Iot device offline authentication method, device and system

Abstract

An Internet of Things device offline authentication method, device and system, the method comprising: receiving an authentication request and generating challenge code information and device wake-up instructions according to the authentication request; sending the challenge code information and the device wake-up instructions to a terminal device for the terminal device to generate and return decoding information and a first digital signature; receiving the decoding information and the first digital signature, extracting a terminal device ID and system public parameters in the first digital signature; generating an identification public key of the terminal device based on the terminal device ID and the system public parameters; and verifying the decoding information and the first digital signature based on the identification public key of the terminal device to determine whether the terminal device is a legal device. The method, device and system provided by the embodiments of the present application can conveniently implement offline identity authentication of Internet of Things devices in an environment without relying on network resources, reduce the complexity of security design and system management of the Internet of Things system, and improve the security of the offline authentication system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things and device identity authentication, in particular to an offline authentication method, device and system for Internet of Things and a computer storage medium. BACKGROUND

[0002] In the Internet of Things (IoT), a large number of devices need to collect data from their operating environment and upload them to the cloud of the Internet of Things through edge aggregation nodes for analysis and processing. These devices generally adopt periodic hibernation to reduce power consumption, resulting in device offline in normal state. In order to ensure the success rate of communication, short transmission messages, less communication frequency with the master station and widely used asynchronous UDP communication protocol are generally adopted. Therefore, in the scenarios of collecting data and receiving instructions from the master station, offline authentication methods independent of network resources are needed for end-to-end communication to ensure the authenticity of device identity and the integrity of transmitted data.

[0003] At present, the existing offline authentication method needs to store and transmit authentication information for identifying the identity of the terminal in the edge aggregation device connected to a large number of Internet of Things terminals, and needs to rely on the environment of network resources. In addition, there are problems of high system complexity, low device authentication efficiency, not considering the objective conditions such as limited device resources and low security. SUMMARY

[0004] In view of this, the present application provides an offline authentication method, device and system for Internet of Things and a computer storage medium, aiming at solving the problems of existing offline authentication for Internet of Things devices, such as occupying wideband, high system complexity, low device authentication efficiency, not considering the objective conditions such as limited device resources and low security.

[0005] In the first aspect, an offline authentication method for Internet of Things devices is provided by the embodiments of the present application, which is applied to a server, and the method comprises the following steps: receiving an authentication request and generating challenge code information and a device wake-up instruction according to the authentication request; sending the challenge code information and the device wake-up instruction to a terminal device, so that the terminal device generates and returns decoding information and a first digital signature; receiving the decoding information and the first digital signature, extracting a terminal device ID and a system public parameter in the first digital signature; generating an identification public key of the terminal device based on the terminal device ID and the system public parameter; verifying the decoding information and the first digital signature based on the identification public key of the terminal device to determine whether the terminal device is a legal device.

[0006] Furthermore, the method further includes: sending an application request containing a server ID to an identity cryptography infrastructure according to the authentication request, so that the identity cryptography infrastructure generates and returns an identity private key for the server ID; receiving the identity private key for the server ID, and calculating a second digital signature based on the identity private key for the device wake-up command; and sending the second digital signature and the device wake-up command to the terminal device for the terminal device to verify whether the server is legitimate.

[0007] Furthermore, the method further includes: sending the server ID and the system public parameters to the terminal device according to the authentication request, so that the terminal device can generate the server's identifier public key.

[0008] Furthermore, generating challenge code information based on the authentication request includes: inputting the time of the authentication request as the final time into the verification function to obtain the challenge code information.

[0009] Furthermore, before inputting the authentication request time as the final moment into the verification function, the process includes: collecting time at preset time intervals, inputting the collected time into a pre-trained function determination model to obtain the verification function; detecting network transmission speed in real time, obtaining network disconnection time based on the network transmission speed, and inputting the network disconnection time as the initial moment into the verification function.

[0010] Furthermore, the step of inputting the collected time into a pre-trained function determination model to obtain a verification function includes: establishing a connection channel with an elementary function database; extracting several elementary functions from the elementary function database according to preset connection rules to obtain an initial verification function, wherein the initial verification function contains constant terms equal to the number of time features; inputting the collected time into a pre-trained feature transformation model to obtain an identifier constant; and determining the final verification function based on the identifier constant and the initial verification function.

[0011] Secondly, embodiments of the present invention also provide an offline authentication method for IoT devices, applied to a terminal device. The method includes: responding to a device wake-up command sent by a server, sending an application request containing a terminal device ID to an identification cryptographic infrastructure, so that the identification cryptographic infrastructure generates and returns an identification private key of the terminal device ID and the system public parameters; generating a first digital signature based on the identification private key of the terminal device ID and the system public parameters; returning the first digital signature to the server; and receiving challenge code information sent by the server; generating decoding information based on the challenge code information; and returning the decoding information to the server.

[0012] Furthermore, the method further includes: in response to a device wake-up command sent by the server, obtaining a server ID and system public parameters; generating a public key for identifying the server based on the server ID and the system public parameters; receiving a second digital signature sent by the server, and verifying the second digital signature according to the public key for identifying the server to determine whether the server is a legitimate server.

[0013] Furthermore, generating decoding information based on the challenge code information includes: inputting the challenge code information into a verification function to obtain the decoding information.

