A trusted authentication method for smart light poles

Abstract

The present invention provides a trusted authentication method for smart lamp poles, belonging to the technical field of smart city Internet of Things. The trusted authentication method includes an initialization stage, a registration stage, a time synchronization stage, a data encryption stage, a data decryption stage, an identity authentication stage and a smart lamp pole terminal data collection or a cloud platform reverse control stage; the initialization stage generates a global master key, the registration stage is the smart lamp pole terminal and the edge gateway register on the cloud platform and obtain the global master key and a unique identity ID identification code, the time synchronization stage ensures the time consistency of each node of the system, the encryption / decryption stage realizes the conversion between plaintext data and ciphertext data, the identity authentication stage realizes the node identity trusted authentication, and the smart lamp pole terminal data collection or cloud platform reverse control stage is the normal working state of the system; the method realizes the trusted authentication between the smart lamp pole terminal, the edge gateway and the cloud platform, and can effectively improve the security of the smart lamp pole system.

Description

Technical Field

[0001] The present invention relates to the technical field of smart city Internet of Things, and in particular to a trusted authentication method for smart lamp poles. Background Art

[0002] Smart light poles include the pole body and the sensing terminals (various devices and sensors) carried by it. They are a new type of IoT infrastructure that integrates smart lighting, information release, video surveillance, environmental monitoring, communication services, energy services and one-click help. However, the number of smart light pole terminal nodes is huge, and most of the time they are in an unattended environment, with low mobility and limited resources, and their security faces huge challenges. Various provinces have formulated relevant construction standards for smart light poles, such as Jiangsu Provincial Local Standard DB32 / T3877-2020 "Technical and Engineering Construction Specifications for Multifunctional Pole Intelligent Systems" and Guangdong Provincial Local Standard DBJ / T 15-164-2019 "Technical Specifications for Smart Light Poles", but there is a lack of formulation of security technical standards. Most of the existing smart light pole platforms use plain text data transmission, do not implement identity authentication and binding for mounted devices, or use complex encryption algorithms to achieve identity authentication and adopt centralized management methods. The existing complex encryption algorithm technical solutions have a large amount of computation and are not suitable for resource-constrained terminals. The existing plain text data transmission methods have problems such as counterfeiting attacks, eavesdropping attacks, replay attacks, and channel blocking. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a trusted authentication method for smart light poles, to achieve trusted authentication between smart light pole terminals, edge gateways and cloud platforms, and to effectively improve the security of the smart light pole system.

[0004] To achieve the above object, the present invention adopts the following technical solution: a trusted authentication method for smart lamp poles, comprising the following steps:

[0005] Step 1: During the initialization phase, the system administrator generates a global master key on the cloud platform;

[0006] Step 2: Registration phase, including the following processes:

[0007] The edge gateway or smart light pole terminal is registered on the cloud platform. When registering, input the light pole location information, device type and device number information. The system generates a unique ID code and sends the unique ID code and system master key to the smart light pole terminal or edge gateway through a secure channel.

[0008] The cloud platform performs hash operations on the unique ID codes registered by the smart lamp pole terminal and the edge gateway, and stores the hash values ​​of the operation results in the database;

[0009] Step 3: During the synchronization phase, the edge gateway needs to send a synchronization request to the cloud platform when it is started, and the smart light pole terminal needs to send a synchronization request to the edge gateway when it is started. The smart light pole terminal and the edge gateway should perform synchronization operations every day. The time to send the synchronization request is determined by the hash value of its unique identity ID code after hashing.

[0010] Step 4: Data encryption phase, realizing the encryption process of plaintext data;

[0011] Step 5: Data decryption phase, realizing the decryption process of ciphertext data;

[0012] Step 6: Identity authentication phase, used to determine the credibility of the identity source and the correctness of the data;

[0013] Step 7: Smart lamp pole terminal data collection or cloud platform reverse control stage.

[0014] In a preferred embodiment, the step 4 specifically includes the following steps:

[0015] Step 41: Calculate the key seed of the symmetric encryption algorithm. The key seed is derived from the global master key or the system clock. Before the sending end and the receiving end complete the time synchronization, the key seed is derived from the global master key. After the time synchronization is completed, the combination of the system clock and the global master key is used.

