device; and a device login verification module, configured to verify the authentication information based on the random number, and allow the IoT device to log in to the server if the verification is successful.

[0008] In some embodiments, the target encrypted data is data obtained by encrypting preset data using a preset encryption key; when the IoT device stores a preset decryption key corresponding to the preset encryption key, the IoT device uses the preset decryption key to decrypt the received target encrypted data, obtains the decryption result, and sends the decryption result to the server.

[0009] In some embodiments, the authentication information sent by the IoT device is first authentication information, which is information obtained by encrypting a pre-stored device password in the IoT device using the random number; the device login verification module is further configured to: search for the device password of the IoT device from the pre-stored device passwords; encrypt the found device password using the random number to generate second authentication information; and allow the IoT device to log in to the server if the first authentication information and the second authentication information are consistent.

[0010] In some embodiments, the first authentication information is information obtained by the IoT device encrypting a device password and device identity information pre-stored in the IoT device using the random number; the device login verification module is further configured to: receive device identity information sent by the IoT device, and use the device identity information to search for the device password of the IoT device from the pre-stored device passwords; the step of encrypting the found device password using the random number to generate the second authentication information includes: encrypting the found device password and the device identity information using the random number to generate the second authentication information.

[0011] In some embodiments, the device login verification module is further configured to: concatenate the random number with the found device password to generate concatenated information; encrypt the concatenated information to generate the second authentication information.

[0012] In some embodiments, the device login verification module is further configured to: encrypt the spliced ​​information using a first encryption method to obtain first encrypted information; encrypt the first encrypted information using a second encryption method, and determine the encryption result as the second authentication information.

[0013] In some embodiments, the server pre-stores identity identifiers corresponding to multiple IoT devices; the device login request carries the identity identifier; the encrypted data return module is further configured to: extract the identity identifier from the device login request in response to the IoT device; and return target encrypted data to the IoT device if it is determined that the extracted identity identifier belongs to the identity identifier pre-stored in the server.

[0014] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps in the above-described secure login method for IoT devices.

[0015] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps in the above-described secure login method for IoT devices.

[0016] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps in the above-described secure login method for IoT devices.

[0017] The aforementioned secure login method, apparatus, computer device, and storage medium for IoT devices respond to a login request sent by an IoT device by returning target encrypted data to the IoT device, receiving the decryption result obtained by decrypting the target encrypted data returned by the IoT device, notifying the IoT device of successful decryption based on the decryption result, and receiving authentication information and a random number (generated by the IoT device) sent by the IoT device. The authentication information is verified based on the random number, and if the verification passes, the IoT device is allowed to log in to the server. The technical solution described in this application, by returning target encrypted data to the IoT device, enables the IoT device to decrypt the target encrypted data, thereby completing the device self-check. If the decryption result is correct, the authentication information sent by the IoT device is verified based on the random number. If the verification passes, the IoT device is allowed to log in to the server. This device self-check and authentication information verification reduces the possibility of unauthorized devices impersonating IoT devices to log in to the server, thus improving the security of IoT device login. Attached Figure Description

[0018] Figure 1 This is an application environment diagram of a secure login method for IoT devices in one embodiment;

[0019] Figure 2 This is a flowchart illustrating a secure login method for IoT devices in one embodiment;

[0020] Figure 3 This is a flowchart illustrating a secure login method for IoT devices in one embodiment;

[0021] Figure 4 This is a flowchart illustrating a secure login method for IoT devices in another embodiment;

[0022] Figure 5 This is a structural block diagram of an IoT device secure login device in one embodiment;

[0023] Figure 6 This is an internal structural diagram of a computer device in one embodiment;

[0024] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0026] The secure login method for IoT devices provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, server 104 communicates with IoT devices 102 and terminal 106 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or located in the cloud or on other network servers. Server 104 can be a server belonging to a production testing system platform, which is used to input device information into IoT devices 102.

[0027] Specifically, in response to the device login request sent by the IoT device 102, the server 104 returns the target encrypted data to the IoT device 102, receives the decryption result obtained by the IoT device 102 in decrypting the target encrypted data, and if the decryption is successful based on the decryption result, the server 104 notifies the IoT device 102 that the decryption is successful. If the decryption is successful, the server 104 receives the authentication information and random number sent by the IoT device 102, verifies the authentication information based on the random number, and allows the IoT device 102 to log in to the server if the verification is successful.

