A method and system for realizing external authentication of a smart home cloud device

Abstract

The application discloses a method and system for realizing external authentication of smart home cloud equipment, steps comprising: obtaining a security authentication signature of the smart home based on a device key and a device ID of the smart home; after the smart home accesses the Internet, sending a service request and authentication information to a third-party cloud platform; the authentication information comprising: the security authentication signature, the device ID and product ID of the smart home; after receiving the service request and authentication information, the third-party cloud platform sends a verification package to a smart home cloud platform to which the smart home belongs and performs security filtering to obtain a filtering result; the verification package comprising: a third-party cloud platform ID, a third-party cloud platform authentication signature and authentication information; when the filtering result is qualified, the smart home cloud platform checks the authentication information to obtain a checking result; when the checking result is qualified, the third-party cloud platform is fed back to respond to the service request.

Description

Technical Field

[0001] This application relates to the field of smart home security, specifically to a method and system for external authentication of smart home cloud devices. Background Technology

[0002] During the manufacturing process of smart home devices, a device key is written into the device storage. This key is used for interface signature authentication when the device requests HTTP services from the smart home cloud platform, and also for signature authentication during device activation and binding. When the smart home cloud platform verifies signatures in these two scenarios, it needs to query the corresponding key from its database and then use the key for signature calculation and verification. However, when the smart home device is registered and activated indirectly through a third-party smart home cloud platform or a third-party smart home client, and requests HTTP services from the smart home cloud platform to which the device belongs, the third-party smart home cloud platform's database does not contain the smart home device key. Therefore, it cannot complete the corresponding device signature authentication service, and the device cannot be recognized and registered by the cloud platform.

[0003] There are two main existing technical solutions. One is that during the activation and authentication process of the device on a third-party smart home client, the device needs to log in to the smart home system once on the third-party client. If the device does not have a smart home account, it also needs to register an account. The second method is to import the device key information from the smart home database into the third-party smart home cloud platform, or to enable authentication, allowing the device to connect to the cloud platform without authentication. Summary of the Invention

[0004] This application primarily targets the connection of smart home devices that have been registered and certified on this smart home cloud platform to a third-party smart home cloud platform (third-party smart home client). By simplifying user operation steps and reducing the process of user login and authentication on the platform, while avoiding the input of smart device key authentication information into the third-party cloud platform and reducing security, the application aims to enable smart home devices to be authenticated and registered through the third-party smart home cloud platform or the third-party smart home client.

[0005] To achieve the above objectives, this application provides a method for external authentication of smart home cloud devices, comprising the following steps:

[0006] Based on the smart home device key and device ID, obtain the smart home security authentication signature;

[0007] After the smart home device connects to the Internet, it sends a business request and authentication information to a third-party cloud platform; the authentication information includes: the security authentication signature, the smart home device ID, and the product ID.

[0008] After receiving the service request and the authentication information, the third-party cloud platform sends the verification packet to the smart home cloud platform to which the smart home belongs and performs security filtering to obtain the filtering result; the verification packet includes: the third-party cloud platform ID, the third-party cloud platform authentication signature, and the authentication information;

[0009] When the filtering result is qualified, the smart home cloud platform verifies the authentication information and obtains the verification result;

[0010] When the verification result is satisfactory, feedback is sent to the third-party cloud platform, which then responds to the business request.

[0011] Preferably, the security filtering rules include: comparing the third-party cloud platform ID and the key information of the third-party cloud platform in the database of the smart home cloud platform to determine whether it is the third-party cloud platform certified by the smart home cloud platform, and obtaining a judgment result; if the judgment result is negative, the filtering result is unqualified.

[0012] Preferably, the security filtering rules further include: when the judgment result is yes, the third-party cloud platform is allowed to perform device verification, authentication, and signature. The smart home cloud platform determines whether the number of such smart home devices allowed to be verified by the third-party cloud platform is based on a preset threshold for the number of smart home devices, the product ID, and the device ID. If the number of smart home devices is within the upper limit allowed by the third-party cloud platform, the filtering result is qualified; if the number of smart home devices is not within the limit, the filtering result is unqualified.

[0013] Preferably, when the filtering result is unqualified, the security filtering failure result is reported to the third-party cloud platform.

[0014] Preferably, the smart home cloud platform verifies the authentication information by: the smart home cloud platform using the product ID to filter device keys in the database to calculate the device signature, verifying the security authentication signature, and obtaining the verification result.

