A secure identity authentication method for an Internet of Things terminal device

Abstract

The present invention belongs to the field of identity authentication, and specifically refers to a secure identity authentication method for an Internet of Things terminal device, the method comprising constructing an electronic authentication key module, generating an OTP key, a first-level authentication stage, a second-level authentication stage, and a communication evaluation. This scheme proposes a multi-party key fusion method based on a one-time password protocol, ensuring that even if the system is compromised, it is difficult for a third party to infer confidential information, and has high practicality and confidentiality in various hybrid Internet of Things scenarios and Internet of Things terminal devices with limited processing capabilities; a two-layer identity authentication method based on an electronic key is proposed, the electronic key is automatically generated and managed, and no user intervention is required, to achieve two-factor authentication, and by introducing a hash function and random position selection, the legitimacy of the key is verified, and error correction and privacy protection of the key are achieved, ensuring that there are no errors or malicious tampering during the calculation process.

Description

Technical Field

[0001] The present invention relates to the field of identity authentication, and in particular to a method for secure identity authentication of an Internet of Things terminal device. Background Art

[0002] As the Internet of Things becomes more and more integrated into our daily lives, the key issue of data privacy has become increasingly prominent. Traditional lightweight key management systems with low resource intensity, although optimized in resource usage, still have problems with poor scalability, insufficient security, and limited computing and storage; existing network remote login access and two-factor authentication methods are at risk of being cracked when accessing industrial monitoring systems through unprotected Internet networks, and existing authentication methods have limitations such as passwords being easily leaked and OTP tokens being copied. Summary of the invention

[0003] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a method for secure identity authentication of an Internet of Things terminal device;

[0004] Although the traditional lightweight key management system with low resource intensity has been optimized in resource usage, it still has problems such as poor scalability, insufficient security and limited computing and storage. This scheme proposes a multi-party key fusion method based on the One-Time Pad (OTP) protocol. The OTP key and private input value are generated from the real random numbers obtained from the physical phenomena observed by each IoT terminal device to ensure that the key generation process is reliable. Since the key is only used once, strong security can be ensured, ensuring that even if the system is compromised, it is difficult for a third party to infer confidential information. It has high practicality and confidentiality in various hybrid IoT scenarios and IoT terminal devices with limited processing power. Compared with the traditional lightweight key management system with low resource intensity, this fusion method of cloud storage server and IoT terminal device jointly calculating their respective private data has made great progress in security; for the existing network remote login access and two-factor authentication methods, it is not difficult to pass without a third party. There is a risk of being cracked when accessing industrial monitoring systems through protected Internet networks, and existing authentication methods have limitations such as passwords being easily leaked and OTP tokens being copied. This solution proposes a two-layer identity authentication method based on electronic keys. The electronic keys are automatically generated and managed without user intervention to achieve two-factor authentication. A three-level protection measure is used to prevent attackers from reading the firmware in the electronic authentication key module, effectively improving the security of remote access and preventing security threats such as password leakage. By introducing hash functions and random position selection, the legitimacy of the key is verified, error correction and privacy protection of the key are achieved, ensuring that there are no errors or malicious tampering during the calculation process, reducing communication overhead, improving communication efficiency, and facilitating the deployment and application of resource-constrained IoT devices.

[0005] The technical solution adopted by the present invention is as follows: The present invention provides a method for secure identity authentication of an Internet of Things terminal device, the method comprising the following steps:

[0006] Step S1: construct an electronic authentication key module; the electronic authentication key module is composed of a control panel, a display screen and a button control unit, the control panel is electrically connected to the display screen, and the control panel is electrically connected to the button control unit; the Internet of Things terminal device is equipped with the electronic authentication key module, and the electronic authentication key module is electrically connected to the Internet of Things terminal device; the three-level protection measures are applied to the electronic authentication key module;

[0007] Step S2: Generate an OTP key; the electronic authentication key module captures the channel noise, generates a random number seed, encrypts the random number seed using an encrypted hash function, extracts characters of a preset length, generates an OTP key, and securely distributes the OTP key to the cloud storage server and the IoT terminal device. The formula for generating the OTP key is as follows:

[0008] ;

[0009] In the formula, Indicates the OTP key, represents a secure hash algorithm, represents the random number seed function, represents the entropy of the channel noise, Indicates the timestamp, represents the modulo operation, Indicates the key length;

[0010] Step S3: first level authentication stage;

[0011] Step S4: Second level authentication stage;

[0012] Step S5: Communication evaluation.

