Internet-of-things equipment identity authentication method based on implicit certificate and multi-layer management system

Abstract

The invention discloses an internet of things equipment identity authentication method based on an implicit certificate and a multi-layer management system. The method comprises the steps that terminal equipment generates a terminal equipment pre-secret key; the terminal equipment initiates a certificate application request to the terminal management platform; the terminal management platform generates a platform temporary key based on the certificate application request; the terminal management platform requests the PKI / CA system to apply for a terminal device certificate; the PKI / CA system generates a terminal equipment implicit certificate and a CA private key reconstruction value ciphertext after signature verification, and sends the terminal equipment implicit certificate and the CA private key reconstruction value ciphertext to the terminal management platform; the terminal management platform backs up the terminal equipment implicit certificate and sends the terminal equipment implicit certificate to the terminal equipment; and the terminal device generates a device certificate key based on the terminal device implicit certificate. On the premise of realizing multi-layer system authentication, hierarchical management is realized, the PKI / CA system is only responsible for the terminal management platform, and the terminal management platform is responsible for Internet of Things equipment information, so that the equipment authentication mode is systematically improved, overall management is facilitated, and storage and transmission of redundant information are effectively reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an implicit certificate-based IoT device identity authentication method and a multi-layer management system. Background Art

[0002] In the IoT scenario, the system contains a large number of heterogeneous devices such as DTU, RTU, industrial gateways, etc. Information data flows between various platforms, equipment and facilities. Under the increasingly severe network security situation, the security of the data interaction process at each end is particularly important. Among them, due to the limitations of the computing power and storage capacity of IoT devices, the traditional identity authentication mode based on digital certificates is difficult to carry out in IoT devices, and directly transforming IoT devices into digital certificate authentication will cause a lot of processing, storage and communication costs. Therefore, it is necessary to consider an identity authentication solution with low communication volume and small storage space.

[0003] The status monitoring and identity management of IoT devices are usually uniformly controlled by the platform-level system on the management side. Such systems are collectively referred to as terminal management systems. The traditional PKI / CA model binds the identity authentication of IoT devices to CA. The terminal management platform uses digital certificates to achieve identity authentication and unified management of IoT devices, but cannot directly perform device identity management for IoT devices. Therefore, it is necessary to consider a multi-layer authentication strategy so that the identity authentication of IoT devices is not only based on the digital certificates issued by the traditional CA, but the CA and the terminal management platform jointly assume the identity authentication function of the device. Summary of the invention

[0004] In order to overcome the deficiencies of the above technologies, the present invention provides an IoT device identity authentication method and a multi-layer management system based on implicit certificates, which uses implicit certificates to improve the speed of signature verification, is small in size, and occupies less bandwidth. Under the premise of realizing multi-layer system authentication, hierarchical management is realized. The PKI / CA system is only responsible for the terminal management platform, and the terminal management platform is responsible for the IoT device information. In this way, the device authentication mode is systematically improved, which is conducive to overall management and effectively reduces the storage and transmission of redundant information.

[0005] The technical solution adopted by the present invention to overcome the technical problems is:

[0006] The first aspect of the present invention proposes an IoT device identity authentication method based on implicit certificates, including a terminal device generating a terminal device pre-private key, and calculating a terminal device pre-public key and a terminal device pre-secret key based on the terminal device pre-private key; the terminal device at least encapsulates the device information of the terminal device and the information of the terminal device pre-public key, and then initiates a certificate application request to a terminal management platform; the terminal management platform generates a platform temporary private key based on the certificate application request, and calculates a platform temporary public key based on the platform temporary private key, thereby obtaining a platform temporary key; the terminal management platform at least encapsulates the terminal device pre-public key, the platform temporary public key and the device information, and then sends them to a PKI / CA system to request an application for a terminal device certificate; the PKI / CA system generates a CA temporary private key based on the certificate application request, and obtains a CA temporary public key based on the CA temporary private key, thereby obtaining a platform temporary key. And based on the terminal device pre-public key, the platform temporary public key and the CA temporary public key, the terminal device implicit certificate and the CA private key reconstruction value ciphertext are generated, and the terminal device implicit certificate and the CA private key reconstruction value ciphertext are sent to the terminal management platform; the terminal management platform backs up the terminal device implicit certificate, and generates the platform private key reconstruction value ciphertext based on the terminal device implicit certificate and the platform temporary private key; the terminal management platform sends the encapsulated information including at least the terminal device implicit certificate, the platform private key reconstruction value ciphertext and the CA private key reconstruction value ciphertext to the terminal device; the terminal device decrypts the received encapsulated message based on the terminal device pre-private key to obtain the platform private key reconstruction value and the CA private key reconstruction value, and generates the device certificate private key and the device certificate public key respectively based on the terminal device implicit certificate and the pre-key; the terminal device verifies the device certificate public key and obtains the device certificate key.

