A remote user trusted authentication system, method and medium in an internet of things environment

Abstract

The application belongs to the technical field of trusted authentication, and discloses a remote user trusted authentication system, method and medium in an Internet of Things environment. The system comprises a registration center (RC), which is a trusted server and is used for safely registering or initializing other entities; an intelligent device, which is arranged in an environment and is used for collecting and transmitting data; a gateway, which supports interconnection between different protocol networks and has computing and storage capabilities; a user, who accesses remote intelligent devices through a login device; and the login device, which is used for user trustworthiness verification. The login device includes but is not limited to a mobile device, an intelligent card and a PC. Through the system and method, the trusted authentication of remote users can be realized, and safe communication between the user and the intelligent device is established. Meanwhile, the application can also solve the problems of public key cryptography complexity, user authentication vulnerability and symmetric cryptography limitations.

Description

Technical Field

[0001] This invention belongs to the field of trusted authentication technology, and in particular relates to a trusted authentication system, method and medium for remote users in an Internet of Things (IoT) environment. Background Technology

[0002] Currently, an increasing number of smart devices are deployed in various environments to collect, process, transmit, and receive data, enabling us to control any environment, system, and interconnected smart device. In many IoT applications, remote users need real-time access to and control of smart devices, such as remote industrial control. In such scenarios, unauthorized access to smart devices can lead to catastrophic consequences. The connection between remote users and smart devices is via the Internet and wireless networks. These open networks are susceptible to various attacks, a typical example being the threat model proposed by Dolev et al., where attackers can completely control the communication channel in an open network, and the communicating parties are not considered trusted entities. Therefore, before remote users can access smart devices, trust authentication must be performed. This requires not only verifying that the user is a trusted entity but also mutual authentication between the user and the smart device, negotiating a secure communication key to ensure secure communication between them.

[0003] Currently, many secure communication methods exist in IoT environments, but they mainly suffer from several problems: First, they use computationally intensive public-key cryptography. While public-key cryptography makes it easier to implement certain security attributes, it is inefficient for IoT devices due to their limited resources. Second, there are vulnerabilities in authenticating legitimate users. When an attacker obtains a user's login device (such as a smart card or mobile device), they can use power analysis to extract information stored on the device, potentially leading to the leakage of the user's password or fingerprint information. The attacker can then use the login device to impersonate a legitimate user and remotely access the smart device. Third, while remote access methods using symmetric cryptography are lightweight, some important security attributes are difficult to achieve, such as anonymity and perfect forward secrecy.

[0004] Based on the above analysis, the problems and shortcomings of the existing technology are as follows:

[0005] (1) Computational complexity of public-key cryptography: Public-key cryptography can achieve more security attributes, but for resource-constrained IoT devices, performing computationally complex public-key cryptographic operations is inefficient.

[0006] (2) User authentication vulnerability: A vulnerability exists in determining user legitimacy. Attackers can compromise the login device used by the user, such as a smart card or mobile device, and extract information stored in the device using methods such as power analysis. This may lead to the leakage of the user's password or fingerprint information, allowing the attacker to impersonate a legitimate user and remotely access the smart device.

[0007] (3) Limitations of symmetric cryptography: Although remote access methods using symmetric cryptography are lightweight, they struggle to achieve certain important security properties, such as anonymity and perfect forward secrecy. These security properties are crucial for ensuring secure communication between users and smart devices. Summary of the Invention

[0008] To address the problems existing in the prior art, this invention provides a trusted authentication system, method, and medium for remote users in an Internet of Things (IoT) environment.

[0009] This invention is implemented as follows: a remote user trusted authentication system in an Internet of Things (IoT) environment, the system comprising:

[0010] A Registration Center (RC) is a trusted server used to securely register or initialize other entities.

[0011] Smart devices, deployed in the environment, are used to collect and transmit data;

[0012] A gateway supports interconnection between networks using different protocols and has certain computing and storage capabilities.

[0013] Users can access remote smart devices by logging into the device.

[0014] A login device is used for user trust verification; the login device includes, but is not limited to, mobile devices, smart cards, and PCs.

[0015] Furthermore, the registration center registers other entities offline via a secure channel; each smart device connects to a nearby gateway wirelessly or via a wired connection; users connect to the Internet using a login device and then access remote smart devices through a gateway node.

[0016] Furthermore, before accessing the smart device, the user needs to perform user trust verification and mutual authentication between the user and the smart device. After this process is completed, a temporary key is generated between the user and the smart device to protect their secure communication.

[0017] Another object of the present invention is to provide a method for trusted authentication of remote users in an Internet of Things (IoT) environment, which implements the aforementioned trusted authentication system for remote users in an IoT environment, the method comprising:

[0018] (1) Setup phase;

[0019] (2) Registration stage;

[0020] (3) User trustworthiness verification stage;

[0021] (4) Certification stage;

[0022] The setup phase specifically includes:

[0023] The registration center selects an identity IDG and a long-term key KG for the gateway GX connected to the system; selects an identity IDs for the smart device SY connected to the gateway, and calculates a credential SCS = h(IDS||KG) for the smart device; then stores the parameter {IDS} in the gateway and stores {IDS,SCS} in the smart device SY.

