Iot device identity authentication method and system

Abstract

The application discloses an Internet of Things device identity authentication method and system, and belongs to the technical field of blockchains, and aims to solve the technical problem of how to realize identity authentication of Internet of Things devices based on a blockchain and provide a secure transmission channel. The identity of an Internet of Things device is authenticated based on a blockchain and an elliptic curve encryption algorithm, a private key is selected for each Internet of Things device, a public key is generated through the elliptic curve encryption algorithm, and a public key hash value is obtained; an identity authentication center performs identity registration calculation based on registration request information, obtains local identity authentication information and identity registration information, and an Internet of Things device uploads the identity registration information and the public key to an identity authentication contract of the blockchain as identity authentication information through a secure channel; and the identity authentication center performs identity authentication on the Internet of Things device based on login request information, the local identity authentication information and the identity authentication information stored in the identity intelligent contract, and returns a digital certificate to the Internet of Things device.

Description

Technical Field

[0001] This invention relates to the field of blockchain technology, specifically to a method and system for authenticating the identity of Internet of Things (IoT) devices. Background Technology

[0002] With the continuous development of IoT technology, an increasing number of devices and sensors are connecting to the network. Therefore, different types of devices can communicate and collaborate with each other, enabling data collection, transmission, processing, and application. Multiple devices can share data and resources, greatly improving the speed and efficiency of information transmission. IoT has a wide range of applications, including industrial automation, smart agriculture, smart cities, and smart homes. IoT technology has had a profound impact on social development, improving efficiency, sustainability, and intelligence across various fields.

[0003] However, IoT devices also suffer from single points of failure, data security, and privacy breaches. Therefore, authentication schemes for IoT devices are crucial for ensuring the legitimate identities of participants. Unfortunately, data is often transmitted through insecure channels, making data security difficult to guarantee.

[0004] Identity verification is widely used to protect the identity of data and devices. To better address the security challenges faced by IoT devices, researchers have begun applying blockchain technology to IoT device identity authentication. Blockchain is a decentralized, distributed database that ensures data security and immutability through cryptographic algorithms and consensus mechanisms. Blockchain-based identity verification schemes offer many advantages. First, due to its decentralized nature, blockchain eliminates the risks of single points of failure and centralized identity management. Second, by using cryptographic algorithms and advanced encryption technologies, it ensures the confidentiality and integrity of data during transmission and storage. It also introduces a strong authentication and authorization mechanism, ensuring that only authorized devices and users can access and manipulate critical data. Blockchain provides strong authentication and data encryption, ensuring the confidentiality and integrity of communication. Most importantly, blockchain technology provides immutable identity records, making device identity information impossible to forge or tamper with, thus enhancing the credibility of identity authentication.

[0005] How to achieve identity authentication for IoT devices and provide a secure transmission channel based on blockchain is a technical problem that needs to be solved. Summary of the Invention

[0006] The technical objective of this invention is to address the above-mentioned shortcomings by providing an IoT device identity authentication method and system, thereby solving the technical problem of how to achieve IoT device identity authentication based on blockchain and provide a secure transmission channel.

[0007] In a first aspect, the present invention provides an IoT device authentication method, which authenticates IoT devices based on blockchain and elliptic curve cryptography, comprising the following steps:

[0008] Identity generation: For each IoT device, select a random number as the private key, select a curve parameter as the base point, generate a public key through elliptic curve cryptography, and perform a hash operation on the public key to obtain the public key hash value;

[0009] Identity Registration: For each IoT device, the IoT device sends a registration request to the identity authentication center. The identity authentication center performs identity registration calculations based on the registration request, obtains local identity verification information and identity registration information, stores the local identity verification information and registration request information locally, and returns the identity registration information to the IoT device. The IoT device uploads its identity registration information and public key as identity authentication information to the blockchain identity authentication contract through a secure channel. Among them, the device information includes the IoT device ID, login password, public key, private key, and curve parameters; the local identity authentication information includes identity identification information, device expiration time, and local identity authentication intermediate information; and the identity registration information includes identity identification information and blockchain identity authentication intermediate information.

[0010] Identity Authentication: For each IoT device, the IoT device sends a login request to the identity authentication center. The login request includes the IoT device's identity registration information and a randomly generated random number. The identity authentication center authenticates the IoT device based on the login request, local identity authentication information, and identity authentication information stored in the identity smart contract, and returns a digital certificate to the IoT device. The digital certificate includes the IoT device's device ID, public key, and the validity period of the digital certificate.

[0011] Authorized access: IoT devices authenticate with other IoT devices and obtain authorized access based on their identity digital certificates;

[0012] Identity Management: If identity authentication fails during the authorization access process of IoT devices, the identity authentication information of the IoT devices in the blockchain will be cancelled.

[0013] As a preferred method, the formula for calculating the public key is as follows:

[0014] pubK = priK * G

[0015] Where G represents the base point, priK represents the private key, and pubK represents the public key.

[0016] Preferably, when performing a hash operation on the public key to obtain the public key hash value, the public key is hashed using the SHA256 algorithm to generate a fixed-length digest as the public key hash value H, where H = h(pubK).

[0017] As a preferred option, for IoT device Di and identity authentication center IAC, identity registration includes the following steps:

[0018] IoT devices perform hash calculations based on their device ID and login password to obtain the device hash value, and send the device hash value, public key, private key, and curve parameters as registration request information to the identity registration center. The calculation formula for the device hash value Ii is: Ii = h(IDi||PWi), where IDi represents the device ID, PWi represents the login password, and h() represents the hash operation.

[0019] After receiving the registration request information, the identity registration center generates a random string and performs identity registration calculations based on the registration request information and the random string. The identity registration calculations include the following:

[0020] PIDi = h(Ri||ID) IAC ||Ii)⊕ID IAC ,

[0021] CK=h(Ri||priK||EXP_time||PIDi),

[0022] CK' = CK * G,

[0023] Ti=Ri⊕h(priK||PIDi),

[0024] Ai = h(Ti⊕Ii⊕CK'),

[0025] Ai' = Ai * G,

[0026] The identity authentication center stores Ai', PIDi, and EXP_time locally as local identity authentication information, and returns PIDi, CK', and Ti as identity registration information to the IoT device.