[0013] Furthermore, in step S1, the three-level protection measures taken on the electronic authentication key module specifically include the following steps:

[0014] Step S11: unpacking protection; using acid-resistant and solvent-resistant refractory polymer to wrap the chip of the control board to prevent attackers from reading data by physically contacting the chip;

[0015] Step S12: Programming interface protection: hiding the programming interface of the control board to prevent attackers from reading the firmware through a conventional programmer;

[0016] Step S13: Internal disconnection protection; disconnect the circuit of the read and write control board.

[0017] Further, in step S3, the first level authentication stage specifically includes the following steps:

[0018] Step S31: Collecting a PIN code; the display screen prompts the user to enter an m-digit PIN code, and the user enters the m-digit PIN code through the button control unit;

[0019] Step S32: Verify the PIN code; compare the PIN code entered by the user with the PIN code stored in the control panel;

[0020] Step S33: If the verification is correct, the user is prompted to enter the OTP key, and the second level authentication phase is entered. The user's access level is retrieved on the cloud storage server, and the user is granted access rights based on the access level, and step S4 is executed;

[0021] Step S34: If the verification fails, the preset number of attempts is reduced by one. The specific operation is as follows:

[0022] Step S341: When the number of attempts is greater than 0, the display screen continues to prompt the user to enter a PIN code;

[0023] Step S342: When the number of attempts is equal to 0, the electronic authentication key module enters a locked state, and prompts the user to wait for a period of time on the display screen. After the preset time, the electronic authentication key module restarts, enters the first level authentication stage, and jumps to step S31.

[0024] Further, in step S4, the second level authentication stage specifically includes the following steps:

[0025] Step S41: Generate a shared random number; take any two IoT terminal devices in the network, and refer to the two IoT terminal devices and the cloud storage server as three participants. Use the method of step S2 to obtain the private input values ​​of the three participants through channel noise, and generate a shared random number according to the private input values. Define the first IoT terminal device as participant P1, the second IoT terminal device as participant P2, and the cloud storage server as participant P3. The generation of a shared random number according to the private input values ​​specifically includes the following steps:

[0026] Step S411: Each IoT terminal device generates two shared random numbers using the following formula:

[0027] ;

[0028] In the formula, Represents a preset prime number, express The finite field of Represents two independent finite fields The Cartesian product of Represents a uniform distribution Randomly select from and Indicates Two shared random numbers generated by IoT terminal devices, ;

[0029] Step S412: Each IoT terminal device generates its third shared random number using the following formula:

[0030] ;

[0031] In the formula, Indicates The third shared random number generated by an IoT terminal device, Indicates The private input value of each IoT terminal device, represents the modulo operation, ;

[0032] Step S413: The cloud storage server generates three shared random numbers using the following formula:

[0033] ;

[0034] In the formula, Indicates the first A shared random number, Represents a uniform distribution Randomly select from ;

[0035] Step S42: Shared allocation, specifically including the following steps:

[0036] Step S421: Each participant privately sends its shared random number to other participants in the form of unicast, using the following formula:

[0037] ;

[0038] In the formula, represents the participant Pi, represents the participant Pj, represents the shared random number sent from participant Pi to participant Pj, i≠j and i,j∈{1,2,3};

[0039] Step S422: Calculate the partial sum of each participant using the following formula:

[0040] ;

[0041] In the formula, represents the partial sum of the participant Pj, represents the shared random number received by participant Pj from participant P1, represents the shared random number received by participant Pj from participant P2, represents the shared random number received by participant Pj from participant P3, j∈{1, 2, 3};

