Mqtt authentication method based on ssl and related device

Abstract

The application provides an SSL-based MQTT authentication method and related equipment. In the application, after a target server receives target domain name information, an Internet of Things device random number and an encrypted pre-master key sent by an Internet of Things device, the target domain name information and the encrypted pre-master key are sent to a KeyServer cluster; the pre-master key decrypted by the KeyServer cluster is received; a session key is determined according to the Internet of Things device random number, a target server random number and the pre-master key, and a handshake process is completed; a data upload message sent by the Internet of Things device based on an MQTT protocol is received, the data upload request includes identification information of the Internet of Things device; the upload permission of the Internet of Things device and a cache time length of to-be-cached data are determined according to the identification information; the cached data is preprocessed according to a resource type of the cached data; and a first response message is sent to the Internet of Things device.

Description

Technical Field

[0001] This disclosure relates to the field of data processing technology, and in particular to an SSL-based MQTT authentication method and related equipment. Background Technology

[0002] MQTT (Message Queuing Telemetry Transport) is an instant messaging protocol developed by IBM. Many companies in China widely use MQTT as the protocol for pushing messages between Android mobile clients and servers.

[0003] Due to its open-source nature and low power consumption, MQTT will make greater contributions to the field of mobile message push. In the Internet of Things (IoT) field, MQTT can be considered as one of the solutions for communication between sensors and servers and information collection.

[0004] With the development of technology, more and more IoT devices are connecting to the internet, extending the internet from people to things. Among the series of problems facing the development of the IoT, security is paramount, and ensuring the security of device access has become an unavoidable issue for IoT cloud platforms.

[0005] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of this application is to provide an MQTT authentication method and related equipment based on SSL, which at least to some extent overcomes the problems existing in the prior art. This invention uses MQTT as the communication foundation, employs bidirectional SSL to ensure link security, and uses an IoT cloud platform to issue digital certificates to IoT terminals, adopting a one-certificate-per-device approach to solve the identity authentication of IoT terminal devices. Furthermore, IoT devices use their digital certificates to access the IoT cloud platform via the SSL protocol, ensuring bidirectional identity authentication and data communication security, thereby guaranteeing enhanced identity authentication of IoT terminal devices by the IoT cloud platform and ensuring secure and reliable data transmission.

[0007] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part by practice of the invention.

[0008] According to one aspect of this application, an SSL-based MQTT authentication method is provided, applied to a target server, comprising: receiving target domain name information, an IoT device random number, and an encrypted pre-master key sent by an IoT device; sending the target domain name information and the encrypted pre-master key to a KeyServer cluster; receiving the pre-master key decrypted by the KeyServer cluster; determining a session key based on the IoT device random number, the target server random number, and the pre-master key, and completing a handshake process; receiving a data upload message sent by the IoT device based on the MQTT protocol, wherein the data upload request includes identification information of the IoT device; determining the upload permission of the IoT device and configuring the cache duration of the data to be cached based on the identification information; preprocessing the cached data according to the resource type of the cached data; and sending a first response message to the IoT device, wherein the first response message includes the data storage status of the data upload request.

[0009] In one embodiment of this application, the target domain name information and the random number of the IoT device are recorded in the first data packet sent by the IoT device.

[0010] In one embodiment of this application, the method further includes: after receiving the first data packet, the target server sends a public key certificate and a target server random number to the IoT device.

[0011] In one embodiment of this application, the method further includes: the encryption of the pre-master key is performed by the IoT device using the public key in the public key certificate sent by the target server.

[0012] In one embodiment of this application, the step of preprocessing the cached data according to the resource type of the cached data includes: determining whether the resource type of the cached data is a hot resource; if the cached data is a hot resource, then sending the resource data corresponding to the data upload request to a first server through a message queue, wherein the first server may be an edge server in the same cluster as the target server or processing the same business.

[0013] In one embodiment of this application, the method further includes: receiving and processing a data download request sent by a download client; if the data to be downloaded currently exists on the local machine, then sending the data to be downloaded to the download client; if the data to be downloaded does not currently exist on the local machine, then obtaining the data to be downloaded from the local machine and forwarding it to the download client.

