Internet of Things equipment access authentication method, electronic equipment and storage medium

Abstract

The invention discloses an Internet of Things equipment access authentication method, electronic equipment and a storage medium. The method is applied to a cloud security authentication service, and comprises the following steps: carrying out legality authentication on Internet of Things equipment according to a connection pool information acquisition request of a cloud gateway service; after the legality authentication of the Internet of Things equipment is passed, storing a user name and a password randomly allocated to the Internet of Things equipment to a preset database, and sending connection pool information associated with the Internet of Things equipment in the preset database to a cloud gateway service; and in response to a hook function triggering operation of the Internet of Things server, verifying the password according to a target password corresponding to the user name in a preset database to obtain an access authentication result of the Internet of Things device. According to the invention, legality authentication is carried out on the Internet of Things equipment by using the cloud security authentication service, and then the randomly generated user name and password are adopted and the connection pool information associated with the Internet of Things equipment is obtained, so that the security authentication of the access of the Internet of Things equipment is effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to an Internet of Things device access authentication method, electronic equipment and storage medium. Background Art

[0002] With the development of technology, more and more IoT devices are connected to the Internet, realizing the extension of the Internet from people to things. Among the series of problems faced by the development of IoT, security issues are the most important. How to ensure the security of device access has also become an unavoidable issue for IoT cloud platforms.

[0003] In order to prevent IoT servers from being attacked, existing technologies usually choose to use IP whitelists combined with plaintext password encryption to authenticate connected IoT devices. However, the IP whitelist method requires adding a whitelist to each IoT device. If the network IP changes due to the replacement of the device SIM card, the IP whitelist needs to be frequently maintained, which greatly increases the operation and maintenance costs; at the same time, the plaintext password encryption may also be cracked by illegal attackers, causing the IoT server to be attacked maliciously. Therefore, how to effectively improve the security authentication of IoT device access has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] The present invention provides an Internet of Things device access authentication method, an electronic device and a storage medium to solve the problem of low security of Internet of Things device access authentication in the prior art.

[0005] According to one aspect of the present invention, a method for authenticating access to an IoT device is provided. The method is applied to a cloud security authentication service, and includes:

[0006] According to the connection pool information acquisition request of the cloud gateway service, the legitimacy of the IoT device is authenticated;

[0007] After the IoT device passes the legitimacy authentication, the username and password randomly assigned to the IoT device are saved in the preset database, and the connection pool information associated with the IoT device in the preset database is sent to the cloud gateway service;

[0008] In response to the hook function triggering operation of the Internet of Things server, the password is verified according to the target password corresponding to the user name in the preset database to obtain the access authentication result of the Internet of Things device.

[0009] According to another aspect of the present invention, a method for authenticating access to an IoT device is provided. The method is applied to a cloud gateway service and includes:

[0010] According to the connection pool information acquisition request of the device gateway service, the legitimacy of the IoT device is authenticated;

[0011] After the IoT device passes the legitimacy authentication, a connection pool information acquisition request is sent to the cloud security authentication service;

[0012] Obtain the connection pool information sent by the cloud security authentication service after the IoT device passes the legitimacy authentication, and send the connection pool information to the device gateway service.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the Internet of Things device access authentication method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the Internet of Things device access authentication method described in any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention is applied to the cloud security authentication service, and the legitimacy of the Internet of Things device is authenticated by obtaining the connection pool information request according to the cloud gateway service; after the legitimacy authentication of the Internet of Things device is passed, the username and password randomly assigned to the Internet of Things device are saved to the preset database, and the connection pool information associated with the Internet of Things device in the preset database is sent to the cloud gateway service; in response to the triggering operation of the hook function of the Internet of Things server, the password is verified according to the target password corresponding to the username in the preset database to obtain the access authentication result of the Internet of Things device. This embodiment uses the cloud security authentication service to authenticate the legitimacy of the Internet of Things device, and then uses the randomly generated username and password and obtains the connection pool information associated with the Internet of Things device, thereby avoiding the leakage of the username and password, preventing malicious attacks by unlawful attackers, and effectively improving the security authentication of the access to the Internet of Things device.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 This is a flow chart of an Internet of Things device access authentication method provided according to Embodiment 1 of the present invention;

[0022] Figure 2 This is a flow chart of an Internet of Things device access authentication method provided according to Embodiment 2 of the present invention;

[0023] Figure 3 This is a flow chart of an Internet of Things device access authentication method provided according to Embodiment 3 of the present invention;

[0024] Figure 4 This is a flow chart of an Internet of Things device access authentication method provided according to Embodiment 4 of the present invention;

[0025] Figure 5 This is a schematic diagram of the structure of an Internet of Things device access authentication device provided according to Embodiment 5 of the present invention;

[0026] Figure 6 This is a schematic diagram of the structure of an Internet of Things device access authentication device provided according to Embodiment 6 of the present invention;

[0027] Figure 7 It is a structural schematic diagram of an electronic device that implements the Internet of Things device access authentication method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] Embodiment 1

[0031] Figure 1 This is a flowchart of an Internet of Things device access authentication method provided in the first embodiment of the present invention. This embodiment is applicable to the case where an Internet of Things device accesses an Internet of Things server for security authentication. The method can be executed by an Internet of Things device access authentication device. The Internet of Things device access authentication device can be implemented in the form of hardware and / or software. The Internet of Things device access authentication device can be configured in an electronic device. Figure 1 As shown, the first embodiment provides an IoT device access authentication method, which is applied to a cloud security authentication service and specifically includes the following steps:

[0032] S110: Perform legitimacy authentication on the IoT device according to the connection pool information acquisition request of the cloud gateway service.