[0042] Step S423: Participant P1 Send to participant P2, participant P2 will Sent to participant P1, participant P3 will Broadcast to participants P1 and P2;

[0043] Said represents the partial sum calculated by participant P1 in step S422, represents the partial sum calculated by participant P2 in step S422, represents the partial sum calculated by participant P3 in step S422;

[0044] Step S43: Generate a shared session key; Participant P1 and Participant P2 calculate a shared session key, where the shared session key is known only to Participant P1 and Participant P2. The formula used to calculate the shared session key is as follows:

[0045] ;

[0046] In the formula, Represents a bitwise exclusive OR operation, Represents a shared session key;

[0047] Step S44: All parties keep their private input values ​​private.

[0048] Further, in step S5, the communication evaluation specifically includes the following steps:

[0049] Step S51: encryption and decryption; use the shared session key to encrypt and transmit the communication data to achieve secure communication, and estimate the time required for communication between the participants P1 and P2. The formula used is as follows:

[0050] ;

[0051] In the formula, Indicates the transmission of ciphertext between participants P1 and P2 The time required, Indicates the bit length, Represents ciphertext, Indicates plain text, Represents a bitwise exclusive OR operation, It is approximately equal to, It means to sum all shared random numbers. means to sum all partial sums;

[0052] Step S52: Optimizing network configuration, optimizing the allocation of bandwidth resources according to the estimated time required for communication;

[0053] Step S53: Verify the legitimacy of the shared session key. The specific operations are as follows:

[0054] Step S531: Participant P1 selects a random position b, cuts the shared session key from the bth position, calculates the hash value A from the bth position to the end of the shared session key, and sends the hash value A to participant P2. The formula used is as follows:

[0055] ;

[0056] In the formula, represents the hash value A calculated by participant P1, Indicates the operation of calculating the hash value. represents the partial sum of party P2, Indicates the shared session key from bit b to the end. Indicates the total number of bits of the shared session key;

[0057] Step S532: Participant P2 verifies the hash value A sent by participant P1. Specifically, participant P2 calculates hash value B. If hash value A is the same as hash value B, the current communication is maintained. If hash value A is different from hash value B, there is a difference between the shared session keys of participant P1 and participant P2. The current communication is stopped and the shared session key is renegotiated. Step S2 is executed. The calculation formula of hash value B is as follows:

[0058] ;

[0059] In the formula, Represents the hash value B calculated by participant P2.

[0060] The present invention provides a method for secure identity authentication of an Internet of Things terminal device. The beneficial effects achieved by the present invention using the above scheme are as follows:

[0061] (1) Although traditional lightweight key management systems with low resource intensity have been optimized in terms of resource usage, they still have problems such as poor scalability, insufficient security, and limited computing and storage. This scheme proposes a multi-party key fusion method based on the One-Time Pad (OTP) protocol. The OTP key and private input value are generated from the true random numbers obtained from the physical phenomena observed by each IoT terminal device, ensuring that the key generation process is reliable. Since the key is only used once, strong security can be ensured, ensuring that even if the system is compromised, it is difficult for a third party to infer confidential information. It has high practicality and confidentiality in various hybrid IoT scenarios and IoT terminal devices with limited processing power. Compared with traditional lightweight key management systems with low resource intensity, this fusion method of jointly calculating the private data of each cloud storage server and IoT terminal devices has made great progress in security.