[0027] IoT devices upload their identity registration information and public key as identity authentication information to the blockchain identity authentication contract through a secure channel;

[0028] Among them, PIDi identifies the identity information, EXP_time represents the device expiration time, CK represents the encryption key, CK' represents the derived encryption key, Ti represents the temporary value, Ai represents the authentication code, and Ai' represents the derived authentication code; CK, CK', Ti, Ai, and Ai' serve as intermediate information for identity authentication, Ai' serves as intermediate information for local identity authentication, and CK' and Ti serve as intermediate information for blockchain identity authentication.

[0029] As a preferred option, for IoT device Di and identity authentication center IAC, identity authentication includes the following steps:

[0030] The IoT device generates a random number N1 and a current timestamp T1. Based on the random number N1, the current timestamp T1, and the identity information PIDi, it generates login request information {PIDi, P1, Y, T1} and sends the login request information {PIDi, P1, Y, T1} to the identity authentication center.

[0031] Where P1=N1*G, P2=h(N1*CK'), Y=h(P1||P2||T1), and CK' is the blockchain identity authentication information;

[0032] After receiving the login request information {PIDi, P1, Y, T1}, the identity authentication center obtains the current timestamp T2. If the time difference between T2 and T1 is less than the threshold time T, the identity authentication center queries the corresponding EXP_time locally based on PIDi, and queries the corresponding Ti from the blockchain based on PIDi. Based on EXP_time, it determines whether the IoT device has expired. If it has not expired, the following information is calculated:

[0033] Rs=Ti⊕h(priK||PIDi),

[0034] CK=h(Rs||priK||EXP_time||PIDi),

[0035] P2' = h(P1*CK),

[0036] Y' = h(P1||P2'||T1),

[0037] And determine whether Y' is equal to Y. If not, reject the login request of the IoT device; if so, proceed to the next step.

[0038] The identity authentication center generates a random number N2 and obtains the current timestamp T3. It then performs the following calculations: P3 = N2 * G, P4 = N2 * Ai', Z = h(P3||P4||T3), and sends the information {Z,P3,T3} to the IoT device.

[0039] After receiving information {Z, P3, T3}, the IoT device obtains the current timestamp T4. If the time difference between T4 and T3 is less than the time threshold T, the following information calculation is performed:

[0040] Ai = h(Ti⊕Ii⊕CK'),

[0041] P4' = P3 * Ai,

[0042] Z' = h(P3||P4'||T3),

[0043] And determine whether Z' is equal to Z. If not, reject the login request of the physical network device. If yes, proceed to the next step.

[0044] IoT devices perform the following information calculations:

[0045] Vi = h(SK||(N1*CK')),

[0046] SK = h((N1*P3)||Ai||T4),

[0047] And obtain the current timestamp T4, and send the login information {Vi,T4} to the identity authentication center;

[0048] After receiving the login information {Vi, T4}, the identity authentication center obtains the current timestamp T5. If the time difference between T5 and T4 is less than the time threshold T, the identity authentication center performs the following calculations:

[0049] Vi'=h((P1*CK)||SK)

[0050] Determine if Vi and Vi' are equal. If not, reject the login request from the logistics network device. If yes, accept the login request from the IoT device and perform the following calculations:

[0051] SK' = h((N2*P1)||Ai||T4),

[0052] It returns a digital certificate to the IoT device. The digital certificate includes {IDi,pubK,infoCA,T*,signIAC}, where infoCA represents the certificate issuer information, T* represents the certificate validity period, signIAC represents the issuer's digital signature, IDi represents the IoT device ID, and pubK represents the IoT device's public key.

[0053] Where P1 represents a point n times N1, Y, Z, and Vi are hot authentication codes obtained through hash operations, Y', Z', and Vi' represent derived authentication codes obtained through hash operations, P3 represents a point n times N2, and P2 and P4 represent points on the elliptic curve obtained through hash operations.

[0054] Secondly, the present invention provides an IoT device identity authentication system, which is applied to IoT devices, blockchain and identity authentication center, including an IoT device management module, a blockchain management module and an identity authentication management module.

[0055] The IoT device management module is used to perform the following: For each IoT device, select a random number as the private key, select a curve parameter as the base point, generate a public key through the elliptic curve cryptography algorithm, and perform a hash operation on the public key to obtain the public key hash value;

[0056] The IoT device management module, blockchain management module, and identity authentication management module work together to perform the following identity registration:

[0057] For each IoT device, the network device management module is used to send registration request information to the identity authentication center;

[0058] The identity authentication center management module is used to perform identity registration calculations based on registration request information, obtain local identity verification information and identity registration information, store the local identity verification information and registration request information locally, and return the identity registration information to IoT devices;

[0059] For each IoT device, the IoT device management module is used to upload its identity registration information and public key as identity authentication information to the blockchain identity authentication contract through a secure channel. The device information includes the IoT device ID, login password, public key, private key and curve parameters. The local identity authentication information includes identity identification information, device expiration time and local identity authentication intermediate information. The identity registration information includes identity identification information and blockchain identity authentication intermediate information.

[0060] The IoT device management module, blockchain management module, and identity authentication management module work together to perform the following identity authentication:

[0061] For each IoT device, the IoT device management module is used to send login request information to the identity authentication center. The login request information includes the IoT device's identity registration information and a randomly generated random number.

[0062] The Identity Authentication Center Management Module is used to authenticate IoT devices based on login request information, local identity authentication information, and identity authentication information stored in the identity smart contract, and return a digital certificate to the IoT device. The digital certificate includes the IoT device's device ID, public key, and the validity period of the digital certificate.

