A system and method for supporting LORA and NB_IOT dual-channel verification device identity security

Abstract

A system and method for supporting LORA and NB_IOT dual-channel verification device identity security, wherein the system comprises: a LORA module electrically connected with an Internet of Things device, used for reducing communication energy consumption and communication cost; an NB_IOT module electrically connected with the Internet of Things device, used for strengthening verification; a LORA HUB module electrically connected with a verification gateway / server; an NB_IOT HUB module electrically connected with the verification gateway / server; wherein the LORA module and the LORA HUB module are in communication connection for communication, submitting the Internet of Things device identification to the verification gateway / server, and listening to the communication channel of the NB_IOT module and the NB_IOT HUB module, and the NB_IOT module and the NB_IOT HUB module are in communication connection for communication and strengthening verification. The dual-channel mode is added, and an encryption algorithm or an offset corresponding to the device identification is set in the device, so that the security of the key can be fully guaranteed even if the communication packet is stolen.

Description

Technical Field

[0001] This invention relates to the field of wide area narrowband device IoT security technology, and in particular to a system and method that supports dual-channel authentication of device identity security using LoRa and NB_IOT. Background Technology

[0002] In 2022, there will be approximately 29 billion connected devices, of which about 18 billion will be related to the Internet of Things (IoT). These figures easily illustrate the importance of having secure IoT devices. In fact, 70% of IoT devices have serious security vulnerabilities. When so many devices are interconnected through insecure platforms, the potential for compromised data and cybersecurity is extremely high.

[0003] IoT gateways are typically deployed in unattended scenarios and are responsible for communicating with various data acquisition devices and industrial control devices connected to the local southbound interface. In order to ensure that the various devices connected are legitimate, security authentication and identity verification are required when the devices are connected, and a unique encryption method or key must be agreed upon with the devices when they are connected.

[0004] The IoT platform uses ProductKey to identify products and DeviceName to identify devices. Device certificates (ProductKey, DeviceName, and DeviceSecret) verify the device's legitimacy. Before a device can connect to the IoT platform via the protocol, it must report product and device information according to different authentication methods. Only after successful authentication can the device connect to the IoT platform. The IoT platform provides multiple authentication schemes for different usage environments.

[0005] The IoT platform currently offers three authentication schemes:

[0006] One device, one secret: Each device is programmed with its own device certificate (ProductKey, DeviceName, and DeviceSecret).

[0007] One product, one secret: Devices under the same product are burned with the same product certificate (ProductKey and ProductSecret).

[0008] Sub-device dynamic registration: After the IoT gateway connects to the cloud, the sub-devices obtain the DeviceSecret through dynamic registration.

[0009] The first method is the most secure, and the second method is relatively secure. However, many devices connected to the platform through IoT gateways lack the capability to program certificates, such as some low-cost sensors, a large number of older data acquisition devices, and industrial control equipment. Therefore, security primarily relies on the third authentication scheme, which involves sub-devices dynamically registering to obtain keys after connecting to the cloud via an IoT gateway. The security vulnerability of these methods lies in the fact that if only one channel is available for registration and key acquisition, it is easily stolen by unauthorized devices through eavesdropping on communication packet protocols. Summary of the Invention

[0010] In view of the shortcomings of the prior art, the present invention relates to a system and method for supporting dual-channel authentication of device identity security using LoRa and NB-IoT. By adding a dual-channel approach, an encryption algorithm or offset is set in the device that uniquely corresponds to the device identifier, so that the security of the key can be fully guaranteed even if the communication packet is stolen.

[0011] This invention relates to a system that supports dual-channel authentication of device identity security using both LoRa and NB-IoT, comprising:

[0012] A LoRa module, which is electrically connected to an IoT device, is used to reduce communication power consumption and communication costs;

[0013] The NB_IOT module is electrically connected to the Internet of Things (IoT) device and is used to enhance verification.

[0014] The LORA HUB module is electrically connected to the authentication gateway / server.

[0015] The NB_IOT HUB module is electrically connected to the authentication gateway / server.

