Iot device access authentication method and device, equipment and storage medium

Abstract

The application discloses an Internet of Things device access authentication method and device, equipment and a storage medium, and relates to the field of wireless communication. The method comprises the following steps: obtaining device information of an Internet of Things device; generating a first random number; sending the first random number to a device cloud platform according to the device information; receiving a first access key generated by the device cloud platform through a device key and the first random number; providing the first random number to the Internet of Things device; receiving an access authentication request sent by the Internet of Things device, wherein the access authentication request comprises a second access key generated by the Internet of Things device according to the device key and the first random number; and performing access authentication on the Internet of Things device according to the first access key and the second access key. In the process, the identity of the Internet of Things device does not need to be authenticated, and the access authentication process can be simplified, so that the efficiency of the access authentication of the Internet of Things device is improved while the security of the access authentication is ensured.

Description

Technical Field

[0001] This application relates to the field of wireless communication, and in particular to a method, apparatus, device and storage medium for Internet of Things (IoT) device access authentication. Background Technology

[0002] In the Internet of Things (IoT) technology, IoT devices often involve cross-platform access scenarios, requiring access to a cloud platform to issue access keys to the IoT devices.

[0003] To ensure access security, before the cloud platform issues an access key to the IoT device during each process, the IoT device needs to be authenticated at least once. Only after successful authentication can the access key be issued to the IoT device.

[0004] However, the process of authenticating IoT devices through a cloud platform can complicate the access authentication process for IoT devices, affecting the efficiency of access authentication. Summary of the Invention

[0005] This application provides an IoT device access authentication method, apparatus, device, and storage medium.

[0006] On the one hand, an IoT device access authentication method is provided, the method being executed by an access cloud platform, the method comprising:

[0007] Obtain device information for IoT devices;

[0008] Generate the first random number;

[0009] Based on the device information of the IoT device, send the first random number to the device cloud platform;

[0010] The device cloud platform receives a first access key generated by the device key and the first random number; the device key is set in the IoT device and the device cloud platform.

[0011] The first random number is provided to the IoT device;

[0012] The system receives an access authentication request sent by the IoT device, the access authentication request containing a second access key, which is generated by the IoT device based on the device key and the first random number.

[0013] The IoT device is authenticated based on the first access key and the second access key.

[0014] On the one hand, an IoT device access authentication method is provided, the method being executed by the IoT device, the method comprising:

[0015] Provide the device information of the IoT devices to the cloud platform;

[0016] Obtain a first random number provided by the access cloud platform. The first random number is generated by the access cloud platform and is provided by the device cloud platform of the IoT device after obtaining the device key and the first access key generated by the first random number. The device key is set in the IoT device and the device cloud platform.

[0017] A second access key is generated based on the device key and the first random number;

[0018] Send an access authentication request containing the second access key to the access cloud platform. The access authentication request is used to request the access cloud platform to perform access authentication for the IoT device based on the first access key and the second access key.

[0019] On the one hand, an IoT device access authentication method is provided, the method being executed by an access cloud platform, the method comprising:

[0020] Obtain device information for IoT devices;

[0021] Generate the first random number and the first access key;

[0022] Based on the device information of the IoT device, the first random number is sent to the device cloud platform corresponding to the IoT device.

[0023] Receive the first encryption key generated by the device cloud platform through encrypting the first random number using the device key;

[0024] The first access key is encrypted using the first encryption key to obtain encrypted ciphertext;

[0025] The encrypted ciphertext and the first random number are provided to the IoT device;

[0026] The system receives an access authentication request sent by the IoT device, the access authentication request containing a second access key, which is generated by the IoT device based on the device key, the encrypted ciphertext, and the first random number.

[0027] The IoT device is authenticated based on the first access key and the second access key.

[0028] On the one hand, an IoT device access authentication method is provided, the method being executed by the IoT device, the method comprising:

[0029] Provide the device information of the IoT devices to the cloud platform;

[0030] The system obtains encrypted ciphertext provided by the access cloud platform and a first random number generated by the access cloud platform; the encrypted ciphertext is obtained by the access cloud platform encrypting a first access key using a first encryption key; the first encryption key is a key generated by the device cloud platform of the IoT device encrypting the first random number using a device key; the device key is set in the IoT device and the device cloud platform.

[0031] The first random number is encrypted using the device key to generate the second encryption key;

[0032] The encrypted ciphertext is decrypted using the second encryption key to obtain the second access key;

[0033] Send an access authentication request containing the second access key to the access cloud platform. The access authentication request is used to request the access cloud platform to perform access authentication for the IoT device based on the first access key and the second access key.

[0034] On one hand, an IoT device access authentication device is provided, the device being used to access a cloud platform, the device comprising:

[0035] The device information acquisition module is used to acquire device information of IoT devices;

[0036] The first random number generation module is used to generate the first random number.

[0037] The first random number sending module is used to send the first random number to the device cloud platform based on the device information of the Internet of Things device;

[0038] The first access key receiving module is used to receive a first access key generated by the device cloud platform using a device key and the first random number; the device key is set in the IoT device and the device cloud platform;

[0039] A first random number providing module is used to provide the first random number to the Internet of Things device;

[0040] An authentication request receiving module is configured to receive an access authentication request sent by the IoT device, wherein the access authentication request includes a second access key, which is generated by the IoT device based on the device key and the first random number;

[0041] The access authentication module is used to perform access authentication on the IoT device based on the first access key and the second access key.

[0042] On one hand, an IoT device access authentication device is provided, the device being used in IoT devices, the device comprising:

[0043] The device information providing module is used to provide device information of the IoT devices to the cloud platform.

[0044] The first random number acquisition module is used to acquire a first random number provided by the access cloud platform. The first random number is generated by the access cloud platform and is provided by the device cloud platform of the IoT device after obtaining the device key and the first access key generated by the first random number. The device key is set in the IoT device and the device cloud platform.

[0045] The second access key generation module is used to generate a second access key based on the device key and the first random number.

[0046] The authentication request sending module is used to send an access authentication request containing the second access key to the access cloud platform. The access authentication request is used to request the access cloud platform to perform access authentication on the IoT device based on the first access key and the second access key.

[0047] On one hand, an IoT device access authentication device is provided, the device being used to access a cloud platform, the device comprising:

[0048] The device information acquisition module is used to acquire device information of IoT devices;

[0049] A random number and key generation module is used to generate a first random number and a first access key;

[0050] The first random number sending module is used to send the first random number to the device cloud platform corresponding to the IoT device based on the device information of the IoT device.

[0051] The first encryption key receiving module is used to receive the first encryption key generated by the device cloud platform through encrypting the first random number using the device key;

[0052] The encrypted ciphertext acquisition module is used to encrypt the first access key using the first encryption key to obtain encrypted ciphertext;

[0053] A ciphertext and random number providing module is used to provide the encrypted ciphertext and the first random number to the Internet of Things device;

[0054] An authentication request receiving module is used to receive an access authentication request sent by the IoT device. The access authentication request includes a second access key, which is generated by the IoT device based on the device key, the encrypted ciphertext, and the first random number.

[0055] The access authentication module is used to perform access authentication on the IoT device based on the first access key and the second access key.

[0056] On one hand, an IoT device access authentication device is provided, the device being used in IoT devices, the device comprising:

[0057] The device information providing module is used to provide device information of the IoT devices to the cloud platform.

[0058] The ciphertext and random number acquisition module is used to acquire the encrypted ciphertext provided by the access cloud platform and the first random number generated by the access cloud platform; the encrypted ciphertext is the encrypted ciphertext obtained by the access cloud platform encrypting the first access key with the first encryption key; the first encryption key is the key generated by the device cloud platform of the IoT device encrypting the first random number with the device key; the device key is set in the IoT device and the device cloud platform;

[0059] The second encryption key generation module is used to encrypt the first random number using the device key to generate the second encryption key;

[0060] The second access key acquisition module is used to decrypt the encrypted ciphertext using the second encryption key to obtain the second access key;

[0061] The authentication request sending module is used to send an access authentication request containing the second access key to the access cloud platform. The access authentication request is used to request the access cloud platform to perform access authentication on the IoT device based on the first access key and the second access key.

[0062] On one hand, a cloud platform access device is provided, the cloud platform access device comprising: a processor and a transceiver connected to the processor; wherein,

[0063] The processor is used to acquire device information of IoT devices and generate a first random number;

[0064] The transceiver is configured to send the first random number to the device cloud platform based on the device information of the IoT device; and receive a first access key generated by the device cloud platform using the device key and the first random number; the device key is set in the IoT device and the device cloud platform.

[0065] The processor is configured to provide the first random number to the Internet of Things device;

[0066] The transceiver is used to receive an access authentication request sent by the IoT device. The access authentication request includes a second access key, which is generated by the IoT device based on the device key and the first random number.

[0067] The processor is configured to perform access authentication on the IoT device based on the first access key and the second access key.

[0068] On one hand, an Internet of Things (IoT) device is provided, the IoT device comprising: a processor and a transceiver connected to the processor; wherein,

[0069] The processor is configured to provide device information of the IoT device to the access cloud platform; obtain a first random number provided by the access cloud platform, wherein the first random number is generated by the access cloud platform and is provided by the device cloud platform after obtaining the device key of the IoT device and a first access key generated by the first random number; the device key is set in the IoT device and the device cloud platform.

[0070] The processor is configured to generate a second access key based on the device key and the first random number;

[0071] The transceiver is used to send an access authentication request containing the second access key to the access cloud platform. The access authentication request is used to request the access cloud platform to perform access authentication on the IoT device based on the first access key and the second access key.

[0072] On one hand, a cloud platform access device is provided, the cloud platform access device comprising: a processor and a transceiver connected to the processor; wherein,

[0073] The processor is used to acquire device information of IoT devices; generate a first random number and a first access key;

[0074] The transceiver is configured to send the first random number to the device cloud platform corresponding to the IoT device based on the device information of the IoT device; and receive a first encryption key generated by the device cloud platform by encrypting the first random number using the device key.

[0075] The processor is configured to encrypt the first access key using the first encryption key to obtain encrypted ciphertext; and provide the encrypted ciphertext and the first random number to the Internet of Things device.

[0076] The transceiver is used to receive an access authentication request sent by the IoT device. The access authentication request includes a second access key, which is generated by the IoT device based on the device key, the encrypted ciphertext, and the first random number.

[0077] The processor is configured to perform access authentication on the IoT device based on the first access key and the second access key.

[0078] On one hand, an Internet of Things (IoT) device is provided, the IoT device comprising: a processor and a transceiver connected to the processor; wherein,

[0079] The processor is configured to provide device information of the IoT device to the access cloud platform; obtain encrypted ciphertext provided by the access cloud platform and a first random number generated by the access cloud platform; the encrypted ciphertext is encrypted ciphertext obtained by the access cloud platform encrypting a first access key using a first encryption key; the first encryption key is a key generated by the device cloud platform of the IoT device encrypting the first random number using a device key; the device key is set in the IoT device and the device cloud platform;

[0080] The processor is configured to encrypt a first random number using a device key to generate a second encryption key; and to decrypt the encrypted ciphertext using the second encryption key to obtain a second access key.

[0081] The transceiver is used to send an access authentication request containing the second access key to the access cloud platform. The access authentication request is used to request the access cloud platform to perform access authentication on the IoT device based on the first access key and the second access key.

[0082] On one hand, a computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, the computer program being loaded and executed by a processor to implement the Internet of Things device access authentication method as described above.

[0083] According to one aspect of the embodiments of this application, a chip is provided, the chip including programmable logic circuits and / or program instructions, which, when the chip is run on a network device, is used to implement the IoT device access authentication method described above.

[0084] According to one aspect of this application, a computer program product is provided that, when run on a processor of a network device, causes the network device to perform the IoT device access authentication method described above.

