A method and system for smart home security identification based on SM algorithm

Abstract

The present invention relates to the field of smart home security, and provides a method and system for smart home security identification based on an SM algorithm. The method for smart home security identification based on an SM algorithm comprises: a management terminal encrypts a communication instruction to obtain communication instruction encrypted data, generates a signature of the communication instruction using an SM algorithm, and uploads the signature and communication instruction encrypted data to a server; the server decrypts the communication instruction encrypted data to obtain a communication instruction; performs signature verification on the communication instruction, decrypts the communication instruction after successful verification, reorganizes the communication instruction structure based on the identity information of the smart terminal, and re-encrypts the reorganized communication instruction using the communication key of the smart terminal, re-signs the encrypted communication instruction using the server key, and sends the communication instruction to the smart terminal for execution. The present invention realizes that the identity of the smart home environment is credible, the instruction is credible, and the behavior cannot be counterfeited, thereby protecting user privacy.

Description

Technical Field

[0001] The present invention relates to the field of smart home security, and in particular to a method and system for smart home security identification based on an SM algorithm. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the development of science and technology, the Internet of Things technology has developed rapidly. The Internet of Things is invading people's lives in a variety of "smart +" forms. Users can control lights, air conditioners and even cars through mobile phones, providing people with a more convenient and comfortable smart home living environment. However, while smart home devices bring convenience, they also face severe security challenges.

[0004] The information structure of smart terminals in smart homes in our daily life usually includes: terminal name, terminal identification, terminal location, terminal sample image, registration time, other information, etc.; the instruction structure of smart terminals usually includes: terminal identification, instruction information, instruction personnel, execution time, instruction time, other information, etc. Due to the simplicity of the above information structure, it is easy to copy, easy to counterfeit, and cannot be accurately identified, which leads to the illegal operation of smart devices (for example, it is possible to impersonate the owner to control the smart car to open the windows and doors, illegally access smart monitoring to obtain private data, and even illegally control the monitoring to shoot home information, etc.), illegal acquisition of private information and other problems, resulting in countless private life information leaks, and smart home devices are illegally controlled and property is lost. Summary of the invention

[0005] The present invention provides a method and system for smart home security identification based on the SM algorithm. The present invention aims to solve the problems of secure identification of smart home devices, prevention of instruction forgery, and security protection of privacy data without excessively increasing the complexity of existing loads, so as to achieve identity trust, instruction trust, and non-counterfeitable behavior in the smart home environment, so as to protect user privacy and enjoy smart home services conveniently and reliably.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] The first aspect of the present invention provides a method for smart home security identification based on SM algorithm.

[0008] A method for smart home security identification based on SM algorithm, comprising:

[0009] The management terminal encrypts the communication instruction to obtain the communication instruction encrypted data, generates a signature of the communication instruction using the SM algorithm, and uploads the signature and the communication instruction encrypted data to the server;

[0010] The server decrypts the communication instruction encrypted data to obtain the communication instruction; performs signature verification on the communication instruction, decrypts the communication instruction after successful verification, reorganizes the communication instruction structure according to the identity information of the smart terminal, and re-encrypts the reorganized communication instruction using the communication key of the smart terminal, re-signs the encrypted communication instruction using the server key, and sends the communication instruction to the smart terminal for execution;

[0011] Among them, the management terminal encrypts the communication instruction to obtain the process of encrypted communication instruction data, which includes: the management terminal selects the smart terminal that needs to execute the instruction and the instruction that needs to be executed, and reconstructs the encrypted communication instruction data according to the identity information of the smart terminal; the server generates a one-time first temporary communication key, encrypts the communication instruction, and obtains the first instruction ciphertext data; uses the business key of the home where the smart terminal is located to encrypt the one-time first temporary communication key to obtain the first key ciphertext data; signs the first instruction ciphertext data and the first key ciphertext data using the identity of the management terminal to obtain the ciphertext data signature, and uploads the first instruction ciphertext data, the first key ciphertext data and the ciphertext data signature to the server; the communication instruction encrypted data includes the first instruction ciphertext data, the first key ciphertext data and the ciphertext signature data.

[0012] Furthermore, the server decrypts the communication instruction encrypted data to obtain the communication instruction, and the process includes: the server uses the business key to decrypt the first key ciphertext data, and after the decryption is successful, uses the decrypted first key ciphertext data to decrypt the first instruction ciphertext data to obtain the real communication instruction.

[0013] Furthermore, the process of signature verification of the communication instruction includes: obtaining the key identification of the management terminal according to the information of the management terminal, verifying the signature data. If the verification fails, it means that the instruction has been tampered with or replaced and will not be executed. If the verification passes, it means that the instruction is a legitimate instruction initiated by the management terminal.

[0014] Furthermore, the process of sending the communication instruction to the smart terminal for execution includes: reorganizing the instruction information structure data according to the communication instruction smart terminal; generating a one-time second temporary communication key according to the business key, and using the second temporary communication key to encrypt the sent instruction information structure data to obtain second instruction ciphertext data; using the public key of the smart terminal to encrypt the second temporary communication key to obtain second key ciphertext data; signing the second instruction ciphertext data and the second key ciphertext data using the server-side identity information to obtain the signature data of the communication data, and sending the second instruction ciphertext data, the second key ciphertext data and the signature data to the smart terminal.

[0015] Furthermore, the intelligent terminal uses the key public key to decrypt the second key ciphertext data to obtain the instruction data header information. After the decryption is successful, the decrypted second key ciphertext data is used to decrypt the second instruction ciphertext data to obtain the sending instruction information structure data; and the legality is verified. After the verification is successful, the instruction is executed.