[0007] Furthermore, the terminal management platform generates a platform temporary private key based on the certificate application request, and calculates the platform temporary public key based on the platform temporary private key, thereby obtaining the platform temporary key, specifically including: the terminal management platform verifies the integrity of the certificate application request, if the certificate application request integrity verification passes, then checks the device information in the certificate application request, if the check passes, then the terminal management platform generates a random number as the platform temporary private key, calculates the platform temporary public key based on the platform temporary private key, thereby obtaining the platform temporary key, if the certificate application request verification fails or the device information check fails, then the certificate application request message is discarded.

[0008] Furthermore, the terminal management platform at least encapsulates the terminal device pre-public key, the platform temporary public key and the device information and sends them to the PKI / CA system to request an application for a terminal device certificate, including: the terminal management platform specifies the device information of the terminal device according to a preset implicit certificate format; and encapsulates the terminal device pre-public key, the platform temporary public key and the specified device information and sends them to the PKI / CA system.

[0009] Furthermore, the PKI / CA system generates a CA temporary private key based on the certificate application request, obtains a CA temporary public key based on the CA temporary private key, and generates a terminal device implicit certificate and a CA private key reconstruction value ciphertext based on the terminal device pre-public key, the platform temporary public key and the CA temporary public key, specifically including: the PKI / CA system obtains the terminal device pre-public key and the platform temporary public key based on the certificate application request; the PKI / CA system randomly generates a random number as the CA temporary private key; calculates the CA temporary public key based on the CA temporary private key to obtain a CA temporary key pair; generates a terminal device public key reconstruction value based on the terminal device pre-public key, the platform temporary public key and the CA temporary public key; registers the terminal device implicit certificate based on the device information and the device public key reconstruction value; registers the terminal device implicit certificate hash value based on the terminal device implicit certificate, and calculates and generates the CA private key reconstruction value based on the terminal device implicit certificate hash value, the CA temporary private key and the CA root certificate private key; encrypts the CA private key reconstruction value based on the terminal device pre-public key to obtain a private key reconstruction value ciphertext.

[0010] The PKI / CA system is only responsible for the terminal management platform, registers the terminal device implicit certificate through PKI / CA, and returns the terminal device implicit certificate and CA private key reconstruction value.

[0011] Furthermore, the terminal management platform backs up the terminal device implicit certificate, and generates a platform private key reconstruction value ciphertext based on the terminal device implicit certificate and the platform temporary private key, specifically including: verifying the integrity of the terminal device implicit certificate, and verifying the signature of the terminal device implicit certificate received in response to the PKI / CA system; backing up the terminal device implicit certificate that has passed the integrity verification and signature verification, thereby corresponding the terminal device to the terminal device implicit certificate; generating a platform private key reconstruction value based on the terminal device implicit certificate, the platform temporary private key and the platform certificate private key; encrypting the platform private key reconstruction value based on the terminal device pre-public key to obtain a private key reconstruction value ciphertext.

[0012] The terminal management platform is responsible for the information of IoT devices, generates a platform private key reconstruction value and sends it to the terminal device, and forwards the terminal device implicit certificate and CA private key reconstruction value to the terminal device. The terminal device is unbound from the CA.