[0085] The technical solutions provided in this application have at least the following beneficial effects:

[0086] In the IoT device and device cloud platform, a device key is pre-set. During the process of the IoT device initiating access to the access cloud platform, the access cloud platform can obtain a first access key and a first random number it generates by interacting with the device cloud platform. The first access key is generated from the device key and the first random number. That is, after the access cloud platform provides the first random number to the IoT device, the IoT device can obtain a second access key for access by combining the locally stored device key with the first random number, and then request access authentication from the access cloud platform using the second access key. In this process, the access cloud platform does not directly provide the access key to the IoT device, yet the IoT device can still correctly obtain the access key, ensuring security. At the same time, since no identity authentication of the IoT device is required in this process, the access authentication process can be simplified, thereby improving the efficiency of access authentication for IoT devices while ensuring security. Attached Figure Description

[0087] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0088] Figure 1 This is a block diagram of an access authentication system provided in an exemplary embodiment of this application;

[0089] Figure 2 This is a flowchart of an exemplary embodiment of the IoT device access authentication method provided in this application;

[0090] Figure 3 This is a flowchart of an exemplary embodiment of the IoT device access authentication method provided in this application;

[0091] Figure 4 yes Figure 3 The illustrated embodiment is a flowchart of the access authentication process in the power distribution network.

[0092] Figure 5 This is a flowchart of an exemplary embodiment of the IoT device access authentication method provided in this application;

[0093] Figure 6 yes Figure 5 The illustrated embodiment includes a flowchart of the access authentication process after network configuration is completed.

[0094] Figure 7This is a flowchart of an exemplary embodiment of the IoT device access authentication method provided in this application;

[0095] Figure 8 yes Figure 7 The illustrated embodiment is a flowchart of the access authentication process in the power distribution network.

[0096] Figure 9 This is a structural block diagram of an access authentication method apparatus provided in an exemplary embodiment of this application;

[0097] Figure 10 This is a structural block diagram of an access authentication method apparatus provided in an exemplary embodiment of this application;

[0098] Figure 11 This is a structural block diagram of an access authentication method apparatus provided in an exemplary embodiment of this application;

[0099] Figure 12 This is a structural block diagram of an access authentication method apparatus provided in an exemplary embodiment of this application;

[0100] Figure 13 This is a schematic diagram of the structure of a computer device provided in an exemplary embodiment of this application. Detailed Implementation

[0101] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0102] First, a brief introduction to the terms used in the embodiments of this application:

[0103] 1) Soft Access Point (Soft AP).

[0104] Soft AP is a technology that uses dedicated software to implement AP functions on non-AP devices through a wireless network card. It can replace AP (Access Point) in a wireless network, thereby reducing the cost of wireless networking.

[0105] The hardware component of a Soft AP is a standard wireless network card, which, through a driver, provides the same signal relay and routing functions as a traditional AP. Compared to traditional APs, Soft APs are much cheaper. Compared to ordinary wireless network cards, the integrated driver / software of Soft APs offers great ease of use for users new to networking.

[0106] 2) Distribution network based on Soft AP.

[0107] Distribution network refers to the process by which devices waiting to be connected to the network obtain network access information (such as network identifier and access key) and access the network based on the network access information.

[0108] Soft AP-based network configuration refers to the process by which devices seeking to connect to the network request network access information and connect to the network through the Soft AP function, with the help of network configuration devices (such as mobile phones).

[0109] 3) Scan the code to configure the network.

[0110] Scan-to-connect network refers to the process by which a device seeking to connect to the network scans a graphic code (such as a QR code) using an image acquisition component (such as a camera), decodes it, obtains the network access information carried in the graphic code, and then connects to the network based on the network access information.

[0111] In Internet of Things (IoT) technology, since IoT devices typically lack direct and effective means of information input, SoftAP network configuration and QR code network configuration are important means for IoT devices to access the network.

[0112] Figure 1 A block diagram of an access authentication system provided in an exemplary embodiment of this application is shown. The system may include: an Internet of Things device 12, an access cloud platform 14, and a device cloud platform 16.

[0113] The Internet of Things (IoT) device 12 can be a smart device (such as VR (Virtual Reality) glasses, smart wearable devices, etc.), a terminal device, a sensor device, or other devices with network access capabilities. This application embodiment does not limit this.

[0114] In one example, in the context of smart home living, IoT device 12 can be a smart TV, smart speaker, smart air conditioner, smart light, smart doors and windows, smart curtains, smart socket, and other smart home devices. Optionally, there may be one IoT device 12, or there may be multiple IoT devices 12. This application embodiment does not limit this. In practical applications, the number of IoT devices 12 can be determined based on application requirements or the maximum number of devices that the cloud platform 14 can manage.

[0115] The access cloud platform 14 includes access point device 141 and access cloud 142.

[0116] Access point device 141 is used to provide network access services to IoT device 12. For example, access point device 141 can be a wireless router, wireless gateway device, etc. In some scenarios, access point device 141 can also be implemented as a terminal device, such as a mobile phone, tablet computer, wearable device, etc. Optionally, the number of access point devices 141 can be one or more. This application embodiment does not limit this. Generally, for the sake of saving resources, the number of access point devices 141 is one.

[0117] Access cloud 142 can be the cloud server of access point device 141. Access point device 141 and access cloud 142 are connected via wired or wireless network.

[0118] IoT device 12 is developed based on device cloud platform cloud 16.

[0119] A communication link exists between the access cloud 142 and the device cloud platform 16. Optionally, the access cloud 142 and the device cloud platform 16 interact during the access process of the IoT device 12.

[0120] The aforementioned access cloud 142 and device cloud platform 16 can be implemented as a cloud computing resource pool in the field of cloud technology. Various types of virtual resources are deployed in the resource pool for external customers to choose from. The cloud computing resource pool mainly includes: computing devices (virtualized machines, including operating systems), storage devices, and network devices. These can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0121] In one possible implementation, the system may further include a network distribution device 18, which is connected to the access cloud 142 via a wired or wireless network. The network distribution device 18 is operated by a user to control the network distribution process of the IoT device 12. The network distribution device 18 can be implemented as a terminal device, such as a mobile phone, tablet, wearable device, etc.

[0122] Figure 2 A flowchart illustrating an exemplary embodiment of the present application provides an IoT device access authentication method. This method can be applied to, for example... Figure 1 In the access authentication system shown, the method is executed interactively by IoT device 12, access cloud platform 14, and device cloud platform 16, and may include the following steps:

[0123] Step 201: The IoT device provides its device information to the access cloud platform; correspondingly, the access cloud platform obtains the device information of the IoT device.

[0124] The aforementioned device information includes the device identifier (ID) of the IoT device, such as the Media Access Control (MAC) address of the IoT device.

[0125] The aforementioned device information may also include indications from the device cloud platform corresponding to the IoT device. For example, the device information may also include the manufacturer information of the IoT device, or the address of the device cloud platform, etc.

[0126] In one possible implementation of this application, the IoT device can provide its device information to the access cloud platform through a network configuration terminal during the network configuration process. For example, the IoT device can provide its device information to the access cloud platform through a network configuration terminal using either SoftAP or QR code scanning.

[0127] In one possible implementation of this application embodiment, the IoT device can directly send its device information to the access cloud platform after completing network configuration.

[0128] Step 202: The access cloud platform interacts with the device cloud platform corresponding to the IoT device based on the device information of the IoT device to generate a key and obtain a first access key and key indication information; wherein, the first access key and key indication information are information associated with the device key; the device key is set in the IoT device and the device cloud platform.

[0129] In this embodiment, the same device key is stored in both the device cloud platform and the IoT device.

[0130] When the access cloud platform assigns access keys to IoT devices, it interacts with the device cloud. In this process, in addition to generating the first access key, it also obtains key indication information. Furthermore, the first access key and the key indication information are associated through the device key. In other words, the first access key can be obtained by encrypting or decrypting the key indication information through the device key.

[0131] Step 203: The access cloud platform provides the key indication information to the IoT device; correspondingly, the IoT device obtains the key indication information provided by the access cloud platform.

[0132] In this embodiment of the application, the device cloud platform provides key indication information to IoT devices, but does not directly provide access keys.

[0133] For example, in one possible implementation of this application embodiment, during the IoT device network configuration process, the access cloud platform provides key indication information to the IoT device through the configuration terminal. For example, the access cloud platform provides key indication information to the IoT device through the configuration terminal using either a Soft AP configuration method or a QR code configuration method.

[0134] In one possible implementation of this application, after the IoT device completes network configuration, the access cloud platform can directly send key indication information to the IoT device.

[0135] Step 204: The IoT device generates a second access key based on the device key and the key indication information.

[0136] Since the key indication information and the first access key are associated through the device key, after the IoT device obtains the key indication information, it can encrypt / decrypt the key indication information through the device key to obtain the encrypted / decrypted second access key.

[0137] Step 205: The IoT device sends an access authentication request containing the second access key to the access cloud platform; correspondingly, the access cloud platform receives the access authentication request sent by the IoT device.

[0138] Step 206: The cloud platform performs access authentication on the IoT device based on the first access key and the second access key.

[0139] In summary, in the scheme shown in the embodiments of this application, a device key is pre-set in both the IoT device and the device cloud platform. During the process of the IoT device initiating access to the access cloud platform, the access cloud platform obtains a first access key and key indication information through interaction with the device cloud platform. The first access key and key indication information are associated through the device key. That is, after the access cloud platform provides the key indication information to the IoT device, the IoT device can obtain a second access key for access by combining the locally stored device key with the key indication information, and then request access authentication from the access cloud platform through the second access key. In this process, the access cloud platform does not directly provide the access key to the IoT device, yet the IoT device can still correctly obtain the access key, ensuring security. At the same time, since no identity authentication of the IoT device is required in this process, the access authentication process can be simplified, thereby improving the efficiency of access authentication for IoT devices while ensuring the security of access authentication.

[0140] In one possible implementation, when the above Figure 2The scheme in the illustrated embodiment is applied during or after the network configuration of IoT devices. The first access key can be generated by the device cloud platform, and the key indication information includes a first random number generated by the access cloud platform.

[0141] In this scenario, the system accesses the cloud platform to obtain device information of the IoT device; generates a first random number; sends the first random number to the cloud platform based on the device information of the IoT device; receives a first access key generated by the cloud platform using the device key and the first random number; the device key is set in both the IoT device and the cloud platform; provides the first random number to the IoT device; receives an access authentication request from the IoT device, which includes a second access key generated by the IoT device based on the device key and the first random number; and performs access authentication on the IoT device based on the first access key and the second access key.

[0142] Accordingly, the IoT device provides its device information to the access cloud platform; obtains a first random number provided by the access cloud platform, which is generated by the access cloud platform and obtained after the device cloud platform obtains the IoT device's device key and a first access key generated by the first random number; the device key is set in the IoT device and the device cloud platform; a second access key is generated based on the device key and the first random number; and an access authentication request containing the second access key is sent to the access cloud platform, which requests the access cloud platform to perform access authentication for the IoT device based on the first access key and the second access key.

[0143] The following is an exemplary description of the access authentication process in this situation.

[0144] Figure 3 A flowchart illustrating an exemplary embodiment of the present application provides an IoT device access authentication method. This method can be applied to, for example... Figure 1 In the access authentication system shown, the interaction between IoT device 12, access cloud platform 14, and device cloud platform 16 enables the following steps:

[0145] Step 301: The IoT device provides its device information to the access cloud platform; correspondingly, the access cloud platform obtains the device information of the IoT device.

[0146] In this embodiment of the application, when an IoT device needs to be configured for network access, it can provide device information to the cloud platform.

[0147] The aforementioned device information includes the device identifier (ID) of the IoT device, such as the Media Access Control (MAC) address of the IoT device.

[0148] The aforementioned device information may also include indications from the device cloud platform corresponding to the IoT device. For example, the device information may also include the manufacturer information of the IoT device, or the address of the device cloud platform, etc.

[0149] In one possible implementation of this application, the IoT device can provide its device information to the access cloud platform through a network configuration terminal during the network configuration process. For example, the IoT device can provide its device information to the access cloud platform through a network configuration terminal using either SoftAP or QR code scanning.

[0150] In one possible implementation of this application embodiment, the IoT device can directly send its device information to the access cloud platform after completing network configuration.

[0151] Step 302: Connect to the cloud platform to generate the first random number.

[0152] The first random number serves as the key indication information.

[0153] In this embodiment, the access cloud platform generates a first random number corresponding to the IoT device through a pre-set random number generation algorithm.

[0154] In one possible implementation, the access cloud platform also generates access authentication identifiers for IoT devices.

[0155] In this embodiment of the application, after the access cloud platform obtains the device information of the IoT device, it can generate an access authentication identifier for the IoT device. The access authentication identifier is used to identify the IoT device when the IoT device initiates access.

