Identification authentication method and device based on IoT terminal, and IoT terminal

Abstract

The present invention discloses an identity authentication method and device based on an Internet of Things terminal, and an Internet of Things terminal. The method, according to preset protection requirements, organizes the applications that need to be protected in the Internet of Things terminal into an identity authentication circle. The identity authentication circle has multiple members, each member represents a running application, and when the members are jointly started, they obtain a common randomly generated circle identification code, wherein the circle identification code is encrypted and saved by each member in the identity authentication circle to authenticate whether the application is a member of the identity authentication circle. The present invention connects all programs that need to be protected through chains and circles, and protects each other through the internal connections of the members, thereby improving the security of the terminal. The security program can know the security and integrity of the number of protected programs through chain circle authentication, so as to know whether it has been invaded.

Description

Technical Field

[0001] The present invention relates to the technical field of application protection of industrial IoT terminal equipment, and in particular to an identity authentication method and device based on an IoT terminal, and an IoT terminal. Background Art

[0002] With the rapid development of the Internet of Things (IoT), the security landscape is even more challenging than it was in the traditional internet era. The addition of IoT terminals poses security risks that threaten all connected devices. This is particularly true in the Industrial IoT (IIoT), where the underlying infrastructure often requires integration with multiple deployed devices. This puts the security of IIoT terminals at a serious risk.

[0003] Existing industrial IoT terminal devices currently have no effective protection method against illegal program disguise and replacement, resulting in technical problems such as poor protection performance and low security. Summary of the Invention

[0004] The present invention provides an identity authentication method and device based on an Internet of Things terminal, and an Internet of Things terminal, which are used to solve or at least partially solve the technical problems of poor protection performance and low security existing in the prior art.

[0005] In order to solve the above technical problems, the first aspect of the present invention provides an identity authentication method based on an Internet of Things terminal, comprising:

[0006] According to the preset protection requirements, the applications that need to be protected in the IoT terminal are organized into an identity authentication circle. The identity authentication circle has multiple members, each of which represents a running application. When the members are jointly started, they obtain a common randomly generated circle identification code. The circle identification code is encrypted and stored by each member of the identity authentication circle to verify whether the application is a member of the identity authentication circle.

[0007] The first authentication requesting application periodically initiates circle identification code authentication on the first requested application, wherein the circle identification code authentication information includes a first random number, and the first random number is randomly generated by hash authentication using a preset salting method;

[0008] The first requested application responds to the authentication request sent by the first authentication request application, and the response information is a first hash value, where the first hash value is generated based on the first random number, the circle identification code stored by the first requested application itself, and the name of the first requested application;

[0009] The first authentication requester application compares the received first hash value with the hash value calculated by itself. If they are the same, the authentication is successful; otherwise, the authentication fails. The hash value calculated by the first authentication requester application is generated based on the first random number, the circle identification code saved by the first authentication requester application itself, and the name of the first requested application.

[0010] In one embodiment, the method further comprises:

[0011] According to the startup sequence of applications in the IoT terminal and the preset protection requirements, the applications that need to be protected in the IoT terminal are organized into an identity authentication chain. The identity authentication chain has multiple members, each member represents a running application, and the members are divided into superiors and subordinates. When the superior program starts the subordinate program, a randomly generated chain identification code is generated. Among them, an identity authentication chain has one or more chain identification codes, and the chain identification code is encrypted and saved by the corresponding superior member and subordinate member respectively, and is used for mutual identification between the superior and subordinate members of the identity authentication chain.

[0012] In one embodiment, when a superior program starts a subordinate program, a randomly generated chain identification code is generated, including:

[0013] When the upper-level program starts the lower-level program, the upper-level program generates a random parameter, saves it, and sends it to the lower-level program;

[0014] The lower-level program encrypts the received random parameters;

[0015] The upper-level program and the lower-level program respectively use the random parameters saved by themselves as the initial verification code, and can obtain the chain identification code based on the initial verification code.

[0016] In one embodiment, the first authentication requester application and the first requested application are any application within the identity authentication circle or applications outside the circle.

[0017] In one embodiment, the authentication method further includes authentication based on an identity authentication chain, specifically including:

[0018] The second authentication requester application periodically initiates chain identification code authentication on the second requested application, wherein the chain identification code authentication information includes a second random number, and the second random number is randomly generated by hash authentication using a preset salting method;

[0019] The second requested application responds to the authentication request sent by the second authentication request application, and the response information is a second hash value, where the second hash value is generated based on the second random number and the chain identification code stored by the second requested application itself;

[0020] The second authentication requester application compares the received second hash value with the hash value calculated by itself. If they are the same, the authentication is passed; otherwise, the authentication fails. The hash value calculated by the second authentication requester application is generated based on the second random number and the chain identification code saved by the second authentication requester application itself.

[0021] In one embodiment, the second authentication requester application and the second requested application are any application on the identity authentication chain or an application outside the chain.