[0016] Furthermore, the process of verifying the legitimacy includes: using the business key to verify the signature of the sent instruction information structure data. If the verification fails, it means that the instruction has been tampered with or replaced and will not be executed; if the verification passes, it means that the instruction is a legal instruction; according to the instruction identification information structure rules, verify whether the sent instruction information structure data is consistent. If it is inconsistent, it is an illegal instruction, and if it is consistent, it is a legal instruction; the smart terminal executes the legal instruction.

[0017] Furthermore, before the management terminal uploads data, it also includes: according to the device information of the smart terminal, using the SM algorithm to obtain the unique identification of the smart home device, and using the master key of the server to generate the corresponding business private key; according to the unique identification of the management terminal, using the business key to generate the management terminal private key; using the business key to generate a one-time third temporary key, using the one-time third temporary key to encrypt the private key and business public key of the management terminal to obtain the private key ciphertext of the management terminal, and sending the private key ciphertext to the server to wait for decryption; the server sends a random data key via offline SMS to decrypt the private key and business public key of the management terminal, and the registration of the management terminal is completed.

[0018] Furthermore, before the management terminal uploads data, it also includes: the management terminal enters the smart terminal information that needs to be registered, and the server reconstructs the smart terminal device information according to the smart terminal device identification information structure; reconstructs the terminal device identification according to the reconstructed terminal identity identification information, and generates a unique identification code for the smart terminal; uses the business key according to the unique identification code of the smart terminal to obtain the identity private key of the smart terminal; and sends the private key ciphertext to the server for decryption; the server sends a random data key via offline SMS, inputs the received random data key in the smart terminal, decrypts the private key and business public key of the smart terminal, and completes the registration of the smart terminal.

[0019] Furthermore, the structure of the communication instruction encrypted data includes: an initiating instruction information structure and a sending instruction information structure, the initiating instruction information structure includes: an instruction identification ID, instruction information, an instruction source and custom data; the sending instruction information structure includes: an instruction identification, instruction information, an instruction time, an execution time and other information.

[0020] The second aspect of the present invention provides a smart home security identification system based on the SM algorithm.

[0021] A smart home security identification system based on the SM algorithm of the method described in the first aspect, comprising:

[0022] The first transmission module is configured to: the management terminal encrypts the communication instruction to obtain the communication instruction encrypted data, generates a signature of the communication instruction using the SM algorithm, and uploads the signature and the communication instruction encrypted data to the server;

[0023] The second transmission module is configured as follows: the server decrypts the communication instruction encrypted data to obtain the communication instruction; performs signature verification on the communication instruction, decrypts the communication instruction after successful verification, reorganizes the communication instruction structure according to the smart terminal identity information, and re-encrypts the reorganized communication instruction using the smart terminal communication key, re-signs the encrypted communication instruction using the server key, and sends the communication instruction to the smart terminal for execution;

[0024] Among them, the management terminal encrypts the communication instruction to obtain the process of encrypted communication instruction data, which includes: the management terminal selects the smart terminal that needs to execute the instruction and the instruction that needs to be executed, and reconstructs the encrypted communication instruction data according to the identity information of the smart terminal; the server generates a one-time first temporary communication key, encrypts the communication instruction, and obtains the first instruction ciphertext data; uses the business key of the home where the smart terminal is located to encrypt the one-time first temporary communication key to obtain the first key ciphertext data; signs the first instruction ciphertext data and the first key ciphertext data using the identity of the management terminal to obtain the ciphertext data signature, and uploads the first instruction ciphertext data, the first key ciphertext data and the ciphertext data signature to the server; the communication instruction encrypted data includes the first instruction ciphertext data, the first key ciphertext data and the ciphertext signature data.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] The present invention adopts a two-stage encryption method, that is, in the first stage, the management terminal encrypts the instructions to be executed and uploads them to the server after encryption; in the second stage, the server encrypts the instructions of the management terminal and sends them to the smart terminal for execution after encryption; through the two-stage encryption process, the anti-theft capability of the instructions is improved, and the instruction data security of the smart home environment is achieved, so as to achieve the purpose of protecting user privacy and the security of smart terminal instruction services.

[0027] The present invention adopts a two-stage signature method, that is, in the first stage, the management terminal signs the instructions to be executed and uploads them to the server after signing, and in the second stage, the server signs the instructions of the management terminal and sends them to the smart terminal for execution after signing; through the two-stage signing process, the tamper-proofness of the instructions is improved, and the identity of the smart home environment is credible, the instructions are credible, and the behavior cannot be counterfeited, so as to achieve the purpose of enjoying smart home services conveniently and reliably.