[0156] In one possible implementation, the cloud platform also generates a device registration code for the IoT device.

[0157] In this embodiment of the application, the access cloud platform can also generate a corresponding device registration code for the IoT device. This device registration code is used as additional or auxiliary access authentication information when the IoT device initiates access.

[0158] Step 303: The access cloud platform sends the first random number to the device cloud platform based on the device information of the IoT device; correspondingly, the device cloud platform receives the first random number.

[0159] The access cloud platform can determine the corresponding device cloud platform for the IoT device based on the device information of the IoT device, and send a first random number to the determined device cloud platform.

[0160] For example, when the device information of an IoT device includes the device manufacturer information of that IoT device, the access cloud platform can determine the address / interface of the device cloud platform corresponding to the IoT device through the device manufacturer information (for example, the address / interface of the device cloud platform can be obtained by looking up the device cloud platform through the manufacturer information), and send the aforementioned first random number to the device cloud platform through the determined address / interface.

[0161] Step 304: The device cloud platform generates a first access key using the device key of the IoT device and a first random number.

[0162] In one possible implementation, the aforementioned device cloud platform uses the device key corresponding to the IoT device to encrypt the first random number and generate the first access key.

[0163] In this embodiment of the application, the device manufacturer can pre-set a device key for the IoT device. The device key is set in the IoT device before it leaves the factory. At the same time, the device manufacturer also stores the device key of the IoT device in the corresponding device cloud platform. For example, the device cloud platform stores the correspondence between the device identifier (such as MAC address) of the IoT device and the device key.

[0164] Step 305: The device cloud platform returns the first access key to the access cloud platform, and the access cloud platform receives the first access key.

[0165] In other words, the access cloud platform receives the first access key generated by encrypting the first random number using the device key.

[0166] In one possible implementation, the cloud platform also establishes an association between the aforementioned access authentication identifier and the first access key.

[0167] For example, the cloud platform can pre-establish an association table between access authentication identifiers and access keys. Whenever the cloud platform generates an access authentication identifier and obtains a first access key for an IoT device, it stores the IoT device's access authentication identifier and first access key in the association table for subsequent lookup and use during the access authentication process.

[0168] Step 306: The access cloud platform provides the first random number to the IoT device, and the IoT device obtains the first random number provided by the access cloud platform.

[0169] In this embodiment, the access cloud platform sends key indication information to IoT devices that requires device key processing to obtain the access key, instead of directly sending the access key, thereby ensuring the security of key issuance.

[0170] In one possible implementation, the access cloud platform also provides an access authentication identifier to the IoT device; correspondingly, the IoT device obtains the access authentication identifier provided by the access cloud platform.

[0171] In one possible implementation, the access cloud platform also provides the device registration code to the IoT device; correspondingly, the IoT device obtains the device registration code provided by the access cloud platform.

[0172] In one possible implementation, the access cloud platform will also provide the access authentication identifier and device registration code to the IoT device; accordingly, the IoT device obtains the access authentication identifier and device registration code provided by the access cloud platform.

[0173] Step 307: The IoT device generates a second access key using the device key and the first random number.

[0174] In one possible implementation, the IoT device encrypts the first random number using a device key to generate a second access key.

[0175] In this embodiment of the application, after the IoT device obtains the key indication information (i.e. the first random number) sent by the access cloud platform, it can encrypt the first random number according to its own stored device key to obtain the second access key.

[0176] In one possible implementation, the encryption algorithm used by the device cloud platform to encrypt the first random number to obtain the first access key is the same as the encryption algorithm used by the IoT device to encrypt the first random number to obtain the second access key using the device key.

[0177] In this embodiment, since IoT devices need to process key indication information using locally stored device keys to obtain access keys, only IoT devices with specific identities can obtain the correct access keys. This achieves identity authentication during the access key distribution process without the need for additional authentication procedures, thereby ensuring the security of key distribution and reducing the complexity of authentication procedures.

[0178] Step 308: The IoT device sends an access authentication request containing a second access key to the access cloud platform; correspondingly, the access cloud platform receives the access authentication request sent by the IoT device.

[0179] In one possible implementation, the access cloud platform sends an access authentication request containing a second access key and an access authentication identifier to the access cloud platform.

[0180] In one possible implementation, the access cloud platform sends an access authentication request containing a second access key and a device registration code to the access cloud platform.

[0181] In one possible implementation, the access cloud platform sends an access authentication request to the access cloud platform, which includes a second access key, an access authentication identifier, and a device registration code.

[0182] Step 309: The cloud platform performs access authentication on the IoT device based on the first access key and the second access key.

[0183] In one possible implementation, the access cloud platform establishes data connection authentication for IoT devices by establishing a Transport Layer Security (TLS) / Datagram Transport Layer Security (DTLS) pre-shared key (PSK) based on the first access key and the second access key.

[0184] In this embodiment of the application, after the access cloud platform receives the access authentication request sent by the IoT device, it can use the second access key in the request as the PSK and match it with the first access key. If the two match, the access authentication is confirmed to be successful and a TLS / DTLS connection is established.

[0185] In one possible implementation, the access cloud platform queries the aforementioned association based on the access authentication identifier carried in the access authentication request to obtain the first access key; and performs access authentication on the IoT device based on the first access key and the second access key obtained.

[0186] In one possible implementation, the access cloud platform establishes a secure data connection with the IoT device using a TLS / DTLS pre-shared key (PSK) based on the device registration code carried in the access authentication request; and performs one-way or two-way challenge authentication based on the first access key and the second access key.

[0187] For example, an IoT device sends a random value S1 and a verification value X1 generated using a second access key to the access cloud platform. The access cloud platform uses a first access key and the random value S1 to generate a verification value X2 and compares it with X1. At the same time, the access cloud platform sends a random value S2 and a verification value X3 generated using the first access key to the IoT device. The IoT device uses a second access key and the random value S2 to generate a verification value X4 and compares it with X3.

[0188] In another possible implementation, the access cloud platform establishes a secure data connection with IoT devices via TLS / DTLS anonymity and performs one-way or two-way challenge authentication based on the first access key and the second access key.

[0189] Please refer to Figure 4 This illustrates a flowchart of the access authentication process in the power distribution network involved in an embodiment of this application. Figure 4 As shown, the access authentication process for IoT devices is as follows:

[0190] S41, IoT devices broadcast beacon frames or display QR codes; distribution network devices obtain device information of IoT devices through Soft AP discovery or QR code scanning.

[0191] For example, the distribution network device can receive beacon frames broadcast by IoT devices through Soft AP discovery, parse the Service Set Identifier (SSID), Basic Service Set Identifier (BSSID), and Manufacturer-defined Information Element (IE) in the beacon frame to obtain the device information of the IoT device, such as the MAC address of the IoT device (denoted as ID1, corresponding to the device identifier in the above embodiment) and the device manufacturer information of the IoT device.

[0192] Alternatively, the distribution network equipment can scan the QR code on the IoT device (which can be displayed on a physical label or screen) with a camera to decode and obtain the aforementioned device information of the IoT device.

[0193] S42, the distribution network equipment establishes a secure connection with the access cloud platform.

[0194] S43, the distribution network device sends the aforementioned device information of the IoT device, such as ID1 and device manufacturer information, to the access cloud platform.

[0195] S44, access cloud platform determines the device cloud platform based on device manufacturer information.

[0196] S45, the access cloud platform generates an ID2 (corresponding to the aforementioned access authentication identifier) ​​and a random number R1 (corresponding to the aforementioned first random number) for the IoT device based on ID1. In one possible implementation, the access cloud platform also assigns a device registration code A1 to the IoT device.

[0197] S46 establishes a secure connection between the access cloud platform and the device cloud platform.

[0198] S47, access the cloud platform and send ID1 and R1 to the device cloud platform.

[0199] S48, the device cloud platform obtains the key K of the IoT device (corresponding to the above device key) based on ID1.

[0200] S49, the device cloud platform encrypts R1 through K to generate K1 (corresponding to the first access key mentioned above).

[0201] S410, the device cloud platform returns K1 to the access cloud platform.

[0202] S411, the access cloud platform returns ID2 and a random number R1 to the distribution network device. In one possible implementation, the access cloud platform also returns A1 to the distribution network device.

[0203] S412, IoT devices obtain ID2, R1, network information, and access cloud platform address through Soft AP discovery or QR code scanning; in one possible implementation, IoT devices also obtain A1 through Soft AP discovery or QR code scanning.

[0204] For example, a connection based on a Soft AP is established between the distribution network terminal and the IoT device. The distribution network terminal sends the aforementioned ID2, R1, network information, and access cloud platform address (optionally including A1) to the IoT device.

[0205] Alternatively, the distribution network terminal can generate and display a QR code based on the aforementioned ID2, R1, network information, and access cloud platform address (optionally including A1), and the IoT device can scan the QR code to obtain information such as ID2, R1, network information, and access cloud platform address (optionally including A1).

[0206] S413, the IoT device uses the locally stored K to encrypt R1 to obtain K1' (corresponding to the second access key mentioned above).

[0207] S414, IoT devices use K1' as the key to establish a TLS / DTLS connection with the access cloud platform via PSK.

[0208] Optionally, when the IoT device obtains A1, the IoT device may also perform the following step S415.

[0209] S415, IoT devices use A1 as the key to establish a TLS / DTLS connection with the access cloud platform via PSK; and use K1' as the key to perform one-way or two-way challenge authentication with the access cloud platform.

[0210] In the above Figure 4In the scheme shown, the IoT device manufacturer assigns a unique key K to each device (identified by device ID1), pre-installs key K into the corresponding device, and stores key K and the corresponding device ID1 in the device manufacturer's device cloud platform.

[0211] The access cloud platform obtains Device ID1 from the device. Based on Device ID1, the access cloud platform generates ID2 for the device and a random value R1 (the access cloud platform needs to save R1 and the corresponding device ID2). The access cloud platform then sends the aforementioned ID1 and R1 to the device cloud platform.

[0212] The device cloud platform generates key K1 using the following method: R1 is generated using a predefined key generation algorithm S1, such as the Advanced Encryption Standard (AES) 256 Code-Based Message Authentication Code (CMAC) algorithm, the Key Derivation Function (KDF) algorithm based on HMAC (Hash-based Message Authentication Code (MAC) algorithm, or the Password-Based Key Derivation Function (PBKDF) algorithm, and then encrypted with K to obtain K1.

[0213] The device cloud platform returns K1 to the access cloud platform. The access cloud platform then returns ID2 and R1 to the device via the configuration terminal.

[0214] The device uses a predefined key generation algorithm S1 to encrypt R1 with K to obtain K1' (equivalent to K1). Intermediate nodes (such as distribution network terminals) do not have K, so they cannot obtain K1, which can prevent key leakage caused by the distribution network terminal being cracked and hijacked.

[0215] In one possible implementation, the device establishes a TLS / DTLS connection with the mobile cloud platform using K1' as a pre-shared key via PSK. ID2 is used to uniquely identify the device on the access cloud platform and to index K1.

[0216] In another possible implementation, the network distribution device sends network information, ID2, R1, device registration code A1, and access cloud address to the IoT device. Each time the IoT device connects to the aforementioned access cloud platform, it uses the TLS / DTLS method, uses the device registration code as a pre-shared key or negotiates a communication key anonymously to establish a secure connection, and then uses K1 as a key to perform one-way or two-way challenge authentication with the mobile cloud platform.

[0217] In summary, in the scheme shown in the embodiments of this application, a device key is pre-set in both the IoT device and the device cloud platform. During the process of the IoT device initiating access to the access cloud platform, the access cloud platform can obtain a first access key and a first random number it generates by interacting with the device cloud platform. The first access key is generated by the device key and the first random number. That is, after the access cloud platform provides the first random number to the IoT device, the IoT device can obtain a second access key for access by combining the locally stored device key with the first random number, and then request access authentication from the access cloud platform using the second access key. In this process, the access cloud platform does not directly provide the access key to the IoT device, yet the IoT device can still correctly obtain the access key, ensuring security. At the same time, since no identity authentication of the IoT device is required in this process, the access authentication process can be simplified, thereby improving the efficiency of access authentication for IoT devices while ensuring the security of access authentication.