[0024] Furthermore, the registration phase specifically includes the following steps:

[0025] Step 1. When remote user Ui first uses login device L, he / she is asked to choose a username IDi and a password PWi; then login device L calculates two parameters: ULi = h(IDi||si) and ULUi = h(IDi||PWi||si), where h(·) is a one-way hash function in cryptography, and si is a random number generated by the login device; the login device transmits these two parameters {ULi, ULUi} to the registration center for registration;

[0026] Step 2. The registration center generates a dynamic identity DIDi for the user, sets {DIDoldi = null, DIDnewi = DIDi}, and stores it in the corresponding gateway; the registration center calculates a secret parameter P1 = h(KG)⊕h(ULi||ULUi); then transmits the user's dynamic identity DIDi and secret parameter Ai to the login device;

[0027] Step 3. The login device requires the user to press their fingerprint Fi. Since the fingerprint information entered by the user varies slightly each time, a fuzzy extractor is needed to correctly identify the user's fingerprint. The login device uses the fuzzy extractor's generation program G(·) to calculate the public parameter ppi and the secret parameter spi based on the user's fingerprint, i.e., G(Fi) = (ppi, spi). Subsequently, the login device cryptographically binds the user to the login device. This process requires calculating h(KG) = P1⊕h(ULi||ULUi), P2 = si⊕h(IDi||PWi||spi), P3 = h(KG)⊕h(IDi||PWi||spi), TTi = h(h(KG)⊕si⊕h(IDi||PWi||spi)). Finally, some parameters {DIDoldi = null, DIDnewi = DIDi, P2, TTi, P3, ppi, G(·), R(·), h(+)} are stored in the login device.

[0028] Furthermore, the user trust verification stage specifically includes the following steps:

[0029] Step 1. When using the login device, the user is required to enter the username IDi, password PWi, and press the fingerprint Fi*; the login device uses the fuzzy extractor's reconstruction program R(·) to calculate the secret parameter spi*=R(Fi*,ppi) of the fingerprint based on the user's fingerprint information;

[0030] Step 2. The login device calculates si*=P2⊕h(IDi||PWi||spi*), h(KG)=P3⊕h(IDi||PWi||spi*), TTi*=h(h(KG)⊕si*⊕h(IDi||PWi||spi*)); and determines whether the calculated TTi* is equal to the stored TTi; if they are the same, the login device recognizes the user as genuine.

[0031] Furthermore, the authentication phase specifically includes the following steps:

[0032] Step 1. After successful trusted authentication, the user selects the smart device SY to access. The login device generates a random number n1 and the current timestamp T1, and calculates R1 = n1⊕h(h(KG)||T1), R2 = h(h(KG)||DIDi||n1||T1), R3 = IDs⊕h(h(KG)||n1||T1), R4 = h(IDi||PWi||si||spi)⊕h(h(KG||n1). Finally, the login device transmits the message M1 = {R1,R2,R3,R4,DIDi,T1} to the gateway through the public channel.

[0033] Step 2. The gateway determines message freshness based on whether the difference between the received message timestamp T1* and T1 is less than a certain threshold value ΔT. If the message is fresh, the gateway checks if the user's dynamic identity DIDi exists in its storage. After this query is successful, the gateway calculates n1* = R1⊕h(h(KG)||T1), R2* = h(h(KG)||DIDi||n1*||T1), compares R2* with R2, and if they are equal, the gateway calculates IDs = R3⊕h(h(KG)||n1||T1), h(IDi||PWi||si||spi) = R4⊕h(h(KG)||n1), and re-selects a dynamic identity DIDnewi for the user, storing the user's two consecutive dynamic identities {DIDold} in its database. The gateway generates a random number n2 and the current timestamp T2, and calculates RR1=n2⊕h(SCS||T2), RR2=h(h(IDi||PWi||si||spi)||h(KG)||TIDi||TIDnewi||h(SCS||n2||T2)), RR3=h(KG)⊕TIDi⊕h(SCS||n2), RR4=h(KG)⊕DIDnewi⊕h(SCS||n2||T2), RR5=RR2⊕h(SCS||IDs||n2||T2), RR6=h(RR2||SCS||n2||T2); Finally, the gateway transmits the message M2={RR1,RR3,RR4,RR5,RR6,T2} to the smart device through the public channel;