[0014] Furthermore, the verification function is obtained in advance in the following manner: a connection channel with the elementary function database is established, and several elementary functions are extracted from the elementary function database according to the preset connection rules to obtain an initial verification function. In fact, the initial verification function contains constant terms with the same number of time features; the time collected at preset time intervals is input into the pre-trained feature transformation model to obtain an identifier constant; and the final verification function is determined based on the identifier constant and the initial verification function.

[0015] Thirdly, embodiments of the present invention also provide an offline authentication device for IoT devices, applied to a server. The device includes: a first processing unit, configured to receive an authentication request and generate challenge code information and a device wake-up command according to the authentication request; a first sending unit, configured to send the challenge code information and the device wake-up command to a terminal device, so that the terminal device can generate and return decoding information and a first digital signature; a second processing unit, configured to receive the decoding information and the first digital signature, and extract the terminal device ID and system public parameters from the first digital signature; a third processing unit, configured to generate an identifier public key for the terminal device based on the terminal device ID and the system public parameters; and a first verification unit, configured to verify the decoding information and the first digital signature based on the identifier public key of the terminal device to determine whether the terminal device is a legitimate device.

[0016] Furthermore, the device further includes: a second sending unit, configured to send an application request containing a server ID to an identification cryptographic infrastructure according to an authentication request, so that the identification cryptographic infrastructure can generate and return an identification private key for the server ID; a fourth processing unit, configured to receive the identification private key for the server ID and calculate a second digital signature based on the identification private key for the device wake-up command; and a third sending unit, configured to send the second digital signature and the device wake-up command to a terminal device for the terminal device to verify whether the server is legitimate.

[0017] Furthermore, the device also includes a fourth sending unit, used to send the server ID and system public parameters to the terminal device according to the authentication request, so that the terminal device can generate the server's identification public key.

[0018] Furthermore, generating challenge code information based on the authentication request includes: inputting the time of the authentication request as the final time into the verification function to obtain the challenge code information.

[0019] Furthermore, before inputting the authentication request time as the final moment into the verification function, the process includes: collecting time at preset time intervals, inputting the collected time into a pre-trained function determination model to obtain the verification function; detecting network transmission speed in real time, obtaining network disconnection time based on the network transmission speed, and inputting the network disconnection time as the initial moment into the verification function.

[0020] Furthermore, the step of inputting the collected time into a pre-trained function determination model to obtain a verification function includes: establishing a connection channel with an elementary function database; extracting several elementary functions from the elementary function database according to preset connection rules to obtain an initial verification function, wherein the initial verification function contains constant terms equal to the number of time features; inputting the collected time into a pre-trained feature transformation model to obtain an identifier constant; and determining the final verification function based on the identifier constant and the initial verification function.

[0021] Fourthly, embodiments of the present invention also provide an offline authentication device for IoT devices, applied to a terminal device. The device includes: a fifth processing unit, configured to, in response to a device wake-up command sent by a server, send an application request containing a terminal device ID to an identification cryptographic infrastructure, so that the identification cryptographic infrastructure generates and returns an identification private key of the terminal device ID and the system public parameters; generate a first digital signature based on the identification private key of the terminal device ID and the system public parameters; and return the first digital signature to the server; and a sixth processing unit, configured to receive challenge code information sent by the server; generate decoding information based on the challenge code information; and return the decoding information to the server.

[0022] Furthermore, the device also includes a second verification unit, configured to: in response to a device wake-up command sent by the server, obtain the server ID and system public parameters; generate a public key for identifying the server based on the server ID and system public parameters; receive a second digital signature sent by the server, and verify the second digital signature according to the public key for identifying the server to determine whether the server is a legitimate server.

[0023] Furthermore, generating decoding information based on the challenge code information includes: inputting the challenge code information into a verification function to obtain the decoding information.

[0024] Furthermore, the verification function is obtained in advance in the following manner: a connection channel with the elementary function database is established, and several elementary functions are extracted from the elementary function database according to the preset connection rules to obtain an initial verification function. In fact, the initial verification function contains constant terms with the same number of time features; the time collected at preset time intervals is input into the pre-trained feature transformation model to obtain an identifier constant; and the final verification function is determined based on the identifier constant and the initial verification function.

[0025] Fifthly, embodiments of the present invention also provide an offline authentication system for IoT devices. The system includes: a server, configured to receive authentication requests and generate challenge code information and a device wake-up command based on the authentication requests; send the challenge code information and the device wake-up command to a terminal device, so that the terminal device can generate and return decoding information and a first digital signature; receive the decoding information and the first digital signature, and extract the terminal device ID and system public parameters from the first digital signature; generate an identifier public key for the terminal device based on the terminal device ID and system public parameters; verify the decoding information and the first digital signature based on the identifier public key of the terminal device to determine whether the terminal device is a legitimate device; and a terminal device, configured to respond to the device wake-up command sent by the server. The system sends an application request containing a terminal device ID to an identifier cryptographic infrastructure, which generates and returns an identifier private key for the terminal device ID and the system public parameters. Based on the identifier private key and the system public parameters, it generates a first digital signature; returns the first digital signature to the server; and receives challenge code information sent by the server. Based on the challenge code information, it generates decoding information and returns the decoding information to the server. The identifier cryptographic infrastructure is configured to receive an application request containing a terminal device ID from the terminal device, generate an identifier private key for the terminal device ID and the system public parameters based on the terminal device ID, and return the identifier private key and the system public parameters to the terminal device.