[0218] Based on the above Figure 3 In one possible implementation of the scheme shown, after the scheme is applied to the IoT device network configuration, the first access key can be generated by the device cloud platform, and the key indication information includes a first random number generated by the access cloud platform. To improve security, the first access key can be generated based on the first random number and a second random number assigned by the IoT device itself.

[0219] The following is an exemplary description of the access authentication process in this situation.

[0220] Figure 5 A flowchart illustrating an exemplary embodiment of the present application provides an IoT device access authentication method. This method can be applied to, for example... Figure 1 In the access authentication system shown, the interaction between IoT device 12, access cloud platform 14, and device cloud platform 16 enables the following steps:

[0221] Step 501: The IoT device generates a second random number.

[0222] In one possible implementation, the IoT device also encrypts the second random number using a device key to generate the first device authentication information.

[0223] In this embodiment of the application, in order to further improve the security of access key distribution, in addition to providing a second random number, the IoT device also encrypts the second random number with the device key to obtain the first device authentication information, which is used by the device cloud platform to authenticate the IoT device in the future.

[0224] Step 502: The IoT device provides a second random number and its device information to the access cloud platform; correspondingly, the access cloud platform obtains the second random number and the IoT device information.

[0225] In one possible implementation, the IoT device also obtains first device authentication information provided by the IoT device.

[0226] Step 503: Connect to the cloud platform to generate the first random number.

[0227] The first random number serves as the key indication information.

[0228] In one possible implementation, the access cloud platform also generates access authentication identifiers for IoT devices.

[0229] In one possible implementation, the cloud platform also generates a device registration code for the IoT device.

[0230] Step 504: The access cloud platform sends the first random number and the second random number to the device cloud platform based on the device information of the IoT device; correspondingly, the device cloud platform receives the first random number and the second random number.

[0231] In one possible implementation, the access cloud platform sends a first random number, a second random number, and first device authentication information to the device cloud platform; correspondingly, the device cloud platform receives the first random number, the second random number, and the first device authentication information.

[0232] Step 505: The device cloud platform uses the device key corresponding to the IoT device to encrypt the first random number and the second random number to generate the first access key.

[0233] In one possible implementation, the device cloud platform encrypts the second random number using a device key to generate second device authentication information, and then uses the second device authentication information to authenticate the first device authentication information. Once the first device authentication information is successfully authenticated using the second device authentication information, the device cloud platform generates a third random number and encrypts the second and third random numbers using the device key to generate the first cloud authentication information.

[0234] Step 506: The device cloud platform returns the first access key to the access cloud platform, and the access cloud platform receives the first access key.

[0235] In one possible implementation, the access cloud platform receives a first access key, a first cloud authentication information, and a third random number sent by the device cloud platform after the first device authentication information has been authenticated by the second device authentication information.

[0236] The second device authentication information is generated by the device cloud platform encrypting the second random number using the device key; the first cloud authentication information is generated by the device cloud platform encrypting the second random number and the third random number using the device key; and the third random number is generated by the device cloud platform.

[0237] In one possible implementation, the cloud platform also establishes an association between the aforementioned access authentication identifier and the first access key.

[0238] Step 507: The access cloud platform provides the first random number to the IoT device, and the IoT device obtains the first random number provided by the access cloud platform.

[0239] In one possible implementation, the access cloud platform will also provide the first cloud authentication information and the third random number to the IoT device.

[0240] In one possible implementation, the access cloud platform also provides an access authentication identifier to the IoT device; correspondingly, the IoT device obtains the access authentication identifier provided by the access cloud platform.

[0241] In one possible implementation, the access cloud platform also provides the device registration code to the IoT device; correspondingly, the IoT device obtains the device registration code provided by the access cloud platform.

[0242] In one possible implementation, the access cloud platform will also provide the access authentication identifier and device registration code to the IoT device; accordingly, the IoT device obtains the access authentication identifier and device registration code provided by the access cloud platform.

[0243] Step 508: The IoT device encrypts the first random number and the second random number using the device key to generate the second access key.

[0244] In one possible implementation, the IoT device encrypts a second random number and a third random number using a device key to generate second cloud authentication information; after the first cloud authentication information is authenticated based on the second cloud authentication information, a second access key is generated based on the device key and key indication information.

[0245] The algorithm used by the IoT device to encrypt the second and third random numbers using the device key is the same as the algorithm used by the device cloud platform to encrypt the second and third random numbers using the device key; correspondingly, the algorithm used by the IoT device to encrypt the first and second random numbers using the device key is the same as the algorithm used by the device cloud platform to encrypt the first and second random numbers using the device key.

[0246] Step 509: The IoT device sends an access authentication request containing a second access key to the access cloud platform; correspondingly, the access cloud platform receives the access authentication request sent by the IoT device.

[0247] In one possible implementation, the access cloud platform sends an access authentication request containing a second access key and an access authentication identifier to the access cloud platform.

[0248] In one possible implementation, the access cloud platform sends an access authentication request containing a second access key and a device registration code to the access cloud platform.

[0249] In one possible implementation, the access cloud platform sends an access authentication request to the access cloud platform, which includes a second access key, an access authentication identifier, and a device registration code.

[0250] Step 510: The cloud platform performs access authentication on the IoT device based on the first access key and the second access key.

[0251] In one possible implementation, the access cloud platform establishes data connection authentication for IoT devices using a TLS / DTLS pre-shared key (PSK) method based on a first access key and a second access key.

[0252] In one possible implementation, the access cloud platform queries the aforementioned association based on the access authentication identifier carried in the access authentication request to obtain the first access key; and performs access authentication on the IoT device based on the first access key and the second access key obtained.

[0253] In one possible implementation, the access cloud platform establishes a secure data connection with the IoT device using a TLS / DTLS pre-shared key (PSK) based on the device registration code carried in the access authentication request; and performs one-way or two-way challenge authentication based on the first access key and the second access key.

[0254] In another possible implementation, the access cloud platform establishes a secure data connection with IoT devices via TLS / DTLS anonymity and performs one-way or two-way challenge authentication based on the first access key and the second access key.

[0255] In another possible implementation, the access cloud platform receives the first access key, third cloud authentication information, third device authentication information, and third random number sent by the device cloud platform; the third cloud authentication information is generated by the device cloud platform by encrypting the second random number using the device key; the third device authentication information is generated by the device cloud platform by encrypting the third random number; the third random number is generated by the device cloud platform.

[0256] Before the cloud platform receives the access authentication request sent by the IoT device, it also provides the third cloud authentication information and the third random number to the IoT device;

[0257] When the access cloud platform receives the access authentication request sent by the IoT device, it receives the access authentication request sent by the IoT device after the IoT device has successfully authenticated the third cloud authentication information based on the fourth cloud authentication information; the fourth cloud authentication information is generated by the IoT device by encrypting the second random number using the device key; the access authentication request also includes fourth device authentication information, which is generated by the IoT device by encrypting the third random number using the device key.

[0258] When the access cloud platform performs access authentication for the IoT device based on the first access key and the second access key, after the fourth device authentication information is successfully authenticated based on the third device authentication information, the IoT device is then authenticated again based on the first access key and the second access key.

[0259] Accordingly, before generating the second access key based on the device key and the first random number, the IoT device obtains the third cloud authentication information and the third random number provided by the access cloud platform; the third cloud authentication information is generated by the device cloud platform by encrypting the second random number using the device key; the third random number is generated by the device cloud platform.

[0260] When an IoT device generates a second access key based on the device key and the first random number, it encrypts the second random number using the device key to generate fourth cloud authentication information; after the third cloud authentication information is authenticated successfully based on the fourth cloud authentication information, the second access key is generated based on the device key and the first random number.

[0261] The IoT device also uses the device key to encrypt the third random number to generate the fourth device authentication information;

[0262] When an IoT device sends an access authentication request containing the second access key to the access cloud platform, it sends the access authentication request containing the second access key and the fourth device authentication information to the access cloud platform.

[0263] Please refer to Figure 6 This illustrates a flowchart of the access authentication process after network configuration is completed, as described in an embodiment of this application. Figure 6 As shown, the access authentication process for IoT devices is as follows:

[0264] S61, IoT devices establish a secure connection with the access cloud platform.

[0265] S62, the IoT device generates a random string R2 (corresponding to the second random number mentioned above), and encrypts R2 with the device key K to generate device authentication information Hc1 (corresponding to the first device authentication information mentioned above).

[0266] S63, the IoT device sends R2, Hc1, and the device information of the IoT device (including the device identifier ID1 of the IoT device and the device manufacturer information) to the access cloud platform.

[0267] S64 connects to the cloud platform and determines the cloud platform for the device based on the device manufacturer information.

[0268] S65, the access cloud platform generates an ID2 (corresponding to the aforementioned access authentication identifier) ​​and a random number R1 (corresponding to the aforementioned first random number) for the IoT device based on ID1. In one possible implementation, the access cloud platform also assigns a device registration code A1 to the IoT device.

[0269] S66 establishes a secure connection between the access cloud platform and the device cloud platform.

[0270] S67, access cloud platform sends ID1, R1, R2 and Hc1 to device cloud platform.

[0271] S68, the device cloud platform obtains the key K of the IoT device (corresponding to the above device key) based on ID1.

[0272] S69, the device cloud platform encrypts R2 with K to generate Hc1' (corresponding to the second device authentication information mentioned above); if Hc1' is the same as Hc1, the IoT device authentication is successful and proceeds to S610; otherwise, the authentication fails.

[0273] S610, the device cloud platform generates a random number R3 (i.e., the third random number mentioned above).

[0274] S611, the device cloud platform encrypts R2 and R3 through K to generate cloud authentication information Hc2 (corresponding to the first cloud authentication information mentioned above).

[0275] S612, the device cloud platform encrypts R1 through K to generate K1 (corresponding to the first access key mentioned above).

[0276] S613, the device cloud platform returns K1, R3 and Hc2 to the access cloud platform.

[0277] S614, the access cloud platform returns ID2, R1, R3, and Hc2 to the IoT device. In one possible implementation, the access cloud platform also returns A1 to the IoT device.

[0278] IoT devices obtain network information such as ID2, R1, R3, and Hc2, and access cloud platform addresses through secure connections; in one possible implementation, IoT devices also obtain A1 through secure connections.

[0279] S615, IoT devices encrypt R2 and R3 via K to generate Hc2' (corresponding to the second cloud authentication information mentioned above).

[0280] S616: The IoT device compares Hc2' with Hc2. If they are the same, the authentication is successful and proceeds to S618; otherwise, the authentication fails.

[0281] S617, the IoT device uses the locally stored K to encrypt R1 and R2 to obtain K1' (corresponding to the second access key mentioned above).

[0282] S618: IoT devices use K1' as the key to establish a TLS / DTLS connection with the access cloud platform via PSK.

[0283] Optionally, when the IoT device obtains A1, the IoT device may also perform the following step S415.

[0284] S619: IoT devices use A1 as the key to establish a TLS / DTLS connection with the access cloud platform via PSK; and use K1' as the key to perform one-way or two-way challenge authentication with the access cloud platform.

[0285] In summary, in the scheme shown in this application embodiment, a device key is pre-set in both the IoT device and the device cloud platform. During the process of the IoT device initiating access to the access cloud platform, the IoT device provides a second random number to the access cloud platform. The access cloud platform, through interaction with the device cloud platform, can obtain a first access key and a first random number it generates itself. The first access key is generated using the device key, the first random number, and the second random number. That is, after the access cloud platform provides the first random number to the IoT device, the IoT device can obtain a second access key for access by combining the locally stored device key and the second random number with the first random number, and then request access authentication from the access cloud platform using the second access key. In this process, the access cloud platform does not directly provide the access key to the IoT device, yet the IoT device can still correctly obtain the access key, ensuring security. At the same time, since no identity authentication of the IoT device is required in this process, the access authentication process can be simplified, thereby improving the efficiency of access authentication for IoT devices while ensuring the security of access authentication.

[0286] In one possible implementation, when the above Figure 2The scheme in the illustrated embodiment is applied during or after the network configuration of IoT devices. The first access key can be generated by the access cloud platform, and the key indication information includes ciphertext obtained by encrypting the first access key.