[0063] For each IoT device, the IoT device management module is used to authenticate with other IoT devices and obtain authorized access based on its identity digital certificate;

[0064] For each IoT device, if authentication fails during the authorized access process, the blockchain management module is used to cancel the IoT device's authentication information in the blockchain.

[0065] As a preferred method, the formula for calculating the public key is as follows:

[0066] pubK = priK * G,

[0067] Where G represents the base point, priK represents the private key, and pubK represents the public key.

[0068] Preferably, when performing a hash operation on the public key to obtain the public key hash value, the IoT device management module is used to perform a hash operation on the public key using the SHA256 algorithm to generate a fixed-length digest as the public key hash value H, where H = h(pubK).

[0069] As a preferred embodiment, for IoT device Di and identity authentication center IAC, during identity registration, for each IoT device, the IoT device management module performs a hash calculation based on its device ID and login password to obtain the device hash value, and sends the device hash value, public key, private key and curve parameters as registration request information to the identity registration center. The calculation formula for the device hash value Ii is: Ii = h(IDi||PWi), where IDi represents the device ID, PWi represents the login password, and h() represents the hash operation.

[0070] Correspondingly, the identity registration center management module is used to perform the following:

[0071] Upon receiving the registration request information, a random string is generated. Based on the registration request information and the random string, identity registration calculation is performed, which includes the following:

[0072] PIDi = h(Ri||ID) IAC ||Ii)⊕ID IAC ,

[0073] CK=h(Ri||priK||EXP_time||PIDi),

[0074] CK' = CK * G,

[0075] Ti=Ri⊕h(priK||PIDi),

[0076] Ai = h(Ti⊕Ii⊕CK'),

[0077] Ai' = Ai * G,

[0078] Correspondingly, for each IoT device, the IoT device management module uploads its identity registration information and public key as identity authentication information to the blockchain identity authentication contract through a secure channel;

[0079] Among them, PIDi identifies the identity information, EXP_time represents the device expiration time, CK represents the encryption key, CK' represents the derived encryption key, Ti represents the temporary value, Ai represents the authentication code, and Ai' represents the derived authentication code; CK, CK', Ti, Ai, and Ai' serve as intermediate information for identity authentication, Ai' serves as intermediate information for local identity authentication, and CK' and Ti serve as intermediate information for blockchain identity authentication.

[0080] As a preferred embodiment, for IoT device Di and identity authentication center IAC, when performing identity authentication, for each IoT device, the IoT device management module performs the following: generates a random number N1 and generates the current timestamp T1, generates login request information {PIDi, P1, Y, T1} based on the random number N1, the current timestamp T1 and the identity identification information PIDi, and sends the login request information {PIDi, P1, Y, T1} to the identity authentication center;

[0081] Where P1=N1*G, P2=h(N1*CK'), Y=h(P1||P2||T1), and CK' is the blockchain identity authentication information;

[0082] Correspondingly, the identity authentication center management module performs the following: Upon receiving the login request information {PIDi, P1, Y, T1}, it obtains the current timestamp T2. If the time difference between T2 and T1 is less than the threshold time T, it queries the corresponding EXP_time locally based on PIDi and queries the corresponding Ti from the blockchain based on PIDi. Based on EXP_time, it determines whether the IoT device has expired. If it has not expired, it performs the following information calculations:

[0083] Rs=Ti⊕h(priK||PIDi),

[0084] CK=h(Rs||priK||EXP_time||PIDi),

[0085] P2' = h(P1*CK),

[0086] Y' = h(P1||P2'||T1),

[0087] And determine whether Y' is equal to Y. If not, refuse the login of the IoT device to Qin Qiu. If yes, proceed to the next step.

[0088] Generate a random number N2 and obtain the current timestamp T3. Perform the following calculations: P3 = N2 * G, P4 = N2 * Ai', Z = h(P3||P4||T3), and send the information {Z,P3,T3} to the IoT device.

[0089] Correspondingly, for each IoT device, the IoT device management module performs the following: After receiving information {Z,P3,T3}, it obtains the current timestamp T4. If the time difference between T4 and T3 is less than the time threshold T, it performs the following information calculations:

[0090] Ai = h(Ti⊕Ii⊕CK'),

[0091] P4' = P3 * Ai,

[0092] Z' = h(P3||P4'||T3),

[0093] And determine whether Z' is equal to Z. If not, reject the login request of the physical network device. If yes, proceed to the next step.

[0094] Perform the following calculations:

[0095] Vi = h(SK||(N1*CK')),

[0096] SK = h((N1*P3)||Ai||T4),

[0097] And obtain the current timestamp T4, and send the login information {Vi,T4} to the identity authentication center;

[0098] Correspondingly, the identity authentication center management module performs the following: After receiving login information {Vi, T4}, it obtains the current timestamp T5. If the time difference between T5 and T4 is less than the time threshold T, it performs the following information calculations:

[0099] Vi' = h((P1*CK)||SK),

[0100] Determine if Vi and Vi' are equal. If not, reject the login request from the logistics network device. If yes, accept the login request from the IoT device and perform the following calculations:

[0101] SK' = h((N2*P1)||Ai||T4),

[0102] It returns a digital certificate to the IoT device. The digital certificate includes {IDi,pubK,infoCA,T*,signIAC}, where infoCA represents the certificate issuer information, T* represents the certificate validity period, signIAC represents the issuer's digital signature, Idi represents the IoT device ID, and pubK represents the IoT device's public key.

[0103] Where P1 represents a point n times N1, Y, Z, and Vi are hot authentication codes obtained through hash operations, Y', Z', and Vi' represent derived authentication codes obtained through hash operations, P3 represents a point n times N2, and P2 and P4 represent points on the elliptic curve obtained through hash operations.

[0104] The IoT device authentication method and system of the present invention have the following advantages:

[0105] 1. An effective authentication process is achieved based on blockchain and elliptic curve cryptography (ECC) algorithm. Blockchain can create a decentralized, tamper-proof, and traceable trust mechanism to ensure the authenticity of IoT devices and the integrity of data. The use of ECC algorithm can enable IoT devices to resist a series of attacks such as password guessing attacks, replay attacks, man-in-the-middle attacks, session key attacks, and DoS attacks.