[0014] In one embodiment of this application, the step of obtaining the data to be downloaded from the local machine and forwarding it to the download client if the data to be downloaded does not currently exist on the local machine includes: obtaining the address information of a first server, wherein the first server is an edge server storing the data to be downloaded; sending a target data acquisition request to the first server, the target data acquisition request including the data to be downloaded; receiving a response message containing the data to be downloaded sent by the first server; and sending a response message containing the data to be downloaded to the download client.

[0015] Another aspect of this application discloses an SSL-based MQTT authentication device, characterized in that it comprises: a receiving module, configured to receive target domain name information, a random number of the IoT device, and an encrypted pre-master key sent by an IoT device; receive the pre-master key decrypted by the Key Server cluster; and receive a data upload message sent by the IoT device based on the MQTT protocol, wherein the data upload request includes identification information of the IoT device; a sending module, configured to send the target domain name information and the encrypted pre-master key to the Key Server cluster, and send a first response message to the IoT device, wherein the first response message includes the data storage status of the data upload request; and a processing module, configured to determine a session key based on the random number of the IoT device, the random number of the target server, and the pre-master key, complete a handshake process, determine the upload permission of the IoT device and the cache duration of the data to be cached based on the identification information, and preprocess the cached data according to the resource type of the cached data.

[0016] According to another aspect of this application, an electronic device is characterized by comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the above-described SSL-based MQTT authentication method by executing the executable instructions.

[0017] According to another aspect of this application, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the above-described SSL-based MQTT authentication method.

[0018] According to another aspect of this application, a computer program product is provided, comprising a computer program, characterized in that the computer program, when executed by a processor, implements the above-described SSL-based MQTT authentication method.

[0019] This application provides an SSL-based MQTT authentication method applied to a target server, comprising: receiving target domain name information, an IoT device random number, and an encrypted pre-master key from an IoT device; sending the target domain name information and the encrypted pre-master key to a Key Server cluster; receiving the pre-master key decrypted by the Key Server cluster; determining a session key based on the IoT device random number, the target server random number, and the pre-master key, and completing a handshake process; receiving a data upload message sent by the IoT device based on the MQTT protocol, the data upload request including the IoT device's identification information; determining the IoT device's upload permissions and configuring the cache duration for the data to be cached based on the identification information; preprocessing the cached data according to the resource type of the cached data; and sending a first response message to the IoT device, wherein the first response message includes the data storage status of the data upload request. This invention uses MQTT as the communication foundation, employs bidirectional SSL to ensure link security, and uses an IoT cloud platform to issue digital certificates to IoT terminals, adopting a one-device-one-certificate approach to solve the identity authentication of IoT terminal devices. In addition, IoT devices use their digital certificates to access the IoT cloud platform via the SSL protocol, ensuring two-way identity authentication and data communication security. This, in turn, ensures enhanced authentication of IoT terminal devices by the IoT cloud platform and guarantees secure and reliable data transmission.

[0020] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0022] Figure 1 A flowchart illustrating an SSL-based MQTT authentication method provided in an embodiment of this application is shown.

[0023] Figure 2 A schematic diagram of the structure of an SSL-based MQTT authentication device provided in an embodiment of this application is shown.

[0024] Figure 3 This illustration shows a schematic diagram of the structure of an electronic device according to an embodiment of this application;

[0025] Figure 4A schematic diagram of a storage medium provided in one embodiment of this application is shown. Detailed Implementation

[0026] Various exemplary embodiments of the present application will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present application.

[0027] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0028] The following description of at least one exemplary embodiment is merely illustrative and is not intended to limit the scope of this application or its application or use.

[0029] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0030] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0031] Furthermore, the technical solutions of the various embodiments of this application can be combined with each other, but only if they are based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by this application.

[0032] It should be noted that other embodiments of this application will readily conceive of by those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this application are indicated in the claims section.

[0033] It should be understood that this application is not limited to the precise structures described below and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

[0034] The following is combined Figure 1This application describes an SSL-based MQTT authentication method according to exemplary embodiments thereof. It should be noted that the following application scenarios are shown only to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited in any way. Rather, the embodiments of this application can be applied to any applicable scenario.