[0015] Preferably, when the verification result is qualified, the third-party cloud platform responds to the business request, performs business processing, and feeds back the response business processing result to the smart home.

[0016] Preferably, when the verification result is unqualified, the third-party cloud platform will send the unqualified authentication information verification result back to the smart home.

[0017] Preferably, the method for obtaining the security authentication signature includes: combining the key and the device ID and calculating the security authentication signature using the MD5 encryption algorithm.

[0018] This application also provides a system for external authentication of smart home cloud devices, including: an encryption module, a request module, a filtering module, a verification module, and a response module;

[0019] The encryption module is used to obtain a secure authentication signature for the smart home based on the smart home device key and device ID.

[0020] The request module is used to send a business request and authentication information to a third-party cloud platform after the smart home is connected to the Internet; the authentication information includes: the security authentication signature, the smart home's device ID and product ID;

[0021] The request module is used to, after receiving the business request and the authentication information, have the third-party cloud platform send a verification packet to the smart home cloud platform to which the smart home belongs and perform security filtering to obtain a filtering result; the verification packet includes: the third-party cloud platform ID, the third-party cloud platform authentication signature, and the authentication information;

[0022] The filtering module is used to verify the authentication information and obtain the verification result when the filtering result is qualified.

[0023] The verification module is used to provide feedback to the third-party cloud platform and respond to the business request when the verification result is qualified.

[0024] Preferably, the workflow of the filtering module includes: comparing the third-party cloud platform ID and the key information of the third-party cloud platform in the database of the smart home cloud platform to determine whether it is the third-party cloud platform certified by the smart home cloud platform, and obtaining a determination result; if the determination result is negative, the filtering result is unqualified.

[0025] Compared with the prior art, the beneficial effects of this application are as follows:

[0026] This application enables devices to perform secure cloud platform authentication while preventing the leakage of device keys, thus avoiding secondary registration and login operations for users, reducing user operation steps, and improving user experience. Attached Figure Description

[0027] To more clearly illustrate the technical solutions of this application, the drawings used in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a schematic diagram of the method flow of an embodiment of this application;

[0029] Figure 2 This is a schematic diagram of the system structure according to an embodiment of this application. Detailed Implementation

[0030] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0032] Example 1

[0033] For the solution in this embodiment, the smart home cloud platform needs to add a device authentication request verification function to its existing cloud connectivity functionality. It also needs to support setting corresponding verification restrictions. When a third-party cloud platform connects to devices on this smart home cloud platform, data calls are made according to the standard cloud connectivity interface protocol specifications. This satisfies the requirements for implementation and facilitates rapid deployment. The method flow is as follows: Figure 1 As shown.

[0034] When a smart home device needs to register and authenticate with a third-party smart home cloud platform, the smart home device enters a network-ready state according to the device network access instructions. It then establishes a communication connection with the user's smartphone. The user's smartphone sends the network access certificate Wi-Fi information to the smart home device (generally, the connection method is either a BLE connection between the user's phone and the smart home device, or a Wi-Fi hotspot connection between the user's phone and the smart home device). Based on the device key generated when the device is created on its respective smart home cloud platform, the smart home device writes this key information into the device cloud module production process. During the network access process, the key stored in the smart home device and the device ID are combined and a secure authentication signature is calculated using the MD5 encryption algorithm.

[0035] After the smart home device connects to the internet, it sends a business request and authentication information to a third-party smart home cloud platform. The authentication information includes: the security authentication signature obtained in the above steps, and the smart home device ID and product ID. In this embodiment, the product ID is parameter information used to distinguish different types of smart home products, and the device ID is a unique ID for each specific smart home product.

[0036] After receiving the business request and authentication information, the third-party smart home cloud platform sends the verification packet to the smart home cloud platform to which the smart home to be connected belongs and performs security filtering to obtain the filtering result; the verification packet includes: third-party cloud platform ID, third-party cloud platform authentication signature and authentication information.

[0037] Next, the smart home cloud platform to which the smart home devices belong performs security filtering and obtains the filtering results. The security filtering rules include: comparing the requested third-party cloud platform ID and authentication signature against the smart home cloud database to determine if it is a third-party cloud platform registered and certified by the smart home cloud platform; if the result is negative, the filtering result is unqualified. If the result is positive, firstly, the device verification and authentication signature is performed on the certified third-party smart home cloud platform. The principle of the verification and authentication signature is as follows: during the third-party cloud platform registration, the smart home cloud platform issues a corresponding security certificate and cloud platform ID. During the platform's security verification process, security authentication is mainly performed by comparing the ID and certificate information in the database.