[0106] 2. It features device anonymity and forward confidentiality, enabling mutual authentication between devices and providing an efficient key management and authentication mechanism. Attached Figure Description

[0107] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0108] The invention will be further described below with reference to the accompanying drawings.

[0109] Figure 1 This is a flowchart of an IoT device authentication method according to Example 1. Detailed Implementation

[0110] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0111] This invention provides an IoT device identity authentication system and system, which solves the technical problem of how to achieve IoT device identity authentication based on blockchain and provide a secure transmission channel.

[0112] Example 1:

[0113] This invention provides an IoT device identity authentication method based on blockchain and elliptic curve cryptography. The method includes five steps: identity generation, identity registration, identity authentication, authorized access, and identity management.

[0114] Step S100 Identity Generation: For each IoT device, select a random number as the private key, select a curve parameter as the base point, generate a public key through the elliptic curve cryptography algorithm, and perform a hash operation on the public key to obtain the public key hash value.

[0115] In this step, the formula for calculating the public key is as follows:

[0116] pubK = priK * G

[0117] Where G represents the base point, priK represents the private key, and pubK represents the public key.

[0118] When hashing the public key to obtain its hash value, the SHA256 algorithm is used to generate a fixed-length digest as the public key hash value H, where H = h(pubK). This embodiment uses the SHA256 algorithm to hash the device's public key, generating a fixed-length digest. SHA256 is a commonly used hash function that can map data of arbitrary length to a 256-bit hash value.

[0119] Step S200 Identity Registration: For each IoT device, the IoT device sends a registration request to the identity authentication center. The identity authentication center performs identity registration calculations based on the registration request, obtains local identity verification information and identity registration information, stores the local identity verification information and registration request information locally, and returns the identity registration information to the IoT device. The IoT device uploads its identity registration information and public key as identity authentication information to the blockchain identity authentication contract through a secure channel. The device information includes the IoT device's device ID, login password, public key, private key, and curve parameters. The local identity authentication information includes identity identification information, device expiration time, and local identity authentication intermediate information. The identity registration information includes identity identification information and blockchain identity authentication intermediate information.

[0120] As a specific implementation of identity registration, for IoT device Di and identity authentication center IAC, identity registration includes the following steps:

[0121] (1) IoT devices perform hash calculations based on their device ID and login password to obtain device hash values, and send the device hash value, public key, private key and curve parameters as registration request information to the identity registration center. The calculation formula for device hash value Ii is: Ii = h(IDi||PWi), where IDi represents the device ID, PWi represents the login password, and h() represents the hash operation.

[0122] (2) After receiving the registration request information, the identity registration center generates a random string and performs identity registration calculations based on the registration request information and the random string. The identity registration calculations include the following:

[0123] PIDi = h(Ri||ID) IAC ||Ii)⊕ID IAC ,

[0124] CK=h(Ri||priK||EXP_time||PIDi),

[0125] CK' = CK * G,

[0126] Ti=Ri⊕h(priK||PIDi),

[0127] Ai = h(Ti⊕Ii⊕CK'),

[0128] Ai' = Ai * G,

[0129] (3) The identity authentication center stores Ai', PIDi and EXP_time as local identity authentication information locally, and returns PIDi, CK' and Ti as identity registration information to the IoT device;

[0130] (4) IoT devices upload their identity registration information and public key as identity authentication information to the blockchain identity authentication contract through a secure channel;

[0131] Among them, PIDi identifies the identity information, EXP_time represents the device expiration time, CK represents the encryption key, CK' represents the derived encryption key, Ti represents the temporary value, Ai represents the authentication code, and Ai' represents the derived authentication code; CK, CK', Ti, Ai, and Ai' serve as intermediate information for identity authentication, Ai' serves as intermediate information for local identity authentication, and CK' and Ti serve as intermediate information for blockchain identity authentication.

[0132] Step S300 Identity Authentication: For each IoT device, the IoT device sends a login request to the identity authentication center. The login request includes the IoT device's identity registration information and a randomly generated random number. The identity authentication center authenticates the IoT device based on the login request, local identity authentication information, and identity authentication information stored in the identity smart contract, and returns a digital certificate to the IoT device. The digital certificate includes the IoT device's device ID, public key, and the validity period of the digital certificate.

[0133] As a specific implementation of identity authentication, for IoT device Di and identity authentication center IAC, identity authentication includes the following steps:

[0134] (1) The IoT device generates a random number N1 and a current timestamp T1. Based on the random number N1, the current timestamp T1 and the identity information PIDi, it generates login request information {PIDi, P1, Y, T1} and sends the login request information {PIDi, P1, Y, T1} to the identity authentication center.

[0135] Where P1=N1*G, P2=h(N1*CK'), Y=h(P1||P2||T1), and CK' is the blockchain identity authentication information;

[0136] (2) After receiving the login request information {PIDi, P1, Y, T1}, the identity authentication center obtains the current timestamp T2. If the time difference between T2 and T1 is less than the threshold time T, the identity authentication center queries the corresponding EXP_time locally based on PIDi, and queries the corresponding Ti from the blockchain based on PIDi. Based on EXP_time, it determines whether the IoT device has expired. If it has not expired, the following information is calculated:

[0137] Rs=Ti⊕h(priK||PIDi),

[0138] CK=h(Rs||priK||EXP_time||PIDi),

[0139] P2' = h(P1*CK),

[0140] Y' = h(P1||P2'||T1),

[0141] And determine whether Y' is equal to Y. If not, reject the login request of the IoT device; if so, proceed to the next step.

[0142] (3) The identity authentication center generates a random number N2 and obtains the current timestamp T3. It performs the following information calculations: P3 = N2 * G, P4 = N2 * Ai', Z = h(P3||P4||T3), and sends the information {Z,P3,T3} to the Internet of Things device.