[0028] The IoT device 102 can decrypt the target encrypted data sent by the server 104 and send the decryption result to the server 104. If the decryption is successful, the IoT device 102 generates a random number and generates authentication information based on the random number, and sends the authentication information and the random number to the server 104.

[0029] After receiving a message that the IoT device has successfully logged into the server, terminal 106 can send IoT device control commands to server 104 to control IoT device 102. For example, when IoT device 102 is a smart air conditioner, terminal 106 sends a smart air conditioner turn-on command to server 104. In response to the smart air conditioner turn-on command, server 104 sends a turn-on command to the smart air conditioner to control it to turn on.

[0030] The IoT device 102 can be various smart home devices, such as smart refrigerators, smart printers, smart air conditioners, smart speakers, smart TVs, smart robot vacuums, smart curtains, smart door locks, smart lights, smart gateways, smart control panels, smart switches, etc. The server 104 can be implemented using a standalone server or a server cluster composed of multiple servers. It can also be implemented using a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, security services, and big data and artificial intelligence platforms. The terminal 106 can be, but is not limited to, a mobile terminal, specifically a mobile phone, tablet computer, laptop computer, or smartwatch. The server 104 can also communicate with the IoT device 102 and the terminal 106 through a communication unit, which includes, but is not limited to, at least one of a Wi-Fi communication unit, a Bluetooth communication unit, or a 4G / 5G communication unit.

[0031] Those skilled in the art will understand that Figure 1 The application environments shown are only some scenarios related to the solution of this application and do not constitute a limitation on the application environment of the solution of this application.

[0032] In some embodiments, such as Figure 2 As shown, a secure login method for IoT devices is provided, which can be applied to... Figure 1 Taking server 104 as an example, the following steps are included:

[0033] Step 202: In response to the device login request sent by the IoT device, return the target encrypted data to the IoT device.

[0034] The device login request is the request information used by an IoT device to log in to the server. The login request includes at least one of the following: device information or communication key. Device information includes at least one of the following: device identification number, device password, or model identifier. The identification number uniquely identifies the IoT device and can be a randomly generated numeric or alphanumeric code; it is also called the device ID or UID (User Identification). The device password is the password used by the device to log in to the server. The device password can be generated based on the identification number and is also called the secret key. There is a one-to-one correspondence between the identification number and the device password; each identification number corresponds to a unique device password. The model identifier identifies the device type of the IoT device; it is also called the modelID. The device type refers to the type of IoT device. For example, the device type can be at least one of the following: smart gateway, smart control panel, smart switch, smart refrigerator, smart printer, smart air conditioner, smart speaker, smart TV, smart robot vacuum cleaner, smart curtain, smart door lock, or smart light. When the IoT device type is a smart refrigerator, the model identifier can be represented by BX001. Communication keys are used for encrypted communication between IoT devices and servers and can be pre-stored in IoT devices.

[0035] The target encrypted data refers to the encrypted data generated by the server according to preset encryption rules after receiving a device login request. These preset encryption rules are stored in advance on the server, allowing the server to encrypt data. The preset encryption rules can be symmetric encryption (e.g., ASE) or asymmetric encryption (e.g., RSA). Correspondingly, there are preset decryption rules, which are stored in advance on the IoT device. The IoT device can use these preset decryption rules to decrypt the target encrypted data.

[0036] Specifically, before an IoT device logs into the server, the server receives a login request from the IoT device, obtains the device information from the login request, and verifies whether the IoT device meets the device self-test requirements based on the device information. If the IoT device does not meet the device self-test requirements, the server refuses the device login. If the IoT device meets the device self-test requirements, the server generates target encrypted data according to preset encryption rules and sends the target encrypted data to the IoT device. The device self-test requirements are the requirements for checking the device information of the IoT device.

[0037] In some embodiments, when an IoT device connects to a server, it requests a communication key from the server. The server responds to the request by sending the communication key to the IoT device. After obtaining the communication key, the IoT device can communicate normally with the server. The communication key is used for encrypted communication between the IoT device and the server. The communication key can be dynamically generated by the server. Each time the IoT device connects to the server, it needs to obtain a different communication key each time.

[0038] Step 204: Receive the decryption result returned by the IoT device after decrypting the target encrypted data. If the decryption is successful based on the decryption result, notify the IoT device that the decryption was successful.