[0026] Furthermore, the server is also configured to: send an application request containing a server ID to the identification cryptography infrastructure according to the authentication request, so that the identification cryptography infrastructure can generate and return an identification private key for the server ID; receive the identification private key for the server ID, and calculate a second digital signature based on the identification private key for the device wake-up command; and send the second digital signature and the device wake-up command to the terminal device for the terminal device to verify whether the server is legitimate.

[0027] Furthermore, the terminal device is also configured to: in response to a device wake-up command sent by the server, obtain a server ID and system public parameters; generate a public key for identifying the server based on the server ID and the system public parameters; receive a second digital signature sent by the server, and verify the second digital signature according to the public key for identifying the server to determine whether the server is a legitimate server.

[0028] Furthermore, the identification cryptographic infrastructure is also used to: receive an application request containing a server ID sent by the server, generate an identification private key for the server ID based on the server ID, and return the identification private key for the server ID to the server.

[0029] Furthermore, the server is also configured to: send the server ID and the system public parameters to the terminal device according to the authentication request, so that the terminal device can generate the server's identifier public key.

[0030] Furthermore, generating challenge code information based on the authentication request includes: inputting the time of the authentication request as the final time into the verification function to obtain the challenge code information.

[0031] Furthermore, before inputting the authentication request time as the final moment into the verification function, the process includes: collecting time at preset time intervals, inputting the collected time into a pre-trained function determination model to obtain the verification function; detecting network transmission speed in real time, obtaining network disconnection time based on the network transmission speed, and inputting the network disconnection time as the initial moment into the verification function.

[0032] Furthermore, the step of inputting the collected time into a pre-trained function determination model to obtain a verification function includes: establishing a connection channel with an elementary function database; extracting several elementary functions from the elementary function database according to preset connection rules to obtain an initial verification function, wherein the initial verification function contains constant terms equal to the number of time features; inputting the collected time into a pre-trained feature transformation model to obtain an identifier constant; and determining the final verification function based on the identifier constant and the initial verification function.

[0033] Sixthly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the methods provided in the above embodiments.

[0034] The offline authentication method, apparatus, system, and computer storage medium for IoT devices provided in this invention generate challenge code information and device wake-up instructions based on an authentication request. The challenge code information and device wake-up instructions are sent to the terminal device to obtain decoding information and a first digital signature. The terminal device ID and system public parameters are extracted from the first digital signature. An identifier public key for the terminal device is generated based on the terminal device ID and system public parameters. The decoded information and the first digital signature are verified based on the identifier public key to determine whether the terminal device is a legitimate device. This method can conveniently achieve offline identity authentication of IoT devices without relying on network resources, solving the identity authentication problem of IoT terminal devices with limited resources (such as low power consumption, low bandwidth usage, and low latency response). It reduces the complexity of IoT system security design and system management, and improves the security of the offline authentication system. Attached Figure Description

[0035] Figure 1 An exemplary flowchart of an offline authentication method for IoT devices according to an embodiment of the present invention is shown;

[0036] Figure 2 An exemplary flowchart of an offline authentication method for IoT devices according to another embodiment of the present invention is shown;

[0037] Figure 3 A schematic diagram of an offline authentication device for Internet of Things (IoT) devices according to an embodiment of the present invention is shown.

[0038] Figure 4 A schematic diagram of an offline authentication device for IoT devices according to another embodiment of the present invention is shown;

[0039] Figure 5 A schematic diagram of an offline authentication system for Internet of Things (IoT) devices according to an embodiment of the present invention is shown. Detailed Implementation

[0040] Exemplary embodiments of the invention will now be described with reference to the accompanying drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to fully and completely disclose the invention and to fully convey its scope to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the drawings is not intended to limit the invention. In the drawings, the same units / elements are referred to by the same reference numerals.

[0041] Unless otherwise stated, the terms used herein (including technical terms) have their common meaning as understood by one of ordinary skill in the art. Furthermore, it is understood that terms defined in commonly used dictionaries should be understood to have a meaning consistent with the context of their relevant field, and not to be interpreted as having an idealized or overly formal meaning.

[0042] Figure 1 An exemplary flowchart of an offline authentication method for IoT devices according to an embodiment of the present invention is shown.

[0043] like Figure 1 As shown, this method is applied to a server, and the method includes:

[0044] Step S101: Receive the authentication request and generate challenge code information and device wake-up command based on the authentication request;

[0045] Step S102: Send the challenge code information and device wake-up command to the terminal device so that the terminal device can generate and return decoding information and the first digital signature;

[0046] Step S103: Receive the decoding information and the first digital signature, and extract the terminal device ID and system public parameters from the first digital signature;

[0047] Step S104: Generate the terminal device's identifier public key based on the terminal device ID and system public parameters;

[0048] Step S105: Verify the decoded information and the first digital signature based on the identifier public key of the terminal device to determine whether the terminal device is a legitimate device;

[0049] Specifically, the decoding information is generated by the terminal device based on the challenge code information; the first digital signature is generated by the terminal device based on the terminal device ID's identifier private key and system public parameters. The system public parameters are generated after system initialization and can be directly obtained through commands.

[0050] Further, step S105 includes:

[0051] The decoded information and the first digital signature are verified based on the identifier public key of the terminal device. If the verification is successful, the terminal device is a legitimate device; otherwise, it is an illegitimate device.