[0143] (4) After receiving information {Z,P3,T3}, the IoT device obtains the current timestamp T4. If the time difference between T4 and T3 is less than the time threshold T, the following information calculation is performed:

[0144] Ai = h(Ti⊕Ii⊕CK'),

[0145] P4' = P3 * Ai,

[0146] Z' = h(P3||P4'||T3),

[0147] And determine whether Z' is equal to Z. If not, reject the login request of the physical network device. If yes, proceed to the next step.

[0148] (5) IoT devices perform the following information calculations:

[0149] Vi = h(SK||(N1*CK')),

[0150] SK = h((N1*P3)||Ai||T4),

[0151] And obtain the current timestamp T4, and send the login information {Vi,T4} to the identity authentication center;

[0152] (6) After receiving the login information {Vi,T4}, the identity authentication center obtains the current timestamp T5. If the time difference between T5 and T4 is less than the time threshold T, the identity authentication center performs the following calculations:

[0153] Vi'=h((P1*CK)||SK)

[0154] Determine if Vi and Vi' are equal. If not, reject the login request from the logistics network device. If yes, accept the login request from the IoT device and perform the following calculations:

[0155] SK' = h((N2*P1)||Ai||T4),

[0156] It returns a digital certificate to the IoT device. The digital certificate includes {IDi,pubK,infoCA,T*,signIAC}, where infoCA represents the certificate issuer information, T* represents the certificate validity period, signIAC represents the issuer's digital signature, IDi represents the IoT device ID, and pubK represents the IoT device's public key.

[0157] Where P1 represents a point n times N1, Y, Z, and Vi are hot authentication codes obtained through hash operations, Y', Z', and Vi' represent derived authentication codes obtained through hash operations, P3 represents a point n times N2, and P2 and P4 represent points on the elliptic curve obtained through hash operations.

[0158] Step S400 Authorized Access: The IoT device authenticates itself with other IoT devices based on its identity digital certificate and obtains authorized access.

[0159] Step S500 Identity Management: If identity authentication fails during the authorized access process of IoT devices, the identity authentication information of IoT devices in the blockchain will be cancelled.

[0160] If a user fails to authenticate their identity during access to the device, it indicates that the device has been lost or stolen. In such cases, the device's identity information needs to be deactivated, and the administrator will delete the device's public key from the blockchain to prevent malicious use of the device.

[0161] This embodiment uses an elliptic curve cryptography (ECC) algorithm and blockchain technology to verify and manage the identities of IoT devices, ensuring data confidentiality and integrity. The scheme utilizes ECC to generate a unique identity key for each IoT device. This key is used not only for authentication but also for encrypting communication data, thus ensuring data confidentiality. Due to the complexity and security of ECC, each device possesses a highly secure identity key that is difficult to crack. The identity information and related authentication data of each IoT device are stored in a decentralized manner on the blockchain, forming an immutable ledger. This means that the device's identity authentication records cannot be tampered with or altered without authorization. Any access to and verification of a device's identity can be verified on the blockchain, enhancing the system's credibility.

[0162] Example 2:

[0163] The present invention provides an IoT device identity authentication system, which is applied to IoT devices, blockchain and identity authentication center, including IoT device management module, blockchain management module and identity authentication management module. The system can execute the method disclosed in Embodiment 1.

[0164] The IoT device management module performs the following actions: For each IoT device, select a random number as the private key, select a curve parameter as the base point, generate a public key using an elliptic curve cryptography algorithm, and perform a hash operation on the public key to obtain the public key hash value.

[0165] In practice, the formula for calculating the public key is as follows:

[0166] pubK = priK * G

[0167] Where G represents the base point, priK represents the private key, and pubK represents the public key.

[0168] When hashing the public key to obtain its hash value, the SHA256 algorithm is used to generate a fixed-length digest as the public key hash value H, where H = h(pubK). This embodiment uses the SHA256 algorithm to hash the device's public key, generating a fixed-length digest. SHA256 is a commonly used hash function that can map data of arbitrary length to a 256-bit hash value.

[0169] The IoT device management module, blockchain management module, and identity authentication management module work together to perform the following identity registration:

[0170] (1) For each IoT device, the IoT device management module is used to send registration request information to the identity authentication center;

[0171] (2) The identity authentication center management module is used to perform identity registration calculation based on the registration request information, obtain local identity verification information and identity registration information, store the local identity verification information and registration request information locally, and return the identity registration information to the IoT device;

[0172] (3) For each IoT device, the IoT device management module is used to upload its identity registration information and public key as identity authentication information to the blockchain identity authentication contract through a secure channel. The device information includes the IoT device ID, login password, public key, private key and curve parameters. The local identity authentication information includes identity identification information, device expiration time and local identity authentication intermediate information. The identity registration information includes identity identification information and blockchain identity authentication intermediate information.

[0173] In a specific implementation, for IoT device Di and identity authentication center IAC, during identity registration, for each IoT device, the IoT device management module performs a hash calculation based on its device ID and login password to obtain the device hash value, and sends the device hash value, public key, private key and curve parameters as registration request information to the identity registration center. The calculation formula for the device hash value Ii is: Ii = h(IDi||PWi), where IDi represents the device ID, PWi represents the login password, and h() represents the hash operation.

[0174] Correspondingly, the identity registration center management module is used to perform the following:

[0175] (1) After receiving the registration request information, a random string is generated. Based on the registration request information and the random string, identity registration calculation is performed. The identity registration calculation includes the following:

[0176] PIDi = h(Ri||ID) IAC ||Ii)⊕ID IAC ,

[0177] CK=h(Ri||priK||EXP_time||PIDi),

[0178] CK' = CK * G,

[0179] Ti=Ri⊕h(priK||PIDi),

[0180] Ai = h(Ti⊕Ii⊕CK'),

[0181] Ai' = Ai * G,

[0182] (2) Store Ai', PIDi and EXP_time as local identity authentication information locally, and return PIDi, CK' and Ti as identity registration information to the IoT device.

