Iot security authentication method, device, system, equipment and medium

Abstract

The application discloses an Internet of Things security authentication method, device and system, electronic equipment and a readable storage medium, and is applied to the technical field of Internet of Things. The method comprises the following steps: determining a target security authentication mode matched with a sensor to be authenticated according to a performance parameter of the sensor to be authenticated in an Internet of Things perception layer; calling a data verification model to perform data verification on target authentication data uploaded by the sensor to be authenticated and matched with the target security authentication mode when the target security authentication mode is verified; obtaining an association verification result of the sensor to be authenticated by analyzing the target authentication data, the data verification model and target data of a sensor associated with the sensor to be authenticated; and determining an authentication result of the sensor to be authenticated by an Internet of Things gateway according to the association verification result and a data verification result, so that the security authentication of each sensor by the Internet of Things gateway in the Internet of Things perception layer can be realized.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) technology, and in particular to an IoT security authentication method, apparatus, electronic device, and readable storage medium. Background Technology

[0002] The Internet of Things (IoT) is an information carrier based on the Internet and traditional telecommunications networks. It enables all ordinary physical objects that can be independently addressed to form an interconnected network. Specifically, it uses various information sensors, RFID technology, GPS, infrared sensors, laser scanners, and other devices and related technologies to collect data in real time on objects or processes that need to be monitored, connected, and interacted with. This data includes, but is not limited to, sound, light, heat, electricity, mechanics, chemical information, biological information, and location information. Then, through various possible network access methods, it ultimately achieves ubiquitous connectivity between things and between things and people, enabling intelligent perception, identification, and management of objects and processes. The IoT consists of a bottom-up structure: a perception layer, a network layer, and an application layer. The perception layer, located at the bottom of the three-layer structure, includes QR code tags and readers, cameras, sensors, and sensor gateways. Its function is "sensing," that is, acquiring environmental information through sensor networks. Sensors are the main devices for acquiring information in the IoT, including, but not limited to, temperature, humidity, pressure, and photoelectric sensors. They use various mechanisms to convert the measured data into electrical signals, which are then processed by corresponding signal processing devices to generate response actions.

[0003] The security of the Internet of Things (IoT) is crucial to its long-term development, and the authentication of hardware devices in the IoT's sensing layer is a vital part of ensuring IoT security, effectively addressing the security issues of IoT terminals. While the publicly disclosed security mechanisms in related technologies are highly complex and energy-intensive, the sheer number of sensors in the IoT's sensing layer, their varying performance characteristics, diverse authentication methods, and the limitations imposed by the energy constraints of terminal nodes mean that existing security mechanisms are not applicable to the security authentication of the IoT's sensing layer.

[0004] Therefore, implementing secure authentication of each sensor by the IoT gateway in the IoT sensing layer is a technical problem that needs to be solved by professionals in this field. Summary of the Invention

[0005] This application provides an IoT security authentication method, apparatus, system, electronic device, and readable storage medium, which can enable IoT gateways in the IoT sensing layer to perform security authentication on various sensors.

[0006] To address the aforementioned technical problems, the embodiments of the present invention provide the following technical solutions:

[0007] One embodiment of the present invention provides an Internet of Things (IoT) security authentication method, comprising:

[0008] Based on the performance parameters of the sensor to be certified in the IoT sensing layer, a matching target security authentication method is determined for the sensor to be certified;

[0009] Once the target security authentication method is verified, the data verification model is invoked to perform data verification on the target authentication data uploaded by the sensor to be authenticated that matches the target security authentication method.

[0010] By analyzing the target authentication data, the data verification model, and the target data of sensors that are associated with the sensor to be certified, the correlation verification result of the sensor to be certified is obtained.

[0011] Based on the correlation verification results and data verification results, the authentication result of the IoT gateway for the sensor to be authenticated is determined.

[0012] Optionally, the step of obtaining the correlation verification result of the sensor to be certified by analyzing the target certification data, the data verification model, and the target data of sensors that are associated with the sensor to be certified includes:

[0013] Obtain historical authentication data of the sensor located at the spatial position of the sensor to be authenticated and its corresponding data verification model;

[0014] Based on the target authentication data and the data verification model, and the comparison results between the target authentication data and the historical authentication data and their corresponding data verification models, a dissimilarity verification result is generated.

[0015] Calculate the correlation between the target authentication data and the authentication data of each sensor within the neighborhood of the spatial location of the sensor to be authenticated, and obtain the correlation verification result;

[0016] Based on the dissimilarity verification results and the correlation verification results, the correlation verification results of the sensor to be certified are obtained.

[0017] Optionally, after determining the authentication result of the IoT gateway for the sensor to be authenticated based on the correlation verification result and the data verification result, the method further includes:

[0018] If the authentication result is abnormal, the abnormal data is recorded, and the number of abnormalities of the sensor to be verified is counted.

[0019] If the number of anomalies of the sensor to be verified exceeds a preset anomaly threshold, the connection between the sensor to be verified and the IoT gateway is cut off.

[0020] Optionally, after disconnecting the connection between the sensor to be verified and the IoT gateway, the method further includes:

[0021] Switch the security authentication method of the sensor to be verified to a security authentication method with a higher security level than the target security authentication method, and send a manual verification command to the administrator client.

[0022] Optionally, the step of calling the data verification model to perform data verification on the target authentication data uploaded by the sensor to be authenticated that matches the target security authentication method includes:

[0023] The data verification model includes an initial verification model and a dynamic adjustment model. The initial verification model is the data allowable range for different types of sensors to be in normal working condition, determined based on empirical thresholds. The dynamic adjustment model is the data allowable range for each type of sensor to be in normal working condition at the current moment, determined by analyzing the historical data of each type of sensor.