[0016] Step 42: adopt private protocol transformation, take the key seed as input, calculate the output to obtain the pseudo key;

[0017] Step 43: Using a hash operation, taking the pseudo key as input, and calculating the output to obtain a symmetric encryption key;

[0018] Step 44: Use a symmetric encryption algorithm and the encryption key calculated above to encrypt the plaintext data.

[0019] In a preferred embodiment, the step 5 specifically includes the following steps:

[0020] Step 51: Try to decrypt the key seed derived from the combination of the system clock and the system master key, perform a private protocol transformation on the key seed to obtain a pseudo key, and perform a hash operation on the pseudo key to obtain an encryption key;

[0021] Step 52: Decrypt the data. If the decryption is successful, the decrypted data is returned. Otherwise, continue to execute the following steps;

[0022] Step 53: Considering that there may be a time difference between the encryption at the sender and the decryption at the receiver due to network transmission delay, determine whether the current system time is in a cross-time interval. If so, try to decrypt using the key seed from the previous time interval and the global master key combination. If the decryption is successful, return the decrypted data, otherwise continue to execute the following steps;

[0023] Step 54: Try to use the global master key as the key seed to perform decryption. If the decryption is successful, the decrypted data is returned. Otherwise, a decryption failure instruction is returned and the decryption failure counter is incremented by 1. When the decryption failure count value exceeds the set threshold, the receiving end disconnects from the sending end.

[0024] Step 55: If the decryption is successful, the decryption failure counter value is reset to zero.

[0025] In a preferred embodiment, the transmitted data is encapsulated in JSON format and includes three data areas, namely, an identity authentication area, a key data encryption area, and a non-key data unencrypted area. The identity authentication area contains random numbers, timestamps, identity IDs, and function code information, all of which are encrypted and transmitted in ciphertext form.

[0026] In a preferred embodiment, the smart light pole platform is divided into three parts: a smart light pole terminal, an edge gateway and a cloud platform. A distributed authentication mechanism is adopted to delegate the authentication function of the smart light pole terminal to a legitimate edge gateway, so that the edge gateway can directly authenticate the smart light pole terminal device. When the edge gateway authenticates the smart light pole terminal for the first time, it needs to request the cloud platform to determine the legitimacy of the identity of the smart light pole terminal. Before the smart light pole terminal authenticates, it should confirm that the edge gateway has been authenticated, and then send an identity authentication request instruction to the edge gateway after confirmation. Before the edge gateway completes the authentication, it will not respond to the data, identity authentication request and time synchronization request sent by the smart light pole terminal.

[0027] In a preferred embodiment, the identity authentication stage of step 6 takes the cloud platform authenticating the edge gateway as an example, and specifically includes the following steps:

[0028] Step 61: The edge gateway generates a random number and a timestamp parameter, encapsulates it according to the JSON format of the identity authentication zone, where the function code is an identity authentication request, and sends the encapsulated data to the cloud platform;

[0029] Step 62: The cloud platform decrypts the received data and determines whether the timestamp is valid. If not, it returns authentication failure, otherwise, it executes the following steps;

[0030] Step 63: Determine whether the random number is repeated with the random number of the data packet within the previous 10 seconds. If so, return authentication failure, otherwise execute the following steps;

[0031] Step 64: Perform a hash operation on the unique ID code, search and match the hash value with the database registry, and if the match fails, return authentication failure, otherwise return authentication success, and the authentication failure counter value is reset to zero;

[0032] Step 65: If the authentication fails, the authentication failure counter is incremented by 1. When the authentication failure count value exceeds the set threshold, the receiving end disconnects from the sending end.

[0033] Compared with the prior art, the present invention has the following beneficial effects:

[0034] 1. During the data encryption phase, only a maximum of 2 hash operations and 1 symmetric encryption operation are required. During the data decryption phase, only a maximum of 6 hash operations and 3 symmetric encryption operations are required. Compared with the asymmetric encryption algorithm, the computing performance is greatly reduced. The lightweight design meets the characteristics of limited resources of the smart lamp pole terminal.

