An alliance chain and MQTT-based internet of things cross-domain authentication system and method

Abstract

The application relates to an alliance chain and MQTT-based Internet of Things cross-domain authentication system and method, and belongs to the Internet of Things cross-domain authentication field. The application first proposes an alliance chain and MQTT-based Internet of Things cross-domain authentication method, chains and traces related devices, gateways and authentication processes of the Internet of Things, efficiently completes access management and cross-domain authentication of the Internet of Things devices through MQTT, shields the bottom heterogeneity problem, simultaneously simplifies the authentication process between trust domains by using the alliance chain node consensus, and builds a trusted cross-domain information interaction environment for the Internet of Things. Compared with the prior art, the application mainly solves the problems of different authentication modes, different certificate forms and low efficiency of different systems, provides an efficient, simple and trusted cross-domain authentication process, and simultaneously provides an Internet of Things device and gateway related data collection and storage mechanism by the alliance chain+MQTT+Internet of Things cross-domain authentication system.

Description

A cross-domain authentication system and method for the Internet of Things based on consortium blockchain and MQTT Technical Field

[0001] This invention relates to an IoT cross-domain authentication system and method based on consortium blockchain and MQTT, belonging to the field of IoT cross-domain authentication. Background Technology

[0002] With the rapid development of network technology and the large-scale deployment of low-cost smart devices, the Internet of Things (IoT) has experienced rapid growth, creating a demand for cross-domain information exchange between IoT devices. Traditional IoT infrastructure is relatively closed, with differences in authentication modes and certificate formats between different systems, resulting in significant isolation and multiple trust domains. Since resources within the same trust domain are no longer sufficient to meet the needs of users and devices, the design of efficient and concise cross-domain access processes has become a key research focus. Existing cross-domain authentication technologies mainly fall into two categories: real-time authorization, which retains a short-term access credential during interaction within the trust domain, but this method is currently very cumbersome and inefficient; and long-term authorization, which suffers from outdated information due to untimely updates. Neither of these methods meets the requirements for efficient, secure, and reliable cross-domain authentication in the IoT. Summary of the Invention

[0003] To address the aforementioned technical issues, this invention provides an IoT cross-domain authentication system and method based on consortium blockchain and MQTT. By applying consortium blockchain technology to cross-domain authentication scenarios between IoT devices, it ensures that all data involved in the cross-domain authentication process of IoT device gateways is stored in the Hyperledger Fabric consortium blockchain management system. All participating parties in the cross-domain process can track and view the data for each step, and the data will not be tampered with within the system, providing robust and secure support for cross-domain authentication access between IoT devices.

[0004] Blockchain, as a distributed trust environment that has gained widespread attention in recent years, is a new type of infrastructure for achieving consensus, co-governance, and sharing among all stakeholders. It possesses characteristics such as distributed data storage, decentralization, immutability, traceability, and trustworthiness, providing a standardized and trustworthy mechanism for cooperation between multiple trust domains, thereby enabling rapid authentication between different trust domains. This invention designs an architecture suitable for cross-domain authentication in the Internet of Things (IoT). By introducing a gateway, it enables the access and management of IoT devices, improving IoT management efficiency and shielding the underlying heterogeneity issues of IoT devices. Then, an MQTT bus is used to connect the various processes, and finally, the Hyperledger Fabric consortium blockchain management system is used to verify the gateway identity of the IoT devices. It has been proven that the cross-domain authentication process designed in this invention can provide a secure, efficient, and privacy-protecting cross-domain authentication environment.

[0005] The technical solution adopted in this invention is: an IoT cross-domain authentication system based on consortium blockchain and MQTT, comprising three parts: an IoT system, MQTT, and a Hyperledger Fabric consortium blockchain management system; the IoT system is used to detect IoT device-related information; the Hyperledger Fabric consortium blockchain management system is used to provide query and write functions, and negotiate and publish chaincode, and verify the IoT device gateway information through consortium trust domain consensus and upload it to the chain.

[0006] The Internet of Things (IoT) system is used for communication between IoT devices and for the transmission and collection of information between IoT devices.

[0007] The MQTT communication model is based on a publish / subscribe pattern. Each module only needs to connect to the bus to subscribe to / publish relevant information. After connecting to the bus, each module only needs to subscribe to the topics it needs to receive the corresponding data. After a client connects to the MQTT bus, it needs to register the topics it needs. Other clients send messages to this topic through the bus, and the messages will be received by the subscribers.