[0039] The decryption result is the data obtained by the IoT device parsing the target encrypted data according to preset decryption rules. The preset encryption rules are encryption rules pre-stored in the server. The server can use these preset encryption rules to encrypt data. Preset encryption rules can be symmetric encryption, such as ASE encryption, or asymmetric encryption, such as RSA encryption. Correspondingly, there are preset decryption rules, which are decryption rules pre-stored in the IoT device. The IoT device can use these preset decryption rules to decrypt the target encrypted data.

[0040] Specifically, the server receives the decryption result returned by the IoT device after parsing the target encrypted data. Based on the decryption result, the server determines whether the IoT device has successfully decrypted the data. For example, the server compares the decryption result with the unencrypted data corresponding to the target encrypted data. If the comparison matches, the server determines that the IoT device has successfully decrypted the data and sends a message to the IoT device to notify it of the successful decryption. If the comparison does not match, the server determines that the IoT device has failed to decrypt the data and sends a message to the IoT device to notify it of the failure.

[0041] In some embodiments, the IoT device stores a preset decryption rule corresponding to a preset encryption rule. After receiving the target encrypted data sent by the server, the device parses the target encrypted data according to the preset decryption rule to obtain the decryption result corresponding to the target encrypted data, and then sends the decryption result to the server.

[0042] In some embodiments, the server starts timing from the moment the target encrypted data is sent. If it does not receive a decryption result from the IoT device within a preset time interval, it determines that the IoT device has failed to decrypt, and sends a message to the IoT device notifying it of the decryption failure. The preset time interval is the time interval during which the server receives the decryption result from the IoT device. This time interval can be pre-set or calculated automatically according to certain rules based on statistics of historical time intervals.

[0043] Step 206: If decryption is successful, receive the authentication information and random number sent by the IoT device; the random number is generated by the IoT device.

[0044] The authentication information is used to verify whether an IoT device has the right to log in to the server; it is also known as an authentication signature. The random number is a randomly generated number produced by the IoT device.

[0045] Specifically, after the server notifies the IoT device that the target encrypted data has been successfully decrypted, the IoT device generates a random number, generates authentication information based on the random number and device information, and then sends the authentication information and random number to the server. The server receives the authentication information and random number sent by the IoT device and verifies the authentication information.

[0046] In some embodiments, if decryption fails, the server rejects the login of the IoT device, sends a message to the IoT device notifying it of the decryption failure, and the IoT device cannot perform the steps of generating random numbers and authentication information after receiving the decryption failure message.

[0047] In some embodiments, the random number generated by the IoT device has a validity period. For example, when the IoT device generates a random number for the first time, the time starts from the moment the random number is generated until the moment the IoT device logs into the server for the second time. If the time period is less than the validity period, the random number is valid, and the IoT device can use the random number to generate authentication information and send it to the server. If the time period is greater than the validity period, the random number is invalid, and the IoT device generates a new random number.

[0048] In some embodiments, each time an IoT device logs into the server, a random number is generated. That is, each generated random number is only valid for the current login. When the IoT device logs into the server again, a new random number needs to be generated.

[0049] Step 208: Verify the authentication information based on a random number. If the verification is successful, allow the IoT device to log in to the server.

[0050] Specifically, after receiving a random number and authentication information sent by an IoT device, the server generates encrypted information based on the received random number and device information. The device information is sent to the server by the IoT device, and the encrypted information is used to verify the authentication information. The encrypted information is compared with the authentication information. If they match, the verification is successful, and the server allows the IoT device to log in; otherwise, the verification fails, and the server does not allow the IoT device to log in.

[0051] In some embodiments, both the server and the IoT device store device information, which includes at least one of the following: the IoT device's identification number, device password, or model identifier, such as... Figure 3 As shown, during the production testing phase, the device information is generated by the data backend of the production testing system. Before the IoT devices leave the factory, the production testing system is used to burn the device information into the corresponding IoT devices. After the device information is burned, the production testing system notifies the backend to mark the device information to ensure the uniqueness of the identification number and device password in the device information, and then saves the device information on the server.