[0035] 2. The distributed authentication mechanism is more flexible and has good system scalability. The failure of one authentication service node will not cause the entire system authentication service to be paralyzed, and channel blocking problems can be effectively avoided.

[0036] 3. The combination of an unchanging key seed and a variable key seed based on the system clock effectively solves the problem of difficult symmetric encryption key management and low encryption security. This makes key storage more secure, increases the difficulty of brute force cracking, and improves the security of encryption algorithms.

[0037] 4. The transmission of critical data is in ciphertext form to effectively resist eavesdropping and tampering attacks.

[0038] 5. Use ID registration and verification to effectively resist counterfeit attacks.

[0039] 6. Random number duplication detection and timestamp validity verification can effectively resist replay attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a three-layer system architecture diagram of the smart lamp pole platform of the preferred embodiment of the present invention;

[0041] Figure 2 This is a working diagram of the smart lamp pole system according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0042] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0043] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0044] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0045] The present invention is aimed at the smart light pole scenario. Smart light poles are a new type of IoT infrastructure that can serve as the basis for the construction of smart cities and digital villages, as well as the deployment of digital application scenarios such as smart agriculture, smart parks, and smart transportation. It can accelerate the pace of digital society construction and provide big data support for improving the comprehensive governance capabilities of cities. The present invention divides the smart light pole platform into three parts: smart light pole terminal equipment, edge gateway, and cloud platform (see Figure 1 ), using a distributed authentication mechanism to delegate the terminal authentication function to the legal edge gateway, so that the edge gateway can directly authenticate the terminal device. The distributed authentication mechanism is more flexible and has good system scalability. The failure of one authentication service node will not cause the entire system authentication service to be paralyzed.

[0046] The data transmitted between the smart light pole terminal and the edge gateway, and between the edge gateway and the cloud platform is encapsulated in JSON format. The data frame format contains three data areas, namely the identity authentication area, the key data encryption area, and the non-key data unencrypted area. The identity authentication area contains random numbers, timestamps, identity IDs, and function code information. The key information of each frame of data is transmitted in ciphertext.

[0047] A trusted authentication method for smart lamp poles of the present invention, referring to Figures 1 to 2 , used for trusted identity authentication in smart light pole scenarios to ensure data transmission security. It includes the following steps:

[0048] Step 1: During the initialization phase, the system administrator generates a global master key on the cloud platform;

[0049] Step 2: Registration phase, including the following processes:

[0050] The edge gateway or smart light pole terminal is registered on the cloud platform. When registering, input the light pole location information, device type and device number information. The system generates a unique ID code and sends the unique ID code and system master key to the smart light pole terminal or edge gateway through a secure channel.

[0051] The cloud platform performs hash operations on the unique ID codes registered by the smart lamp pole terminal and the edge gateway, and stores the hash values ​​of the operation results in the database;

[0052] Step 3: During the time synchronization phase, the edge gateway needs to send a time synchronization request to the cloud platform when it starts, and the smart light pole terminal needs to send a time synchronization request to the edge gateway when it starts. Only when the edge gateway is successfully authenticated will it respond to the time synchronization request of the smart light pole terminal. At the same time, in order to avoid the long-term operation of the smart light pole terminal or edge gateway without restarting, resulting in system time deviation, a regular time synchronization correction phase is added. Considering that simultaneous time synchronization may cause system network congestion problems, the time rules for sending time synchronization requests are agreed to be as follows: The hash value is obtained after the hash operation of its own unique identity ID identification code. When the smart light pole terminal or edge gateway system clock (converted to seconds) and the hash value obtained by counting are congruent to the specified cycle time, a time synchronization request is sent.

[0053] Step 4: Data encryption phase. The specific process includes:

[0054] 1) Calculate the key seed of the symmetric encryption algorithm. The key seed comes from the global master key or the system clock. Before the sender and the receiver complete the time synchronization, the key seed comes from the global master key. After the time synchronization is completed, the system clock and the global master key are combined.