[0034] Step 3. The smart device verifies whether the received message is fresh; if the received message is fresh, the smart device calculates n2*=RR1⊕h(SCS||T2), RR2*=RR5⊕h(SCS||IDs||n2||T2), and checks whether RR6*=h(RR2*||SCS||n2*||T2) is true; after the condition is met, the smart device calculates h(KG)⊕DIDi=RR3⊕h(SCS||n2), h(KG)⊕DIDnewi=RR4⊕h(SCS||n2||T2); then generates a random number n3 for the current timestamp T3, and... Calculate RRR1 = n3 ⊕ h(h(KG) ⊕ DIDi), RRR2 = h(KG) ⊕ DIDnewi ⊕ h(h(KG) ⊕ DIDi) ⊕ n3, RRR3 = h(SCS||n2||T2) ⊕ h(h(KG) ⊕ DIDi) ⊕ T3, SK = h(RR2 *||h(SCS||n2||T2)||n3||T3), RRR4 = h(SK||h(KG) ⊕ DIDnewi||n3||T3); Finally, the smart device transmits the message M3 = {RRR1, RRR2, RRR3, RRR4, T3} to the login device through a public channel;

[0035] Step 4. Log in to the device to verify if the received message is fresh; if the received message is fresh, the device calculates n3=RRR1⊕h(h(KG)⊕DIDi),h(KG)⊕DIDnewi=RRR2⊕h(h(KG)⊕DIDi)⊕n3,h(SCS||n2||T2)=RRR3⊕h(h(KG)⊕DIDi)⊕T3,RR2=h(h(IDi||PWi||si||spi)||h(KG)||DIDi| |DIDnewi||h(SCS||n2||T2)),SK=h(RR2||h(SCS||n2||T2)||n3||T3), check if RRR4*=h(SK||h(KG)⊕TIDnewi||n3||T3) is true. If the condition is met, the login device has authenticated the smart device; a temporary key SK is generated between the login device and the smart device; after this process is completed, the login device will re-store the two consecutive user dynamic identities in the memory.

[0036] Another object of the present invention is to provide a computer device including a memory and a processor, the memory storing a computer program, which, when executed by the processor, causes the processor to perform the steps of the remote user trusted authentication method in the Internet of Things environment.

[0037] Another object of the present invention is to provide a computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to perform the steps of the remote user trusted authentication method in the Internet of Things environment.

[0038] Another objective of this invention is to provide an information data processing terminal for implementing a remote user trusted authentication system in the Internet of Things environment.

[0039] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:

[0040] First, the system and method of this invention enable trusted authentication of remote users and establish secure communication between users and smart devices. Furthermore, this invention addresses issues such as the computational complexity of public-key cryptography, user authentication vulnerabilities, and the limitations of symmetric cryptography.

[0041] This invention employs an authentication scheme based on hash functions and cryptographic algorithms, reducing the computational complexity for resource-constrained IoT devices and improving system efficiency. By using hash functions and cryptographic algorithms, user trust verification and mutual authentication between users and smart devices can be achieved, ensuring secure communication between users and smart devices.

[0042] The authentication scheme provided by this invention also possesses certain security and protection features. By using dynamic identity and secret parameters, it can prevent attackers from forging user identities by attacking the user's login device. Simultaneously, through message encryption and verification, it can prevent information leakage and tampering, ensuring secure communication between the user and the smart device.

[0043] The authentication scheme of this invention also possesses a certain degree of flexibility and scalability. By using dynamic identities and temporary keys, the identities and keys of users and smart devices can be flexibly managed, while supporting secure communication between multiple users and smart devices. The introduction of a registration center and gateway nodes in the system architecture gives the system good scalability, allowing it to adapt to IoT environments of varying sizes and complexities.

[0044] In summary, the technical solution of the present invention can solve the problem of trusted authentication of remote users in the Internet of Things (IoT) environment, has creative technical effects, and improves the security and reliability between users and smart devices in the IoT environment.

[0045] Secondly, the technical effects and advantages of the technical solution protected by this invention are mainly reflected in the following three aspects. First, by using cryptographic technology to bind the user and the login device, when the login device is stolen or lost, attackers cannot perform certain attacks, such as offline password guessing attacks and biometric template leakage attacks, thereby enabling the verification of the user's trustworthiness. Second, our technical solution uses only lightweight cryptographic primitives, which are suitable for the Internet of Things environment and can resist various known attacks, especially achieving some very critical security attributes. Finally, the technical solution to be protected adopts piggybacking technology, that is, using a single message to achieve several functions simultaneously, greatly reducing the number of interactions between the two parties and improving the efficiency of the authentication scheme.

[0046] (5) The application of IoT technology is ubiquitous, and security is a crucial issue that needs to be addressed when deploying IoT applications. This invention solves some security problems related to remote user access to smart devices in IoT applications, achieving user authentication and secure communication between users and smart devices. Therefore, the technical solution of this invention has broad application prospects in IoT applications such as remote access control (e.g., smart homes, remote industrial IoT control, and metaverse environments). Thus, the technical solution of this invention, once transformed, will bring significant expected benefits and commercial value with the application of IoT technology.