[0052] In the aforementioned secure login method for IoT devices, in response to a login request sent by an IoT device, target encrypted data is returned to the IoT device. The decryption result obtained by the IoT device after decrypting the target encrypted data is received. If decryption is successful based on the decryption result, the IoT device is notified of successful decryption. Upon successful decryption, authentication information and a random number (generated by the IoT device) are received from the IoT device. The authentication information is verified based on the random number. If the verification passes, the IoT device is allowed to log in to the server. By returning target encrypted data to the IoT device, enabling the IoT device to decrypt the target encrypted data, a device self-check is completed. If the decryption result is correct, the authentication information sent by the IoT device is verified based on the random number. If the verification passes, the IoT device is allowed to log in to the server. This method verifies device login through device self-check and authentication information, reducing the possibility of unauthorized devices impersonating IoT devices to log in to the server, thereby improving the security of IoT device login.

[0053] In one embodiment, the target encrypted data is data obtained by encrypting preset data using a preset encryption key; if the IoT device stores a preset decryption key corresponding to the preset encryption key, the IoT device uses the preset decryption key to decrypt the received target encrypted data, obtains the decryption result, and sends the decryption result to the server.

[0054] The preset encryption key is the key used to encrypt preset data according to preset encryption rules, and it is stored on the server. A corresponding preset decryption key is used to decrypt the target encrypted data according to preset decryption rules, and it is stored in the IoT device. The preset data is the IoT device's factory data, pre-stored on the server. Factory data refers to data related to the IoT device at the time of its manufacture; for example, it could be the IoT device's manufacturing date or manufacturer information.

[0055] Specifically, when an IoT device receives target encrypted data sent by a server, and if the IoT device stores a preset decryption key corresponding to a preset encryption key, the IoT device uses the preset decryption key to decrypt the received target encrypted data, obtains the decryption result, and sends the decryption result to the server.

[0056] In some embodiments, if the IoT device does not store a preset decryption key corresponding to a preset encryption key, the IoT device cannot decrypt the received target encrypted data, cannot generate a decryption result, and cannot send the decryption result to the server. The server, not receiving the decryption result from the IoT device, notifies the IoT device that decryption failed.

[0057] In some embodiments, the preset encryption key and the preset decryption key are the same. The server and the IoT device each store the same key in advance. The server uses the key to encrypt the preset data to obtain the target encrypted data, which is then sent to the IoT device. The IoT device uses the same key to decrypt the target encrypted data, that is, to restore the target encrypted data to the preset data, obtain the decryption result, and send the decryption result to the server.

[0058] In some embodiments, the preset encryption key and the preset decryption key are different; the preset encryption key and the preset decryption key are a public key and a private key, respectively. For example, the preset encryption key can be a public key, and the preset decryption key is the private key corresponding to the public key. The server uses the public key to encrypt the preset data to obtain the target encrypted data, which is then sent to the IoT device. The IoT device can only decrypt the target encrypted data using the private key corresponding to the public key to obtain the preset data corresponding to the target encrypted data.

[0059] In this embodiment, the IoT device decrypts the target encrypted data using a preset decryption key corresponding to a preset encryption key, thereby determining whether the IoT device can proceed to the next step of logging into the server. This achieves device self-checking and improves the security of IoT device login.

[0060] In one embodiment, the authentication information sent by the IoT device is the first authentication information, which is information obtained by encrypting the device password pre-stored in the IoT device using a random number; step 208 further includes: searching for the device password of the IoT device from the pre-stored device passwords; encrypting the found device password using a random number to generate the second authentication information; and allowing the IoT device to log in to the server if the first authentication information and the second authentication information are consistent.

[0061] The first authentication information is encrypted information obtained by the IoT device using a random number. For example, it can be encrypted information obtained by the IoT device encrypting the device password using a random number. The second authentication information is encrypted information obtained by the server based on the received random number. For example, it can be encrypted information obtained by the server encrypting the pre-stored device password using the received random number.

[0062] Specifically, the server receives the first authentication information, random number, identification number, and model identifier sent by the IoT device. It then searches for the corresponding device password for the IoT device in the device passwords pre-stored on the server. The server encrypts the found device password using the random number to obtain the second authentication information. The server then compares the first authentication information with the second authentication information. If the first authentication information and the second authentication information match, the IoT device is allowed to log in to the server; if the first authentication information and the second authentication information do not match, the IoT device is denied access to the server.

[0063] In some embodiments, the IoT device generates a random number and uses the random number to encrypt the device password stored in the IoT device to obtain first authentication information. Then, the stored identity number, model identifier, generated random number, and first authentication information are sent to the server.

[0064] In this embodiment, the found device password is encrypted using a random number to obtain the second authentication information. If the first authentication information and the second authentication information are consistent, the device is allowed to log in to the server. This realizes the qualification verification of the device logging into the server, reduces the possibility of external fake devices connecting to the platform, and improves the security of IoT device login.