[0022] Based on the same inventive concept, the second aspect of the present invention provides an identity authentication device based on an Internet of Things terminal, comprising:

[0023] The identity authentication circle formation module is used to form an identity authentication circle with the applications that need to be protected in the IoT terminal according to preset protection requirements. The identity authentication circle has multiple members, each of which represents a running application. When the members are jointly started, they obtain a common randomly generated circle identification code. The circle identification code is encrypted and stored by each member of the identity authentication circle and is used to verify whether the application is a member of the identity authentication circle;

[0024] a circle identification code authentication initiating module, configured to periodically initiate circle identification code authentication on a first requested party application via a first authentication requesting party application, wherein the circle identification code authentication information includes a first random number, which is randomly generated by hash authentication using a preset salting method;

[0025] A first reply module, configured to reply, through the first requested application, to the authentication request sent by the first authentication request application, where the reply information is a first hash value, wherein the first hash value is generated based on the first random number, the circle identification code stored by the first requested application itself, and the name of the first requested application;

[0026] The circle authentication module is used to compare the first hash value received by the first authentication requester application with the hash value calculated by itself. If they are the same, the authentication is passed; otherwise, the authentication fails. The hash value calculated by the first authentication requester application is generated based on the first random number, the circle identification code saved by the first authentication requester application itself, and the name of the first requested party application.

[0027] In one embodiment, the device also includes an identity authentication chain building module, which is used to build an identity authentication chain for the applications that need to be protected in the Internet of Things terminal according to the startup order of the applications in the Internet of Things terminal and preset protection requirements. The identity authentication chain has multiple members, each member represents a running application, and the members are divided into superiors and subordinates. When the superior program starts the subordinate program, a randomly generated chain identification code is generated. Among them, an identity authentication chain has one or more chain identification codes, and the chain identification code is encrypted and saved by the corresponding superior member and subordinate member respectively, and is used for mutual identification of superior and subordinate members of the identity authentication chain.

[0028] In one embodiment, the apparatus further comprises:

[0029] a chain identification code authentication initiation module, configured to periodically initiate chain identification code authentication on a second requested party application via a second authentication requester application, wherein the chain identification code authentication information includes a second random number, and the second random number is randomly generated by hash authentication using a preset salting method;

[0030] A second reply module, configured to reply, through the second requested party application, to the authentication sent by the second authentication requester application, where the reply information is a second hash value, where the second hash value is generated based on the second random number and the chain identification code stored by the second requested party application itself;

[0031] The chain authentication module is used to compare the second hash value received by the second authentication requester application with the hash value calculated by itself. If they are the same, the authentication is passed; otherwise, the authentication fails. The hash value calculated by the second authentication requester application is generated based on the second random number and the chain identification code stored by the second authentication requester application itself.

[0032] Based on the same inventive concept, the third aspect of the present invention provides an Internet of Things terminal, including a startup layer application, a business layer application, and the identity authentication device based on the Internet of Things terminal described in the second aspect.

[0033] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0034] The present invention provides an identity authentication method based on an Internet of Things terminal. The application programs that need to be protected in the Internet of Things terminal are organized into an identity authentication circle. The circle members use the circle identification code to authenticate whether they are members of the identity authentication circle (members when jointly started). If a member is closed and replaced by an illegal disguised program, the disguised program cannot obtain the previous circle identification code, and therefore cannot pass the authentication and will be identified. Therefore, by forming an identity authentication circle, the protection of each application program can be achieved, and the protection performance of the Internet of Things terminal can be improved. Only members within the circle can pass the authentication, thus protecting the internal members of the identity authentication circle, ensuring the security of these members, and then ensuring the security of the corresponding business data. By putting all businesses under protection, the business is more secure.

[0035] Furthermore, the present invention constructs an identity authentication chain based on the identity authentication circle. According to the startup order of the applications in the IoT terminal and the preset protection requirements, the applications that need to be protected in the IoT terminal are organized into an identity authentication chain. When the upper-level program starts the lower-level program, a randomly generated chain identification code is generated for mutual identification between the upper and lower members of the identity authentication chain. If a member in the identity authentication chain is closed and replaced by an illegal disguised program, the disguised program cannot obtain the previous chain identification code and therefore cannot pass the authentication and will be identified. Therefore, by forming an identity authentication chain, it is possible to achieve protection for each application and improve the protection performance of the IoT terminal.

[0036] Furthermore, the present invention also provides an identity authentication method based on an identity authentication chain, where only members on the chain can pass the authentication, thereby protecting the internal members of the identity authentication chain, ensuring the security of these members, and then ensuring the security of the corresponding business data. By putting all businesses under protection, the business will be more secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0038] Figure 1 Schematic diagram of an identity authentication circle model in an embodiment of the present invention;

[0039] Figure 2 Schematic diagram of the identity authentication chain model in an embodiment of the present invention;

[0040] Figure 3 This is a diagram showing the startup structure of an industrial IoT terminal in an embodiment of the present invention;

[0041] Figure 4 This is a schematic diagram of the implementation process in which the startup layer of the industrial IoT terminal first starts the external interface management program in the business layer and then starts the external interface acquisition program in an embodiment of the present invention;

[0042] Figure 5 Schematic diagram of the process of chain identification code recognition between the startup layer and the business layer of the industrial Internet of Things terminal in an embodiment of the present invention;

[0043] Figure 6 Schematic diagram of the chain identification process created within the industrial IoT terminal business layer in an embodiment of the present invention;

[0044] Figure 7 Schematic diagram of the process of identifying the circle identification code of the industrial Internet of Things terminal in an embodiment of the present invention;

[0045] Figure 8 Schematic diagram of the circle identification code recognition process when the key protection interface of the industrial IoT terminal is called in an embodiment of the present invention;

[0046] Figure 9 A schematic diagram of a complex circle model created by an industrial IoT terminal in an embodiment of the present invention;

[0047] Figure 10 This is a schematic diagram of a simple circle model created by an industrial IoT terminal in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The present invention discloses an identity authentication method and device based on an Internet of Things terminal, and an Internet of Things terminal, which are used to improve the technical problem of poor protection performance existing in the prior art.