[0033] Among them, the cloud gateway service can refer to the gateway service used to serve as a bridge between the IoT cloud platform and the external network. The cloud gateway service does not provide device access services, but only performs preliminary verification of the device, such as device identification (ClientId) rule verification, device access request rule verification, and device IP blacklist verification.

[0034] The cloud security authentication service may refer to a service interface configured by the IoT cloud platform for performing multi-rule access security authentication on IoT devices. The cloud security authentication service does not expose the interface to the outside world and has high security and reliability.

[0035] The connection pool information acquisition request may refer to a request for obtaining information related to a connection pool pre-created by an IoT server. The connection pool information may be pre-bound to a device identifier (ClientId) of an IoT device. Only devices that have passed the specified rule verification, i.e., the legitimacy authentication, can obtain the connection pool information.

[0036] In an embodiment of the present invention, the Internet of Things cloud platform can be pre-configured with a cloud gateway service and a cloud security authentication service. The cloud security authentication service can obtain the connection pool information acquisition request sent by the cloud gateway service after the Internet of Things device has passed the preliminary verification, thereby triggering the legitimacy authentication process for the Internet of Things device applying for access; wherein, the rules for verifying the legitimacy of the device may include but are not limited to: device IP black / white list authentication, device identification (ClientId) authentication, device username + password authentication, digital certificate authentication, device serial number + device authentication code verification, device serial number + device MAC address verification, etc.

[0037] S120: After the IoT device passes the legitimacy authentication, the username and password randomly assigned to the IoT device are saved in a preset database, and the connection pool information associated with the IoT device in the preset database is sent to the cloud gateway service.

[0038] The connection pool information may include but is not limited to the following information: IoT server address (ServerAddress), IoT server port (Port), device identifier (ClientId), clean session flag (Clean SessionFlag), will message (Will Message), keep alive (Keep Alive), etc. The function of the connection pool is to save the pre-created connection (object) in the pool (Pool). When a device request comes, the created connection (object) can be directly used to access the IoT server, thereby omitting the process of creating and destroying the connection, and improving the performance of data transmission between the device and the IoT server.

[0039] In an embodiment of the present invention, when the cloud security authentication service performs a series of device legitimacy rule authentication on the IoT device and all verifications are passed, a set of unique usernames (Username) and passwords (Password) can be randomly assigned to the IoT device applying for access, and the username and password are then associated and stored in a preset database such as Redis; at the same time, since the connection pool information has been pre-bound to the device identifier (ClientId) of the IoT device and stored in the preset database, after the IoT device passes the legitimacy authentication, the corresponding associated connection pool information can be obtained in the preset database according to its ClientId, and the connection pool information can be sent to the cloud gateway service, so that the device gateway service corresponding to the subsequent IoT device can establish a connection request with the IoT server based on the connection pool information.

[0040] S130. In response to the triggering operation of the hook function of the Internet of Things server, the password is verified according to the target password corresponding to the user name in the preset database to obtain the access authentication result of the Internet of Things device.

[0041] Among them, the Internet of Things server may include but is not limited to: MQTT (Message Queuing Telemetry Transport) server, EMQX (Erlang / Enterprise / Elastic MQTT Broker) server, etc.

[0042] The hook function triggering operation can be understood as the operation that triggers the hook function when the IoT device accesses the IoT server. The IoT server is pre-configured with a hook function. When the device accesses, the cloud security authentication service (interface) will be called to authenticate the device access request. Only after the authentication is passed can it connect to the IoT server.

[0043] In an embodiment of the present invention, since an unlawful attacker may maliciously attack the IoT server by simulating an existing username and password, the cloud security authentication service will not allow the device to directly establish a connection (e.g., a TCP connection) with the IoT server after the IoT device passes the legitimacy authentication. Instead, the cloud security authentication service will respond to the hook function trigger operation of the IoT server, and use the randomly assigned username in S120 to search the preset database for the target password associated with it, and determine whether the target password is consistent with the previously randomly assigned password. If they are consistent, the access authentication result will be determined as a successful device access authentication, that is, the device is allowed to establish a connection with the IoT server, and the two can communicate for business; if they are inconsistent, the access authentication result will be determined as a failed device access authentication, that is, the device is not allowed to establish a connection with the IoT server.

