Mutual authentication and secure communication method and system between internet of things devices

Abstract

The application belongs to the technical field of Internet of Things, and discloses a mutual authentication and secure communication method and system between Internet of Things devices; in an initialization stage, a system administrator performs initialization, and generates and distributes a master key and registers a fog node; in a registration stage, registration of all Internet of Things devices is performed, and all Internet of Things devices are registered at a nearest fog node, and identity information after registration is attached to a block chain in the form of a transaction; in an authentication stage, a secure channel is established and information sharing is performed after identity authentication when two Internet of Things devices communicate. With the aid of block chain technology and fog computing technology, a distributed trust mechanism is adopted to replace a central trust mechanism, so that authentication between devices is simpler and safer; the block chain technology is fused with fog computing to solve a data delay problem in access control; authentication and communication between devices are lightweight, have anonymity and controllability, and can resist various attacks.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of Internet of Things, and particularly relates to a mutual authentication and secure communication method and system between Internet of Things devices. BACKGROUND

[0002] At present, the introduction of fog computing makes the application prospect of Internet of Things (IoT) technology in various scenarios become more and more extensive, and more and more devices are connected to the Internet. Fog computing technology, as an enabling technology, interconnects intelligent and automatically configurable devices to establish an efficient and dynamic platform. Internet of Things technology has almost penetrated into all aspects of life, from smart home, smart medical care to smart city, and life is convenient, while data security becomes more and more important, and identity authentication and access control between various communication entities are an important part. For example, in the smart home scenario, sensors collect data of various devices and analyze them, and give early warning to abnormal behavior, and if some sensitive devices are invaded by illegal devices or personnel, the operation of the Internet of Things system will be seriously disturbed, and even a major security incident will be caused. The security of the Internet of Things system is divided into the following aspects: data aggregation, confidentiality, integrity, availability and non-repudiation. Among them, identity authentication and access control are the first line of defense, which limits data access to only those who have the correct permissions. Mutual authentication between Internet of Things devices and other systems is an important part of a secure Internet of Things system, and unauthorized access control will bring various security risks to the system.

[0003] The current mutual authentication and secure communication method between Internet of Things devices usually has the following defects: 1) they are based on a centralized architecture, which is not conducive to the expansion of the network edge, and at the same time, relying on the registration authority cannot get rid of the single point failure problem; 2) the authentication between devices needs the participation of the cloud. In the authentication process between the two parties, data needs to be transmitted to the cloud for processing, and cloud processing will cause data delay, which is contrary to the delay-sensitive characteristics of Internet of Things.

[0004] In view of the fact that the traditional authentication method between Internet of Things devices is centralized and not sensitive to delay, it is necessary to design an effective authentication and secure communication method between Internet of Things devices.

[0005] Through the above analysis, the problems and defects of the prior art are:

[0006] (1) The current mutual authentication and secure communication method between Internet of Things devices is based on a centralized architecture, which is not conducive to the expansion of the network edge, and at the same time, relying on the registration authority cannot get rid of the single point failure problem.

[0007] (2) The authentication between devices needs the participation of the cloud; in the authentication process between the two parties, data needs to be transmitted to the cloud for processing, and cloud processing will cause data delay, which is contrary to the delay-sensitive characteristics of Internet of Things. SUMMARY

[0008] In view of the problems of the prior art, the present application provides a mutual authentication and secure communication method and system between Internet of Things devices.

[0009] The mutual authentication and secure communication method between Internet of Things devices is as follows: the scheme designed by the present application mainly consists of three parts: a fog layer enabled with a blockchain, a device layer, and a system administrator. Each Internet of Things system has a corresponding fog node, which is closest to the system and is used for registration and authentication of Internet of Things devices belonging to the same system. When an Internet of Things device joins the network, it will first register with its corresponding fog node enabled with a blockchain. The registration information of these devices is stored in the data center (DC) for subsequent authentication phase. In the inventive design of the present application, a device can only communicate with devices that have been registered and authenticated in the fog node enabled with a blockchain. Devices that are not registered on the fog node cannot be authenticated, so they are not allowed to communicate with unauthenticated devices, whether they belong to the same environment or belong to another Internet of Things environment. This will reduce the possibility of malicious devices interacting with legitimate devices. In addition, the device can only be registered to one fog node enabled with a blockchain.

[0010] The data center is used to store all Internet of Things device related information, including registration information, product information, etc., and all information is stored in encrypted form. In the proposed authentication mechanism, all fog nodes share a DC. The DC communicates with all fog nodes through a secure channel. The DC has rich computing and storage resources, and in the network model of the present application, the DC only serves to store information and does not participate in the authentication logic, so the present application removes the data center from the inventive model.

