Internet of Things access authentication method and device

Abstract

The present invention provides an Internet of Things access authentication method and device, including: when an access terminal device needs to access an Internet of Things platform, the access terminal device obtains the current time; generates a user name of the access terminal device according to the product category identification and the current time of the access terminal device; generates a client identification of the access terminal device according to the device number of the access terminal device; generates an authentication password according to the user name and the client identification; sends the authentication password, the client identification and the user name to the Internet of Things platform, so that the Internet of Things platform performs authentication, and establishes a connection with the access terminal device when the authentication is passed. The present invention can strengthen the security of the Internet of Things system.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to an Internet of Things access authentication method and device. Background Art

[0002] With the advancement of digitalization, IoT technology has developed rapidly around themes such as smart manufacturing, smart cities, smart buildings, and smart homes. The MQTT (Message Queuing Telemetry Transport) protocol uses a subscription and publishing mechanism because it occupies little bandwidth and has good reliability. Subscribers only receive data they have subscribed to, and do not receive non-subscribed data. This ensures the exchange of necessary data and avoids the storage and processing of invalid data. Therefore, it is widely used in the IoT.

[0003] At present, the IoT system architecture based on MQTT is as follows Figure 1 As shown, the IoT platform is used to realize cloud computing, cloud storage, data analysis, and front-end data application of the IoT system. The IoT gateway is used to realize Internet access of heterogeneous networks, such as zigbee gateway, Bluetooth gateway, LoRa gateway, etc. IoT devices are devices that directly access the IoT platform through the Internet. For example, industrial computers with network cards and industrial equipment with network cards. The IoT edge server is a device that aggregates data from edge IoT devices and IoT gateways for analysis and edge storage to unify the interaction between edge nodes and the IoT platform. IoT gateways, IoT devices, and IoT edge servers are all access devices for the IoT platform.

[0004] The overall security of the above IoT system is not strong enough and there are many risks. First, the MQTT username and password are relatively fixed. Once leaked, there is a risk of illegal access to the MQTT server, and it will also bring the hidden danger of DDOS (Distributed Denial of Service) attacks consuming MQTT server resources; secondly, when the program or firmware of the IoT access device is illegally cloned and copied, the devices that are online at the same time will interfere with the normal operation of the entire IoT system. Summary of the invention

[0005] To solve the above problems, the present invention provides an Internet of Things access authentication method and device to enhance the security of the Internet of Things system.

[0006] On the one hand, the present invention provides an Internet of Things access authentication method, which is applied to an access terminal device, comprising:

[0007] Get the current time when you need to access the IoT platform;

[0008] Generate a user name of the access terminal device according to the product category identifier of the access terminal device and the current time;

[0009] Generate a client ID of the access terminal device according to the device number of the access terminal device;

[0010] Generate an authentication password based on the username and client ID;

[0011] The authentication password, client ID, and user name are sent to the IoT platform so that the IoT platform can authenticate and establish a connection with the access terminal device if the authentication is successful.

[0012] Optionally, generate an authentication password based on the user name and client identifier, including:

[0013] Generate a first combination according to the client identifier and the user name;

[0014] Call the USB shield bound to the device number, use the SM3 algorithm built into the USB shield to process the first combination, obtain a first SM3 summary value, and use the SM2 algorithm built into the USB shield to sign the first SM3 summary value with the USB shield private key to obtain an SM2 digital signature;

[0015] Encode the SM2 digital signature to obtain the authentication password.

[0016] Optionally, generating a client identifier of the access terminal device according to the device number of the access terminal device includes:

[0017] Generate a client ID based on the device number and a random string.

[0018] Optionally, it also includes:

[0019] Receive the authentication result returned by the IoT platform, which can be either authentication passed or authentication failed.

[0020] On the other hand, the present invention provides an Internet of Things access authentication method, which is applied to an Internet of Things platform, comprising:

[0021] Receive the authentication password, client identifier and user name sent by the access terminal device, where the user name is generated by the access terminal device according to the product category identifier of the access terminal device and the current time obtained by the access terminal device when it needs to access the Internet of Things platform, the client identifier is generated by the access terminal device according to the device number of the access terminal device, and the authentication password is generated by the access terminal device according to the user name and client identifier;

[0022] Authenticate the authentication password, client ID, and user name;

[0023] If the authentication is successful, a connection is established with the access device.