[0287] In this scenario, the system accesses the cloud platform to obtain device information of the IoT device; generates a first random number and a first access key; sends the first random number to the device cloud platform corresponding to the IoT device based on the device information; receives a first encryption key generated by the device cloud platform using the device key to encrypt the first random number; encrypts the first access key using the first encryption key to obtain encrypted ciphertext; provides the encrypted ciphertext and the first random number to the IoT device; receives an access authentication request sent by the IoT device, the access authentication request containing a second access key, which is generated by the IoT device based on the device key, the encrypted ciphertext, and the first random number; and performs access authentication on the IoT device based on the first access key and the second access key.

[0288] Accordingly, the IoT device provides its device information to the access cloud platform; obtains encrypted ciphertext and a first random number generated by the access cloud platform; the encrypted ciphertext is obtained by the access cloud platform encrypting a first access key using a first encryption key; the first encryption key is a key generated by the IoT device's device cloud platform encrypting the first random number using a device key; the device key is set in both the IoT device and the device cloud platform; the first random number is encrypted using the device key to generate a second encryption key; the encrypted ciphertext is decrypted using the second encryption key to obtain a second access key; and an access authentication request containing the second access key is sent to the access cloud platform, the access authentication request being used to request the access cloud platform to perform access authentication for the IoT device based on the first access key and the second access key.

[0289] The following is an exemplary description of the access authentication process in this situation.

[0290] Figure 7 A flowchart illustrating an exemplary embodiment of the present application provides an IoT device access authentication method. This method can be applied to, for example... Figure 1 In the access authentication system shown, the interaction between IoT device 12, access cloud platform 14, and device cloud platform 16 enables the following steps:

[0291] Step 701: The IoT device provides its device information to the access cloud platform; correspondingly, the access cloud platform obtains the device information of the IoT device.

[0292] The above step 701 can be referred to. Figure 3 The description of step 401 in the illustrated embodiment will not be repeated here.

[0293] Step 702: Connect to the cloud platform to generate the first random number and the first access key.

[0294] In this embodiment of the application, in addition to generating a first random number, the access cloud platform also generates a first access key.

[0295] In one possible implementation, the access cloud platform also generates access authentication identifiers for IoT devices.

[0296] In one possible implementation, the cloud platform also generates a device registration code for the IoT device.

[0297] In one possible implementation, the cloud platform also establishes an association between the aforementioned access authentication identifier and the first access key.

[0298] Step 703: The access cloud platform sends the first random number to the device cloud platform based on the device information of the IoT device; correspondingly, the device cloud platform receives the first random number.

[0299] Step 704: The device cloud platform uses the device key corresponding to the IoT device to encrypt the first random number to generate the first encryption key.

[0300] Step 705: The device cloud platform returns the first encryption key to the access cloud platform, and the access cloud platform receives the first encryption key.

[0301] In other words, the cloud platform receives the first encryption key generated by the IoT device encrypting the first random number using the device key.

[0302] Step 706: The cloud platform encrypts the first access key using the first encryption key to obtain encrypted ciphertext.

[0303] The encrypted ciphertext and the first random number are the key indication information.

[0304] Step 707: The access cloud platform provides the encrypted ciphertext and the first random number to the IoT device. Correspondingly, the IoT device obtains the encrypted ciphertext and the first random number provided by the access cloud platform.

[0305] In one possible implementation, the access cloud platform also provides an access authentication identifier to the IoT device; correspondingly, the IoT device obtains the access authentication identifier provided by the access cloud platform.

[0306] In one possible implementation, the access cloud platform also provides the device registration code to the IoT device; correspondingly, the IoT device obtains the device registration code provided by the access cloud platform.

[0307] In one possible implementation, the access cloud platform will also provide the access authentication identifier and device registration code to the IoT device; accordingly, the IoT device obtains the access authentication identifier and device registration code provided by the access cloud platform.

[0308] Step 708: The IoT device encrypts the first random number using the device key to generate a second encryption key; it then decrypts the encrypted ciphertext using the second encryption key to obtain a second access key.

[0309] In this embodiment, the encryption algorithm used by the IoT device to encrypt the first random number using the device key is the same as the encryption algorithm used by the device cloud platform to encrypt the first random number using the device key.

[0310] Furthermore, the algorithm used by the IoT device to decrypt encrypted ciphertext with the second encryption key matches the algorithm used by the cloud platform to encrypt the first access key with the first encryption key.

[0311] Step 709: The IoT device sends an access authentication request containing a second access key to the access cloud platform; correspondingly, the access cloud platform receives the access authentication request sent by the IoT device.

[0312] In one possible implementation, the access cloud platform sends an access authentication request containing a second access key and an access authentication identifier to the access cloud platform.

[0313] In one possible implementation, the access cloud platform sends an access authentication request containing a second access key and a device registration code to the access cloud platform.

[0314] In one possible implementation, the access cloud platform sends an access authentication request to the access cloud platform, which includes a second access key, an access authentication identifier, and a device registration code.

[0315] Step 710: The cloud platform performs access authentication on the IoT device based on the first access key and the second access key.

[0316] In one possible implementation, the access cloud platform establishes data connection authentication for IoT devices using a pre-shared key TLS / DTLSPSK method based on a first access key and a second access key.

[0317] In one possible implementation, the access cloud platform queries the aforementioned association based on the access authentication identifier carried in the access authentication request to obtain the first access key; and performs access authentication on the IoT device based on the first access key and the second access key obtained.

[0318] In one possible implementation, the access cloud platform establishes a secure data connection with the IoT device using a TLS / DTLS pre-shared key (PSK) based on the device registration code carried in the access authentication request; and performs one-way or two-way challenge authentication based on the first access key and the second access key.

[0319] In another possible implementation, the access cloud platform establishes a secure data connection with IoT devices via TLS / DTLS anonymity and performs one-way or two-way challenge authentication based on the first access key and the second access key.

[0320] Please refer to Figure 8 This illustrates a flowchart of the access authentication process in the power distribution network involved in an embodiment of this application. Figure 8 As shown, the access authentication process for IoT devices is as follows:

[0321] S81, IoT devices broadcast beacon frames or display QR codes; distribution network devices obtain device information of IoT devices through Soft AP discovery or QR code scanning.

[0322] S82 establishes a secure connection between the distribution network equipment and the access cloud platform.

[0323] S83, the distribution network device sends the aforementioned device information of the IoT device, such as ID1 and device manufacturer information, to the access cloud platform.

[0324] S84 connects to the cloud platform and determines the cloud platform for the device based on the device manufacturer information.

[0325] S85, the access cloud platform generates an ID2 (corresponding to the aforementioned access authentication identifier), a key K1 (corresponding to the aforementioned first access key), and a random number R1 (corresponding to the aforementioned first random number) for the IoT device based on ID1. In one possible implementation, the access cloud platform also assigns a device registration code A1 to the IoT device.

[0326] S86 establishes a secure connection between the access cloud platform and the device cloud platform.

[0327] S87 connects to the cloud platform and sends ID1 and R1 to the device cloud platform.

[0328] S88, the device cloud platform obtains the key K of the IoT device (corresponding to the above device key) based on ID1.

[0329] S89, the device cloud platform encrypts R1 with K to generate K2 (corresponding to the first encryption key mentioned above).

[0330] S810, the device cloud platform returns K2 to the access cloud platform.

[0331] S811 connects to the cloud platform and encrypts K1 using K2 to obtain ciphertext C1.

[0332] S812, the access cloud platform returns ID2, random number R1, and ciphertext C1 to the distribution network device. In one possible implementation, the access cloud platform also returns A1 to the distribution network device.

[0333] S813, the IoT device obtains ID2, R1, encrypted C1, network information, and access cloud platform address through Soft AP discovery or QR code scanning; in one possible implementation, the IoT device also obtains A1 through Soft AP discovery or QR code scanning.

[0334] For example, a connection based on a Soft AP is established between the distribution network terminal and the IoT device. The distribution network terminal sends the aforementioned ID2, R1, C1, network information, and access cloud platform address (optionally including A1) to the IoT device.

[0335] Alternatively, the distribution network terminal can generate and display a QR code based on the aforementioned ID2, R1, C1, network information, and access cloud platform address (optionally including A1). The IoT device can then scan the QR code to obtain information such as ID2, R1, C1, network information, and access cloud platform address (optionally including A1).

[0336] S814, the IoT device uses the locally stored K to encrypt R1 to obtain K2' (corresponding to the second encryption key mentioned above), and decrypts C1 through K2' to obtain K1' (corresponding to the second access key mentioned above).

[0337] S815: IoT devices use K1' as the key to establish a TLS / DTLS connection with the access cloud platform via PSK.

[0338] Optionally, when the IoT device obtains A1, the IoT device may also perform the following step S816.

[0339] S816: IoT devices use A1 as the key to establish a TLS / DTLS connection with the access cloud platform via PSK; and use K1' as the key to perform one-way or two-way challenge authentication with the access cloud platform.

[0340] In summary, in the scheme shown in the embodiments of this application, a device key is pre-set in both the IoT device and the device cloud platform. During the process of the IoT device initiating access to the access cloud platform, the access cloud platform can obtain a first access key, a first random number, and ciphertext obtained by encrypting the first random number with the device key through interaction with the device cloud platform. That is, after the access cloud platform provides the ciphertext and the first random number to the IoT device, the IoT device can obtain a second access key for access by combining the device key stored locally with the first random number and the ciphertext, and request access authentication from the access cloud platform through the second access key. In this process, the access cloud platform does not directly provide the access key to the IoT device, yet the IoT device can still correctly obtain the access key, ensuring security. At the same time, since no identity authentication of the IoT device is required in this process, the access authentication process can be simplified, thereby improving the efficiency of access authentication for IoT devices while ensuring the security of access authentication.

[0341] Figure 9 This application shows a structural block diagram of an IoT device access authentication apparatus provided in an exemplary embodiment. The apparatus can be used to access a cloud platform, becoming either an access cloud platform device or a part of an access cloud platform device. The apparatus includes:

[0342] The device information acquisition module 901 is used to acquire device information of IoT devices;

[0343] The first random number generation module 902 is used to generate a first random number;

[0344] The first random number sending module 903 is used to send the first random number to the device cloud platform according to the device information of the Internet of Things device;

[0345] The first access key receiving module 904 is used to receive a first access key generated by the device cloud platform using a device key and the first random number; the device key is set in the IoT device and the device cloud platform;

[0346] The first random number providing module 905 is used to provide the first random number to the Internet of Things device;

[0347] The authentication request receiving module 906 is used to receive the access authentication request sent by the IoT device. The access authentication request includes a second access key, which is generated by the IoT device based on the device key and the first random number.

[0348] The access authentication module 907 is used to perform access authentication on the IoT device based on the first access key and the second access key.

[0349] In one possible implementation, the device further includes:

[0350] The second random number acquisition module is used to acquire a second random number generated by the IoT device before the first random number sending module sends the first random number to the device cloud platform based on the device information of the IoT device.

[0351] The first random number sending module is used to send the first random number and the second random number to the device cloud platform according to the device information of the Internet of Things device;

[0352] The first access key receiving module is used to receive the first access key generated by the device cloud platform through encrypting the first random number and the second random number using the device key.

[0353] In one possible implementation, the device further includes:

[0354] The first device authentication information acquisition module is used to acquire first device authentication information before the first random number sending module sends the first random number and the second random number to the device cloud platform based on the device information of the IoT device. The first device authentication information is generated by the IoT device encrypting the second random number using the device key.

[0355] The first random number sending module is used to send the first random number, the second random number, and the first device authentication information to the device cloud platform based on the device information of the IoT device;

[0356] The first access key receiving module is used to receive the first access key, first cloud authentication information, and a third random number sent by the device cloud platform after the first device authentication information has been successfully authenticated based on the second device authentication information; the second device authentication information is generated by the device cloud platform by encrypting the second random number using the device key; the first cloud authentication information is generated by the device cloud platform by encrypting the second random number and the third random number using the device key; the third random number is generated by the device cloud platform.

[0357] The device further includes:

[0358] The first cloud authentication information providing module is used to provide the first cloud authentication information and the third random number to the IoT device before the authentication request receiving module receives the access authentication request sent by the IoT device.

[0359] The authentication request receiving module is used to receive the access authentication request sent by the IoT device after the IoT device has successfully authenticated the first cloud authentication information based on the second cloud authentication information; the second cloud authentication information is generated by the IoT device encrypting the second random number and the third random number using the device key.