[0049] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0050] Example 1

[0051] An embodiment of the present invention provides an identity authentication method based on an Internet of Things terminal, comprising:

[0052] According to the preset protection requirements, the applications that need to be protected in the IoT terminal are organized into an identity authentication circle. The identity authentication circle has multiple members, each of which represents a running application. When the members are jointly started, they obtain a common randomly generated circle identification code. The circle identification code is encrypted and stored by each member of the identity authentication circle to verify whether the application is a member of the identity authentication circle.

[0053] The first authentication requesting application periodically initiates circle identification code authentication on the first requested application, wherein the circle identification code authentication information includes a first random number, and the first random number is randomly generated by hash authentication using a preset salting method;

[0054] The first requested application responds to the authentication request sent by the first authentication request application, and the response information is a first hash value, where the first hash value is generated based on the first random number, the circle identification code stored by the first requested application itself, and the name of the first requested application;

[0055] The first authentication requester application compares the received first hash value with the hash value calculated by itself. If they are the same, the authentication is successful; otherwise, the authentication fails. The hash value calculated by the first authentication requester application is generated based on the first random number, the circle identification code saved by the first authentication requester application itself, and the name of the first requested application.

[0056] See Figure 1 , which is a schematic diagram of an identity authentication circle model in an embodiment of the present invention.

[0057] During implementation, protection requirements are pre-set, specifying which applications need to be protected. A hash algorithm can be used to verify whether a member is a member of the circle. If a member is shut down and replaced by an illegal masquerading program, it will be identified during the authentication process because it was not a member at the time of co-launch and therefore cannot obtain the circle identification code.

[0058] exist Figure 4 In the security protection program, members who have passed in the circle identification code are grouped into an identity authentication circle. Each member of the circle shares a randomly generated circle identification code, which is encrypted and stored separately. The circle members use the circle identification code to verify whether they are the members at the time of startup.

[0059] In one embodiment, the first authentication requester application and the first requested application are any application within the identity authentication circle or applications outside the circle.

[0060] Specifically, the first authentication requester application and the first requested application are application programs participating in the circle authentication. The first and second do not limit the application programs. Specifically, the types of applications include security protection programs at the startup layer, external interface management programs at the business layer, and external interface collection programs.

[0061] When identity authentication is performed based on an identity authentication circle, members within the circle can authenticate each other, that is, the first authentication requester application and the first requested application can be any application within the circle. For example, member 1 within the identity authentication circle can initiate an authentication request to other members within the circle, and member 2 can also initiate an authentication request to other members within the circle. In addition, applications outside the circle (such as disguised applications) can also initiate authentication requests. When an application outside the circle initiates an authentication request to a member within the circle, since the circle identification code of the identity authentication circle is generated when all members are jointly started and encrypted and saved by each member within the circle, the application outside the circle cannot obtain the circle identification code. Therefore, in the subsequent authentication process, a different hash value will be calculated from that of the members within the circle, and therefore it will fail to pass the authentication. That is, the application outside the circle will be identified during the authentication process.

[0062] An authentication process based on identity authentication circle such as Figure 7 shown.

[0063] For example, when the first authentication requester application is a security protection program and the first requested party is an external interface management program, the circle identification code recognition process (i.e., the identity authentication process based on the identity authentication circle) includes steps 400 to 402:

[0064] In step 400, the security protection program periodically initiates "circle identification code" authentication with the external interface management program. Real-name communication issues a random large number "abc123!@#..." This random large number is randomly generated according to common salted hash authentication requirements and must be regenerated for each new verification. Subsequent steps perform salted hash authentication.

[0065] Step 401: The external interface management program replies to the security protection program with the real name of the random large number "abc123!@#..."+"circle identification code"+the hash value of the external interface management program name.

[0066] Step 402, the security protection program verifies the replied hash value and compares it with the hash value of the random large number "abc123!@#..." + "circle identification code" + external interface management program name calculated by itself. If they are the same, there is no problem.

[0067] Similarly, when the first authentication requester application is a security protection program and the first requested party is an external interface acquisition program, the circle identification code recognition process (ie, the identity authentication process based on the identity authentication circle) includes steps 403 to 405.

[0068] In step 403, the security protection program regularly initiates "circle identification code" authentication with the external interface collection program using the same method. Real-name communication issues a random large number "abc123!@#..." This random large number is randomly generated according to common salted hash authentication requirements and must be regenerated for each new verification. Subsequent steps perform salted hash authentication.

[0069] Step 404, the external interface collection program replies to the security protection program in real name, which is the random large number "abc123!@#..."+"circle identification code"+the hash value of the external interface collection program name.

[0070] Step 405, the security protection program verifies the replied hash value and compares it with the hash transformation value of the random large number "abc123!@#..." + "circle identification code" + external interface collection program name calculated by itself. If they are the same, there is no problem.