[0044] The technical solution of the embodiment of the present invention is applied to the cloud security authentication service, and the legitimacy of the Internet of Things device is authenticated by obtaining the connection pool information request according to the cloud gateway service; after the legitimacy authentication of the Internet of Things device is passed, the username and password randomly assigned to the Internet of Things device are saved to the preset database, and the connection pool information associated with the Internet of Things device in the preset database is sent to the cloud gateway service; in response to the triggering operation of the hook function of the Internet of Things server, the password is verified according to the target password corresponding to the username in the preset database to obtain the access authentication result of the Internet of Things device. This embodiment uses the cloud security authentication service to authenticate the legitimacy of the Internet of Things device, and then uses the randomly generated username and password and obtains the connection pool information associated with the Internet of Things device, thereby avoiding the leakage of the username and password, preventing malicious attacks by unlawful attackers, and effectively improving the security authentication of the access to the Internet of Things device.

[0045] Embodiment 2

[0046] Figure 2The flowchart of an IoT device access authentication method provided in the second embodiment of the present invention is further optimized and expanded based on the above implementation, and can be combined with various optional technical solutions in the above implementation. Figure 2 As shown, the second embodiment provides an IoT device access authentication method, which is applied to a cloud security authentication service and specifically includes the following steps:

[0047] S210. Receive a connection pool information acquisition request sent by the cloud gateway service; wherein the connection pool information acquisition request adopts an HTTP POST request method.

[0048] In an embodiment of the present invention, when an IoT device applies to access an IoT server, a cloud-based security authentication service may receive a connection pool information acquisition request sent by a cloud-based gateway service, wherein the connection pool information acquisition request carries information such as a device MAC address, a device serial number (SN), a device type, a device number, and a device authentication code associated with the IoT device; and the connection pool information acquisition request uses an HTTP POST request method to send data to the IoT server and request the IoT server to process the data, which has the advantages of high data transmission security and concealment.

[0049] S220: Obtain the device IP address corresponding to the IoT device, and verify the device IP address according to a preset device blacklist.

[0050] The preset device blacklist may refer to a pre-configured device IP blacklist that is prohibited from establishing a connection with the IoT server.

[0051] In an embodiment of the present invention, the cloud security authentication service can be provided with an IP blacklist authentication strategy, which determines whether the IoT device applying for access is an illegal device by performing IP matching between the acquired device IP address of the IoT device and the preset device blacklist. The subsequent device access security authentication process will be executed only after the device IP passes. Otherwise, the device connection will be directly rejected.

[0052] S230: After the device IP address is verified, obtain the device registration information of the IoT device.

[0053] Among them, the device registration information may refer to the relevant device information pre-registered in the cloud before the IoT device is connected to the IoT server, for example, it may include but is not limited to the following information: device name, device type, device code, device MAC address, device serial number (SN), device identifier (ClientId), etc.

[0054] In an embodiment of the present invention, when the IP address of an IoT device is verified, its corresponding device registration information can be obtained from a data storage location such as a preset database, so that the device registration information can be used to authenticate the legitimacy of the device.

[0055] S240. According to the target device serial number, target device authentication code and target device MAC address in the device registration information, the device serial number, device authentication code and device MAC address in the connection pool information acquisition request are verified respectively, and after the device serial number, device authentication code and device MAC address are all verified, it is determined that the legitimacy authentication of the Internet of Things device has passed.

[0056] In an embodiment of the present invention, after the IP address of the Internet of Things device is verified, the device serial number, device authentication code and device MAC address corresponding to the Internet of Things device can be extracted by parsing the message of the connection pool information acquisition request, and then the target device serial number, target device authentication code and target device MAC address in the device registration information are used to verify the above device serial number, device authentication code and device MAC address respectively. Only when all three are verified can the legitimacy of the Internet of Things device be verified. Conversely, if at least one of the three is not verified, the device connection will be directly rejected.

[0057] S250: After the IoT device passes the legitimacy authentication, a unique user name and password are randomly generated for the IoT device, and the user name and password are associated and stored in a preset database.

[0058] In the embodiment of the present invention, after determining that the IoT device has passed the legal authentication, the cloud security authentication service can randomly generate a unique user name and password for the device, and store the user name and password in a preset database such as Redis, so as to facilitate the subsequent access request authentication of the device. Furthermore, preset databases such as Redis can also set an expiration time to prevent illegal attackers from using existing user names and passwords to maliciously attack IoT servers due to the leakage of user names and passwords.

[0059] S260: Obtain corresponding associated connection pool information in a preset database according to the device identification of the IoT device, and send the connection pool information to the cloud gateway service.

[0060] In an embodiment of the present invention, after determining that the legitimacy authentication of the IoT device has passed, the cloud-based security authentication service can search for the corresponding associated connection pool information in a preset database such as Redis according to the device identifier (ClientId) of the IoT device, and send the connection pool information to the cloud-based gateway service, so that the device gateway service corresponding to the subsequent IoT device can establish a connection request with the IoT server based on the connection pool information.