[0052] Furthermore, the method also includes:

[0053] Based on the authentication request, a request containing the server ID is sent to the identity cryptography infrastructure, so that the identity cryptography infrastructure can generate and return the identity private key of the server ID;

[0054] Receive the private key of the server ID, and calculate the second digital signature based on the private key of the server ID for the device wake-up command;

[0055] The second digital signature and device wake-up command are sent to the terminal device so that the terminal device can verify whether the server is legitimate.

[0056] Furthermore, the method also includes:

[0057] Based on the authentication request, the server ID and system public parameters are sent to the terminal device so that the terminal device can generate the server's identification public key.

[0058] Specifically, the server ID and system public parameters are sent from the server to the terminal device during the authentication process between the terminal device and the server.

[0059] Further, challenge code information is generated based on the authentication request, including:

[0060] Input the authentication request time as the final time into the verification function to obtain the challenge code information.

[0061] Furthermore, before using the authentication request time as the final input to the verification function, the following steps are included:

[0062] Collect data at preset time intervals, input the collected data into a pre-trained function determination model, and obtain the verification function.

[0063] Real-time detection of network transmission speed; obtaining network disconnection time based on network transmission speed; and using network disconnection time as the initial input to the verification function.

[0064] Furthermore, the collected time data is input into a pre-trained function determination model to obtain a validation function, including:

[0065] Establish a connection channel with the elementary function database, extract several elementary functions from the database according to the preset connection rules, and obtain the initial verification function. In fact, the initial verification function contains constant terms with the same number of time features.

[0066] The collected time data is input into a pre-trained feature transformation model to obtain the identifier constant;

[0067] The final verification function is determined based on the identifier constant and the initial verification function.

[0068] Specifically, the preset connection rule can be a rule for collecting time according to a preset time interval. The verification function contains a constant term with the same number of time features, where the number of time features represents the number of time format divisions. For example, if the time format is hour, then the time feature is 1; if the time format is hour:minute, then the time feature is 2; if the time format is hour:minute:second, then the time feature is 3.

[0069] The offline authentication methods for IoT devices provided in the above embodiments have the following advantages:

[0070] (1) Without relying on network resources or environment, offline identity authentication of IoT devices can be easily achieved, thereby solving the identity authentication problem of IoT terminal devices with limited resources (low power consumption, low bandwidth usage, low latency response, etc.).

[0071] (2) In edge aggregation devices that connect massive numbers of IoT terminals, there is no need to store and transmit authentication information used to identify the terminal, such as device digital certificates, which significantly reduces the complexity of IoT system security design and system management.

[0072] (3) Digital signature technology based on public key cryptography, combined with the CHAP challenge and response mechanism, can achieve strong identity authentication for IoT terminal devices and effectively resist security threats such as fake device identity and network replay attacks.

[0073] Figure 2 An exemplary flowchart of an offline authentication method for IoT devices according to another embodiment of the present invention is shown.

[0074] like Figure 2 As shown, this method is applied to a terminal device, and the method includes:

[0075] Step S201: In response to a device wake-up command sent by the server, a request containing the terminal device ID is sent to the identity cryptography infrastructure, so that the identity cryptography infrastructure can generate and return the identifier private key and system public parameters of the terminal device ID; a first digital signature is generated based on the identifier private key and system public parameters of the terminal device ID; the first digital signature is returned to the server; and,

[0076] Step S202: Receive the challenge code information sent by the server; generate decoding information based on the challenge code information; return the decoding information to the server.

[0077] It is important to understand that steps S201 and S202 are not in any particular order and can be executed simultaneously. They can be executed in the order of steps S201 and S202, or in the order of steps S202 and S201.

[0078] Furthermore, the method also includes:

[0079] In response to the device wake-up command sent by the server, obtain the server ID and common system parameters;

[0080] Generate the server's identifier public key based on the server ID and system public parameters;

[0081] The server receives a second digital signature and verifies it using the server's identifier public key to determine whether the server is legitimate.

[0082] Further, the system receives a second digital signature sent by the server and verifies the second digital signature based on the server's identifier public key to determine whether the server is a legitimate server, including:

[0083] The server receives the second digital signature sent by the server and verifies the second digital signature based on the server's identifier public key. If the verification is successful, the server is a legitimate server; otherwise, it is an illegitimate server.

[0084] Furthermore, decoding information is generated based on the challenge code information, including:

[0085] Input the challenge code information into the verification function to obtain the decoded information.

[0086] Specifically, the verification function of the terminal device is determined by the same model as the verification function of the server.

[0087] Furthermore, the verification function is obtained in advance in the following way:

[0088] Establish a connection channel with the elementary function database, extract several elementary functions from the database according to the preset connection rules, and obtain the initial verification function. In fact, the initial verification function contains constant terms with the same number of time features.

[0089] The time data collected at preset time intervals is input into the pre-trained feature transformation model to obtain the identifier constant;

[0090] The final verification function is determined based on the identifier constant and the initial verification function.

[0091] Specifically, the preset connection rule can be a rule for collecting time according to a preset time interval. The verification function contains a constant term with the same number of time features, where the number of time features represents the number of time format divisions. For example, if the time format is hour, then the time feature is 1; if the time format is hour:minute, then the time feature is 2; if the time format is hour:minute:second, then the time feature is 3.