[0024] Optionally, the authentication password is generated by the access terminal device according to the user name and the client identifier, specifically including: generating a first combination according to the client identifier and the user name; calling the U shield bound to the device number, using the SM3 algorithm built into the U shield to process the first combination to obtain a first SM3 summary value, and using the SM2 algorithm built into the U shield to sign the first SM3 summary value with the U shield private key to obtain an SM2 digital signature; encoding the SM2 digital signature to obtain the authentication password;

[0025] Authenticate the authentication password, client ID, and user name, including:

[0026] Generate a second combination according to the client identifier and the user name, and process the second combination using the SM3 algorithm built into the IoT platform to obtain a second SM3 summary value;

[0027] Obtain the SM2 digital signature by decoding the authentication password;

[0028] The device number of the access device is obtained from the client identifier, and the SM2 algorithm built into the IoT platform is used to verify the SM2 digital signature through the U-Shield public key bound to the device number;

[0029] If the signature verification passes, the first SM3 summary value is obtained;

[0030] Compare the first SM3 digest value and the second SM3 digest value; if the first SM3 digest value and the second SM3 digest value are the same, the authentication is successful; if the first SM3 digest value and the second SM3 digest value are different, the authentication fails and no connection is established with the access terminal device.

[0031] Optionally, before authenticating the authentication password, client identifier, and user name, the following steps are also included:

[0032] Obtain the current time of the access terminal device from the user name when it needs to access the IoT platform;

[0033] Determine whether the difference between the current time obtained by the access terminal device when it needs to access the IoT platform and the current time when the IoT platform receives the authentication password, client identifier and user name is within the set time range;

[0034] If the difference is within the set time range, the authentication password, client ID and user name are authenticated.

[0035] If the difference is not within the set time range, the authentication fails.

[0036] Optionally, the method further includes: returning an authentication result to the access terminal device, where the authentication result is authentication passed or authentication failed.

[0037] On the other hand, the present invention provides an Internet of Things access authentication device, which is applied to an access terminal device, comprising:

[0038] The time acquisition module is used to obtain the current time when access to the IoT platform is required;

[0039] A first generating module, used to generate a user name of the access terminal device according to a product category identifier of the access terminal device and a current time;

[0040] A second generating module is used to generate a client identifier of the access terminal device according to the device number of the access terminal device;

[0041] The third generation module is used to generate an authentication password according to the user name and the client identifier;

[0042] The authentication data sending module is used to send the authentication password, client identifier and user name to the Internet of Things platform so that the Internet of Things platform can perform authentication and establish a connection with the access terminal device if the authentication is successful.

[0043] Optionally, the third generating module is specifically used to: generate a first combination according to the client identifier and the user name;

[0044] Call the USB shield bound to the device number, use the SM3 algorithm built into the USB shield to process the first combination, obtain a first SM3 summary value, and use the SM2 algorithm built into the USB shield to sign the first SM3 summary value with the USB shield private key to obtain an SM2 digital signature;

[0045] Encode the SM2 digital signature to obtain the authentication password.

[0046] Optionally, the second generating module is used to generate a client identifier according to the device number and the random character string.

[0047] Optionally, the device also includes: an authentication result receiving module, which is used to receive the authentication result returned by the Internet of Things platform, and the authentication result is authentication passed or authentication failed.

[0048] On the other hand, the present invention provides an Internet of Things access authentication device, which is applied to an Internet of Things platform, comprising:

[0049] An authentication data receiving module is used to receive an authentication password, a client identifier and a user name sent by an access terminal device, wherein the user name is generated by the access terminal device according to the product category identifier of the access terminal device and the current time obtained by the access terminal device when the access terminal device needs to access the Internet of Things platform, the client identifier is generated by the access terminal device according to the device number of the access terminal device, and the authentication password is generated by the access terminal device according to the user name and the client identifier;

[0050] Authentication module, used to authenticate the authentication password, client identifier and user name;

[0051] The connection module is used to establish a connection with the access terminal device when the authentication is passed.

[0052] Optionally, the authentication password is generated by the access terminal device according to the user name and the client identifier, specifically including: generating a first combination according to the client identifier and the user name; calling the U shield bound to the device number, using the SM3 algorithm built into the U shield to process the first combination to obtain a first SM3 summary value, and using the SM2 algorithm built into the U shield to sign the first SM3 summary value with the U shield private key to obtain an SM2 digital signature; encoding the SM2 digital signature to obtain the authentication password;

[0053] Authentication module, specifically used for:

[0054] Generate a second combination according to the client identifier and the user name, and process the second combination using the SM3 algorithm built into the IoT platform to obtain a second SM3 summary value;

[0055] Obtain the SM2 digital signature by decoding the authentication password;

[0056] The device number of the access device is obtained from the client identifier, and the SM2 algorithm built into the IoT platform is used to verify the SM2 digital signature through the U-Shield public key bound to the device number;

[0057] If the signature verification passes, the first SM3 summary value is obtained;

[0058] Compare the first SM3 digest value and the second SM3 digest value; if the first SM3 digest value and the second SM3 digest value are the same, the authentication is successful; if the first SM3 digest value and the second SM3 digest value are different, the authentication fails and no connection is established with the access terminal device.