[0038] Next, the smart home cloud platform uses the product ID and device ID to determine whether the number of such smart home devices allowed for verification by the third-party smart home cloud platform meets the upper limit. If it does, the filtering result is qualified; otherwise, the filtering result is unqualified. In other words, when the third-party cloud platform's information authentication is successful and the number of devices registered does not exceed the maximum limit for the number of devices registered for this type of product on the third-party cloud platform, the filtering result is qualified.

[0039] The purpose of the aforementioned security filtering is primarily to prevent unauthorized access requests to the smart home cloud platform, thereby enhancing its security. Simultaneously, it also limits traffic to prevent mass network security attacks on the smart home cloud platform, which could disrupt the normal device authentication process. Furthermore, the device quantity limit also restricts the number of platform licenses issued, which is related to the platform's charging logic, preventing third-party cloud platforms from registering devices in bulk and causing resource waste.

[0040] If the third-party cloud platform requesting authentication is not registered with the smart home cloud platform, and its cloud platform ID and security certificate verification fails, the third-party smart home cloud platform will respond with an unqualified filtering result. If the number of devices requested for registration and authentication by the third-party cloud platform exceeds the limit set by the smart home cloud platform for the number of such products registered by this third-party cloud platform, the third-party smart home cloud platform will also respond with an unqualified filtering result, including an explanation of the reason for the failure.

[0041] If the smart home device passes the security filter of the smart home cloud platform, the platform uses the MD5 encryption algorithm to perform a security authentication signature verification based on the device key in its database. The verification request from the smart home device includes its product ID, device ID, and security authentication signature. The smart home cloud platform filters device keys in its database using the product ID and performs device authentication signature verification. If the signature calculated by the smart home cloud platform matches the device's requested authentication signature (i.e., the verification result is qualified), the platform responds with a device authentication signature verification result for the device, and the third-party smart home cloud platform then performs the device registration and network access processing.

[0042] If the signature calculated by the smart home cloud platform does not match the authentication signature requested by the device (i.e., the verification result is unqualified), then for the device whose signature matching fails the verification, the third-party smart home cloud platform will respond with the device authentication signature verification failure result and feed back the device signature verification authentication failure result to the smart home device.

[0043] It should be noted that the data transmission in this embodiment must comply with the security specifications of the smart home cloud platform device connection protocol. During data transmission between the device and the third-party cloud platform, and between the third-party cloud platform and the smart home cloud platform, critical data is encrypted using asymmetric encryption, primarily employing the RSA algorithm, and supporting data tamper-proofing. Specifically, the smart home cloud platform generates a data transmission private key for each third-party cloud platform and calculates a public key, which is stored on the third-party cloud platform. During each information transmission, the third-party cloud platform encrypts the transmitted information using the public key, and the smart home cloud platform decrypts it using the private key. The encryption principle is the same for information transmitted between the device and the cloud platform. When a third-party cloud platform registers its application on the smart home cloud platform, a corresponding security certificate is issued for security authentication and identification. A private key for the third-party cloud platform is also generated on the smart home cloud platform for decrypting transmitted information. Key information such as the device ID and the third-party cloud ID are also identified as random strings to prevent data interception and leakage of privacy information.

[0044] Example 2

[0045] like Figure 2The diagram shown illustrates the system architecture of this embodiment, including an encryption module, a request module, a filtering module, a verification module, and a response module. The encryption module obtains a secure authentication signature based on the smart home's key and device ID. The request module sends a business request and authentication information to a third-party cloud platform after the smart home connects to the internet. The authentication information includes the secure authentication signature, the smart home's device ID, and the product ID. Upon receiving the business request and authentication information, the third-party cloud platform sends a verification packet to the smart home cloud platform to which the smart home belongs and performs security filtering using the filtering module to obtain a filtering result. The verification packet includes the third-party cloud platform ID, the third-party cloud platform authentication signature, the product ID, and the device ID. The verification module verifies the authentication information when the filtering result is satisfactory, obtaining a verification result. The response module responds to the business request by providing feedback to the third-party cloud platform when the verification result is satisfactory.