[0011] The mutual authentication and secure communication method between Internet of Things devices includes the following steps: in the initialization phase, the system administrator performs initialization for the generation and distribution of master keys and the registration of fog nodes; in the registration phase, the registration phase is mainly responsible for the registration of all Internet of Things devices. All Internet of Things devices need to register with the nearest fog node before participating in communication. After registration, the identity information of the device is saved in the data center, and the identity information of the device can be easily retrieved through the address pointer address saved on the blockchain; in the authentication phase, before two Internet of Things devices communicate, a secure channel is established and information is shared after completing identity authentication.

[0012] Further, the mutual authentication and secure communication method between Internet of Things devices further comprises:

[0013] Internet of Things device D iInitiate an authentication request to the nearby fog node; the fog node checks the freshness of the message, checks the information of the IoT device, and forwards the message to the IoT device D j Initiate an authentication request; the IoT device D j Check freshness, calculate relevant authentication variables, and send a response message to the nearest fog node; the fog node checks the freshness of the message and completes the authentication of the IoT device D i and D j , and forwards the message to D i ; the IoT device D i checks the freshness of the message and completes the authentication of the IoT device D j , updates the authentication variables, and establishes a secure connection for communication.

[0014] Further, the mutual authentication and secure communication method between IoT devices includes the following steps:

[0015] Step one, initialization phase: when the system starts, the system administrator performs initialization and generates and distributes the master key, and registers the fog node;

[0016] Step two, registration phase: all IoT devices need to be registered in the nearest fog node, and the identity information after registration is attached to the blockchain in the form of a transaction;

[0017] Step three, authentication phase: two smart devices perform mutual authentication before communicating, and then complete subsequent data exchange and collaborative sharing.

[0018] Further, the initialization phase in step one includes:

[0019] (1) Generate the master key K f ;

[0020] (2) The system manager is responsible for registering the fog node and storing K f in the memory of the fog node.

[0021] Further, the registration phase in step two includes: the IoT device D i selects the nearest fog node Fog for registration and submits a registration request, which includes:

[0022] (1) The fog node Fog selects an identity ID i , a random number a i and m i for the IoT device D i , and calculates X i = m i ⊕K f , Y i = h(m iK f ), Z i = ID i ⊕h(m i , K f );

[0023] (2) The fog node Fog sends the triple (IDi, Zi, ai) to the DC for storage; the DC broadcasts the memory pointer Pi to all blockchain nodes, Pi points to the memory address of the registration information in the DC, and (IDi, Zi, ai) is retrieved through the pointer; the mining node packages the pointer into a block, and after completing the consensus process, the block is attached at the end of the blockchain;

[0024] (3) The fog node Fog sends the five-tuple (ID i , X i , Y i , a i , P i ) to the Internet of Things device D i through a secure channel, and the Internet of Things device D i stores the five-tuple in memory.

[0025] Further, the authentication phase in step three includes:

[0026] When the Internet of Things device D i wants to communicate with the Internet of Things device D j , then:

[0027] (1) D i → Fog: {X i , M1, M2, M3, T1}; the Internet of Things device D i first generates a random number n1 and a timestamp T1 to calculate the message M1 = Y i ⊕P, M2 = n1 ⊕ ID i , M3 = h(ID i , X i , M1, M2, n1, T1), and the Internet of Things device sends the message {X i , M1, M2, M3, T1} to the nearest fog node;

[0028] (2) Fog → D j : {M4, M5, Z i * , T2}; the fog node checks whether (T new -T1 < Δt) is satisfied, and if it is, the process continues, otherwise it is rejected; calculate m i * = X i ⊕K f , P i * = M1 ⊕ h(mi * K f ), while checking if the memory address of P * exists and is legal; if not, terminate the authentication, otherwise, according to the calculated memory address, query the ID i * Z i * a i * ; generate a random number n2 and a timestamp T2, calculate M4 = n2 © ID i * M5 = h(ID i * , M4, X i * n2, T2, K f ); the fog node broadcasts the message {M4, M5, Z i * , T2}, triggers the pre-defined smart contract rule, and the message is forwarded to the fog node away from D j 's home, and the message continues to be sent to the device D j ;

[0029] (3) D j → Fog: {X j , M6, M7, M8, T3}; the IoT device D j checks if (T new - T2 < Δt) is satisfied, if satisfied, continue the flow, otherwise, reject; D j generates a random number n3 and a timestamp T3, calculates M6 = Y j © P j , M7 = n3 © ID j , M8 = h(ID j , X j , M6, M7, n3, T3), and D j sends the message {X j , M6, M7, M8, T3} to the nearest fog node;