[0035] In one embodiment, this application also proposes an SSL-based MQTT authentication method. Figure 1 A schematic diagram illustrating a flow chart of an SSL-based MQTT authentication method according to an embodiment of this application is shown. Figure 1 As shown, this method is applied to the target server and includes:

[0036] S101: After receiving the target domain name information, the IoT device random number, and the encrypted pre-master key sent by the IoT device, the target domain name information and the encrypted pre-master key are sent to the Key Server cluster.

[0037] In one implementation, the target domain name information and the IoT device random number are recorded in the first data packet sent by the received IoT device.

[0038] In another implementation, after receiving the first data packet, the target server sends a public key certificate and a random number to the IoT device.

[0039] In another implementation, the encryption of the pre-master key is performed by the IoT device using the public key in the public key certificate sent by the target server. In yet another implementation, the target server can be a CDN server, cloud storage server, etc., and its upload interface receives data upload requests from upload clients. These data upload requests can be requests to upload resource files. IoT devices can be, for example, smartphones, desktop computers, laptops, tablets, or other devices capable of accessing the network. IoT devices include, but are not limited to, industrial production equipment and various machine tools, such as lathes, milling machines, grinding machines, and planers. By pre-setting data acquisition devices on the industrial equipment, various operational data of the industrial equipment can be obtained. These acquisition devices include, but are not limited to, cameras, binocular cameras, flow meters, pressure gauges, ammeters, sensors, and other devices capable of collecting factory production data.

[0040] S102, Receive the pre-master key obtained by decryption by the Key Server cluster.

[0041] In one implementation, the Key Server cluster receives a client random number, client key-share information, server random number, and server key-share information sent by the target server, and then generates a pre-master key based on the client key-share information and the server key-share information.

[0042] S103, determine the session key based on the random number of the IoT device, the random number of the target server, and the pre-master key, and complete the handshake process.

[0043] In one implementation, the IoT device random number and IoT device key-share information are generated by the IoT device; the target server random number and target server key-share information are generated by the target server, and the specific generation method is not limited here.

[0044] In this way, by utilizing the pre-existing information of the session key exchanged during the handshake process (connection establishment process) between the IoT device and the target server, the session key can be quickly determined without affecting the handshake process (connection establishment process), greatly shortening the time for communication between the two ends after the handshake (connection establishment).

[0045] In another implementation, the IoT device sends Secure Sockets Layer (SSL) handshake information (including supported SSL handshake versions, cipher suites, and client random numbers) / Transport Layer Security (TLS) handshake information (including supported SSL handshake versions, cipher suites, and client random numbers) to the target server. The target server, based on the received SSL / TLS handshake information, sends a message to the IoT device, whereby the message includes the selected cipher suite, server random number, and public key certificate. The IoT device generates a pre-master key based on the above messages and sends an encrypted message (including the pre-master key) to the server. The target server sends the encrypted message to the Keyless Server cluster; the Keyless Server cluster sends the decrypted message to the target server; the target server receives the private key obtained from the Keyless Server cluster, decrypts or signs the message, and then sends a decrypted or signed message. The handshake process is completed based on the decrypted or signed message (wherein, the target server determines the session key based on the message information (including client random number, server random number, and pre-master key)).

[0046] S104, Receive a data upload message sent by the IoT device based on the MQTT protocol, wherein the data upload request includes the identification information of the IoT device.

[0047] In one embodiment, this application does not specifically limit the identification information. The identification information can be a pre-defined string, including but not limited to 001, a, and A. It is understood that as long as the meaning of the number or letter field is agreed in advance on the first server side as corresponding to the client's upload permission and the storage duration of the client's data, this application does not limit the identification information.

[0048] In another implementation, if the target server receives a data upload request from an IoT device that carries A100S information, it determines that A100S is pre-negotiated identification information. This identification information corresponds to the IoT device having data upload permissions, and the data can be stored for 100 seconds.

[0049] S105, determine the upload permission of the IoT device and the cache duration of the data to be cached based on the identification information.

[0050] In one implementation, the type of cached data can be determined based on file type information or membership level information in the customer information. For example, if the cached data includes user order information, then the cached data is confirmed to be related to shopping transactions. The cache duration is configured based on the resource type of the cached data, and the cached data is deleted after the cache duration is reached.