[0028] The present invention adopts an encryption method of a lightweight SM identity identification algorithm, that is, the first stage manages the terminal identity identification, the second stage, the server identity identification, and the third stage the identity identification of the smart terminal, which increases the security of instruction data in the communication process and the trustworthiness of instructions, the trustworthiness of identities, and the security of non-counterfeiting, and only adds a little bit of lightweight calculation without adding too much burden to the overall smart service process; that is, it improves the security and trustworthiness of smart home services without affecting the convenience and trustworthiness of smart home services; and provides a broad space for the promotion of convenient, trustworthy, and safe smart home services. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0030] Figure 1 It is a schematic diagram of the structure of smart home identity information based on the SM algorithm shown in the present invention;

[0031] Figure 2 It is a schematic diagram of the structure of smart home instruction identification information based on the SM algorithm shown in the present invention;

[0032] Figure 3 is a schematic diagram of a unique identifier of a reconstruction server shown in the present invention;

[0033] Figure 4 It is a flow chart of management terminal information registration shown in the present invention;

[0034] Figure 5 is a smart home device registration flow chart shown in the present invention;

[0035] Figure 6 It is a flow chart of communication security instruction sending authentication shown in the present invention. DETAILED DESCRIPTION

[0036] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0037] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0038] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0039] It should be noted that the flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the methods and systems according to various embodiments of the present disclosure. It should be noted that each box in the flowchart or block diagram can represent a module, a program segment, or a part of a code, and the module, program segment, or a part of a code may include one or more executable instructions for implementing the logical functions specified in each embodiment. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, or they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the flowchart and / or block diagram, and the combination of boxes in the flowchart and / or block diagram can be implemented using a dedicated hardware-based system that performs a specified function or operation, or can be implemented using a combination of dedicated hardware and computer instructions.

[0040] Embodiment 1

[0041] This embodiment provides a method for smart home security identification based on the SM algorithm, including:

[0042] The management terminal encrypts the communication instruction to obtain the communication instruction encrypted data, generates a signature of the communication instruction using the SM algorithm, and uploads the signature and the communication instruction encrypted data to the server;

[0043] The server decrypts the communication instruction encrypted data to obtain the communication instruction; performs signature verification on the communication instruction, decrypts the communication instruction after successful verification, reorganizes the communication instruction structure according to the identity information of the smart terminal, and re-encrypts the reorganized communication instruction using the communication key of the smart terminal, re-signs the encrypted communication instruction using the server key, and sends the communication instruction to the smart terminal for execution;

[0044] Among them, the management terminal encrypts the communication instruction to obtain the process of encrypted communication instruction data, which includes: the management terminal selects the smart terminal that needs to execute the instruction and the instruction that needs to be executed, and reconstructs the encrypted communication instruction data according to the identity information of the smart terminal; the server generates a one-time first temporary communication key, encrypts the communication instruction, and obtains the first instruction ciphertext data; uses the business key of the home where the smart terminal is located to encrypt the one-time first temporary communication key to obtain the first key ciphertext data; signs the first instruction ciphertext data and the first key ciphertext data using the identity of the management terminal to obtain the ciphertext data signature, and uploads the first instruction ciphertext data, the first key ciphertext data and the ciphertext data signature to the server; the communication instruction encrypted data includes the first instruction ciphertext data, the first key ciphertext data and the ciphertext signature data.

[0045] The present embodiment is described in detail below:

[0046] Among them, the reconstruction of the terminal identity identification information structure, the terminal command identification information structure and the privacy data information structure is as follows:

[0047] (1) Terminal identity information structure

[0048] The structure of the smart terminal identity information is defined as: Identifying identity information --IDInfo.

[0049] like Figure 1 As shown, the logical structure of the smart terminal identity information data is device identification information and signature information.

[0050] The device identification information is defined as:

[0051] IDInfo::=SEQUENCE{

[0052] IDInfoidInfo--Identification information

[0053] signDataUTF8String--Identification signature information

[0054] }

[0055] The terminal identity information includes: identification ID, attribute information, image information and custom data.

[0056] The identification information is defined as:

[0057] IDInfo::=SEQUENCE{

[0058] dvIDUTF8String,--Unique code for identification data

[0059] propertyPropertyInfo,--Device property information

[0060] picturePictureInfo,--Picture attribute information

[0061] extDatasIA5String--Custom data

[0062] }

[0063] in:

[0064] dvID: A unique identification code that distinguishes the device identity and is used to find and index other information. It is obtained by calculating the device SN + location identifier.

[0065] Property: device attribute information, which is also the basic information of smart terminals;

[0066] picture: device picture information, which can be the default picture of the terminal or a randomly uploaded picture;

[0067] extDatas: used by manufacturers to use custom data.

[0068] (1-1) Device attribute information

[0069] The structure of device attribute information includes: type, name, device SN, location identifier, area, registration time, start time and end time.

[0070] The device attribute information is defined as:

[0071] PropertyInfo::=SEQUENCE{

[0072] typeUTF8String,--Device type

[0073] nameUTF8String,--Device name

[0074] dvsnUTF8String,--Device serial number, unique identifier

[0075] position UTF8String,--The location identifier of the device

[0076] areaUTF8String,--the area where the device is located, address, etc.

[0077] createDateUTCTIME,--Device registration time

[0078] validStartUTCTIME,--Equipment valid start time (optional)

[0079] validEndUTCTIME--Equipment valid end time (optional)

[0080] }

[0081] in:

[0082] type: represents the major category of equipment, such as mobile phones, cars, door locks, air conditioners, etc.;

[0083] name: the mnemonic name of the device, such as door lock, bedroom air conditioner, living room main light, etc.

[0084] dvsn: unique code of the device, which can be a serial number or device identification number, etc.

[0085] position: the location of the device, which can be a network IP or communication ID, etc.

[0086] area: the device's regional information, marking the device's location information;

[0087] createDate: registration time;

[0088] validStart: the start time of the validity period;

[0089] validEnd: validity expiration time.

[0090] (1-2) Image attribute information

[0091] The structure of the image attribute information includes: image type, image data, image width and height.