[0030] (4) Fog → D i : {M6, M 10 , M 11 , X i * , T4}; the fog node checks if (T new - T3 < Δt) is satisfied, if satisfied, continue the flow, otherwise, reject; calculate m i * = X i © K f , Y i* =h(m i * ,K f ID i **- =Z i * ⊕Y i * n1 * =M2⊕ID i ** M3 * =h(ID) i ** ,X i ,M1,M2,n1 * (T1), check M3==M3 *- If they are equal, the authentication process continues; otherwise, it terminates. Calculate m. j * =X j ⊕K f P j * =M1⊕h(m i * ,K f According to P j * Query D j Registration information triple (ID) j * Z j * ,a j * ); Calculate Y j * =h(m i * ,K f ID j **- =Z j * ⊕Y j * n3 * =M4⊕ID j ** M8 * =h(ID) j ** Z i ,M7,M8,n3 * ,T3), check M8==M8 * If they are equal, the authentication process continues; otherwise, it terminates. A random number n4 and a timestamp T4 are generated, and X is calculated. i new =n4⊕K f Yi new = h(n4, K f ), P = M1 I * = X i new h(n1 * , n3 * , ID i ** ), M 10 = X i new h(n3 * , n3 * , P), M 11 = X i new h(M4, M6, M7, ID I ** , T4); the fog node broadcasts the message {M4, M 10 , M 11 , X i * , T4}, triggers the pre-defined smart contract rule, and the message is forwarded to the fog node away from the D i home, and the message is continuously sent to the device D i ;

[0031] (5) Fog -> D i : After the Internet of Things device receives the message, the D i checks whether (T new -T4 < Δt) is satisfied, if satisfied, the process continues, otherwise, it is rejected; n2 * = M4 i is calculated, M 11 * = h(ID i , n2 * , T3, M4, M9, M 10 ) is calculated, and M 11 * == M 11 is judged; if equal, the Internet of Things device D I successfully authenticates D j , and simultaneously updates the authentication variable.

[0032] Another purpose of the present application is to provide an Internet of Things device mutual authentication and secure communication system between the Internet of Things devices applying the mutual authentication and secure communication method between the Internet of Things devices, the Internet of Things device mutual authentication and secure communication system between the Internet of Things devices comprising:

[0033] Device layer, including Internet of Things devices for sensing, driving and communication, devices perceive and generate data while transmitting data to other devices, Internet of Things devices are grouped according to system types;

[0034] Fog layer, including a blockchain-enabled fog node network, nodes work cooperatively through the Internet; each system and all corresponding smart devices are associated with the nearest blockchain-enabled fog node, and the blockchain-enabled fog nodes communicate with each other to synchronize data related to identity verification and authorization; smart contracts containing a set of rules are defined on the blockchain-enabled fog nodes; consensus algorithms are executed to create blocks for transactions; blockchain ledgers are shared among blockchain-enabled fog nodes to support distributed identity verification and authorization;

[0035] System administrator, responsible for generating and distributing master keys during the initialization phase, and registering fog nodes.

[0036] Another object of the present application is to provide a computer device comprising a memory and a processor, the memory storing a computer program, the computer program being executed by the processor to cause the processor to perform the steps of the mutual authentication and secure communication method between Internet of Things devices.

[0037] Another object of the present application is to provide a computer-readable storage medium storing a computer program, the computer program being executed by the processor to cause the processor to perform the steps of the mutual authentication and secure communication method between Internet of Things devices.

[0038] Another object of the present application is to provide an information data processing terminal for implementing the mutual authentication and secure communication system between Internet of Things devices.

[0039] In combination with the above technical solutions and the technical problems solved, the technical solutions of the present application have the following advantages and positive effects:

[0040] First, in view of the technical problems existing in the prior art and the difficulty of solving the problems, the technical solutions of the present application are closely combined with the results and data obtained during the research and development process, and the technical problems solved by the technical solutions are analyzed in detail and deeply. Some creative technical effects brought about after solving the problems are described as follows:

[0041] The application provides a mutual authentication and secure communication method between Internet of Things devices, which mainly realizes secure communication between two fog Internet of Things devices in a general Internet of Things scene, a first stage is an initialization stage, a system administrator performs initialization, and the system administrator is mainly responsible for generation and distribution of a master key and registration of a fog node; a second stage is a registration stage, which is used for registration of all Internet of Things devices, and all Internet of Things devices are registered at a nearest fog node, and identity information after registration is attached to a block chain in the form of a transaction; and a third stage is an authentication stage, when two Internet of Things devices want to communicate, identity authentication needs to be completed to establish a secure channel to share information. In the application, one Internet of Things device sends an authentication request to a fog node, the fog node verifies the identity of the Internet of Things device by using information stored by the Internet of Things device in the registration stage, thereby assisting in completing the authentication process, and the two Internet of Things devices open a secure channel to communicate after completing mutual identity authentication.

[0042] Secondly, from the perspective of the product or as a whole, the technical solution to be protected by the application has the technical effects and advantages described as follows:

[0043] The mutual authentication and secure communication method between Internet of Things devices provided by the application uses a distributed trust mechanism instead of a central trust mechanism by means of block chain technology and fog computing technology, solves the single-point failure problem, and makes the authentication between devices simpler and safer. The application fuses block chain technology and fog computing, solves the data delay problem in access control, the authentication and communication between devices are lightweight, and can resist various known attacks. The mutual authentication between devices of the application has anonymity and controllability.