[0024] If the time the sensor to be certified is deployed in the IoT sensing layer does not exceed a preset time threshold, then the initial verification model is invoked to verify the target certification data of the sensor to be certified.

[0025] If the time the sensor to be certified is deployed in the IoT sensing layer exceeds a preset time threshold, the dynamic adjustment model is invoked to verify the target certification data of the sensor to be certified.

[0026] Optionally, determining a matching target security authentication method for the sensor to be authenticated based on the performance parameters of the sensor currently being authenticated in the IoT sensing layer includes:

[0027] If the sensor to be authenticated supports Modbus TCP, obtain the MAC address information of the sensor to be authenticated, and complete the security authentication of the sensor to be authenticated by comparing the MAC address information with the local MAC whitelist.

[0028] If the sensor to be certified supports a unique identifier, obtain the unique identifier information of the sensor to be certified, and complete the security certification of the sensor to be certified by comparing the unique identifier information with the local identifier whitelist.

[0029] If the sensor to be certified supports biometrics, obtain the biometric information of the user of the sensor to be certified, and complete the security authentication of the sensor to be certified by comparing the biometric information with the local biometric whitelist.

[0030] If the sensor to be certified supports public identity authentication, the encrypted data of the sensor to be certified is obtained, and the encrypted data is decrypted using the public identity of the sensor to be certified as the public key. The security authentication of the sensor to be certified is completed by comparing whether the decrypted data is the same as the original data.

[0031] Another embodiment of the present invention provides an Internet of Things (IoT) security authentication device, comprising:

[0032] The initial authentication module is used to determine a matching target security authentication method for the sensor to be authenticated based on the performance parameters of the sensor currently to be authenticated in the IoT sensing layer.

[0033] The data verification module is used to call the data verification model to verify the target authentication data uploaded by the sensor to be certified that matches the target security authentication method when the verification is passed by the target security authentication method.

[0034] The secondary verification module is used to obtain the correlation verification result of the sensor to be certified by analyzing the target certification data, the data verification model, and the target data of the sensor that has a correlation relationship with the sensor to be certified.

[0035] The authentication module is used to determine the authentication result of the IoT gateway for the sensor to be authenticated based on the correlation verification result and the data verification result.

[0036] This invention also provides an electronic device, including a processor, which executes a computer program stored in a memory to implement the steps of the Internet of Things security authentication method as described in any of the preceding claims.

[0037] This invention also provides a readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the IoT security authentication method as described in any of the preceding claims.

[0038] Finally, this embodiment of the invention also provides an Internet of Things (IoT) security authentication system, including a server, various sensors deployed in the IoT sensing layer, and an IoT gateway;

[0039] The IoT gateway is used to determine a matching target security authentication method for the sensor to be authenticated based on the performance parameters of the sensor to be authenticated in the IoT sensing layer; when the verification of the target security authentication method is passed, the data verification model is invoked to perform data verification on the target authentication data uploaded by the sensor to be authenticated that matches the target security authentication method; and the authentication result of the IoT gateway for the sensor to be authenticated is determined based on the correlation verification result and the data verification result.

[0040] The server is used to pre-build the data verification model; by analyzing the target authentication data, the data verification model, and the target data of the sensor that has a correlation relationship with the sensor to be certified, the correlation verification result of the sensor to be certified is obtained.

[0041] The advantages of the technical solution provided in this application are that it selects the most suitable security authentication method for each sensor based on its own computing and storage capabilities, enabling the IoT gateway to effectively and quickly authenticate different sensors. This effectively avoids the problem of high security authentication overhead caused by the limited resources of massive devices in the IoT sensing layer. For sensors that have passed security authentication, the data uploaded by the sensors is verified through a data verification model, which can ensure the security of the sensors. Further verification using data from sensors that are related to the sensor to be authenticated can effectively avoid the possibility of sensor data being forged, further improving the security of the sensors. This enables the IoT gateway in the IoT sensing layer to securely authenticate each sensor, effectively protecting the security of IoT terminals and contributing to the security of the Internet of Things.

[0042] Furthermore, embodiments of the present invention also provide corresponding implementation devices, systems, electronic devices, and readable storage media for the Internet of Things security authentication method, further making the method more practical, and the devices, systems, electronic devices, and readable storage media have corresponding advantages.

[0043] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0044] To more clearly illustrate the technical solutions of the embodiments of the present invention or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart illustrating an IoT security authentication method provided in an embodiment of the present invention.

[0046] Figure 2 This is a schematic diagram of a security verification process for a sensor and an IoT gateway provided in an embodiment of the present invention;

[0047] Figure 3 This is a schematic diagram of a data verification process for target authentication data provided in an embodiment of the present invention;

[0048] Figure 4 A flowchart illustrating another IoT security authentication method provided in an embodiment of the present invention;

[0049] Figure 5 This is a schematic diagram illustrating the different security levels supported by the Internet of Things (IoT) in this embodiment of the invention.

[0050] Figure 6 A structural diagram of a specific embodiment of the IoT security authentication device provided in this invention;

[0051] Figure 7 A structural diagram of a specific embodiment of the electronic device provided in this invention;

[0052] Figure 8 This is a structural diagram of a specific implementation of the IoT security authentication system provided in an embodiment of the present invention. Detailed Implementation

[0053] To enable those skilled in the art to better understand the present invention, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] The terms "comprising" and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to cover a non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may include steps or units not listed. Various non-limiting embodiments of this application are described in detail below.

[0055] First see Figure 1 , Figure 1 This is a flowchart illustrating an IoT security authentication method provided by an embodiment of the present invention. The embodiment of the present invention may include the following:

[0056] S101: Based on the performance parameters of the sensor to be certified in the IoT sensing layer, determine the matching target security authentication method for the sensor to be certified.