[0065] In one embodiment, the first authentication information is information obtained by encrypting the device password and device identity information pre-stored in the IoT device using a random number; in step 208, searching for the device password of the IoT device from the pre-stored device passwords includes: receiving the device identity information sent by the IoT device, and searching for the device password of the IoT device from the pre-stored device passwords using the device identity information; encrypting the found device password using a random number to generate the second authentication information includes: encrypting the found device password and device identity information using a random number to generate the second authentication information.

[0066] The first authentication information is encrypted information obtained by the IoT device using a random number. For example, it can be encrypted information obtained by the IoT device using a random number to encrypt the device password and device identity information stored in the IoT device in advance. The device identity information is information used to identify the identity of the IoT device, including at least one of the IoT device's identity number or model identifier.

[0067] Specifically, the server receives the first authentication information, a random number, and device identity information sent by the IoT device. Using the device identity information, the server searches for the corresponding device password for the IoT device. For example, the server can use the identification number to find the device password. Then, the server encrypts the found device password, the received identification number, and the model identifier using the random number to obtain the second authentication information. The server then compares the first authentication information with the second authentication information. If the first and second authentication information match, the IoT device is allowed to log in to the server; if they do not match, the server refuses to allow the IoT device to log in.

[0068] In some embodiments, the identification number, device password, and model identifier of an IoT device are referred to as triplet information, such as... Figure 3 As shown, the IoT device generates a random number and uses the random number to encrypt the identity number, device password, and model identifier stored in the IoT device to obtain the first authentication information. Then, the stored identity number, model identifier, generated random number, and first authentication information are sent to the server.

[0069] In this embodiment, the found device password and device identity information are encrypted using random numbers to obtain second authentication information. If the first authentication information and the second authentication information are consistent, the device is allowed to log in to the server. This realizes the qualification verification of the device logging into the server, reduces the possibility of external fake devices connecting to the platform, and improves the security of IoT device login.

[0070] In one embodiment, step 208, encrypting the found device password with a random number to generate second authentication information includes: concatenating the random number with the found device password to generate concatenated information; encrypting the concatenated information to generate second authentication information.

[0071] Among them, concatenated information is information obtained by concatenating multiple data. For example, it can be a string of information obtained by concatenating a random number with the found device password.

[0072] Specifically, the server concatenates the received random number with the found device password to obtain concatenated information, then encrypts the concatenated information, and uses the encrypted information as the second authentication information.

[0073] In some embodiments, the server concatenates the received random number, identification number, model identifier, and found device password to obtain concatenated information, then encrypts the concatenated information, and uses the encrypted information as the second authentication information.

[0074] In this embodiment, by concatenating a random number with the found device password to generate concatenated information, and then encrypting the concatenated information to generate second authentication information, the login of IoT devices can be verified using the second authentication information, thereby improving the security of IoT device login.

[0075] In one embodiment, step 208, encrypting the spliced ​​information to generate second authentication information, includes: encrypting the spliced ​​information using a first encryption method to obtain first encrypted information; encrypting the first encrypted information using a second encryption method, and determining the encrypted result as the second authentication information.

[0076] The first encryption method is an encryption method for encrypting the spliced ​​information, and the first encrypted information is the encrypted information obtained by encrypting the spliced ​​information using the first encryption method. The second encryption method is an encryption method for encrypting the first encrypted information, and the second encrypted information is the encrypted information obtained by encrypting the first encrypted information using the second encryption method.

[0077] Specifically, the server uses a first encryption method to encrypt the concatenated information, obtaining the first encrypted information. For example, the server performs a binary conversion on the concatenated information to obtain a binary sequence, and then groups the binary sequence into groups of 6 bits each. When the last group has less than 6 bits, it pads the lower bits with 0s. It then pads the higher bits of each 6-bit group with 0s, obtaining a new byte. All these new bytes form a new binary sequence. Finally, according to the base64 index table, the server finds the character corresponding to each byte in the new binary sequence to obtain a string, which is used as the first encrypted information. Then, the server uses a second encryption method to encrypt the first encrypted information, and the encrypted result is used as the second authentication information. For example, the server first pads the first encrypted information with a 1, then adds 0s, until the length of the padded first encrypted information is (n×512)+448 bytes. The length of the unpadded first encrypted information is represented by 64 bits, obtaining the padded information, which has a byte length of (n+1)×512. Then, the server uses a linker variable to perform a loop operation on the padded information to obtain the encryption result, which is used as the second authentication information. The link variable is a constant used for loop operations.