[0051] In another implementation, the target server determines whether the resource type of the cached data is a hot resource. If the cached data is a hot resource, the central server will send a data sharing instruction to the target server, so that the target server can send the resource data corresponding to the data upload request to the first server through a message queue. The first server may be an edge server in the same cluster as the target server or processing the same business.

[0052] In another implementation, the target server determines whether the resource type of the cached data is a hot resource; if the cached data is a hot resource, it sends the resource data corresponding to the data upload request to the first server through a message queue. The first server may be an edge server in the same cluster as the target server or processing the same business.

[0053] S106, Preprocess the cached data according to the resource type of the cached data.

[0054] In one implementation, the server determines whether the resource type of the cached data is a hot resource; if the cached data is a hot resource, the server sends the resource data corresponding to the data upload request to the first server through a message queue. The first server may be an edge server in the same cluster as the target server or processing the same business.

[0055] In another implementation, the message queue includes, but is not limited to, RabbitMQ, RocketMQ, ActiveMQ, Kafka, ZeroMQ, and MetaMQ.

[0056] In another implementation, the target server determines whether the cached data is a hot resource. If the cached data is a hot resource, the central server sends a data sharing instruction to the target server, which then sends the resource data corresponding to the data upload request to the first server via a message queue. The first server can be an edge server in the same cluster as the target server or processing the same business. In one implementation, the second response message includes a valid identifier representing the corresponding data in the data upload request, which is contained in the response body of the response message. When the target server receives a data download request from the download client containing this valid identifier, it indicates that the data to be downloaded is valid, thereby improving the efficiency of the target server.

[0057] S107, a first response message is sent to the IoT device, wherein the first response message includes the data storage status of the data upload request.

[0058] In one implementation, the first response message includes a valid identifier representing the corresponding data in the data upload request, wherein the valid identifier is contained in the response body of the response message. When the target server receives a data download request sent by the download client containing this valid identifier, it indicates that the data to be downloaded is valid, thereby improving the working efficiency of the target server.

[0059] In this application, after receiving the target domain name information, the IoT device's random number, and the encrypted pre-master key from the IoT device, the target server sends the target domain name information and the encrypted pre-master key to the KeyServer cluster; receives the pre-master key decrypted by the KeyServer cluster; determines the session key based on the IoT device's random number, the target server's random number, and the pre-master key, and completes the handshake process; receives a data upload message sent by the IoT device based on the MQTT protocol, the data upload request including the IoT device's identification information; determines the IoT device's upload permissions and configures the cache duration for the data to be cached based on the identification information; preprocesses the cached data according to the resource type of the cached data; and sends a first response message to the IoT device, wherein the first response message includes the data storage status of the data upload request. This invention uses MQTT as the communication foundation, employs bidirectional SSL to ensure link security, and uses a digital certificate issued by the IoT cloud platform for the IoT terminal, adopting a one-device-one-certificate approach to solve the identity authentication of IoT terminal devices. In addition, IoT devices use their digital certificates to access the IoT cloud platform via the SSL protocol, ensuring two-way identity authentication and data communication security. This, in turn, ensures enhanced authentication of IoT terminal devices by the IoT cloud platform and guarantees secure and reliable data transmission.

[0060] Optionally, in another embodiment based on the method described above in this application, the method further includes:

[0061] Receive and process data download requests sent by download clients;

[0062] If the data to be downloaded currently exists on the local machine, then the data to be downloaded is sent to the download client;

[0063] If the data to be downloaded does not currently exist on the local machine, the local machine will retrieve the data to be downloaded and forward it to the download client.

[0064] In one implementation, the target server's download interface receives and processes a download request from a client. It obtains authentication information by decoding the URL containing the target index information carried in the download request. The authentication server then checks this information, primarily for anti-leeching purposes. If the access is invalid, it returns a 403 status code to the client. Additionally, the target server checks if the resource file cache has expired. If expired, it returns a 404 status code to the client. The target server can determine the expiration of the resource file cache, for example, by checking if the file's TTL is 0. If the target server determines that the file cache server is not its own machine, it retrieves the corresponding data from the server storing the resource file based on the target index information and sends the retrieved data to the client. If the file is indeed the cached file on its own machine and the permissions are valid, it returns the corresponding file to the client.