[0057] In this embodiment, the sensor to be authenticated is any sensor deployed in the IoT sensing layer that needs to be authenticated at the current moment. It can be any type of sensor or any model within the same type of sensor; this does not affect the implementation of this application. When the sensor requests authentication with the IoT gateway, the sensor's security authentication process is activated. The performance parameters in this step refer to parameters that reflect the sensor's computing and storage capabilities. The target security authentication method is the security authentication method matched to the sensor to be authenticated from all available security authentication methods. Of course, when matching a security authentication method to the sensor, the security authentication methods currently supported by the IoT and the user's needs can also be considered. The matching method can be implemented by issuing a security authentication method selection command to the system through human-computer interaction, or by building an automated program. This automated program tries each security authentication method sequentially from high to low security coefficient based on the acquired performance parameters until a supported security authentication method is determined as the target security authentication method. Of course, the built-in automated program can also select randomly; this does not affect the implementation of this application. This step selects a suitable authentication method for the sensor based on its computing and storage capabilities, such as... Figure 2 As shown, for each security authentication method, the feature information required by that security authentication method is obtained and compared with the feature information stored in the database of the IoT gateway to realize the gateway's identity authentication for different sensors.

[0058] S102: When the target security authentication method is verified, the data verification model is invoked to perform data verification on the target authentication data uploaded by the sensor to be authenticated, which matches the target security authentication method.

[0059] After determining the optimal security authentication method in the previous step, the sensor to be authenticated is verified based on the selected target security authentication method. For sensors that pass authentication, further data verification is performed. The data verification model in this step is used to verify the data uploaded by the sensor to the IoT gateway. This data includes the data collected by the sensor to be authenticated, and may also include data required by the target security authentication method, such as performance parameters. For ease of description, all data uploaded by the sensor to the IoT gateway in this step is referred to as target authentication data. The data verification model can be used to verify whether the data uploaded by the sensor to be authenticated is abnormal. Considering the limited computing resources of the IoT gateway, the data verification model can be pre-built or trained using a resource-rich backend server. The IoT gateway can adjust some parameters of the data verification model according to user instructions or new data. This data verification model can define the allowable data range for each type or model of sensor, which may rely on manual experience. The data verification model can also utilize big data analysis methods such as machine learning algorithms, based on neural network models or convolutional neural network models, to learn from a large amount of historical data to determine whether the data uploaded by each type of sensor is abnormal. Those skilled in the art can flexibly choose appropriate methods to construct a data verification model for detecting whether sensor data is abnormal, depending on the actual situation.

[0060] S103: By analyzing the target certification data, the data verification model, and the target data of sensors that are related to the sensor to be certified, the correlation verification results of the sensor to be certified are obtained.

[0061] This embodiment records all data related to the authentication process of each sensor with the IoT gateway throughout its lifecycle and saves the data verification model corresponding to each authentication. To prevent potential sensor data forgery, this step further performs correlation verification on the sensors to be authenticated. Sensors correlated with the sensor to be authenticated can include those correlated in time and spatially, such as historical data of the same sensor deployed in the same location and historical data of different sensors, such as other sensors deployed around the sensor to be authenticated. The target data can include data uploaded by correlated sensors. By comparing and analyzing the data from correlated sensors, the security of the sensor to be authenticated can be further guaranteed.

[0062] S104: Based on the correlation verification results and data verification results, determine the authentication result of the sensor to be authenticated by the IoT gateway.

[0063] In this embodiment, the authentication result is the identity verification result of the sensor to be authenticated. If the sensor to be authenticated passes the identity verification, its identity is normal, and the authentication result is normal. If the sensor to be authenticated fails the identity verification, the authentication result is abnormal.

[0064] In the technical solution provided by this invention, the most suitable security authentication method is selected for each sensor based on its own computing and storage capabilities, enabling effective and rapid authentication of the sensors. This effectively avoids the problem of high security authentication overhead caused by the limited resources of massive devices in the IoT sensing layer. For sensors that have passed security authentication, the data uploaded by the sensors is verified through a data verification model to ensure the security of the sensors. Further verification is performed using data from sensors that are related to the sensors to be authenticated, which effectively avoids the possibility of sensor data being forged, further improving the security of the sensors. This enables the IoT gateway in the IoT sensing layer to perform security authentication on each sensor, effectively protecting the security of IoT terminals and contributing to the security of the IoT.

[0065] In the above embodiments, there is no limitation on how to perform step S102. This embodiment provides an optional implementation method for calling the data verification model to perform data verification on the target authentication data, which may include the following steps:

[0066] The data verification model in this embodiment may include an initial verification model and a dynamic adjustment model. The initial verification model is the allowable data range for different types of sensors under normal operating conditions, determined based on empirical thresholds. The dynamic adjustment model is the allowable data range for each type of sensor under normal operating conditions at the current moment, determined by analyzing historical data of each type of sensor. If the time the sensor to be certified has been deployed in the IoT sensing layer does not exceed a preset time threshold, the initial verification model is invoked to verify the target certification data of the sensor to be certified. If the time the sensor to be certified has been deployed in the IoT sensing layer exceeds the preset time threshold, the dynamic adjustment model is invoked to verify the target certification data of the sensor to be certified.