[0061] S270: In response to the hook function triggering operation of the IoT server, a corresponding target password is searched in a preset database according to the user name.

[0062] In an embodiment of the present invention, the cloud security authentication service can respond to the hook function trigger operation of the IoT server, and use the randomly assigned user name in S250 to search for the corresponding associated target password in a preset database such as Redis, so as to authenticate the device access request based on the target password.

[0063] S280: Determine whether the target password is consistent with the randomly assigned password.

[0064] S290. If yes, determine the access authentication result as successful device access authentication; if no, determine the access authentication result as failed device access authentication.

[0065] In an embodiment of the present invention, the access authentication result of the Internet of Things device applying for access can be determined by judging the consistency between the target password and the previously randomly assigned password. Specifically, if the target password is consistent with the aforementioned randomly assigned password, the access authentication result is determined as a successful device access authentication, that is, the device is allowed to establish a connection with the Internet of Things server, and the two can communicate for business; if the two are inconsistent, the access authentication result is determined as a failed device access authentication, that is, the device is not allowed to establish a connection with the Internet of Things server.

[0066] Furthermore, based on the above-mentioned embodiments of the invention, an IoT device access authentication method provided by an embodiment of the invention further includes:

[0067] When the access authentication result is that the device access authentication is successful, determining whether the first request message for the IoT device is a login request message;

[0068] If yes, keep the normal connection between the IoT device and the IoT server;

[0069] If not, the connection between the IoT device and the IoT server is removed, and the number of illegal logins of the IoT device is recorded.

[0070] In an embodiment of the present invention, in order to further enhance the access security of the Internet of Things device, after the device establishes a connection with the Internet of Things server, it is necessary to verify whether the first request message of the device is a login request message. If so, the normal connection between the Internet of Things device and the Internet of Things server is maintained; if not, the device is considered to be an illegal device, and the connection between the device and the Internet of Things server is immediately removed, and the number of illegal logins of the device is recorded.

[0071] Furthermore, based on the above-mentioned embodiments of the invention, an IoT device access authentication method provided by an embodiment of the invention further includes:

[0072] When the number of illegal logins exceeds a preset threshold, the device IP address of the IoT device is added to a preset device blacklist.

[0073] Among them, the preset number threshold can be understood as the maximum number of times the IoT device can retry an illegal login request, and it can be configured according to actual application requirements. For example, the preset number threshold can be 10 times.

[0074] In an embodiment of the present invention, when it is detected that the number of illegal logins of an IoT device exceeds a preset threshold, the device IP address of the device is recorded in a preset device blacklist, prohibiting all subsequent device access authentication requests of the device, thereby further enhancing the security authentication mechanism.

[0075] The technical solution of the embodiment of the present invention performs IP blacklist verification, device serial number + device authentication code + device MAC address verification on the Internet of Things device through a cloud security authentication service, and uses multiple verification rules to prevent unlawful attackers from maliciously simulating device access requests; when the device accesses, a fixed password is not used, but connection pool information is obtained from the cloud service. The connection pool information is safe and reliable, and password leakage can be prevented, thereby effectively improving the security authentication of the Internet of Things device access and ensuring the security and reliability of data transmission between the Internet of Things device and the Internet of Things server.

[0076] Embodiment 3

[0077] Figure 3 This is a flowchart of an Internet of Things device access authentication method provided in the third embodiment of the present invention. This embodiment is applicable to the case where an Internet of Things device accesses an Internet of Things server for security authentication. The method can be executed by an Internet of Things device access authentication device. The Internet of Things device access authentication device can be implemented in the form of hardware and / or software. The Internet of Things device access authentication device can be configured in an electronic device. Figure 3 As shown, the third embodiment provides an IoT device access authentication method, which is applied to a cloud gateway service and specifically includes the following steps:

[0078] S310: Perform legitimacy authentication on the IoT device according to the connection pool information acquisition request of the device gateway service.

[0079] Among them, when the IoT device (client) applies to access the IoT server, that is, when the device gateway service associated with the device receives the device's online login message, it will send a connection pool information acquisition request to the cloud gateway service, so that the cloud gateway service can respond to the connection pool information acquisition request and perform preliminary authentication on the legitimacy of the device.

[0080] Further, based on the above-mentioned embodiment of the invention, S310 specifically includes the following steps:

[0081] S3101, receiving a connection pool information acquisition request sent by a device gateway service, and acquiring device registration information and a device IP address of an IoT device; wherein the connection pool information acquisition request adopts an HTTP POST request method;

[0082] S3102, verifying the device IP address according to the preset device blacklist;

[0083] S3103. After the device IP address is verified, the device serial number, device authentication code, device name, device type, device code and device MAC address in the connection pool information acquisition request are verified according to the target device serial number, target device authentication code and target device identifier in the device registration information. After the device serial number, device authentication code, device name, device type, device code and device MAC address are all authenticated, it is determined that the IoT device has passed the legitimacy authentication. Among them, the target device identifier is pre-concatenated from the device name, device type, device code and device MAC address corresponding to the IoT device.