[0062] (2) In view of the fact that the existing network remote login access and two-factor authentication methods (Two-Factor Authentication, 2FA) are at risk of being cracked when accessing industrial monitoring systems through unprotected Internet networks, and the existing authentication methods have the limitations of passwords being easily leaked and OTP tokens being copied, this scheme proposes a two-layer identity authentication method based on electronic keys. The electronic keys are automatically generated and managed without user intervention to achieve two-factor authentication. A three-level protection measure is adopted to prevent attackers from reading the firmware in the electronic authentication key module, effectively improving the security of remote access and preventing password leakage security threats. By introducing hash functions and random position selection, the legitimacy of the key is verified, and error correction and privacy protection of the key are achieved, ensuring that there are no errors or malicious tampering during the calculation process, reducing communication overhead, improving communication efficiency, and facilitating the deployment and application of resource-constrained IoT devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 A schematic diagram of a flow chart of a secure identity authentication method for an Internet of Things terminal device provided by the present invention.

[0064] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0065] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0066] In the description of the present invention, it should be understood that terms such as “upper”, “lower”, “front”, “back”, “left”, “right”, “top”, “bottom”, “inside” and “outside” indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as limiting the present invention.

[0067] Example 1, see Figure 1 The present invention provides a method for secure identity authentication of an Internet of Things terminal device, the method comprising the following steps:

[0068] Step S1: construct an electronic authentication key module; the electronic authentication key module is composed of a control panel, a display screen and a button control unit, the control panel is electrically connected to the display screen, and the control panel is electrically connected to the button control unit; the Internet of Things terminal device is equipped with the electronic authentication key module, and the electronic authentication key module is electrically connected to the Internet of Things terminal device; the three-level protection measures are applied to the electronic authentication key module;

[0069] Step S2: Generate an OTP key; the electronic authentication key module captures the channel noise, generates a random number seed, encrypts the random number seed using an encrypted hash function, extracts characters of a preset length, generates an OTP key, and securely distributes the OTP key to the cloud storage server and the IoT terminal device. The formula for generating the OTP key is as follows:

[0070] ;

[0071] In the formula, Indicates the OTP key, represents a secure hash algorithm, represents the random number seed function, represents the entropy of the channel noise, Indicates the timestamp, represents the modulo operation, Indicates the key length;

[0072] Step S3: first level authentication stage;

[0073] Step S4: Second level authentication stage;

[0074] Step S5: Communication evaluation.

[0075] Example 2, see Figure 1 This embodiment is based on the above embodiment. In step S1, the three-level protection measures taken on the electronic authentication key module specifically include the following steps:

[0076] Step S11: unpacking protection; using acid-resistant and solvent-resistant refractory polymer to wrap the chip of the control board to prevent attackers from reading data by physically contacting the chip;

[0077] Step S12: Programming interface protection: hiding the programming interface of the control board to prevent attackers from reading the firmware through a conventional programmer;

[0078] Step S13: Internal disconnection protection; disconnect the circuit of the read and write control board.

[0079] Example 3, see Figure 1 This embodiment is based on the above embodiment. In step S3, the first level authentication stage specifically includes the following steps:

[0080] Step S31: Collecting a PIN code; the display screen prompts the user to enter an m-digit PIN code, and the user enters the m-digit PIN code through the button control unit;

[0081] Step S32: Verify the PIN code; compare the PIN code entered by the user with the PIN code stored in the control panel;

[0082] Step S33: If the verification is correct, the user is prompted to enter the OTP key, and the second level authentication phase is entered. The user's access level is retrieved on the cloud storage server, and the user is granted access rights based on the access level, and step S4 is executed;

[0083] Step S34: If the verification fails, the preset number of attempts is reduced by one. The specific operation is as follows:

[0084] Step S341: When the number of attempts is greater than 0, the display screen continues to prompt the user to enter a PIN code;

[0085] Step S342: When the number of attempts is equal to 0, the electronic authentication key module enters a locked state, and prompts the user to wait for a period of time on the display screen. After the preset time, the electronic authentication key module restarts, enters the first level authentication stage, and jumps to step S31.