[0067] like Figure 3As shown, in this embodiment, both the initial verification model and the dynamic adjustment model are used to verify the data uploaded by the sensors to be certified, determining the correctness of the sensor data. The dynamic adjustment model adjusts the normal data range of the sensor in real time by learning from historical data; the more historical data, the higher the accuracy. To ensure the accuracy of sensor verification, a preset time threshold can be used to measure the accuracy of the dynamic adjustment model. The preset time threshold can be flexibly determined according to the actual operating scenario, but it must ensure that sufficient historical data is available to support the construction of a high-precision dynamic adjustment model after reaching the preset time threshold. The choice between using the initial verification model or the dynamic adjustment model to verify the sensor data depends on the nature of the sensor and the detection location. For example, the data uploaded by the sensors to be certified are w1, w2, ..., w t If an initial verification model is used, the upper and lower limits of the allowable data range of the sensor to be certified can be manually set as M0 and M1, respectively. If M0 ≤ w i If the data is ≤M1, i=1,2,……,t, then the data is considered normal; otherwise, it is considered abnormal, and the corresponding abnormal data is incremented by 1. If a dynamic adjustment model is used, it can be based on the t sets of data w1,w2,…,w uploaded by the sensor to be certified. t The time series model is constructed using data mining methods. It can be divided into long-term trends, seasonal variations, and development cycles, which are modeled and represented separately, and abbreviated as f. t (w1,w2,…,w t The dynamic adjustment model can be represented as:

[0068] f t (w1,w2,…,w t )=f 长期 (w1,w2,…,w t )+f 季节 (w1,w2,…,w t )+f 周期 (w1,w2,…,w t )

[0069] A reasonable forecast range, or data allowable range, is determined by selecting a percentage of the predicted value. If the data falls outside this range, it is considered an anomaly, and the corresponding anomaly is incremented by 1. Let p be the reasonable percentage, then:

[0070] (1-p)f t (w1,w2,…,w t )≤w i ≤(1+p)f t (w1,w2,…,w t )

[0071] Furthermore, to ensure the high accuracy of the dynamic adjustment model, for reasonably newly stored sensor data, this data can be used to update the dynamic adjustment model. That is, the parameters of the dynamic adjustment model are adjusted based on the newly stored sensor data. Correspondingly, the adjustment process of the dynamic adjustment model can be expressed as: f t+1 (w1,w2,…,w t ,w t+1 )=g(f t (w1,w2,…,w t )).

[0072] Furthermore, to prevent misoperation and accuracy issues, an anomaly threshold can be preset. If the authentication result of the sensor to be authenticated is abnormal, the abnormal data and the number of anomalies are recorded. Based on the system's records, the number of anomalies of the sensor to be verified can be counted in real time. When the number of anomalies of the sensor to be verified exceeds the preset anomaly threshold, the connection between the sensor to be verified and the IoT gateway is disconnected. Furthermore, after disconnecting the sensor to be verified from the IoT gateway, to balance security and minimize the impact on operational business, the following can also be included: switching the security authentication method of the sensor to be verified to a security authentication method with a higher security level than the target security authentication method, and sending a manual verification command to the administrator client.

[0073] For example, this embodiment performs data anomaly processing based on the statistics of abnormal data. If the preset anomaly threshold is N, and the statistical value of the abnormal data of the sensor to be certified is N... a When the above authentication result indicates data anomaly, the current N will be... a Updated to N a +1, and compare it with the preset abnormal threshold of N. If N a If N < N, then remain unchanged and continue to accept data uploaded by the sensor to be certified; if N < ... a If the value is ≥N, then the sensor to be certified will be handled abnormally, meaning the connection between the sensor and the IoT gateway will be disconnected. However, to ensure the normal operation of the IoT, the IoT gateway will continue to certify the sensor and, based on the authentication records between the sensor and the IoT gateway, may request the sensor to increase the security level of its authentication method. If the sensor can pass authentication after adjusting the security authentication method, it will be allowed to reconnect to the IoT gateway. If the sensor cannot support a higher security level authentication method, or if the authentication between the sensor and the IoT gateway fails, manual verification by administrators can be provided. If the manual verification passes, the connection between the sensor and the IoT gateway will be allowed to continue.

[0074] The above embodiments do not limit how the correlation verification results are generated. This application also provides an optional implementation method, which may include the following:

[0075] Obtain historical authentication data of the sensor located at the spatial location of the sensor to be authenticated and its corresponding data verification model;

[0076] Based on the target authentication data and data verification model, and the comparison results with historical authentication data and their corresponding data verification models, a dissimilarity verification result is generated.

[0077] The correlation between the target authentication data and the authentication data of each sensor within the neighborhood of the spatial location of the sensor to be authenticated is calculated to obtain the correlation verification result.

[0078] Based on the dissimilarity verification results and the correlation verification results, the correlation verification results of the sensor to be certified are obtained.

[0079] The data processing in this embodiment can be implemented through a backend server. The IoT gateway records all data from the authentication process of each sensor deployed in the perception layer, including data uploaded by the sensors and the corresponding data verification model, and simultaneously uploads this data to the server for record keeping. Figure 4 Because the server stores a large amount of historical data, when the IoT gateway authenticates the sensor to be authenticated, the server can compare the target authentication data with the data verification model and historical records from the same location to determine their dissimilarity. For sensors that are spatially close, the server compares the correlation between the sensor data. By implementing these two methods to re-verify the sensor data, potential sensor data forgery can be avoided. Let w be the target authentication data uploaded by the sensor to be authenticated. i Spatial data analysis: Let the data from n nearby sensors be w0, w1, ..., w n The data from each sensor are weighted according to the distance between the sensor and the sensor to be certified, and the values ​​can be q0, q1, ..., q n The data model of the sensor to be certified is constructed using nearby sensor data, with a range of f(q0w0,q1w1,…,q). n w n ), and set the target authentication data as w i With f(q0w0,q1w1,…,q) n w n The data is compared within a certain range. If the range is exceeded, an anomaly is detected, meaning the correlation verification result is abnormal. The server then handles the anomaly and transmits the result to the IoT gateway. From a time-based data analysis perspective, let the data from other sensors at the same location before be w0, w1, ..., w... nThe data are weighted according to the time validity of other sensor data, and abbreviated as q0, q1, ..., q n The data model of the sensor to be certified is constructed using nearby sensor data, with a range of g(q0w0,q1w1,…,q). n w n ); Set the target authentication data as w i With g(q0w0,q1w1,…,q) n w n If the range of the correlation verification is exceeded, it is judged as an anomaly. In other words, the correlation verification result is an anomaly, which is handled by the server and the result is transmitted to the IoT gateway.

