Identity recognition method and system of internet of things card device and related device

Abstract

The present disclosure provides an identity recognition method and system of an Internet of Things card device and related equipment, and relates to the technical field of communication. The method comprises the following steps: receiving an identity recognition request message from an Internet of Things card device, wherein the identity recognition request message contains chip information of the Internet of Things card device; the Internet of Things card device comprises a subscriber identity module (SIM) chip and a physically unclonable function (PUF) chip; the chip information comprises SIM chip identification information of the SIM chip and PUF chip identification information of the PUF chip; verifying whether the SIM chip identification information and the PUF chip identification information of the Internet of Things card device have a pre-established association relationship according to the chip information of the Internet of Things card device; and returning an identity recognition response message to the Internet of Things card device according to the verification result. The present disclosure can effectively prevent the identity of the Internet of Things card device from being tampered with or forged, and improve the security and reliability of the identity of the Internet of Things card device.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to an identification method, identification system and related equipment for Internet of Things (IoT) card devices. Background Technology

[0002] Industrial Internet identifiers (IIEs) are primarily used to assign unique digital identities to device terminals through the Industrial Internet IIE resolution system, enabling operations such as terminal addressing, identity verification, and command issuance. However, these IIEs are stored on IoT card devices. Existing IoT card device identification methods have several shortcomings, including vulnerabilities and vulnerability to attack in their identity verification mechanisms. For example, if identity verification information is intercepted or forged, unauthorized devices could gain access, compromising the security of the entire system. Some identification methods lack effective hardware-level protection mechanisms, making them susceptible to physical attacks, such as the copying or tampering of chip information. Furthermore, the authentication information used in some existing technologies during the identification process can be forged or misused, allowing unauthorized devices to pass verification.

[0003] Therefore, how to provide a new identification method to improve the security and reliability of IoT card device identity is an urgent technical problem to be solved.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] This disclosure provides an identification method, identification system, and related equipment for IoT card devices, which at least to some extent overcomes the problem of low security and reliability of IoT card device identity in related technologies.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] According to one aspect of this disclosure, an identification method for an IoT card device is provided, applied to an industrial internet identification platform. The method includes: receiving an identification request message from the IoT card device, wherein the identification request message includes: chip information of the IoT card device, the IoT card device including: a User Identification Module (SIM) chip and a Physically Unclonable Function (PUF) chip, the chip information including: SIM chip identification information of the SIM chip and PUF chip identification information of the PUF chip; verifying whether the SIM chip identification information and the PUF chip identification information of the IoT card device have a pre-established association relationship based on the chip information of the IoT card device; and returning an identification response message to the IoT card device based on the verification result.

[0008] In some embodiments, before verifying whether the SIM chip identification information and PUF chip identification information of the IoT card device have a pre-established association relationship based on the chip information of the IoT card device, the above method further includes: obtaining the SIM chip identification information and PUF chip identification information of multiple IoT card devices; and storing the SIM chip identification information and PUF chip identification information of each IoT card device in association.

[0009] In some embodiments, the identification request message is a network attach request message or a location change request message. The network attach request message is a request message initiated when the IoT SIM card device first accesses the network, and the location change request message is a request message initiated when the IoT SIM card device changes its location in the network.

[0010] In some embodiments, the chip information contained in the identity verification request message is encrypted chip information; wherein, after receiving the identity verification request message from the IoT card device, the method further includes: decrypting the encrypted chip information contained in the identity verification request message.

[0011] In some embodiments, the identity verification request message includes: SIM chip identification information and PUF chip identification information encrypted using a first shared key, wherein the first shared key is generated based on the public key of the Industrial Internet Identification Platform and the private key of the PUF chip; after receiving the identity verification request message from the IoT card device, the method further includes: decrypting the SIM chip identification information and PUF chip identification information contained in the identity verification request message using a second shared key, wherein the second shared key is generated based on the private key of the Industrial Internet Identification Platform and the public key of the PUF chip.

[0012] In some embodiments, before using the second shared key to decrypt the SIM chip identification information and PUF chip identification information contained in the identity verification request message, the method further includes: generating a second shared key based on the private key of the industrial internet identification platform and the public key of the PUF chip.

[0013] In some embodiments, generating a second shared key based on the private key of the Industrial Internet Identification Platform and the public key of the PUF chip includes: generating the public and private keys of the Industrial Internet Identification Platform; sending the public key of the Industrial Internet Identification Platform to the SIM chip of the IoT card device, so that the SIM chip of the IoT card device forwards it to the PUF chip; generating a PUF key pair generation trigger message and sending it to the SIM chip of the IoT card device, so that the SIM chip of the IoT card device forwards it to the PUF chip, wherein the PUF key pair generation trigger message is used to trigger the PUF chip to generate the public and private keys of the PUF chip; receiving the private key of the PUF chip returned by the PUF chip; and generating the second shared key based on the private key of the Industrial Internet Identification Platform and the public key of the PUF chip.

[0014] In some embodiments, the aforementioned identity verification request message may further include: device information of the IoT card device.

[0015] In some embodiments, the method is applied to an IoT card device and includes: sending an identity verification request message to an industrial internet identification platform, wherein the identity verification request message includes: chip information of the IoT card device, the IoT card device including: a SIM chip and a PUF chip, the chip information including: SIM chip identification information of the SIM chip and PUF chip identification information of the PUF chip, the industrial internet identification platform being used to verify whether the SIM chip identification information and PUF chip identification information of the IoT card device have a pre-established association relationship based on the chip information of the IoT card device; and receiving an identity verification response message returned by the industrial internet identification platform.

[0016] In some embodiments, before sending the identity verification request message to the industrial internet identification platform, the method further includes encrypting the chip information contained in the identity verification request message.

[0017] In some embodiments, before sending an identity verification request message to the Industrial Internet Identification Platform, the method further includes: receiving the public key of the Industrial Internet Identification Platform; generating a first shared key based on the public key of the Industrial Internet Identification Platform and the private key of the PUF chip; and encrypting the SIM chip identification information and the PUF chip identification information based on the first shared key.

[0018] In some embodiments, the identity verification request message includes: SIM chip identification information and PUF chip identification information encrypted according to a first shared key; after sending the identity verification request message to the industrial internet identification platform, the method further includes: receiving a PUF key pair generation trigger message, generating a public key and a private key of the PUF chip; sending the public key of the PUF chip to the industrial internet identification platform, so that the industrial internet identification platform generates a second shared key according to the public key of the PUF chip and the private key of the industrial internet identification platform, the second shared key being used to decrypt the SIM chip identification information and PUF chip identification information encrypted according to the first shared key contained in the identity verification request message.

[0019] According to another aspect of this disclosure, an identification device for an IoT card device is also provided, applied to an industrial internet identification platform, comprising: a request message receiving module for receiving an identification request message from the IoT card device, wherein the identification request message includes: chip information of the IoT card device, the IoT card device including: a SIM chip and a PUF chip, the chip information including: SIM chip identification information of the SIM chip and PUF chip identification information of the PUF chip; a verification module for verifying whether the SIM chip identification information and PUF chip identification information of the IoT card device have a pre-established association relationship based on the chip information of the IoT card device; and a result return module for returning an identification response message to the IoT card device based on the verification result.