[0092] Image attribute information is defined as:

[0093] PictureInfo::=SEQUENCE{

[0094] typeIA5String,--Picture type

[0095] dataOCTET STRING,--image data

[0096] widthINTEGER,--image width

[0097] heightINTEGER,--image height

[0098] }

[0099] in:

[0100] type: represents the image type, such as GIF, BMP, JPG;

[0101] data: image data;

[0102] width: image display width, in millimeters (mm);

[0103] height: Image display height, in millimeters (mm).

[0104] (2) Terminal command identification information structure

[0105] The structure of the intelligent terminal command information is defined as: Command information -- CmmInfo.

[0106] like Figure 2 As shown, the logical structure of the intelligent terminal instruction information data includes instruction information and signature information.

[0107] The identification information is defined as:

[0108] CmmInfo::=SEQUENCE{

[0109] cmmInfoCmmInfo--command information

[0110] signDataUTF8String--Signature information

[0111] }

[0112] (2-1) Initiate command information structure

[0113] The logical structure of the initiated instruction information data includes: instruction identification ID, instruction information, instruction source and custom data.

[0114] The identification information is defined as:

[0115] CmmInfo::=SEQUENCE{

[0116] cmmIDIA5String,--Unique identification code of instruction data

[0117] mssInfoMssInfo,--command information

[0118] source IA5String,--instruction source information

[0119] extDatasIA5String--Custom data

[0120] }

[0121] in:

[0122] cmmID: unique identification code to distinguish commands, used to find and index other information;

[0123] mssInfo: instruction information, the specific instruction to be executed;

[0124] Source: The source of the command, the person or thing that initiated the message command;

[0125] extDatas: used for custom data used by manufacturers.

[0126] The structure of the instruction information includes: device identification ID, instruction information, instruction time, execution time and other information.

[0127] The instruction attribute information is defined as:

[0128] MssInfo::=SEQUENCE{

[0129] dvID UTF8String,--Device identification unique code,

[0130] messageIA5String,--command content

[0131] mssTimeOCTET STRING,--the time when the command was issued

[0132] runTimeOCTET STRING,--instruction execution time

[0133] …

[0134] }

[0135] in:

[0136] dvID: device unique code, calculated from the information of the smart terminal that needs to execute the command, the same as dvID in IDInfo;

[0137] message: represents the actual command content that needs to be sent;

[0138] mssTime: instruction issuance / generation time;

[0139] runTime: Instruction execution time. The time when the message instruction needs to start executing. If it is executed immediately, it is 0.

[0140] (2-2) Sending command information structure

[0141] The structure of instruction attribute information includes: instruction identification, instruction information, instruction time, execution time and other information.

[0142] The instruction attribute information is defined as:

[0143] MssInfo::=SEQUENCE{

[0144] cmmIDIA5String,--Unique identification code of instruction data

[0145] messageIA5String,--command content

[0146] mssTimeOCTET STRING,--the time when the command was issued

[0147] runTimeOCTET STRING,--instruction execution time

[0148] …

[0149] }

[0150] in:

[0151] cmmID: unique identification code to distinguish commands, used to find and index other information;

[0152] message: represents the actual command content that needs to be sent;

[0153] mssTime: instruction issuance / generation time;

[0154] runTime: Instruction execution time. The time when the message instruction needs to start executing. If it is executed immediately, it is 0.

[0155] (3) Privacy data information structure

[0156] The structure of privacy data information is defined as: Privacy information -- PriInfo.

[0157] The logical structure of private data information includes: data header information and data ciphertext information.

[0158] The identification information is defined as:

[0159] PriInfo::=SEQUENCE{

[0160] priInfoUTF8String--ciphertext data header

[0161] secDataUTF8String--ciphertext data information

[0162] }

[0163] in:

[0164] priInfo: ciphertext data of the private data encryption key;

[0165] secData: ciphertext data of private data.

[0166] The present invention completes services such as intelligent terminal information entry, terminal key generation, key distribution, instruction message authentication, and privacy data security storage through the server.

[0167] First, the server needs to complete system initialization, which mainly includes: service operating environment configuration, server master key generation, management terminal initial configuration, etc. After completing the above initialization operations, the server can enter the business service state. Once again, special attention should be paid that the server master key needs to be stored in the hardware password module, which ensures that the key cannot be illegally exported or read, ensuring the security of the system master key.

[0168] In order to ensure the security of private data on the server side, the system needs to generate the business key of the management system through the master key in the hardware cryptographic module. The business key is mainly used to encrypt and decrypt private data in the management system.

[0169] Step 1: Instead of simply using the device SN and other direct identifiers as the calculation factors of the SM9 key, reconstruct the unique identifier of the server according to the reconstruction information structure definition, through the initial configuration information and the inherent information of the device, such as Figure 3 As shown, the type (such as smart home), name (such as 3X's home), device SN, and location identifier (such as IP) defined in the device information are obtained, and a sequence is combined. After using the SM3 algorithm, 256-bit data is obtained, and the data is used as the unique identifier of 3X's home's smart home. The identifier is used to generate the corresponding SM9 business key (including business public key and business private key).

[0170] Step 2: Management terminal information access. It should be noted that there are many possibilities for management terminal access, which can be through mobile devices, desktop computers, or laptops, and each device may not be fixed. Therefore, when managing terminal access, the reconstruction of the management terminal unique identifier needs to take into account multiple possibilities. Figure 4 As shown, the reconstruction method here is to obtain the type of configuration information item as management terminal, the name as 3X, the device SN is optional depending on whether the configuration item of the current device is bound, and the location identifier is the mobile phone number. The above information is combined and calculated using the SM3 algorithm to obtain a 256-bit unique identifier. The server-side cryptographic module uses the home business key of 3X to derive the private key of the management terminal 3X based on the unique identifier.