[0046] The following will, in conjunction with this embodiment, explain in detail how this application solves technical problems in real life.

[0047] When a smart home device needs to register and authenticate with a third-party smart home cloud platform, the smart home device enters a network-ready state according to the device network access instructions. It then establishes a communication connection with the user's smartphone. The user's smartphone sends the network access certificate Wi-Fi information to the smart home device (generally, the connection method is either a BLE connection between the user's phone and the smart home device, or a Wi-Fi hotspot connection between the user's phone and the smart home device). Based on the device key generated when the device is created on its respective smart home cloud platform, the smart home device writes this key information into the device cloud module during production. During the network access process, the encryption module combines the key stored in the smart home device with the device ID and calculates a secure authentication signature using the MD5 encryption algorithm.

[0048] After the smart home device connects to the internet, the request module sends a business request and authentication information to a third-party smart home cloud platform. The authentication information includes: the security authentication signature obtained in the above steps, and the smart home device ID and product ID. In this embodiment, the product ID is parameter information used to distinguish different types of smart home products, and the device ID is a unique ID for each specific smart home product.

[0049] After receiving the business request and authentication information, the third-party smart home cloud platform sends the verification packet to the smart home cloud platform to which the smart home to be connected belongs and uses the filtering module to perform security filtering to obtain the filtering result; the verification packet includes: third-party cloud platform ID, third-party cloud platform authentication signature and authentication information.

[0050] Next, the smart home cloud platform to which the smart home devices belong performs security filtering and obtains the filtering results. The security filtering rules include: comparing the requested third-party cloud platform ID and authentication signature against the smart home cloud database to determine if it is a third-party cloud platform registered and certified by the smart home cloud platform; if the result is negative, the filtering result is unqualified. If the result is positive, firstly, the device verification and authentication signature is performed on the certified third-party smart home cloud platform. The principle of the verification and authentication signature is as follows: during the third-party cloud platform registration, the smart home cloud platform issues a corresponding security certificate and cloud platform ID. During the platform's security verification process, security authentication is mainly performed by comparing the ID and certificate information in the database.

[0051] Next, the smart home cloud platform uses the product ID and device ID to determine whether the number of such smart home devices allowed for verification by the third-party smart home cloud platform meets the upper limit. If it does, the filtering result is qualified; otherwise, the filtering result is unqualified. In other words, when the third-party cloud platform's information authentication is successful and the number of devices registered does not exceed the maximum limit for the number of devices registered for this type of product on the third-party cloud platform, the filtering result is qualified.

[0052] The purpose of setting up the aforementioned filtering modules is primarily to prevent unauthorized requests to access the smart home cloud platform, thereby enhancing its security. Simultaneously, it also limits traffic to prevent mass network security attacks on the smart home cloud platform, which could disrupt the normal device authentication process. Furthermore, the device quantity limit also limits the number of platform licenses issued, which is related to the platform's charging logic, preventing third-party cloud platforms from registering devices in bulk and causing resource waste.

[0053] If the third-party cloud platform requesting authentication is not registered with the smart home cloud platform, and its cloud platform ID and security certificate verification fails, the third-party smart home cloud platform will respond with an unqualified filtering result. If the number of devices requested for registration and authentication by the third-party cloud platform exceeds the limit set by the smart home cloud platform for the number of such products registered by this third-party cloud platform, the third-party smart home cloud platform will also respond with an unqualified filtering result, including an explanation of the reason for the failure.

[0054] If the smart home device passes the security filter of the smart home cloud platform, the verification module installed on the smart home cloud platform uses the MD5 encryption algorithm to perform a security authentication signature verification of the device based on the device key in the database. The information requested for verification by the smart home device includes the product ID, device ID, and security authentication signature of the smart home device. The smart home cloud platform filters the device keys in the database through the product ID and performs device authentication signature verification. If the signature calculated by the smart home cloud platform matches the authentication signature requested by the device (i.e., the verification result is qualified), the response module responds with a device authentication signature verification result for devices that have passed the matching signature verification, and the third-party smart home cloud platform performs the device registration, authentication, and network access business processing.

[0055] If the signature calculated by the smart home cloud platform does not match the authentication signature requested by the device (i.e., the verification result is unqualified), the response module will respond with a device authentication signature verification failure result for the device that failed the signature matching verification, and the third-party smart home cloud platform will feed back the device signature verification authentication failure result to the smart home device.

