T-ntru public key cryptography-based secure access authentication method for internet of things terminal

Abstract

The application provides an Internet of Things terminal security access authentication method based on a T-NTRU public key cryptography, which judges whether a terminal device requesting to access the Internet of Things has access permission, and accesses the terminal device with access permission to a security channel of the Internet of Things, and uses a gateway server to allocate unique identity information to the terminal device with access permission of the Internet of Things according to a preset NTRU algorithm, so that the data packet sent by the terminal device to the gateway server can be uniquely identified, and accurate tracking of the data packet in the Internet of Things is ensured; a dynamic hash function is also used for encryption processing to generate a key corresponding to the data packet and update the key, so that the key of the data packet is dynamically changed, and the key is prevented from being cracked and stolen; after the data packet is sent to a target terminal device, a matching decryption process is performed on the data packet, and a notification message is fed back to the gateway server, so that the access security authentication process of the terminal device and the Internet of Things is simplified, and the data security of the Internet of Things is improved.

Description

Technical Field

[0001] This invention relates to the technical field of Internet of Things (IoT) control and management, and in particular to a secure access authentication method for IoT terminals based on T-NTRU public key cryptography. Background Technology

[0002] The Internet of Things (IoT) typically connects a large number of terminal devices, which exchange and transmit data with each other. During this data transmission, IoT gateway servers need to perform various types of business processing on the transmitted data to ensure secure data transmission within the IoT. Existing IoT access security authentication strategies for terminal devices are based on elliptic curve cryptography algorithms. However, the process of authenticating requesting terminal devices using these algorithms is cumbersome and cannot quickly and reliably screen and identify requesting terminal devices. Furthermore, terminal device access implemented in this way is vulnerable to even minor individual attacks, failing to guarantee the data security of the IoT. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a secure access authentication method for IoT terminals based on T-NTRU public-key cryptography. This method determines whether a terminal device requesting access to the IoT has access permissions and connects authorized devices to the IoT's secure channel. A gateway server assigns unique identity information to authorized terminal devices based on a preset NTRU algorithm, ensuring the unique identification of data packets sent from the terminal device to the gateway server and guaranteeing accurate tracking of data packets within the IoT. Furthermore, dynamic hash functions are used to encrypt and generate keys corresponding to data packets and to update these keys, ensuring dynamic key changes and preventing key cracking and theft. After the data packet is sent to the destination terminal device, the method verifies the data packet's matching and decryption process and sends a notification message back to the gateway server, enabling effective monitoring of data packet transmission. This simplifies the secure access authentication process between the terminal device and the IoT and improves the data security of the IoT.

[0004] This invention provides a secure access authentication method for IoT terminals based on T-NTRU public-key cryptography, which includes the following steps:

[0005] Step S1: Obtain access requests from terminal devices to the Internet of Things (IoT); analyze and process the access requests to determine whether the terminal devices have IoT access permissions; identify terminal devices that do not have IoT access permissions; and connect terminal devices with IoT access permissions to the corresponding secure channel of the IoT.

[0006] Step S2: The gateway server corresponding to the secure channel assigns unique identity information to the terminal device with IoT access permission according to a preset NTRU algorithm; and identifies the data packets sent by the terminal device with IoT access permission to the gateway server according to the identity information.

[0007] Step S3: The gateway server performs dynamic hash function encryption on the data packet to allocate a corresponding key to the data packet, and updates the key according to the timestamp information of the data packet being sent by the gateway server; the gateway server then sends the data packet to the corresponding destination terminal device.

[0008] Step S4: After the destination terminal device receives the data packet, it performs matching and decryption processing on the key, and sends a corresponding notification message to the gateway server based on the matching and decryption processing.

[0009] Furthermore, in step S1, obtaining access requests from terminal devices to the Internet of Things (IoT), analyzing and processing the access requests, determining whether the terminal devices have IoT access permissions, and identifying terminal devices that do not have IoT access permissions specifically includes:

[0010] Obtain access requests from terminal devices to the Internet of Things (IoT), extract the IP address information of the terminal devices from the access requests, and trace the access operation log information between the terminal devices and the IoT in a preset historical period based on the IP address information.