[0059] Optionally, the device further comprises: a time difference judgment module, which is used to obtain the current time obtained by the access terminal device when it needs to access the Internet of Things platform from the user name before authenticating the authentication password, the client identifier and the user name;

[0060] Determine whether the difference between the current time obtained by the access terminal device when it needs to access the IoT platform and the current time when the IoT platform receives the authentication password, client identifier and user name is within the set time range;

[0061] If the difference is within the set time range, the authentication module performs the steps of authenticating the authentication password, client identification and user name;

[0062] If the difference is not within the set time range, the authentication fails.

[0063] Optionally, the apparatus further includes: an authentication result sending module, configured to return an authentication result to the access terminal device, wherein the authentication result is authentication passed or authentication failed.

[0064] In another aspect, the present invention provides an Internet of Things system, comprising:

[0065] An access terminal device, used to implement the above-mentioned Internet of Things access authentication method applied to the access terminal device;

[0066] An Internet of Things platform, used to implement the Internet of Things access authentication method applied to the Internet of Things platform;

[0067] U shield, with built-in SM3 algorithm and SM2 algorithm, is connected to the access end device.

[0068] The Internet of Things access authentication method and device provided by the present invention generates a client identification, user name and authentication password of the access terminal device on the access terminal device, wherein the authentication password is generated by calling a U shield bound to the device number of the access terminal device, and the U shield has a built-in national secret algorithm, and generates an authentication password according to the client identification and user name of the access terminal device, and then sends the authentication password, client identification and user name to the Internet of Things platform to enable the Internet of Things platform to perform authentication; if the authentication is successful, the Internet of Things platform establishes a connection with the access terminal device, and if the authentication fails, the Internet of Things platform refuses to connect to the access terminal device. An Internet of Things access authentication method provided by an embodiment of the present invention strengthens the security of the Internet of Things system. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 This is a schematic diagram of the existing IoT system architecture;

[0070] Figure 2 A flowchart of an Internet of Things access authentication method provided by an embodiment of the present invention;

[0071] Figure 3 A flowchart of an Internet of Things access authentication method provided by an embodiment of the present invention;

[0072] Figure 4 This is a timing diagram of the MQTT access authentication process according to an embodiment of the present invention;

[0073] Figure 5 A schematic diagram of the structure of an Internet of Things access authentication device provided by an embodiment of the present invention;

[0074] Figure 6 A schematic diagram of the structure of an Internet of Things access authentication device provided by an embodiment of the present invention;

[0075] Figure 7 A schematic diagram of an Internet of Things system architecture provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0076] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0077] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0078] Figure 2 FIG. 1 is a flow chart of an IoT access authentication method provided by an embodiment of the present invention. The method is applied to an access terminal device, such as Figure 2 As shown, the method may include steps S201-S205.

[0079] In step S201, the current time is obtained when access to the Internet of Things platform is required.

[0080] It is explained here that the situation where access to the Internet of Things platform is required may be when the access-end device receives an access instruction or when the access-end device is started.

[0081] The access device obtains the current time, for example, synchronizes the UTC time to the local device and obtains the current UTC time. UTC time is also known as the world unified time, world standard time, and international coordinated time.

[0082] In step S202, a user name of the access terminal device is generated according to the product category identifier of the access terminal device and the current time.

[0083] In the embodiment of the present invention, the user name of the access terminal device may be generated according to the product category identifier and the UTC timestamp of the access terminal device.

[0084] ProductID: Product ID, i.e., product category identification. The same product ID indicates products of the same category and model with the same functions (can be the product ID of IoT gateways, IoT devices, IoT edge servers). For example, a zigbee gateway and an RS485 industrial gateway based on a certain hardware solution are two types of products. The product ID is used to distinguish product types and specific models. The product ID is burned and stored in the access terminal device before leaving the factory.

[0085] The user name of the access device is composed of the product ID + UTC timestamp, the time unit is seconds, separated by a vertical bar (|). For example, if the product ID is "TEST_ABCD", the current Beijing time is 2022-06-27 16:35:00, and the corresponding UTC timestamp is "1656318900", then the user name is "TEST_ABCD|1656318900".

[0086] In step S203, a client identifier of the access terminal device is generated by using the device number of the access terminal device.

[0087] In the embodiment of the present invention, the client identifier of the access terminal device may be generated according to the device number of the access terminal device and a random character string.

[0088] DeviceID: Device ID, or device number, is the ID of a specific device that belongs to a certain product ID. For example, for a certain model of RS485 industrial gateway, the product ID is the same, but the device ID of each gateway produced is different and globally unique on the IoT platform. The device ID is burned and stored in the access device before leaving the factory, and is associated and bound with the public key PublicKey of the U shield on the IoT platform before leaving the factory.

[0089] ClientID: Client ID. Both the access device and the IoT platform must use ClientID to identify the status of the corresponding MQTT session they hold. It must be globally unique.

[0090] The client ID can be composed of the device number + a 6-byte random string connected by "&&". For example, if the device number is "TESTabcdefg" and the 6-byte random string is "123456", the client ID is "TESTabcdefg&&123456".