[0008] $iot / v1 / ZigBee / Register

[0009] $iot / v1 / ZigBee / UnRegister

[0010] $iot / v1 / RF / Register

[0011] $iot / v1 / RF / UnRegister

[0012] $iot / v1 / ZWave / Register

[0013] $iot / v1 / ZWave / UnRegister

[0014] The MQTT mentioned above allows for publishing and subscribing to topics, connecting various processes, and controlling commands to transmit data through topics. The relevant MQTT configuration is as follows:

[0015] public final String TAG="MQTT";

[0016] private MqttAndroidClient mqttAndroidClient;

[0017] private MqttConnectOptions mMqttConnectOptions;

[0018] public String MQTT_HOST="tcp: / / xxx.xxx.xxx.xxx:1883";

[0019] publicStringMQTT_UserName="admin";

[0020] publicStringMQTT_PassWord="admin";

[0021] publicintMQTT_ConnectionTimeout=10;

[0022] publicintKeepAliveIntervalTime=20;

[0023] publicbooleanCleanSession=true;

[0024] publicStringSubscribe_Topic="androidTopic";

[0025] publicStringEndWillMsgPublish_Topic="EndWillMsg";

[0026] publicstaticStringRESPONSE_TOPIC="message_arrived";

[0027] Specifically, the Hyperledger Fabric consortium blockchain management system, acting as a trust domain, provides trust endorsement for the identity and capabilities of devices it can control. As a complete node of the consortium blockchain, it endorses and reaches consensus on information published on the chain, provides real-time sharing of authentication information, performs basic query and write functions in the Hyperledger Fabric consortium blockchain management system, and nodes publish smart contracts through negotiation and implement complex functions by calling the contracts.

[0028] The Hyperledger Fabric consortium blockchain management system is built on Fabric version 1.4. Leveraging the distributed storage, peer-to-peer transmission, transparency, and immutability of blockchain, the system allows IoT devices and gateways to submit information through transactions. Participating nodes in the Hyperledger Fabric consortium blockchain management system verify and upload the data to the blockchain. Elliptic curve digital signatures are used to ensure non-repudiation of information, enabling data upload and guaranteeing that information cannot be tampered with. The system is accessible via a web interface, interacting with the fabric-node-sdk client. Participating trusted domains collaborate to construct the Hyperledger Fabric consortium blockchain management system.

[0029] The IoT device registration algorithm of the Hyperledger Fabric consortium blockchain management system is as follows:

[0030] vardevice=Device{DeviceType:args[1],args[2],PublicKey:args[4],

[0031] keyvalue:m,PermissionType:args[6],privace:n,DeviceSwitch:args[8],

[0032] DeviceFunction:l}

[0033] deviceAsBytes,_=json.Marshal(device)

[0034] APIstub.PutState(args[0],deviceAsBytes)

[0035] Specifically, the IoT device structure of the Hyperledger Fabric consortium blockchain management system is as follows:

[0036]

[0037] Specifically, the gateway structure of the Hyperledger Fabric consortium blockchain management system is as follows:

[0038]

[0039] The IoT system is responsible for collecting relevant information from IoT devices. MQTT connects the IoT system and the Hyperledger Fabric consortium blockchain management system through topic division. The Hyperledger Fabric consortium blockchain management system verifies and uploads the information collected by the IoT system to the blockchain through MQTT topics, and also verifies and uploads cross-domain authentication between IoT devices.

[0040] Optionally, the IoT system includes sensors, gateways, and a data processing center;

[0041] The aforementioned sensor is used to collect relevant information about IoT devices, including the functions, device type, and operating status of the IoT devices.

[0042] The sensor is responsible for sending the collected IoT device information to the gateway, which then sends it to the data processing center.

[0043] The gateway is the central node for communication between all devices and the relay node for communication between the intranet and the extranet. In other words, it is the relay that connects various smart devices to the Internet. The gateway plays the role of protocol conversion. If the "input" device and the "output" device use different types of wireless communication protocols, the gateway also needs to perform protocol conversion, then determine the wireless communication protocol of the target device, and finally send the instructions to the corresponding topic communication module, which then sends the control instructions to the device via radio signals.

[0044] The data processing center is used to upload IoT device information to the Hyperledger Fabric consortium blockchain management system for querying and authentication. The relevant information includes IoT device information and hash values ​​to verify whether the information has been tampered with.

[0045] The Hyperledger Fabric consortium blockchain management system uses the Hyperledger Fabric consortium blockchain and deploys the Go language version of Chaincode within the system.

[0046] Optionally, the Hyperledger Fabric consortium blockchain management system defines a unique ID for IoT devices and gateways, ensuring that the data of the IoT devices and gateways is stored in the Hyperledger Fabric consortium blockchain and that the IoT device and gateway information is not tampered with.

[0047] Optionally, the Hyperledger Fabric consortium blockchain management system uploads IoT device and gateway information to the system through the trust domain. The IoT device and gateway data are encrypted and verified using hash functions and elliptic curve ECC asymmetric encryption algorithms to achieve data on-chain, ensuring that all participants in the entire blockchain can transparently view the information of each process, and that the stored information cannot be tampered with.