[0020] According to another aspect of this disclosure, an IoT card device is also provided, comprising: a request message sending module, configured to send an identity recognition request message to an industrial internet identification platform, wherein the identity recognition request message includes: chip information of the IoT card device, the IoT card device including: a SIM chip and a PUF chip, the chip information including: SIM chip identification information of the SIM chip and PUF chip identification information of the PUF chip, the industrial internet identification platform being configured to verify whether the SIM chip identification information and PUF chip identification information of the IoT card device have a pre-established association relationship based on the chip information of the IoT card device; and a response message receiving module, configured to receive an identity recognition response message returned by the industrial internet identification platform.

[0021] According to another aspect of this disclosure, an Internet of Things (IoT) card device is also provided, comprising: a SIM chip and a PUF chip, wherein the SIM chip has SIM chip identification information, the PUF chip has PUF chip identification information, and the association between the SIM chip identification information and the PUF chip identification information is used to verify the identity information of the IoT card device.

[0022] According to another aspect of this disclosure, an industrial internet identification system is also provided, comprising: an industrial internet identification platform and an IoT card device; wherein the IoT card device is used to send an identity recognition request message to the industrial internet identification platform, wherein the identity recognition request message includes: chip information of the IoT card device, the IoT card device including: a SIM chip and a PUF chip, the chip information including: SIM chip identification information of the SIM chip and PUF chip identification information of the PUF chip; the industrial internet identification platform is used to verify, based on the chip information of the IoT card device, whether the SIM chip identification information and the PUF chip identification information of the IoT card device have a pre-established association relationship, and return an identity recognition response message to the IoT card device based on the verification result.

[0023] According to another aspect of this disclosure, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform an IoT card device identification method by executing the executable instructions.

[0024] According to another aspect of this disclosure, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the identification method for an IoT card device according to any one of the above.

[0025] According to another aspect of this disclosure, a computer program product is also provided, including a computer program that, when executed by a processor, implements an identification method for an IoT card device according to any of the above.

[0026] This disclosure provides an identification method, identification system, and related equipment for IoT card devices. The method involves receiving an identification request message from the IoT card device; verifying whether the SIM chip identification information and PUF chip identification information of the IoT card device have a pre-established association based on the device's chip information; and returning an identification response message to the IoT card device based on the verification result. This disclosure utilizes the association between the SIM chip identification information and the PUF chip identification information within the IoT card device to verify its identity. Leveraging the immutable nature of the PUF chip identification information, it enhances the security of IoT card devices while maintaining compatibility with existing industrial internet identification systems.

[0027] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0028] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0029] Figure 1 This diagram illustrates an industrial internet identification system architecture according to an embodiment of the present disclosure.

[0030] Figure 2 This diagram illustrates an IoT card device according to an embodiment of the present disclosure;

[0031] Figure 3 This diagram illustrates an identification method for an IoT card device according to an embodiment of the present disclosure.

[0032] Figure 4 This diagram illustrates another method for identifying an IoT card device according to an embodiment of the present disclosure.

[0033] Figure 5 This diagram illustrates another method for identifying an IoT card device according to an embodiment of the present disclosure.

[0034] Figure 6 This diagram illustrates another method for identifying an IoT card device according to an embodiment of the present disclosure.

[0035] Figure 7 This diagram illustrates another method for identifying an IoT card device according to an embodiment of the present disclosure.

[0036] Figure 8 This diagram illustrates another method for identifying an IoT card device according to an embodiment of the present disclosure.

[0037] Figure 9 This diagram illustrates an identification device for an IoT card device according to an embodiment of the present disclosure.

[0038] Figure 10 This diagram illustrates a structural block diagram of an electronic device according to an embodiment of the present disclosure;

[0039] Figure 11 A schematic diagram of a computer-readable storage medium is shown in an embodiment of the present disclosure. Detailed Implementation

[0040] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0041] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0042] As mentioned in the background section, the construction of the Industrial Internet Identifier Resolution System is one of the important tasks of the Industrial Internet development strategy. The Industrial Internet identifier primarily assigns a unique digital identity to a device terminal through this system, enabling operations such as terminal addressing, identity verification, and command issuance. The Industrial Internet identifier is stored on IoT card devices, but existing methods for identifying IoT card devices have some shortcomings. While the Industrial Internet Identifier Resolution System is under rapid construction, the security issues related to Industrial Internet identifiers and related business data are becoming increasingly prominent.

[0043] The business processes related to industrial internet identification include reading the identification, attaching network information reporting, and location changes. The transmitted data includes the device's industrial internet identification and the device's location area / tracking area / cell, requiring a higher level of security mechanisms to ensure the security of end-to-end data transmission.

[0044] If the SIM card in an IoT card device is compromised or the card manufacturing data is leaked, it can be used to copy the card and disguise it as a legitimate device to access the platform, leading to security issues.

[0045] The Industrial Internet identifier is stored in plaintext on the SIM card, which poses a risk of being read directly through security vulnerabilities.

[0046] Therefore, how to provide a new identification method to improve the security and reliability of IoT card identification is an urgent technical problem to be solved.

[0047] The specific implementation methods of the embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0048] Figure 1A schematic diagram of an industrial internet identification platform system architecture is shown, illustrating an exemplary application of the identification method for IoT card devices according to embodiments of this disclosure. For example... Figure 1 As shown, the industrial internet identification platform system architecture may include an industrial internet identification platform 101 and an IoT card device 102.

[0049] The IoT card device is used to send an identity recognition request message to the industrial internet identification platform. The identity recognition request message includes the chip information of the IoT card device, which includes a SIM chip and a PUF chip. The chip information includes the SIM chip identification information of the SIM chip and the PUF chip identification information of the PUF chip.

[0050] The Industrial Internet Identification Platform is used to verify whether the SIM chip identification information and PUF chip identification information of the IoT card device have a pre-established association relationship based on the chip information of the IoT card device, and to return an identity recognition response message to the IoT card device based on the verification result.

[0051] In some embodiments of this disclosure, the system architecture described above also includes a network, which serves as a medium for providing a communication link between the Industrial Internet Identification Platform 101 and the Internet of Things Card Device 102. The network can be a wired network or a wireless network.

[0052] Optionally, the aforementioned wireless or wired networks use standard communication technologies and / or protocols. The network is typically the Internet, but can also be any network, including but not limited to Local Area Networks (LANs), Metropolitan Area Networks (MANs), Wide Area Networks (WANs), mobile, wired or wireless networks, private networks, or any combination of virtual private networks. In some embodiments, technologies and / or formats including Hyper Text Markup Language (HTML), Extensible Markup Language (XML), etc., are used to represent data exchanged over the network. Furthermore, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Networks (VPNs), and Internet Protocol Security (IPSec) can be used to encrypt all or some links. In other embodiments, custom and / or dedicated data communication technologies can be used to replace or supplement the aforementioned data communication technologies.

[0053] The IoT card device 102 can be various electronic devices, including but not limited to smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, wearable devices, augmented reality devices, virtual reality devices, etc.

[0054] The industrial internet identification platform 101 can be a server that provides IoT card device identification services, such as a server that verifies and identifies IoT card device 102. The backend management server can analyze and process the received requests and other data, and feed the processing results back to IoT card device 102.

[0055] Optionally, the Industrial Internet Identification Platform 101 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0056] Those skilled in the art will know that Figure 1The number of industrial internet identification platform 101 and IoT card device 102 shown is merely illustrative; any number of terminal devices, networks, and servers can be included depending on actual needs. This disclosure does not limit the number of such devices.