[0091] In step S204, an authentication password is generated according to the user name and the client identifier.

[0092] In the embodiment of the present invention, the authentication password can be generated according to the client identifier ClientID and the user name UserName by calling the USB shield bound to the device number of the access terminal device. Specifically including:

[0093] The first step is to generate a first combination according to the client identifier ClientID and the user name UserName. The first combination is generated by the following method: ClientID is combined with UserName, for example, if ClientID is "TESTabcdefg&&123456" and UserName is "TEST_ABCD|1656318900", then the first combination is "TESTabcdefg&&123456TEST_ABCD|1656318900".

[0094] In the second step, the access end device calls the USB shield bound to the device ID, uses the SM3 algorithm built into the USB shield to process the first combination, and generates the first SM3 summary value. The SM3 algorithm is a domestic hash algorithm, and the relevant standard is "GM / T0004-2012 SM3 Cryptographic Hash Algorithm".

[0095] In the third step, the access device continues to call the bound USB shield, uses the built-in SM2 algorithm of the USB shield, signs the first SM3 digest value with the USB shield private key, and generates an SM2 digital signature. The SM2 algorithm is a more advanced and secure algorithm, which is used to replace the RSA algorithm in our country's commercial encryption system.

[0096] The fourth step is to encode the SM2 digital signature and generate the authentication password Password.

[0097] For example, the SM2 digital signature can be Base64 encoded to generate the authentication password Password. Base64 is one of the common encoding methods for transmitting 8-bit bytecodes, but is not limited to this encoding method.

[0098] In step S205, the authentication password, the client identifier and the user name are sent to the IoT platform so that the IoT platform performs authentication and establishes a connection with the access terminal device if the authentication is successful.

[0099] In another embodiment of the present invention, after executing step S205, the method further includes:

[0100] Receive the authentication result returned by the IoT platform, which can be either authentication passed or authentication failed.

[0101] An IoT access authentication method provided by an embodiment of the present invention is applied to an access terminal device, and generates a client identifier, a user name, and an authentication password of the access terminal device on the access terminal device, wherein the authentication password is generated by calling a U-shield bound to the device number of the access terminal device, and the U-shield has a built-in national secret algorithm, and generates an authentication password according to the client identifier and user name of the access terminal device, and then sends the authentication password, client identifier, and user name to the IoT platform to enable the IoT platform to perform authentication; if the authentication is successful, the IoT platform establishes a connection with the access terminal device, and if the authentication fails, the IoT platform refuses to connect to the access terminal device. An IoT access authentication method provided by an embodiment of the present invention strengthens the security of the IoT system.

[0102] Figure 3 FIG. 1 is a flow chart of an Internet of Things access authentication method provided by an embodiment of the present invention. The method is applied to an Internet of Things platform, such as Figure 3 As shown, the method may include steps S301-S303.

[0103] In step S301, an authentication password, a client identifier and a user name sent by an access terminal device are received, wherein the user name is generated by the access terminal device according to a product category identifier of the access terminal device and a current time obtained when the access terminal device needs to access an Internet of Things platform, the client identifier is generated by the access terminal device according to a device number of the access terminal device, and the authentication password is generated by the access terminal device according to the user name and the client identifier.

[0104] In step S302, the authentication password, client identification and user name are authenticated.

[0105] In an embodiment of the present invention, the authentication password is generated by the access terminal device according to the client identifier and the user name, specifically including: generating a first combination according to the client identifier and the user name; calling the USB shield bound to the device number, using the SM3 algorithm built into the USB shield to process the first combination, and generating a first SM3 summary value; continuing to call the bound USB shield, using the SM2 algorithm built into the USB shield, signing the first SM3 summary value with the USB shield private key, and obtaining an SM2 digital signature; encoding the SM2 digital signature to obtain the authentication password.

[0106] The certification process may include:

[0107] A second combination is generated according to the client identifier ClientID and the user name UserName. The second combination is generated in the same way as the first combination, that is, ClientID and UserName are combined. For example, if ClientID is "TESTabcdefg&&123456" and UserName is "TEST_ABCD|1656318900", then the first combination is "TESTabcdefg&&123456TEST_ABCD|1656318900".

[0108] The second combination is processed using the SM3 algorithm built into the IoT platform to generate a second SM3 summary value.

[0109] Decode the authentication password to obtain the SM2 digital signature. If the authentication password is encoded in base64, decode the authentication password in base64.

[0110] The device number of the access device is obtained from the client identifier, and the SM2 algorithm built into the IoT platform is used to verify the SM2 digital signature through the U-Shield public key bound to the device number; if the verification passes, the first SM3 summary value is obtained.

[0111] The first SM3 digest value is compared with the second SM3 digest value. If the two are the same, the authentication succeeds; if the two are different, the authentication fails.

