A CoAP network security access method based on software-defined boundaries

Abstract

The embodiment of the present invention belongs to the field of information security technology and relates to a CoAP network security access method based on software-defined boundaries. In order to alleviate the security issues of CoAP servers with limited resources, the software-defined boundary technology is combined with the CoAP network, including the following steps: introducing an SDP controller and an SDP gateway into the CoAP communication system; registering at the SDP controller when the client goes online; the client sends an SPA data packet containing its own identity information and CoAP request context information to the SDP controller; the SDP controller performs multi-factor identity authentication and multi-dimensional trust assessment on the request; for trusted requests, the SDP controller controls the SDP gateway to forward the client's data to the CoAP server. This improves the communication security performance of the CoAP server without occupying the resources of the CoAP server.

Description

Technical Field

[0001] The present invention belongs to the technical field of CoAP network access security, and in particular relates to a CoAP network access security method based on software-defined boundaries. Background Art

[0002] With the widespread adoption of the Internet of Things (IoT), the number of IoT devices is growing rapidly. The global number of IoT devices is projected to increase from 8.74 billion in 2020 to over 25.4 billion by 2030. A significant portion of these devices are small, resource-constrained devices. Many of these devices are powered by batteries, and their lifespan can only be extended by minimizing energy consumption.

[0003] Considering the limited resources and heterogeneity of IoT devices, researchers have developed various lightweight communication protocols for the IoT. The most commonly used protocols are Message Queuing Telemetry Transport (MQTT) and Constrained Application Protocol (CoAP). CoAP is an HTTP-like request / response protocol designed specifically for small IoT devices. Its transport layer uses the UDP protocol and is primarily used in constrained environments such as wireless sensor networks for web-like communication. CoAP is based on REST, where server resource addresses use a URI-like format, similar to the internet. It uses HTTP-like GET, POST, PUT, and DELETE commands to provide resource-oriented interaction within a client-server architecture. Compared to the TCP-based MQTT protocol, the UDP-based CoAP protocol reduces computational overhead and bandwidth requirements, consuming fewer resources. With the lightweighting of IoT devices and protocols, a key concern remains: privacy and security. As an emerging IoT protocol, CoAP faces many security threats, such as parsing attacks, amplification attacks, man-in-the-middle attacks, and denial-of-service attacks. In addition, CoAP server resources are quite limited, making it difficult to adopt complex security features to address security issues.

[0004] To address CoAP network security issues, a security framework based on software-defined boundaries is needed. This framework leverages a third-party SDP controller and SDP gateway for security protection without consuming server resources. The SDP gateway is deployed in front of the CoAP server, hiding server resources from the outside world. The SDP controller authenticates and evaluates the trustworthiness of access requests. Only when the trustworthiness exceeds a trust threshold will the SDP controller instruct the SDP gateway to forward communication data between the client and server. Summary of the Invention

[0005] Technical Problem: To alleviate the security issues of resource-limited CoAP servers, this invention combines software-defined boundary technology with CoAP networks. It uses an SDP gateway to hide CoAP services and an SDP controller to perform multi-factor authentication and multi-dimensional trust assessment on clients. This ensures secure communication between CoAP clients and CoAP servers without consuming CoAP server resources.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a CoAP network security access method based on software-defined boundaries, the method comprising the following steps:

[0007] S1: Add SDP gateway and SDP controller before CoAP server;

[0008] S2: The client registers on the SDP controller;

[0009] S3: The client sends a SPA packet to the SDP controller;

[0010] S4: The SDP controller authenticates the client based on the information in the SPA packet. If the authentication succeeds, the process jumps to S5.

[0011] S5: The SDP controller performs a trust calculation on this request. If the trust value is greater than the threshold, it jumps to S6.