[0011] The maximum total number of times the terminal device was continuously denied access to the Internet of Things within a preset historical period is extracted from the access operation log information; if the maximum total number is less than the preset number threshold, it is determined that the terminal device has Internet of Things access permission; otherwise, it is determined that the terminal device does not have Internet of Things access permission.

[0012] Based on the device MCA information and IP address information of terminal devices that do not have IoT access permissions, the access operation log information is updated, thereby enabling the identification of terminal devices that do not have IoT access permissions.

[0013] Furthermore, in step S1, connecting the terminal device with IoT access permissions to the corresponding secure channel of the IoT specifically includes:

[0014] Obtain the current device access status of the IoT security channel with the first access priority; if the device access status indicates that the security channel with the first access priority is already in a state of full device access, then connect the terminal device to a security channel with a lower access priority that is not in a state of full device access.

[0015] Furthermore, in step S2, the process of assigning unique identity information to terminal devices with IoT access permissions through the gateway server corresponding to the secure channel according to a preset NTRU algorithm specifically includes:

[0016] The gateway server corresponding to the secure channel performs corresponding operations based on the set of integers and the set of polynomials contained in the preset NTRU algorithm to generate a unique bit stream, and then distributes the bit stream as identity information to the terminal device.

[0017] Once the terminal device is assigned the corresponding identity information, the channel occupancy priority of the terminal device in the secure channel is set according to the time information of the terminal device accessing the secure channel.

[0018] Furthermore, in step S2, identifying the data packets sent by the terminal device with IoT access permissions to the gateway server based on the identity information specifically includes:

[0019] When a terminal device with IoT access permissions obtains exclusive access to the secure channel, it adds its assigned identity information to the data packets that the terminal device needs to send to the gateway server, using this information as the data index information of the data packets, and then sends the data packets to the gateway server through the secure channel.

[0020] Furthermore, in step S3, the gateway server performs dynamic hash function encryption on the data packet to assign a corresponding key to the data packet, and updates the key according to the timestamp information of the data packet being sent by the gateway server. Specifically, this includes:

[0021] When the gateway server receives the data packet sent by the terminal device, the gateway server performs dynamic hash function processing on the timestamp information of the received data packet to obtain the initial key for data allocation;

[0022] The gateway server estimates the timestamp information of the data packet sent by the gateway server based on its own data packet sending process information, and then performs dynamic hash function processing on the sending timestamp information to obtain another key; the initial key is replaced and updated using the other key.

[0023] Furthermore, in step S3, sending the data packet to the corresponding destination terminal device through the gateway server specifically includes:

[0024] Based on the respective gateway locations of the destination terminal device and the gateway server in the Internet of Things (IoT) to which the data packet needs to be sent, determine the shortest data transmission path between the destination terminal device and the gateway server in the IoT;

[0025] The data packet is sent from the gateway server to the destination terminal device via the shortest data transmission path.

[0026] Furthermore, in step S4, after the destination terminal device receives the data packet, it performs matching and decryption processing on the key, and sends a corresponding notification message to the gateway server based on the matching and decryption processing. Specifically, this includes:

[0027] When the destination terminal device receives the data packet, it performs matching and decryption processing on the current key of the data packet. If the matching and decryption processing is successful, the destination terminal device sends a decryption success notification message to the gateway server. If the matching and decryption processing fails, the destination terminal device sends a decryption failure notification message to the gateway server. At this time, when the terminal device regains exclusive access to the secure channel, the gateway terminal resends the data packet until the matching and decryption processing is successful.