[0092] The offline authentication methods for IoT devices provided in the above embodiments have the following advantages:

[0093] (1) Without relying on network resources or environment, offline identity authentication of IoT devices can be easily achieved, thereby solving the identity authentication problem of IoT terminal devices with limited resources (low power consumption, low bandwidth usage, low latency response, etc.).

[0094] (2) In edge aggregation devices that connect massive numbers of IoT terminals, there is no need to store and transmit authentication information used to identify the terminal, such as device digital certificates, which significantly reduces the complexity of IoT system security design and system management.

[0095] (3) Digital signature technology based on public key cryptography, combined with the CHAP challenge and response mechanism, can achieve strong identity authentication for IoT terminal devices and effectively resist security threats such as fake device identity and network replay attacks.

[0096] Figure 3 A schematic diagram of an offline authentication device for Internet of Things (IoT) devices according to an embodiment of the present invention is shown.

[0097] like Figure 3 As shown, this device is used in a server and includes:

[0098] The first processing unit 301 is used to receive authentication requests and generate challenge code information and device wake-up instructions based on the authentication requests;

[0099] The first sending unit 302 is used to send the challenge code information and the device wake-up command to the terminal device, so that the terminal device can generate and return the decoding information and the first digital signature;

[0100] The second processing unit 303 is used to receive decoding information and the first digital signature, and extract the terminal device ID and system public parameters from the first digital signature.

[0101] The third processing unit 304 is used to generate a public key for identifying the terminal device based on the terminal device ID and system public parameters.

[0102] The first verification unit 305 is used to verify the decoded information and the first digital signature based on the identifier public key of the terminal device, so as to determine whether the terminal device is a legitimate device.

[0103] Specifically, the decoding information is generated by the terminal device based on the challenge code information; the first digital signature is generated by the terminal device based on the terminal device ID's identifier private key and system public parameters. The system public parameters are generated after system initialization and can be directly obtained through commands.

[0104] Furthermore, the first verification unit 305 is also used for:

[0105] The decoded information and the first digital signature are verified based on the identifier public key of the terminal device. If the verification is successful, the terminal device is a legitimate device; otherwise, it is an illegitimate device.

[0106] Furthermore, the device also includes:

[0107] The second sending unit is used to send an application request containing the server ID to the identity cryptography infrastructure according to the authentication request, so that the identity cryptography infrastructure can generate and return the identity private key of the server ID;

[0108] The fourth processing unit is used to receive the identifier private key of the server ID, and calculate the device wake-up command based on the identifier private key of the server ID to obtain the second digital signature;

[0109] The third sending unit is used to send the second digital signature and the device wake-up command to the terminal device so that the terminal device can verify whether the server is legitimate.

[0110] Furthermore, the device also includes:

[0111] The fourth sending unit is used to send the server ID and system public parameters to the terminal device according to the authentication request, so that the terminal device can generate the server's identification public key.

[0112] Specifically, the server ID and system public parameters are sent from the server to the terminal device during the authentication process between the terminal device and the server.

[0113] Furthermore, challenge code information is generated based on the authentication request, including:

[0114] Input the authentication request time as the final time into the verification function to obtain the challenge code information.

[0115] Furthermore, before using the authentication request time as the final input to the verification function, the following steps are included:

[0116] Collect data at preset time intervals, input the collected data into a pre-trained function determination model, and obtain the verification function.

[0117] Real-time detection of network transmission speed; obtaining network disconnection time based on network transmission speed; and using network disconnection time as the initial input to the verification function.

[0118] Furthermore, the collected time data is input into a pre-trained function determination model to obtain a validation function, including:

[0119] Establish a connection channel with the elementary function database, extract several elementary functions from the database according to the preset connection rules, and obtain the initial verification function. In fact, the initial verification function contains constant terms with the same number of time features.

[0120] The collected time data is input into a pre-trained feature transformation model to obtain the identifier constant;

[0121] The final verification function is determined based on the identifier constant and the initial verification function.

[0122] Specifically, the preset connection rule can be a rule for collecting time according to a preset time interval. The verification function contains a constant term with the same number of time features, where the number of time features represents the number of time format divisions. For example, if the time format is hour, then the time feature is 1; if the time format is hour:minute, then the time feature is 2; if the time format is hour:minute:second, then the time feature is 3.

[0123] The offline authentication devices for IoT devices provided in the above embodiments have the following advantages:

[0124] (1) Without relying on network resources or environment, offline identity authentication of IoT devices can be easily achieved, thereby solving the identity authentication problem of IoT terminal devices with limited resources (low power consumption, low bandwidth usage, low latency response, etc.).

[0125] (2) In edge aggregation devices that connect massive numbers of IoT terminals, there is no need to store and transmit authentication information used to identify the terminal, such as device digital certificates, which significantly reduces the complexity of IoT system security design and system management.

[0126] (3) Digital signature technology based on public key cryptography, combined with the CHAP challenge and response mechanism, can achieve strong identity authentication for IoT terminal devices and effectively resist security threats such as fake device identity and network replay attacks.

[0127] Figure 4 A schematic diagram of an offline authentication device for Internet of Things (IoT) devices according to another embodiment of the present invention is shown.