[0065] Optionally, in another embodiment based on the method described above in this application, the step of obtaining the data to be downloaded from the local machine and forwarding it to the download client if the data to be downloaded does not currently exist on the local machine includes:

[0066] Obtain the address information of the first server, wherein the first server is an edge server storing data to be downloaded;

[0067] Send a target data acquisition request to the first server, wherein the target data acquisition request includes the data to be downloaded;

[0068] Receive a response message from the first server containing the data to be downloaded;

[0069] Send a response message containing the data to be downloaded to the download client.

[0070] In one implementation, the first server can be an edge server in the same cluster as the target server or processing the same business. When the target server does not store the data to be downloaded sent by the download client, the target server directly sends a resource acquisition request to the first server to obtain the data to be downloaded, and then sends the data to the download client. This reduces the need for the download client to send another resource acquisition request containing the data to be downloaded to the first server, shortens the resource acquisition time for the download client, and improves the efficiency of the download client in acquiring resources.

[0071] In this application, after the target server receives the target domain name information, the IoT device's random number, and the encrypted pre-master key sent by the IoT device, it sends the target domain name information and the encrypted pre-master key to the KeyServer cluster. The target domain name information and the IoT device's random number are recorded in the first data packet received from the IoT device. After receiving the first data packet, the target server sends a public key certificate and a target server random number to the IoT device. The encryption of the pre-master key is performed by the IoT device using the public key in the public key certificate sent by the target server. The KeyServer cluster receives the target domain name information and the IoT device's random number. The server cluster decrypts the pre-master key; based on the random number from the IoT device, the random number from the target server, and the pre-master key, a session key is determined, and the handshake process is completed; a data upload message sent by the IoT device based on the MQTT protocol is received, the data upload request including the IoT device's identification information; the upload permission of the IoT device and the cache duration of the data to be cached are determined based on the identification information; it is determined whether the resource type of the cached data is a hot resource; if the cached data is a hot resource, the resource data corresponding to the data upload request is sent to the first server through a message queue, the first server may be an edge server in the same cluster as the target server or processing the same business; a first response message is sent to the IoT device, wherein the first response message includes the data storage status of the data upload request.

[0072] The system receives and processes data download requests sent by download clients; if the data to be downloaded currently exists on the local machine, the data to be downloaded is sent to the download client; if the data to be downloaded does not currently exist on the local machine, the address information of a first server is obtained, wherein the first server is an edge server storing the data to be downloaded; a target data acquisition request is sent to the first server, the target data acquisition request including the data to be downloaded; a response message containing the data to be downloaded is received from the first server; and a response message containing the data to be downloaded is sent to the download client. This invention uses MQTT as the communication foundation, employs bidirectional SSL to ensure link security, and uses a digital certificate issued by the IoT cloud platform for IoT terminals, adopting a one-device-one-certificate approach to solve the identity authentication of IoT terminal devices. Furthermore, IoT devices use their digital certificates to access the IoT cloud platform via the SSL protocol, ensuring bidirectional identity authentication and data communication security, thereby ensuring enhanced identity authentication of IoT terminal devices by the IoT cloud platform and guaranteeing secure and reliable data transmission.

[0073] In one embodiment, this application also provides an SSL-based MQTT authentication method applied to a Key Server cluster, comprising:

[0074] Obtain the target domain name information and the encrypted pre-master key sent by the target server;

[0075] The private key is determined based on the target domain name information, and the encrypted pre-master key is decrypted.

[0076] The pre-master key is sent to the target server.

[0077] Optionally, in another embodiment based on the method described above in this application, one LB Key Server and at least two Cal Key Servers are deployed within the Key Server cluster, and the method further includes:

[0078] After receiving the target domain name information and the encrypted pre-master key sent by the target server, the LB Key Server selects one of the at least two Cal Key Servers to forward the message and sends the pre-master key returned by the Cal Key Server to the target server.

[0079] Optionally, in another embodiment based on the method described above in this application, the LB Key Server selects one Cal Key Server from at least two Cal Key Servers by polling.

[0080] Optionally, in another embodiment based on the method described above in this application, the method further includes:

[0081] After receiving the target domain name information and the encrypted pre-master key forwarded by the LB Key Server, the Cal Key Server determines the private key corresponding to the target domain name information and returns the decrypted pre-master key to the LB Key Server.