[0086] Example 4, see Figure 1 This embodiment is based on the above embodiment. In step S4, the second level authentication stage specifically includes the following steps:

[0087] Step S41: Generate a shared random number; take any two IoT terminal devices in the network, and refer to the two IoT terminal devices and the cloud storage server as three participants. Use the method of step S2 to obtain the private input values ​​of the three participants through channel noise, and generate a shared random number according to the private input values. Define the first IoT terminal device as participant P1, the second IoT terminal device as participant P2, and the cloud storage server as participant P3. The generation of a shared random number according to the private input values ​​specifically includes the following steps:

[0088] Step S411: Each IoT terminal device generates two shared random numbers using the following formula:

[0089] ;

[0090] In the formula, Represents a preset prime number, express The finite field of Represents two independent finite fields The Cartesian product of Represents a uniform distribution Randomly select from and Indicates Two shared random numbers generated by IoT terminal devices, ;

[0091] Step S412: Each IoT terminal device generates its third shared random number using the following formula:

[0092] ;

[0093] In the formula, Indicates The third shared random number generated by an IoT terminal device, Indicates The private input value of each IoT terminal device, represents the modulo operation, ;

[0094] Step S413: The cloud storage server generates three shared random numbers using the following formula:

[0095] ;

[0096] In the formula, Indicates the first A shared random number, Represents a uniform distribution Randomly select from ;

[0097] Step S42: Shared allocation, specifically including the following steps:

[0098] Step S421: Each participant privately sends its shared random number to other participants in the form of unicast, using the following formula:

[0099] ;

[0100] In the formula, represents the participant Pi, represents the participant Pj, represents the shared random number sent from participant Pi to participant Pj, i≠j and i,j∈{1,2,3};

[0101] Step S422: Calculate the partial sum of each participant using the following formula:

[0102] ;

[0103] In the formula, represents the partial sum of the participant Pj, represents the shared random number received by participant Pj from participant P1, represents the shared random number received by participant Pj from participant P2, represents the shared random number received by participant Pj from participant P3, j∈{1, 2, 3};

[0104] Step S423: Participant P1 Send to participant P2, participant P2 will Sent to participant P1, participant P3 will Broadcast to participants P1 and P2;

[0105] Said represents the partial sum calculated by participant P1 in step S422, represents the partial sum calculated by participant P2 in step S422, represents the partial sum calculated by participant P3 in step S422;

[0106] Step S43: Generate a shared session key; Participant P1 and Participant P2 calculate a shared session key, where the shared session key is known only to Participant P1 and Participant P2. The formula used to calculate the shared session key is as follows:

[0107] ;

[0108] In the formula, Represents a bitwise exclusive OR operation, Represents a shared session key;

[0109] Step S44: All parties keep their private input values ​​private.

[0110] Example 5, see Figure 1 This embodiment is based on the above embodiment. In step S5, the communication evaluation specifically includes the following steps:

[0111] Step S51: encryption and decryption; use the shared session key to encrypt and transmit the communication data to achieve secure communication, and estimate the time required for communication between the participants P1 and P2. The formula used is as follows:

[0112] ;

[0113] In the formula, Indicates the transmission of ciphertext between participants P1 and P2 The time required, Indicates the bit length, Represents ciphertext, Indicates plain text, Represents a bitwise exclusive OR operation, It is approximately equal to, It means to sum all shared random numbers. means to sum all partial sums;

[0114] Step S52: Optimizing network configuration, optimizing the allocation of bandwidth resources according to the estimated time required for communication;

[0115] Step S53: Verify the legitimacy of the shared session key. The specific operations are as follows:

[0116] Step S531: Participant P1 selects a random position b, cuts the shared session key from the bth position, calculates the hash value A from the bth position to the end of the shared session key, and sends the hash value A to participant P2. The formula used is as follows:

[0117] ;

[0118] In the formula, represents the hash value A calculated by participant P1, Indicates the operation of calculating the hash value. represents the partial sum of party P2, Indicates the shared session key from bit b to the end. Indicates the total number of bits of the shared session key;

[0119] Step S532: Participant P2 verifies the hash value A sent by participant P1. Specifically, participant P2 calculates hash value B. If hash value A is the same as hash value B, the current communication is maintained. If hash value A is different from hash value B, there is a difference between the shared session keys of participant P1 and participant P2. The current communication is stopped and the shared session key is renegotiated. Step S2 is executed. The calculation formula of hash value B is as follows:

[0120] ;

[0121] In the formula, Represents the hash value B calculated by participant P2.