[0057] In some embodiments of this disclosure, such as Figure 2 As shown, the chip information of the IoT card device 102 is attached to the IoT card 201, which includes a SIM chip 2011 and a PUF chip 2012. In some other embodiments of this disclosure, the SIM chip 2011 and the PUF chip 2012 can be directly attached to the IoT card device 102.

[0058] Under the above system architecture, this disclosure provides an identification method for IoT card devices, which can be executed by any electronic device with computing capabilities.

[0059] Figure 3 This diagram illustrates a flowchart of an identification method for an IoT card device according to an embodiment of the present disclosure, such as... Figure 3 As shown, the IoT card device identification method provided in this embodiment includes the following steps:

[0060] S302, Receive an identity recognition request message from an IoT card device, wherein the identity recognition request message includes: chip information of the IoT card device, the IoT card device includes: a SIM chip and a Physically Unclonable Function (PUF) chip, and the chip information includes: SIM chip identification information of the SIM chip and PUF chip identification information of the PUF chip.

[0061] It should be noted that, in this embodiment, the IoT card device can be any device with a built-in IoT card, including but not limited to terminal devices with built-in IoT cards, such as smart home devices, smart city devices, industrial automation devices, and vehicle-to-everything (V2X) devices. The IoT card device communicates with the internet and other devices via the IoT card, enabling data transmission, remote monitoring, and control between devices.

[0062] The aforementioned identity verification request message can be any message sent by an IoT device requesting verification of its identity information in the network. It can be sent proactively by the IoT device or triggered passively.

[0063] In some embodiments, the identification message in this disclosure may be a network attach request message initiated when an IoT device joins the network for the first time, or a location change request message initiated when the location of an IoT SIM card device changes in the network.

[0064] The aforementioned SIM chip identification information refers to the identification information of the SIM card chip, which is used to uniquely identify the identity information of IoT card devices in the network. It can be, but is not limited to, industrial internet identification. The SIM chip identification information is usually stored in the SIM card chip in plaintext, which is easily tampered with or forged.

[0065] The aforementioned PUF chip identification information refers to the identification information of the PUF chip, which may be, but is not limited to, the unique serial number of the PUF chip. Since the PUF chip is packaged inside the IoT card device, it has the physical characteristic of being unclonable. Therefore, the PUF chip identification information of the IoT card device has the characteristic of being unalterable.

[0066] In order to accommodate the existing Industrial Internet Identification System's approach of using Industrial Internet Identifiers to authenticate IoT SIM card devices, and to improve the security of IoT SIM card devices, this embodiment associates PUF chip identification information and SIM card chip identification information to verify the identity information of IoT SIM card devices.

[0067] Specifically, in the Internet of Things (IoT), the IoT SIM card device identification request message is an information transmission mechanism used to verify the device's identity. When an IoT SIM card device needs to communicate with the network or obtain access permissions, it sends an identification request message to prove its identity.

[0068] The identity verification request message in this embodiment contains the following key information:

[0069] IoT SIM card device chip information: This includes the chip information in the IoT SIM card installed on the device, which typically includes the identification information of the SIM chip and the Physically Unclonable Function (PUF) chip.

[0070] It's important to note that the SIM chip (Subscriber Identity Module chip), also known as the SIM card chip, is an integrated circuit chip used to store and process user identity and authentication information related to mobile communication networks. SIM chips are commonly used in the mobile communications field to manage mobile device identification, user subscription information, and communication with operator networks. The SIM chip identification information refers to the unique identifier of the SIM chip in an IoT card; it can be used to distinguish different devices, thus representing an Industrial Internet identifier.

[0071] A PUF (Physical Unclonable Function) chip is a chip that cannot be cloned based on physical characteristics. It leverages the minute differences and randomness inherent in chip manufacturing to generate unique identification information, thereby achieving hardware-level unique authentication and security features. PUF chips generate unique identification information by detecting minute changes in physical characteristics with randomized features, such as current, voltage, resistance, and reflection. These characteristics are unique to each PUF chip and cannot be copied. PUF chips generate unique device identifiers through hardware-based methods to further verify the device's identity. Therefore, PUF chips can be used to generate unique identity proofs for each IoT card device and provide the foundation for secure computing and communication. PUF chip identification information refers to the unique identifier of the PUF chip in an IoT card. PUF chips are typically used to generate unique identity information for IoT card devices; the PUF chip identification information represents the unique serial number of the PUF.

[0072] By using identity verification request messages, IoT SIM card devices can effectively authenticate their identities, ensuring that only authorized devices can communicate with the network, thereby improving the security and trustworthiness of the entire IoT system.

[0073] S304, Based on the chip information of the IoT card device, verify whether the SIM chip identification information and PUF chip identification information of the IoT card device have a pre-established association relationship.

[0074] It should be noted that in the pre-established association database, the SIM chip identifier and the PUF chip identifier are paired and saved as an association record. This association is usually established during the IoT card device manufacturing process, which binds the SIM chip identifier information of the SIM chip and the PUF chip identifier information of the PUF chip to form a one-to-one binding association.

[0075] The collected SIM chip identification information and PUF chip identification information are compared with a pre-established association database. If the two identification information matches in the database, it can be confirmed that they have a pre-established association relationship.

[0076] By verifying the association, the identity of the IoT SIM card device is confirmed. This means that the identification information of the SIM chip and PUF chip is valid and matches, allowing the IoT SIM card device to be authenticated and granted access to the network or other protected services.

[0077] This verification method ensures the authenticity and integrity of the IoT card device's identity. By comparing the correlation between two chip identifiers, it prevents unauthorized devices from impersonating, counterfeiting, or tampering with the device. Furthermore, since the identification information of the PUF chip cannot be copied, the security and reliability of the verification are further enhanced.

[0078] S306, based on the verification result, return an identity recognition response message to the IoT card device.

[0079] It should be noted that, based on the previous verification steps, the authentication result of the IoT card device is determined, i.e., whether the verification was successful. If the verification result is successful, it means that the IoT card device's identity recognition is valid; if the verification result is unsuccessful, it means that the IoT card device's identity recognition has a problem or is invalid.

[0080] Construct an identity verification response message based on the verification result. The response message should contain the authentication result and related information, and the format of the response message can be organized using predefined data structures or protocols. Populate the response message with the verification result information. If the verification is successful, the response message can include information such as the identity verification identifier and access permissions; if the verification fails, the response message can explain the reason for the failure.

[0081] The constructed identity verification response message is sent to the IoT card device. The message can be transmitted to the device via a network connection, ensuring that the device can receive and process the response message in a timely manner.

[0082] It should be noted that after receiving the response message, the IoT SIM card device will perform further processing based on the message content. If the verification result is successful, the device can continue to access the network or perform corresponding operations; if the verification result fails, appropriate security measures may need to be taken, such as denying access or triggering an alarm.

[0083] By sending an identity verification response message to an IoT SIM card device, feedback information confirming the device's identity and verification result can be provided. This helps ensure the security of devices and networks, and ensures that only legitimate and verified devices can obtain the appropriate services and permissions.

[0084] The IoT card device identification method provided in this disclosure can effectively prevent the identity of IoT card devices from being tampered with or forged, thus ensuring the security and reliability of the Internet of Things.