[0047] Third, in the Internet of Things (IoT) environment, each component of this remote user trusted authentication system has achieved significant technological advancements:

[0048] 1. Registry Center (RC): A significant technological advancement in Registries is the ability to register or initialize other entities offline via secure channels. This utilizes advanced encryption techniques to ensure the security and integrity of data during the registration process. Furthermore, the use of machine learning and artificial intelligence technologies enhances security by enabling the detection and prevention of anomalous behavior.

[0049] 2) Smart Devices: A significant technological advancement in smart devices is their miniaturization and energy efficiency optimization. Today's smart devices are not only smaller but also consume less power, enabling them to be deployed and operate in a wider range of environments. Furthermore, these devices can now connect to networks wirelessly or via wired connections, enhancing their connectivity and convenience.

[0050] 3) Gateways: A significant technological advancement in gateways is their ability to support interconnection between networks using different protocols. This enhances interoperability between devices and allows a wider variety of devices to access the network. Furthermore, modern gateways possess greater computing and storage capabilities, enabling them to process more data and run more complex algorithms.

[0051] 4) Login Devices: A significant technological advancement in login devices is multi-factor authentication (MFA). This makes the user authentication process more secure because it requires users to provide multiple forms of evidence to prove their identity. Furthermore, biometric technologies such as fingerprint and facial recognition are widely used on devices like smartphones and computers, improving the convenience and security of user verification.

[0052] 5) Mutual authentication and temporary key generation between users and smart devices: This is a significant security advancement that ensures the security of communication between users and devices. By using advanced encryption algorithms, a temporary key can be generated between users and devices to encrypt their communication, preventing data theft or tampering. Attached Figure Description

[0053] Figure 1 This is a structural diagram of a remote user trusted authentication system in an IoT environment provided by an embodiment of the present invention;

[0054] Figure 2 This is a schematic diagram of entity registration in a remote user trusted authentication system in an Internet of Things environment provided by an embodiment of the present invention;

[0055] Figure 3 This is a schematic diagram illustrating the principle of a remote user trusted authentication system in an IoT environment provided in an embodiment of the present invention. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0057] like Figure 1 As shown, the present invention provides a remote user trusted authentication system in an Internet of Things (IoT) environment, the system comprising:

[0058] A Registration Center (RC) is a trusted server used to securely register or initialize other entities.

[0059] Smart devices, deployed in the environment, are used to collect and transmit data;

[0060] A gateway supports interconnection between networks using different protocols and has computing and storage capabilities;

[0061] Users can access remote smart devices by logging into the device.

[0062] A login device is used for user trust verification; the login device includes, but is not limited to, mobile devices, smart cards, and PCs.

[0063] like Figure 2 As shown, the registration center registers other entities offline via a secure channel. Each smart device connects to a nearby gateway wirelessly or via a wired connection; users connect to the Internet using a login device and then access remote smart devices through the gateway node.

[0064] Furthermore, before accessing the smart device, the user needs to perform user trust verification and mutual authentication between the user and the smart device. After this process is completed, a temporary key is generated between the user and the smart device to protect their secure communication.

[0065] like Figure 3 As shown, the user logs in using a login device, which performs feasibility authentication. Upon successful verification, the login device initiates an authentication request. The gateway authenticates the login device. After successful authentication, the gateway encrypts the authentication information and transmits it to the smart device. The smart device authenticates the user; upon successful authentication, the smart device sends information to the user, who then authenticates the smart device. Upon successful authentication, a secure communication temporary key is generated between the user and the smart device.

[0066] To achieve this objective, the technical solution of the present invention includes a setup stage, a registration stage, a user credibility verification stage, and an authentication stage.

[0067] (1) Setup phase:

[0068] The registry center selects an identity IDG and a long-term key KG for the gateway GX connected to the system. It selects an identity IDs for the smart device SY connected to the gateway and calculates a credential SCS = h(IDS||KG) for the smart device. The parameter {IDS} is then stored in the gateway, and {IDS, SCS} is stored in the smart device SY.

[0069] (2) Registration stage:

[0070] Step 1. When remote user Ui first uses login device L, they are prompted to choose a username IDi and a password PWi. Login device L then calculates two parameters: ULi = h(IDi||si) and ULUi = h(IDi||PWi||si), where h(·) is a one-way hash function in cryptography, and si is a random number generated by the login device. The login device then transmits these two parameters {ULi, ULUi} to the registration center for registration.

[0071] Step 2. The registration center generates a dynamic identity DIDi for the user, sets {DIDoldi = null, DIDnewi = DIDi}, and stores it in the corresponding gateway. The registration center calculates a secret parameter P1 = h(KG)⊕h(ULi||ULUi). Then, it transmits the user's dynamic identity DIDi and secret parameter Ai to the login device.