[0078] In some embodiments, the server generates the second authentication information in the same way as the IoT device generates the first authentication information, and the second encryption method used is an irreversible encryption algorithm. The irreversible encryption algorithm directly encrypts the plaintext, and the encrypted data cannot be decrypted.

[0079] In this embodiment, by using a first encryption method to encrypt the spliced ​​information to obtain first encrypted information, and using a second encryption method to encrypt the first encrypted information to obtain second authentication information, the security of IoT device login is improved.

[0080] In one embodiment, the server pre-stores the identity identifiers corresponding to multiple IoT devices; the device login request carries the identity identifier; step 202 further includes: in response to the device login request sent by the IoT device, extracting the identity identifier from the device login request; if it is determined that the extracted identity identifier belongs to the identity identifier pre-stored in the server, returning the target encrypted data to the IoT device.

[0081] The identification number is used to uniquely identify IoT devices. The identification number can be a randomly generated numeric or alphanumeric number.

[0082] Specifically, when the server receives a device login request from an IoT device, it parses the request and extracts an identity identifier. This identifier is then searched in the server's database, which contains a list of pre-stored identity identifiers for various IoT devices. If the server finds the extracted identifier, it determines that the extracted identifier belongs to a pre-stored identifier, indicating that the IoT device corresponding to that identifier is qualified to connect to the server. The server then generates target encrypted data and returns it to the IoT device. If the server does not find the extracted identifier, it determines that the extracted identifier does not belong to a pre-stored identifier, indicating that the IoT device corresponding to that identifier is not qualified to connect to the server. The server then notifies the IoT device that the login request failed.

[0083] In this embodiment, by searching for the received identity number from the pre-stored identity numbers corresponding to IoT devices, the legitimacy of the IoT device logging into the server is determined, which can improve the security of IoT device login.

[0084] In some embodiments, such as Figure 4 As shown, a secure login method for IoT devices is provided. Taking the application of this method to a server as an example, the method includes the following steps:

[0085] Step 402: In response to the device login request sent by the IoT device, extract the identity identifier from the device login request.

[0086] Step 404: Confirm whether the extracted identity number belongs to the identity number pre-stored in the server. If not, proceed to step 406; if yes, proceed to step 408.

[0087] Step 406: The login request from the IoT device is rejected, and the IoT device login fails.

[0088] Step 408: Return the target encrypted data to the IoT device.

[0089] The target encrypted data is obtained by encrypting preset data using a preset encryption key.

[0090] Step 410: Receive the decryption result returned by the IoT device after decrypting the target encrypted data. If the decryption is successful based on the decryption result, notify the IoT device that the decryption was successful.

[0091] Step 412: Receive the first authentication information, identity number, model identifier and random number sent by the IoT device.

[0092] The first authentication information is encrypted information obtained by the IoT device by encrypting a random number, identification number, model identifier, and device password. The random number is generated by the IoT device.

[0093] Step 414: Find the device password of the IoT device from the pre-stored device passwords, encrypt the random number, identification number, model identifier and the found device password to obtain the second authentication information.

[0094] The server pre-stores the identification number, model number, and device password of the IoT device, and uses the received identification number to find the device password of the IoT device from the pre-stored device password.

[0095] Step 416: Compare the first authentication information with the second authentication information to determine whether the first authentication information and the second authentication information are consistent. If not, proceed to step 406; if yes, proceed to step 418.

[0096] Step 418: Allow IoT devices to log in to the server. The IoT devices have successfully logged in.

[0097] In this embodiment, by extracting the identity identifier from the device login request, it is determined whether the identity identifier belongs to the identity identifier pre-stored by the server. If it is determined that the identity identifier belongs to the identity identifier pre-stored by the server, the target encrypted data is sent to the IoT device. If the IoT device can successfully parse the target encrypted data and return the decryption result, the next login verification step is performed on the IoT device. The random number generated by the IoT device and the first authentication information are received, and the second authentication information is generated. The first authentication information and the second authentication information are compared. If the first authentication information and the second authentication information are consistent, the IoT device is allowed to log in to the server. This realizes device self-check and device login verification, reduces the possibility of external fake devices connecting to the platform, and improves the security of IoT device login.