[0028] Compared to existing technologies, this IoT terminal security access authentication method based on T-NTRU public-key cryptography determines whether a terminal device requesting access to the IoT has access permissions and connects authorized terminal devices to the IoT's secure channel. The gateway server assigns unique identity information to authorized terminal devices according to a preset NTRU algorithm, ensuring unique identification of data packets sent from the terminal device to the gateway server and guaranteeing accurate tracking of data packets within the IoT. Furthermore, dynamic hash functions are used to encrypt and generate keys corresponding to data packets and to update these keys, ensuring dynamic key changes and preventing key cracking and theft. After the data packet is sent to the destination terminal device, the method verifies the data packet's matching and decryption, and sends a notification message back to the gateway server, effectively monitoring data packet transmission. This simplifies the access security authentication process between the terminal device and the IoT and improves IoT data security.

[0029] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings.

[0030] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a flowchart illustrating the IoT terminal secure access authentication method based on T-NTRU public key cryptography provided by the present invention. Detailed Implementation

[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] See Figure 1 This is a flowchart illustrating the IoT terminal secure access authentication method based on T-NTRU public key cryptography provided in an embodiment of the present invention. The IoT terminal secure access authentication method based on T-NTRU public key cryptography includes the following steps:

[0035] Step S1: Obtain the access request for IoT from the terminal device, analyze and process the access request, determine whether the terminal device has IoT access permission, and mark the terminal devices that do not have IoT access permission; connect the terminal devices with IoT access permission to the corresponding secure channel of IoT.

[0036] Step S2: The gateway server corresponding to the secure channel assigns unique identity information to the terminal device with IoT access permission according to the preset NTRU algorithm; based on the identity information, the data packets sent by the terminal device with IoT access permission to the gateway server are identified.

[0037] Step S3: The gateway server performs dynamic hash function encryption on the data packet, thereby assigning a corresponding key to the data packet, and updates the key according to the timestamp information of the data packet being sent by the gateway server; the gateway server then sends the data packet to the corresponding destination terminal device.

[0038] Step S4: After the destination terminal device receives the data packet, it performs matching and decryption processing on the key, and sends a corresponding notification message to the gateway server based on the matching and decryption processing.

[0039] The beneficial effects of the above technical solution are as follows: This IoT terminal security access authentication method based on T-NTRU public key cryptography determines whether the terminal device requesting access to the IoT has access permissions, and connects the terminal device with access permissions to the secure channel of the IoT. The gateway server assigns unique identity information to the terminal device with IoT access permissions according to a preset NTRU algorithm, thus enabling unique identification of data packets sent by the terminal device to the gateway server, ensuring accurate tracking of data packets in the IoT. Furthermore, dynamic hash function encryption is used to generate and update the keys corresponding to the data packets, ensuring the dynamic changeability of the keys and preventing key cracking and theft. After the data packet is sent to the destination terminal device, the gateway server receives a corresponding notification message based on the destination terminal device's matching and decryption of the data packet, achieving effective monitoring of data packet transmission. This simplifies the access security authentication process between the terminal device and the IoT, improving the data security of the IoT.

[0040] Preferably, in step S1, obtaining an access request from a terminal device to the Internet of Things (IoT), analyzing and processing the access request, determining whether the terminal device has IoT access permissions, and identifying terminal devices that do not have IoT access permissions specifically includes:

[0041] Obtain access requests from terminal devices to the Internet of Things (IoT), extract the IP address information of the terminal device from the access request, and trace the access operation log information between the terminal device and the IoT in a preset historical period based on the IP address information.

[0042] The maximum total number of times the terminal device was continuously denied access to the Internet of Things within a preset historical period is extracted from the access operation log information; if the maximum total number is less than the preset threshold, the terminal device is determined to have Internet of Things access permission; otherwise, the terminal device is determined not to have Internet of Things access permission.

[0043] Based on the device MCA information and IP address information of terminal devices that do not have IoT access permissions, the access operation log information is updated, thereby enabling the identification of terminal devices that do not have IoT access permissions.