[0183] Correspondingly, for each IoT device, the IoT device management module uploads its identity registration information and public key as identity authentication information to the blockchain identity authentication contract through a secure channel.

[0184] Among them, PIDi identifies the identity information, EXP_time represents the device expiration time, CK represents the encryption key, CK' represents the derived encryption key, Ti represents the temporary value, Ai represents the authentication code, and Ai' represents the derived authentication code; CK, CK', Ti, Ai, and Ai' serve as intermediate information for identity authentication, Ai' serves as intermediate information for local identity authentication, and CK' and Ti serve as intermediate information for blockchain identity authentication.

[0185] The IoT device management module, blockchain management module, and identity authentication management module work together to perform the following identity authentication:

[0186] (1) For each IoT device, the IoT device management module is used to send login request information to the identity authentication center. The login request information includes the IoT device's identity registration information and a randomly generated random number.

[0187] (2) The identity authentication center management module is used to authenticate IoT devices based on login request information, local identity authentication information and identity authentication information stored in the identity smart contract, and return digital certificates to IoT devices. The digital certificates include the device ID, public key and validity period of the IoT device.

[0188] In a specific implementation, for IoT device Di and identity authentication center IAC, when performing identity authentication, the IoT device management module performs the following for each IoT device: generates a random number N1 and generates the current timestamp T1; generates login request information {PIDi, P1, Y, T1} based on the random number N1, the current timestamp T1, and the identity identification information PIDi; and sends the login request information {PIDi, P1, Y, T1} to the identity authentication center; where P1 = N1 * G, P2 = h(N1 * CK'), Y = h(P1||P2||T1), and CK' is the blockchain identity authentication information.

[0189] Correspondingly, the identity authentication center management module is used to perform the following:

[0190] (1) After receiving the login request information {PIDi, P1, Y, T1}, obtain the current timestamp T2. If the time difference between T2 and T1 is less than the threshold time T, query the corresponding EXP_time locally based on PIDi, and query the corresponding Ti from the blockchain based on PIDi. Determine whether the IoT device has expired based on EXP_time. If it has not expired, perform the following information calculations:

[0191] Rs=Ti⊕h(priK||PIDi),

[0192] CK=h(Rs||priK||EXP_time||PIDi),

[0193] P2' = h(P1*CK),

[0194] Y' = h(P1||P2'||T1),

[0195] (2) Determine whether Y' is equal to Y. If not, reject the login request of the IoT device. If yes, proceed to the next step.

[0196] (3) Generate a random number N2 and obtain the current timestamp T3. Perform the following information calculations: P3 = N2 * G, P4 = N2 * Ai', Z = h(P3||P4||T3), and send the information {Z,P3,T3} to the IoT device.

[0197] Correspondingly, for each IoT device, the IoT device management module performs the following:

[0198] (1) After receiving the information {Z,P3,T3}, obtain the current timestamp T4. If the time difference between T4 and T3 is less than the time threshold T, perform the following information calculation:

[0199] Ai = h(Ti⊕Ii⊕CK'),

[0200] P4' = P3 * Ai,

[0201] Z' = h(P3||P4'||T3),

[0202] (2) Determine whether Z' is equal to Z. If not, reject the login request of the physical network device. If yes, perform the following information calculation:

[0203] Vi = h(SK||(N1*CK')),

[0204] SK = h((N1*P3)||Ai||T4),

[0205] (3) Obtain the current timestamp T4 and send the login information {Vi,T4} to the identity authentication center.

[0206] Correspondingly, the identity authentication center management module is used to perform the following:

[0207] (1) After receiving the login information {Vi,T4}, obtain the current timestamp T5. If the time difference between T5 and T4 is less than the time threshold T, perform the following information calculation:

[0208] Vi' = h((P1*CK)||SK),

[0209] (2) Determine whether Vi and Vi' are equal. If not, reject the login request of the logistics network device. If yes, accept the login request of the Internet of Things device and perform the following information calculation:

[0210] SK' = h((N2*P1)||Ai||T4),

[0211] (3) Return a digital certificate to the IoT device. The digital certificate includes {IDi,pubK,infoCA,T*,signIAC}, where infoCA represents the certificate issuer information, T* represents the certificate validity period, signIAC represents the issuer's digital signature, IDi represents the IoT device ID, and pubK represents the IoT device's public key.

[0212] Where P1 represents a point n times N1, Y, Z, and Vi are hot authentication codes obtained through hash operations, Y', Z', and Vi' represent derived authentication codes obtained through hash operations, P3 represents a point n times N2, and P2 and P4 represent points on the elliptic curve obtained through hash operations.

[0213] For each IoT device, the IoT device management module is used to authenticate with other IoT devices and obtain authorized access based on its identity digital certificate.

[0214] For each IoT device, if authentication fails during the authorized access process, the blockchain management module is used to cancel the IoT device's authentication information in the blockchain.

[0215] The present invention has been shown and described in detail above with reference to the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above embodiments, those skilled in the art will know that more embodiments of the present invention can be obtained by combining the code review methods in the different embodiments. These embodiments are also within the protection scope of the present invention.