[0098] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0099] Based on the same inventive concept, this application also provides an IoT device secure login apparatus for implementing the IoT device secure login method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more IoT device secure login apparatus embodiments provided below can be found in the limitations of the IoT device secure login method described above, and will not be repeated here.

[0100] In one embodiment, such as Figure 5 As shown, an IoT device secure login device is provided, including: an encrypted data return module 502, a decryption result confirmation module 504, an authentication information receiving module 506, and a device login verification module 508, wherein:

[0101] The encrypted data return module 502 is used to return target encrypted data to the IoT device in response to the device login request sent by the IoT device;

[0102] The decryption result confirmation module 504 is used to receive the decryption result returned by the IoT device after decrypting the target encrypted data, and to notify the IoT device that the decryption is successful if the decryption result is confirmed to be successful.

[0103] The authentication information receiving module 506 is used to receive authentication information and a random number sent by the IoT device when decryption is successful; the random number is generated by the IoT device.

[0104] The device login verification module 508 is used to verify the authentication information based on a random number. If the verification is successful, the IoT device is allowed to log in to the server.

[0105] In some embodiments, the target encrypted data is data obtained by encrypting preset data using a preset encryption key; when the IoT device stores a preset decryption key corresponding to the preset encryption key, the IoT device uses the preset decryption key to decrypt the received target encrypted data, obtains the decryption result, and sends the decryption result to the server.

[0106] In some embodiments, the authentication information sent by the IoT device is the first authentication information, which is information obtained by encrypting the device password pre-stored in the IoT device using a random number; the device login verification module is further configured to: search for the device password of the IoT device from the pre-stored device passwords; encrypt the found device password using a random number to generate the second authentication information; and allow the IoT device to log in to the server if the first authentication information and the second authentication information are consistent.

[0107] In some embodiments, the first authentication information is information obtained by encrypting the device password and device identity information pre-stored in the IoT device using a random number; the device login verification module is further configured to: receive the device identity information sent by the IoT device, and use the device identity information to search for the device password of the IoT device from the pre-stored device passwords; encrypting the found device password with a random number to generate the second authentication information includes: encrypting the found device password and device identity information with a random number to generate the second authentication information.

[0108] In some embodiments, the device login verification module is further configured to: concatenate a random number with the found device password to generate concatenated information; encrypt the concatenated information to generate second authentication information.

[0109] In some embodiments, the device login verification module is further configured to: encrypt the spliced ​​information using a first encryption method to obtain first encrypted information; encrypt the first encrypted information using a second encryption method, and determine the encrypted result as second authentication information.

[0110] In some embodiments, the server pre-stores the identification numbers corresponding to multiple IoT devices; the device login request carries the identification number; the encrypted data return module is further configured to: extract the identification number from the device login request in response to the device login request sent by the IoT device; and return the target encrypted data to the IoT device if it is determined that the extracted identification number belongs to the identification number pre-stored in the server.

[0111] The modules in the aforementioned IoT device security login device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0112] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores relevant data related to device login. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements a secure login method for Internet of Things (IoT) devices.

[0113] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a secure login method for Internet of Things (IoT) devices. The display screen can be an LCD screen or an e-ink display screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0114] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0115] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described secure login method for Internet of Things devices.

[0116] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above-described secure login method for IoT devices.

[0117] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above-described secure login method for IoT devices.

[0118] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0119] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0120] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0121] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A secure login method for Internet of Things (IoT) devices, characterized in that, The method comprises: in response to a device login request sent by an Internet of Things device, returning target encrypted data to the Internet of Things device; the target encrypted data is data obtained by encrypting preset data by using a preset encryption key; the preset data is factory data of the Internet of Things device, and the factory data is pre-stored in a server; receiving a decryption result obtained by decrypting the target encrypted data returned by the Internet of Things device, and notifying the Internet of Things device of decryption success in a case where it is determined that decryption is successful based on the decryption result; in a case where decryption is successful, receiving first authentication information and a random number sent by the Internet of Things device; the random number is generated by the Internet of Things device; and the first authentication information is information obtained by encrypting a device password pre-stored in the Internet of Things device by using the random number by the Internet of Things device; finding the device password of the Internet of Things device from the pre-stored device password; splicing the random number and the found device password to generate spliced information; performing binary conversion on the spliced information to obtain a binary sequence; grouping the binary sequence in a manner of each 6-bit group to obtain each 6-bit group; supplementing 00 to a high bit of each 6-bit group to obtain each new byte; generating a new binary sequence based on each new byte; determining a character corresponding to each byte in the new binary sequence according to a base64 index table to obtain a string, and taking the string as first encrypted information; encrypting the first encrypted information by using a second encryption mode, and determining a result of the encryption as second authentication information; the generation mode of the second authentication information is the same as that of the first authentication information; in a case where the first authentication information and the second authentication information are consistent, allowing the Internet of Things device to log in to the server.