[0072] Step 3. The login device requires the user to press their fingerprint Fi. Since the fingerprint information entered by the user varies slightly each time, a fuzzy extractor is needed to correctly identify the user's fingerprint. The login device uses the fuzzy extractor's generation program G(·) to calculate the public parameter ppi and the secret parameter spi based on the user's fingerprint, i.e., G(Fi) = (ppi, spi). The login device then cryptographically binds the user to the login device. This process requires calculating h(KG) = P1⊕h(ULi||ULUi), P2 = si⊕h(IDi||PWi||spi), P3 = h(KG)⊕h(IDi||PWi||spi), TTi = h(h(KG)⊕si⊕h(IDi||PWi||spi)). Finally, some parameters {DIDoldi = null, DIDnewi = DIDi, P2, TTi, P3, ppi, G(·), R(·), h(+)} are stored in the login device.

[0073] (3) User trustworthiness verification stage

[0074] Step 1. When logging into the device, the user is prompted to enter the username IDi, password PWi, and press their fingerprint Fi*. The login device uses the fuzzy extractor's reconstruction program R(·) to calculate the fingerprint's secret parameters spi* = R(Fi*, ppi) based on the user's fingerprint information.

[0075] Step 2. The login device calculates si*=P2⊕h(IDi||PWi||spi*), h(KG)=P3⊕h(IDi||PWi||spi*), TTi*=h(h(KG)⊕si*⊕h(IDi||PWi||spi*)). It then checks if the calculated TTi* is equal to the stored TTi. If they are the same, the login device recognizes the user as genuine.

[0076] (4) Certification Phase

[0077] Step 1. After successful trusted authentication, the user selects the smart device SY to access. The login device generates a random number n1 and the current timestamp T1, and calculates R1 = n1⊕h(h(KG)||T1), R2 = h(h(KG)||DIDi||n1||T1), R3 = IDs⊕h(h(KG)||n1||T1), R4 = h(IDi||PWi||si||spi)⊕h(h(KG||n1). Finally, the login device transmits the message M1 = {R1,R2,R3,R4,DIDi,T1} to the gateway through the public channel.

[0078] Step 2. The gateway determines the freshness of a message based on whether the difference between the received message timestamp T1* and T1 is less than a certain threshold ΔT. If the message is fresh, the gateway checks if the user's dynamic identity DIDi exists in its storage. After this query is successful, the gateway calculates n1* = R1⊕h(h(KG)||T1), R2* = h(h(KG)||DIDi||n1*||T1), compares R2* with R2, and if they are equal, the gateway calculates IDs = R3⊕h(h(KG)||n1||T1), h(IDi||PWi||si||spi) = R4⊕h(h(KG)||n1), and re-selects a dynamic identity DIDnewi for the user, storing the user's two consecutive dynamic identities {DIDoldi, DIDnewi} in its database. The gateway generates a random number n2 and the current timestamp T2, and calculates RR1 = n2⊕h( SCS||T2), RR2=h(h(IDi||PWi||si||spi)||h(KG)||TIDi||TIDnewi||h(SCS||n2||T2)), RR3=h(KG)⊕TIDi⊕h(SCS||n2), RR4=h(KG)⊕DIDnewi⊕h(SCS||n2||T2), RR5=RR2⊕h(SCS||IDs||n2||T2), RR6=h(RR2||SCS||n2||T2). Finally, the gateway transmits message M2={RR1,RR3,RR4,RR5,RR6,T2} to the smart device through the public channel.

[0079] Step 3. The smart device verifies whether the received message is fresh. If the received message is fresh, the smart device calculates n2*=RR1⊕h(SCS||T2), RR2*=RR5⊕h(SCS||IDs||n2||T2), and checks whether RR6*=h(RR2*||SCS||n2*||T2) is true. After the condition is met, the smart device calculates h(KG)⊕DIDi=RR3⊕h(SCS||n2), h(KG)⊕DIDnewi=RR4⊕h(SCS||n2||T2). Then, a random number n3 is generated, and the current timestamp T3 is calculated. RRR1 = n3 ⊕ h(h(KG) ⊕ DIDi), RRR2 = h(KG) ⊕ DIDnewi ⊕ h(h(KG) ⊕ DIDi) ⊕ n3, RRR3 = h(SCS||n2||T2) ⊕ h(h(KG) ⊕ DIDi) ⊕ T3, SK = h(RR2 * ||h(SCS||n2||T2)||n3||T3), RRR4 = h(SK||h(KG) ⊕ DIDnewi||n3||T3). Finally, the smart device transmits the message M3 = {RRR1, RRR2, RRR3, RRR4, T3} to the logged-in device via a public channel.