[0085] It should be noted that the acquisition, storage, use, and processing of data in this disclosed technical solution comply with the relevant provisions of national laws and regulations. The various types of data, such as personal identity data, operational data, and behavioral data related to individuals, customers, and groups, obtained in the embodiments of this disclosure have all been authorized.

[0086] In some embodiments of this disclosure, such as Figure 4 As shown, before verifying whether the SIM chip identification information and PUF chip identification information of the IoT card device have a pre-established association based on the chip information of the IoT card device, the following steps are also included:

[0087] S402, obtain SIM chip identification information and PUF chip identification information of multiple IoT card devices.

[0088] It should be noted that this involves obtaining chip information from multiple IoT SIM card devices, including the SIM chip identifier and PUF chip identifier for each device. This information can be obtained from the SIM card and PUF chip of the IoT SIM card device.

[0089] S404 associates and stores the SIM chip identification information and PUF chip identification information of each IoT card device.

[0090] Specifically, the SIM chip identification information and PUF chip identification information of each IoT card device are associated and stored. The association relationship between the SIM chip identification information and PUF chip identification information of each device can be established in an association database or table to ensure that the subsequent verification process can use these associated data for comparison.

[0091] In other embodiments, encryption technology can be introduced to enhance data security during the acquisition and storage of SIM chip identification information and PUF chip identification information of IoT card devices. Encryption algorithms can be used to encrypt the identification information, ensuring that only authorized personnel or systems can decrypt and access this information. Regular data backups of the associated databases can also be performed, and data synchronization between multiple databases can be ensured. This prevents data loss and maintains consistency between different databases, allowing data to be accessed and restored at any time when needed.

[0092] This embodiment of the disclosure acquires SIM chip identification information and PUF chip identification information of multiple IoT SIM card devices and stores them in association, establishing a one-to-one binding relationship between the SIM chip identification information and the PUF chip identification information. This provides the necessary data for subsequent verification steps. Thus, when verifying whether the SIM chip identification information and PUF chip identification information of IoT SIM card devices have a pre-established association relationship, the relationship between them can be determined by comparing the associated data in the database. This association storage method can further improve the accuracy and reliability of identity recognition.

[0093] In some embodiments of this disclosure, the identity verification request message is either a network attach request message or a location change request message. Specifically, the network attach request message is initiated when the IoT SIM card device first accesses the network, and the location change request message is initiated when the IoT SIM card device's location changes within the network.

[0094] It's important to note that the network attach request message is initiated by the IoT SIM card device when it first connects to the network. When an IoT SIM card device first connects to an operator's network, it needs to perform a network attach process to obtain registration and authentication. During this process, the IoT SIM card device sends a network attach request message to the network to establish a connection and verify its identity. The network attach process is crucial for IoT devices accessing the operator's network, ensuring the device's legitimacy and the reliability of the network connection. Through the network attach process, the device can obtain network services and resources and communicate with other devices and systems.

[0095] A location change request message is a request message initiated by an IoT SIM card device when its location changes within the network. When an IoT SIM card device switches from one location to another, such as from one base station to another, it needs to notify the network to update its location information. For location update and authentication operations, the IoT SIM card device sends a location change request message to the network to update its location information and perform identity verification.

[0096] By using network attach request messages and location change request messages as carriers of identity verification requests, authentication and identification can be performed when a device accesses the network or changes location. This ensures that the location and identity of IoT SIM card devices within the network are legitimate and trustworthy, thereby maintaining network security and quality of service.

[0097] In some embodiments of this disclosure, the chip information contained in the identity verification request message is encrypted chip information.

[0098] It's important to note that the chip information included in the identity verification request message is encrypted to enhance the security and protection of the identity verification process. Encrypting the chip information protects it from unauthorized access and tampering by unauthorized personnel or systems. Encryption transforms the original data into unreadable ciphertext, which can only be restored to readable plaintext by an authorized decryptor. Furthermore, the chip information of IoT devices may contain sensitive, commercially valuable data, such as manufacturer identifiers and device serial numbers. Encrypting the chip information prevents this sensitive data from being stolen or leaked during transmission. Moreover, encrypting the chip information prevents malicious attackers from tampering with or forging the data in the request message. The decryption step verifies the chip information, ensuring that the received data was encrypted by a legitimate sender and is not fraudulent data manipulated by a third party.

[0099] It's important to understand that encrypted chip information provides an additional layer of security for the identification of IoT devices. Even if the identification request message is intercepted or intercepted, attackers cannot directly obtain the sensitive chip information. Only through legitimate decryption can the original data be obtained.

[0100] In some embodiments of this disclosure, the chip information contained in the identity recognition request message is encrypted chip information. After receiving the identity recognition request message from the IoT card device, the method further includes the step of decrypting the encrypted chip information contained in the identity recognition request message.

[0101] Specifically, the IoT card device sends an identity recognition request message to the Industrial Internet Identification Platform, which contains encrypted chip information. After receiving this request message, the Industrial Internet Identification Platform begins the decryption process.

[0102] The decryption process involves extracting the encrypted chip information from the identity verification request message. This can be done by parsing the message's data fields or a specific message structure. Alternatively, the extracted encrypted chip information can be decrypted using a suitable decryption algorithm and key. The decryption process restores the chip information to its original, unencrypted format.

[0103] After decryption, the decrypted chip information is obtained for subsequent authentication and identification processes.

[0104] By decrypting the encrypted chip information in the identity verification request message, the original chip information can be obtained for further identity verification and identification. This ensures that the chip information used in the identity verification process is accurate and reliable.

[0105] In some embodiments of this disclosure, the identity recognition request message includes: SIM chip identification information and PUF chip identification information encrypted using a first shared key, wherein the first shared key is generated based on the public key of the industrial internet identification platform and the private key of the PUF chip.

[0106] After receiving the identification request message from the IoT card device, the method further includes:

[0107] The SIM chip identification information and PUF chip identification information contained in the identity recognition request message are decrypted using the second shared key, which is generated based on the private key of the Industrial Internet Identification Platform and the public key of the PUF chip.

[0108] It should be noted that this disclosed embodiment is a specific example where the chip information contained in the identity recognition request message is encrypted. Specifically, the identity recognition request message includes SIM chip identification information and PUF chip identification information encrypted using a first shared key. This first shared key is generated based on the public key of the Industrial Internet Identification Platform and the private key of the PUF chip.

[0109] Upon receiving an identification request message from an IoT card device, the system uses a second shared key to decrypt the SIM chip identification information and PUF chip identification information encrypted using the first shared key within the identification request message. The second shared key is generated based on the private key of the Industrial Internet Identification Platform and the public key of the PUF chip.

[0110] It is important to understand that the two shared keys used in this embodiment ensure that only the recipient with the corresponding key can decrypt and access this identification information. The shared keys are generated using the public-private key pair of the Industrial Internet Identification Platform and the public-private key pair of the PUF chip. This configuration ensures the uniqueness and trustworthiness of the key, while protecting its security and correctness.

[0111] Furthermore, because PUF chips are based on physical uncertainty, they possess uniqueness and are difficult to replicate. Combining the PUF chip's private and public keys with a shared key generated by pairing the public and private keys of the Industrial Internet Identification Platform further enhances the security of identity verification.