[0048] Optionally, the Hyperledger Fabric consortium blockchain management system supports converting the queried data into hash values ​​and then comparing them with the values ​​stored in the Hyperledger Fabric consortium blockchain to ensure the authenticity of the data.

[0049] A cross-domain authentication method for the Internet of Things (IoT) based on consortium blockchain and MQTT includes the following steps:

[0050] 1) Divide the MQTT topics according to the system requirements;

[0051] 2) Initialize the Hyperledger Fabric consortium blockchain management system;

[0052] 3) Upload information from IoT devices and gateways to the blockchain;

[0053] 4) Perform cross-domain authentication between IoT devices.

[0054] Specifically, step 1) includes the following steps:

[0055] Step 1.1: An MQTT topic is a string separated by backslashes / , used to represent multiple levels of hierarchy. Based on the communication module type, it is divided into the following three types: ZigBee, RF, and ZWave, which represent three different communication modules.

[0056] Step 1.2: Based on different functions, the three communication modules above are divided into levels. Register and UnRegister represent the registration and deregistration of IoT devices on the gateway. Report represents uploading information to the Hyperledger Fabric consortium blockchain management system. Control represents the control of IoT devices. The final division is based on the type of IoT / ZigBee / Report.

[0057] Specifically, step 2) includes the following steps:

[0058] Step 2.1: Each trust domain generates a large prime number n through negotiation, and uses n to generate the elliptic curve group G and the generator P;

[0059] Step 2.2: Each trust domain generates its own public and private keys using elliptic curve cryptography;

[0060] Step 2.3: Publish the system parameters and public keys of the trust domains to the Hyperledger Fabric consortium blockchain management system, and deploy chaincode to allow each trust domain to query the public keys and information about various IoT devices and gateways. The deployed chaincode is as follows:

[0061]

[0062] The first line of the formula is for deploying the chaincode for the IoT device, the second line is for deploying the chaincode for the gateway, -N represents the name of the chaincode, -v represents the version, and -p represents the path of the chaincode.

[0063] Specifically, step 3) includes the following:

[0064] IoT devices and gateways obtain their respective public and private keys through registration and call the above chaincode to upload their information to the blockchain. "device" refers to the IoT device and "gateway" refers to the gateway.

[0065] Specifically, step 4) includes the following steps:

[0066] Step 4.1 When the IoT device in gateway g1 performs cross-domain authentication to the IoT device d2 in gateway g2:

[0067] Choose a random number k, C g1-g2 =E pukg2 (content) (2)

[0068] Gateway g1 first selects a random number k, C g1-g2 This indicates that the transmitted message `content` is encrypted using the public key `pukg2` of gateway `g2`. pukg2 This indicates that encryption is performed using the public key pukg2;

[0069] Step 4.2: Gateway g1 uses its private key to sign the relevant information:

[0070] zg1-g2 =h(ID) g1 C g1-g2 ,Tstamp g1-g2 (3)

[0071] (x g1-g2 y g1-g2 )=kG (4)

[0072] r g1-g2 =x g1-g2 modn (5)

[0073] s g1-g2 =k -1 (z g1-g2 +d g1-g2 r g1-g2 )modn (6)

[0074] Tstamp g1-g2 Represents timestamp, ID g1 This represents the identity identifier of gateway g1, where h represents the hash algorithm, and gateway g1 will use the signed information r g1-g2 s g1-g2 and encrypted content C g1-g2 Verification is performed using the public key of gateway g2 via the Hyperledger Fabric consortium blockchain management system. The encrypted data is then sent to g2 via MQTT, where n represents a large prime number and x... g1-g2 y g1-g2 Let z represent a point in the elliptic curve group G. g1-g2 d represents the result after hash encryption. g1-g2 Let r represent a random number in the range [1, n]. g1-g2 s g1-g2 A pair of digital signatures representing an elliptic curve.

[0075] Step 4.3: Gateway g2 verifies the Hyperledger Fabric consortium blockchain by querying and authenticating through the Hyperledger Fabric consortium blockchain management system and by receiving information via MQTT. If the verification is successful, cross-domain communication is initiated.

[0076]

[0077]

[0078] (x' g1-g2 ,y' g1-g2 )=u g1-g2 1G+u g1-g2 2Q g1 ,check x' g1-g2 =r g1-g2mod n (9)

[0079] In the formula u g1-g2 1, u g1-g2 2 indicates that decoding the signature produces intermediate data within the range [1, n], x' g1-g2 ,y' g1-g2 The points in the elliptic curve group after decoding the signature represent the verification of the gateway g1 signature. If the verification is successful, the cross-domain authentication is completed.