[0171] Step 3: Manage private key distribution. Due to the importance and security of private keys, the server-side key management module calculates the private key information based on the unique identifier of the management terminal 3X, and cannot distribute it directly. This design adopts a lightweight off-service encryption distribution method. The server-side password module generates 8-bit random data as the decryption key, and uses the service key of the server-side business 3X home to derive a one-time temporary key. The one-time temporary key is used to encrypt the private key of 3X and the service public key of the server to obtain the key ciphertext of the 3X management terminal in ciphertext mode, which is transmitted to the registered device of 3X through the network and waits for decryption. The 8-bit random data key required for decryption is sent off-service by the server through the mobile phone number of the management terminal. After the 3X management terminal receives the 8-bit random data key, it is input through the management interface. The terminal decrypts the input 8-bit random data key to obtain the private key data of 3X and the service public key of the server. At this point, the key distribution is completed.

[0172] Step 4: Smart home device registration. After logging in to the management terminal, enter the smart home terminal information to be registered in the server, such as: type: smart door lock, name: home door lock, brand AA, start searching and matching through the communication protocol, and after receiving the door lock response, obtain the basic information of the door lock, such as: type: smart door lock, device SN: door lock serial number, factory logo product picture, etc.; the server reconstructs the smart terminal device information according to the terminal device identification information structure, type-smart door lock, name-home door lock, device SN-device serial number, location identification-IP, area-ABC, registration time-20240101132656, start time-20240101132656, end time-20990101132656.

[0173] The picture identification information structure is reconstructed into picture type JPG, picture data jk879***, and picture width and height 134-320.

[0174] Follow up the reconstructed terminal identity information, reconstruct the terminal device identification, combine the terminal type, name, device SN, and location identification, execute the SM3 algorithm, and obtain a 256-bit identification code, which becomes the unique identification code of the terminal 13E9F36B1EF02E15FB46AD5854794337177E66ABD7EF9928987D929E3197A73F.

[0175] The reconstructed terminal identity information is encrypted and synchronized to the terminal, and this information will serve as the basic information for valid verification of subsequent instructions.

[0176] The server password module uses the 3X home business key to derive the identity private key of the terminal device according to the unique identification code of the terminal. For the key distribution method, refer to the management terminal key distribution method to complete the key distribution.

[0177] At this point, the registration operation of the smart home terminal is completed.

[0178] Step 5: Communication instruction security identification to prevent forgery. Communication instruction transmission has two transmission stages. The first stage is that the management terminal uploads the instructions to be executed to the server; the second stage is that the server transmits the instructions of the management terminal to the corresponding intelligent terminal for execution. The present invention will decrypt the instructions to be executed based on the reconstructed terminal identity information, effectively identify them, and prevent forgery. The specific identification process is as follows:

[0179] (a) Log in to the server through the management terminal, select the smart terminal door lock that needs to execute the command, and execute the unlock command; Figure 5 , Figure 6 As shown:

[0180] (b) The management terminal reorganizes the instruction identification structure according to the terminal identity information. The instruction identification structure includes: device identification (256-bit identification code), instruction information (open door), instruction time (20240102123330), execution time (0-immediate execution) and other information.

[0181] Generate a 256-bit identification code cmmID for this instruction based on the terminal reconstruction information.

[0182] At this time, the terminal instruction information of management terminal A has been fully formed, but no actual real directional information is presented in the terminal information, which ensures the privacy of the instruction execution terminal. In addition, in order to ensure the security of the instruction transmission process and prevent tampering, before transmitting the instruction, the above-mentioned reconstructed instruction information needs to be signed using the SM9 key of the management terminal to generate the signature data of the instruction. Finally, the reconstructed terminal instruction identification information structure according to the present invention is: instruction identification (256-bit identification), instruction information, instruction source (management terminal A), signature information (management terminal signature), device identification (256-bit identification), instruction information (open door), instruction time (20240102123330), execution time (0-immediate execution) and other information.

[0183] For the confidentiality and integrity of command transmission, the present invention needs to perform secondary encapsulation on the transmission command in the smart home. The smart terminal generates a one-time temporary communication key, uses the temporary key to encrypt the reconstructed terminal command identification information structure data, obtains the command ciphertext data, uses the 3X home business key public key to encrypt the one-time temporary communication key, obtains the communication key ciphertext data, and the data combination structure includes: data header information-key ciphertext data, data ciphertext information-command ciphertext data.

[0184] (c) The server receives instructions from management terminal A and performs security identification.

[0185] The command data of the above-mentioned management terminal A is transmitted to the server. After receiving the above-mentioned command, the management system first uses 3X's business key to decrypt the command data header information. If the decryption fails, the command is regarded as illegal data such as tampered with or counterfeited; if the data header information is successfully decrypted, the communication key for this time is obtained; then check whether the communication key information has been used. The used communication key information is regarded as illegal data, and the unused communication key information is regarded as legal data; then use this communication key to decrypt the command ciphertext data to obtain structured command identification information; obtain the key identification of management terminal A according to the information of the original management terminal A where the command was issued, and verify the signature data according to the structured instruction. If the verification fails, it means that the command has been tampered with or replaced and will not be executed. If the verification passes, it means that the command is a legal command initiated by management terminal A, and enters the second stage of command transmission.