[0080] Step 4. Log in to the device to verify if the received message is fresh. If the received message is fresh, the login device calculates n3=RRR1⊕h(h(KG)⊕DIDi),h(KG)⊕DIDnewi=RRR2⊕h(h(KG)⊕DIDi)⊕n3,h(SCS||n2||T2)=RRR3⊕h(h(KG)⊕DIDi)⊕T3,RR2=h(h(IDi||PWi||si||spi)||h(KG)||DIDi||DIDnewi||h(SCS||n2||T2)),SK=h(RR2||h(SCS||n2||T2)||n3||T3), and checks whether RRR4*=h(SK||h(KG)⊕TIDnewi||n3||T3) is true. If the condition is met, the login device has authenticated the smart device. A temporary key SK is generated between the login device and the smart device. After this process is completed, the login device will re-store the two consecutive dynamic user identities in its memory.

[0081] Working principle of the invention:

[0082] This invention primarily implements trusted authentication of remote users in an Internet of Things (IoT) environment. Its working principle is as follows: cryptographic technology is used to bind the user to their login device, ensuring the legitimacy of the entity using the login device can be verified even if the device is lost. Following this process, the user and the remote smart device perform mutual authentication and negotiate a temporary key for subsequent secure communication. The implementation process includes four stages: The first stage is the setup stage, where the registry center sets parameters for the gateways and smart devices connected to the system. The second stage is the registration stage, where the registry center registers users accessing the system, using cryptographic technology to bind user information (such as passwords and fingerprints) to the login device. The third stage is the user trusted verification stage, where the user's trustedness is verified before using the login device to ensure the user actually possesses the device. The fourth stage is the mutual authentication between the user and the remote smart device; upon successful authentication, a temporary key is negotiated for subsequent secure communication.

[0083] The user trust authentication method provided in the application embodiment of the present invention is applied to a computer device, the computer device including a memory and a processor, the memory storing a computer program, and when the computer program is executed by the processor, the processor performs the steps of the remote user trust authentication method in the Internet of Things environment.

[0084] The user trust authentication method provided in the application embodiment of the present invention is applied to an information data processing terminal, which is used to implement a remote user trust authentication system in the Internet of Things environment.

[0085] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0086] This invention has advantages over existing related solutions in terms of achieving security and functional attributes, as well as in terms of communication and computation costs.

[0087] Security and Functional Attributes: This invention is resistant to various known attacks and possesses several functional attributes, including: lightweight design, mutual authentication and key negotiation, user trustworthiness verification, resistance to attacks such as stolen login devices, privileged insider attacks, desynchronization attacks, impersonation attacks, smart device theft attacks, temporary key leakage attacks, long-term key leakage attacks, and man-in-the-middle attacks. It also achieves anonymity and perfect forward confidentiality.

[0088] Communication Cost: To facilitate comparison of communication costs across different systems, we assume the hash value (using the SHA-1 algorithm) is 160 bits long, the random number and identity information are 128 bits long, symmetric encryption / decryption is 128 bits, the timestamp is 32 bits, and the elliptic curve point is 320 bits. Table 1 shows a comparison of the communication costs of this invention with other methods. Li et al.'s scheme exchanges four messages, with a communication cost of (800+640+640+640) = 2720 bits. The communication costs of Srinivas et al.'s scheme and Abdi et al.'s scheme are (1152+672+832) = 2656 bits and (1440+768+480+608) = 3296 bits, respectively. The technical solution of this invention exchanges three messages, with costs of (160+160+160+160+128+32) = 800 bits, (160+160+160+160+160+32) = 832 bits, and (160+160+160+160+32) = 672 bits, for a total cost of (800+832+672) = 2304 bits.

[0089] Table 1 Comparison of communication costs for several technical solutions

[0090]

[0091] Computational Cost: To facilitate comparison of computational costs, we use the following notation to represent the operation time of different cryptographic primitives: T h T represents the operation time of a hash function in cryptography. epm T represents the time to perform the dot product in elliptic curve cryptography. cm T represents the execution time of the Chebysev chaotic map. fe Operation time of the fuzz extractor. Since the same cryptographic primitives have different operation times in different hardware environments, we tested the execution time of these cryptographic primitives on login devices, gateways, and smart devices, as shown in Table 2.

[0092] Table 2 Operation Time of Cipher Primitives

[0093]

[0094] Based on the simulated values ​​in Table 2, the computational cost evaluation results of the present invention and related technical solutions are shown in Table 3. In the present invention, the computational cost of the login device, gateway, and smart device is 12T. h +T fe ≈3.3568ms, 9T h ≈0.000342ms and 10T h The computation time is approximately 0.5835ms, and the total computation cost is 3.9406ms. As can be seen from Table 3, the computational performance of this invention is superior to other technical solutions.

[0095] Table 3 Comparison of Calculation Costs

[0096]

[0097] The following are three embodiments provided by the present invention:

[0098] Example 1: Trusted Authentication of Remote Users in a Smart Home Environment

[0099] In a smart home environment, smart devices might include smart light bulbs, smart water heaters, smart speakers, and more. Users connect to their home's Wi-Fi network (gateway) via their mobile phones (login devices) and can then remotely control these smart devices. When users first set up and use these devices, registration and initialization through a registry center are required. The registry center might be a secure cloud server through which users register their devices. When users want to access the devices, they need to verify their trustworthiness on their mobile phones. This might include entering a password or performing biometric verification (such as fingerprint or facial recognition). Upon successful verification, a temporary key is generated between the user and the smart device to protect their communication.