[0080] Specifically, the Hyperledger Fabric consortium management system defines a unique ID for each IoT device gateway. This ensures that the fingerprint of all information about the IoT device gateway, from registration to access, is stored in the Hyperledger Fabric consortium chain management system, guaranteeing that the information of the IoT device gateway is not tampered with. The information of IoT devices in the Hyperledger Fabric consortium management system is queried and synchronized via chaincode. The gateway supports various communication protocols and data types for different IoT devices, enabling data format conversion between various IoT devices and uploading data in a unified format. Received acquisition or control commands are mapped to generate messages that meet the specific communication protocols of the IoT devices.

[0081] The beneficial effects of this invention are as follows: The strong-trust cross-domain authentication application system proposed in this invention integrates technologies such as the Internet of Things (IoT), MQTT, and Hyperledger Fabric consortium blockchain. It uploads IoT device gateway information to the blockchain, constructing a strong-trust endorsement cross-domain access capability with immutable and unforgeable IoT device gateway information. The solution of this invention utilizes the secure encryption mechanism of the consortium blockchain and the characteristics of transparent and immutable records, overcoming many shortcomings of centralized cross-domain access systems.

[0082] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above features and other objects, characteristics and advantages of the present invention more obvious and understandable, the following are the accompanying drawings and specific embodiments of the present invention. Attached Figure Description

[0083] Figure 1 is a schematic diagram of the basic functional structure of the IoT cross-domain authentication scheme of consortium blockchain and MQTT according to an embodiment of the present invention;

[0084] Figure 2 is a schematic diagram of the technical architecture of the present invention;

[0085] Figures 3 and 4 are schematic diagrams and flowcharts of the IoT cross-domain authentication scheme of consortium blockchain and MQTT according to an embodiment of the present invention;

[0086] Figure 5 is an IoT topology diagram of the present invention. Detailed Implementation

[0087] Example 1: An IoT cross-domain authentication scheme based on Hyperledger Fabric consortium blockchain and MQTTD, as shown in Figures 1 and 2, includes three parts: IoT system, MQTT, and Hyperledger Fabric consortium blockchain management system;

[0088] The Internet of Things (IoT) system is used for communication between IoT devices and for the transmission and collection of information between IoT devices.

[0089] The MQTT communication model is based on a publish / subscribe pattern. Each module only needs to be connected to the bus. Each module only needs to listen to the topics it is interested in to receive the corresponding data. After a client connects to the MQTT bus, it needs to register the topics it is interested in. Other clients (modules) send messages to these topics, and the messages will be received by the subscribers.

[0090] $iot / v1 / ZigBee / Register

[0091] $iot / v1 / ZigBee / UnRegister

[0092] $iot / v1 / RF / Register

[0093] $iot / v1 / RF / UnRegister

[0094] $iot / v1 / ZWave / Register

[0095] $iot / v1 / ZWave / UnRegister

[0096] The Hyperledger Fabric consortium blockchain management system is built on Fabric version 1.4. Leveraging the distributed storage, peer-to-peer transmission, transparency, and immutability of blockchain, the system allows IoT device and gateway information to be submitted through transactions, with participating nodes in the Hyperledger Fabric consortium blockchain verifying and uploading the data. Elliptic curve digital signatures in the Hyperledger Fabric consortium blockchain ensure non-repudiation of information, enabling data uploading and guaranteeing information integrity. The system provides web-based access and interacts with the Hyperledger Fabric consortium blockchain via the fabric-node-sdk client interface. It is constructed through collaboration among participating parties in the trust domain.

[0097] The IoT device registration algorithm of the Hyperledger Fabric consortium blockchain management system is as follows:

[0098] vardevice=Device{DeviceType:args[1],args[2],PublicKey:args[4],

[0099] keyvalue:m,PermissionType:args[6],privace:n,DeviceSwitch:args[8],

[0100] DeviceFunction:l}

[0101] deviceAsBytes,_=json.Marshal(device)

[0102] APIstub.PutState(args[0],deviceAsBytes)

[0103] The IoT cross-domain authentication scheme based on consortium blockchain and MQTT is characterized in that MQTT can publish and subscribe to topics, connecting each process and controlling the transmission of data through topics. The relevant MQTT configuration is as follows:

[0104] public final String TAG="MQTT";

[0105] private MqttAndroidClient mqttAndroidClient;

[0106] private MqttConnectOptions mMqttConnectOptions;

[0107] public String MQTT_HOST="tcp: / / xxx.xxx.xxx.xxx:1883";

[0108] publicStringMQTT_UserName="admin";

[0109] publicStringMQTT_PassWord="admin";

[0110] publicintMQTT_ConnectionTimeout=10;