[0186] (d) The server reconstructs and pushes instructions to the execution smart terminal.

[0187] The server pushes specific instructions to the specified smart terminal and reassembles the instruction structure, obtains the device identification information in the initiating instruction information, and obtains the location information of the smart terminal in the management system; replaces the device identification of the instruction information in the initiating instruction information with the instruction identification to form a new sending instruction information structure; uses 3X's home business key to sign the instruction information in the sending instruction information structure, obtains the instruction signature data, and combines them into the final sending instruction information structure. The final sending instruction information structure includes instruction information, signature information (3X's home business signature), instruction identification (256-bit identification), instruction information (open the door), instruction time (20240102123330), execution time (0-immediate execution) and other information.

[0188] For the confidentiality and integrity of instruction transmission, the present invention needs to perform secondary encapsulation on the transmission instruction. The server uses the business key of 3X to generate a one-time temporary communication key, uses the temporary key to encrypt the reconstructed terminal instruction identification information structure data, obtains instruction ciphertext data, uses the public key of the intelligent terminal key to encrypt the one-time temporary communication key, obtains the communication key ciphertext data, and the data combination structure includes: data header information-key ciphertext data, data ciphertext information-instruction ciphertext data.

[0189] (e) The smart terminal receives the instructions pushed by the server and executes them after secure identification.

[0190] After the smart terminal receives the instruction data packet, it first uses its own private key to decrypt the instruction data header information. If the decryption fails, the instruction is regarded as illegal data such as tampered or counterfeit; if the data header information is successfully decrypted, the communication key is obtained; then the instruction ciphertext data is decrypted using the communication key to obtain the structured instruction identification information; the signature data of the structured instruction information is verified using the business key public key. If the verification fails, it means that the instruction has been tampered with or replaced and will not be executed. If the verification passes, it means that the instruction is a legal instruction; finally, according to the instruction identification information structure rules, verify whether the instruction identification data is consistent. If not, it is an illegal instruction, and if it is consistent, it is a legal instruction; at this point, the smart terminal has received a legal instruction and can execute it.

[0191] Embodiment 2

[0192] This embodiment provides a smart home security identification system based on the SM algorithm, including:

[0193] After the server is deployed, the system is initialized, which mainly includes: service operation environment configuration, server master key generation, management terminal initial configuration, etc. The server master key is stored in the hardware password module, which ensures that the key cannot be illegally exported or read, ensuring the security of the system master key.

[0194] Figure 3 The present invention designs a unique identifier for the reconstruction server, uses the initial configuration information and the inherent information of the device, obtains the type (such as: smart home), name (such as: 3X's home), device SN, and location identifier (such as: A Province B City C District) defined in the device information, combines them, and uses the SM3 algorithm to calculate to obtain 256-bit data. This data is used as the unique identifier of 3X's home's smart home, and the system master key is used to generate the corresponding business private key.

[0195] When the management terminal A accesses, the unique identifier of the management terminal is reconstructed as follows: the type of the configuration information item is the management terminal, the name is 3X, the device SN is optional according to whether the configuration item of the current device is bound, and the location identifier is the mobile phone number. The above information is combined and calculated using the SM3 algorithm to obtain a 256-bit unique identifier;

[0196] The server-side password module uses 3X's home business key to derive the private key of management terminal A based on the unique identifier in the previous step.

[0197] Lightweight off-service encryption distribution key, the server-side cryptographic module generates 8-bit random data as the decryption key, uses the service key of the server-side business 3X home to derive a one-time temporary key, uses the temporary key to encrypt 3X's private key and business public key, and obtains the private key data of the 3X management terminal in ciphertext form. The private key data ciphertext is transmitted to the registered device of 3X through the network and waits for decryption. The 8-bit random data key required for decryption is sent off-service by the server through the mobile phone number registered by the management terminal A. After receiving the 8-bit random data key, the management terminal A of 3X home enters it through the management interface. The terminal decrypts the input 8-bit random data key to obtain the private key data of the management terminal A and the business public key of 3X home, and the registration of the management terminal A is completed.

[0198] The management terminal logs in to the server;

[0199] Enter the smart home terminal information that needs to be registered, such as: type smart door lock, name entrance door lock, brand AA, start searching and matching through the communication protocol, and after receiving the door lock response, obtain the basic information of the door lock, such as: type smart door lock, device SN door lock serial number, factory logo product picture, etc.;

[0200] The server reconstructs the intelligent terminal device information according to the terminal device identification information structure, type-intelligent door lock, name-entry door lock, device SN-device serial number, location identifier-IP, area-ABC, registration time-20240101132656, start time-20240101132656, end time-20990101132656;

[0201] The picture identification information structure is reconstructed into picture type JPG, picture data jk879***, and the width and height of the picture are 134-320.

[0202] According to the reconstructed terminal identity information, the terminal device identification is reconstructed, and the terminal type, name, SN, and location identification are combined. After executing the SM3 algorithm, a 256-bit identification code is obtained, which becomes the unique identification code of the terminal:

[0203] 13E9F36B1EF02E15FB46AD5854794337177E66ABD7EF9928987D929E3197A73F.

[0204] The reconstructed terminal identity information is encrypted and synchronized to the terminal, and this information will serve as the basic information for valid verification of subsequent instructions.

[0205] The server password module uses the 3X home business key to derive the identity private key of the terminal device according to the unique identification code of the terminal. For the key distribution method, refer to the management terminal key distribution method to complete the key distribution.

[0206] At this point, the registration operation of the smart home terminal is completed.