[0112] In the embodiment of the present invention, after the authentication is completed, the IoT platform will return the authentication result to the access terminal device, and the authentication result is authentication passed or authentication failed. For example, if the authentication is passed, the authentication result is assigned a value of 0x00, indicating that the connection is allowed. If the authentication fails, the authentication result is assigned a value of 0x05, indicating that the connection is rejected.

[0113] In step S303, if the authentication is successful, a connection is established with the access terminal device.

[0114] In another embodiment of the present invention, before authenticating the authentication password, the client identifier and the user name, the method further includes:

[0115] Obtain the current time of the access terminal device from the user name when it needs to access the IoT platform;

[0116] Determine whether the difference between the current time obtained by the access terminal device when it needs to access the IoT platform and the current time when the IoT platform receives the authentication password, client identifier and user name is within the set time range;

[0117] If the difference is within the set time range, the authentication password, client ID and user name are authenticated.

[0118] If the difference is not within the set time range, the authentication fails.

[0119] The set time can be set to 15 seconds, or other values, without special limitation.

[0120] An Internet of Things access authentication method provided by an embodiment of the present invention is applied to an Internet of Things platform. The Internet of Things platform receives a client identifier, a user name, and an authentication password of an access terminal device sent by an access terminal device; the authentication password, the client identifier, and the user name are authenticated; if the authentication is successful, the access terminal device is allowed to establish a connection with the Internet of Things platform; if the authentication fails, the access terminal device is denied connection to the Internet of Things platform. An Internet of Things access authentication method provided by an embodiment of the present invention strengthens the security of the Internet of Things system.

[0121] Figure 4 A timing diagram of an embodiment of the IoT platform access authentication process is shown. It should be noted that the embodiment of the present invention takes the MQTT protocol as an example, but does not limit whether the network protocol is MQTT. This solution can also be applied to other network protocols. The access terminal device (including the IoT gateway, IoT device, IoT edge server) needs to be plugged in with a U-shield with a built-in national encryption algorithm, and the MQTT access authentication process must be completed before it can connect to the IoT platform. Without the U-shield, it is impossible to connect to the IoT platform.

[0122] In step 1, the access terminal device is started and needs to be connected to the IoT platform.

[0123] In step 2, the access device synchronizes the UTC time to the local device and obtains the current UTC time.

[0124] In step 3.1, the access end device obtains the device ID burned and stored before the product leaves the factory, combines it with the randomly generated string, and connects them through "&&" to generate the client identifier ClientID.

[0125] In step 3.2, the access device obtains the product ID burned and stored before the product leaves the factory, separates it with a vertical bar (|), and then combines it with the world standard time UTC timestamp to generate the user name UserName.

[0126] In steps 3.3 to 8, the access device combines ClientID and UserName, with ClientID in front and UserName in the back, to obtain the first combination. Then, according to the device ID, the U-shield interface of the U-shield bound to the device ID is called, and the SM3 algorithm built into the U-shield is used to process the first combination to obtain the 32-byte first SM3 digest value. Then, the U-shield is called again, and the SM2 algorithm built into the U-shield is used to sign the first SM3 digest value according to the U-shield private key, generate an SM2 digital signature, and base64 encode the SM2 digital signature to obtain the authentication password Password.

[0127] In step 9, the access device sends the MQTT authentication package containing ClientID, UserName and Password to the IoT platform.

[0128] In step 10.1, when the IoT platform receives the MQTT authentication package, it determines whether the difference between the UTC timestamp in the UserName in the MQTT authentication package and the current UTC time is within 15 seconds (the preset value can be adjusted according to the actual situation. If the historical data packet is replayed in the future, the time difference will be longer). If it is within the preset value, the next step is determined. If it is not within the preset value, the authentication fails, and the IoT platform returns the authentication result return package ConnectACK to the access terminal device. The value of ConnectACK is 0x05, indicating that the connection is rejected and the authentication is completed. Figure 4 Only the case where the time difference satisfies the preset value and the next step of judgment is shown. This step can reduce the possibility of data packets being replayed.

[0129] In step 10.2, the IoT platform calls the USB interface of the USB bound to the DeviceID according to the DeviceID, and uses the built-in SM3 algorithm of the IoT platform to process the second combination of ClientID and UserName in the MQTT authentication package to generate a 32-byte second SM3 digest value.

[0130] In step 10.3, the IoT platform performs base64 decoding on the authentication password in the MQTT authentication package, obtains the SM2 digital signature, and then retrieves the U-shield public key bound to the DeviceID from the IoT platform database (a pair with the U-shield private key, private key signature, public key signature verification), uses the built-in SM2 algorithm of the IoT platform, and verifies the SM2 digital signature according to the bound U-shield public key. If the signature verification passes, obtain the first SM3 digest value; compare the first SM3 digest value with the second SM3 digest value generated in step 10.2 to see if they are consistent, and return ConnectACK to the access terminal device based on the comparison result. This step is to prevent hijacking and tampering during data transmission.