[0055] 2) Use private protocol transformations, such as row byte substitution, row shift, column mixing, four arithmetic operations, hash operations, etc. to calculate the pseudo key from the key seed.

[0056] 3) Use hash operation, take the pseudo key as input, and calculate the output to get the symmetric encryption key.

[0057] 4) Use a symmetric encryption algorithm and the encryption key calculated above to encrypt the plaintext data.

[0058] Step 5: Data decryption phase. The specific process includes:

[0059] 1) Try to decrypt the key seed from the combination of the system clock and the system master key, perform a private protocol transformation on the key seed to obtain a pseudo key, and perform a hash operation on the pseudo key to obtain the encryption key.

[0060] 2) Decrypt the data and return the decrypted data if the decryption is successful. Otherwise, continue to execute the following steps.

[0061] 3) Considering that due to network transmission delay, there may be a time difference between encryption at the sender and decryption at the receiver. Determine whether the current system time is in a cross-time interval. If so, try to decrypt using the key seed from the previous time interval and the global master key combination. If the decryption is successful, return the decrypted data. Otherwise, continue to perform the following steps.

[0062] 4) Try to use the global master key as the key seed for decryption. If the decryption is successful, the decrypted data is returned, otherwise the decryption failure instruction is returned. At the same time, the decryption failure counter is increased by 1. When the decryption failure count value exceeds the set threshold, the receiving end disconnects from the sending end.

[0063] 5) If the decryption is successful, the decryption failure counter value is reset to zero.

[0064] Step 6: During the identity authentication phase, when the edge gateway authenticates the smart light pole terminal for the first time, it needs to request the cloud platform to determine the legitimacy of the smart light pole terminal identity. Before the smart light pole terminal authenticates, it should confirm that the edge gateway has been authenticated, and then send an identity authentication request instruction to the edge gateway after confirmation. Before the edge gateway completes the authentication, it will not respond to the data, identity authentication request, and time synchronization request sent by the smart light pole terminal. The specific process includes:

[0065] 1) The edge gateway generates random numbers and timestamp parameters, encapsulates them according to the JSON format of the identity authentication zone, where the function code is the identity authentication request, and sends the encapsulated data to the cloud platform.

[0066] 2) The cloud platform decrypts the received data and determines whether the timestamp is valid. If not, it returns authentication failure. Otherwise, it executes the following steps.

[0067] 3) Determine whether the random number is repeated with the random number of the data packet within the previous 10 seconds. If so, return authentication failure, otherwise execute the following steps.

[0068] 4) Perform a hash operation on the unique ID code and search and match the hash value with the database registry. If the match fails, the authentication failure is returned; otherwise, the authentication success is returned and the authentication failure counter value is reset to zero.

[0069] 5) If the authentication fails, the authentication failure counter will increase by 1. When the authentication failure count value exceeds the set threshold, the receiving end will disconnect from the sending end.

[0070] Step 7: Smart lamp pole terminal data collection or cloud platform reverse control stage.

Claims

1. A trusted authentication method for smart lamp poles, characterized in that: The steps include: Step 1: During the initialization phase, the system administrator generates a global master key on the cloud platform; Step 2: Registration phase, including the following processes: The edge gateway or smart light pole terminal is registered on the cloud platform. When registering, input the light pole location information, device type and device number information. The system generates a unique ID code and sends the unique ID code and system master key to the smart light pole terminal or edge gateway through a secure channel. The cloud platform performs hash operations on the unique ID codes registered by the smart lamp pole terminal and the edge gateway, and stores the hash values ​​of the operation results in the database; Step 3: During the synchronization phase, the edge gateway needs to send a synchronization request to the cloud platform when it is started, and the smart light pole terminal needs to send a synchronization request to the edge gateway when it is started. The smart light pole terminal and the edge gateway should perform synchronization operations every day. The time to send the synchronization request is determined by the hash value of its unique identity ID code after hashing. Step 4: Data encryption phase, realizing the encryption process of plaintext data; Step 5: Data decryption phase, realizing the decryption process of ciphertext data; Step 6: Identity authentication phase, used to determine the credibility of the identity source and the correctness of the data; Step 7: Smart lamp pole terminal data collection or cloud platform reverse control stage; The step 4 specifically comprises the following steps: Step 41: Calculate the key seed of the symmetric encryption algorithm. The key seed is derived from the global master key or the system clock. Before the sending end and the receiving end complete the time synchronization, the key seed is derived from the global master key. After the time synchronization is completed, the combination of the system clock and the global master key is used. Step 42: adopt private protocol transformation, take the key seed as input, calculate the output to obtain the pseudo key; Step 43: Using a hash operation, taking the pseudo key as input, and calculating the output to obtain a symmetric encryption key; Step 44: Use a symmetric encryption algorithm and the symmetric encryption key calculated above to encrypt the plaintext data.