[0207] There are two transmission stages for communication security command transmission. The first stage is that the management terminal uploads the command to be executed to the server. The second stage is that the server transmits the command of the management terminal to the corresponding intelligent terminal for execution.

[0208] Management terminal A logs in to the server, selects the smart terminal door lock that needs to execute the command, and executes the unlock command;

[0209] Management terminal A reorganizes the instruction identification structure according to the terminal identity information. The instruction identification structure includes: device identification (256-bit identification code), instruction information (open door), instruction time (20240102123330), execution time (0—immediate execution) and other information.

[0210] Generate a 256-bit identification code cmmID for this instruction based on the terminal reconstruction information.

[0211] At this time, the terminal instruction information of the management terminal A does not present any actual real directional information in the terminal data, thereby ensuring the privacy of the instruction execution terminal.

[0212] In order to ensure the security of the instruction transmission process and prevent tampering, the reconstructed instruction information is signed using the SM9 key of the management terminal to generate signature data of the instruction.

[0213] Finally, the reconstructed terminal instruction identification information structure according to the present invention is: instruction identification (256-bit identification), instruction information, instruction source (management terminal A), signature information (management terminal signature), device identification (256-bit identification), instruction information (open door), instruction time (20240102123330), execution time (0-immediate execution) and other information.

[0214] In order to ensure the confidentiality and integrity of command transmission, the transmission commands in the smart home are encapsulated twice. The smart terminal generates a one-time temporary communication key, uses the temporary key to encrypt the reconstructed terminal command identification information structure data, obtains the command ciphertext data, uses the 3X home business key public key to encrypt the one-time temporary communication key, obtains the communication key ciphertext data, and the two ciphertexts are combined into a ciphertext command structure. The ciphertext data structure includes: data header information-key ciphertext data, data ciphertext information-command ciphertext data.

[0215] The server receives the instruction from management terminal A and uses 3X's business key to decrypt the instruction data header information. If the decryption fails, the instruction is considered to be tampered with, forged, or other illegal data. If the data header information is successfully decrypted, the communication key is obtained.

[0216] Check whether the communication key information has been used. The used communication key information is regarded as illegal data, and the unused communication key information is regarded as legal data.

[0217] Use the current communication key to decrypt the instruction ciphertext data to obtain structured instruction identification information;

[0218] The key identifier of management terminal A is obtained based on the information of the instruction originating from management terminal A. The signature data is verified according to the structured instruction. If the verification fails, it means that the instruction has been tampered with or replaced and will not be executed. If the verification passes, it means that the instruction is a legitimate instruction initiated by management terminal A, and the second stage of instruction transmission is entered;

[0219] The server obtains the device identification information in the initiating command information and obtains the location information of the smart terminal;

[0220] The device identifier of the instruction information in the initiating instruction information is replaced by the instruction identifier to form a new sending instruction information structure; the instruction information in the sending instruction information structure is signed using 3X's home business key to obtain the instruction signature data, which is combined into the final sending instruction information structure. The final sending instruction information structure includes instruction information, signature information (3X's home business signature), instruction identifier (256-bit identifier), instruction information (open the door), instruction time (20240102123330), execution time (0—execute immediately) and other information.

[0221] In order to ensure the confidentiality and integrity of instruction transmission, the transmission instruction is encapsulated twice. The server uses 3X's business key to generate a one-time temporary communication key, uses the temporary key to encrypt the reconstructed terminal instruction identification information structure data, obtains instruction ciphertext data, uses the smart terminal key public key to encrypt the one-time temporary communication key, obtains communication key ciphertext data, and the data combination structure includes: data header information-key ciphertext data, data ciphertext information-instruction ciphertext data.

[0222] After receiving the instruction data packet, the intelligent terminal first uses its own private key to decrypt the instruction data header information. If the decryption fails, the instruction is regarded as illegal data such as tampered or counterfeited. If the data header information is successfully decrypted, the communication key is obtained.

[0223] Use the current communication key to decrypt the instruction ciphertext data to obtain structured instruction identification information;

[0224] Use the business key public key to verify the signature data of the structured instruction information. If the verification fails, it means that the instruction has been tampered with or replaced and will not be executed. If the verification passes, it means that the instruction is a legal instruction.

[0225] Finally, according to the instruction identification information structure rules, verify whether the instruction identification data is consistent. If it is inconsistent, it is an illegal instruction, and if it is consistent, it is a legal instruction;

[0226] At this point, the smart terminal has received legal instructions and can execute them.