[0012] S6: The SDP controller sends the client information to the SDP gateway;

[0013] S7: The client sends a SPA data packet to the SDP gateway; the SDP gateway cross-verifies the information in the SPA packet with the information received from the SDP controller. If the verification succeeds, the SDP gateway updates its firewall rules and opens the specified service port to the client within a preset time; if the verification fails, the communication fails;

[0014] S8: The user establishes a DTLS connection with the CoAP server through the gateway for communication.

[0015] Furthermore, the S1 includes: the server numbers each service or resource, called sdpid, and provides resource information to the SDP controller and the SDP gateway, and the SDP controller and the SDP gateway save the mapping relationship between the sdpid and the server.

[0016] Furthermore, S2 includes: the client registers its own username and password with the SDP controller, the SDP controller generates a symmetric encryption key for encrypting SPA data packets and an HMAC key for generating a digest for the client, and provides the address of the SDP gateway, the sdpid of all services, and the port number mapped to the SDP gateway to the client.

[0017] Furthermore, the S3 includes: the SPA data packet sent by the client includes its own IP, username and password, CoAP request context, digest HMAC, and encrypts the SPA packet.

[0018] Furthermore, the S4 includes: the SDP controller decrypts the SPA data packet using the symmetric key, and verifies whether the IP, user name, password hash and HMAC contained in the SPA are correct.

[0019] Furthermore, the S5 includes: the SDP controller calculates a comprehensive trust value and a trust threshold based on multi-dimensional attributes. If the comprehensive trust value is greater than the trust threshold required by the resource, the client is trustworthy; otherwise, it is not trustworthy.

[0020] Furthermore, the calculation method of the trust value and trust threshold is as follows:

[0021] The calculation of trust value consists of two parts: direct trust value DT and comprehensive trust value CT;

[0022] The direct trust value consists of four parts: the client's initial credibility T i , DTLS security credibility T dtls , environmental trust value T e , abnormal behavior trust evaluation value T b ;

[0023] T i It is the initial trust score obtained after the client is authenticated and is set to 100;

[0024] T dtls Depending on the encryption method of the DTLS tunnel, different encryption methods correspond to different security levels sl. sl takes a positive integer between [0, 3]. If DTLS is in NoSec mode, sl takes a value of 0; if DTLS is in PresharedKey mode, sl takes a value of 1; if DTLS is in RawPublicKey mode, sl takes a value of 2; if DTLS is in Certificates mode, sl takes a value of 3.

[0025] T dtls The calculation formula is as follows:

[0026]

[0027] T e It is the ratio of the number of trusted requests received by the SDP controller. Assume that the number of trusted requests in all requests received in the last minute is N. t , the number of untrusted requests is N ut , T e The calculation formula is as follows:

[0028]

[0029] T b is the proportion of abnormal behavior of the client. Assume that the number of normal request behaviors of the client evaluated by the system is N n times, the number of abnormal request behaviors is N an , T b The calculation formula is as follows:

[0030]

[0031] The calculation formula of direct trust value DT is as follows, where w is the weighted coefficient of each trust source:

[0032] DT=T i +w1*T dtls +w2*T e +w3*T b

[0033] The comprehensive trust value is obtained by weighting the direct trust value and the comprehensive trust value of the last visit. The SDP controller records the comprehensive trust value of the client and its generation time. Assume that t i is the time of this request, t j The time of the last request, DT i CT is the direct trust value evaluated by the SDP controller for this request. j For the last request t j The comprehensive trust value calculated at this time, the comprehensive trust value calculation formula for this request is CT i as follows:

[0034]

[0035] Trust threshold T th The calculation formula is as follows:

[0036] T th =MAX(Op con *Ob con ,Op int *Ob int )

[0037] Ob conRefers to the confidentiality level of the client's access target, Ob int Refers to the completeness of the target accessed by the client. Different targets have different confidentiality and completeness. For targets like temperature values, the confidentiality is set to 0, but the completeness is higher, set to 100. For targets involving personal privacy, the confidentiality is extremely high, but the completeness is low.