[0112] By using a first shared key and a second shared key to encrypt and decrypt the identification information in the identification request message, this method provides a more secure identification method, ensuring that only a legitimate recipient can access and use the device's identification information.

[0113] In some embodiments of this disclosure, before using the second shared key to decrypt the SIM chip identification information and PUF chip identification information contained in the identity verification request message, the following steps are further included:

[0114] A second shared key is generated based on the private key of the Industrial Internet Identification Platform and the public key of the PUF chip.

[0115] It should be noted that the purpose of this step is to generate a second shared key for decrypting the identity verification request message. Specifically, this involves obtaining the private key of the Industrial Internet Identification Platform and the public key of the PUF chip; using the private key of the Industrial Internet Identification Platform and the public key of the PUF chip to perform a key calculation or key exchange algorithm to generate the second shared key; and using the generated second shared key to decrypt the SIM chip identification information and PUF chip identification information encrypted with the first key in the identity verification request message. The decrypted information can then be used in subsequent identity verification and identification processes.

[0116] By generating a second shared key using the private key from the Industrial Internet Identification Platform and the public key from the PUF chip, the uniqueness and security of the key can be ensured. This design prevents unauthorized decryptors from using illegal keys for decryption operations.

[0117] Generating a second shared key based on the private key of the Industrial Internet Identification Platform and the public key of the PUF chip is part of the IoT card device identification method, used to ensure that the identification information in the identification request message can only be decrypted and accessed by the legitimate recipient.

[0118] In some embodiments of this disclosure, such as Figure 5 As shown, a second shared key is generated based on the private key of the Industrial Internet Identification Platform and the public key of the PUF chip, including the following steps:

[0119] S502 generates the public and private keys for the Industrial Internet Identification Platform.

[0120] It's important to note that for the Industrial Internet Identification Platform, the process of generating public and private keys can utilize asymmetric encryption algorithms. Specifically, this involves selecting an appropriate asymmetric encryption algorithm and key length. The Industrial Internet Identification Platform may choose a suitable encryption algorithm and key length based on specific needs to generate a random private key. The private key is a randomly generated large integer used to control the encryption and decryption processes. A public key is then generated using the selected asymmetric encryption algorithm and the private key. This typically involves calculating the value of the public key based on a specific algorithm applied to the private key. The public and private keys are then stored in a secure location. The public key can be shared with other devices or entities for encrypted communication, while the private key must be kept strictly confidential and can only be used by the Industrial Internet Identification Platform itself.

[0121] It is important to note that the process of generating and managing public and private keys requires careful security measures to prevent the private key from being leaked or accessed by unauthorized entities. Therefore, best security practices and standards should be followed when generating and using public and private keys.

[0122] S504 sends the public key of the Industrial Internet Identification Platform to the SIM chip of the IoT card device, so that the SIM chip of the IoT card device can forward it to the PUF chip.

[0123] Specifically, a portion of storage space is reserved in the IoT SIM card device for storing and managing the public key. The Industrial Internet Identification Platform converts the generated public key into an appropriate format and sends it to the IoT SIM card device via a secure communication channel, which can be achieved through IoT connectivity or other secure communication methods. After receiving the public key from the Industrial Internet Identification Platform, the SIM chip in the IoT SIM card device stores it in the reserved storage space. The SIM chip then forwards the received public key to the PUF chip. It should be noted that the specific forwarding method may vary depending on the actual connection method between the SIM and PUF chips. After receiving the public key, the PUF chip can store it in a suitable storage medium for future use.

[0124] It is important to note that to ensure the security of the public key of the Industrial Internet Identification Platform, a secure channel should be used during transmission to prevent the public key from being tampered with or stolen during transmission. Furthermore, the public key also needs to be properly protected during storage and transmission to prevent malicious access or modification.

[0125] Through the above steps, the public key of the Industrial Internet Identification Platform can be transmitted to the SIM chip of the IoT card device, and then forwarded by the SIM chip to the PUF chip for subsequent identity recognition and verification operations.

[0126] S506, Generate PUF key pair generation trigger message and send it to the SIM chip of the IoT card device so that the SIM chip of the IoT card device forwards it to the PUF chip. The PUF key pair generation trigger message is used to trigger the PUF chip to generate the PUF chip's public key and private key.

[0127] It's important to note that generating the public and private keys for the PUF chip requires triggering the PUF chip to execute the corresponding generation algorithm. Therefore, the Industrial Internet Identification Platform first generates a PUF key pair generation trigger message. This process typically involves generating a random number using a secure random number generator. The generated trigger message contains this random number and other necessary information, informing the SIM chip of the IoT card device to trigger the PUF chip. Upon receiving the trigger message, the SIM chip of the IoT card device forwards it to the PUF chip according to the designed communication protocol. Upon receiving the trigger message, the PUF chip executes the generation algorithm based on the random number and other necessary information in the message to generate its public and private keys.

[0128] Through this step, the PUF chip generates its own public and private keys upon receiving the trigger message. These generated public and private keys exist only within the PUF chip, and because the PUF chip's physical characteristics are unique and cannot be copied, it provides enhanced security and resistance to attacks.

[0129] S508 receives the private key of the PUF chip returned by the PUF chip.

[0130] It should be explained that the Industrial Internet Identification Platform receives the private key of the PUF chip to verify the chip's identity and authenticity. By obtaining the PUF chip's private key, the platform can match and verify it with a pre-stored public key to ensure that the received private key does indeed come from the intended PUF chip and has not been tampered with or impersonated.

[0131] By obtaining the private key of the Industrial Internet Identification Platform, the public key of the PUF chip, and the private key returned by the PUF chip, the Industrial Internet Identification Platform can use key derivation functions or protocols to combine these key materials to generate a second shared key. This shared key can be used for secure operations such as encrypted communication or authentication.

[0132] It is important to note that the confidentiality of the private key is paramount. Therefore, when the Industrial Internet Identification Platform receives the private key from the PUF chip, appropriate security measures must be taken to protect its confidentiality. This includes secure methods for storing, transmitting, and processing the private key to ensure it is not accessed or leaked without authorization. Furthermore, the generated second shared key also needs to be properly protected to prevent unauthorized access or use.

[0133] S510 generates a second shared key based on the private key of the Industrial Internet Identification Platform and the public key of the PUF chip.

[0134] It should be noted that when generating the second shared key based on the private key of the Industrial Internet Identification Platform and the public key of the PUF chip, a key derivation function or protocol can be used. Specifically, using an appropriate key derivation function or protocol, the private key of the Industrial Internet Identification Platform and the public key of the PUF chip are taken as input. The key derivation function or protocol processes the input and generates the second shared key as output. It is crucial to ensure that the generated second shared key uses an appropriate length and algorithm to meet security requirements. Depending on the specific use case and security strategy, a suitable encryption algorithm and key length can be selected. The generated second shared key should be securely stored to prevent unauthorized access and use.

[0135] It is important to note that the choice of specific key derivation function or protocol depends on the system architecture and security requirements. During design and implementation, factors such as cryptographic security, performance requirements, and standards compliance should be considered to ensure the security and reliability of the generated second shared key. Furthermore, the key generation and processing procedures should also adhere to relevant information security and privacy regulations.