[0084] In an embodiment of the present invention, when an IoT device applies to access an IoT server, the cloud gateway service can receive a connection pool information acquisition request sent by the device gateway service, and simultaneously obtain the device registration information and device IP address corresponding to the device; then the device IP address is verified using a preset device blacklist, and if the IP address verification is successful, the acquired connection pool information acquisition request is parsed, and the device serial number, device authentication code, device name, device type, device code and device MAC address corresponding to the IoT device are extracted, and the target device serial number, target device authentication code and target device identifier in the device registration information are used to verify the above information, and if all the above information is verified, it is determined that the device has passed the legitimacy authentication; conversely, if at least one of the above information is not verified, the device connection will be directly rejected, that is, there is no need to execute the subsequent device access request authentication process.

[0085] S320: After the IoT device passes the legitimacy authentication, a connection pool information acquisition request is sent to the cloud security authentication service.

[0086] In an embodiment of the present invention, after the cloud gateway service determines that the legitimacy authentication of the IoT device has passed, that is, the device has passed the preliminary authentication, it can send a connection pool information acquisition request to the cloud security authentication service. Subsequently, the cloud security authentication service will perform multiple rule access security authentication on the device to ensure the legitimacy and security of the device access.

[0087] S330, obtaining the connection pool information sent by the cloud security authentication service after the IoT device passes the legitimacy authentication, and sending the connection pool information to the device gateway service.

[0088] In an embodiment of the present invention, after the cloud security authentication service performs multiple rule access security authentication on the IoT device and determines that the device has passed the legitimacy authentication, the cloud gateway service can return the connection pool information sent by the cloud security authentication service to the device gateway service, and the device gateway service will subsequently establish a connection request with the IoT server based on the connection pool information.

[0089] The technical solution of the embodiment of the present invention is applied to the cloud gateway service, and the Internet of Things device is authenticated for legitimacy by obtaining the connection pool information request according to the device gateway service; after the Internet of Things device passes the legitimacy authentication, the connection pool information acquisition request is sent to the cloud security authentication service; the connection pool information sent by the cloud security authentication service after the Internet of Things device passes the legitimacy authentication is obtained, and the connection pool information is sent to the device gateway service. This embodiment performs preliminary verification of the Internet of Things device through the cloud gateway service to verify its legitimacy, does not perform specific device access services, is decoupled from the cloud security authentication service, and realizes double verification, which greatly improves the throughput of device access and improves the efficiency of device access authentication.

[0090] Embodiment 4

[0091] Figure 4 This is a flow chart of an Internet of Things device access authentication method provided by Embodiment 4 of the present invention. Figure 4 As shown in the figure, the IoT device access authentication method takes the IoT device access to the EMQX server as an example, and mainly includes the following key points:

[0092] 1. When an IoT device is connected to the EMQX server, it needs to call the cloud gateway service to obtain the connection pool information. The connection pool information can be pre-bound to the device ID (ClientId) of the IoT device and stored in the Redis database. Only devices that have passed the specified rule verification, i.e., the legality authentication, can obtain the connection pool information.

[0093] 2. The connection pool information acquisition request sent by the IoT device when applying for access to the EMQX server adopts the HTTP POST request method, and the connection pool information acquisition request carries the device MAC address, device serial SN number, device type, device number and device authentication code associated with the IoT device; among them, the device authentication code is generated based on the salt value and device code and uses the SHA256 encryption algorithm. The device code needs to call the database to verify whether it exists to prevent the device request interface from being leaked and causing malicious attacks by others.

[0094] 3. The cloud gateway service and cloud security authentication service are decoupled to achieve double verification. The cloud gateway service does not perform device access services, but only performs preliminary verification of devices, such as device identification (ClientId) rule verification, device access request rule verification, and device IP blacklist verification, which greatly improves the throughput of device access. The cloud security authentication service is used to perform multiple rule access security authentication on IoT devices, and does not expose the interface to the outside world, with high security and reliability.

[0095] 4. Both the cloud gateway service and cloud security authentication service are designed with IP blacklist strategies. Devices in the IP blacklist are prohibited from connecting to prevent malicious IP attacks.

[0096] 5. The username and password for IoT devices to access the EMQX server are randomly generated and stored in Redis. At the same time, Redis sets an expiration time to prevent illegal attackers from using existing usernames and passwords to maliciously attack the IoT server due to the leakage of usernames and passwords.

[0097] 6. The EMQX server is configured with a hook function, which calls back the cloud authentication service (interface) to perform device security access authentication when the device is connected. Only when the device passes the authentication can it connect to the EMQX server.

[0098] 7. All EMQX protocol messages use the protobuf protocol to prevent request message leakage.