[0038] Op is the impact factor of the four request methods of adding, deleting, modifying and querying on the confidentiality and integrity of the target data. If the client request method is GET, then the confidentiality impact factor Op is con =1, the integrity impact factor Op int Is 0; if the client request method is POST and PUT, then the confidentiality factor Op con is 0.5, the integrity impact factor Op int is 0.5; if the client request method is DELETE, then the confidentiality factor Op con is 0, the integrity impact factor Op int is 1.

[0039] Furthermore, the S7 includes: the SDP controller sends the HMAC key and the symmetric encryption key contained in the SPA to the SDP gateway; the gateway decrypts the SPA data packet using the symmetric encryption key, verifies the HMAC digest, and compares whether the information in the two SPA packets is the same. If the information is the same, it proves that it is the same client.

[0040] Furthermore, the S7 includes: the SDP gateway discards all received non-SPA data packets by default. When the SDP gateway verifies the client successfully, the gateway adds a firewall rule to forward the client's non-SPA data packets to the corresponding server. The rule is valid within a preset time.

[0041] Beneficial effects: Compared with the prior art, the technical solution of the present invention has the following beneficial technical effects:

[0042] As an emerging IoT protocol, CoAP faces multiple network security challenges. Its lightweight nature makes traditional, complex security features impossible to implement. This article combines SDP technology with CoAP to design a new security framework, SDP-CoAP, to mitigate the advanced security threats faced by traditional CoAP. The implementation of the SDP-CoAP architecture is described in detail. While SDP's authentication process increases latency in communications between devices, the SDP-CoAP authentication process only occurs once before establishing a connection. Running the SDP component does not impose significant computational overhead on resource-constrained CoAP clients. This article proposes a solution for introducing a zero-trust mechanism to enhance the security capabilities of lightweight IoT protocols such as CoAP. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 An SDP-based CoAP network structure is provided in an embodiment of the present invention;

[0044] Figure 2 A structure of a SPA data packet provided by an embodiment of the present invention;

[0045] Figure 3 An embodiment of the present invention provides a communication process of a CoAP network based on SDP. DETAILED DESCRIPTION

[0046] The following is a clear and complete description of the technical solutions in the embodiments of the present invention, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts are within the scope of protection of the present invention.

[0047] The terms "comprises" and "having" and any variations thereof in the description and claims of the present invention are intended to cover non-exclusive inclusions. For example, a process or apparatus comprising a series of steps is not necessarily limited to those structures or steps explicitly listed but may include other steps or structures not explicitly listed or inherent to the process or apparatus.

[0048] refer to Figure 1-3 , an embodiment of the present invention proposes a CoAP network security access method based on software-defined boundaries, the method comprising the following steps:

[0049] 1: Add SDP gateway and SDP controller before CoAP server;

[0050] 2: The client registers on the SDP controller;

[0051] 3: The client sends a SPA packet to the SDP controller;

[0052] 4: The SDP controller performs identity authentication based on the information in the SPA packet. If the identity authentication succeeds, it jumps to 5;

[0053] 5: The SDP controller performs a trust evaluation on this request. If the trust value is greater than the threshold, it jumps to 6;

[0054] 6: The SDP controller sends the client's information to the gateway;

[0055] 7: The client sends an SPA packet to the SDP gateway. The SDP gateway cross-verifies the information in the SPA packet with the information received from the SDP controller. If the verification is successful, the SDP gateway updates its firewall rules and opens the specified service port to the client within the preset time.

[0056] 8: The user establishes a DTLS connection with the CoAP server through the gateway.

[0057] Furthermore, in step 1, an SDP controller and an SDP gateway are deployed in the CoAP network, such as Figure 1 As shown in the figure, the server assigns a number to each service or resource, called an sdpid, and provides this resource information to the SDP controller and SDP gateway. The SDP gateway is deployed before the CoAP server. The server hides its URI and does not provide it to the public. Only the SDP gateway knows the server URI corresponding to the sdpid.