[0100] Example 2: Remote User Trusted Authentication in an Industrial Internet of Things Environment

[0101] In an Industrial Internet of Things (IIoT) environment, smart devices may include various sensors and actuators for monitoring and controlling the production line. Workers (users) connect to the factory's internal network (gateway) via industrial computers (login devices) to remotely access and control these devices. When workers first use these devices, registration and initialization via a registry center are required. The registry center may be a secure internal server. When workers want to access the devices, they need to perform user authentication on the computer. This may involve entering their employee ID and password. Upon successful authentication, a temporary key is generated between the worker and the smart device to protect their communication.

[0102] Example 3: Trusted Authentication of Remote Users in a Smart Healthcare Environment

[0103] In a smart healthcare environment, smart devices may include various medical monitoring equipment, such as electrocardiographs and blood pressure monitors. Doctors (users) connect to the hospital's internal network (gateway) via a computer or tablet (login device) to remotely access and control these devices. When doctors first use these devices, they need to register and initialize through a registry center. The registry center may be a secure medical information system. When doctors want to access the devices, they need to perform user authentication on their computer or tablet. This may involve entering the doctor's employee ID and password. After successful authentication, a temporary key is generated between the doctor and the smart device to protect their communication.

[0104] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A remote user trusted authentication system in an Internet of Things (IoT) environment, characterized in that, The system includes: A Registration Center (RC) is a trusted server used to securely register or initialize other entities. Smart devices, deployed in the environment, are used to collect and transmit data; A gateway supports interconnection between networks using different protocols and has computing and storage capabilities; Users can access remote smart devices by logging into the device. A login device is used for user trust verification; the login device includes, but is not limited to, mobile devices, smart cards, and PCs. The method for remote user trusted authentication in an IoT environment, which implements the aforementioned remote user trusted authentication system in an IoT environment, includes: (1) Setup phase; (2) Registration stage; (3) User credibility verification stage; (4) Certification stage; The setup phase specifically includes: The registration center selects an identity IDG and a long-term key KG for the gateway GX connected to the system; selects an identity IDs for the smart device SY connected to the gateway, and calculates a credential SCS=h(IDS|| KG) for the smart device; then stores the parameter {IDS} in the gateway and stores {IDS, SCS} in the smart device SY. The registration phase specifically includes the following steps: Step 1. When remote user Ui first uses login device L, it is asked to choose a username IDi and a password PWi; then login device L calculates two parameters: ULi = h(IDi || si), ULUi = h(IDi || PWi || si), where h(·) is a one-way hash function in cryptography, and si is a random number generated by the login device; the login device transmits these two parameters {ULi, ULUi} to the registration center for registration; Step 2. The registration center generates a dynamic identity DIDi for the user, sets {DIDoldi=null, DIDnewi=DIDi}, and stores it in the corresponding gateway; the registration center calculates a secret parameter P1= h(KG)⊕h(ULi ||ULUi); then transmits the user's dynamic identity DIDi and secret parameter Ai to the login device; Step 3. The login device requires the user to press their fingerprint Fi. Since the fingerprint information entered by the user varies slightly each time, a fuzzy extractor is needed to correctly identify the user's fingerprint. The login device uses the fuzzy extractor's generation program G(·) to calculate the public parameter ppi and the secret parameter spi based on the user's fingerprint, i.e., G(Fi) = (ppi, spi). Subsequently, the login device cryptographically binds the user to the login device. This process requires calculating h(KG) = P1⊕h(ULi || ULUi), P2 = si⊕h(IDi||PWi||spi), P3 = h(KG)⊕h(IDi||PWi||spi), TTi = h(h(KG)⊕si⊕h(IDi||PWi||spi)). Finally, some parameters {DIDoldi = null, DIDnewi = DIDi, P2, TTi, P3,ppi, G(·), R(·), h(˖)} are stored in the login device. The user trust verification phase specifically includes the following steps: Step 1. When using the login device, the user is required to enter the username IDi, password PWi, and press the fingerprint Fi*; the login device uses the fuzzy extractor's reconstruction program R(·) to calculate the secret parameters spi*=R (Fi*, ppi) of the fingerprint based on the user's fingerprint information; Step 2. The login device calculates si* = P2⊕h(IDi||PWi|| spi *), h(KG) = P3⊕h(IDi||PWi||spi *), TTi* = h(h(KG)⊕si*⊕h(IDi||PWi||spi*)); and determines whether the calculated TTi* is equal to the stored TTi; if they are the same, the login device recognizes the user as genuine.