[0082] Optionally, in another embodiment based on the method described above in this application, the Cal Key Server reads the private key corresponding to the target domain name information from memory.

[0083] In one embodiment, this application also provides an SSL-based MQTT authentication system, characterized in that it includes: an Internet of Things (IoT) device, a target server, and a Key Server cluster;

[0084] IoT devices are used to send target domain name information, IoT device random number and encrypted pre-master key to the target server;

[0085] The target server is used to send the received target domain name information and the encrypted pre-master key to the Key Server cluster; receive the pre-master key decrypted by the Key Server cluster; determine the session key based on the random number of the IoT device, the random number of the target server, and the pre-master key, and complete the handshake process.

[0086] The Key Server cluster is used to determine the private key based on the target domain name information, decrypt the encrypted pre-master key, and send the pre-master key to the target server.

[0087] In one implementation, such as Figure 2 As shown, this application also provides an SSL-based MQTT authentication device, comprising:

[0088] The receiving module 201 is used to receive target domain name information, IoT device random number and encrypted pre-master key sent by IoT device, receive the pre-master key decrypted by the Key Server cluster, and receive data upload message sent by IoT device based on MQTT protocol, wherein the data upload request includes IoT device identification information;

[0089] The sending module 202 is used to send the target domain name information and the encrypted pre-master key to the KeyServer cluster and send a first response message to the IoT device, wherein the first response message includes the data storage status of the data upload request;

[0090] Processing module 203 is used to determine a session key based on the random number of the IoT device, the random number of the target server, and the pre-master key, complete the handshake process, determine the upload permission of the IoT device and the cache duration of the data to be cached based on the identification information, and preprocess the cached data according to the resource type of the cached data.

[0091] In this application, after receiving the target domain name information, the IoT device's random number, and the encrypted pre-master key from the IoT device, the target server sends the target domain name information and the encrypted pre-master key to the KeyServer cluster; receives the pre-master key decrypted by the KeyServer cluster; determines the session key based on the IoT device's random number, the target server's random number, and the pre-master key, and completes the handshake process; receives a data upload message sent by the IoT device based on the MQTT protocol, the data upload request including the IoT device's identification information; determines the IoT device's upload permissions and configures the cache duration for the data to be cached based on the identification information; preprocesses the cached data according to the resource type of the cached data; and sends a first response message to the IoT device, wherein the first response message includes the data storage status of the data upload request. This invention uses MQTT as the communication foundation, employs bidirectional SSL to ensure link security, and uses a digital certificate issued by the IoT cloud platform for the IoT terminal, adopting a one-device-one-certificate approach to solve the identity authentication of IoT terminal devices. In addition, IoT devices use their digital certificates to access the IoT cloud platform via the SSL protocol, ensuring two-way identity authentication and data communication security. This, in turn, ensures enhanced authentication of IoT terminal devices by the IoT cloud platform and guarantees secure and reliable data transmission.

[0092] In another embodiment of this application, the processing module 203 is configured to record the target domain name information and the random number of the IoT device in the first data packet sent by the IoT device.

[0093] In another embodiment of this application, the sending module 202 is configured to send a public key certificate and a random number to the IoT device after the target server receives the first data packet.

[0094] In another embodiment of this application, the processing module 203 is configured such that the encryption of the pre-master key is performed by the IoT device using the public key in the public key certificate sent by the target server.

[0095] In another embodiment of this application, the processing module 203 is configured as follows:

[0096] The preprocessing of the cached data according to the resource type of the cached data includes:

[0097] Determine whether the resource type of the cached data is a hot resource;

[0098] If the cached data is a hot resource, the resource data corresponding to the data upload request is sent to the first server through a message queue. The first server may be an edge server in the same cluster as the target server or processing the same business.

[0099] In another embodiment of this application, the processing module 203 is configured such that the method further includes:

[0100] Receive and process data download requests sent by download clients;

[0101] If the data to be downloaded currently exists on the local machine, then the data to be downloaded is sent to the download client;

[0102] If the data to be downloaded does not currently exist on the local machine, the local machine will retrieve the data to be downloaded and forward it to the download client.