[0122] Example 6, see Figure 1 This embodiment is based on the above embodiment. In step S2, the channel noise is captured and a true random number generator (TRNG) is used to generate a truly unpredictable random number based on the physical phenomenon of the channel noise.

[0123] Embodiment 7, see Figure 1 This embodiment is based on the above embodiment. In step S2, step S3 and step S4, ZeroC-Ice v.3.7 middleware and Python language v.3.12 are used to develop and implement the first-level authentication stage, the second-level authentication stage and the communication evaluation.

[0124] Embodiment 8, see Figure 1 This embodiment is based on the above embodiment. In step S1, the electronic key hardware is constructed by using an Arduino Pro Micro development board based on an ATmega32U4 microcontroller as a control board, and a 0.91-inch OLED display and a button control unit.

[0125] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0126] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

[0127] The present invention and its embodiments are described above, and such description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if ordinary technicians in the field are inspired by it, without departing from the purpose of the invention, they can design a structure and embodiment similar to the technical solution without creativity, which should belong to the protection scope of the present invention.

Claims

1. A method for secure identity authentication of an Internet of Things terminal device, characterized in that: The method comprises the following steps: Step S1: construct an electronic authentication key module; the electronic authentication key module is composed of a control panel, a display screen and a button control unit, the control panel is electrically connected to the display screen, and the control panel is electrically connected to the button control unit; the Internet of Things terminal device is equipped with the electronic authentication key module, and the electronic authentication key module is electrically connected to the Internet of Things terminal device; the three-level protection measures are applied to the electronic authentication key module; Step S2: Generate an OTP key; the electronic authentication key module captures the channel noise, generates a random number seed, encrypts the random number seed using an encrypted hash function, extracts characters of a preset length, generates an OTP key, and securely distributes the OTP key to the cloud storage server and the IoT terminal device. The formula for generating the OTP key is as follows: ； In the formula, Indicates the OTP key, represents a secure hash algorithm, represents the random number seed function, represents the entropy of the channel noise, Indicates the timestamp, represents the modulo operation, Indicates the key length; Step S3: first level authentication stage; Step S4: Second level authentication stage; Step S5: communication evaluation; In step S4, the second level authentication stage specifically includes the following steps: Step S41: Generate a shared random number; take any two IoT terminal devices in the network, and refer to the two IoT terminal devices and the cloud storage server as three participants. Use the method of step S2 to obtain the OTP keys of the three participants respectively through channel noise, generate a shared random number according to the OTP key, define the first IoT terminal device as participant P1, define the second IoT terminal device as participant P2, and define the cloud storage server as participant P3. The generation of a shared random number according to the OTP key specifically includes the following steps: Step S411: Each IoT terminal device generates two shared random numbers using the following formula: ； In the formula, Represents a preset prime number, express The finite field of Represents two independent finite fields The Cartesian product of Represents a uniform distribution Randomly select from and Indicates Two shared random numbers generated by IoT terminal devices, ; Step S412: Each IoT terminal device generates its third shared random number using the following formula: ； In the formula, Indicates The third shared random number generated by an IoT terminal device, Indicates The OTP key of each IoT terminal device, represents the modulo operation, ; Step S413: The cloud storage server generates three shared random numbers using the following formula: ； In the formula, Indicates the first A shared random number, Represents a uniform distribution Randomly select from ; Step S42: Shared allocation, specifically including the following steps: Step S421: Each participant privately sends its shared random number to other participants in the form of unicast, using the following formula: ； In the formula, represents the participant Pi, represents the participant Pj, represents the shared random number sent from participant Pi to participant Pj, i≠j and i,j∈{1,2,3}; Step S422: Calculate the partial sum of each participant using the following formula: ； In the formula, represents the partial sum of the participant Pj, represents the shared random number received by participant Pj from participant P1, represents the shared random number received by participant Pj from participant P2, represents the shared random number received by participant Pj from participant P3, j∈{1, 2, 3}; Step S423: Participant P1 Send to participant P2, participant P2 will Sent to participant P1, participant P3 will Broadcast to participants P1 and P2; Said represents the partial sum calculated by participant P1 in step S422, represents the partial sum calculated by participant P2 in step S422, represents the partial sum calculated by participant P3 in step S422; Step S43: Generate a shared session key; Participant P1 and Participant P2 calculate a shared session key, where the shared session key is known only to Participant P1 and Participant P2. The formula used to calculate the shared session key is as follows: ； In the formula, Represents a bitwise exclusive OR operation, Represents a shared session key; Step S44: All parties keep their OTP keys private; In step S5, the communication evaluation specifically includes the following steps: Step S51: encryption and decryption; use the shared session key to encrypt and transmit the communication data to achieve secure communication, and estimate the time required for communication between the participants P1 and P2. The formula used is as follows: ； In the formula, Indicates the transmission of ciphertext between participants P1 and P2 The time required, Indicates the bit length, Represents ciphertext, Indicates plain text, Represents a bitwise exclusive OR operation, It is approximately equal to, It means to sum all shared random numbers. means to sum all partial sums; Step S52: Optimizing network configuration, optimizing the allocation of bandwidth resources according to the estimated time required for communication; Step S53: Verify the legitimacy of the shared session key. The specific operations are as follows: Step S531: Participant P1 selects a random position b, cuts the shared session key from the bth position, calculates the hash value A from the bth position to the end of the shared session key, and sends the hash value A to participant P2. The formula used is as follows: ； In the formula, represents the hash value A calculated by participant P1, Indicates the operation of calculating the hash value. represents the partial sum of party P2, Indicates the shared session key from bit b to the end. Indicates the total number of bits of the shared session key; Step S532: Participant P2 verifies the hash value A sent by participant P1. Specifically, participant P2 calculates hash value B. If hash value A is the same as hash value B, the current communication is maintained. If hash value A is different from hash value B, there is a difference between the shared session keys of participant P1 and participant P2. The current communication is stopped and the shared session key is renegotiated. Step S2 is executed. The calculation formula of hash value B is as follows: ； In the formula, Represents the hash value B calculated by participant P2.