Claims

1. A method for authenticating the identity of Internet of Things (IoT) devices, characterized in that, Authentication of IoT devices based on blockchain and elliptic curve cryptography includes the following steps: Identity generation: For each IoT device, select a random number as the private key, select a curve parameter as the base point, generate a public key through elliptic curve cryptography, and perform a hash operation on the public key to obtain the public key hash value; Identity Registration: For each IoT device, the IoT device sends a registration request to the identity authentication center. The identity authentication center performs identity registration calculations based on the registration request, obtains local identity verification information and identity registration information, stores the local identity verification information and registration request information locally, and returns the identity registration information to the IoT device. The IoT device uploads its identity registration information and public key as identity authentication information to the blockchain identity authentication contract through a secure channel. Among them, the device information includes the IoT device ID, login password, public key, private key, and curve parameters; the local identity authentication information includes identity identification information, device expiration time, and local identity authentication intermediate information; and the identity registration information includes identity identification information and blockchain identity authentication intermediate information. Identity Authentication: For each IoT device, the IoT device sends a login request to the identity authentication center. The login request includes the IoT device's identity registration information and a randomly generated random number. The identity authentication center authenticates the IoT device based on the login request, local identity authentication information, and identity authentication information stored in the identity smart contract, and returns a digital certificate to the IoT device. The digital certificate includes the IoT device's device ID, public key, and the validity period of the digital certificate. Authorized access: IoT devices authenticate with other IoT devices and obtain authorized access based on their identity digital certificates; Identity Management: If identity authentication fails during the authorization access process of IoT devices, the identity authentication information of the IoT devices in the blockchain will be cancelled. For IoT device Di and identity authentication center IAC, identity registration includes the following steps: IoT devices perform hash calculations based on their device ID and login password to obtain the device hash value. The device hash value, public key, private key, and curve parameters are then sent to the identity registration center as registration request information. The calculation formula for the device hash value Ii is: Ii=h(IDi||PWi), where IDi represents the device ID, PWi represents the login password, and h() represents the hash operation. After receiving the registration request information, the identity registration center generates a random string and performs identity registration calculations based on the registration request information and the random string. The identity registration calculations include the following: ， The identity authentication center stores Ai', PIDi, and EXP_time locally as local identity authentication information, and returns PIDi, CK', and Ti as identity registration information to the IoT device. IoT devices upload their identity registration information and public key as identity authentication information to the blockchain identity authentication contract through a secure channel; Among them, PIDi identifies the identity information, EXP_time represents the device expiration time, CK represents the encryption key, CK' represents the derived encryption key, Ti represents the temporary value, Ai represents the authentication code, and Ai' represents the derived authentication code; CK, CK', Ti, Ai, and Ai' serve as intermediate information for identity authentication, Ai' serves as intermediate information for local identity authentication, and CK' and Ti serve as intermediate information for blockchain identity authentication; For IoT device Di and identity authentication center IAC, identity authentication includes the following steps: The IoT device generates a random number N1 and a current timestamp T1. Based on the random number N1, the current timestamp T1, and the identity information PIDi, it generates login request information {PIDi, P1, Y, T1} and sends the login request information {PIDi, P1, Y, T1} to the identity authentication center. Where P1=N1*G, P2=h(N1*CK'), Y=h(P1||P2||T1), and CK' is the blockchain identity authentication information; After receiving the login request information {PIDi, P1, Y, T1}, the identity authentication center obtains the current timestamp T2. If the time difference between T2 and T1 is less than the threshold time T, the identity authentication center queries the corresponding EXP_time locally based on PIDi, and queries the corresponding Ti from the blockchain based on PIDi. Based on EXP_time, it determines whether the IoT device has expired. If it has not expired, the following information is calculated: Rs=Ti⊕h(priK ||PIDi), CK = h(Rs|| priK ||EXP_time||PIDi), P2' = h(P1*CK), Y'=h(P1||P2'||T1), And determine whether Y' is equal to Y. If not, reject the login request of the IoT device; if so, proceed to the next step. The identity authentication center generates a random number N2 and obtains the current timestamp T3. It then performs the following calculations: P3=N2*G, P4=N2*Ai', Z=h(P3||P4||T3), and sends the information {Z,P3,T3} to the IoT device. After receiving information {Z, P3, T3}, the IoT device obtains the current timestamp T4. If the time difference between T4 and T3 is less than the time threshold T, the following information calculation is performed: Ai = h(Ti⊕Ii⊕CK'), P4' = P3*Ai, Z' = h(P3||P4'||T3), And determine whether Z' is equal to Z. If not, reject the login request of the physical network device. If yes, proceed to the next step. IoT devices perform the following information calculations: Vi=h(SK||(N1*CK')), SK = h((N1*P3)||Ai||T4), And obtain the current timestamp T4, and send the login information {Vi,T4} to the identity authentication center; After receiving the login information {Vi, T4}, the identity authentication center obtains the current timestamp T5. If the time difference between T5 and T4 is less than the time threshold T, the identity authentication center performs the following calculations: Vi' = h((P1*CK)||SK) Determine if Vi and Vi' are equal. If not, reject the login request from the logistics network device. If yes, accept the login request from the IoT device and perform the following calculations: SK' = h((N2*P1)||Ai||T4), It returns a digital certificate to the IoT device. The digital certificate includes {IDi,pubK,infoCA,T*,signIAC}, where infoCA represents the certificate issuer information, T* represents the certificate validity period, signIAC represents the issuer's digital signature, IDi represents the IoT device ID, and pubK represents the IoT device's public key. Where P1 represents a point n times N1, Y, Z, and Vi are hot authentication codes obtained through hash operations, Y', Z', and Vi' represent derived authentication codes obtained through hash operations, P3 represents a point n times N2, and P2 and P4 represent points on the elliptic curve obtained through hash operations.

2. The IoT device authentication method according to claim 1, characterized in that, The formula for calculating the public key is as follows: pubK = priK * G Where G represents the base point, priK represents the private key, and pubK represents the public key.

3. The IoT device authentication method according to claim 1, characterized in that, When performing a hash operation on the public key to obtain the public key hash value, the public key is hashed using the SHA256 algorithm to generate a fixed-length digest as the public key hash value H, where H = h(pubK).