[0016] The LORA module is communicatively connected to the LORA HUB module, and the NB_IOT module is communicatively connected to the NB_IOT HUB module. The communication connection between the LORA module and the LORA HUB module is used for communication, submitting IoT device identifiers to the verification gateway / server, and monitoring the communication channel between the NB_IOT module and the NB_IOT HUB module. The communication connection between the NB_IOT module and the NB_IOTHUB module is used for communication and enhanced verification.

[0017] By adopting the above scheme and using a dual-channel approach, the security of the key is fully guaranteed on the one hand, and the communication energy consumption and communication cost are reduced on the other hand.

[0018] Furthermore, the IoT device includes a secure network proxy process.

[0019] This invention also provides a method for supporting dual-channel authentication of device identity security using LoRa and NB-IoT, employing the aforementioned system for supporting dual-channel authentication of device identity security using LoRa and NB-IoT, comprising the following steps:

[0020] S1. Start the secure network agent process;

[0021] S2. The device identifier of the IoT device is submitted to the access verification gateway / server through the LORA module communication. After that, the LORA module listens to the communication channel of the NB_IOT module.

[0022] S3. After receiving the device identifier, the verification gateway / server generates a device identifier code and a random verification code data pair, which are temporarily stored in the verification buffer table, and the remaining validity time is recorded at the same time.

[0023] S4. Verify the verification buffer table at regular time intervals.

[0024] S5. The verification gateway / server sends a random verification code to the IoT device through the NB_IOT module;

[0025] S6. After receiving the random verification code through the NB_IOT module communication channel, the secure network proxy process fills in the verification code for the secure network proxy process to access the network and submits it to the access verification gateway / server.

[0026] S7. The access verification gateway / server receives the verification code and the device identifier of the IoT device, checks them against the verification buffer table, confirms the access request if successful, transmits the device key, and subsequently uses this key to encrypt secure communication between the two parties; otherwise, the access request is rejected.

[0027] By adopting the above scheme, the security of the key is fully guaranteed.

[0028] Furthermore, the time interval mentioned in step S4 is a custom duration.

[0029] By adopting the above solution, the time interval can be adjusted according to the user's needs.

[0030] Furthermore, in step S4, when checking the verification buffer table, data pairs with a remaining valid time of 0 are deleted.

[0031] The above method is used to delete expired data pairs.

[0032] Furthermore, after the NB_IOT module undergoes enhanced verification, the IoT device stops the NB_IOT module from working and uses the LORA module for communication.

[0033] By adopting the above solution, the security of LoRa communication can be ensured while reducing communication energy consumption and communication costs. Attached Figure Description

[0034] Figure 1 This is a schematic diagram of the module connection relationship in Embodiment 1 of the present invention. Detailed Implementation

[0035] The technical solutions in the embodiments of the present invention will be clearly and completely described and discussed below with reference to the accompanying drawings. Obviously, what is described here is only a part of the examples of the present invention, not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the protection scope of the present invention.

[0036] To facilitate understanding of the embodiments of the present invention, further explanations and descriptions will be provided below with reference to the accompanying drawings and specific embodiments, and these embodiments do not constitute a limitation on the embodiments of the present invention.

[0037] Example 1 of the present invention refers to Figure 1 As shown, this relates to a system and method for supporting dual-channel authentication of device identity security using LoRa and NB_IOT, wherein the system includes:

[0038] A LoRa module, which is electrically connected to an IoT device, is used to reduce communication power consumption and communication costs;

[0039] The NB_IOT module is electrically connected to the Internet of Things (IoT) device and is used to enhance verification.

[0040] The LORA HUB module is electrically connected to the authentication gateway / server.

[0041] The NB_IOT HUB module is electrically connected to the authentication gateway / server.

[0042] The LORA module is communicatively connected to the LORA HUB module, and the NB_IOT module is communicatively connected to the NB_IOT HUB module. The communication connection between the LORA module and the LORA HUB module is used for communication, submitting IoT device identifiers to the verification gateway / server, and monitoring the communication channel between the NB_IOT module and the NB_IOT HUB module. The communication connection between the NB_IOT module and the NB_IOTHUB module is used for communication and enhanced verification.

[0043] The IoT device includes a proxy process that requests access to a secure network.

[0044] This invention also provides a method for supporting dual-channel authentication of device identity security using LoRa and NB-IoT, comprising the following steps:

[0045] S1. Start the secure network agent process;

[0046] S2. The device identifier of the IoT device is submitted to the access verification gateway / server through the LORA module communication. After that, the LORA module listens to the communication channel of the NB_IOT module.