[0360] In one possible implementation, the first access key receiving module is configured to receive the first access key, third cloud authentication information, third device authentication information, and a third random number sent by the device cloud platform; the third cloud authentication information is generated by the device cloud platform by encrypting the second random number using the device key; the third device authentication information is generated by the device cloud platform by encrypting the third random number; and the third random number is generated by the device cloud platform.

[0361] The device further includes:

[0362] The authentication information and random number providing module is used to provide the third cloud authentication information and the third random number to the IoT device before the authentication request receiving module receives the access authentication request sent by the IoT device;

[0363] The authentication request receiving module is used to receive the access authentication request sent by the IoT device after the IoT device has successfully authenticated the third cloud authentication information based on the fourth cloud authentication information; the fourth cloud authentication information is generated by the IoT device encrypting the second random number using the device key; the access authentication request also includes fourth device authentication information, which is generated by the IoT device encrypting the third random number using the device key;

[0364] The access authentication module is used to perform access authentication on the IoT device based on the first access key and the second access key after the fourth device authentication information is successfully authenticated based on the third device authentication information.

[0365] In one possible implementation, the access authentication module is used to establish data connection authentication for the IoT device using the TLS / DTLS pre-shared key (PSK) method based on the first access key and the second access key.

[0366] In one possible implementation, the device further includes:

[0367] The device registration code generation module is used to generate a device registration code before the authentication request receiving module receives the access authentication request sent by the IoT device;

[0368] A device registration code providing module is used to provide the device registration code to the IoT device;

[0369] The authentication request receiving module is used to receive the access authentication request carrying the device registration code;

[0370] The access authentication module is used for,

[0371] Based on the device registration code carried in the access authentication request, a secure data connection is established with the IoT device using the TLS / DTLS pre-shared key PSK method;

[0372] One-way or two-way challenge authentication is performed based on the first access key and the second access key.

[0373] In one possible implementation, the access authentication module is used for:

[0374] Establish a secure data connection with the IoT device using TLS / DTLS anonymous method;

[0375] One-way or two-way challenge authentication is performed based on the first access key and the second access key.

[0376] In one possible implementation, the device further includes:

[0377] The access authentication identifier generation module is used to generate the access authentication identifier of the IoT device before the authentication request receiving module receives the access authentication request sent by the IoT device.

[0378] The association establishment module is used to establish the association between the access authentication identifier and the first access key;

[0379] An access authentication identifier providing module is used to provide the access authentication identifier to the IoT device;

[0380] The authentication request receiving module is used to receive the access authentication request carrying the access authentication identifier;

[0381] The access authentication module is used for,

[0382] The first access key is obtained by querying the association relationship based on the access authentication identifier carried in the access authentication request;

[0383] The IoT device is authenticated based on the first access key and the second access key obtained from the query.

[0384] Figure 10This application illustrates a structural block diagram of an IoT device access authentication apparatus provided in an exemplary embodiment. The apparatus can be used in an IoT device to become an IoT device, or to become part of an IoT device. The apparatus includes:

[0385] Device information providing module 1001 is used to provide device information of the IoT device to the cloud platform;

[0386] The first random number acquisition module 1002 is used to acquire a first random number provided by the access cloud platform. The first random number is generated by the access cloud platform and is provided by the device cloud platform of the Internet of Things device after obtaining the device key and the first access key generated by the first random number. The device key is set in the Internet of Things device and the device cloud platform.

[0387] The second access key generation module 1003 is used to generate a second access key based on the device key and the first random number.

[0388] The authentication request sending module 1004 is used to send an access authentication request containing the second access key to the access cloud platform. The access authentication request is used to request the access cloud platform to perform access authentication on the IoT device based on the first access key and the second access key.

[0389] In one possible implementation, the device further includes:

[0390] The second random number generation module is used to generate a second random number before the first random number acquisition module acquires the first random number provided by the access cloud platform;

[0391] The second random number providing module is used to provide the second random number to the access cloud platform;

[0392] The second access key generation module is used to encrypt the first random number and the second random number using the device key to generate the second access key.

[0393] In one possible implementation, the device further includes:

[0394] The first device authentication information generation module is used to obtain a first random number provided by the access cloud platform, encrypt the second random number with the device key, and generate the first device authentication information;

[0395] The first device authentication information providing module is used to provide the first device authentication information to the access cloud platform;

[0396] The first cloud authentication information and third random number acquisition module is used to acquire the first cloud authentication information and third random number provided by the access cloud platform before the second access key generation module generates the second access key based on the device key and the first random number; the third random number is generated by the device cloud platform; the first cloud authentication information is generated by the device cloud platform after the first device authentication information is authenticated based on the second device authentication information, and then the device cloud platform encrypts the second random number and the third random number using the device key; the second device authentication information is generated by the device cloud platform encrypting the second random number using the device key.

[0397] The second access key generation module is used for,

[0398] The second random number and the third random number are encrypted using the device key to generate the second cloud authentication information;

[0399] After the first cloud authentication information is authenticated based on the second cloud authentication information, the second access key is generated based on the device key and the first random number.

[0400] In one possible implementation, the device further includes:

[0401] The authentication information and random number acquisition module is used to acquire third cloud authentication information and a third random number provided by the access cloud platform before the second access key generation module generates the second access key based on the device key and the first random number; the third cloud authentication information is generated by the device cloud platform by encrypting the second random number using the device key; the third random number is generated by the device cloud platform.

[0402] The second access key generation module is used for,

[0403] The second random number is encrypted using the device key to generate the fourth cloud authentication information;

[0404] After the third cloud authentication information is successfully authenticated based on the fourth cloud authentication information, the second access key is generated based on the device key and the first random number.

[0405] The device further includes:

[0406] The fourth device authentication information generation module is used to encrypt the third random number using the device key to generate the fourth device authentication information;

[0407] The authentication request sending module is used to send an access authentication request containing the second access key and the fourth device authentication information to the access cloud platform.

[0408] In one possible implementation, the device further includes:

[0409] The device registration code acquisition module is used to acquire the device registration code provided by the access cloud platform before the authentication request sending module sends an access authentication request containing the second access key to the access cloud platform;

[0410] The authentication request sending module is used to send the access authentication request, which includes the second access key and the device registration code, to the access cloud platform.

[0411] In one possible implementation, the device further includes:

[0412] The access authentication identifier acquisition module is used to acquire the access authentication identifier of the IoT device provided by the access cloud platform before the authentication request sending module sends an access authentication request containing the second access key to the access cloud platform;

[0413] The authentication request sending module is used to send the access authentication request, which includes the second access key and the access authentication identifier, to the access cloud platform.

[0414] Figure 11 This application illustrates a structural block diagram of an IoT device access authentication apparatus provided in an exemplary embodiment. The apparatus can be used to access a cloud platform, becoming either an access cloud platform device or a part of an access cloud platform device. The apparatus includes:

[0415] Device information acquisition module 1101 is used to acquire device information of IoT devices;

[0416] Random number and key generation module 1102 is used to generate a first random number and a first access key;

[0417] The first random number sending module 1103 is used to send the first random number to the device cloud platform corresponding to the IoT device based on the device information of the IoT device.

[0418] The first encryption key receiving module 1104 is used to receive the first encryption key generated by the device cloud platform through encrypting the first random number using the device key;

[0419] The encrypted ciphertext acquisition module 1105 is used to encrypt the first access key using the first encryption key to obtain encrypted ciphertext;

[0420] The ciphertext and random number providing module 1106 is used to provide the encrypted ciphertext and the first random number to the Internet of Things device;

[0421] The authentication request receiving module 1107 is used to receive the access authentication request sent by the IoT device. The access authentication request includes a second access key, which is generated by the IoT device based on the device key, the encrypted ciphertext, and the first random number.

[0422] The access authentication module 1108 is used to perform access authentication on the IoT device based on the first access key and the second access key.

[0423] In one possible implementation, the access authentication module is used to establish data connection authentication for the IoT device using the TLS / DTLS pre-shared key (PSK) method based on the first access key and the second access key.

[0424] In one possible implementation, the device further includes:

[0425] The device registration code generation module is used to generate a device registration code before the authentication request receiving module receives the access authentication request sent by the IoT device;

[0426] A device registration code providing module is used to provide the device registration code to the IoT device;

[0427] The authentication request receiving module is used to receive the access authentication request carrying the device registration code;

[0428] The access authentication module is used for,

[0429] Based on the device registration code carried in the access authentication request, a secure data connection is established with the IoT device using the TLS / DTLS pre-shared key PSK method;

[0430] One-way or two-way challenge authentication is performed based on the first access key and the second access key.

[0431] In one possible implementation, the access authentication module is used for:

[0432] Establish a secure data connection with the IoT device using TLS / DTLS anonymous method;

[0433] One-way or two-way challenge authentication is performed based on the first access key and the second access key.

[0434] In one possible implementation, the device further includes:

[0435] The access authentication identifier generation module is used to generate the access authentication identifier of the IoT device before the authentication request receiving module receives the access authentication request sent by the IoT device.

[0436] The association establishment module is used to establish the association between the access authentication identifier and the first access key;

[0437] An access authentication identifier providing module is used to provide the access authentication identifier to the IoT device;

[0438] The authentication request receiving module is used to receive the access authentication request carrying the access authentication identifier;

[0439] The access authentication module is used for,

[0440] The first access key is obtained by querying the association relationship based on the access authentication identifier carried in the access authentication request;

[0441] The IoT device is authenticated based on the first access key and the second access key obtained from the query.

[0442] Figure 12 This application illustrates a structural block diagram of an IoT device access authentication apparatus provided in an exemplary embodiment. The apparatus can be used in an IoT device to become an IoT device, or to become part of an IoT device. The apparatus includes:

[0443] Device information providing module 1201 is used to provide device information of the IoT device to the access cloud platform;

[0444] The ciphertext and random number acquisition module 1202 is used to acquire the encrypted ciphertext provided by the access cloud platform and the first random number generated by the access cloud platform; the encrypted ciphertext is the encrypted ciphertext obtained by the access cloud platform encrypting the first access key with the first encryption key; the first encryption key is the key generated by the device cloud platform of the IoT device encrypting the first random number with the device key; the device key is set in the IoT device and the device cloud platform.

[0445] The second encryption key generation module 1203 is used to encrypt the first random number using the device key to generate the second encryption key;

[0446] The second access key acquisition module 1204 is used to decrypt the encrypted ciphertext using the second encryption key to obtain the second access key;

[0447] The authentication request sending module 1205 is used to send an access authentication request containing the second access key to the access cloud platform. The access authentication request is used to request the access cloud platform to perform access authentication on the IoT device based on the first access key and the second access key.

[0448] In one possible implementation, the device further includes:

[0449] The device registration code acquisition module is used to acquire the device registration code provided by the access cloud platform before the authentication request sending module sends an access authentication request containing the second access key to the access cloud platform;

[0450] The authentication request sending module is used to send the access authentication request, which includes the second access key and the device registration code, to the access cloud platform.

[0451] In one possible implementation, the device further includes:

[0452] The access authentication identifier acquisition module is used to acquire the access authentication identifier of the IoT device provided by the access cloud platform before the authentication request sending module sends an access authentication request containing the second access key to the access cloud platform;

[0453] The authentication request sending module is used to send the access authentication request, which includes the second access key and the access authentication identifier, to the access cloud platform.

[0454] It should be noted that the above embodiments only illustrate the division of the above functional modules when implementing the device. In actual applications, the above functions can be assigned to different functional modules according to actual needs, that is, the content structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0455] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0456] Figure 13 This illustration shows a schematic diagram of the structure of a computer device (such as an Internet of Things device, a cloud access platform device, or a device platform cloud) provided in an exemplary embodiment of this application. The computer device includes: a processor 131, a receiver 132, a transmitter 133, a memory 134, and a bus 135.

[0457] The processor 131 includes one or more processing cores. The processor 131 executes various functional applications and information processing by running software programs and modules.

[0458] The receiver 132 and the transmitter 133 can be implemented as a communication component, which can be a communication chip.

[0459] The memory 134 is connected to the processor 131 via the bus 135.

[0460] The memory 134 can be used to store at least one instruction, and the processor 131 can execute the at least one instruction to implement the various steps in the above method embodiments.