[0044] Thirdly, as auxiliary evidence for the creativity of the claims of the application, the following important aspects are also embodied:

[0045] The expected income and commercial value of the technical solution of the application after transformation are as follows: with 5G+AIoT empowerment, Internet of Things technology is comprehensively innovated, more extensive bottom-layer interconnection protocols begin to be born, devices fully support more platforms, and the Internet of Everything has entered an AIoT empowerment period in recent years. Information security and privacy problems begin to attract more and more attention, and for a smart Internet of Things system, selecting a suitable identity authentication scheme is particularly important.

[0046] Consumer market analysis: in recent years, the shipment of various types of Internet of Things devices in China has been growing rapidly every year, and China has optimized the user scale, so the market prospect is immeasurable. According to the IDC report data, it is expected that the market shipment will exceed 80 billion US dollars in 2024. With the 80s and 90s gradually becoming the main force of the consumer market, personalization, comfort, convenience and fashion have become the common pursuit of the young consumer market. Based on these needs, there is great potential for intelligent Internet of Things industry in different scenarios. At the same time, because many data sent through the Internet (such as video data of cameras) are not encrypted, many sensitive information is publicly transmitted or stored on Internet accessible systems. Therefore, the present application needs to design a reasonable identity authentication and secure communication system. The present application is a lightweight identity authentication scheme, which takes into account authentication efficiency and system performance, while giving users privacy protection. Moreover, since the present application is a decentralized architecture, it is more in line with the development trend of the Internet of Things ecosystem today, so the consumer market of the technology converted by the present application is also clear. Business value and expected income analysis: through the above background and market analysis, it can be seen that the market prospect of the identity authentication and communication system designed to cope with various challenges in the Internet of Things scenario in the future is huge. Because the present application adopts a decentralized architecture and introduces fog computing to balance performance and security, the technology converted by the present application has great commercial value in the foreseeable future. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. Obviously, the drawings described below are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0048] Figure 1 is a flow chart of the mutual authentication and secure communication method between Internet of Things devices provided by the embodiments of the present application;

[0049] Figure 2 is a principle diagram of the mutual authentication and secure communication method between Internet of Things devices provided by the embodiments of the present application;

[0050] Figure 3 is a structure diagram of the mutual authentication and secure communication system between Internet of Things devices provided by the embodiments of the present application;

[0051] In the figure: ① Internet of Things device D i Initiate an authentication request to the nearby fog node; ② the fog node checks the message freshness, checks the information of the Internet of Things device, and the message is transmitted to the Internet of Things device D jInitiating an authentication request; ③ The Internet of Things device D j Checking freshness, calculating relevant authentication variables, and sending a response message to the nearest fog node; ④ The fog node checks the message freshness, completes the authentication of the Internet of Things device D i and D j at the same time, and passes the message forward to D i ; ⑤ The Internet of Things device D i checks the message freshness, completes the authentication of the Internet of Things device D j , updates the authentication variables, and at this time, a secure connection is established between the two parties for communication. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in combination with embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0053] In view of the problems existing in the prior art, the present application provides a mutual authentication and secure communication method and system between Internet of Things devices, which will be described in detail below in combination with the accompanying drawings.

[0054] As shown in Figure 1 , the mutual authentication and secure communication method between Internet of Things devices provided by the embodiments of the present application comprises the following steps:

[0055] S101, in the initialization phase, the system administrator initializes, generates and distributes the master key and registers the fog node;

[0056] S102, in the registration phase, all Internet of Things devices are registered, and all Internet of Things devices are registered in the nearest fog node. After registration, the identity information is attached to the blockchain in the form of a transaction;

[0057] S103, in the authentication phase, before two Internet of Things devices communicate, identity authentication is completed to establish a secure channel and share information.

[0058] The working principle of this invention is as follows: This invention primarily enables secure communication between two fog-connected devices in a general IoT scenario. Its working principle is as follows: The first stage is the initialization stage, where the system administrator performs initialization, mainly responsible for generating and distributing the master key and registering the fog node. The second stage is the registration stage, which is responsible for registering all IoT devices. All IoT devices register with the nearest fog node, and their identity information is attached to the blockchain in the form of a transaction after registration. The third stage is the authentication stage, where two IoT devices need to complete identity authentication before establishing a secure channel for information sharing. In this invention, one IoT device sends an authentication request to the fog node. The fog node verifies the identity of the IoT device using the information stored during the registration stage, thus assisting in the authentication process. After both IoT devices complete mutual identity authentication, they open a secure channel for communication.

[0059] As a preferred embodiment, such as Figure 2 As shown, the mutual authentication and secure communication method between IoT devices provided in this embodiment of the invention includes an initialization phase, a registration phase, and an authentication phase.

[0060] • Initialization Phase: When the system starts, the System Administrator (SA) performs initialization, mainly generating and distributing the master key, and registering fog nodes.

[0061] • Registration Phase: In this phase, all IoT devices need to register with the nearest fog node. Once registered, their identity information is attached to the blockchain in the form of a transaction.