[0103] In another embodiment of this application, the processing module 203 is configured as follows:

[0104] If the data to be downloaded does not currently exist on the local machine, then the local machine obtains the data to be downloaded and forwards it to the download client, including:

[0105] Obtain the address information of the first server, wherein the first server is an edge server storing data to be downloaded;

[0106] Send a target data acquisition request to the first server, wherein the target data acquisition request includes the data to be downloaded;

[0107] Receive a response message from the first server containing the data to be downloaded;

[0108] Send a response message containing the data to be downloaded to the download client.

[0109] In this application, after the target server receives the target domain name information, the IoT device's random number, and the encrypted pre-master key sent by the IoT device, it sends the target domain name information and the encrypted pre-master key to the KeyServer cluster. The target domain name information and the IoT device's random number are recorded in the first data packet received from the IoT device. After receiving the first data packet, the target server sends a public key certificate and a target server random number to the IoT device. The encryption of the pre-master key is performed by the IoT device using the public key in the public key certificate sent by the target server. The KeyServer cluster receives the target domain name information and the IoT device's random number. The server cluster decrypts the pre-master key; based on the random number from the IoT device, the random number from the target server, and the pre-master key, a session key is determined, and the handshake process is completed; a data upload message sent by the IoT device based on the MQTT protocol is received, the data upload request including the IoT device's identification information; the upload permission of the IoT device and the cache duration of the data to be cached are determined based on the identification information; it is determined whether the resource type of the cached data is a hot resource; if the cached data is a hot resource, the resource data corresponding to the data upload request is sent to the first server through a message queue, the first server may be an edge server in the same cluster as the target server or processing the same business; a first response message is sent to the IoT device, wherein the first response message includes the data storage status of the data upload request.

[0110] The system receives and processes data download requests sent by download clients; if the data to be downloaded currently exists on the local machine, the data to be downloaded is sent to the download client; if the data to be downloaded does not currently exist on the local machine, the address information of a first server is obtained, wherein the first server is an edge server storing the data to be downloaded; a target data acquisition request is sent to the first server, the target data acquisition request including the data to be downloaded; a response message containing the data to be downloaded is received from the first server; and a response message containing the data to be downloaded is sent to the download client. This invention uses MQTT as the communication foundation, employs bidirectional SSL to ensure link security, and uses a digital certificate issued by the IoT cloud platform for IoT terminals, adopting a one-device-one-certificate approach to solve the identity authentication of IoT terminal devices. Furthermore, IoT devices use their digital certificates to access the IoT cloud platform via the SSL protocol, ensuring bidirectional identity authentication and data communication security, thereby ensuring enhanced identity authentication of IoT terminal devices by the IoT cloud platform and guaranteeing secure and reliable data transmission.

[0111] This application provides an electronic device, such as... Figure 3As shown, it includes a processor 300, a memory 301, a bus 302, and a communication interface 303. The processor 300, the communication interface 303, and the memory 301 are connected via the bus 302. The memory 301 stores a computer program that can run on the processor 300. When the processor 300 runs the computer program, it executes the SSL-based MQTT authentication method provided in any of the foregoing embodiments of this application.

[0112] The memory 301 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 303 (which can be wired or wireless), such as the Internet, wide area network, local area network, or metropolitan area network.

[0113] Bus 302 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. Memory 301 is used to store programs. After receiving an execution instruction, processor 300 executes the program. The SSL-based MQTT authentication method disclosed in any of the foregoing embodiments of this application can be applied to processor 300, or implemented by processor 300.

[0114] Processor 400 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 300 or by instructions in software form. Processor 300 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application-Specific Integrated Circuit (ASIC), an Off-the-shelf Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be implemented by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 301. The processor 300 reads the information in memory 301 and, in conjunction with its hardware, completes the steps of the above method.

[0115] The electronic devices provided in the above embodiments of this application and the SSL-based MQTT authentication method provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications they store.

[0116] This application provides a computer-readable storage medium, such as... Figure 4 As shown, the computer-readable storage medium 401 stores a computer program, which is read and executed by the processor 402 to implement the SSL-based MQTT authentication method as described above.

[0117] The technical solutions of this application embodiment, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be an air conditioner, refrigeration unit, personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the method described in the embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0118] The computer-readable storage medium provided in the above embodiments of this application and the SSL-based MQTT authentication method provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0119] This application provides a computer program product, including a computer program that is executed by a processor to implement the method described above.