[0128] like Figure 4 As shown, the device is applied to a terminal device, and the device includes:

[0129] The fifth processing unit 401 is configured to, in response to a device wake-up command sent by the server, send a request containing a terminal device ID to the identification cryptographic infrastructure, so that the identification cryptographic infrastructure can generate and return the identification private key and system public parameters of the terminal device ID; generate a first digital signature based on the identification private key and system public parameters of the terminal device ID; return the first digital signature to the server; and,

[0130] The sixth processing unit 402 is used to receive challenge code information sent by the server; generate decoding information based on the challenge code information; and return the decoding information to the server.

[0131] It is important to understand that the fifth processing unit 401 and the sixth processing unit 402 do not have a specific order and can be executed simultaneously. They can be executed in the order of the fifth processing unit 401 and the sixth processing unit 402, or in the order of the sixth processing unit 402 and the fifth processing unit 401.

[0132] Furthermore, the device also includes a second verification unit for:

[0133] In response to the device wake-up command sent by the server, obtain the server ID and common system parameters;

[0134] Generate the server's identifier public key based on the server ID and system public parameters;

[0135] The server receives a second digital signature and verifies it using the server's identifier public key to determine whether the server is legitimate.

[0136] Further, the system receives a second digital signature sent by the server and verifies the second digital signature based on the server's identifier public key to determine whether the server is a legitimate server, including:

[0137] The server receives the second digital signature sent by the server and verifies the second digital signature based on the server's identifier public key. If the verification is successful, the server is a legitimate server; otherwise, it is an illegitimate server.

[0138] Furthermore, decoding information is generated based on the challenge code information, including:

[0139] Input the challenge code information into the verification function to obtain the decoded information.

[0140] Specifically, the verification function of the terminal device is determined by the same model as the verification function of the server.

[0141] Furthermore, the verification function is obtained in advance in the following way:

[0142] Establish a connection channel with the elementary function database, extract several elementary functions from the database according to the preset connection rules, and obtain the initial verification function. In fact, the initial verification function contains constant terms with the same number of time features.

[0143] The time data collected at preset time intervals is input into the pre-trained feature transformation model to obtain the identifier constant;

[0144] The final verification function is determined based on the identifier constant and the initial verification function.

[0145] Specifically, the preset connection rule can be a rule for collecting time according to a preset time interval. The verification function contains a constant term with the same number of time features, where the number of time features represents the number of time format divisions. For example, if the time format is hour, then the time feature is 1; if the time format is hour:minute, then the time feature is 2; if the time format is hour:minute:second, then the time feature is 3.

[0146] The offline authentication methods for IoT devices provided in the above embodiments have the following advantages:

[0147] (1) Without relying on network resources or environment, offline identity authentication of IoT devices can be easily achieved, thereby solving the identity authentication problem of IoT terminal devices with limited resources (low power consumption, low bandwidth usage, low latency response, etc.).

[0148] (2) In edge aggregation devices that connect massive numbers of IoT terminals, there is no need to store and transmit authentication information used to identify the terminal, such as device digital certificates, which significantly reduces the complexity of IoT system security design and system management.

[0149] (3) Digital signature technology based on public key cryptography, combined with the CHAP challenge and response mechanism, can achieve strong identity authentication for IoT terminal devices and effectively resist security threats such as fake device identity and network replay attacks.

[0150] Figure 5 A schematic diagram of an offline authentication system for Internet of Things (IoT) devices according to an embodiment of the present invention is shown.

[0151] like Figure 5 As shown, the system includes:

[0152] Server 501 is used to receive authentication requests and generate challenge code information and device wake-up instructions based on the authentication requests; send the challenge code information and device wake-up instructions to the terminal device so that the terminal device can generate and return decoding information and a first digital signature; receive the decoding information and the first digital signature, extract the terminal device ID and system public parameters from the first digital signature; generate the terminal device's identification public key based on the terminal device ID and system public parameters; and verify the decoding information and the first digital signature based on the terminal device's identification public key to determine whether the terminal device is a legitimate device.

[0153] Terminal device 502 is configured to, in response to a device wake-up command sent by a server, send a request containing a terminal device ID to an identification cryptographic infrastructure, so that the identification cryptographic infrastructure can generate and return an identification private key and system public parameters of the terminal device ID; generate a first digital signature based on the identification private key and system public parameters of the terminal device ID; return the first digital signature to the server; and receive challenge code information sent by the server; generate decoding information based on the challenge code information; and return the decoding information to the server.

[0154] The identification cryptographic infrastructure 503 is used to receive an application request containing a terminal device ID sent by a terminal device, generate an identification private key and system public parameters of the terminal device ID based on the terminal device ID, and return the identification private key and system public parameters of the terminal device ID to the terminal device.

[0155] Furthermore, server 501 is also used for:

[0156] Based on the authentication request, a request containing the server ID is sent to the identity cryptography infrastructure, so that the identity cryptography infrastructure can generate and return the identity private key of the server ID;

[0157] Receive the private key of the server ID, and calculate the second digital signature based on the private key of the server ID for the device wake-up command;

[0158] The second digital signature and device wake-up command are sent to the terminal device so that the terminal device can verify whether the server is legitimate.

[0159] Furthermore, terminal device 502 is also used for:

[0160] In response to the device wake-up command sent by the server, obtain the server ID and common system parameters;

[0161] Generate the server's identifier public key based on the server ID and system public parameters;

[0162] The server receives a second digital signature and verifies it using the server's identifier public key to determine whether the server is legitimate.