[0071] Therefore, steps 400, 401, and 402 verify the "circle identification code" + external interface management program name, and steps 403, 404, and 405 verify the "circle identification code" + external interface collection program name. The two are different and the same content will not be verified in circle identification.

[0072] When the program calls important interface functions, it must first pass the "circle identification code" authentication. When the external interface acquisition program calls the acquisition interface to collect data and the 5G communication interface to transmit data, the "circle identification code" authentication method used is as follows: Figure 8 shown.

[0073] When the first authentication requester application is an external interface acquisition program and the first requested party is an external interface management program, the circle identification code recognition process (i.e., the identity authentication process based on the identity authentication circle) includes steps 500 to 504:

[0074] Step 500: The external interface acquisition program initiates a data acquisition request to the external interface management program.

[0075] In step 501, the external interface management program sends a real-name reply to the external interface acquisition program, a large random number "abc123!@#..." This large random number is randomly generated according to common salted hash authentication requirements and needs to be regenerated for each new verification. The subsequent steps perform salted hash authentication.

[0076] Step 502: The external interface acquisition program calls the acquisition interface of the external interface management program and inputs the hash value of the random large number "abc123!@#..."+"circle identification code"+external interface acquisition program name.

[0077] Step 503: The external interface management program verifies the incoming hash value and compares it with the hash value of the random large number "abc123!@#..." + "circle identification code" + external interface collection program name calculated by itself.

[0078] Step 504: If the verification in step 503 is passed, the collected data is returned.

[0079] Among them, when the first authentication requester application is an external interface acquisition program and the first requested application is a 5G communication management program, the circle identification code recognition process (i.e., the identity authentication process based on the identity authentication circle) includes steps 505 to 509:

[0080] Step 505: The external interface acquisition program initiates a data transmission request to the 5G communication management program.

[0081] In step 506, the 5G communication management program sends a real-name reply to the external interface collection program with a large random number, "abc123!@#..." This large random number is randomly generated according to common salted hash authentication requirements and needs to be regenerated for each new verification. Subsequent steps perform salted hash authentication.

[0082] Step 507: The external interface acquisition program calls the communication interface of the 5G communication management program and passes in the hash value of the random large number "abc123!@#..."+"circle identification code"+external interface acquisition program name.

[0083] In step 508, the 5G communication management program verifies the incoming hash value and compares it with the hash value of the random large number "abc123!@#..." + "circle identification code" + external interface collection program name calculated by itself.

[0084] Step 509: If the verification in step 508 is successful, the collected data is sent using 5G.

[0085] In one embodiment, the method further comprises:

[0086] According to the startup sequence of applications in the IoT terminal and the preset protection requirements, the applications that need to be protected in the IoT terminal are organized into an identity authentication chain. The identity authentication chain has multiple members, each member represents a running application, and the members are divided into superiors and subordinates. When the superior program starts the subordinate program, a randomly generated chain identification code is generated. Among them, an identity authentication chain has one or more chain identification codes, and the chain identification code is encrypted and saved by the corresponding superior member and subordinate member respectively, and is used for mutual identification between the superior and subordinate members of the identity authentication chain.

[0087] like Figure 2 Figure 2 shows a schematic diagram of establishing an identity authentication chain. In the identity authentication chain, a superior program initiates a subordinate program, which in turn initiates its subordinates, and so on. In specific implementations, a hash algorithm can be used to verify whether a member is a member of the chain. If a member is shut down and replaced by an illegal impersonation program, since the impersonation program is not a member of the chain and therefore cannot obtain the chain identification code, it will be identified during the authentication process.

[0088] If an identity authentication chain has more than two members, the middle member has multiple chain identifiers.

[0089] In one embodiment, when a superior program starts a subordinate program, a randomly generated chain identification code is generated, including:

[0090] When the upper-level program starts the lower-level program, the upper-level program generates a random parameter, saves it, and sends it to the lower-level program;

[0091] The lower-level program encrypts the received random parameters;

[0092] The upper-level program and the lower-level program respectively use the random parameters saved by themselves as the initial verification code, and can obtain the chain identification code based on the initial verification code.

[0093] See Figure 3 , which is a diagram of the startup structure of an Industrial IoT terminal, divides the programs of the Industrial IoT terminal into two layers: the startup layer and the business layer. The security protection program is the startup layer. During initial startup, it is a key functional module that manages the entire terminal device. The business layer implements business functions and is protected by circle chain identity authentication. The startup layer starts the business layer to achieve joint startup. The startup layer randomly generates a circle identification code and transmits it to the business layer via encrypted means to achieve a shared circle identification code. This allows members with a shared circle identification code to form an identity authentication circle. When the startup layer starts the business layer in batches, it creates specific business layer applications based on the startup order to achieve the establishment of an identity authentication chain.

[0094] Specifically, in industrial IoT terminal devices, there is a security protection program. As the top-level member of the industrial IoT terminal device, the security protection program is the starting point of the entire circle chain-based identity authentication application protection. During the authentication process, you can first verify whether the security protection program is normal, and then add startup protection to the security protection program to ensure that it can start normally.

[0095] In one implementation, a security program serves as the startup layer. The program is designed with multiple protections to ensure proper startup. The program then creates authentication circles and chains, significantly enhancing the security of this circle-chain authentication-based application protection approach.