[0080] The above embodiments do not limit the method of target security authentication. Based on the above embodiments, this application also provides an optional implementation method for target security authentication. In this embodiment, such as Figure 5 As shown, in order of increasing security level, the security authentication methods supported by the Internet of Things (IoT) can include MAC address-based authentication, token-based authentication, biometric authentication, password-based authentication, and public key authentication. MAC address-based authentication uses a MAC address pattern for authentication. A MAC address is an identifier assigned to a network interface for network access control in an intranet environment. Token-based authentication uses a token created by an identity authentication server to uniquely identify a user or device. Biometric authentication uses a specific biometric scanner to collect unique biometric data from the user and matches it with stored data collected during the registration process. Password-based authentication requires the user to provide a unique ID and password, which are stored in the identity authentication server's database. Public key authentication uses a public key cryptosystem with the user's (i.e., client) ID. The public key includes the email address, name, publicly available IP address, and signature, providing both security and authentication. If the sensor's computing and storage resources allow, a certificate system from the traditional password authentication process can be further employed. The aforementioned authentication methods progressively increase in resources, with correspondingly higher security levels. Alternatively, a combination of these methods can be used, i.e., multi-factor authentication, such as sensor-based authentication using both password and biometric data. Therefore, the implementation process of S101 may include the following:

[0081] If the sensor to be authenticated supports Modbus TCP, the corresponding target security authentication method is MAC address-based authentication. When the sensor connects to the IoT gateway, the IoT gateway obtains the MAC address information of the sensor and compares it with the local MAC whitelist. If the MAC address belongs to a sensor in the whitelist, the authentication is successful; otherwise, it fails, completing the security authentication of the sensor. If the whitelist information in the gateway can be modified, manual modification by the administrator is required.

[0082] If the sensor to be authenticated supports a unique identifier, the corresponding target security authentication method is token-based authentication. When the sensor to be authenticated connects to the IoT gateway, its unique identifier information is obtained. By comparing the unique identifier information with the local identifier whitelist, if the unique identifier belongs to a sensor in the whitelist, the authentication is successful; otherwise, it fails, and the connection with the sensor is disconnected to complete the security authentication of the sensor to be authenticated. If it is necessary to change the unique identifier whitelist information in the gateway, the administrator needs to manually issue the corresponding command.

[0083] If the sensor to be authenticated supports biometrics, the corresponding target security authentication method is biometric authentication. When the sensor to be authenticated connects to the IoT gateway, it extracts the user's biometric information and uploads it to the IoT gateway. The IoT gateway obtains the user's biometric information from the sensor to be authenticated and compares it with its local biometric whitelist. If the biometric information belongs to the data stored in the gateway, the authentication is successful; otherwise, it fails, and the connection with the sensor is disconnected, thus completing the security authentication of the sensor to be authenticated. If it is necessary to modify the biometric information data stored in the gateway, the administrator needs to manually issue the corresponding command.

[0084] If the sensor to be authenticated supports public identity authentication, the corresponding target security authentication method is public key authentication based on the public identity. The sensor to be authenticated has the corresponding computing and storage capabilities and can authenticate with the IoT gateway using a public key cryptographic system based on the user's (client's) ID, based on the user's public identity. When the sensor to be authenticated connects to the IoT gateway, it acquires the encrypted data of the sensor to be authenticated, decrypts the encrypted data using the sensor's public identity as the public key, and completes the security authentication of the sensor to be authenticated by comparing the decrypted data with the original data. The encrypted data can be generated by the sensor to be authenticated encrypting the target authentication data using its own private key, or it can be generated by encrypting the MAC information of the target authentication data. The sensor to be authenticated uploads the encrypted data and its private key to the gateway. The IoT gateway uses the acquired data information, combined with the sensor's public identity as the public key, to decrypt the MAC value of the target authentication data and compares it with the actual data MAC value. If they match, authentication is successful, and the data is uploaded to the gateway. Otherwise, the data is abnormal, the IoT gateway does not accept the target authentication data uploaded by the sensor to be authenticated, and requires the sensor to be authenticated again.

[0085] It should be noted that there is no strict order of execution for the steps in this application. As long as they conform to a logical order, these steps can be executed simultaneously or in a certain preset order. Figures 1-5 This is just an illustrative example and does not mean that this is the only possible execution order.

[0086] This invention also provides a corresponding apparatus for the IoT security authentication method, further enhancing the method's practicality. The apparatus can be described from both a functional module perspective and a hardware perspective. The IoT security authentication apparatus provided in this invention embodiment is described below, which is used to implement the IoT security authentication method provided in this application. In this embodiment, the IoT security authentication apparatus may include or be divided into one or more program modules. These program modules are stored in a storage medium and executed by one or more processors to complete the IoT security authentication method disclosed in Embodiment 1. The program module referred to in this application is a series of computer program instruction segments capable of performing a specific function, which is more suitable than the program itself for describing the execution process of the IoT security authentication apparatus in the storage medium. The following description will specifically introduce the functions of each program module in this embodiment. The IoT security authentication apparatus described below can be referred to in correspondence with the IoT security authentication method described above.