[0044] The beneficial effects of the above technical solution are as follows: By using the IP address information of the terminal device initiating the access request as a basis, access operation log information between the terminal device and the Internet of Things (IoT) within a preset historical period is obtained. If the maximum total number of consecutive rejections for a terminal device within the preset historical period is too large, it indicates that the terminal device is highly likely to be rejected for access due to data security issues within the preset historical period. In this case, it is determined that the terminal device does not have IoT access permissions, which can maximize the data security of the IoT. In addition, the access operation log information is updated based on the device MCA information and IP address information of the terminal device that does not have IoT access permissions, which can provide a reliable basis for judgment for the terminal device's next request to access the IoT.

[0045] Preferably, in step S1, connecting the terminal device with IoT access permissions to the corresponding secure channel of the IoT specifically includes:

[0046] Obtain the current device access status of the IoT security channel with the first access priority; if the device access status indicates that the security channel with the first access priority is already in a state of full device access, then connect the terminal device to the security channel with the second access priority and which is not in a state of full device access.

[0047] The beneficial effects of the above technical solution are as follows: In practical work, the Internet of Things can be set up with multiple security channels, and all security channels have corresponding access priority order. Among them, the security channel with the first access priority will be used first for the connection between the terminal device and the Internet of Things. In this way, it can be guaranteed that the terminal device can connect to the Internet of Things at the fastest speed.

[0048] Preferably, in step S2, the process of assigning unique identity information to terminal devices with IoT access permissions through the gateway server corresponding to the secure channel according to a preset NTRU algorithm specifically includes:

[0049] The gateway server corresponding to the secure channel performs corresponding operations based on the set of integers and polynomials contained in the preset NTRU algorithm to generate a unique bit stream, and then distributes the bit stream as identity information to the terminal device.

[0050] Once the terminal device is assigned the corresponding identity information, the channel occupancy priority of the terminal device on the secure channel is set according to the time information of the terminal device accessing the secure channel.

[0051] The beneficial effects of the above technical solution are as follows: By utilizing the integer and polynomial sets included in the preset NTRU algorithm for corresponding algorithmic operations, a unique identity information can be generated for the terminal device. This allows for the unique identification of any data interaction behavior of the terminal device when accessing the Internet of Things, effectively and accurately tracking the data interaction behavior of the terminal device. The use of the integer and polynomial sets included in the preset NTRU algorithm to generate a unique bitstream is a conventional technique in this field and will not be described in detail here.

[0052] Preferably, in step S2, identifying the data packets sent by the terminal device with IoT access permissions to the gateway server based on the identity information specifically includes:

[0053] When a terminal device with IoT access permissions obtains exclusive access to the secure channel, its assigned identity information is added to the data packets that the terminal device needs to send to the gateway server, which serves as the data index information for the data packets, and then the data packets are sent to the gateway server through the secure channel.

[0054] The beneficial effects of the above technical solution are as follows: In actual work, all terminal devices accessing the same secure channel will be assigned exclusive access rights to the secure channel that do not overlap. Each terminal device will obtain a corresponding time period to realize its exclusive access rights to the secure channel. When the terminal device with IoT access rights obtains the exclusive access rights to the secure channel, it first adds its assigned identity information to the data packets to be sent, thereby identifying the terminal device to which the data packets belong.

[0055] Preferably, in step S3, the gateway server performs dynamic hash function encryption on the data packet to assign a corresponding key to the data packet, and updates the key according to the timestamp information of the data packet being sent by the gateway server. Specifically, this includes:

[0056] When the gateway server receives the data packet sent by the terminal device, the gateway server performs dynamic hash function processing on the timestamp information of the received data packet to obtain the initial key for data allocation;

[0057] Based on its own information on the sending process of all data packets, the gateway server estimates the timestamp information of the data packet sent by the gateway server, and then processes the timestamp information by a dynamic hash function to obtain another key; the original key is then replaced and updated using this other key.

[0058] The beneficial effects of the above technical solution are as follows: By using the above method, an initial key and another key are generated based on the timestamp information of the gateway server when the data packet is received and the timestamp information of the data packet when it is sent by the gateway server, respectively. This enables dynamic changes in the key and avoids the data packet's corresponding key from being tampered with or stolen due to its static nature, thus ensuring the data security of the data packet.