[0111] publicintKeepAliveIntervalTime=20;

[0112] publicbooleanCleanSession=true;

[0113] publicStringSubscribe_Topic="androidTopic";

[0114] publicStringEndWillMsgPublish_Topic="EndWillMsg";

[0115] publicstaticStringRESPONSE_TOPIC="message_arrived";

[0116] The IoT cross-domain authentication scheme based on consortium blockchain and MQTT is characterized by the following IoT device structure in the Hyperledger Fabric consortium blockchain management system:

[0117]

[0118] The IoT cross-domain authentication scheme based on consortium blockchain and MQTT is characterized by the following gateway structure of the Hyperledger Fabric consortium blockchain management system:

[0119]

[0120] In other words, the IoT cross-domain authentication scheme based on consortium blockchain and MQTT in this invention comprises three parts: an IoT system, MQTT, and a Hyperledger Fabric consortium blockchain management system. This invention applies consortium blockchain technology to the IoT device gateway registration and writing scenario. After the IoT device gateway's information data is stored in this system, all trust domains participating in the Hyperledger Fabric consortium blockchain can view the relevant information of the IoT device gateway, and the information cannot be tampered with. The information stored on the system allows for easy querying of each piece of information data from the IoT device gateway, and avoids the threat of single-point data attacks. The Fabric consortium blockchain technology provides a new solution to the cross-domain authentication problem in the IoT, bringing more information value to cross-domain access.

[0121] This invention presents an IoT cross-domain authentication scheme based on consortium blockchain and MQTT, which organically combines IoT, MQTT, consortium blockchain and other technologies. By leveraging the technical advantages of consortium blockchain, it solves the problem of closed construction in traditional IoT, addresses the cross-domain trust problem in IoT from the source, and provides technical support for strong trust endorsement for each trust domain.

[0122] This invention applies consortium blockchain technology to IoT cross-domain authentication scenarios. It ensures that after relevant data records for the IoT cross-domain authentication process are uploaded to the consortium blockchain, all participating trust domains can view the relevant information for each process, and this information cannot be tampered with. This invention proposes a strong-trust IoT cross-domain authentication application system integrating IoT, MQTT, and consortium blockchain technologies. It uploads IoT device gateway-related data to the blockchain, constructing a strong trust endorsement capability that ensures the key information of the entire IoT cross-domain authentication process is tamper-proof and unforgeable. The solution of this invention utilizes the strong security encryption mechanism and the characteristics of transparent and tamper-proof records of consortium blockchains, overcoming many shortcomings of centralized cross-domain authentication systems.

[0123] Optionally, as shown in Figure 2, the MQTT can connect various processes such as IoT device registration and cross-domain access.

[0124] The IoT cross-domain authentication scheme based on consortium blockchain and MQTT is characterized in that the MQTT topic is a string separated by backslashes / to represent multi-level hierarchies. Based on the communication module type, it is divided into three types: ZigBee, RF, and ZWave. These represent three different communication modules, as shown in Figure 2. According to different functions, the above three communication modules are further hierarchically divided: Register and UnRegister represent the registration and deregistration of IoT devices on the gateway; Report represents uploading information to the Hyperledger Fabric consortium blockchain management system; and Control represents the control of IoT devices. Finally, the topic is divided into IoT / ZigBee / Report types.

[0125] In the MQTT framework, Proc_Bridge indicates that instructions received from the Hyperledger Fabric consortium link are forwarded to the gateway system, and information received from the system is forwarded to the Hyperledger Fabric consortium link. Proc_DevMgr indicates that IoT device management functions are performed, including adding (joining) and deleting (unjoining) IoT devices. Proc_Protocol indicates that the unified communication protocol at the application layer is converted into different types of wireless communication protocols and sent to the corresponding wireless modules. It converts the different types of wireless communication protocols reported by IoT devices into the unified communication protocol at the application layer. Proc_Auto indicates that an independent module handles various calculations. Each wireless communication module, such as Proc_ZigBee, Proc_Xxx, and Proc_ZWave, communicates with the CPU of the gateway through a serial port or other hardware connection. Therefore, each wireless communication module requires a corresponding module for processing.

[0126] The MQTT example described illustrates how data flows through topics: First, the Proc_Bridge module receives the control command from the Hyperledger Fabric consortium blockchain management system and sends it to the topic $iot / v1 / Device / Control on the message bus. Since the Proc_Protocol module subscribes to this topic, it immediately receives the command. Proc_Protocol analyzes the command content, identifies it as a ZigBee IoT device, performs protocol conversion, and sends a ZigBee control command to the topic $iot / v1 / ZigBee / Control on the message bus. Since the Proc_ZigBee module subscribes to this topic, it receives the control command. Proc_ZigBee then converts the control command into the format required by the ZigBee wireless communication module and sends it to the IoT device via hardware.