[0131] In step 11, if the digest values ​​are consistent, it means that the transmitted data has not been hijacked or tampered with, and the digital signature is generated by the USB shield bound to the DeviceID. If the authentication is successful, ConnectACK returns 0x00, indicating that the connection is allowed, and the access-end device (including IoT gateways, IoT devices, and IoT edge servers) is successfully connected to the IoT platform; if the two are inconsistent, it means that the transmitted data has been hijacked or tampered with, or the user end is an illegally cloned device, and there is no bound USB shield access, and the authentication fails, then ConnectACK returns 0x05, indicating that the connection is rejected, and the access-end device (including IoT gateways, IoT devices, and IoT edge servers) cannot connect to the IoT platform.

[0132] Figure 5 5 is a schematic diagram of the structure of an IoT access authentication device provided by an embodiment of the present invention. As shown in FIG5 , the device is applied to an access terminal device, and includes: a time acquisition module 501, a first generation module 502, a second generation module 503, a third generation module 504 and an authentication data sending module 505, wherein:

[0133] The time acquisition module 501 is used to obtain the current time when access to the Internet of Things platform is required;

[0134] A first generating module 502, configured to generate a user name of the access terminal device according to a product category identifier of the access terminal device and a current time;

[0135] The second generating module 503 is used to generate a client identifier of the access terminal device according to the device number of the access terminal device;

[0136] The third generating module 504 is used to generate an authentication password according to the user name and the client identifier;

[0137] The authentication data sending module 505 is used to send the authentication password, client identifier and user name to the Internet of Things platform so that the Internet of Things platform can perform authentication and establish a connection with the access terminal device if the authentication is successful.

[0138] Further, as an implementation mode, the third generating module 504 is specifically used to: generate a first combination according to the client identifier and the user name;

[0139] Call the USB shield bound to the device number, use the SM3 algorithm built into the USB shield to process the first combination, obtain a first SM3 summary value, and use the SM2 algorithm built into the USB shield to sign the first SM3 summary value with the USB shield private key to obtain an SM2 digital signature;

[0140] Encode the SM2 digital signature to obtain the authentication password.

[0141] As an implementation manner, the second generating module 503 is used to generate a client identifier according to the device number and the random character string.

[0142] As an implementation mode, the device further includes: an authentication result receiving module, which is used to receive the authentication result returned by the Internet of Things platform, and the authentication result is authentication passed or authentication failed.

[0143] It can be understood that the Internet of Things access authentication device provided in an embodiment of the present invention is used to execute the above-mentioned Internet of Things access authentication method embodiment applied to the access terminal device. Its specific process and detailed content can refer to the above-mentioned method embodiment and have the same technical effect.

[0144] Figure 6 6, the device is applied to the Internet of Things platform, including: an authentication data receiving module 601, an authentication module 602 and a connection module 603, wherein:

[0145] The authentication data receiving module 601 is used to receive the authentication password, client identifier and user name sent by the access terminal device, where the user name is generated by the access terminal device according to the product category identifier of the access terminal device and the current time obtained by the access terminal device when the access terminal device needs to access the Internet of Things platform, the client identifier is generated by the access terminal device according to the device number of the access terminal device, and the authentication password is generated by the access terminal device according to the user name and the client identifier;

[0146] Authentication module 602, used to authenticate the authentication password, client identification and user name;

[0147] The connection module 603 is used to establish a connection with the access terminal device when the authentication is successful.

[0148] With reference to the description of the aforementioned embodiment, in the embodiment of the present invention, the client identifier of the access terminal device is generated based on the device number of the access terminal device and a random string. The user name of the access terminal device is generated based on the product category identifier and the UTC timestamp of the access terminal device. The authentication password is generated based on the client identifier and the user name, specifically including: generating a first combination based on the client identifier and the user name; calling the U shield bound to the device number, using the SM3 algorithm built into the U shield to process the first combination to obtain a first SM3 summary value, and using the SM2 algorithm built into the U shield to sign the first SM3 summary value through the U shield private key to obtain an SM2 digital signature; encoding the SM2 digital signature to obtain an authentication password.

[0149] Further, as an implementation, the authentication module 602 is specifically configured to:

[0150] Generate a second combination according to the client identifier and the user name, and process the second combination using the SM3 algorithm built into the IoT platform to obtain a second SM3 summary value;

[0151] Obtain the SM2 digital signature by decoding the authentication password;

[0152] The device number of the access device is obtained from the client identifier, and the SM2 algorithm built into the IoT platform is used to verify the SM2 digital signature through the U-Shield public key bound to the device number;

[0153] If the signature verification passes, the first SM3 summary value is obtained;

[0154] Compare the first SM3 digest value and the second SM3 digest value; if the first SM3 digest value and the second SM3 digest value are the same, the authentication is successful; if the first SM3 digest value and the second SM3 digest value are different, the authentication fails and no connection is established with the access terminal device.