[0163] Furthermore, the identification cryptographic infrastructure 503 is also used for:

[0164] Receive the request containing the server ID sent by the server, generate an identifier private key for the server ID based on the server ID, and return the identifier private key for the server ID to the server.

[0165] Furthermore, server 501 is also used for:

[0166] Based on the authentication request, the server ID and system public parameters are sent to the terminal device so that the terminal device can generate the server's identification public key.

[0167] Furthermore, challenge code information is generated based on the authentication request, including:

[0168] Input the authentication request time as the final time into the verification function to obtain the challenge code information.

[0169] Furthermore, before using the authentication request time as the final input to the verification function, the following steps are included:

[0170] Collect data at preset time intervals, input the collected data into a pre-trained function determination model, and obtain the verification function.

[0171] Real-time detection of network transmission speed; obtaining network disconnection time based on network transmission speed; and using network disconnection time as the initial input to the verification function.

[0172] Furthermore, the collected time data is input into a pre-trained function determination model to obtain a validation function, including:

[0173] Establish a connection channel with the elementary function database, extract several elementary functions from the database according to the preset connection rules, and obtain the initial verification function. In fact, the initial verification function contains constant terms with the same number of time features.

[0174] The collected time data is input into a pre-trained feature transformation model to obtain the identifier constant;

[0175] The final verification function is determined based on the identifier constant and the initial verification function.

[0176] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the offline authentication method for IoT devices provided in the above embodiments.

[0177] The invention has been described with reference to a few embodiments. However, as will be known to those skilled in the art, and as defined in the appended claims, other embodiments besides those disclosed above fall equivalently within the scope of the invention.

[0178] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the art, unless otherwise expressly defined herein. All references to “a / the / the [device, component, etc.]” ​​are openly interpreted as at least one instance of said device, component, etc., unless otherwise expressly stated. The steps of any method disclosed herein need not be performed in the exact order disclosed unless explicitly stated otherwise.

[0179] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0180] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0181] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0182] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0183] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for offline authentication of an Internet of Things device, the method comprising: Applied to a server, the method comprises: receiving an authentication request and generating challenge code information and device wake-up instructions according to the authentication request; sending the challenge code information and the device wake-up instructions to a terminal device for the terminal device to generate and return decoding information and a first digital signature; receiving the decoding information and the first digital signature, and extracting a terminal device ID and a system public parameter in the first digital signature; generating an identification public key of the terminal device based on the terminal device ID and the system public parameter; verifying the decoding information and the first digital signature based on the identification public key of the terminal device to determine whether the terminal device is a legal device; wherein the method further comprises: sending an application request containing a server ID to an identification cryptographic infrastructure according to the authentication request, for the identification cryptographic infrastructure to generate and return an identification private key of the server ID; receiving the identification private key of the server ID and calculating the device wake-up instructions based on the identification private key of the server ID to obtain a second digital signature; sending the second digital signature and the device wake-up instructions to the terminal device for the terminal device to verify whether the server is legal.

2. The method of claim 1, wherein, The method further comprises: sending a server ID and the system public parameter to the terminal device according to the authentication request for the terminal device to generate an identification public key of the server.

3. The method of claim 1, wherein, Generating challenge code information according to the authentication request comprises: inputting the time of the authentication request as a final time into a verification function to obtain challenge code information.

4. The method of claim 3, wherein, Before inputting the time of the authentication request as a final time into a verification function, it comprises: collecting time according to a preset time interval, and inputting the collected time into a function determination model trained in advance to obtain a verification function; real-time detecting network transmission speed, obtaining network disconnection time according to the network transmission speed, and inputting the network disconnection time as an initial time into the verification function.

5. The method of claim 3, wherein, The verification function obtained by inputting the collected time into the function determination model trained in advance comprises: establishing a connection channel with an elementary function database, extracting a plurality of elementary functions from the elementary function database according to a preset connection rule to obtain an initial verification function, wherein the initial verification function contains a constant term with the same number of time characteristics; inputting the collected time into a feature conversion model trained in advance to obtain an identification constant; determining a final verification function according to the identification constant and the initial verification function.

6. An Internet of Things device offline authentication method, characterized in that, Applied to a terminal device, the method comprises: in response to the device wake-up instructions sent by the server, sending an application request containing a terminal device ID to an identification cryptographic infrastructure for the identification cryptographic infrastructure to generate and return an identification private key of the terminal device ID and a system public parameter; generating a first digital signature based on the identification private key of the terminal device ID and the system public parameter; returning the first digital signature to the server; and receiving challenge code information sent by the server; generating decoding information based on the challenge code information; returning the decoding information to the server; The method further comprises: In response to the device wake-up instruction sent by the server, obtaining the server ID and the system public parameter; Generating the identification public key of the server based on the server ID and the system public parameter; Receiving the second digital signature sent by the server, and verifying the second digital signature according to the identification public key of the server to determine whether the server is a legal server.

7. The method of claim 6, wherein, Generating decoding information based on the challenge code information, comprising: Inputting the challenge code information into a verification function to obtain decoding information.

8. The method of claim 7, wherein, The verification function is obtained in advance in the following manner: Establishing a connection channel with an elementary function database, extracting a plurality of elementary functions from the elementary function database according to a preset connection rule to obtain an initial verification function, wherein the initial verification function contains a constant term with the same number of time characteristics; Inputting the time collected according to a preset time interval into a pre-trained feature conversion model to obtain an identification constant; Determining a final verification function according to the identification constant and the initial verification function.