[0096] Figure 4 For the industrial IoT terminal startup layer, first start the external interface management program in the business layer, and then start the implementation process of the external interface acquisition program.

[0097] Specifically, the security protection program uses system functions to establish an identity authentication chain and launch other programs. These include external interface management programs such as 485 / 232, DI / DO (input / output), and UART (serial port), as well as 5G communication management programs, Wi-Fi communication management programs, optical module management programs, and WAN and LAN port management programs. Before launching, the MD5 hash of each program is verified to ensure a secure boot. External interface acquisition programs include 485 / 232, DI / DO (input / output), and UART (serial port) services.

[0098] When establishing an identity authentication chain, the security program, acting as the superior member, passes an encrypted random parameter when starting a subordinate member. After startup, the subordinate member first saves the encrypted random parameter and then hides it by resetting it to zero. This encrypted random parameter serves as the initial verification code for startup by the superior member. It is used to obtain the chain identification code when communicating with the superior member. Upon successful startup, the initial verification code becomes invalid. Once the chain identification code is obtained, chain identification authentication is initiated. This chain identification code is randomly generated by the superior member's security program and is generated individually for each subordinate member. Each chain identification code is encrypted and stored for identification purposes within the identity authentication chain. A subordinate member can also start its subordinates. In specific applications, the external interface management program (superior program) can start the corresponding acquisition program (subordinate program) for the external interface, thus forming an identity authentication chain. Different authentication chains are created based on the startup method within the business layer.

[0099] During the specific implementation process, the startup layer first starts the external interface management program in the business layer, and then starts the external interface collection program.

[0100] The specific implementation of the security protection program starting the external interface management program is as follows:

[0101] Step 100, the security protection program starts the external interface management program and verifies the MD5 value of the program file before starting to ensure that the external interface management program starts normally and safely. An encrypted "initial verification code" can be randomly generated and passed in during startup.

[0102] In step 101, the external interface management program saves the "initial verification code" and sets the input "initial verification code" parameter to zero, thus hiding the "initial verification code". The external interface management program communicates with the security protection program and obtains the "circle identification code" and "chain identification code" through the "initial verification code" request.

[0103] In step 102, the security program encrypts and transmits the "circle and chain identification codes." The circle identification code is generated by the security program's random algorithm, and only one is generated. This code is used to establish circle identification. The chain identification code is also generated by the security program's random algorithm, and is generated and stored separately for each program launched by the security program. Each time a chain identification code is verified, the corresponding chain identification code of the verification program is used.

[0104] At this point, the external interface management program begins real-name communication with the security protection program, verifies the "circle identification code" and "chain identification code", and joins the circle and chain identification.

[0105] Similarly, the security protection program starts the 5G communication management program, WIFI communication management program, optical module management program, WAN and LAN port management program and other programs, verifies the MD5 value of the corresponding program file before starting, ensures that the external interface acquisition program starts normally, ensures safe startup, and establishes circle and chain identification in the same way as above, which will not be explained specifically.

[0106] Protection and authentication based on identity authentication circles, and identification and authentication based on identity authentication chains are two protection methods that do not affect each other and can coexist. They have similarities in their creation process.

[0107] The specific implementation process of the external interface management program starting the external interface collection program is as follows:

[0108] Step 103: The external interface management program starts the external interface acquisition program and verifies the MD5 value of the program before starting to ensure a safe start. During the start, an encrypted "initial verification code" can be randomly generated and passed in.

[0109] In step 104, the external interface acquisition program saves the "initial verification code" and resets the original "initial verification code" parameter to zero, thereby hiding the "initial verification code." The external interface acquisition program communicates with the external interface management program in real-name format, using the "initial verification code" to obtain the "circle identification code" passed in by the security program and the "chain identification code" newly created by the external interface management program.

[0110] In step 105, the external interface management program encrypts and transmits the "circle and chain identification codes." The circle identification code was transmitted to the external interface management program by the security protection program, and is now transmitted to the external interface collection program by the external interface management program, thereby achieving a shared circle identification code. The chain identification code is generated by the external interface management program's random algorithm and is generated and stored separately for each program launched by the external interface management program. Each time a chain identification code is verified, the chain identification code corresponding to the verification program is verified.

[0111] At this point, the external interface collection program begins to communicate with the security protection program in real name, verifies the "circle identification code", begins to communicate with the external interface management program in real name, verifies the "chain identification code", and joins the circle and chain identification.

[0112] Similarly, the external interface management program starts the collection program corresponding to other external interfaces, verifies the MD5 value of the corresponding program file before starting, ensures safe startup, and establishes circle and chain identification in the same way as above, which will not be explained specifically.

[0113] It should be noted that in step 102 and step 105, the method of encrypting the "circle, chain identification code" may include but is not limited to using an anonymous pipe to hide the communication method, using an encryption chip method so that the encryption chip that is only read once by the started program can obtain the "circle, chain identification code", using a key negotiation method to encrypt the "circle, chain identification code", and using the key interface provided by the root key method to encrypt the "circle, chain identification code".

[0114] like Figure 9 The figure shows a complex circle model that divides the programs inside the Industrial Internet of Things terminal into circles at different levels, and different circles protect different members.

[0115] like Figure 10 The figure shows a simple circle model that divides the programs inside the Industrial IoT terminal into a circle. The startup layer decides which members to put into the circle for protection.