[0013] Furthermore, the terminal device decrypts the received encapsulated message based on the terminal device pre-private key to obtain the platform private key reconstruction value and the CA private key reconstruction value, and generates the device certificate private key and the device certificate public key respectively based on the received terminal device implicit certificate and the pre-key, specifically including: verifying the integrity of the received terminal device implicit certificate, and if the verification is successful, verifying the signature of the received terminal device implicit certificate, and if the verification is successful, decrypting based on the terminal device pre-private key to obtain the platform private key reconstruction value and the CA private key reconstruction value, and calculating the device certificate private key based on the terminal device implicit certificate hash value, the terminal device pre-private key, the CA private key reconstruction value and the platform private key reconstruction value; and calculating the device certificate public key based on the terminal device implicit certificate hash value, the terminal device public key reconstruction value, the platform certificate public key and the CA root certificate public key.

[0014] Furthermore, the terminal device obtains a device certificate key after verifying the device certificate public key, specifically including: verifying whether the generated device certificate public key is equal to the device certificate public key calculated based on the device certificate private key and elliptic curve algorithm parameters; if they are equal, obtaining a device certificate key including the device certificate private key and the device certificate public key.

[0015] Furthermore, the public key cryptographic algorithm adopts the SM2 elliptic curve algorithm, and the terminal device, the terminal management platform and the PKI / CA system jointly agree on the elliptic curve algorithm parameters.

[0016] Furthermore, the SM3 hash algorithm is used to calculate the hash value of the terminal device implicit certificate.

[0017] The second aspect of the present invention also proposes a multi-layer management system for IoT device identity authentication based on implicit certificates, which runs the above-mentioned IoT device identity authentication method based on implicit certificates, and at least includes several terminal devices, several terminal management platforms that manage IoT terminal devices respectively, and a PKI / CA system connected to the terminal management platform. The terminal device is used to generate a terminal device pre-public key, and encapsulate the terminal device information and the terminal device pre-public key, and then send a certificate application request to the corresponding IoT terminal management platform, and generate a device certificate key based on the returned terminal device implicit certificate, platform private key reconstruction value and CA private key reconstruction value; the terminal management platform is used to generate a platform temporary public key based on the certificate application request, and send a terminal device certificate application request to the PKI / CA system with the terminal device pre-public key, platform temporary public key and terminal device information, and generate a platform private key reconstruction value ciphertext based on the returned terminal device implicit certificate, and send the platform private key reconstruction value ciphertext and the terminal device implicit certificate to the terminal device; the PKI / CA system registers the terminal device implicit certificate and CA private key reconstruction value based on the received terminal device certificate request, and sends them to the corresponding terminal management platform.

[0018] The beneficial effects of the present invention are:

[0019] 1. The implicit certificate solution based on multi-layer management uses implicit certificates as the signature certificate and encryption certificate of IoT devices, completes the calculation of public and private keys and identity authentication through public and private key reconstruction, and completes certificate verification through public and private key matching;

[0020] 2. The use of terminal device certificates only needs to be verified by the terminal management center, without the need for additional CA participation;

[0021] 3. The implicit certificate has small storage space, high signature verification speed and is compatible with standard certificate formats;

[0022] 4. The implicit certificate is used to combine the generation of the public key and the verification of the CA into one step, which reduces the process compared to the traditional certificate which requires two signature verification operations with the CA;

[0023] 5. The upper-level system authenticates the device through the reconstruction value of public and private keys. It does not need to be directly responsible for the system or device information other than the directly subordinate lower-level system. It optimizes the identity authentication system architecture, is compatible with existing traditional digital certificates and implicit certificate solutions, and has a high degree of freedom in the number of devices and authentication modes on the multi-layer management side.

[0024] 6. Optimized the security issues caused by the reconstruction value of the public and private keys of implicit certificates. The private key or even the complete reconstruction value of the private key cannot be restored through other systems other than the terminal device, including the encryption key generation scheme generated by the device management platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a schematic diagram of the architecture of a multi-layer management system for Internet of Things identity authentication used in an embodiment of the present invention;

[0026] Figure 2 The present invention is a flowchart of an implicit certificate-based IoT device identity authentication method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to facilitate those skilled in the art to better understand the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The following is only exemplary and does not limit the protection scope of the present invention.