[0099] 8. After the device is connected to the EMQX server, it is necessary to verify whether the first request message of the device is a login request message, and the login request message needs to be a protobuf login protocol formulated according to the specified rules. If it is not a login request message, the device is considered to be an illegal device, and the connection between the device and the IoT server is immediately removed, and the number of illegal logins of the device is recorded; at the same time, if the device retries the above error operation multiple times, the device (client) IP is added to the IP blacklist.

[0100] 9. After the device logs in to the EMQX server, all message parsing uses JWT TOKEN for security authentication. Specifically, after the device is verified, the EMQX server will send a token value to the client; the client stores the token and carries this token value in each request; the EMQX server verifies the token value and returns the corresponding data.

[0101] The technical solution of the embodiment of the present invention has at least the following beneficial effects:

[0102] 1. When IoT devices are connected, fixed passwords are not used. Instead, the client's connection pool information is obtained from the cloud service. The connection pool information is safe and reliable, and can prevent password leakage.

[0103] 2. IoT devices are pre-registered in the cloud. When the device is connected to the EMQX server, the ClientId is verified according to multiple rules of device name-device type-device code-device MAC address-device SN number to prevent others from maliciously simulating requests.

[0104] 3. Illegal device IPs will be added to the blacklist design to prevent random malicious attacks from illegal device client IPs.

[0105] 4. The device access request interface, namely the cloud gateway service, uses SHA256 to encrypt the device code to prevent interface leakage from leading to client connection pool information leakage.

[0106] 5. The cloud gateway service and cloud security authentication service are decoupled. The cloud gateway service only provides rules and IP blacklist verification to prevent malicious attacks and improve throughput. The cloud security authentication service provides a security authentication backup service and does not expose the interface to the outside world, further improving the security and reliability of device access.

[0107] 6. All EMQX messages are formulated using the protobuf protocol, and message encryption and decryption rules are set, as well as Token security authentication, which prevents both protocol leakage and security issues caused by message leakage.

[0108] 7. When a device is connected, the first request must be a login request, otherwise it will be considered a malicious request and the connection will be rejected. When the number of illegal logins of the device exceeds the preset threshold, the device (client) IP will be added to the IP blacklist to further enhance the security authentication mechanism.

[0109] Embodiment 5

[0110] Figure 5 This is a schematic diagram of the structure of an Internet of Things device access authentication device provided by Embodiment 5 of the present invention. Figure 5 As shown, the device is applied to cloud security authentication services, including:

[0111] The device legitimacy authentication module 41 is used to authenticate the legitimacy of the IoT device according to the connection pool information acquisition request of the cloud gateway service;

[0112] The connection pool information sending module 42 is used to save the username and password randomly assigned to the IoT device to a preset database after the IoT device passes the legitimacy authentication, and send the connection pool information associated with the IoT device in the preset database to the cloud gateway service;

[0113] The access authentication module 43 is used to respond to the hook function triggering operation of the Internet of Things server, verify the password according to the target password corresponding to the user name in the preset database, and obtain the access authentication result of the Internet of Things device.

[0114] The technical solution of the embodiment of the present invention is applied to the cloud security authentication service. The device legitimacy authentication module obtains the connection pool information of the cloud gateway service and performs legitimacy authentication on the IoT device; after the legitimacy authentication of the IoT device is passed, the connection pool information sending module saves the randomly assigned user name and password to the preset database, and sends the connection pool information associated with the IoT device in the preset database to the cloud gateway service; the access authentication module responds to the hook function trigger operation of the IoT server, verifies the password according to the target password corresponding to the user name in the preset database, and obtains the access authentication result of the IoT device. This embodiment uses the cloud security authentication service to authenticate the legitimacy of the IoT device, and then uses the randomly generated user name and password and obtains the connection pool information associated with the IoT device, thereby avoiding the leakage of the user name and password, preventing malicious attacks by unlawful attackers, and effectively improving the security authentication of the access to the IoT device.

[0115] Further, based on the above-mentioned embodiment of the invention, the device legitimacy authentication module 41 includes:

[0116] A request receiving unit, used to receive a connection pool information acquisition request sent by a cloud gateway service; wherein the connection pool information acquisition request adopts an HTTP POST request method;

[0117] An IP verification unit is used to obtain a device IP address corresponding to an IoT device and verify the device IP address according to a preset device blacklist;

[0118] A registration information acquisition unit, used to obtain device registration information of the IoT device after the device IP address is verified;

[0119] The legitimacy authentication unit is used to verify the device serial number, device authentication code and device MAC address in the connection pool information acquisition request according to the target device serial number, target device authentication code and target device MAC address in the device registration information, and determine that the legitimacy authentication of the Internet of Things device has passed after the device serial number, device authentication code and device MAC address are all verified.