[0227] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for smart home security identification based on SM algorithm, characterized in that: include: The management terminal encrypts the communication instruction to obtain the communication instruction encrypted data, generates a signature of the communication instruction using the SM algorithm, and uploads the signature and the communication instruction encrypted data to the server; The server decrypts the communication instruction encrypted data to obtain the communication instruction; performs signature verification on the communication instruction, and after successful verification, reorganizes the communication instruction structure according to the identity information of the smart terminal, and re-encrypts the reorganized communication instruction using the communication key of the smart terminal, re-signs the encrypted communication instruction using the server key, and sends the communication instruction to the smart terminal for execution; The process of the management terminal encrypting the communication instruction to obtain the communication instruction encrypted data includes: the management terminal selects the smart terminal that needs to execute the instruction and the instruction that needs to be executed, and reconstructs the communication instruction encrypted data according to the identity information of the smart terminal; the server generates a one-time first temporary communication key, encrypts the communication instruction, and obtains the first instruction ciphertext data; uses the business key of the home where the smart terminal is located to encrypt the one-time first temporary communication key to obtain the first key ciphertext data; signs the first instruction ciphertext data and the first key ciphertext data using the identity of the management terminal to obtain the ciphertext data signature, and uploads the first instruction ciphertext data, the first key ciphertext data and the ciphertext data signature to the server; The process of the server decrypting the communication instruction encrypted data to obtain the communication instruction includes: the server uses the business key to decrypt the first key ciphertext data, and after the decryption is successful, uses the decrypted first key ciphertext data to decrypt the first instruction ciphertext data to obtain the real communication instruction; The process of performing signature verification on the communication instruction includes: obtaining the key identification of the management terminal according to the information of the management terminal, verifying the signature data, if the verification fails, it means that the instruction has been tampered with or replaced and will not be executed, and if the verification passes, it means that the instruction is a legal instruction initiated by the management terminal; The process of sending the communication instruction to the smart terminal for execution includes: reorganizing the instruction information structure data obtained according to the communication instruction smart terminal; generating a one-time second temporary communication key according to the business key, using the second temporary communication key to encrypt the sending instruction information structure data to obtain second instruction ciphertext data; using the key public key of the smart terminal to encrypt the second temporary communication key to obtain second key ciphertext data; signing the second instruction ciphertext data and the second key ciphertext data using the server-side identity information to obtain signature data of the communication data, and sending the second instruction ciphertext data, the second key ciphertext data and the signature data to the smart terminal; The intelligent terminal uses the private key to decrypt the second key ciphertext data to obtain the second temporary communication key. After the decryption is successful, the second instruction ciphertext data is decrypted using the decrypted second key ciphertext data to obtain the sending instruction information structure data; and verifies the legitimacy. After the verification is successful, the instruction is executed; The process of verifying the legitimacy includes: using the business key to verify the signature of the instruction information structure data, if the verification fails, it means that the instruction has been tampered with or replaced and will not be executed; if the verification passes, it means that the instruction is a legal instruction; according to the instruction identification information structure rule, verify whether the instruction information structure data is consistent, if it is inconsistent, it is an illegal instruction, and if it is consistent, it is a legal instruction; the intelligent terminal executes the legal instruction; Before the management terminal uploads data, it also includes: the management terminal enters the smart terminal information to be registered, and the server reconstructs the smart terminal device information according to the smart terminal device identification information structure; reconstructs the terminal device identification according to the reconstructed terminal identity identification information, and generates a unique identification code for the smart terminal; uses the business key according to the unique identification code of the smart terminal to obtain the identity private key of the smart terminal, and completes the registration of the smart terminal; Among them, according to the reconstruction information structure definition, the unique identifier of the server is reconstructed, and the type, name, device SN and location identifier defined in the smart terminal device information are obtained through the initial configuration information and the inherent information of the device for sequence combination. The SM3 algorithm is used to calculate to obtain 256-bit data, and the data is used as the unique identifier of the smart home. The identifier is used to generate the corresponding SM9 business key, including the business public key and the business private key.

2. The method for smart home security identification based on SM algorithm according to claim 1, characterized in that: Before the management terminal uploads data, it also includes: according to the device information of the smart terminal, using the SM algorithm to obtain the unique identification of the smart home device, and using the master key of the server to generate the corresponding business private key; according to the unique identification of the management terminal, using the business key to generate the management terminal private key; using the business key to generate a one-time third temporary key, using the one-time third temporary key to encrypt the private key and business public key of the management terminal to obtain the private key ciphertext of the management terminal, and sending the private key ciphertext to the server to wait for decryption; the server sends a random data key via offline SMS to decrypt the private key and business public key of the management terminal, and the registration of the management terminal is completed.

3. The method for smart home security identification based on SM algorithm according to claim 1, characterized in that: The structure of the communication instruction encrypted data includes: an initiating instruction information structure and a sending instruction information structure. The initiating instruction information structure includes: an instruction identification ID, instruction information, instruction source and custom data; the sending instruction information structure includes: an instruction identification, instruction information, instruction time, execution time and other information.

4. A smart home security identification system based on the SM algorithm of any one of claims 1 to 3, characterized in that: include: The first transmission module is configured to: the management terminal encrypts the communication instruction to obtain the communication instruction encrypted data, generates a signature of the communication instruction using the SM algorithm, and uploads the signature and the communication instruction encrypted data to the server; The second transmission module is configured as follows: the server decrypts the communication instruction encrypted data to obtain the communication instruction; performs signature verification on the communication instruction, and after successful verification, reorganizes the communication instruction structure according to the identity information of the smart terminal, and re-encrypts the reorganized communication instruction using the smart terminal communication key, re-signs the encrypted communication instruction using the server key, and sends the communication instruction to the smart terminal for execution; Among them, the management terminal encrypts the communication instruction to obtain the process of encrypted communication instruction data, including: the management terminal selects the smart terminal that needs to execute the instruction and the instruction that needs to be executed, and reconstructs the encrypted communication instruction data according to the identity information of the smart terminal; the server generates a one-time first temporary communication key, encrypts the communication instruction, and obtains the first instruction ciphertext data; uses the business key of the home where the smart terminal is located to encrypt the one-time first temporary communication key to obtain the first key ciphertext data; signs the first instruction ciphertext data and the first key ciphertext data using the identity of the management terminal to obtain the ciphertext data signature, and uploads the first instruction ciphertext data, the first key ciphertext data and the ciphertext data signature to the server.

Images