[0062] • Authentication Phase: In this phase, two smart devices need to authenticate each other before they can communicate, in order to complete subsequent data exchange and collaborative sharing.

[0063] Initialization phase:

[0064] Generate master key K f ;

[0065] The system administrator is responsible for registering fog nodes and setting up K. f It is stored in the memory of the fog node.

[0066] Registration phase:

[0067] Internet of Things (IoT) i Let's assume that the nearest fog node, Fog, is selected for registration, and a registration request is submitted. The specific steps are as follows:

[0068] Fog node Fog represents IoT device D i Select an identity ID i A random number a i and m iand compute X i = m i ⊕K f , Y i = h(m i , K f ), Z i = ID i ⊕h(m i , K f ).

[0069] • The fog node Fog sends this triple (IDi, Zi, ai) to the DC for storage, and then the DC broadcasts the memory pointer Pi to all blockchain nodes, Pi points to the memory address of the registration information in the DC, through which (IDi, Zi, ai) can be retrieved. Then the mining node packages the pointer into a block, and after the consensus process is completed, this block will be attached to the end of the blockchain.

[0070] • The fog node Fog sends the five-tuple (ID i , X i , Y i , a i , P i ) to the Internet of Things device D i through a secure channel, and the Internet of Things device D i stores the five-tuple in its memory.

[0071] Authentication phase:

[0072] Since the communication between devices to fog and fog to fog mainly involves information sharing and identity verification synchronization of Internet of Things devices, the identity authentication between devices is mainly discussed in the authentication phase. The authentication mechanism proposed by the present application has five steps in total, assuming that the Internet of Things device D i wants to communicate with the Internet of Things device D j , the detailed process is as follows:

[0073] S1: D i → Fog: {X i , M1, M2, M3, T1}. The Internet of Things device D i first generates a random number n1 and a timestamp T1 to calculate M1 = Y i ⊕P, M2 = n1 ⊕ ID i , M3 = h(ID i , X i , M1, M2, n1, T1), and the Internet of Things device sends the message {X i , M1, M2, M3, T1} to the nearest fog node.

[0074] S2: Fog → D j : {M4, M5, Zi * , T2}. The fog node first checks if (T new -T1< At) is satisfied, if yes, continue the flow, otherwise reject. Next, the fog node computes m i * = X i ⊕K f , P i * =M1⊕h(m i * , K f ). Meanwhile, check if the memory address of P * exists and is legal. If not, terminate the authentication, otherwise, according to the memory address calculated above, query the ID i * , Z i * , a i * . Next, generate a random number n2 and a timestamp T2, compute M4 = n2⊕ID i * , M5 = h(ID i * , M4, X i * , n2, T2, K f ), and finally the fog node broadcasts the message {M4, M5, Z i * , T2}, triggering the pre-defined smart contract rules, the message is forwarded to the fog node that is home to D j , and then the message is sent to device D j .

[0075] S3: D j → Fog: {X j , M6, M7, M8, T3}. The IoT device D j first checks if (T new -T2< At) is satisfied, if yes, continue the flow, otherwise reject. Next, D j generates a random number n3 and a timestamp T3, computes M6 = Y j ⊕P j , M7 = n3⊕ID j , M8 = h(ID j , X j , M6, M7, n3, T3), and finally D j sends the message {X j , M6, M7, M8, T3} to the nearest fog node.

[0076] S4: Fog → D i:{M6,M 10 M 11 ,X i * The fog node first checks (T4). new If -T3 < Δt, check if the condition is met. If so, continue the process; otherwise, reject the query. Next, calculate m. i * =X i ⊕K f Y i * =h(m i * ,K f ID i **- =Z i * ⊕Y i * n1 * =M2⊕ID i ** M3 * =h(ID) i ** ,X i ,M1,M2,n1 * (T1), check M3==M3 *- If they are equal, the authentication process continues; otherwise, it terminates. Similarly, m can be calculated. j * =X j ⊕K f P j * =M1⊕h(m i * ,K f According to P j * Query D j Registration information triple (ID) j * Z j * ,a j * Next, calculate Y. j * =h(m i * ,K f ID j **- =Z j * ⊕Y j * n3 * =M4⊕ID j **, M8 * = h(ID j ** ,Z i , M7, M8, n3 * , T3), check M8 == M8 * , if equal, continue the authentication process, otherwise terminate. Finally, generate a random number n4 and a timestamp T4, compute X i new = n4 0 K f , Y i new = h(n4, K f ), P = M1 0 Y I * , M9 = X i new 0 h(n1 * , n3 * , ID i ** ), M 10 = X i new 0 h(n3 * , n3 * , P), M 11 = X i new 0 h(M4, M6, M7, ID I ** , T4), then the fog node broadcasts the message {M4, M 10 , M 11 , X i * , T4}, triggers the pre-defined smart contract rules, and the message is forwarded to the fog node that is closest to D i , then the message is sent to device D i .