[0116] It should be noted that the order of program startup within the business layer can be changed according to actual conditions, thereby customizing the settings to create different circles and chain identifications, and is not limited to Figure 9 and Figure 10 The method of creating identity authentication circles and identity authentication chains and the corresponding identification methods.

[0117] This invention connects all applications requiring protection through an identity authentication chain and / or identity authentication circle. Through internal connections between members, these members protect each other, improving the security of IoT terminals. Through chain and circle authentication, security programs can determine the security and integrity of the number of protected programs, thereby determining whether any intrusion has occurred. This protection method based on circle and chain identity authentication applications protects internal members, ensuring their security, and thus the security of the corresponding business data. Protecting all businesses makes them even more secure.

[0118] In one embodiment, the authentication method further includes authentication based on an identity authentication chain, specifically comprising: the second authentication requester application periodically initiating a chain identification code authentication on the second requested application, wherein the chain identification code authentication information includes a second random number, and the second random number is randomly generated by hash authentication using a preset salting method;

[0119] The second requested application responds to the authentication request sent by the second authentication request application, and the response information is a second hash value, where the second hash value is generated based on the second random number and the chain identification code stored by the second requested application itself;

[0120] The second authentication requester application compares the received second hash value with the hash value calculated by itself. If they are the same, the authentication is passed; otherwise, the authentication fails. The hash value calculated by the second authentication requester application is generated based on the second random number and the chain identification code saved by the second authentication requester application itself.

[0121] Specifically, based on the authentication method based on the identity authentication circle, an identity authentication chain has been further established. Based on the identity authentication chain, there are corresponding identity authentication methods. In other words, the authentication method based on the identity authentication circle can be used alone, or the authentication method based on the identity authentication circle and the identity authentication chain can be used, further ensuring security.

[0122] In one embodiment, the second authentication requester application and the second requested application are any application on the identity authentication chain or an application outside the chain.

[0123] Specifically, the types of applications include security protection programs at the startup layer, external interface management programs at the business layer, and external interface collection programs.

[0124] When identity authentication is performed based on the identity authentication chain, the upper and lower members on the chain can authenticate each other, that is, the second authentication requester application can be the upper or lower application on the chain, and the second requested application can also be the upper or lower application on the chain. In addition, it can also be an application outside the chain (for example, an application on another chain or other disguised application, etc.). When an application outside the chain participates in identity authentication, since the chain identification code of the identity authentication chain is generated by the upper member of the chain when the lower member is started, and is encrypted and saved by the upper and lower members on the chain, the application outside the chain cannot obtain the chain identification code. Therefore, in the subsequent authentication process, a different hash value will be calculated from that of the members on the chain, and therefore it will not pass the authentication, that is, the application outside the chain will be identified during the authentication process.

[0125] In the specific implementation process, Figure 5 The figure shows the identification process of the chain identification code (identity identification process based on the identity authentication chain).

[0126] When the second authentication requester application is a security protection program and the second requested party is an external interface management program, the circle identification code recognition process includes steps 200 to 202:

[0127] In step 200, the security protection program periodically initiates "chain identification code" authentication with the external interface management program. Real-name communication issues a random large number "abc123!@#..." This random large number is randomly generated according to common salted hash authentication requirements and must be regenerated for each new verification. Subsequent steps perform salted hash authentication.

[0128] Step 201: The external interface management program replies to the security protection program in real name, which is the hash value of the random large number "abc123!@#..." + "chain identification code".

[0129] Step 202: The security protection program verifies the hash value of the reply and compares it with the hash value of the random large number "abc123!@#..." + "chain identification code" calculated by itself. If they are the same, there is no problem.

[0130] Similarly, when the authentication requester application is an external interface management program and the requested party is a security protection program, the circle identification code recognition process includes steps 203 to 205:

[0131] In step 203, the external interface management program regularly initiates "chain identification code" authentication for the security protection program, and the real-name communication sends a random large number "abc123!@#...".

[0132] In step 204, the security protection program sends a real-name reply to the external interface management program, including the hash value of the random number "abc123!@#..." + the chain identification code. This random number is randomly generated according to common salted hash authentication requirements and must be regenerated for each new verification. Subsequent steps perform salted hash authentication.

[0133] Step 205: The external interface management program verifies the hash value of the reply and compares it with the hash value of the random large number "abc123!@#..." + "chain identification code" calculated by itself. If they are the same, there is no problem.

[0134] like Figure 6 The figure shows the "chain identification code" authentication process between the external interface acquisition program and the external interface management program in the business layer.

[0135] When the second authentication requester application is an external interface management program and the second requested application is an external interface acquisition program, the circle identification code recognition process includes steps 300 to 302:

[0136] In step 300, the external interface management program periodically initiates "chain identification code" authentication with the external interface collection program. Real-name communication issues a random large number "abc123!@#..." This random large number is randomly generated according to common salted hash authentication requirements and must be regenerated for each new verification. Subsequent steps perform salted hash authentication.

[0137] Step 301: The external interface collection program replies to the external interface management program in real name, including the hash value of the random large number "abc123!@#..." + "chain identification code".

[0138] Step 302: The external interface management program verifies the hash value of the reply and compares it with the hash value of the random large number "abc123!@#..." + "chain identification code" calculated by itself. If they are the same, there is no problem.