[0136] In some embodiments of this disclosure, the PUF chip in the IoT card of the IoT card device can utilize its internal physical characteristics to generate a public-private key pair for encrypting and decrypting data and for authentication. The Industrial Internet Identification Platform (IIPP) can communicate with the PUF chip in the IoT card via an Elliptic Curve Cryptography (ECC) key negotiation mechanism. ECC is an asymmetric encryption algorithm that can efficiently generate a shared data protection key. When communicating with the PUF chip, the IIPP generates its own ECC public-private key pair and sends its public key to the IoT card. The PUF chip in the IoT card uses its private key and the IIPP's public key to perform key negotiation operations, thereby generating a shared data protection key. The shared data protection key generated through the ECC key negotiation mechanism can be used to encrypt and decrypt transmitted data. This key is generated through negotiation between the two parties and is shared only between them. By using this key, the confidentiality and integrity of the data can be ensured, as well as unauthorized access and modification can be prevented.

[0137] In some embodiments of this disclosure, the identity verification request message also includes: device information of the IoT card device.

[0138] It should be noted that the device information of an IoT SIM card device may include: Device Serial Number: A unique serial number for the IoT SIM card device, used to identify the device and distinguish it from other devices; Device Type: The type of device to which the IoT SIM card device belongs, such as a sensor, actuator, controller, etc.; Hardware Information: The hardware specifications and technical parameters of the IoT SIM card device, such as chip model, processor speed, memory capacity, etc.; Software Information: The software version and firmware information running on the IoT SIM card device; Network Information: The network configuration and connection information of the IoT SIM card device, such as IP address, MAC address, network provider, etc.

[0139] By including device information in the identification request message, the platform or service receiving the identification request can gain a more comprehensive understanding of the attributes and characteristics of the IoT SIM card device, effectively preventing unauthorized device access and providing personalized services and management for the device. Simultaneously, device information can also play a crucial role in security auditing and troubleshooting, helping to track and diagnose device problems. Specific methods for device identification including IoT SIM card device information are described in the steps outlined above and will not be repeated here.

[0140] Based on the same inventive concept, this disclosure also provides a method for identifying IoT card devices, such as... Figure 6 As shown, this method is applied to IoT card devices and includes the following steps:

[0141] S602, send an identity recognition request message to the Industrial Internet Identification Platform. The identity recognition request message includes: chip information of the IoT card device. The IoT card device includes: SIM chip and PUF chip. The chip information includes: SIM chip identification information of the SIM chip and PUF chip identification information of the PUF chip. The Industrial Internet Identification Platform is used to verify whether the SIM chip identification information and PUF chip identification information of the IoT card device have a pre-established association relationship based on the chip information of the IoT card device.

[0142] It should be noted that the purpose of sending an identity verification request message to the Industrial Internet Identification Platform is to verify device identity and establish a trust relationship. By sending an identity verification request message to the Industrial Internet Identification Platform, the legitimacy of the IoT card device can be verified. The platform can verify the device's identity information to ensure that the device is authorized and recognized, and not an unauthorized device.

[0143] Through identity verification request messages, a trust relationship can be established between IoT SIM card devices and the industrial internet identification platform. The platform can then authenticate and authorize devices based on the information in the identity verification request, thereby enabling legitimate access to the devices and providing personalized services.

[0144] The Internet of Things (IoT) involves a large amount of sensitive data and critical equipment, including industrial control systems and smart home devices. Through identity verification request messages, the Industrial Internet Identification Platform can ensure that only legitimate and trusted devices can access and operate relevant systems and data, thereby improving overall system security and preventing unauthorized intrusions.

[0145] It's also important to understand the pre-established association: Before the identity verification process, the industrial internet identification platform needs to pre-establish an association between SIM chip identification information and PUF chip identification information. This means the platform stores the SIM chip and PUF chip identification information of known legitimate devices and associates them for subsequent identity verification.

[0146] By verifying the association between the SIM chip and the PUF chip identification information, the industrial internet identification platform can determine the authenticity and legitimacy of devices. This authentication mechanism can prevent unauthorized devices from accessing the industrial internet, protecting system security and data integrity.

[0147] S604, Receive the identity recognition response message returned by the Industrial Internet Identification Platform.

[0148] It should be noted that receiving the identity verification response message from the Industrial Internet Identification Platform is a response to the identity verification request message sent to the platform. The identity verification response message contains information about the device's authentication result. This response can be positive, indicating that the device's authentication has passed and it has been confirmed as a legitimate device. It can also be negative, indicating that the device's authentication has failed and it is considered an illegal or unauthorized device.

[0149] Based on the information in the identity verification response message, the IoT card device and related systems can perform subsequent operations. For example, if the device is successfully authenticated, it can continue with operations such as connection establishment, data exchange, access control, identification reading, attachment network information reporting, and location changes. If the device fails authentication, appropriate security measures may need to be taken, such as terminating the connection or sending an alarm.

[0150] Using the method described in this embodiment, the industrial internet identification platform can identify devices based on the chip information of IoT card devices. By verifying the association between the SIM chip and PUF chip identification information, the authenticity and legitimacy of the IoT card device can be ensured. This identification method can be used to ensure the security of device access and provide personalized services and management based on device identity.

[0151] In some embodiments of this disclosure, before sending the identity recognition request message to the industrial internet identification platform, the step of encrypting the chip information contained in the identity recognition request message is further included.

[0152] It's important to understand that before sending an identification request message, the IoT SIM card device encrypts the chip information within it. Encryption is a process of transforming raw data into ciphertext that cannot be directly read or understood; only those with the correct decryption key can decrypt and read the original data.

[0153] Encrypting the chip information in the identity verification request message enhances data confidentiality and security. The encryption process protects chip information from unauthorized access, theft, or tampering by third parties, ensuring the confidentiality and integrity of data during transmission. This increases the security of the device authentication process and reduces potential risks and the likelihood of attacks.

[0154] In some embodiments of this disclosure, such as Figure 7 As shown, before sending the identity verification request message to the Industrial Internet Identification Platform, the following steps are also included:

[0155] S702 receives the public key from the Industrial Internet Identification Platform.

[0156] S702 generates a first shared key based on the public key of the Industrial Internet Identification Platform and the private key of the PUF chip.

[0157] S702, encrypt the SIM chip identification information and PUF chip identification information according to the first shared key.

[0158] It should be noted that the IoT SIM card device uses the public key provided by the Industrial Internet Identification Platform and the private key of the device's internal PUF chip to generate a first shared key. This shared key is generated through a process of encryption using the public key and decryption using the private key, and is used to ensure secure communication between the two parties. Using the first shared key, the IoT SIM card device encrypts the SIM chip identification information and PUF chip identification information in the identity verification request message. In this way, the information in the identity verification request message sent by the device to the Industrial Internet Identification Platform is encrypted, ensuring the confidentiality and security of the data. By receiving the public key from the Industrial Internet Identification Platform, generating the first shared key, and encrypting the identification information in the identity verification request message, the IoT SIM card device can send identity verification requests to the platform while maintaining communication security. This encryption process improves the confidentiality of the identity verification request message, prevents unauthorized access and information leakage, and thus enhances the security of the device authentication process.

[0159] In some embodiments of this disclosure, the identity verification request message includes: SIM chip identification information and PUF chip identification information encrypted according to a first shared key.

[0160] After sending an identity verification request message to the Industrial Internet Identification Platform, such as Figure 8 As shown, it also includes the following steps:

[0161] S802 receives the PUF key pair generation trigger message and generates the public and private keys of the PUF chip.