4. An Internet of Things (IoT) device authentication system, characterized in that, It is applied to IoT devices, blockchain, and identity authentication centers, including IoT device management modules, blockchain management modules, and identity authentication management modules; The IoT device management module is used to perform the following: For each IoT device, select a random number as the private key, select a curve parameter as the base point, generate a public key through the elliptic curve cryptography algorithm, and perform a hash operation on the public key to obtain the public key hash value; The IoT device management module, blockchain management module, and identity authentication management module work together to perform the following identity registration: For each IoT device, the network device management module is used to send registration request information to the identity authentication center; The identity authentication center management module is used to perform identity registration calculations based on registration request information, obtain local identity verification information and identity registration information, store the local identity verification information and registration request information locally, and return the identity registration information to IoT devices; For each IoT device, the IoT device management module is used to upload its identity registration information and public key as identity authentication information to the blockchain identity authentication contract through a secure channel. The device information includes the IoT device ID, login password, public key, private key and curve parameters. The local identity authentication information includes identity identification information, device expiration time and local identity authentication intermediate information. The identity registration information includes identity identification information and blockchain identity authentication intermediate information. The IoT device management module, blockchain management module, and identity authentication management module work together to perform the following identity authentication: For each IoT device, the IoT device management module is used to send login request information to the identity authentication center. The login request information includes the IoT device's identity registration information and a randomly generated random number. The identity authentication center management module is used to authenticate IoT devices based on login request information, local identity authentication information, and identity authentication information stored in the identity smart contract, and return a digital certificate to the IoT device. The digital certificate includes the IoT device's device ID, public key, and the validity period of the digital certificate. For each IoT device, the IoT device management module is used to authenticate with other IoT devices and obtain authorized access based on its identity digital certificate; For each IoT device, if authentication fails during the authorized access process, the blockchain management module is used to cancel the IoT device's authentication information in the blockchain. Specifically, for IoT device Di and identity authentication center IAC, during identity registration, for each IoT device, the IoT device management module performs a hash calculation based on its device ID and login password to obtain the device hash value, and sends the device hash value, public key, private key, and curve parameters as registration request information to the identity registration center. The calculation formula for the device hash value Ii is: Ii=h(IDi||PWi), where IDi represents the device ID, PWi represents the login password, and h() represents the hash operation. Correspondingly, the identity registration center management module is used to perform the following: Upon receiving the registration request information, a random string is generated. Based on the registration request information and the random string, identity registration calculation is performed, which includes the following: ， Correspondingly, for each IoT device, the IoT device management module uploads its identity registration information and public key as identity authentication information to the blockchain identity authentication contract through a secure channel; Among them, PIDi identifies the identity information, EXP_time represents the device expiration time, CK represents the encryption key, CK' represents the derived encryption key, Ti represents the temporary value, Ai represents the authentication code, and Ai' represents the derived authentication code; CK, CK', Ti, Ai, and Ai' serve as intermediate information for identity authentication, Ai' serves as intermediate information for local identity authentication, and CK' and Ti serve as intermediate information for blockchain identity authentication; Specifically, for IoT device Di and identity authentication center IAC, when performing identity authentication, for each IoT device, the IoT device management module performs the following: generates a random number N1 and generates the current timestamp T1, generates login request information {PIDi, P1, Y, T1} based on the random number N1, the current timestamp T1 and the identity identification information PIDi, and sends the login request information {PIDi, P1, Y, T1} to the identity authentication center; Where P1=N1*G, P2=h(N1*CK'), Y=h(P1||P2||T1), and CK' is the blockchain identity authentication information; Correspondingly, the identity authentication center management module performs the following: Upon receiving the login request information {PIDi, P1, Y, T1}, it obtains the current timestamp T2. If the time difference between T2 and T1 is less than the threshold time T, it queries the corresponding EXP_time locally based on PIDi and queries the corresponding Ti from the blockchain based on PIDi. Based on EXP_time, it determines whether the IoT device has expired. If it has not expired, it performs the following information calculations: Rs=Ti⊕h(priK||PIDi), CK = h(Rs|| priK ||EXP_time||PIDi), P2' = h(P1*CK), Y'=h(P1||P2'||T1), And determine whether Y' is equal to Y. If not, reject the login request of the IoT device; if so, proceed to the next step. Generate a random number N2 and obtain the current timestamp T3. Perform the following calculations: P3=N2*G, P4=N2*Ai', Z=h(P3||P4||T3), and send the information {Z,P3,T3} to the IoT device. Correspondingly, for each IoT device, the IoT device management module performs the following: After receiving information {Z,P3,T3}, it obtains the current timestamp T4. If the time difference between T4 and T3 is less than the time threshold T, it performs the following information calculations: Ai = h(Ti⊕Ii⊕CK'), P4' = P3*Ai, Z' = h(P3||P4'||T3), And determine whether Z' is equal to Z. If not, reject the login request of the physical network device. If yes, proceed to the next step. Perform the following calculations: Vi=h(SK||(N1*CK')), SK = h((N1*P3)||Ai||T4), And obtain the current timestamp T4, and send the login information {Vi,T4} to the identity authentication center; Correspondingly, the identity authentication center management module performs the following: After receiving login information {Vi, T4}, it obtains the current timestamp T5. If the time difference between T5 and T4 is less than the time threshold T, it performs the following information calculations: Vi' = h((P1*CK)||SK), Determine if Vi and Vi' are equal. If not, reject the login request from the logistics network device. If yes, accept the login request from the IoT device and perform the following calculations: SK' = h((N2*P1)||Ai||T4), It returns a digital certificate to the IoT device. The digital certificate includes {IDi,pubK,infoCA,T*,signIAC}, where infoCA represents the certificate issuer information, T* represents the certificate validity period, signIAC represents the issuer's digital signature, Idi represents the IoT device ID, and pubK represents the IoT device's public key. Where P1 represents a point n times N1, Y, Z, and Vi are hot authentication codes obtained through hash operations, Y', Z', and Vi' represent derived authentication codes obtained through hash operations, P3 represents a point n times N2, and P2 and P4 represent points on the elliptic curve obtained through hash operations.

5. The IoT device authentication system according to claim 4, characterized in that, The formula for calculating the public key is as follows: pubK = priK * G, Where G represents the base point, priK represents the private key, and pubK represents the public key.

6. The IoT device authentication system according to claim 4, characterized in that, When performing a hash operation on the public key to obtain the public key hash value, the IoT device management module is used to perform a hash operation on the public key using the SHA256 algorithm to generate a fixed-length digest as the public key hash value H, where H=h(pubK).

Images