2. The method of claim 1, wherein, The target encrypted data is data obtained by encrypting preset data by using a preset encryption key; in a case where the Internet of Things device stores a preset decryption key corresponding to the preset encryption key, the Internet of Things device decrypts the received target encrypted data by using the preset decryption key to obtain the decryption result, and sends the decryption result to the server.

3. The method of claim 1, wherein, The first authentication information is information obtained by encrypting a device password and device identity information pre-stored in the Internet of Things device by using the random number by the Internet of Things device; The finding of the device password of the Internet of Things device from the pre-stored device password comprises: receiving device identity information sent by the Internet of Things device, and finding the device password of the Internet of Things device from the pre-stored device password by using the device identity information.

4. The method of claim 1, wherein, The server pre-stores identity identification numbers corresponding to a plurality of Internet of Things devices respectively; The device login request carries the identity identification numbers; The returning of the target encrypted data to the Internet of Things device in response to the device login request sent by the Internet of Things device comprises: extracting identity identification numbers from the device login request in response to the device login request sent by the Internet of Things device; In a case where the extracted identity number is determined to belong to the identity numbers pre-stored in the server, target encrypted data is returned to the Internet of Things device.

5. An Internet of Things device secure onboarding apparatus, comprising: The apparatus comprises: An encrypted data returning module, configured to return target encrypted data to the Internet of Things device in response to a device login request sent by the Internet of Things device; the target encrypted data is data obtained by encrypting preset data by using a preset encryption key; the preset data is factory data of the Internet of Things device, and the factory data is pre-stored in a server; A decryption result confirming module, configured to receive a decryption result obtained by decrypting the target encrypted data returned by the Internet of Things device, and notify the Internet of Things device of decryption success in a case where the decryption is determined to be successful based on the decryption result; An authentication information receiving module, configured to receive first authentication information and a random number sent by the Internet of Things device in a case where the decryption is successful; the random number is generated by the Internet of Things device; and the first authentication information is information obtained by encrypting a device password pre-stored in the Internet of Things device by using the random number by the Internet of Things device; A device login verifying module, configured to find the device password of the Internet of Things device from the pre-stored device passwords, splice the random number and the found device password to generate spliced information, perform binary conversion on the spliced information to obtain a binary sequence, group the binary sequence in a manner of each 6-bit group to obtain each 6-bit group, add 00 to the high bit of each 6-bit group to obtain each new byte, generate a new binary sequence based on each new byte, determine a character corresponding to each byte in the new binary sequence according to a base64 index table to obtain a string, and use the string as first encrypted information; encrypt the first encrypted information by using a second encryption manner, and determine the result of the encryption as second authentication information; the second authentication information is generated in the same manner as the first authentication information; and the Internet of Things device is allowed to log in to the server in a case where the first authentication information and the second authentication information are consistent.

6. The apparatus of claim 5, wherein, The target encrypted data is data obtained by encrypting preset data by using a preset encryption key; in a case where the Internet of Things device stores a preset decryption key corresponding to the preset encryption key, the Internet of Things device decrypts the received target encrypted data by using the preset decryption key to obtain the decryption result, and sends the decryption result to the server.

7. The apparatus of claim 5, wherein, The first authentication information is information obtained by encrypting a device password and device identity information pre-stored in the Internet of Things device by using the random number by the Internet of Things device; The device login verifying module is further configured to: Receive device identity information sent by the Internet of Things device, and find the device password of the Internet of Things device from the pre-stored device passwords by using the device identity information. 8.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-7. The processor, when executing the computer program, implements the steps of the method in any one of claims 1 to 4.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, which when executed by a processor, implements the steps of the method of any one of claims 1 to 4.

10. A computer program product comprising a computer program, characterized in that, The computer program, which when executed by a processor, implements the steps of the method of any one of claims 1 to 4.

Images