[0461] Furthermore, the memory 134 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, including but not limited to: magnetic disks or optical disks, electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), static random access memory (SRAM), read-only memory (ROM), magnetic storage, flash memory, and programmable read-only memory (PROM).

[0462] In an exemplary embodiment, the computer device includes a processor, a memory, and a transceiver (the transceiver may include a receiver and a transmitter, the receiver being used to receive information and the transmitter being used to send information).

[0463] In one possible implementation, when the computer device is implemented as a cloud platform access device,

[0464] The processor is used to acquire device information of IoT devices and generate a first random number;

[0465] The transceiver is configured to send the first random number to the device cloud platform based on the device information of the IoT device; and receive a first access key generated by the device cloud platform using the device key and the first random number; the device key is set in the IoT device and the device cloud platform.

[0466] The processor is used to provide the first random number to the Internet of Things device;

[0467] The transceiver is used to receive an access authentication request sent by the IoT device. The access authentication request includes a second access key, which is generated by the IoT device based on the device key and the first random number.

[0468] The processor is configured to perform access authentication on the IoT device based on the first access key and the second access key.

[0469] In one possible implementation, when the computer device is implemented as an Internet of Things (IoT) device,

[0470] The processor is configured to provide device information of the IoT device to the access cloud platform; obtain a first random number provided by the access cloud platform, wherein the first random number is generated by the access cloud platform and is provided by the device cloud platform after obtaining the device key of the IoT device and a first access key generated by the first random number; the device key is set in the IoT device and the device cloud platform.

[0471] The processor is configured to generate a second access key based on the device key and the first random number;

[0472] The transceiver is used to send an access authentication request containing the second access key to the access cloud platform. The access authentication request is used to request the access cloud platform to perform access authentication on the IoT device based on the first access key and the second access key.

[0473] In one possible implementation, when the computer device is implemented as a cloud platform access device,

[0474] The processor is used to acquire device information of IoT devices; generate a first random number and a first access key;

[0475] The transceiver is configured to send the first random number to the device cloud platform corresponding to the IoT device based on the device information of the IoT device; and receive a first encryption key generated by the device cloud platform by encrypting the first random number using the device key.

[0476] The processor is configured to encrypt the first access key using the first encryption key to obtain encrypted ciphertext; and provide the encrypted ciphertext and the first random number to the Internet of Things device.

[0477] The transceiver is used to receive an access authentication request sent by the IoT device. The access authentication request includes a second access key, which is generated by the IoT device based on the device key, the encrypted ciphertext, and the first random number.

[0478] The processor is configured to perform access authentication on the IoT device based on the first access key and the second access key.

[0479] In one possible implementation, when the computer device is implemented as an Internet of Things (IoT) device,

[0480] The processor is configured to provide device information of the IoT device to the access cloud platform; obtain encrypted ciphertext provided by the access cloud platform and a first random number generated by the access cloud platform; the encrypted ciphertext is encrypted ciphertext obtained by the access cloud platform encrypting a first access key using a first encryption key; the first encryption key is a key generated by the device cloud platform of the IoT device encrypting the first random number using a device key; the device key is set in the IoT device and the device cloud platform;

[0481] The processor is configured to encrypt a first random number using a device key to generate a second encryption key; and to decrypt the encrypted ciphertext using the second encryption key to obtain a second access key.

[0482] The transceiver is used to send an access authentication request containing the second access key to the access cloud platform. The access authentication request is used to request the access cloud platform to perform access authentication on the IoT device based on the first access key and the second access key.

[0483] When the computer device is implemented as an access platform cloud or IoT device, the processor and transceiver in the computer device involved in the embodiments of this application can perform the above-mentioned functions. Figures 2 to 8 The steps performed by the access platform cloud or IoT device in any of the methods shown will not be described in detail here.

[0484] In an exemplary embodiment, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer program, which is loaded and executed by a processor to implement the Internet of Things device access authentication method executed by a computer device provided in the above-described method embodiments.

[0485] In an exemplary embodiment, a computer program product is also provided, which, when run on the processor of a computer device, causes a network device to perform the IoT device access authentication method described above.

[0486] In an exemplary embodiment, a chip is also provided, the chip including programmable logic circuits and / or program instructions, which, when the chip is run on a computer device, are used to implement the IoT device access authentication method described above.

[0487] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for authenticating Internet of Things (IoT) device access, characterized in that, The method is executed by the access cloud platform, and the method includes: Obtain device information for IoT devices; Generate the first random number; Based on the device information of the IoT device, send the first random number to the device cloud platform; The device cloud platform receives a first access key generated by the device key and the first random number; the device key is set in the IoT device and the device cloud platform. The first random number is provided to the IoT device; The system receives an access authentication request sent by the IoT device, the access authentication request containing a second access key, which is generated by the IoT device based on the device key and the first random number. The IoT device is authenticated based on the first access key and the second access key. Before sending the first random number to the device cloud platform based on the device information of the IoT device, the process includes: Obtain the second random number generated by the IoT device; Sending the first random number to the device cloud platform based on the device information of the IoT device includes: Based on the device information of the IoT device, send the first random number and the second random number to the device cloud platform; The step of receiving the first access key generated by the device cloud platform using the device key and the first random number includes: The device cloud platform receives the first access key generated by encrypting the first random number and the second random number using the device key; Before sending the first random number and the second random number to the device cloud platform based on the device information of the IoT device, the method further includes: Obtain first device authentication information, wherein the first device authentication information is generated by the IoT device encrypting the second random number using the device key; The step of sending the first random number and the second random number to the device cloud platform based on the device information of the IoT device includes: Based on the device information of the IoT device, the first random number, the second random number, and the first device authentication information are sent to the device cloud platform. The step of receiving the first access key generated by the device cloud platform through encrypting the first random number and the second random number using the device key includes: The device receives the first access key, first cloud authentication information, and a third random number sent by the device cloud platform after the first device authentication information has been successfully authenticated based on the second device authentication information; the second device authentication information is generated by the device cloud platform by encrypting the second random number using the device key; the first cloud authentication information is generated by the device cloud platform by encrypting the second random number and the third random number using the device key; the third random number is generated by the device cloud platform. Before receiving the access authentication request sent by the IoT device, the method further includes: The first cloud authentication information and the third random number are provided to the IoT device; The receiving of the access authentication request sent by the IoT device includes: The system receives the access authentication request sent by the IoT device after it has successfully authenticated the first cloud authentication information based on the second cloud authentication information; the second cloud authentication information is generated by the IoT device encrypting the second random number and the third random number using the device key.

2. The method according to claim 1, characterized in that, The step of receiving the first access key generated by the device cloud platform through encrypting the first random number and the second random number using the device key further includes: The device receives a first access key, a third cloud authentication information, a third device authentication information, and a third random number sent by the device cloud platform; the third cloud authentication information is generated by the device cloud platform by encrypting the second random number using the device key; the third device authentication information is generated by the device cloud platform by encrypting the third random number; the third random number is generated by the device cloud platform. Before receiving the access authentication request sent by the IoT device, the method further includes: The third cloud authentication information and the third random number are provided to the IoT device; The receiving of the access authentication request sent by the IoT device includes: The system receives an access authentication request sent by the IoT device after it has successfully authenticated the third cloud authentication information based on the fourth cloud authentication information; the fourth cloud authentication information is generated by the IoT device encrypting the second random number using the device key; the access authentication request also includes fourth device authentication information, which is generated by the IoT device encrypting the third random number using the device key; The step of authenticating the IoT device based on the first access key and the second access key includes: After the fourth device authentication information is successfully authenticated based on the third device authentication information, the IoT device is access authenticated based on the first access key and the second access key.

3. The method according to any one of claims 1 to 2, characterized in that, The step of authenticating the IoT device based on the first access key and the second access key includes: Based on the first access key and the second access key, the IoT device is authenticated by establishing a data connection using the TLS / DTLS pre-shared key (PSK) method.

4. The method according to any one of claims 1 to 2, characterized in that, Before receiving the access authentication request sent by the IoT device, the method further includes: Generate device registration code; Provide the device registration code to the IoT device; The receiving of the access authentication request sent by the IoT device includes: Receive the access authentication request carrying the device registration code; The step of authenticating the IoT device based on the first access key and the second access key includes: Based on the device registration code carried in the access authentication request, a secure data connection is established with the IoT device using the TLS / DTLS pre-shared key PSK method; One-way or two-way challenge authentication is performed based on the first access key and the second access key.

5. The method according to any one of claims 1 to 2, characterized in that, The step of authenticating the IoT device based on the first access key and the second access key includes: Establish a secure data connection with the IoT device using TLS / DTLS anonymous method; One-way or two-way challenge authentication is performed based on the first access key and the second access key.

6. The method according to any one of claims 1 to 2, characterized in that, Before receiving the access authentication request sent by the IoT device, the method further includes: Generate the access authentication identifier for the IoT device; Establish the association between the access authentication identifier and the first access key; Provide the access authentication identifier to the IoT device; The receiving of the access authentication request sent by the IoT device includes: Receive the access authentication request carrying the access authentication identifier; The step of authenticating the IoT device based on the first access key and the second access key includes: The first access key is obtained by querying the association relationship based on the access authentication identifier carried in the access authentication request; The IoT device is authenticated based on the first access key and the second access key obtained from the query.

7. A method for authenticating access to Internet of Things (IoT) devices, characterized in that, The method is executed by an Internet of Things (IoT) device, and the method includes: Provide the device information of the IoT devices to the cloud platform; Obtain a first random number provided by the access cloud platform. The first random number is generated by the access cloud platform and is provided by the device cloud platform of the IoT device after obtaining the device key and the first access key generated by the first random number. The device key is set in the IoT device and the device cloud platform. A second access key is generated based on the device key and the first random number; Send an access authentication request containing the second access key to the access cloud platform. The access authentication request is used to request the access cloud platform to perform access authentication for the IoT device based on the first access key and the second access key. Before obtaining the first random number provided by the access cloud platform, the method further includes: Generate a second random number; Provide the second random number to the access cloud platform; The step of generating a second access key based on the device key and the first random number includes: The first random number and the second random number are encrypted using the device key to generate the second access key; Before obtaining the first random number provided by the access cloud platform, the method further includes: The second random number is encrypted using the device key to generate the first device authentication information; Provide the first device authentication information to the access cloud platform; Before generating the second access key based on the device key and the first random number, the method further includes: The system obtains first cloud authentication information and a third random number provided by the access cloud platform; the third random number is generated by the device cloud platform; the first cloud authentication information is generated by the device cloud platform after authenticating the first device authentication information according to the second device authentication information, and then encrypting the second random number and the third random number using the device key; the second device authentication information is generated by the device cloud platform by encrypting the second random number using the device key. The step of generating a second access key based on the device key and the first random number includes: The second random number and the third random number are encrypted using the device key to generate the second cloud authentication information; After the first cloud authentication information is authenticated based on the second cloud authentication information, the second access key is generated based on the device key and the first random number.

8. The method according to claim 7, characterized in that, Before generating the second access key based on the device key and the first random number, the method further includes: Obtain third cloud authentication information and a third random number provided by the access cloud platform; the third cloud authentication information is generated by the device cloud platform by encrypting the second random number using the device key; the third random number is generated by the device cloud platform. The step of generating a second access key based on the device key and the first random number includes: The second random number is encrypted using the device key to generate the fourth cloud authentication information; After the third cloud authentication information is successfully authenticated based on the fourth cloud authentication information, the second access key is generated based on the device key and the first random number. The method further includes: The third random number is encrypted using the device key to generate the fourth device authentication information; Sending an access authentication request containing the second access key to the access cloud platform includes: Send the access authentication request, which includes the second access key and the fourth device authentication information, to the access cloud platform.

9. The method according to any one of claims 7 to 8, characterized in that, Before sending the access authentication request containing the second access key to the access cloud platform, the method further includes: Obtain the device registration code provided by the access cloud platform; Sending an access authentication request containing the second access key to the access cloud platform includes: Send the access authentication request, which includes the second access key and the device registration code, to the access cloud platform.

10. The method according to any one of claims 7 to 8, characterized in that, Before sending the access authentication request containing the second access key to the access cloud platform, the method further includes: Obtain the access authentication identifier of the IoT device provided by the access cloud platform; Sending an access authentication request containing the second access key to the access cloud platform includes: Send the access authentication request, which includes the second access key and the access authentication identifier, to the access cloud platform.