[0087] From the perspective of functional modules, see Figure 6 , Figure 6 This is a structural diagram of an IoT security authentication device provided in an embodiment of the present invention, in one specific implementation. The device may include:

[0088] The initial authentication module 601 is used to determine a matching target security authentication method for the sensor to be authenticated based on the performance parameters of the sensor to be authenticated in the IoT sensing layer.

[0089] The data verification module 602 is used to call the data verification model when the verification of the target security authentication method is passed, and to perform data verification on the target authentication data uploaded by the sensor to be authenticated that matches the target security authentication method.

[0090] The secondary verification module 603 is used to obtain the correlation verification result of the sensor to be certified by analyzing the target certification data, the data verification model, and the target data of the sensor that is related to the sensor to be certified.

[0091] The authentication module 604 is used to determine the authentication result of the sensor to be authenticated by the IoT gateway based on the correlation verification result and the data verification result.

[0092] Optionally, in some embodiments of this example, the secondary verification module 603 may also be used for:

[0093] Obtain historical authentication data of the sensor located at the spatial location of the sensor to be authenticated and its corresponding data verification model;

[0094] Based on the target authentication data and data verification model, and the comparison results with historical authentication data and their corresponding data verification models, a dissimilarity verification result is generated.

[0095] The correlation between the target authentication data and the authentication data of each sensor within the neighborhood of the spatial location of the sensor to be authenticated is calculated to obtain the correlation verification result.

[0096] Based on the dissimilarity verification results and the correlation verification results, the correlation verification results of the sensor to be certified are obtained.

[0097] As an optional implementation of the above embodiments, the above apparatus may further include, for example, an exception handling module, for:

[0098] If the authentication result is abnormal, the abnormal data is recorded and the number of abnormalities of the sensor to be verified is counted.

[0099] If the number of anomalies of the sensor to be verified exceeds the preset anomaly threshold, the connection between the sensor to be verified and the IoT gateway will be cut off.

[0100] As another optional implementation of the above embodiments, the exception handling module can also be used for:

[0101] Switch the security authentication method of the sensor to be verified to a security authentication method with a higher security level than the target security authentication method, and send a manual verification command to the administrator client.

[0102] Optionally, in some other embodiments of this example, the data verification module 602 may further be used for:

[0103] The data verification model includes an initial verification model and a dynamic adjustment model. The initial verification model is the data allowable range for different types of sensors under normal working conditions, determined based on empirical thresholds. The dynamic adjustment model is the data allowable range for each type of sensor under normal working conditions at the current moment, determined by analyzing historical data of each type of sensor.

[0104] If the time the sensor to be certified is deployed in the IoT sensing layer does not exceed the preset time threshold, the initial verification model is invoked to verify the target certification data of the sensor to be certified.

[0105] If the time the sensor to be certified is deployed in the IoT sensing layer exceeds a preset time threshold, the dynamic adjustment model is invoked to verify the target certification data of the sensor to be certified.

[0106] Optionally, in other embodiments of this example, the initial authentication module 601 described above can also be used for:

[0107] If the sensor to be certified supports Modbus TCP, obtain the MAC address information of the sensor to be certified, and complete the security certification of the sensor to be certified by comparing the MAC address information with the local MAC whitelist.

[0108] If the sensor to be certified supports a unique identifier, obtain the unique identifier information of the sensor to be certified, and complete the security certification of the sensor to be certified by comparing the unique identifier information with the local identifier whitelist.

[0109] If the sensor to be certified supports biometrics, obtain the biometric information of the user of the sensor to be certified, and complete the security certification of the sensor to be certified by comparing the biometric information with the local biometric whitelist.

[0110] If the sensor to be certified supports public identity authentication, the encrypted data of the sensor to be certified is obtained, and the public identity of the sensor to be certified is used as the public key to decrypt the encrypted data. The security authentication of the sensor to be certified is completed by comparing whether the decrypted data is the same as the original data.

[0111] The functions of each functional module of the IoT security authentication device in this embodiment of the invention can be specifically implemented according to the methods in the above method embodiments. The specific implementation process can be referred to the relevant descriptions in the above method embodiments, and will not be repeated here.

[0112] As can be seen from the above, the embodiments of the present invention can realize the security authentication of each sensor by the IoT gateway in the IoT sensing layer.

[0113] The IoT security authentication device mentioned above is described from the perspective of functional modules. Furthermore, this application also provides an electronic device, which is described from the perspective of hardware. Figure 7 This is a schematic diagram of the structure of the electronic device provided in one embodiment of this application. For example... Figure 7 As shown, the electronic device includes a memory 70 for storing a computer program; and a processor 71 for executing the computer program to implement the steps of the IoT security authentication method as described in any of the above embodiments.

[0114] The processor 71 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 71 may also be a controller, microcontroller, microprocessor, or other data processing chip. The processor 71 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 71 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 71 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 71 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0115] The memory 70 may include one or more computer-readable storage media, which may be non-transitory. The memory 70 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the memory 70 may be an internal storage unit of an electronic device, such as a server hard drive. In other embodiments, the memory 70 may be an external storage device of an electronic device, such as a plug-in hard drive on a server, a smart media card (SMC), a secure digital card (SD), a flash card, etc. Furthermore, the memory 70 may include both internal and external storage units of the electronic device. The memory 70 can be used not only to store application software and various types of data installed on the electronic device, such as code in the process of executing the IoT security authentication method, but also to temporarily store data that has been output or will be output. In this embodiment, the memory 70 is used to store at least the following computer program 701, which, after being loaded and executed by the processor 71, can implement the relevant steps of the IoT security authentication method disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 70 may also include an operating system 702 and data 703, and the storage method may be temporary storage or permanent storage. The operating system 702 may include Windows, Unix, Linux, etc. The data 703 may include, but is not limited to, data corresponding to IoT security authentication results.