[0059] Preferably, in step S3, sending the data packet to the corresponding destination terminal device through the gateway server specifically includes:

[0060] Based on the respective gateway locations of the destination terminal device and the gateway server in the Internet of Things (IoT) to which the data packet needs to be sent, determine the shortest data transmission path between the destination terminal device and the gateway server in the IoT;

[0061] The data packet is sent from the gateway server to the destination terminal device via the shortest data transmission path.

[0062] The beneficial effects of the above technical solution are as follows: by using the above method, it is possible to ensure that data packets are sent from the gateway server to the destination terminal device along the shortest data transmission path, thereby improving the transmission speed of data packets in the Internet of Things.

[0063] Preferably, in step S4, after the destination terminal device receives the data packet, it performs matching and decryption processing on the key, and sends a corresponding notification message to the gateway server based on the matching and decryption processing. Specifically, this includes:

[0064] When the destination terminal device receives the data packet, it performs matching and decryption processing on the current key of the data packet. If the matching and decryption processing is successful, the destination terminal device sends a decryption success notification message to the gateway server. If the matching and decryption processing fails, the destination terminal device sends a decryption failure notification message to the gateway server. At this time, when the terminal device regains exclusive access to the secure channel, the gateway terminal resends the data packet until the matching and decryption processing is successful.

[0065] The beneficial effects of the above technical solution are as follows: through the above method, the matching and decryption processing results of the destination terminal device for data packets can be fed back to the gateway server in a timely manner, and when the matching and decryption processing fails, the data packets are resent to the destination terminal device to avoid data packet loss.

[0066] As can be seen from the above embodiments, this IoT terminal security access authentication method based on T-NTRU public key cryptography determines whether a terminal device requesting access to the IoT has access permissions, and connects the terminal device with access permissions to the IoT security channel. The gateway server assigns unique identity information to the terminal device with IoT access permissions according to a preset NTRU algorithm, thus uniquely identifying the data packets sent by the terminal device to the gateway server, ensuring accurate tracking of data packets in the IoT. Furthermore, dynamic hash function encryption is used to generate and update the keys corresponding to the data packets, ensuring the dynamic changeability of the keys and preventing key cracking and theft. After the data packet is sent to the destination terminal device, the destination terminal device performs matching and decryption of the data packet and sends a notification message back to the gateway server, achieving effective monitoring of data packet transmission. This simplifies the access security authentication process between the terminal device and the IoT and improves the data security of the IoT.

[0067] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A secure access authentication method for IoT terminals based on T-NTRU public-key cryptography, characterized in that, It includes the following steps: Step S1: Obtain access requests from terminal devices to the Internet of Things (IoT); analyze and process the access requests to determine whether the terminal devices have IoT access permissions; identify terminal devices that do not have IoT access permissions; and connect terminal devices with IoT access permissions to the corresponding secure channel of the IoT. Step S2: The gateway server corresponding to the secure channel assigns unique identity information to the terminal device with IoT access permission according to a preset NTRU algorithm; and identifies the data packets sent by the terminal device with IoT access permission to the gateway server according to the identity information. Step S3: The gateway server performs dynamic hash function encryption on the data packet to allocate a corresponding key to the data packet, and updates the key according to the timestamp information of the data packet being sent by the gateway server. The data packet is sent to the corresponding destination terminal device through the gateway server; Step S4: After the destination terminal device receives the data packet, it performs matching and decryption processing on the key, and sends a corresponding notification message to the gateway server based on the matching and decryption processing.