2. According to claim 1, a trusted authentication method for smart lamp poles is characterized in that: The step 5 specifically comprises the following steps: Step 51: Try to decrypt the key seed derived from the combination of the system clock and the system master key, perform a private protocol transformation on the key seed to obtain a pseudo key, and perform a hash operation on the pseudo key to obtain an encryption key; Step 52: Decrypt the data. If the decryption is successful, the decrypted data is returned. Otherwise, continue to execute the following steps; Step 53: Considering that there may be a time difference between the encryption at the sender and the decryption at the receiver due to network transmission delay, determine whether the current system time is in a cross-time interval. If so, try to decrypt using the key seed from the previous time interval and the global master key combination. If the decryption is successful, return the decrypted data, otherwise continue to execute the following steps; Step 54: Try to use the global master key as the key seed to perform decryption. If the decryption is successful, the decrypted data is returned. Otherwise, a decryption failure instruction is returned and the decryption failure counter is incremented by 1. When the decryption failure count value exceeds the set threshold, the receiving end disconnects from the sending end. Step 55: If the decryption is successful, the decryption failure counter value is reset to zero.

3. A trusted authentication method for smart lamp poles according to claim 1, characterized in that: The transmitted data is encapsulated in JSON format and contains three data areas: identity authentication area, key data encryption area and non-key data unencrypted area. The identity authentication area contains random numbers, timestamps, identity ID and function code information, all of which are encrypted and transmitted in ciphertext form.

4. A trusted authentication method for smart lamp poles according to claim 1, characterized in that: The smart light pole platform is divided into three parts: smart light pole terminal, edge gateway and cloud platform. It adopts a distributed authentication mechanism to delegate the authentication function of the smart light pole terminal to the legal edge gateway, so that the edge gateway can directly authenticate the smart light pole terminal device. When the edge gateway authenticates the smart light pole terminal for the first time, it needs to request the cloud platform to determine the legitimacy of the smart light pole terminal identity; before the smart light pole terminal authenticates, it should confirm that the edge gateway has been authenticated, and then send an identity authentication request instruction to the edge gateway after confirmation. Before the edge gateway completes the authentication, it will not respond to the data, identity authentication request and time synchronization request sent by the smart light pole terminal.

5. A trusted authentication method for smart lamp poles according to claim 1, characterized in that: The identity authentication stage in step 6 takes the cloud platform authenticating the edge gateway as an example, and specifically includes the following steps: Step 61: The edge gateway generates a random number and a timestamp parameter, encapsulates it according to the JSON format of the identity authentication zone, where the function code is an identity authentication request, and sends the encapsulated data to the cloud platform; Step 62: The cloud platform decrypts the received data and determines whether the timestamp is valid. If not, it returns authentication failure, otherwise, it executes the following steps; Step 63: Determine whether the random number is repeated with the random number of the data packet within the previous 10 seconds. If so, return authentication failure, otherwise execute the following steps; Step 64: Perform a hash operation on the unique ID code, search and match the hash value with the database registry, and if the match fails, return authentication failure, otherwise return authentication success, and the authentication failure counter value is reset to zero; Step 65: If the authentication fails, the authentication failure counter is incremented by 1. When the authentication failure count value exceeds the set threshold, the receiving end disconnects from the sending end.

Images