9. An Internet of Things device offline authentication apparatus, characterized by, Applied to a server, the device comprises: A first processing unit configured to receive an authentication request and generate challenge code information and a device wake-up instruction based on the authentication request; A first sending unit configured to send the challenge code information and the device wake-up instruction to a terminal device, so that the terminal device generates and returns decoding information and a first digital signature; A second processing unit configured to receive the decoding information and the first digital signature, and extract a terminal device ID and a system public parameter in the first digital signature; A third processing unit configured to generate an identification public key of the terminal device based on the terminal device ID and the system public parameter; A first verification unit configured to verify the decoding information and the first digital signature based on the identification public key of the terminal device to determine whether the terminal device is a legal device; The device further comprises: A second sending unit configured to send an application request containing a server ID to an identification cryptography infrastructure based on an authentication request, so that the identification cryptography infrastructure generates and returns an identification private key of the server ID; A fourth processing unit configured to receive the identification private key of the server ID, and calculate a second digital signature based on the identification private key of the server ID; A third sending unit configured to send the second digital signature and the device wake-up instruction to a terminal device to verify whether the server is legal.

10. An Internet of Things device offline authentication apparatus, characterized by, Applied to a terminal device, the device comprises: A fifth processing unit configured to send an application request containing a terminal device ID to an identification cryptography infrastructure in response to a device wake-up instruction sent by a server, so that the identification cryptography infrastructure generates and returns an identification private key of the terminal device ID and a system public parameter; generate a first digital signature based on the identification private key of the terminal device ID and the system public parameter; return the first digital signature to the server; and A sixth processing unit configured to receive challenge code information sent by a server, generate decoding information based on the challenge code information, and return the decoding information to the server; The device further comprises a second verification unit configured to: In response to the device wake-up instruction sent by the server, the server ID and the system public parameter are acquired; The identification public key of the server is generated based on the server ID and the system public parameter; The second digital signature sent by the server is received, and the second digital signature is verified according to the identification public key of the server, so as to determine whether the server is a legal server.

11. An Internet of Things device offline authentication system, characterized in that, The system comprises: The server is configured to receive an authentication request, and generate challenge code information and a device wake-up instruction according to the authentication request; send the challenge code information and the device wake-up instruction to a terminal device, so that the terminal device generates and returns decoding information and a first digital signature; receive the decoding information and the first digital signature, extract the terminal device ID and the system public parameter in the first digital signature; generate the identification public key of the terminal device based on the terminal device ID and the system public parameter; and verify the decoding information and the first digital signature based on the identification public key of the terminal device, so as to determine whether the terminal device is a legal device; The terminal device is configured to, in response to the device wake-up instruction sent by the server, send an application request containing the terminal device ID to an identification password infrastructure, so that the identification password infrastructure generates and returns the identification private key of the terminal device ID and the system public parameter; generate the first digital signature based on the identification private key of the terminal device ID and the system public parameter; return the first digital signature to the server; and receive the challenge code information sent by the server; generate the decoding information based on the challenge code information; and return the decoding information to the server; The identification password infrastructure is configured to receive the application request containing the terminal device ID sent by the terminal device, generate the identification private key of the terminal device ID and the system public parameter based on the terminal device ID, and return the identification private key of the terminal device ID and the system public parameter to the terminal device; The server is further configured to: send an application request containing the server ID to the identification password infrastructure according to the authentication request, so that the identification password infrastructure generates and returns the identification private key of the server ID; receive the identification private key of the server ID, and calculate the second digital signature based on the identification private key of the server ID; send the second digital signature and the device wake-up instruction to the terminal device, so that the terminal device verifies whether the server is legal; The terminal device is further configured to: In response to the device wake-up instruction sent by the server, the server ID and the system public parameter are acquired; The identification public key of the server is generated based on the server ID and the system public parameter; The second digital signature sent by the server is received, and the second digital signature is verified according to the identification public key of the server, so as to determine whether the server is a legal server.

12. The system of claim 11, wherein, The identification password infrastructure is further configured to: receive the application request containing the server ID sent by the server, generate the identification private key of the server ID based on the server ID, and return the identification private key of the server ID to the server.

13. The system of claim 11, wherein, The server is further configured to: According to the authentication request, send a server ID and the system public parameter to the terminal device, so that the terminal device generates an identification public key of the server.

14. The system of claim 11, wherein, According to the authentication request, generate challenge code information, including: Input the time of the authentication request as a final time into a verification function to obtain the challenge code information.

15. The system of claim 14, wherein, Before inputting the time of the authentication request as a final time into a verification function, including: Collect time according to a preset time interval, input the collected time into a function determination model trained in advance to obtain a verification function; Detect the network transmission speed in real time, obtain a network disconnection time according to the network transmission speed, and input the network disconnection time as an initial time into the verification function.

16. The system of claim 15, wherein, The inputting of the collected time into the function determination model trained in advance to obtain a verification function includes: Establish a connection channel with a primary function database, extract a plurality of primary functions from the primary function database according to a preset connection rule to obtain an initial verification function, wherein the initial verification function contains a constant term with the same number of time characteristics; Input the collected time into a feature conversion model trained in advance to obtain an identification constant; Determine a final verification function according to the identification constant and the initial verification function.

17. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by a processor to implement the method of any one of claims 1-5 or 6-8.

Images