[0120] Further, based on the above-mentioned embodiment of the invention, the connection pool information sending module 42 includes:

[0121] A user name and password random generation unit is used to randomly generate a unique user name and password for the IoT device after the IoT device passes the legitimacy authentication, and store the user name and password in a preset database in association;

[0122] The connection pool information acquisition and development unit is used to obtain the corresponding connection pool information in the preset database according to the device identification of the Internet of Things device, and send the connection pool information to the cloud gateway service.

[0123] Further, based on the above-mentioned embodiment of the invention, the access authentication module 43 includes:

[0124] A target password search unit, configured to respond to a hook function trigger operation of the IoT server and search for a corresponding target password in a preset database according to the user name;

[0125] A password matching unit, used to determine whether the target password and the randomly assigned password are consistent;

[0126] The access authentication result determining unit is used to determine the access authentication result as a successful device access authentication if yes; and to determine the access authentication result as a failed device access authentication if no.

[0127] Furthermore, based on the above-mentioned embodiment of the invention, the IoT device access authentication device further includes:

[0128] A message verification module, used to determine whether the first request message for the IoT device is a login request message when the access authentication result is that the device access authentication is successful;

[0129] A first device processing module, configured to maintain a normal connection between the IoT device and the IoT server if yes;

[0130] The second device processing module is used to, if not, remove the connection between the IoT device and the IoT server and record the number of illegal logins of the IoT device.

[0131] Further, based on the above-mentioned embodiment of the invention, when the number of illegal logins exceeds a preset threshold, the device IP address of the Internet of Things device is added to a preset device blacklist.

[0132] The Internet of Things device access authentication device provided in the embodiment of the present invention can execute the Internet of Things device access authentication method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0133] Embodiment 6

[0134] Figure 6 This is a schematic diagram of the structure of an Internet of Things device access authentication device provided by Embodiment 6 of the present invention. Figure 6As shown, the device is applied to cloud gateway services and includes:

[0135] The device legitimacy authentication module 51 is used to authenticate the legitimacy of the IoT device according to the connection pool information acquisition request of the device gateway service;

[0136] The request sending module 52 is used to send a connection pool information acquisition request to the cloud security authentication service after the IoT device passes the legitimacy authentication;

[0137] The connection pool information sending module 53 is used to obtain the connection pool information sent by the cloud security authentication service after the IoT device passes the legitimacy authentication, and send the connection pool information to the device gateway service.

[0138] The technical solution of the embodiment of the present invention is applied to the cloud gateway service, and the device legitimacy authentication module obtains the connection pool information request of the device gateway service to authenticate the legitimacy of the Internet of Things device; after the legitimacy authentication of the Internet of Things device is passed, the connection pool information acquisition request is sent to the cloud security authentication service through the request sending module; the connection pool information sent by the cloud security authentication service after the Internet of Things device passes the legitimacy authentication is obtained through the connection pool information sending module, and the connection pool information is sent to the device gateway service. This embodiment performs preliminary verification of the Internet of Things device through the cloud gateway service to verify its legitimacy, does not perform specific device access services, is decoupled from the cloud security authentication service, and realizes double verification, which greatly improves the throughput of device access and improves the efficiency of device access authentication.

[0139] Further, based on the above-mentioned embodiment of the invention, the device legitimacy authentication module 51 includes:

[0140] A request receiving and information obtaining unit, used to receive a connection pool information obtaining request sent by a device gateway service, and obtain device registration information and device IP address of an IoT device; wherein the connection pool information obtaining request adopts an HTTP POST request method;

[0141] IP verification unit, used to verify the device IP address according to the preset device blacklist;

[0142] The legitimacy authentication unit is used to verify the device serial number, device authentication code, device name, device type, device code and device MAC address in the connection pool information acquisition request according to the target device serial number, target device authentication code and target device identifier in the device registration information after the device IP address is verified, and determine that the legitimacy authentication of the Internet of Things device has passed after the device serial number, device authentication code, device name, device type, device code and device MAC address are all authenticated; wherein, the target device identifier is pre-concatenated from the device name, device type, device code and device MAC address corresponding to the Internet of Things device.

[0143] The Internet of Things device access authentication device provided in the embodiment of the present invention can execute the Internet of Things device access authentication method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0144] Embodiment 7

[0145] Figure 7 A schematic diagram of the structure of an electronic device 60 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0146] like Figure 7 As shown, the electronic device 60 includes at least one processor 61, and a memory connected to the at least one processor 61, such as a read-only memory (ROM) 62, a random access memory (RAM) 63, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 61 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 62 or the computer program loaded from the storage unit 68 to the random access memory (RAM) 63. In the RAM 63, various programs and data required for the operation of the electronic device 60 can also be stored. The processor 61, the ROM 62, and the RAM 63 are connected to each other via a bus 64. An input / output (I / O) interface 65 is also connected to the bus 64.

[0147] A number of components in the electronic device 60 are connected to the I / O interface 65, including: an input unit 66, such as a keyboard, a mouse, etc.; an output unit 67, such as various types of displays, speakers, etc.; a storage unit 68, such as a disk, an optical disk, etc.; and a communication unit 69, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 69 allows the electronic device 60 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0148] The processor 61 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 61 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 61 executes the various methods and processes described above, such as the IoT device access authentication method.