[0127] The MQTT IoT device data reporting scenario is as follows: After the IoT device is turned on, it reports information to the Proc_ZWare module via wireless communication. The Proc_ZWare module receives the data reported by the ZWare433 communication module and sends the "IoT device turned on" information to the topic on the message bus: $iot / v1 / ZWare / Report. Since the Proc_Protocol module subscribes to this topic, it receives the reported IoT device data. Proc_Protocol analyzes the data, converts the ZWare433 protocol data into unified application layer protocol data, and sends it to the topic on the message bus: $iot / v1 / Device / Report. Since the Proc_Bridge module subscribes to this topic, it receives this reported data. The Proc_Bridge module then reports the data to the Hyperledger Fabric consortium blockchain management system.

[0128] Optionally, the Hyperledger Fabric consortium blockchain management system uses a consortium blockchain consensus mechanism to establish a trusted IoT cross-domain authentication application system. By leveraging the distributed storage, peer-to-peer transmission, consensus, and immutability characteristics of the consortium blockchain, it unites participants from various trusted domains to build a trusted IoT cross-domain authentication Hyperledger Fabric consortium blockchain management system. This system verifies and uploads IoT system and IoT device gateway information to the blockchain through joint verification by the system's participants.

[0129] Optionally, as shown in Figures 3 and 4, the Hyperledger Fabric consortium blockchain management system is built on the Fabric consortium blockchain version 1.4. The IoT device gateway provides web page access and registration, and through the Hyperledger Fabric consortium blockchain management system, identity authentication is performed to achieve collaborative cooperation based on cross-domain authentication according to the trust domain.

[0130] The IoT cross-domain authentication uses the Hyperledger Fabric consortium blockchain and deploys Go-language version of chaincode within it.

[0131] The Hyperledger Fabric consortium blockchain's IoT cross-domain authentication system uses the Hyperledger Fabric consortium blockchain. It publishes system parameters and the public keys of trusted domains to the Hyperledger Fabric consortium blockchain management system, and deploys chaincode to allow each trusted domain to query the public keys and information about various IoT devices and gateways. The deployed chaincode is as follows:

[0132]

[0133] The first line of the formula is for deploying the chaincode for the IoT device, the second line is for deploying the chaincode for the gateway, -N represents the name of the chaincode, -v represents the version, and -p represents the path of the chaincode.

[0134] The Hyperledger Fabric consortium blockchain's IoT cross-domain authentication system is shown in the cross-domain authentication steps in Figure 3. The specific implementation steps are as follows:

[0135] Step 1: When an IoT device in gateway g1 performs cross-domain authentication to an IoT device d2 in gateway g2:

[0136] Choose a random number k, C g1-g2 =E pukg2 (content) (2)

[0137] Gateway g1 first selects a random number k, C g1-g2 This indicates that the transmitted message `content` is encrypted using the public key `pukg2` of gateway `g2`. pukg2 This indicates that encryption is performed using the public key pukg2;

[0138] Step 2: Gateway g1 uses its private key to sign the relevant information:

[0139] z g1-g2 =h(ID) g1 C g1-g2 ,Tstamp g1-g2 (3)

[0140] (x g1-g2 y g1-g2 )=kG (4)

[0141] r g1-g2 =x g1-g2 modn (5)

[0142] s g1-g2 =k -1 (z g1-g2 +d g1-g2 r g1-g2 )mod n (6)

[0143] Tstamp g1-g2 Represents timestamp, ID g1 This represents the identity identifier of gateway g1, where h represents the hash algorithm, and gateway g1 will use the signed information r g1-g2 s g1-g2 and encrypted content C g1-g2 Verification is performed via Hyperledger Fabric consortium blockchain query using the public key of gateway g2, encrypted and sent to network g2 via MQTT. Here, n represents a large prime number, and x... g1-g2 y g1-g2 Let z represent a point in the elliptic curve group G. g1-g2 d represents the result after hash encryption. g1-g2 Let r represent a random number in the range [1, n]. g1-g2 s g1-g2 A pair of digital signatures representing an elliptic curve.

[0144] Step 3: Gateway g2 verifies the Hyperledger Fabric consortium blockchain by querying and authenticating the system and receiving information via MQTT. If the verification is successful, cross-domain communication is initiated.

[0145]

[0146]

[0147] (x' g1-g2 ,y' g1-g2 )=u g1-g2 1G+u g1-g2 2Q g1 ,check x'g1-g2 =r g1-g2 mod n (9)

[0148] In the formula u g1-g2 1, u g1-g2 2 indicates that decoding the signature produces intermediate data within the range [1, n], x' g1-g2 ,y' g1-g2 The points in the elliptic curve group after decoding the signature represent the verification of the gateway g1 signature. If the verification is successful, the cross-domain authentication is completed.