2. The remote user trusted authentication system in an IoT environment as described in claim 1, characterized in that, The registration center registers other entities offline via a secure channel; each smart device connects to a nearby gateway wirelessly or via a wired connection; users connect to the Internet using a login device and then access remote smart devices through a gateway node.

3. The remote user trusted authentication system in an IoT environment as described in claim 1, characterized in that, Before accessing a smart device, the user needs to perform user trust verification and mutual authentication between the user and the smart device. After this process is completed, a temporary key is generated between the user and the smart device to protect their secure communication.

4. The remote user trusted authentication system in an IoT environment as described in claim 1, characterized in that, The authentication phase specifically includes the following steps: Step 1. After successful trusted authentication, the user selects the smart device SY to access. The login device generates a random number n1 and the current timestamp T1, and calculates R1 = n1⊕h(h(KG)||T1), R2 = h(h(KG)||DIDi || n1||T1), R3 = IDs⊕h(h(KG)||n1||T1), R4 = h(IDi||PWi||si||spi)⊕h(h(KG ||n1). Finally, the login device transmits the message M1 = {R1, R2, R3, R4, DIDi,T1} to the gateway through the public channel. Step 2. The gateway determines message freshness based on whether the difference between the received message timestamp T1* and T1 is less than a certain threshold ∆T. If the message is fresh, the gateway checks if the user's dynamic identity DIDi exists in its storage. After this query is successful, the gateway calculates n1* = R1⊕h(h(KG)||T1), R2* = h(h(KG)||DIDi || n1*||T1), and compares R2* with R2. If they are equal, the gateway calculates IDs =R3⊕h(h(KG)||n1||T1), h(IDi||PWi||si|| spi) =R4⊕h(h(KG)||n1), and re-selects a dynamic identity DIDnewi for the user, storing the user's two consecutive dynamic identities {DIDoldi, DIDnewi} in its database. The gateway generates a random number n2 and the current timestamp T2, and calculates RR1 = n2⊕h(SCS||T2), RR2=h(h(IDi||PWi||si|| spi)|| h(KG)||TIDi || TIDnewi || h(SCS ||n2||T2)), RR3= h(KG)⊕TIDi⊕h(SCS || n2), RR4= h(KG)⊕DIDi new⊕h(SCS || n2||T2), RR5= RR2⊕h(SCS || IDs||n2||T2), RR6=h(RR2|| SCS || n2||T2); Finally, the gateway transmits message M2={ RR1, RR3, RR4, RR5, RR6,T2} to the smart device through the public channel; Step 3. The smart device verifies whether the received message is fresh; if the received message is fresh, the smart device calculates n2*= RR1⊕h(SCS ||T2), RR2*= RR5⊕h(SCS || IDs||n2||T2), and checks whether RR6*=h(RR2*|| SCS || n2*||T2) is true; after the condition is met, the smart device calculates h(KG)⊕DIDi = RR3⊕h(SCS || n2), h(KG)⊕DIDnewi = RR4⊕h(SCS || n2||T2); then generates a random number n3 and the current timestamp T3, and calculates RRR1= n3⊕h(h(KG)⊕DIDi), RRR2= h(KG)⊕DIDi new⊕h(h(KG)⊕DIDi)⊕n3, RRR3=h(SCS ||n2||T2)⊕h(h(KG)⊕DIDi) ⊕T3, SK=h(RR2*|| h(SCS ||n2||T2) || n3||T3), RRR4=h(SK || h(KG)⊕DIDnewi ||n3||T3); Finally, the smart device transmits the message M3={RRR1, RRR2, RRR3, RRR4, T3} to the login device through the public channel; Step 4. The login device verifies whether the received message is fresh; if the received message is fresh, the login device calculates n3 = RRR1⊕h(h(KG)⊕DIDi), h(KG)⊕DIDnewi = RRR2⊕h(h(KG)⊕DIDi) ⊕n3, h(SCS ||n2||T2) = RRR3⊕h(h(KG)⊕DIDi)⊕T3, RR2=h(h(IDi||PWi||si|| spi)|| h(KG)||DIDi || DIDnewi || h(SCS ||n2||T2)), SK=h(RR2|| h(SCS ||n2||T2) || n3||T3), and determines RRR4*=h(SK || h(KG)⊕TIDnewi If the condition is met, the login device has authenticated the smart device; a temporary key SK is generated between the login device and the smart device. Once this process is complete, the login device will re-store the two consecutive dynamic user identities in its memory.

5. A computer device, characterized in that, The computer device includes a memory and a processor. The memory stores a computer program that, when executed by the processor, causes the processor to perform steps of a method applied to a remote user trusted authentication system in an Internet of Things environment as described in any one of claims 1-4.

6. A computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to perform steps of a method applied to a remote user trusted authentication system in an Internet of Things environment as described in any one of claims 1-4.

7. An information data processing terminal, characterized in that, The information data processing terminal includes a remote user trusted authentication system in the Internet of Things environment as described in any one of claims 1-4.

Images