[0116] In some embodiments, the aforementioned electronic device may further include a display screen 72, an input / output interface 73, a communication interface 74 (or network interface), a power supply 75, and a communication bus 76. The display screen 72 and input / output interface 73, such as a keyboard, are user interfaces; optional user interfaces may also include standard wired interfaces, wireless interfaces, etc. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen, etc. The display may also be appropriately referred to as a display screen or display unit, used to display information processed in the electronic device and to display a visual user interface. The communication interface 74 may optionally include a wired interface and / or a wireless interface, such as a Wi-Fi interface, a Bluetooth interface, etc., typically used to establish communication connections between the electronic device and other electronic devices. The communication bus 76 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0117] Those skilled in the art will understand that Figure 7 The structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, such as sensors 77 that perform various functions.

[0118] The functions of each functional module of the electronic device in the embodiments of the present invention can be specifically implemented according to the methods in the above method embodiments. The specific implementation process can be referred to the relevant descriptions in the above method embodiments, which will not be repeated here.

[0119] As can be seen from the above, the embodiments of the present invention can realize the security authentication of each sensor by the IoT gateway in the IoT sensing layer.

[0120] It is understood that if the IoT security authentication method in the above embodiments is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes: USB flash drive, mobile hard drive, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM, register, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, removable disk, CD-ROM, magnetic disk or optical disk, and other media capable of storing program code.

[0121] Based on this, embodiments of the present invention also provide a readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the steps of the IoT security authentication method of any of the above embodiments are as follows.

[0122] This invention also provides an IoT security authentication system; please refer to [link / reference]. Figure 8 It may include:

[0123] The Internet of Things (IoT) security authentication system may include a server 801, various sensors 802 deployed in the IoT sensing layer, and an IoT gateway 803.

[0124] The IoT gateway 803 is used to determine a matching target security authentication method for the sensor to be authenticated based on the performance parameters of the sensor currently being authenticated in the IoT sensing layer. When the target security authentication method is verified, a data verification model is invoked to perform data verification on the target authentication data uploaded by the sensor to be authenticated that matches the target security authentication method. Based on the correlation verification result and the data verification result, the IoT gateway determines the authentication result for the sensor to be authenticated. The sensor currently being authenticated can be any sensor 802 deployed in the IoT sensing layer.

[0125] Server 801 is used to pre-build a data verification model; by analyzing the target authentication data, the data verification model, and the target data of sensors that are related to the sensor to be certified, the correlation verification result of the sensor to be certified is obtained.

[0126] The functions of each module of the IoT security authentication system in this embodiment of the invention can be specifically implemented according to the methods in the above method embodiments. The specific implementation process can be referred to the relevant descriptions in the above method embodiments, which will not be repeated here.

[0127] As can be seen from the above, the embodiments of the present invention can realize the security authentication of each sensor by the IoT gateway in the IoT sensing layer.

[0128] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the hardware disclosed in the embodiments, including devices and electronic equipment, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0129] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0130] The foregoing has provided a detailed description of an IoT security authentication method, apparatus, system, electronic device, and readable storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of the invention. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and core ideas of the invention. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from the principles of the invention, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. An Internet of Things (IoT) security authentication method, characterized in that, include: Based on at least one type of security authentication technology supported by the sensor to be authenticated in the IoT sensing layer, such as MAC address-based authentication, token-based authentication, biometric authentication, password-based authentication, or public key-based authentication, a matching target security authentication method is determined for the sensor to be authenticated. When the target security authentication method is verified, the data verification model is invoked to verify the target authentication data uploaded by the sensor to be authenticated, which matches the target security authentication method. The data verification model includes an initial verification model and a dynamic adjustment model. The initial verification model is the data allowable range for different types of sensors in normal working condition, determined based on empirical thresholds. The dynamic adjustment model is the data allowable range for each type of sensor in normal working condition at the current moment, determined by analyzing historical data of each type of sensor. If the time the sensor to be authenticated has been deployed in the IoT sensing layer does not exceed a preset time threshold, the initial verification model is invoked to verify the target authentication data of the sensor to be authenticated. If the time the sensor to be certified is deployed in the IoT sensing layer exceeds a preset time threshold, the dynamic adjustment model is invoked to verify the target certification data of the sensor to be certified. By analyzing the target authentication data, the data verification model, and the target data of sensors associated with the sensor to be authenticated, the correlation verification result of the sensor to be authenticated is obtained. The correlation verification result includes dissimilarity verification result and correlation verification result. The dissimilarity verification result is generated by comparing the target authentication data and the data verification model with the historical authentication data of the sensors at the spatial location of the sensor to be authenticated and their corresponding data verification models. The correlation verification result is obtained by calculating the correlation between the target authentication data and the authentication data of each sensor within the neighborhood of the spatial location of the sensor to be authenticated. Based on the correlation verification results and data verification results, the authentication result of the IoT gateway for the sensor to be authenticated is determined.

2. The IoT security authentication method according to claim 1, characterized in that, The process of obtaining the correlation verification result of the sensor to be certified by analyzing the target certification data, the data verification model, and the target data of sensors that are associated with the sensor to be certified includes: Obtain historical authentication data of the sensor located at the spatial location of the sensor to be authenticated, as well as its corresponding data verification model; Based on the dissimilarity verification results and the correlation verification results, the correlation verification results of the sensor to be certified are obtained.