2. The method for secure identity authentication of an Internet of Things terminal device according to claim 1, characterized in that: In step S1, the three-level protection measures are applied to the electronic authentication key module, specifically including the following steps: Step S11: unpacking protection; using acid-resistant and solvent-resistant refractory polymer to wrap the chip of the control board to prevent attackers from reading data by physically contacting the chip; Step S12: Programming interface protection: hiding the programming interface of the control board to prevent attackers from reading the firmware through a conventional programmer; Step S13: Internal disconnection protection; disconnect the circuit of the read and write control board.

3. A method for secure identity authentication of an Internet of Things terminal device according to claim 2, characterized in that: In step S3, the first level authentication stage specifically includes the following steps: Step S31: Collecting a PIN code; the display screen prompts the user to enter an m-digit PIN code, and the user enters the m-digit PIN code through the button control unit; Step S32: Verify the PIN code; compare the PIN code entered by the user with the PIN code stored in the control panel; Step S33: If the verification is correct, the user is prompted to enter the OTP key, and the second level authentication phase is entered. The user's access level is retrieved on the cloud storage server, and the user is granted access rights based on the access level, and step S4 is executed; Step S34: If the verification fails, the preset number of attempts is reduced by one. The specific operation is as follows: Step S341: When the number of attempts is greater than 0, the display screen continues to prompt the user to enter a PIN code; Step S342: When the number of attempts is equal to 0, the electronic authentication key module enters a locked state, and prompts the user to wait for a period of time on the display screen. After the preset time, the electronic authentication key module restarts, enters the first level authentication stage, and jumps to step S31.

Images