2. The IoT terminal secure access authentication method based on T-NTRU public key cryptography as described in claim 1, characterized in that: In step S1, obtaining an access request from a terminal device to the Internet of Things (IoT), analyzing and processing the access request to determine whether the terminal device has IoT access permissions, and identifying terminal devices that do not have IoT access permissions specifically includes: Obtain access requests from terminal devices to the Internet of Things (IoT), extract the IP address information of the terminal devices from the access requests, and trace the access operation log information between the terminal devices and the IoT in a preset historical period based on the IP address information. The maximum total number of times the terminal device was continuously denied access to the Internet of Things within a preset historical period is extracted from the access operation log information; if the maximum total number is less than the preset number threshold, it is determined that the terminal device has Internet of Things access permission; otherwise, it is determined that the terminal device does not have Internet of Things access permission. Based on the device MCA information and IP address information of terminal devices that do not have IoT access permissions, the access operation log information is updated, thereby enabling the identification of terminal devices that do not have IoT access permissions.

3. The IoT terminal secure access authentication method based on T-NTRU public key cryptography as described in claim 2, characterized in that: In step S1, connecting the terminal device with IoT access permissions to the corresponding secure channel of the IoT specifically includes: Obtain the current device access status of the IoT security channel with the first access priority; if the device access status indicates that the security channel with the first access priority is already in a state of full device access, then connect the terminal device to a security channel with a lower access priority that is not in a state of full device access.

4. The IoT terminal secure access authentication method based on T-NTRU public key cryptography as described in claim 3, characterized in that: In step S2, assigning unique identity information to terminal devices with IoT access permissions through the gateway server corresponding to the secure channel according to a preset NTRU algorithm specifically includes: The gateway server corresponding to the secure channel performs corresponding operations based on the set of integers and the set of polynomials contained in the preset NTRU algorithm to generate a unique bit stream, and then distributes the bit stream as identity information to the terminal device. Once the terminal device is assigned the corresponding identity information, the channel occupancy priority of the terminal device in the secure channel is set according to the time information of the terminal device accessing the secure channel.

5. The IoT terminal secure access authentication method based on T-NTRU public key cryptography as described in claim 4, characterized in that: In step S2, identifying the data packets sent by the terminal device with IoT access permissions to the gateway server based on the identity information specifically includes: When a terminal device with IoT access permissions obtains exclusive access to the secure channel, it adds its assigned identity information to the data packets that the terminal device needs to send to the gateway server, using this information as the data index information of the data packets, and then sends the data packets to the gateway server through the secure channel.

6. The IoT terminal secure access authentication method based on T-NTRU public key cryptography as described in claim 5, characterized in that: In step S3, the gateway server performs dynamic hash function encryption on the data packet to allocate a corresponding key to the data packet, and updates the key according to the timestamp information of the data packet being sent by the gateway server. Specifically, when the gateway server receives the data packet sent by the terminal device, the gateway server performs dynamic hash function processing on the timestamp information of the received data packet to obtain the initial key allocated to the data packet. The gateway server estimates the timestamp information of the data packet sent by the gateway server based on its own data packet sending process information, and then performs dynamic hash function processing on the sending timestamp information to obtain another key; the initial key is replaced and updated using the other key.

7. The IoT terminal secure access authentication method based on T-NTRU public key cryptography as described in claim 6, characterized in that: In step S3, sending the data packet to the corresponding destination terminal device through the gateway server specifically includes: Based on the respective gateway locations of the destination terminal device and the gateway server in the Internet of Things (IoT) to which the data packet needs to be sent, determine the shortest data transmission path between the destination terminal device and the gateway server in the IoT; The data packet is sent from the gateway server to the destination terminal device via the shortest data transmission path.

8. The IoT terminal secure access authentication method based on T-NTRU public key cryptography as described in claim 7, characterized in that: In step S4, after the destination terminal device receives the data packet, it performs matching and decryption processing on the key, and sends a corresponding notification message to the gateway server based on the matching and decryption processing. Specifically, this includes: When the destination terminal device receives the data packet, it performs matching and decryption processing on the current key of the data packet. If the matching and decryption processing is successful, the destination terminal device sends a decryption success notification message to the gateway server. If the matching and decryption processing fails, the destination terminal device sends a decryption failure notification message to the gateway server. At this time, when the terminal device regains exclusive access to the secure channel, the gateway terminal resends the data packet until the matching and decryption processing is successful.

Images