[0149] Optionally, the Hyperledger Fabric consortium blockchain management system allows each trust domain to upload IoT device gateway data to the system. The relevant data is encrypted and verified using hash functions and elliptic curve ECC asymmetric encryption algorithms to achieve data on-chain, ensuring that participants in each trust domain of the entire system can transparently view relevant information, and that the large-capacity fingerprints cannot be tampered with.

[0150] In this invention, IoT devices are blockchain-enabled. For participants in the trusted domain, the system registers IoT device data with a gateway using blockchain technology. The gateway acquires the capabilities and permissions of the IoT device, generates a local key pair for the IoT device, and then signs it with its private key to complete the registration within the domain. The gateway sends a registration request to its trusted domain, including the IoT device's identity, function list, and permissions. After checking the gateway's signature, the trusted domain generates a key pair for the IoT device. Upon confirmation from the gateway, the trusted domain registers the IoT device using the IoT device registration contract.

[0151] Optionally, the Hyperledger Fabric consortium blockchain management system supports converting the queried data into hash values ​​and then comparing them with the information stored in the system to ensure the authenticity of the information.

[0152] Optionally, as shown in Figure 5, the IoT topology of the Hyperledger Fabric consortium blockchain's IoT cross-domain authentication system consists of IoT devices connecting to the network via a wireless network, IoT servers securely transmitting various information, gateways authenticating IoT devices, clients inputting information, and Hyperledger Fabric consortium blockchain nodes providing security protection for IoT device gateways and cross-domain authentication information.

[0153] Optionally, in the IoT topology of the Hyperledger Fabric consortium blockchain's IoT cross-domain authentication system, the information of each IoT device gateway is securely encrypted and transmitted through the Internet of Things server to achieve data privacy protection, ensure that the information between the IoT device gateway and the Hyperledger Fabric consortium blockchain management system is not leaked during information transmission, and guarantee the security of the entire data transmission.

[0154] In this invention, for cross-domain access by IoT devices, the IoT device uses its private key and a random number to complete a signature and encryption. Then, the gateway's public key is used to encrypt the random number. Upon receiving the encryption, the gateway first decrypts it using its own identity to obtain the IoT device's signature and identity. Then, the gateway verifies the IoT device's identity. If the IoT device's identity conforms to the access control, the gateway negotiates a session key with it to initiate communication.

[0155] Compared with existing technologies, this invention mainly solves the problems of different authentication modes, different certificate forms, and low efficiency in different systems, and provides an efficient, simple and reliable cross-domain authentication process. At the same time, the consortium blockchain + MQTT + IoT cross-domain authentication system not only provides a data collection and storage mechanism for IoT devices and gateways, but also provides a transparent, decentralized and tamper-proof secure environment to effectively perform IoT cross-domain authentication between IoT devices.

[0156] The specific embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. An IoT cross-domain authentication system based on consortium blockchain and MQTT, characterized in that, This system comprises an Internet of Things (IoT) system, MQTT, and a Hyperledger Fabric consortium blockchain management system. The IoT system facilitates communication and information transfer / collection between IoT devices. The MQTT communication model is based on a publish / subscribe pattern; each module only needs to connect to the bus to subscribe to / publish relevant information. After connecting, each module only needs to subscribe to its desired topics to receive corresponding data. When a client connects to the MQTT bus, it needs to register its desired topics. Other clients can send messages to these topics via the bus, which will be received by subscribers. The Hyperledger Fabric consortium blockchain management system acts as a trust domain, providing trust endorsement for the identity and capabilities of devices it controls. As a complete node in the Hyperledger Fabric consortium blockchain management system, it endorses and agrees on information published on the chain, provides real-time sharing of authentication information, and performs basic query and write functions within the system. Nodes negotiate and publish smart contracts and implement complex functions by calling these contracts. The IoT system is responsible for collecting relevant information from IoT devices. MQTT connects the IoT system and the Hyperledger Fabric consortium blockchain management system through topic division. The Hyperledger Fabric consortium blockchain management system verifies and uploads information collected by the IoT system to the blockchain via MQTT topics, and also verifies and uploads cross-domain authentication between IoT devices. The IoT system includes sensors, gateways, and a data processing center. Sensors collect relevant information about IoT devices, including their functions, device types, and operating status. Gateways are the central nodes for communication between all IoT devices and also act as relay nodes between the internal and external networks, connecting various smart IoT devices to the internet. Gateways also act as protocol converters; if the "input" and "output" IoT devices use different wireless communication protocols, the gateway performs protocol conversion, determines the target IoT device's wireless communication protocol, and finally sends instructions to the corresponding topic communication module, which then transmits the control commands to the IoT devices via radio signals. The data processing center uploads relevant data from IoT devices and gateways to the Hyperledger Fabric consortium blockchain management system for querying and authentication. MQTT publishes and subscribes to topics, connecting each process and transmitting data through topics to control commands.The Hyperledger Fabric consortium blockchain management system utilizes the distributed storage, peer-to-peer transmission, transparency, and immutability of blockchain technology. Information related to IoT devices and gateways is submitted through transactions, and participating nodes in the Hyperledger Fabric consortium blockchain management system verify and upload this information to the blockchain.