[0058] Furthermore, in step 2, the client registers its IP address, username, and password with the SDP controller. To prevent leaks, the SDP controller stores a hash of the password in its database rather than the password itself. The controller provides the client with the symmetric encryption key used to encrypt SPA packets and the HMAC key used to generate the message authentication code. It also provides the address of the SDP gateway and the SDPIDs of all services.

[0059] Furthermore, in step 3, the package structure of SPA is as follows Figure 2 As shown, SPA consists of three parts. The first is the UDP header, which contains the visitor's IP address. The second part is the basic message, which includes a timestamp and a 32-bit random number to prevent replay attacks. The username and password are used for identity authentication. To prevent password leakage during transmission, the password is hashed. The CoAP request context includes the access method, the resource sdpid to be accessed, and the DTLS tunnel encryption method. There are four access methods: GET (query), PUT (add), POST (modify), and DELETE (delete). There are four DTLS encryption methods: NoSec, PresharedKey, RawPublicKey, and Certificates. These represent, respectively, not establishing a DTLS connection, establishing a DTLS connection using a pre-shared symmetric encryption key, forcing the device to establish a DTLS connection using a pre-configured key list, and establishing a DTLS connection using an asymmetric key and X.509 certificate. The third part is the HMAC digest, which is generated to verify the device's identity. Finally, the entire SPA packet is encrypted using the Rijndael algorithm.

[0060] Furthermore, in step 4, the SDP controller decrypts the SPA packet using the symmetric key. First, identity authentication is performed: the IP address, username, and password hash contained in the SPA packet are compared with a database. Device authentication is then performed: the digest is decrypted using the HMAC key. Successful decryption indicates that the client device is registered. Furthermore, the controller records the last valid authorized SPA packet it received to prevent attackers from replaying old packets. If both identity and device authentication pass and the SPA packet is not a duplicate, the controller proceeds to step 5. Otherwise, it does nothing.

[0061] Furthermore, in step 5, the SDP controller calculates a comprehensive trust value and trust threshold based on the multi-dimensional attributes. If the comprehensive trust value is greater than the required trust threshold for the resource, the client is trusted; otherwise, it is untrustworthy. The trust value calculation consists of two parts: the direct trust value DT and the comprehensive trust value CT.

[0062] The direct trust value consists of four parts: the client's initial credibility T i , DTLS security credibility T dtls , environmental trust value T e , abnormal behavior trust evaluation value T b ;

[0063] T i It is the initial trust score obtained after the subject has been authenticated and is set to 100;

[0064] T dtls Depending on the encryption method of the DTLS tunnel, different encryption methods correspond to different security levels sl. sl takes a positive integer between [0, 3], and the values ​​are shown in the table.

[0065]

[0066] T dtls The calculation formula is as follows:

[0067]

[0068] T e Determined by the current network environment, it is the ratio of the number of trusted requests received by the SDP controller. Assume that the number of trusted requests in all requests received in the last minute is N. t , the number of untrusted requests is N ut , T e The calculation formula is as follows:

[0069]

[0070] T bis the percentage of abnormal behavior of the client. Assume that the number of normal request behaviors of the client evaluated by the system is N n times, the number of abnormal request behaviors is N an , T b The calculation formula is as follows.

[0071]

[0072] The calculation formula of direct trust value DT is as follows, where w is the weighted coefficient of each trust source:

[0073] DT=T i +w1*T dtls +w2*T e +w3*T b

[0074] In order to take historical factors into account, the comprehensive trust value is further introduced. The comprehensive trust value is obtained by weighting the direct trust value and the comprehensive trust value of the last access. The SDP controller records the comprehensive trust value of the client and its generation time. Assume that t i is the time of this request, t j The time of the last request, DT i CT is the direct trust value evaluated by the SDP controller for this request. j For the last request t j The comprehensive trust value calculated at this time, the comprehensive trust value calculation formula for this request is CT i as follows:

[0075]

[0076] θ is a Gaussian decay function. Requests closer to the current request have greater reference value, mitigating the impact of the previous access over time. Furthermore, to prevent attackers from accumulating trust by performing several normal accesses before launching an attack, historical factors are only considered when the previous comprehensive trust is lower than the current trust value.