[0120] The computer program products provided in the above embodiments of this application and the SSL-based MQTT authentication method provided in the embodiments of this application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications they store.

[0121] It should be noted that in this application, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0122] The various embodiments in this application are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of the SSL-based MQTT authentication method, electronic device, electronic device, and readable storage medium are basically similar to the SSL-based MQTT authentication method embodiments described above, so the descriptions are relatively simple. Relevant parts can be referred to the descriptions of the SSL-based MQTT authentication method embodiments described above.

[0123] While this application discloses the above information, it is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of this application; therefore, the scope of protection of this application shall be determined by the scope defined in the claims.

Claims

1. A method for SSL-based MQTT authentication, characterized in that, The application is applied to a target server, and comprises the following steps: After receiving target domain name information, an Internet of Things device random number and an encrypted pre-master key sent by the Internet of Things device, the target domain name information and the encrypted pre-master key are sent to a Key Server cluster, the Key Server cluster determines a private key according to the target domain name information, and the encrypted pre-master key is decrypted; The pre-master key decrypted by the Key Server cluster is received; A session key is determined according to the Internet of Things device random number, a target server random number and the pre-master key, and a handshake process is completed; A data upload message sent by the Internet of Things device based on an MQTT protocol is received, and the data upload request comprises identification information of the Internet of Things device; The upload permission of the Internet of Things device and a cache time length of to-be-cached data are determined according to the identification information; The cached data is preprocessed according to a resource type of the cached data, which comprises determining whether the resource type of the cached data is a hot resource; if the cached data is a hot resource, resource data corresponding to the data upload request is sent to a first server through a message queue, and the first server is an edge server which is in the same cluster as the target server or processes the same business as the target server; A first response message is sent to the Internet of Things device, wherein the first response message comprises a data storage state of the data upload request.

2. The method of claim 1, wherein, The target domain name information and the Internet of Things device random number are recorded in a first data packet sent by the Internet of Things device.

3. The method of claim 2, wherein, The method further comprises the following steps: After receiving the first data packet, the target server sends a public key certificate and a target server random number to the Internet of Things device.

4. The method according to any one of claims 1 to 3, characterized in that, The method further comprises the following steps: The encryption of the pre-master key is performed by the Internet of Things device using a public key in the public key certificate sent by the target server.

5. The method of claim 1, wherein, The method further comprises the following steps: A data download request sent by a download client is received and processed; If the to-be-downloaded data currently exists in the local machine, the to-be-downloaded data is sent to the download client; If the to-be-downloaded data currently does not exist in the local machine, the to-be-downloaded data is acquired by the local machine and forwarded to the download client.

6. The method of claim 5, wherein, If the to-be-downloaded data currently does not exist in the local machine, the to-be-downloaded data is acquired by the local machine and forwarded to the download client, which comprises the following steps: Address information of a first server is acquired, wherein the first server is an edge server which stores the to-be-downloaded data; A target data acquisition request is sent to the first server, and the target data acquisition request comprises the to-be-downloaded data; A response message containing the to-be-downloaded data sent by the first server is received; A response message containing the to-be-downloaded data is sent to the download client.

7. An SSL-based MQTT authentication apparatus for implementing the method of claim 1, characterized by, The application is applied to a target server, and comprises the following steps: A receiving module is configured to receive target domain name information, an Internet of Things device random number and an encrypted pre-master key sent by an Internet of Things device, receive the pre-master key decrypted by a Key Server cluster, and receive a data upload message sent by the Internet of Things device based on an MQTT protocol, wherein the data upload request comprises identification information of the Internet of Things device. The sending module is configured to send the target domain name information and the encrypted pre-master key to a Key Server cluster, and send a first response message to the Internet of Things device, wherein the first response message comprises a data storage state of the data upload request. The processing module is configured to determine a session key according to the Internet of Things device random number, a target server random number and the pre-master key, complete a handshake process, judge an upload permission of the Internet of Things device according to the identification information and a cache duration of to-be-cached data, and pre-process the cached data according to a resource type of the cached data.

8. An electronic device, comprising: The computer readable storage medium stores a computer program, and the computer program is read and run by the processor to implement the method in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is read and run by the processor to implement the method in any one of claims 1-6.

Images