[0077] S5: Fog -> D i : The IoT device receives the message, and D i first checks whether (T new - T4 < At) is satisfied, if satisfied, continues the flow, otherwise rejects. Compute n2 * = M4 0 ID i , compute M 11 * = h(ID i , n2 * , T3, M4, M9, M 10 ), judge M 11 * == M 11 . If equal, the IoT device D I is successfully authenticated Dj The authentication variable is updated at the same time.

[0078] As Figure 3 shown, the mutual authentication and secure communication system between Internet of Things devices provided by the embodiments of the present application is divided into three entity modules:

[0079] Device layer: This layer mainly contains Internet of Things devices for sensing, driving and communication. These devices perceive and generate data, which can be further transmitted to other devices, such as actuators. Internet of Things devices can be grouped according to system types. For example, in Figure 3 , there are different types of systems, and devices belonging to these systems can communicate with each other to provide value-added services.

[0080] Fog layer: This layer contains a blockchain-enabled fog node network, and these nodes work collaboratively through the Internet. Fog nodes are usually not owned by the same party. Each system and all its corresponding smart devices are associated with the nearest blockchain-enabled fog node. These blockchain-enabled fog nodes communicate with each other to synchronize data related to identity verification and authorization. Smart contracts containing a set of rules can also be defined on top of the blockchain-enabled fog nodes. Only when they meet the predefined strategy will it provide the necessary additional functions in terms of transaction execution. In addition, in order to verify transactions, consensus algorithms are executed, and blocks are created for these transactions. The blockchain ledger is shared among the blockchain-enabled fog nodes to support identity verification and authorization in a distributed manner.

[0081] System administrator: The system administrator (SA) is mainly responsible for the generation and distribution of master keys during the initialization phase. And responsible for the registration of fog nodes.

[0082] In order to prove the creativity and technical value of the technical solutions of the present application, this part is the application embodiment of the technical solutions of the claims on the specific product or related technology.

[0083] The specific idea in the commercial application instance of combining fog settlement and blockchain is to sink the network functions provided by the cloud server to the network edge. Compared with cloud computing, fog computing can effectively reduce the data transmission delay because the location deployment of fog servers is closer to network users. The distributed processing method adopted by fog computing not only can effectively alleviate the network congestion problem caused by a large amount of data flowing into the cloud, but also fits the distributed ledger technology of blockchain based on the Internet. The combination of fog computing and blockchain technology can effectively solve the problems of expensive transaction costs and easy data loss in centralized authentication methods.

[0084] In the already commercialized model SPF (Super Fog Computing Chain), they use a decentralized fog computing platform to build a network that can connect any computing-capable device in the world, and anyone can contribute or use the required computing power. At the same time, SPF has a blockchain of native protocol tokens, which can stimulate the two-way market between service providers and consumers. The SPF fog computing network is not composed of powerful servers, but of various types of "computers" with similar performance and more dispersed geographical locations, a semi-virtualized service computing architecture model. It makes the authentication and communication system in various scenarios have distributed characteristics while reducing costs and improving authentication efficiency.

[0085] The following table shows the security properties of the present application. F1 represents a theft attack, F2 represents an IoT device impersonation attack, F3 represents a man-in-the-middle attack, F4 represents a replay attack, F5 represents an IoT device capture attack, F6 represents a blocking attack, F7 represents anonymity, F8 represents untraceability, F9 represents mutual authentication, F10 represents offline password guessing attack, F11 represents mobile device stolen attack, and F12 represents forward / backward secrecy. The security properties of the present application and known solutions on the market are shown in Table 1. From the table, it can be seen that the protocol of the present application realizes more security properties and can resist various known attacks.

[0086] Table 1

[0087]

[0088] Note: Y has, N means not to have, N / A means not applicable.

[0089] Communication cost

[0090] Here, the total number of message exchanges in the authentication protocol is quantified to represent the communication cost of the present application. The present application assumes that the timestamp is 32 bits, the hash function uses the SHA-256 hash algorithm. The symmetric encryption and decryption block size is 128 bits, the point length on the group is 1024 bits, and the MAC length is 256 bits. The communication cost of each protocol is shown in Table 2. In scheme

[43] , the number of messages exchanged is 3, and the total communication cost required is (1824+588+544) = 2956 bits. The total communication cost required by schemes

[39] ,

[47] ,

[50] ,

[40] ,

[49] is 2688 bits, 3640 bits, 4672 bits, 4512 bits, and 1696 bits, respectively. In the scheme proposed in the present application, a total of 4 messages need to be transmitted, and the total calculation cost is 2716 bits.

[0091] Table 2

[0092]

[0093] Computational cost

[0094] In the quantification of the computational cost, the present invention uses the sum of the approximate execution time of various operations used in the invention to characterize. Assume that Th, Ted, Te, Tmac, Thamc, Tbp, Tme, Tsg, Tsv, Txor represent the operation time of hash function, message encryption / decryption, point multiplication operation on ECC, message authentication code, hash MAC, modular exponentiation operation, bilinear pair, signature generation and verification using ECDSA algorithm and XOR operation time respectively, since the operation time of hash function, hash authentication code and hash MAC is similar, the present invention assumes Th = Tmac = Thamc, and since the operation time of XOR operation is extremely short, it can be ignored, so Txor = 0. The present invention uses existing experimental data as the basis for calculation, and the execution time of each cryptographic primitive is summarized in Table 3.