[0077] Trust threshold T th The calculation formula is as follows:

[0078] T th =MAX(Op con *Ob con ,Op int *Ob int )

[0079] Ob con Refers to the confidentiality level of the client's access target, Ob intRefers to the completeness of the target accessed by the client. Different targets have different confidentiality and completeness. For targets like temperature values, the confidentiality is set to 0, but the completeness is higher, set to 100. For targets involving personal privacy, the confidentiality is extremely high, but the completeness is low.

[0080] Op is the impact factor of the four request methods of adding, deleting, modifying and querying on the confidentiality and integrity of the target data. If the client request method is GET, then the confidentiality impact factor Op is con =1, the integrity impact factor Op int Is 0; if the client request method is POST and PUT, then the confidentiality factor Op con is 0.5, the integrity impact factor Op int is 0.5; if the client request method is DELETE, then the confidentiality factor Op con is 0, the integrity impact factor Op int is 1.

[0081] When the comprehensive trust value is greater than the trust threshold, jump to step 6.

[0082] Furthermore, in step 6, the SDP controller sends the client information to the SDP gateway, including the visitor's IP information, username and password, HMAC key, Rijndael encryption key, access method, resource sdpid to be accessed, and DTLS tunnel encryption method.

[0083] Furthermore, in step 7, the client generates another SPA packet and sends it to the SDP gateway. The SDP gateway decrypts the SPA packet using the Rijndael encryption key from step 6, decrypts the digest using HMAC, and compares the IP address, username, password, and CoAP request context contained in the SPA packet with the information from step 6. If they match, it indicates the same user. The SDP gateway then adds a rule to the iptables to forward packets from this client to the CoAP server. This rule is deleted after 20 seconds.

[0084] Furthermore, in step 8, the client sends a CoAP request to the server or establishes a DTLS connection, so that secure communication is possible.

[0085] The above description of the present invention is illustrative. It is clear that the specific implementation of the present invention is not limited to the above-described methods. Any non-substantial improvements made using the method concepts and technical solutions of the present invention, or any direct application of the concepts and technical solutions of the present invention to other situations without modification, are all within the scope of protection of the present invention. The scope of protection of the present invention shall be based on the scope of protection defined in the claims.