[0162] S804, send the public key of the PUF chip to the Industrial Internet Identification Platform, so that the Industrial Internet Identification Platform can generate a second shared key based on the public key of the PUF chip and the private key of the Industrial Internet Identification Platform. The second shared key is used to decrypt the SIM chip identification information and PUF chip identification information encrypted according to the first shared key contained in the identity recognition request message.

[0163] It should be noted that, through the above steps, this method further enhances the security and confidentiality of the identity verification process. First, when sending the identity verification request message, the device uses a first shared key to encrypt the SIM chip identification information and the PUF chip identification information. Then, upon receiving the response from the Industrial Internet Identification Platform, the device generates a public key and a private key for the PUF chip and sends the public key to the platform. The Industrial Internet Identification Platform uses the PUF chip's public key and its own private key to generate a second shared key, which is used to decrypt the encrypted data in the identity verification request message. In this way, only the platform can decrypt and obtain the original SIM chip identification information and the PUF chip identification information, increasing data security and protecting device privacy.

[0164] Based on the same inventive concept, this disclosure also provides an identification device for an IoT card device, as described in the following embodiments. Since the principle by which this device embodiment solves the problem is similar to that of the above-described method embodiments, the implementation of this device embodiment can refer to the implementation of the above-described method embodiments, and repeated details will not be elaborated further.

[0165] Figure 9 This diagram illustrates an identification device for an IoT card device according to an embodiment of the present disclosure, such as... Figure 9 As shown, the identification device 90 of the IoT card device includes:

[0166] The request message receiving module 901 is used to receive an identity recognition request message from an IoT card device. The identity recognition request message includes: chip information of the IoT card device, which includes: a SIM chip and a PUF chip. The chip information includes: SIM chip identification information of the SIM chip and PUF chip identification information of the PUF chip.

[0167] The verification module 902 is used to verify whether the SIM chip identification information and PUF chip identification information of the IoT card device have a pre-established association relationship based on the chip information of the IoT card device.

[0168] The result return module 903 is used to return an identity recognition response message to the IoT card device based on the verification result.

[0169] It should be noted that the above-mentioned module, as part of the device, can be executed in a computer system such as a set of computer-executable instructions.

[0170] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0171] The following reference Figure 10 To describe an electronic device 1000 according to such an embodiment of the present disclosure. Figure 10 The electronic device 1000 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0172] like Figure 10 As shown, the electronic device 1000 is manifested in the form of a general-purpose computing device. The components of the electronic device 1000 may include, but are not limited to: at least one processing unit 1010, at least one storage unit 1020, and a bus 1030 connecting different system components (including storage unit 1020 and processing unit 1010).

[0173] The storage unit stores program code that can be executed by the processing unit 1010, causing the processing unit 1010 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 1010 can perform the following steps of the above method embodiment: receiving an identity verification request message from an IoT card device, wherein the identity verification request message includes: chip information of the IoT card device, the IoT card device including: a SIM chip and a Physically Unclonable Function (PUF) chip, the chip information including: SIM chip identification information of the SIM chip and PUF chip identification information of the PUF chip; verifying whether the SIM chip identification information and PUF chip identification information of the IoT card device have a pre-established association relationship based on the chip information of the IoT card device; and returning an identity verification response message to the IoT card device based on the verification result.

[0174] Storage unit 1020 may include readable media in the form of volatile storage units, such as random access memory (RAM) 10201 and / or cache memory 10202, and may further include read-only memory (ROM) 10203.

[0175] Storage unit 1020 may also include a program / utility 10204 having a set (at least one) program module 10205, such program module 10205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0176] Bus 1030 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the multiple bus structures.

[0177] Electronic device 1000 can also communicate with one or more external devices 1040 (e.g., keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with electronic device 1000, and / or any device that enables electronic device 1000 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1050. Furthermore, electronic device 1000 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1060. As shown, network adapter 1060 communicates with other modules of electronic device 1000 via bus 1030. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1000, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0178] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0179] In particular, according to embodiments of this disclosure, the process described above with reference to the flowchart can be implemented as a computer program product, which includes a computer program that, when executed by a processor, implements the above-described IoT card device identification method.

[0180] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. Figure 11 This illustration shows a schematic diagram of a computer-readable storage medium according to an embodiment of the present disclosure, such as... Figure 11 As shown, the computer-readable storage medium 1100 stores a program product capable of implementing the methods described above in this disclosure. In some possible embodiments, various aspects of this disclosure may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0181] More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0182] In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

[0183] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0184] In practical implementation, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0185] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0186] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0187] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0188] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A method for identifying an IoT card device, characterized in that, The method, applied to an industrial internet identification platform, includes: Receive an identity verification request message from an IoT card device, wherein the identity verification request message includes: chip information of the IoT card device, the IoT card device includes: a SIM chip and a PUF chip, wherein the SIM chip and the PUF chip are connected, and the chip information includes: SIM chip identification information of the SIM chip and PUF chip identification information of the PUF chip; Based on the chip information of the IoT card device, verify whether the SIM chip identification information and the PUF chip identification information of the IoT card device have a pre-established association relationship; Based on the verification result, an identity recognition response message is returned to the IoT card device; The identity recognition request message also includes: SIM chip identification information and PUF chip identification information encrypted using a first shared key, wherein the first shared key is generated based on the public key of the industrial internet identification platform and the private key of the PUF chip; After receiving an identity verification request message from an IoT card device, the method further includes: using a second shared key to decrypt the SIM chip identification information and PUF chip identification information contained in the identity verification request message, wherein the second shared key is generated based on the private key of the industrial internet identification platform and the public key of the PUF chip.

2. The identification method for IoT card devices according to claim 1, characterized in that, Before verifying whether the SIM chip identification information and the PUF chip identification information of the IoT card device have a pre-established association based on the chip information of the IoT card device, the method further includes: Obtain SIM chip identification information and PUF chip identification information from multiple IoT SIM card devices; The SIM chip identification information and PUF chip identification information of each IoT card device are associated and stored.

3. The identification method for IoT card devices according to claim 1, characterized in that, The identity verification request message is either a network attach request message or a location change request message. The network attach request message is initiated when the IoT SIM card device first accesses the network, and the location change request message is initiated when the IoT SIM card device changes its location in the network.

4. The identification method for IoT card devices according to claim 1, characterized in that, The chip information contained in the identity recognition request message is encrypted chip information; The method further includes, after receiving the identity verification request message from the IoT card device: The encrypted chip information contained in the identity verification request message is decrypted.

5. The identification method for IoT card devices according to claim 1, characterized in that, Before using the second shared key to decrypt the SIM chip identification information and PUF chip identification information contained in the identity verification request message, the method further includes: The second shared key is generated based on the private key of the industrial internet identification platform and the public key of the PUF chip.

6. The identification method for IoT card devices according to claim 5, characterized in that, The second shared key is generated based on the private key of the industrial internet identification platform and the public key of the PUF chip, including: Generate the public and private keys of the industrial internet identification platform; The public key of the Industrial Internet Identification Platform is sent to the SIM chip of the IoT card device, so that the SIM chip of the IoT card device forwards it to the PUF chip; A PUF key pair generation trigger message is sent to the SIM chip of the IoT card device, so that the SIM chip of the IoT card device forwards the message to the PUF chip. The PUF key pair generation trigger message is used to trigger the PUF chip to generate the public key and private key of the PUF chip. Receive the private key of the PUF chip returned by the PUF chip; The second shared key is generated based on the private key of the industrial internet identification platform and the public key of the PUF chip.