[0095] Table 3

[0096]

[0097] In scheme

[43] , the execution time of the Internet of Things device is 1Th+1Ted=5.92, the execution time of the user mobile device is 12Th+3Ted+2Te=54.84ms, and the execution time of the fog node is 13Th+4Ted+2Te=60.76121.53ms. So the total computational cost is 121.52ms. Similarly, the present invention can calculate that the total computational cost in schemes

[39] ,

[47] ,

[50] ,

[40] ,

[49] is 55.480ms, 28.480ms, 456.80ms, 100.760ms and 40.820ms respectively. In the scheme proposed in the present invention, the total computational cost required is 24Th+19Txor=7.690ms.

[0098] Table 4

[0099]

[0100]

[0101] It should be noted that embodiments of the present application can be realized by hardware, software, or a combination of software and hardware. The hardware portion can be realized by a special logic; the software portion can be stored in a memory and executed by a proper instruction execution system, such as a microprocessor or a specially designed hardware. A person of ordinary skill in the art can understand that the above-mentioned apparatus and method can be realized by computer executable instructions and / or included in processor control codes, such as a carrier medium, such as a magnetic disk, CD or DVD-ROM, a programmable memory, such as a read-only memory (firmware), or a data carrier, such as an optical or electronic signal carrier. The apparatus of the present application and its modules can be realized by a hardware circuit, such as a very large scale integrated circuit or a gate array, a semiconductor, such as a logic chip, a transistor, or a programmable hardware device, such as a field programmable gate array, a programmable logic device, or the like, by software executed by various types of processors, or by a combination of the above-mentioned hardware circuit and software, such as firmware.

[0102] The above description is merely a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any modification, equivalent replacement, and improvement within the technical range disclosed by the present application, and within the spirit and principle of the present application, should be included in the protection scope of the present application.