3. The IoT security authentication method according to claim 1, characterized in that, After determining the authentication result of the IoT gateway for the sensor to be authenticated based on the correlation verification result and the data verification result, the method further includes: If the authentication result is abnormal, the abnormal data is recorded, and the number of abnormalities of the sensor to be authenticated is counted. If the number of anomalies of the sensor to be certified exceeds a preset anomaly threshold, the connection between the sensor to be certified and the IoT gateway is cut off.

4. The IoT security authentication method according to claim 3, characterized in that, After severing the connection between the sensor to be authenticated and the IoT gateway, the method further includes: Switch the security authentication method of the sensor to be authenticated to a security authentication method with a higher security level than the target security authentication method, and send a manual verification command to the administrator client.

5. The IoT security authentication method according to claim 1, characterized in that, The step of determining a matching target security authentication method for the sensor to be authenticated includes: If the sensor to be authenticated supports Modbus TCP, obtain the MAC address information of the sensor to be authenticated, and complete the security authentication of the sensor to be authenticated by comparing the MAC address information with the local MAC whitelist. If the sensor to be certified supports a unique identifier, obtain the unique identifier information of the sensor to be certified, and complete the security certification of the sensor to be certified by comparing the unique identifier information with the local identifier whitelist. If the sensor to be certified supports biometrics, obtain the biometric information of the user of the sensor to be certified, and complete the security authentication of the sensor to be certified by comparing the biometric information with the local biometric whitelist. If the sensor to be certified supports public identity authentication, the encrypted data of the sensor to be certified is obtained, and the encrypted data is decrypted using the public identity of the sensor to be certified as the public key. The security authentication of the sensor to be certified is completed by comparing whether the decrypted data is the same as the original data.

6. An Internet of Things (IoT) security authentication device, characterized in that, include: The initial authentication module is used to determine a matching target security authentication method for the sensor to be authenticated based on at least one type of security authentication technology supported by the sensor currently being authenticated in the IoT sensing layer, including MAC address-based authentication, token-based authentication, biometric authentication, password-based authentication, or public key-based authentication. The data verification module is used to, upon successful verification by the target security authentication method, invoke a data verification model to verify the target authentication data uploaded by the sensor to be authenticated, which matches the target security authentication method. The data verification model includes an initial verification model and a dynamic adjustment model. The initial verification model is a data allowable range for different types of sensors under normal operating conditions, determined based on empirical thresholds. The dynamic adjustment model is a data allowable range for each type of sensor under normal operating conditions at the current moment, determined by analyzing historical data of each type of sensor. If the time the sensor to be authenticated has been deployed in the IoT sensing layer does not exceed a preset time threshold, the initial verification model is invoked to verify the target authentication data of the sensor to be authenticated. If the time the sensor to be certified is deployed in the IoT sensing layer exceeds a preset time threshold, the dynamic adjustment model is invoked to verify the target certification data of the sensor to be certified. The secondary verification module is used to obtain the correlation verification result of the sensor to be certified by analyzing the target certification data, the data verification model, and the target data of sensors that are associated with the sensor to be certified. The correlation verification result includes the dissimilarity verification result and the correlation verification result. The dissimilarity verification result is generated by comparing the target certification data and the data verification model with the historical certification data of the sensors at the spatial location of the sensor to be certified and their corresponding data verification models. The correlation verification result is obtained by calculating the correlation between the target certification data and the certification data of each sensor within the neighborhood of the spatial location of the sensor to be certified. The authentication module is used to determine the authentication result of the IoT gateway for the sensor to be authenticated based on the correlation verification result and the data verification result.

7. An electronic device, characterized in that, It includes a processor and a memory, wherein the processor is used to implement the steps of the Internet of Things security authentication method as described in any one of claims 1 to 5 when executing a computer program stored in the memory.

8. A readable storage medium, characterized in that, The readable storage medium stores a computer program that, when executed by a processor, implements the steps of the Internet of Things security authentication method as described in any one of claims 1 to 5.

9. An Internet of Things (IoT) security authentication system, characterized in that, This includes servers, various sensors deployed in the IoT sensing layer, and IoT gateways; The IoT gateway is used to determine a matching target security authentication method for the sensor to be authenticated based on at least one type of security authentication technology supported by the sensor currently being authenticated in the IoT sensing layer, including MAC address-based authentication, token-based authentication, biometric authentication, password-based authentication, or public key-based authentication. When the target security authentication method is verified, the data verification model is invoked to verify the target authentication data uploaded by the sensor to be authenticated, which matches the target security authentication method. Based on the correlation verification result and the data verification result, the authentication result of the IoT gateway for the sensor to be authenticated is determined. The data verification model includes an initial verification model and a dynamic adjustment model. The initial verification model is the data allowable range for different types of sensors in normal working condition determined based on empirical thresholds. The dynamic adjustment model is the data allowable range for each type of sensor in normal working condition at the current moment determined by analyzing the historical data of each type of sensor. If the time the sensor to be authenticated has been deployed in the IoT sensing layer does not exceed a preset time threshold, the initial verification model is invoked to verify the target authentication data of the sensor to be authenticated. If the time the sensor to be certified is deployed in the IoT sensing layer exceeds a preset time threshold, the dynamic adjustment model is invoked to perform data verification on the target certification data of the sensor to be certified. The correlation verification result includes dissimilarity verification result and correlation verification result. The dissimilarity verification result is generated based on the comparison between the target certification data and the data verification model and the historical certification data and corresponding data verification models of the sensors at the spatial location of the sensor to be certified. The correlation verification result is obtained by calculating the correlation between the target certification data and the certification data of each sensor within the neighborhood of the spatial location of the sensor to be certified. The server is used to pre-build the data verification model; by analyzing the target authentication data, the data verification model, and the target data of the sensor that has a correlation relationship with the sensor to be certified, the correlation verification result of the sensor to be certified is obtained.

Images