7. The method for identifying an IoT card device according to any one of claims 1-6, characterized in that, The identity verification request message also includes: device information of the IoT card device.

8. A method for identifying an IoT card device, characterized in that, Applied to IoT card devices, the method includes: An identity verification request message is sent to the Industrial Internet Identification Platform. This message includes the chip information of the IoT card device, which comprises a SIM chip and a PUF chip, connected to each other. The chip information includes the SIM chip identification information and the PUF chip identification information. The Industrial Internet Identification Platform verifies whether the SIM chip identification information and the PUF chip identification information of the IoT card device have a pre-established association based on the chip information of the IoT card device. Receive the identity recognition response message returned by the Industrial Internet Identification Platform; Before sending an identity verification request message to the Industrial Internet Identification Platform, the method further includes: receiving the public key of the Industrial Internet Identification Platform; generating a first shared key based on the public key of the Industrial Internet Identification Platform and the private key of the PUF chip; and encrypting the SIM chip identification information and the PUF chip identification information based on the first shared key. The identity verification request message includes: SIM chip identification information and PUF chip identification information encrypted according to the first shared key; after sending the identity verification request message to the industrial internet identification platform, the method further includes: receiving a PUF key pair generation trigger message, generating a public key and a private key of the PUF chip; sending the public key of the PUF chip to the industrial internet identification platform, so that the industrial internet identification platform generates a second shared key according to the public key of the PUF chip and the private key of the industrial internet identification platform, the second shared key being used to decrypt the SIM chip identification information and the PUF chip identification information encrypted according to the first shared key contained in the identity verification request message.

9. The identification method for an IoT card device according to claim 8, characterized in that, Before sending the identity verification request message to the industrial internet identification platform, the method further includes: The chip information contained in the identity verification request message is encrypted.

10. An identification device for an Internet of Things (IoT) card device, characterized in that, Applications to industrial internet identification platforms include: A request message receiving module is used to receive an identity recognition request message from an IoT card device, wherein the identity recognition request message includes: chip information of the IoT card device, the IoT card device including: a SIM chip and a PUF chip, wherein the SIM chip and the PUF chip are connected to each other; the chip information includes: SIM chip identification information of the SIM chip and PUF chip identification information of the PUF chip; The verification module is used to verify whether the SIM chip identification information and the PUF chip identification information of the IoT card device have a pre-established association relationship based on the chip information of the IoT card device. The result return module is used to return an identity recognition response message to the IoT card device based on the verification result; The identity recognition request message also includes: SIM chip identification information and PUF chip identification information encrypted using a first shared key, wherein the first shared key is generated based on the public key of the industrial internet identification platform and the private key of the PUF chip; The identification device of the IoT card device is further configured to: after receiving an identification request message from the IoT card device, use a second shared key to decrypt the SIM chip identification information and PUF chip identification information contained in the identification request message, wherein the second shared key is generated based on the private key of the industrial internet identification platform and the public key of the PUF chip.

11. An Internet of Things (IoT) card device, characterized in that, include: A request message sending module is used to send an identity recognition request message to an industrial internet identification platform. The identity recognition request message includes: chip information of the IoT card device, which includes a SIM chip and a PUF chip, wherein the SIM chip and the PUF chip are connected; the chip information includes: SIM chip identification information of the SIM chip and PUF chip identification information of the PUF chip; the industrial internet identification platform is used to verify whether the SIM chip identification information and the PUF chip identification information of the IoT card device have a pre-established association relationship based on the chip information of the IoT card device. The response message receiving module is used to receive the identity recognition response message returned by the industrial internet identification platform; The IoT card device is further configured to: receive the public key of the Industrial Internet Identification Platform before sending an identity recognition request message to the Industrial Internet Identification Platform; generate a first shared key based on the public key of the Industrial Internet Identification Platform and the private key of the PUF chip; and encrypt the SIM chip identification information and the PUF chip identification information based on the first shared key. The identity verification request message includes: the SIM chip identification information and the PUF chip identification information encrypted according to the first shared key; the IoT card device is further configured to: after sending the identity verification request message to the industrial internet identification platform, receive a PUF key pair generation trigger message, generate the public key and private key of the PUF chip; send the public key of the PUF chip to the industrial internet identification platform, so that the industrial internet identification platform generates a second shared key according to the public key of the PUF chip and the private key of the industrial internet identification platform, the second shared key being used to decrypt the SIM chip identification information and the PUF chip identification information encrypted according to the first shared key contained in the identity verification request message.

12. An Internet of Things (IoT) card device, characterized in that, include: A SIM chip and a PUF chip are connected to each other. The SIM chip has SIM chip identification information, and the PUF chip has PUF chip identification information. The association between the SIM chip identification information and the PUF chip identification information is used to verify the identity information of the IoT card device. The IoT card device is further configured to: receive the public key of the Industrial Internet Identification Platform before sending an identity recognition request message to the Industrial Internet Identification Platform; generate a first shared key based on the public key of the Industrial Internet Identification Platform and the private key of the PUF chip; and encrypt the SIM chip identification information and the PUF chip identification information based on the first shared key. The identity verification request message includes: the SIM chip identification information and the PUF chip identification information encrypted according to the first shared key; the IoT card device is further configured to: after sending the identity verification request message to the industrial internet identification platform, receive a PUF key pair generation trigger message, generate the public key and private key of the PUF chip; send the public key of the PUF chip to the industrial internet identification platform, so that the industrial internet identification platform generates a second shared key according to the public key of the PUF chip and the private key of the industrial internet identification platform, the second shared key being used to decrypt the SIM chip identification information and the PUF chip identification information encrypted according to the first shared key contained in the identity verification request message.

13. An industrial internet identification system, characterized in that, include: Industrial Internet identification platform and IoT card device; The IoT card device is used to send an identity recognition request message to the industrial internet identification platform. The identity recognition request message includes the chip information of the IoT card device. The IoT card device includes a SIM chip and a PUF chip, which are connected to each other. The chip information includes the SIM chip identification information of the SIM chip and the PUF chip identification information of the PUF chip. The industrial internet identification platform is used to verify whether the SIM chip identification information and the PUF chip identification information of the IoT card device have a pre-established association relationship based on the chip information of the IoT card device, and to return an identity recognition response message to the IoT card device based on the verification result; The IoT card device is further configured to: receive the public key of the Industrial Internet Identification Platform before sending an identity recognition request message to the Industrial Internet Identification Platform; generate a first shared key based on the public key of the Industrial Internet Identification Platform and the private key of the PUF chip; and encrypt the SIM chip identification information and the PUF chip identification information based on the first shared key. The industrial internet identification platform is also used to: after receiving an identity recognition request message from an IoT card device, use a second shared key to decrypt the SIM chip identification information and PUF chip identification information contained in the identity recognition request message, wherein the second shared key is generated based on the private key of the industrial internet identification platform and the public key of the PUF chip.

14. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the identification method for an IoT card device according to any one of claims 1 to 9 by executing the executable instructions.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the identification method for IoT card devices according to any one of claims 1 to 9.

Images