Claims

1. A method for mutual authentication and secure communication between Internet of Things devices, characterized in that, In the initialization phase, the system administrator performs initialization for the generation and distribution of master keys and the registration of fog nodes; in the registration phase, the registration phase is mainly responsible for the registration of all Internet of Things devices, and all Internet of Things devices need to register with the nearest fog node before participating in communication, and the identity information of the device after registration is saved in the data center, and the address pointer address saved on the blockchain can easily retrieve the identity information of the device; in the authentication phase, when two Internet of Things devices communicate, a secure channel is established after identity authentication and information sharing is completed; The mutual authentication and secure communication method between Internet of Things devices comprises the following steps: Step one, initialization phase: when the system starts, the system administrator performs initialization and generates and distributes master keys, and registers the fog nodes; Step two, registration phase: all Internet of Things devices need to register with the nearest fog node, and the identity information after registration is attached to the blockchain in the form of a transaction; Step three, authentication phase: two smart devices communicate with each other before mutual authentication, and then complete subsequent data exchange and collaborative sharing; The registration phase in step two includes: the Internet of Things D i The device selects the nearest fog node Fog for registration, and submits a registration request, which specifically includes: (1) Fog node F for Internet of Things device D i Select an identity ID i , a random number a i and m i , and calculate X i =m i ⊕K f , Y i =h(m i ,K f ), Z i =ID i ⊕h(m i ,K f ); (2) The fog node F sends the triple (ID i , Z i , a i ) to the DC for storage; the DC broadcasts the memory pointer P i to all blockchain nodes, P i points to the memory address of the registration information in the DC, and (ID i , Z i , a i ) is retrieved through the pointer; the mining node packages the pointer into a block, and after the consensus process is completed, the block is attached at the end of the blockchain; (3) Fog node sends the quintuple (ID) through a secure channel. i ,X i ,Y i ,a i ,P i To IoT devices D i IoT device D i The quintuple is stored in memory; The authentication phase in step three comprises: When the Internet of Things device D i wants to communicate with the Internet of Things device D j then: (1) D i Fog: {X i , M1, M2, M3, T1}; the IoT device D i First, generate a random number n1 and a timestamp T1 to calculate the message M1 = Y i P, M2 = n1 P, M3 = h(ID i P, M2 = n1 P, M3 = h(ID i X i , M1, M2, n1, T1), the IoT device sends the message {X i , M1, M2, M3, T1} to the nearest fog node; (2) Fog D j :{M4,M5,Z i * ,T2};Fog node inspection(T new If -T1 < Δt is satisfied, continue the process; otherwise, reject the test. Calculate m. i * =X i ⊕K f P i * =M1⊕h(m i * ,K f ), and check P at the same time * If the memory address exists and is valid, the authentication process terminates; otherwise, the ID is retrieved based on the calculated memory address. i * Z i * a i * Generate a random number n2 and a timestamp T2, and calculate M4 = n2 ⊕ ID. i * M5=h(ID) i * M4,X i * ,n2,T2,K f Fog node broadcast message {M4,M5,Z} i * ,T2}, triggering the predefined smart contract rules, the message is passed forward to D j The message continues to be sent to the belonging fog node, device D. j ; (3) D j Fog: {X j , M6, M7, M8, T3}; IoT device D j Check (T new -T2 < At) is satisfied, if satisfied then continue flow, otherwise reject; D j Generate random number n3 and timestamp T3, compute M6 = Y j P j , M7 = n3 P j , M8 = h(ID j , X j , M6, M7, n3, T3), D j Send message {X j , M6, M7, M8, T3} to nearest fog node; (4) Fog D i :{M6,M 10 M 11 ,X i * ,T4};Fog node inspection (T new If -T3 < Δt) is satisfied, continue the process; otherwise, reject the test. Calculate m. i * =X i ⊕K f Y i * =h(m i * ,K f ID i **- =Z i * ⊕Y i * n1 * =M2⊕ID i ** M3 * =h(ID i ** ,X i ,M1,M2,n1 * (T1), check M3==M3 *- If they are equal, the authentication process continues; otherwise, it terminates. Calculate m. j * =X j ⊕K f P j * =M1⊕h(m i * , K f According to P j * Query D j Registration information triple (ID) j * Z j * ,a j * ); Calculate Y j * =h(m i * , K f ID j **- =Z j * ⊕Y j * n3 * = M4 j ** , M8 * = h(ID j ** , Z i , M7, M8, n3 * , T3), check M8 == M8 * , if equal continue authentication process, otherwise terminate; generate random number n4 and time stamp T4, compute X i new = n4 f , Y i new = h(n4, K f ), P = M1 I * , M9 = X i new * * , ID i ** ), M 10 = X i new * * , P), M 11 = X i new I ** , T4); fog node broadcasts message {M4, M 10 , M 11 , X i * , T4}, triggers pre-defined smart contract rules, message is forwarded to fog node that is closest to D i 's home, message is further sent to device D i ;​​​​​ (5) Fog D i : The IoT device receives the message, D i checks whether T new -T4<Δt) is satisfied, if satisfied, continue the flow, otherwise reject; calculate n2 * =M4⊕ID i , calculate M 11 * =h(ID i ,n2 * ,T3,M4,M9,M 10 ), judge M 11 * ==M 11 ; if equal, the IoT device D I successfully authenticates D j , and updates the authentication variables. 2.The method of claim 1, wherein, The mutual authentication and secure communication method between Internet of Things devices further comprises: IoT device D i Initiate authentication request to nearby fog node; fog node checks message freshness, performs information check on IoT device, message is forwarded to IoT device D j Initiate authentication request; IoT device D j Check freshness, perform relevant authentication variable calculation and send response message to the nearest fog node; fog node checks message freshness, completes authentication of IoT device D i and D j , and forwards the message to D i ; IoT device D i checks message freshness and completes authentication of IoT device D j , updates authentication variables, and both parties establish a secure connection for communication. 3.The method of claim 1, wherein, The initialization phase in step one comprises: (1) generating a master key K f ; (2) The system management is responsible for registering the fog nodes and sending K f stored in the memory of the fog nodes.

4. A mutual authentication and secure communication system between Internet of Things devices applying the mutual authentication and secure communication method between Internet of Things devices according to any one of claims 1 to 3, characterized in that, The mutual authentication and secure communication system between Internet of Things devices comprises: The device layer includes Internet of Things devices for sensing, driving and communication, and the device senses and generates data, and transmits the data to other devices, and the Internet of Things devices are grouped according to the system type; The fog layer includes a network of fog nodes supporting blockchain, and the nodes work cooperatively through the Internet; each system and all corresponding smart devices are associated with the nearest fog node enabled with blockchain, and the fog nodes enabled with blockchain communicate with each other to synchronize data related to identity verification and authorization; smart contracts containing a set of rules are defined on the fog nodes enabled with blockchain; a consensus algorithm is executed to create blocks for transactions; the blockchain ledger is shared among the fog nodes enabled with blockchain to support distributed identity verification and authorization; The system administrator is responsible for generating and distributing master keys in the initialization phase and registering fog nodes.

5. A computer device, comprising: The computer device includes a memory and a processor, the memory stores a computer program, and the computer program is executed by the processor to make the processor execute the steps of the mutual authentication and secure communication method between Internet of Things devices as claimed in any one of claims 1-3.

6. A computer readable storage medium storing a computer program, the computer program being executed by a processor to make the processor execute the steps of the mutual authentication and secure communication method between Internet of Things devices as claimed in any one of claims 1-3.

7. An information data processing terminal, characterized by The information data processing terminal is used to implement the mutual authentication and secure communication system between Internet of Things devices as claimed in claim 4.

Images