[0056] The embodiments described above are merely preferred embodiments of this application and are not intended to limit the scope of this application. Any modifications and improvements made to the technical solutions of this application by those skilled in the art without departing from the spirit of this application shall fall within the protection scope defined by the claims of this application.

Claims

1. A method for external authentication of smart home cloud devices, characterized by the following steps: include: Based on the smart home device key and device ID, obtain the smart home security authentication signature; After the smart home device is connected to the Internet, it sends a business request and authentication information to a third-party cloud platform. The authentication information includes: the security authentication signature, the smart home device ID, and the product ID; After receiving the service request and the authentication information, the third-party cloud platform sends the verification packet to the smart home cloud platform to which the smart home belongs and performs security filtering to obtain a filtering result. The security filtering rules include: comparing the third-party cloud platform ID and the third-party cloud platform key information in the database of the smart home cloud platform to determine whether it is the third-party cloud platform authenticated by the smart home cloud platform, and obtaining a judgment result; if the judgment result is negative, the filtering result is unqualified. The security filtering rules also include: when the judgment result is yes, the third-party cloud platform is allowed to perform device verification and authentication signature. The principle of the device verification and authentication signature is as follows: during the registration of the third-party cloud platform, the smart home cloud platform will issue a corresponding security certificate and cloud platform ID. During the device verification and authentication signature process, the smart home cloud platform performs security authentication on the third-party cloud platform by comparing the cloud platform ID and security certificate in the database. The smart home cloud platform determines whether the number of such smart home devices meets the upper limit allowed by the third-party cloud platform based on a pre-set threshold for the number of smart home devices, the product ID, and the device ID. If it meets the threshold, the filtering result is qualified; if it does not meet the threshold, the filtering result is unqualified. The verification package includes: the third-party cloud platform ID, the third-party cloud platform authentication signature, and the authentication information; When the filtering result is qualified, the smart home cloud platform verifies the authentication information and obtains the verification result; When the verification result is satisfactory, feedback is sent to the third-party cloud platform, which then responds to the business request.

2. The method for external authentication of smart home cloud devices according to claim 1, characterized in that, When the filtering result is unqualified, the security filtering failure result is reported to the third-party cloud platform.

3. The method for external authentication of smart home cloud devices according to claim 1, characterized in that, The smart home cloud platform verifies the authentication information by: the smart home cloud platform filtering device keys in the database using the product ID to calculate the device signature, verifying the security authentication signature, and obtaining the verification result.

4. The method for external authentication of smart home cloud devices according to claim 3, characterized in that, When the verification result is qualified, the third-party cloud platform responds to the business request, performs business processing, and sends the response business processing result back to the smart home.

5. The method for external authentication of smart home cloud devices according to claim 1, characterized in that, When the verification result is unqualified, the third-party cloud platform will send the unqualified authentication information verification result back to the smart home.

6. The method for external authentication of smart home cloud devices according to claim 1, characterized in that, The method for obtaining the security authentication signature includes: combining the key and the device ID and calculating the security authentication signature using the MD5 encryption algorithm.

7. A system for external authentication of smart home cloud devices, the system being used to implement the method described in any one of claims 1-6, characterized in that, include: Encryption module, request module, filtering module, verification module, and response module; The encryption module is used to obtain a secure authentication signature for the smart home based on the smart home device key and device ID. The request module is used to send business requests and authentication information to a third-party cloud platform after the smart home is connected to the Internet; The authentication information includes: the security authentication signature, the smart home device ID, and the product ID; The request module is used to, after receiving the business request and the authentication information, have the third-party cloud platform send a verification packet to the smart home cloud platform to which the smart home belongs and perform security filtering to obtain a filtering result; the verification packet includes: the third-party cloud platform ID, the third-party cloud platform authentication signature, and the authentication information; The filtering module is used to verify the authentication information and obtain the verification result when the filtering result is qualified. The verification module is used to provide feedback to the third-party cloud platform and respond to the business request when the verification result is qualified.

8. The system for external authentication of smart home cloud devices according to claim 7, characterized in that, The workflow of the filtering module includes: comparing the third-party cloud platform ID and the key information of the third-party cloud platform in the database of the smart home cloud platform to determine whether it is the third-party cloud platform certified by the smart home cloud platform, and obtaining a judgment result; if the judgment result is negative, the filtering result is unqualified.

Images