Claims

1. A CoAP network security access method based on software-defined boundaries, characterized in that: The method comprises the following steps: S1: CoAP server adds SDP gateway and SDP controller; S2: The client registers on the SDP controller; S3: The client sends a SPA packet to the SDP controller; S4: The SDP controller authenticates the client based on the information in the SPA data packet. If the authentication succeeds, the process jumps to S5. S5: The SDP controller performs a trust calculation on this request. If the trust value is greater than the threshold, it jumps to S6. S6: The SDP controller sends the client information to the SDP gateway; S7: The client sends an SPA packet to the SDP gateway. The SDP gateway cross-validates the information in the SPA packet with the information received from the SDP controller. If the validation succeeds, the SDP gateway updates its firewall rules and opens the specified service port to the client within a preset time. If the validation fails, the communication fails. S8: The user establishes a DTLS connection with the CoAP server through the gateway for communication; The calculation method of the trust value and trust threshold is as follows: The calculation of trust value consists of two parts: direct trust value DT and comprehensive trust value CT; The direct trust value consists of four parts: the client's initial credibility T i , DTLS security credibility T dtls , environmental trust value T e , abnormal behavior trust evaluation value T b ; T i It is the initial trust score obtained after the client is authenticated and is set to 100; T dtls Depending on the encryption method of the DTLS tunnel, different encryption methods correspond to different security levels sl. sl takes a positive integer between [0, 3]. If DTLS is in NoSec mode, sl takes a value of 0; if DTLS is in PresharedKey mode, sl takes a value of 1; if DTLS is in RawPublicKey mode, sl takes a value of 2; if DTLS is in Certificates mode, sl takes a value of 3. T dtls The calculation formula is as follows: T e It is the ratio of the number of trusted requests received by the SDP controller. Assume that the number of trusted requests in all requests received in the last minute is N. t , the number of untrusted requests is N ut , T e The calculation formula is as follows: T b is the proportion of abnormal behavior of the client. Assume that the number of normal request behaviors of the client evaluated by the system is N n times, the number of abnormal request behaviors is N an , T b The calculation formula is as follows: The calculation formula of direct trust value DT is as follows, where w is the weighted coefficient of each trust source: DT=T i +w1*T dtls +w2*T e +w3*T b The comprehensive trust value is obtained by weighting the direct trust value and the comprehensive trust value of the last visit. The SDP controller records the comprehensive trust value of the client and its generation time. Assume that t i is the time of this request, t j The time of the last request, DT i CT is the direct trust value evaluated by the SDP controller for this request. j For the last request t j The comprehensive trust value calculated at this time, the comprehensive trust value calculation formula for this request is CT i as follows: Trust threshold T th The calculation formula is as follows: T th =MAX(On con *Whether con ,On int *Whether int ) Ob con Refers to the confidentiality level of the client's access target, Ob int Refers to the completeness of the customer's access to the target; If the client request method is GET, then the confidentiality factor Op con =1, the integrity impact factor Op int Is 0; if the client request method is POST and PUT, then the confidentiality factor Op con is 0.5, the integrity impact factor Op int is 0.5; if the client request method is DELETE, then the confidentiality factor Op con is 0, the integrity impact factor Op int is 1.

2. A CoAP network security access method based on software-defined boundaries according to claim 1, characterized in that: Said S1 includes: the server assigns a number to each service or resource, called sdpid, and provides resource information to the SDP controller and the SDP gateway, and the SDP controller and the SDP gateway save the mapping relationship between the sdpid and the server.

3. A CoAP network security access method based on software-defined boundaries according to claim 1, characterized in that: The S2 includes: the client registers its own username and password with the SDP controller, the SDP controller generates a symmetric encryption key for encrypting SPA data packets and an HMAC key for generating a digest for the client, and provides the client with the address of the SDP gateway, the sdpid of all services, and the port number mapped to the SDP gateway.

4. A CoAP network security access method based on software-defined boundaries according to claim 1, characterized in that: The S3 includes: the SPA data packet sent by the client includes its own IP, username and password, CoAP request context, digest HMAC, and encrypts the SPA data packet.

5. The CoAP network security access method based on software-defined boundaries according to claim 1 is characterized in that: The S4 includes: the SDP controller decrypts the SPA data packet using the symmetric key, and verifies whether the IP, user name, password hash and HMAC contained in the SPA data packet are correct.

6. A CoAP network security access method based on software-defined boundaries according to claim 1, characterized in that: The S5 includes: the SDP controller calculates a comprehensive trust value and a trust threshold based on multi-dimensional attributes. If the comprehensive trust value is greater than the trust threshold required by the resource, the client is trustworthy; otherwise, it is not trustworthy.

7. A CoAP network security access method based on software-defined boundaries according to claim 1, characterized in that: S7 includes: the SDP controller sends the HMAC key and the symmetric encryption key in the SPA data packet to the SDP gateway; the gateway decrypts the SPA data packet using the symmetric encryption key, verifies the HMAC digest, and compares whether the information in the two SPA data packets is the same. If the information is the same, it proves that they are the same client.

8. The CoAP network security access method based on software-defined boundaries according to claim 1 is characterized in that: The S7 includes: the SDP gateway discards all received non-SPA data packets by default. When the SDP gateway verifies the client successfully, the gateway adds a firewall rule to forward the client's non-SPA data packets to the corresponding server. The rule is valid within a preset time.

Images