[0149] In some embodiments, the IoT device access authentication method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 68. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 60 via the ROM 62 and / or the communication unit 69. When the computer program is loaded into the RAM 63 and executed by the processor 61, one or more steps of the IoT device access authentication method described above may be performed. Alternatively, in other embodiments, the processor 61 may be configured to execute the IoT device access authentication method in any other appropriate manner (e.g., by means of firmware).

[0150] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0151] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0152] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0153] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0154] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0155] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0156] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0157] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for authenticating access to an Internet of Things device, characterized in that: Applied to cloud security authentication services, the method includes: According to the connection pool information acquisition request of the cloud gateway service, the legitimacy of the IoT device is authenticated; After the IoT device passes the legitimacy authentication, the username and password randomly assigned to the IoT device are saved in a preset database, and the connection pool information associated with the IoT device in the preset database is sent to the cloud gateway service; In response to the hook function triggering operation of the Internet of Things server, the password is verified according to the target password corresponding to the user name in the preset database to obtain the access authentication result of the Internet of Things device.

2. The method according to claim 1, characterized in that: The obtaining request for connection pool information of the cloud gateway service and authenticating the legitimacy of the IoT device include: Receive the connection pool information acquisition request sent by the cloud gateway service; wherein the connection pool information acquisition request adopts HTTP POST request mode; Obtain the device IP address corresponding to the IoT device, and verify the device IP address according to a preset device blacklist; After the IP address of the device is verified, obtaining the device registration information of the IoT device; According to the target device serial number, target device authentication code and target device MAC address in the device registration information, the device serial number, device authentication code and device MAC address in the connection pool information acquisition request are verified respectively, and after the device serial number, the device authentication code and the device MAC address are all verified, it is determined that the legitimacy authentication of the Internet of Things device has passed.

3. The method according to claim 1, characterized in that After the IoT device passes the legitimacy authentication, the username and password randomly assigned to the IoT device are saved in a preset database, and the connection pool information associated with the IoT device in the preset database is sent to the cloud gateway service, including: After the Internet of Things device passes the legitimacy authentication, a set of unique user names and passwords is randomly generated for the Internet of Things device, and the user names and passwords are associated and stored in the preset database; According to the device identification of the Internet of Things device, the corresponding associated connection pool information is obtained in the preset database, and the connection pool information is sent to the cloud gateway service.

4. The method according to claim 1, characterized in that: The step of responding to the triggering operation of the hook function of the IoT server, verifying the password according to the target password corresponding to the user name in the preset database, and obtaining the access authentication result of the IoT device includes: In response to the hook function triggering operation of the Internet of Things server, searching the corresponding associated target password in the preset database according to the user name; Determining whether the target password and the randomly assigned password are consistent; If so, the access authentication result is determined as a successful device access authentication; if not, the access authentication result is determined as a failed device access authentication.

5. The method according to claim 1, characterized in that Also includes: When the access authentication result is that the device access authentication is successful, determining whether the first request message for the Internet of Things device is a login request message; If yes, maintain the normal connection between the IoT device and the IoT server; If not, the connection between the IoT device and the IoT server is removed, and the number of illegal logins of the IoT device is recorded.

6. The method according to claim 5, characterized in that Also includes: When the number of illegal logins exceeds a preset threshold, the device IP address of the IoT device is added to a preset device blacklist.

7. A method for authenticating access to an Internet of Things device, characterized in that: Applied to cloud gateway services, the method includes: According to the connection pool information acquisition request of the device gateway service, the legitimacy of the IoT device is authenticated; After the IoT device passes the legitimacy authentication, the connection pool information acquisition request is sent to the cloud security authentication service; The connection pool information sent by the cloud security authentication service after the IoT device passes the legitimacy authentication is obtained, and the connection pool information is sent to the device gateway service.

8. The method according to claim 7, characterized in that The obtaining request for the connection pool information of the device gateway service and authenticating the legitimacy of the IoT device include: Receive the connection pool information acquisition request sent by the device gateway service, and obtain the device registration information and device IP address of the IoT device; wherein the connection pool information acquisition request adopts an HTTP POST request method; Verify the IP address of the device according to a preset device blacklist; After the device IP address is verified, the device serial number, device authentication code, device name, device type, device code and device MAC address in the connection pool information acquisition request are verified according to the target device serial number, target device authentication code and target device identifier in the device registration information, and after the device serial number, the device authentication code, the device name, the device type, the device code and the device MAC address are all authenticated, it is determined that the legitimacy authentication of the Internet of Things device has passed; wherein the target device identifier is pre-obtained by concatenating the device name, device type, device code and device MAC address corresponding to the Internet of Things device.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the Internet of Things device access authentication method described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the Internet of Things device access authentication method described in any one of claims 1 to 8 when executed.

Images