11. An Internet of Things (IoT) device access authentication device, characterized in that, The device is used to access a cloud platform, and the device includes: The device information acquisition module is used to acquire device information of IoT devices; The first random number generation module is used to generate the first random number. The first random number sending module is used to send the first random number to the device cloud platform based on the device information of the Internet of Things device; The first access key receiving module is used to receive a first access key generated by the device cloud platform using a device key and the first random number; the device key is set in the IoT device and the device cloud platform; A first random number providing module is used to provide the first random number to the Internet of Things device; An authentication request receiving module is configured to receive an access authentication request sent by the IoT device, wherein the access authentication request includes a second access key, which is generated by the IoT device based on the device key and the first random number; An access authentication module is used to perform access authentication on the IoT device based on the first access key and the second access key; The device further includes: The second random number acquisition module is used to acquire a second random number generated by the IoT device before the first random number sending module sends the first random number to the device cloud platform based on the device information of the IoT device. The first random number sending module is used to send the first random number and the second random number to the device cloud platform according to the device information of the Internet of Things device; The first access key receiving module is used to receive the first access key generated by the device cloud platform through encrypting the first random number and the second random number using the device key; The device further includes: The first device authentication information acquisition module is used to acquire first device authentication information before the first random number sending module sends the first random number and the second random number to the device cloud platform based on the device information of the IoT device. The first device authentication information is generated by the IoT device encrypting the second random number using the device key. The first random number sending module is used to send the first random number, the second random number, and the first device authentication information to the device cloud platform based on the device information of the IoT device; The first access key receiving module is used to receive the first access key, first cloud authentication information, and a third random number sent by the device cloud platform after the first device authentication information has been successfully authenticated based on the second device authentication information; the second device authentication information is generated by the device cloud platform by encrypting the second random number using the device key; the first cloud authentication information is generated by the device cloud platform by encrypting the second random number and the third random number using the device key; the third random number is generated by the device cloud platform. The device further includes: The first cloud authentication information providing module is used to provide the first cloud authentication information and the third random number to the IoT device before the authentication request receiving module receives the access authentication request sent by the IoT device. The authentication request receiving module is used to receive the access authentication request sent by the IoT device after the IoT device has successfully authenticated the first cloud authentication information based on the second cloud authentication information; the second cloud authentication information is generated by the IoT device encrypting the second random number and the third random number using the device key.

12. The apparatus according to claim 11, characterized in that, The first access key receiving module is used to receive the first access key, third cloud authentication information, third device authentication information, and third random number sent by the device cloud platform; the third cloud authentication information is generated by the device cloud platform encrypting the second random number using the device key; The third device authentication information is generated by the device cloud platform through encryption using the third random number; The third random number is generated by the device cloud platform; The device further includes: The authentication information and random number providing module is used to provide the third cloud authentication information and the third random number to the IoT device before the authentication request receiving module receives the access authentication request sent by the IoT device; The authentication request receiving module is used to receive the access authentication request sent by the IoT device after the IoT device has successfully authenticated the third cloud authentication information based on the fourth cloud authentication information; the fourth cloud authentication information is generated by the IoT device encrypting the second random number using the device key; the access authentication request also includes fourth device authentication information, which is generated by the IoT device encrypting the third random number using the device key; The access authentication module is used to perform access authentication on the IoT device based on the first access key and the second access key after the fourth device authentication information is successfully authenticated based on the third device authentication information.

13. The apparatus according to any one of claims 11 to 12, characterized in that, The access authentication module is used to establish data connection authentication for the IoT device using the TLS / DTLS pre-shared key (PSK) method based on the first access key and the second access key.

14. The apparatus according to any one of claims 11 to 12, characterized in that, The device further includes: The device registration code generation module is used to generate a device registration code before the authentication request receiving module receives the access authentication request sent by the IoT device; A device registration code providing module is used to provide the device registration code to the IoT device; The authentication request receiving module is used to receive the access authentication request carrying the device registration code; The access authentication module is used for, Based on the device registration code carried in the access authentication request, a secure data connection is established with the IoT device using the TLS / DTLS pre-shared key PSK method; One-way or two-way challenge authentication is performed based on the first access key and the second access key.

15. The apparatus according to any one of claims 11 to 12, characterized in that, The access authentication module is used for, Establish a secure data connection with the IoT device using TLS / DTLS anonymous method; One-way or two-way challenge authentication is performed based on the first access key and the second access key.

16. The apparatus according to any one of claims 11 to 12, characterized in that, The device further includes: The access authentication identifier generation module is used to generate the access authentication identifier of the IoT device before the authentication request receiving module receives the access authentication request sent by the IoT device. The association establishment module is used to establish the association between the access authentication identifier and the first access key; An access authentication identifier providing module is used to provide the access authentication identifier to the IoT device; The authentication request receiving module is used to receive the access authentication request carrying the access authentication identifier; The access authentication module is used for, The first access key is obtained by querying the association relationship based on the access authentication identifier carried in the access authentication request; The IoT device is authenticated based on the first access key and the second access key obtained from the query.

17. An Internet of Things (IoT) device access authentication device, characterized in that, The device is used in an Internet of Things (IoT) device, and the device includes: The device information providing module is used to provide device information of the IoT devices to the cloud platform. The first random number acquisition module is used to acquire a first random number provided by the access cloud platform. The first random number is generated by the access cloud platform and is provided by the device cloud platform of the IoT device after obtaining the device key and the first access key generated by the first random number. The device key is set in the IoT device and the device cloud platform. The second access key generation module is used to generate a second access key based on the device key and the first random number. An authentication request sending module is used to send an access authentication request containing the second access key to the access cloud platform. The access authentication request is used to request the access cloud platform to perform access authentication on the IoT device based on the first access key and the second access key. The device further includes: The second random number generation module is used to generate a second random number before the first random number acquisition module acquires the first random number provided by the access cloud platform; The second random number providing module is used to provide the second random number to the access cloud platform; The second access key generation module is used to encrypt the first random number and the second random number using the device key to generate the second access key; The device further includes: The first device authentication information generation module is used to obtain a first random number provided by the access cloud platform, encrypt the second random number with the device key, and generate the first device authentication information; The first device authentication information providing module is used to provide the first device authentication information to the access cloud platform; The first cloud authentication information and third random number acquisition module is used to acquire the first cloud authentication information and third random number provided by the access cloud platform before the second access key generation module generates the second access key based on the device key and the first random number; the third random number is generated by the device cloud platform; the first cloud authentication information is generated by the device cloud platform after the first device authentication information is authenticated based on the second device authentication information, and then the device cloud platform encrypts the second random number and the third random number using the device key; the second device authentication information is generated by the device cloud platform encrypting the second random number using the device key. The second access key generation module is used for, The second random number and the third random number are encrypted using the device key to generate the second cloud authentication information; After the first cloud authentication information is authenticated based on the second cloud authentication information, the second access key is generated based on the device key and the first random number.

18. The apparatus according to claim 17, characterized in that, The device further includes: The authentication information and random number acquisition module is used to acquire third cloud authentication information and a third random number provided by the access cloud platform before the second access key generation module generates the second access key based on the device key and the first random number; the third cloud authentication information is generated by the device cloud platform by encrypting the second random number using the device key; the third random number is generated by the device cloud platform. The second access key generation module is used for, The second random number is encrypted using the device key to generate the fourth cloud authentication information; After the third cloud authentication information is successfully authenticated based on the fourth cloud authentication information, the second access key is generated based on the device key and the first random number. The device further includes: The fourth device authentication information generation module is used to encrypt the third random number using the device key to generate the fourth device authentication information; The authentication request sending module is used to send an access authentication request containing the second access key and the fourth device authentication information to the access cloud platform.

19. The apparatus according to any one of claims 17 to 18, characterized in that, The device further includes: The device registration code acquisition module is used to acquire the device registration code provided by the access cloud platform before the authentication request sending module sends an access authentication request containing the second access key to the access cloud platform; The authentication request sending module is used to send the access authentication request, which includes the second access key and the device registration code, to the access cloud platform.

20. The apparatus according to any one of claims 17 to 18, characterized in that, The device further includes: The access authentication identifier acquisition module is used to acquire the access authentication identifier of the IoT device provided by the access cloud platform before the authentication request sending module sends an access authentication request containing the second access key to the access cloud platform; The authentication request sending module is used to send the access authentication request, which includes the second access key and the access authentication identifier, to the access cloud platform.

21. A device for accessing a cloud platform, characterized in that, The cloud platform access device includes: a processor and a transceiver connected to the processor; wherein, The processor is used to acquire device information of IoT devices and generate a first random number; The transceiver is configured to send the first random number to the device cloud platform based on the device information of the IoT device; and receive a first access key generated by the device cloud platform using the device key and the first random number; the device key is set in the IoT device and the device cloud platform. The processor is configured to provide the first random number to the Internet of Things device; The transceiver is used to receive an access authentication request sent by the IoT device. The access authentication request includes a second access key, which is generated by the IoT device based on the device key and the first random number. The processor is configured to perform access authentication on the IoT device based on the first access key and the second access key; The transceiver is further configured to obtain a second random number generated by the IoT device before the first random number sending module sends the first random number to the device cloud platform based on the device information of the IoT device; The transceiver is further configured to send the first random number and the second random number to the device cloud platform based on the device information of the IoT device; The processor is further configured to receive the first access key generated by the device cloud platform through encrypting the first random number and the second random number using the device key; The transceiver is further configured to obtain first device authentication information before the first random number sending module sends the first random number and the second random number to the device cloud platform based on the device information of the IoT device. The first device authentication information is generated by the IoT device encrypting the second random number using the device key. The transceiver is further configured to send the first random number, the second random number, and the first device authentication information to the device cloud platform based on the device information of the IoT device; and to receive the first access key, the first cloud authentication information, and the third random number sent by the device cloud platform after the first device authentication information has been successfully authenticated based on the second device authentication information; the second device authentication information is generated by the device cloud platform by encrypting the second random number using the device key; the first cloud authentication information is generated by the device cloud platform by encrypting the second random number and the third random number using the device key; the third random number is generated by the device cloud platform; and to provide the first cloud authentication information and the third random number to the IoT device before the authentication request receiving module receives the access authentication request sent by the IoT device; and to receive the access authentication request sent by the IoT device after the first cloud authentication information has been successfully authenticated based on the second cloud authentication information; the second cloud authentication information is generated by the IoT device by encrypting the second random number and the third random number using the device key.

22. An Internet of Things (IoT) device, characterized in that, The IoT device includes: a processor and a transceiver connected to the processor; wherein, The processor is configured to provide device information of the IoT device to the access cloud platform; obtain a first random number provided by the access cloud platform, wherein the first random number is generated by the access cloud platform and is provided by the device cloud platform after obtaining the device key of the IoT device and a first access key generated by the first random number; the device key is set in the IoT device and the device cloud platform. The processor is configured to generate a second access key based on the device key and the first random number; The transceiver is used to send an access authentication request containing the second access key to the access cloud platform. The access authentication request is used to request the access cloud platform to perform access authentication on the IoT device based on the first access key and the second access key. The processor is further configured to generate a second random number before the first random number acquisition module acquires the first random number provided by the access cloud platform; The transceiver is also used to provide the second random number to the access cloud platform; The processor is further configured to encrypt the first random number and the second random number using the device key to generate the second access key, and to obtain the first random number provided by the access cloud platform and encrypt the second random number using the device key to generate first device authentication information; The transceiver is further configured to provide the first device authentication information to the access cloud platform, and to obtain the first cloud authentication information and a third random number provided by the access cloud platform before the second access key generation module generates the second access key based on the device key and the first random number; the third random number is generated by the device cloud platform; the first cloud authentication information is generated by the device cloud platform after authenticating the first device authentication information based on the second device authentication information, by encrypting the second random number and the third random number using the device key; the second device authentication information is generated by the device cloud platform by encrypting the second random number using the device key. The processor is further configured to encrypt the second random number and the third random number using the device key to generate second cloud authentication information, and after authenticating the first cloud authentication information based on the second cloud authentication information, generate the second access key based on the device key and the first random number.

23. A computer-readable storage medium, characterized in that, The readable storage medium stores a computer program, which is loaded and executed by a processor to implement the Internet of Things device access authentication method as described in any one of claims 1 to 10.

Images