[0047] S3. After receiving the device identifier, the verification gateway / server generates a device identifier code and a random verification code data pair, which are temporarily stored in the verification buffer table, and the remaining validity time is recorded at the same time.

[0048] S4. Verify the verification buffer table at regular time intervals.

[0049] S5. The verification gateway / server sends a random verification code to the IoT device through the NB_IOT module;

[0050] S6. After receiving the random verification code through the NB_IOT module communication channel, the secure network proxy process fills in the verification code for the secure network proxy process to access the network and submits it to the access verification gateway / server.

[0051] S7. The access verification gateway / server receives the verification code and the device identifier of the IoT device, checks them against the verification buffer table, confirms the access request if successful, transmits the device key, and subsequently uses this key to encrypt secure communication between the two parties; otherwise, the access request is rejected.

[0052] The time interval mentioned in step S4 is a custom duration, with 60 seconds being the optimal time interval.

[0053] In step S4, when checking the verification buffer table, delete data pairs with a remaining validity period of 0.

[0054] After the NB_IOT module is enhanced and verified, the IoT device stops the NB_IOT module from working and uses the LORA module for communication.

[0055] This invention is applicable to application scenarios where IoT terminal devices or IoT communication gateway devices access secure IoT networks. It adds a dual-channel approach to solve the problem of IoT device access security, preventing unauthorized devices, unverified devices, and insecure devices from accessing the IoT network. It sets an encryption algorithm or offset that uniquely corresponds to the device identifier within the device, so that even if the communication packet is stolen, the security of the key can be fully guaranteed.

[0056] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for supporting dual-channel authentication of device identity security using LoRa and NB-IoT, comprising a system for supporting dual-channel authentication of device identity security using LoRa and NB-IoT, characterized in that... The system includes: A LoRa module, which is electrically connected to an IoT device, is used to reduce communication power consumption and communication costs; The NB_IOT module is electrically connected to the Internet of Things (IoT) device and is used to enhance verification. The LORA HUB module is electrically connected to the authentication gateway / server. The NB_IOT HUB module is electrically connected to the authentication gateway / server. The LORA module and LORA HUB module are communicatively connected, and the NB_IOT module and NB_IOT HUB module are also communicatively connected. This communication connection between the LORA module and LORA HUB module is used for communication, submitting IoT device identifiers to the authentication gateway / server, and monitoring the communication channel between the NB_IOT module and NB_IOT HUB module. The communication connection between the NB_IOT module and NB_IOT HUB module is used for communication and enhanced authentication. The method includes the following steps: S1. Start the secure network agent process; S2. The device identifier of the IoT device is submitted to the access verification gateway / server through the LORA module communication. After that, the LORA module listens to the communication channel of the NB_IOT module. S3. After receiving the device identifier, the verification gateway / server generates a device identifier code and a random verification code data pair, which are temporarily stored in the verification buffer table, and the remaining validity time is recorded at the same time. S4. Verify the verification buffer table at regular time intervals. S5. The verification gateway / server sends a random verification code to the IoT device through the NB_IOT module; S6. After receiving the random verification code through the NB_IOT module communication channel, the secure network proxy process fills in the verification code for the secure network proxy process to access the network and submits it to the access verification gateway / server. S7. The access verification gateway / server receives the verification code and the device identifier of the IoT device, checks them against the verification buffer table, confirms the access request if successful, transmits the device key, and subsequently uses this key to encrypt secure communication between the two parties; otherwise, the access request is rejected.

2. The method for supporting dual-channel authentication of device identity security using LoRa and NB-IoT as described in claim 1, characterized in that: The time interval mentioned in step S4 is a custom duration.

3. The method for supporting dual-channel authentication of device identity security using LoRa and NB-IoT as described in claim 1, characterized in that: In step S4, when checking the verification buffer table, delete data pairs with a remaining validity period of 0.

4. The method for supporting dual-channel authentication of device identity security using LoRa and NB-IoT as described in claim 1, characterized in that: After the NB_IOT module is enhanced and verified, the IoT device stops the NB_IOT module from working and uses the LORA module for communication.

Images