2. A cross-domain authentication method for the Internet of Things based on consortium blockchain and MQTT, characterized in that, Includes the following steps: 1) Divide the corresponding MQTT topics according to system needs; 2) Initialize the Hyperledger Fabric consortium blockchain management system; 3) Upload information of IoT devices and gateways to the blockchain; 4) Perform cross-domain authentication between IoT devices; Step 1) includes the following steps: Step 1.1: The MQTT topic is a string separated by backslashes / , used to represent multi-level hierarchies. Based on the communication module type, it is divided into three types: ZigBee, RF, and ZWave, representing three different communication modules; Step 1.2: Based on different functions, hierarchical division is performed under the above three communication modules. Register and UnRegister represent the registration and deregistration of IoT devices on the gateway, and Report represents uploading information to Hyperledger. The Hyperledger Fabric consortium blockchain management system, where Control represents the control of IoT devices, and the final topic is divided into IoT / ZigBee / Report types; Step 2) includes the following steps: Step 2.1: Each trust domain negotiates to generate a large prime number n, and uses n to generate an elliptic curve group G and a generator P; Step 2.2: Each trust domain generates its own public and private keys through elliptic curves; Step 2.3: The system parameters and the public keys of the trust domains are published to the Hyperledger Fabric consortium blockchain management system, and chaincode is deployed to allow each trust domain to query the public keys and information about each IoT device and gateway. The deployed chaincode is as follows: (1) The first line in the formula is the chaincode deployment for the IoT device, the second line is the chaincode deployment for the gateway, -N represents the name of the chaincode, -v represents the version, and -p represents the path of the chaincode; Step 4) includes the following steps: Step 4.1 When the IoT device in gateway g1 performs cross-domain authentication to the IoT device d2 in gateway g2: ， (2) Gateway g1 first selects a random number k, This indicates that the transmitted message `content` is encrypted using the public key `pukg2` of gateway `g2`. pukg2 This indicates that the public key pukg2 is used for encryption; step 4.2: Gateway g1 uses its own private key to sign the relevant information: （3） （4） （5） (6) Tstamp g1-g2 Represents timestamp, ID g1 This represents the identity identifier of gateway g1, where h represents the hash algorithm. Gateway g1 will then sign the information. ， and encrypted content Verification is performed using the public key of gateway g2 via the Hyperledger Fabric consortium blockchain management system. The encrypted data is then sent to g2 via MQTT, where n represents a large prime number and x... g1-g2 y g1-g2 Let z represent a point in the elliptic curve group G. g1-g2 d represents the result after hash encryption. g1-g2 Represents a random number within the range [1, n]. ， A pair of digital signatures representing an elliptic curve; Step 4.3: Gateway g2 verifies the authentication by querying the Hyperledger Fabric consortium blockchain management system and receiving information via MQTT. If the verification is successful, cross-domain communication is initiated. （7） （8） ， (9) In the formula ， This indicates that decoding the signature produces intermediate data within the range [1, n]. The points in the elliptic curve group after decoding the signature represent the verification of the gateway g1 signature. If the verification is successful, the cross-domain authentication is completed.

3. The IoT cross-domain authentication method based on consortium blockchain and MQTT according to claim 2, characterized in that, Step 3) includes the following: IoT devices and gateways obtain their respective public and private keys through registration and call the above chaincode to upload their information to the chain. Device refers to IoT device and gateway refers to gateway.

4. The IoT cross-domain authentication method based on consortium blockchain and MQTT according to claim 2, characterized in that, The Hyperledger Fabric consortium management system defines a unique ID for each IoT device gateway. This ensures that the fingerprint of all information about the IoT device gateway, from registration to access, is stored in the Hyperledger Fabric consortium chain management system, guaranteeing that the information of the IoT device gateway is not tampered with. The information of IoT devices in the Hyperledger Fabric consortium management system is queried and synchronized via chaincode. The gateway supports various communication protocols and data types for different IoT devices, enabling data format conversion between various IoT devices and uploading data in a unified format. It also maps received acquisition or control commands into messages that satisfy the specific communication protocol of the IoT device.

Images