[0155] As an implementation mode, the device further includes: a time difference judgment module, which is used to obtain the current time obtained by the access terminal device when it needs to access the Internet of Things platform from the user name before authenticating the authentication password, the client identifier and the user name;

[0156] Determine whether the difference between the current time obtained by the access terminal device when it needs to access the IoT platform and the current time when the IoT platform receives the authentication password, client identifier and user name is within the set time range;

[0157] If the difference is within the set time range, the authentication module performs the steps of authenticating the authentication password, client identification and user name;

[0158] If the difference is not within the set time range, the authentication fails.

[0159] As an implementation mode, the apparatus further includes: an authentication result sending module, which is used to return the authentication result to the access terminal device, where the authentication result is authentication passed or authentication failed.

[0160] It can be understood that the Internet of Things access authentication device provided in an embodiment of the present invention is used to execute the above-mentioned Internet of Things access authentication method embodiment applied to the Internet of Things platform. Its specific process and detailed content can refer to the above-mentioned method embodiment and have the same technical effect.

[0161] On the other hand, another embodiment of the present invention provides an Internet of Things system, which strengthens the security of the Internet of Things system based on the national secret algorithm U shield.

[0162] Figure 7 This is a schematic diagram of the architecture of the IoT system. Figure 7 As shown, the IoT system includes: access terminal equipment, IoT platform and U shield with built-in national encryption algorithm. The access terminal equipment includes IoT gateway, IoT device and IoT edge server. The U shield has built-in SM3 algorithm and SM2 algorithm and is connected to the access terminal equipment. The U shield provides a function access interface through USB2.0 and can output the signature public key (PublicKey).

[0163] The access terminal device is used to implement an Internet of Things access authentication method, including: obtaining the current time when access to the Internet of Things platform is required; generating a user name of the access terminal device according to the product category identification and current time of the access terminal device; generating a client identification of the access terminal device through the device number of the access terminal device; generating an authentication password according to the user name and the client identification; sending the authentication password, the client identification and the user name to the Internet of Things platform so that the Internet of Things platform performs authentication, and establishing a connection with the access terminal device if the authentication is passed.

[0164] The Internet of Things platform is used to implement an Internet of Things access authentication method, including: receiving an authentication password, a client identifier and a user name sent by an access terminal device, the user name is generated by the access terminal device according to the product category identifier of the access terminal device and the current time obtained by the access terminal device when the access terminal device needs to access the Internet of Things platform, the client identifier is generated by the access terminal device according to the device number of the access terminal device, and the authentication password is generated by the access terminal device according to the user name and the client identifier; authenticating the authentication password, the client identifier and the user name; and establishing a connection with the access terminal device when the authentication is successful.

[0165] The IoT system has the following advantages: First, the username and authentication password are different for each authentication process, and the SM2 private key is stored in the USB shield, which effectively prevents leakage and copying, prevents illegal connection, and strengthens the security of the IoT system. At the same time, the IoT platform access service will verify the UTC timestamp to avoid data packet replay and DDOS attacks.

[0166] Secondly, it effectively prevents the illegal cloning and copying of programs or firmware of networked devices, because without the U-shield bound to the device before leaving the factory, the signature verification cannot pass, and the cloned device cannot be connected to the IoT platform through MQTT.

[0167] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0168] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0169] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0170] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for Internet of Things access authentication, characterized in that: The method is applied to an access terminal device, comprising: Get the current time when you need to access the IoT platform; generating a user name of the access terminal device according to the product category identifier of the access terminal device and the current time; Generate a client identifier of the access terminal device according to the device number of the access terminal device; Generate an authentication password according to the user name and the client identifier, specifically including: generate a first combination according to the client identifier and the user name; call the USB shield bound to the device number, use the SM3 algorithm built into the USB shield to process the first combination to obtain a first SM3 summary value, and use the SM2 algorithm built into the USB shield to sign the first SM3 summary value through the USB shield private key to obtain an SM2 digital signature; encode the SM2 digital signature to obtain an authentication password; The authentication password, the client identifier and the user name are sent to the Internet of Things platform so that the Internet of Things platform performs authentication and establishes a connection with the access terminal device if the authentication is successful.

2. The method according to claim 1, characterized in that The step of generating a client identifier of the access terminal device by using the device number of the access terminal device comprises: The client identifier is generated according to the device number and the random character string.

3. The method according to claim 1 or 2, characterized in that: Also includes: Receive the authentication result returned by the IoT platform, where the authentication result is authentication passed or authentication failed.