[0139] When the second authentication requester application is an external interface acquisition program and the second requested application is an external interface management program, the circle identification code recognition process includes steps 303 to 305:

[0140] In step 303, the external interface acquisition program periodically initiates "chain identification code" authentication with the external interface management program. Real-name communication issues a random large number "abc123!@#..." This random large number is randomly generated according to common salted hash authentication requirements and must be regenerated for each new verification. Subsequent steps perform salted hash authentication.

[0141] In step 304, the external interface management program replies to the external interface management program in real name, with the hash value of the random large number "abc123!@#..."+"chain identification code".

[0142] Step 305: The external interface acquisition program verifies the replied hash value and compares it with the hash value of the random large number "abc123!@#..." + "chain identification code" calculated by itself. If they are the same, there is no problem.

[0143] Example 2

[0144] Based on the same inventive concept, this embodiment provides an identity authentication device based on an IoT terminal, comprising:

[0145] The identity authentication circle formation module is used to form an identity authentication circle with the applications that need to be protected in the IoT terminal according to preset protection requirements. The identity authentication circle has multiple members, each of which represents a running application. When the members are jointly started, they obtain a common randomly generated circle identification code. The circle identification code is encrypted and stored by each member of the identity authentication circle and is used to verify whether the application is a member of the identity authentication circle;

[0146] a circle identification code authentication initiating module, configured to periodically initiate circle identification code authentication on a first requested party application via a first authentication requesting party application, wherein the circle identification code authentication information includes a first random number, which is randomly generated by hash authentication using a preset salting method;

[0147] A first reply module, configured to reply, through the first requested application, to the authentication request sent by the first authentication request application, where the reply information is a first hash value, wherein the first hash value is generated based on the first random number, the circle identification code stored by the first requested application itself, and the name of the first requested application;

[0148] The circle authentication module is used to compare the first hash value received by the first authentication requester application with the hash value calculated by itself. If they are the same, the authentication is passed; otherwise, the authentication fails. The hash value calculated by the first authentication requester application is generated based on the first random number, the circle identification code saved by the first authentication requester application itself, and the name of the first requested party application.

[0149] In one embodiment, the device also includes an identity authentication chain building module, which is used to build an identity authentication chain for the applications that need to be protected in the Internet of Things terminal according to the startup order of the applications in the Internet of Things terminal and preset protection requirements. The identity authentication chain has multiple members, each member represents a running application, and the members are divided into superiors and subordinates. When the superior program starts the subordinate program, a randomly generated chain identification code is generated. Among them, an identity authentication chain has one or more chain identification codes, and the chain identification code is encrypted and saved by the corresponding superior member and subordinate member respectively, and is used for mutual identification of superior and subordinate members of the identity authentication chain.

[0150] In one embodiment, the apparatus further comprises:

[0151] a chain identification code authentication initiation module, configured to periodically initiate chain identification code authentication on a second requested party application via a second authentication requester application, wherein the chain identification code authentication information includes a second random number, and the second random number is randomly generated by hash authentication using a preset salting method;

[0152] A second reply module, configured to reply, through the second requested party application, to the authentication sent by the second authentication requester application, where the reply information is a second hash value, where the second hash value is generated based on the second random number and the chain identification code stored by the second requested party application itself;

[0153] The chain authentication module is used to compare the second hash value received by the second authentication requester application with the hash value calculated by itself. If they are the same, the authentication is passed; otherwise, the authentication fails. The hash value calculated by the second authentication requester application is generated based on the second random number and the chain identification code stored by the second authentication requester application itself.

[0154] Since the device described in Example 2 of the present invention is used to implement the identity authentication based on the IoT terminal in Example 1 of the present invention, the specific structure and variations of the device are well understood by those skilled in the art based on the method described in Example 1 of the present invention, and therefore will not be described in detail here. All devices used in the method of Example 1 of the present invention fall within the scope of protection of the present invention.

[0155] Example 3

[0156] Based on the same inventive concept, this embodiment provides an Internet of Things terminal, including a startup layer application, a business layer application, and the identity authentication device described in the second embodiment.

[0157] Since the device described in the third embodiment of the present invention is a terminal including the identity authentication device described in the second embodiment of the present invention, those skilled in the art will be able to understand the specific structure and variations of the terminal based on the device described in the second embodiment of the present invention, and therefore will not be described in detail here. Any terminal including the device described in the second embodiment of the present invention falls within the scope of protection of the present invention.