4. A method for Internet of Things access authentication, characterized in that: The method is applied to an Internet of Things platform, including: Receive an authentication password, a client identifier and a user name sent by an access terminal device, wherein the user name is generated by the access terminal device according to the product category identifier of the access terminal device and the current time obtained by the access terminal device when the access terminal device needs to access the Internet of Things platform, the client identifier is generated by the access terminal device according to the device number of the access terminal device, and the authentication password is generated by the access terminal device according to the user name and the client identifier. The method for generating the authentication password specifically includes: generating a first combination according to the client identifier and the user name; calling a U shield bound to the device number, using the built-in SM3 algorithm of the U shield to process the first combination to obtain a first SM3 digest value, and using the built-in SM2 algorithm of the U shield to sign the first SM3 digest value through the U shield private key to obtain an SM2 digital signature; encoding the SM2 digital signature to obtain an authentication password; Authenticating the authentication password, the client identifier, and the user name; If the authentication is successful, establishing a connection with the access terminal device; The step of authenticating the authentication password, the client identifier and the user name specifically includes: Generate a second combination according to the client identifier and the user name, and process the second combination using the SM3 algorithm built into the Internet of Things platform to obtain a second SM3 summary value; Obtain the SM2 digital signature by decoding the authentication password; Obtain the device number of the access terminal device from the client identifier, and use the SM2 algorithm built into the IoT platform to verify the SM2 digital signature through the U-Shield public key bound to the device number; If the signature verification passes, the first SM3 summary value is obtained; Compare the first SM3 digest value and the second SM3 digest value; if the first SM3 digest value and the second SM3 digest value are the same, the authentication is successful; if the first SM3 digest value and the second SM3 digest value are different, the authentication fails.

5. The method according to claim 4, characterized in that Before authenticating the authentication password, the client identifier and the user name, the method further includes: Obtaining from the user name the current time obtained by the access terminal device when accessing the Internet of Things platform is required; Determine whether the difference between the current time obtained by the access terminal device when accessing the Internet of Things platform is needed and the current time when the Internet of Things platform receives the authentication password, the client identifier and the user name is within a set time range; If the difference value is within the set time range, executing the step of authenticating the authentication password, the client identifier and the user name; If the difference value is not within the set time range, the authentication fails.

6. The method according to claim 4 or 5, characterized in that: Also includes: An authentication result is returned to the access terminal device, where the authentication result is authentication passed or authentication failed.

7. An Internet of Things access authentication device, characterized in that: The device is applied to an access terminal device, and includes: The time acquisition module is used to obtain the current time when access to the IoT platform is required; A first generating module, configured to generate a user name of the access terminal device according to a product category identifier of the access terminal device and the current time; A second generating module, configured to generate a client identifier of the access terminal device according to the device number of the access terminal device; The third generation module is used to generate an authentication password according to the user name and the client identifier, and is specifically used to: generate a first combination according to the client identifier and the user name; call the USB shield bound to the device number, use the SM3 algorithm built into the USB shield to process the first combination to obtain a first SM3 summary value, and use the SM2 algorithm built into the USB shield to sign the first SM3 summary value through the USB shield private key to obtain an SM2 digital signature; encode the SM2 digital signature to obtain an authentication password; The authentication data sending module is used to send the authentication password, the client identifier and the user name to the Internet of Things platform so that the Internet of Things platform can perform authentication and establish a connection with the access terminal device if the authentication is successful.

8. An Internet of Things access authentication device, characterized in that: The device is applied to an Internet of Things platform, including: The authentication data receiving module is used to receive the authentication password, client identifier and user name sent by the access terminal device, wherein the user name is generated by the access terminal device according to the product category identifier of the access terminal device and the current time obtained by the access terminal device when the access terminal device needs to access the Internet of Things platform, the client identifier is generated by the access terminal device according to the device number of the access terminal device, and the authentication password is generated by the access terminal device according to the user name and the client identifier. The method for generating the authentication password specifically includes: generating a first combination according to the client identifier and the user name; calling a U shield bound to the device number, using the built-in SM3 algorithm of the U shield to process the first combination to obtain a first SM3 summary value, and using the built-in SM2 algorithm of the U shield to sign the first SM3 summary value through the U shield private key to obtain an SM2 digital signature; encoding the SM2 digital signature to obtain an authentication password; An authentication module, used to authenticate the authentication password, the client identifier and the user name; A connection module, used to establish a connection with the access terminal device if the authentication is successful; The authentication module is specifically used for: Generate a second combination according to the client identifier and the user name, and process the second combination using the SM3 algorithm built into the Internet of Things platform to obtain a second SM3 summary value; Obtain the SM2 digital signature by decoding the authentication password; Obtain the device number of the access terminal device from the client identifier, and use the SM2 algorithm built into the IoT platform to verify the SM2 digital signature through the U-Shield public key bound to the device number; If the signature verification passes, the first SM3 summary value is obtained; Compare the first SM3 digest value and the second SM3 digest value; if the first SM3 digest value and the second SM3 digest value are the same, the authentication is successful; if the first SM3 digest value and the second SM3 digest value are different, the authentication fails.

Images