[0158] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0159] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0160] Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if such changes and modifications of the embodiments of the present invention fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. An identity authentication method based on an Internet of Things terminal, characterized in that: include: According to the preset protection requirements, the applications that need to be protected in the IoT terminal are organized into an identity authentication circle. The identity authentication circle has multiple members, each of which represents a running application. When the members are jointly started, they obtain a common randomly generated circle identification code. The circle identification code is encrypted and stored by each member of the identity authentication circle to verify whether the application is a member of the identity authentication circle. The first authentication requesting application periodically initiates circle identification code authentication on the first requested application, wherein the circle identification code authentication information includes a first random number, and the first random number is randomly generated by hash authentication using a preset salting method; The first requested application responds to the authentication request sent by the first authentication request application, and the response information is a first hash value, where the first hash value is generated based on the first random number, the circle identification code stored by the first requested application itself, and the name of the first requested application; The first authentication requesting application compares the received first hash value with the hash value calculated by itself. If they are the same, authentication succeeds; otherwise, authentication fails. The hash value calculated by the first authentication requesting application is generated based on the first random number, the circle identification code stored by the first authentication requesting application, and the name of the first requested application. The method further comprises: According to the startup sequence of applications in the IoT terminal and the preset protection requirements, the applications that need to be protected in the IoT terminal are organized into an identity authentication chain. The identity authentication chain has multiple members, each member represents a running application, and the members are divided into superiors and subordinates. When the superior program starts the subordinate program, a randomly generated chain identification code is generated. Among them, an identity authentication chain has one or more chain identification codes, and the chain identification code is encrypted and saved by the corresponding superior member and subordinate member respectively, and is used for mutual identification between the superior and subordinate members of the identity authentication chain.

2. The identity authentication method based on the Internet of Things terminal according to claim 1, characterized in that: When the upper-level program starts the lower-level program, it generates a randomly generated chain identification code, including: When the upper-level program starts the lower-level program, the upper-level program generates a random parameter, saves it, and sends it to the lower-level program; The lower-level program encrypts the received random parameters; The upper-level program and the lower-level program respectively use the random parameters saved by themselves as the initial verification code, and can obtain the chain identification code based on the initial verification code.

3. The identity authentication method based on the Internet of Things terminal according to claim 1, characterized in that: The first authentication requester application and the first requested application are any application within the identity authentication circle or applications outside the circle.

4. The identity authentication method based on the Internet of Things terminal according to claim 1, characterized in that: The authentication method also includes authentication based on an identity authentication chain, specifically including: The second authentication requester application periodically initiates chain identification code authentication on the second requested application, wherein the chain identification code authentication information includes a second random number, and the second random number is randomly generated by hash authentication using a preset salting method; The second requested application responds to the authentication request sent by the second authentication request application, and the response information is a second hash value, where the second hash value is generated based on the second random number and the chain identification code stored by the second requested application itself; The second authentication requester application compares the received second hash value with the hash value calculated by itself. If they are the same, the authentication is passed; otherwise, the authentication fails. The hash value calculated by the second authentication requester application is generated based on the second random number and the chain identification code saved by the second authentication requester application itself.

5. The identity authentication method based on the Internet of Things terminal according to claim 4, characterized in that: The second authentication requester application and the second requested application are any application on the identity authentication chain or an application outside the chain.

6. An identity authentication device based on an Internet of Things terminal, characterized in that: include: The identity authentication circle formation module is used to form an identity authentication circle with the applications that need to be protected in the IoT terminal according to preset protection requirements. The identity authentication circle has multiple members, each of which represents a running application. When the members are jointly started, they obtain a common randomly generated circle identification code. The circle identification code is encrypted and stored by each member of the identity authentication circle and is used to verify whether the application is a member of the identity authentication circle; a circle identification code authentication initiating module, configured to periodically initiate circle identification code authentication on a first requested party application via a first authentication requesting party application, wherein the circle identification code authentication information includes a first random number, which is randomly generated by hash authentication using a preset salting method; A first reply module, configured to reply, through the first requested application, to the authentication request sent by the first authentication request application, where the reply information is a first hash value, wherein the first hash value is generated based on the first random number, the circle identification code stored by the first requested application itself, and the name of the first requested application; a circle authentication module, configured to compare, through the first authentication requesting application, a received first hash value with a hash value calculated by the first authentication requesting application; if the hash value is the same, authentication succeeds; otherwise, authentication fails, wherein the hash value calculated by the first authentication requesting application is generated based on the first random number, the circle identification code stored by the first authentication requesting application itself, and the name of the first requested application; The device also includes an identity authentication chain building module, which is used to build an identity authentication chain for the applications that need to be protected in the Internet of Things terminal according to the startup order of the applications in the Internet of Things terminal and preset protection requirements. The identity authentication chain has multiple members, each member represents a running application, and the members are divided into superiors and subordinates. When the superior program starts the subordinate program, a randomly generated chain identification code is generated, wherein an identity authentication chain has one or more chain identification codes, and the chain identification code is encrypted and stored by the corresponding superior member and subordinate member respectively, and is used for mutual identification between the superior and subordinate members of the identity authentication chain.

7. The identity authentication device based on the Internet of Things terminal according to claim 6, characterized in that: The device also includes a chain identification code authentication initiation module, configured to periodically initiate chain identification code authentication on a second requested party application via a second authentication requester application, wherein the chain identification code authentication information includes a second random number, and the second random number is randomly generated by hash authentication using a preset salting method; A second reply module, configured to reply, through the second requested party application, to the authentication sent by the second authentication requester application, where the reply information is a second hash value, where the second hash value is generated based on the second random number and the chain identification code stored by the second requested party application itself; The chain authentication module is used to compare the second hash value received by the second authentication requester application with the hash value calculated by itself. If they are the same, the authentication is passed; otherwise, the authentication fails. The hash value calculated by the second authentication requester application is generated based on the second random number and the chain identification code stored by the second authentication requester application itself.

8. An Internet of Things terminal, characterized in that: It comprises a startup layer application, a business layer application and an identity authentication device based on an Internet of Things terminal as described in any one of claims 6 to 7.

Images