[0028] like Figure 1 As shown, the multi-layer management system for IoT device identity authentication based on implicit certificates in this embodiment includes a number of IoT terminal devices, an IoT terminal management platform and a PKI / CA system, which is used to manage the use of IoT terminal device certificates only through the IoT terminal management platform. Figure 1In the multi-layer management authentication system shown in the figure, the generation of implicit certificates requires a public key reconstruction value and a corresponding private key reconstruction value. The certificate public key is derived from the certificate hash value, the terminal device pre-public key, the terminal management platform and the public key reconstruction value of the PKI / CA system. The certificate private key is derived from the certificate hash value, the device pre-signed private key, the terminal management platform and the private key reconstruction value of the PKI / CA system. The flowchart of the IoT device authentication method based on implicit certificates proposed in the present invention is as follows: Figure 2 As shown, the specific steps include the following steps.

[0029] S1, the terminal device generates a terminal device pre-private key, and calculates a terminal device pre-public key and a terminal device pre-secret key based on the terminal device pre-private key.

[0030] In one embodiment of the present invention, the public key cryptographic algorithm of the IoT terminal device, the IoT terminal management platform and the PKI / CA system adopts the SM2 elliptic curve algorithm, the selection of the elliptic curve parameters adopts the SM2 specification, and the networked terminal device, the IoT terminal management platform and the PKI / CA system pre-agree on a unified elliptic curve parameter G=(p, a, b, g x ,g y ,z).

[0031] The terminal device generates a terminal device pre-key including the following steps:

[0032] S11, the terminal device generates a random number k u ∈[1,2,…,n-1] as the terminal device pre-private key;

[0033] S12, by calculating the terminal device pre-public key P u =k u G, get the pre-key (k u ,P u ).

[0034] S2, the terminal device at least sends the device information of the terminal device and the terminal device pre-public key P u After the information is packaged, a certificate application request is initiated to the terminal management platform.

[0035] The device information of the terminal device includes basic device information, device serial number, etc.

[0036] S3, the terminal management platform generates a platform temporary private key based on the certificate application request, and calculates the platform temporary public key based on the platform temporary private key, thereby obtaining the platform temporary key.

[0037] S31, the terminal management platform verifies the integrity of the certificate application request message and checks the device information.

[0038] In one embodiment of the present invention, HMAC may be used to perform integrity verification on the certificate application request message.

[0039] S32: If the integrity verification of the certificate application request passes, the device information in the certificate application request is checked. If the check passes, the terminal management platform generates a random number k. m ∈[1,2,…,n-1] is used as the temporary private key of the terminal management platform.

[0040] S33, according to the temporary private key k of the terminal management platform m Computing terminal management platform temporary public key P m =k m G, get the temporary key (k m ,P m ).

[0041] S34: If the certificate application request integrity verification fails or the device information check fails, the application request message is considered unreliable or the device is unreliable, and the certificate application request message is directly discarded.

[0042] S4, the terminal management platform encapsulates at least the terminal device pre-public key, the platform temporary public key and the device information and sends them to the PKI / CA system to request an application for a terminal device certificate.

[0043] S41, the terminal management platform standardizes the device information of the terminal device according to the preset implicit certificate format;

[0044] S42, the terminal device pre-public key P u 、Platform temporary public key P m The standardized device information is encapsulated and sent to the PKI / CA system.

[0045] S5, the PKI / CA system generates a CA temporary private key based on the certificate application request, obtains a CA temporary public key based on the CA temporary private key, generates a terminal device implicit certificate and a CA private key reconstruction value ciphertext based on the terminal device pre-public key, the platform temporary public key and the CA temporary public key, and sends the terminal device implicit certificate and the CA private key reconstruction value ciphertext to the terminal management platform.

[0046] S51, the PKI / CA system receives the certificate application request message and obtains the terminal device pre-public key P u and the platform temporary public key P m ;

[0047] S52, the PKI / CA system randomly generates a random number k CA ∈[1,2,…,n-1] as the CA temporary private key;

[0048] S53, based on CA temporary private key k CACalculate CA temporary public key P CA =k CA G, get CA temporary key pair (k CA ,P CA );

[0049] S54, based on the terminal device pre-public key P u 、Platform temporary public key P m and CA temporary public key P CA Generate the terminal device public key reconstruction value R u =P u +P m +P CA .

[0050] S55, calculate and register the terminal device implicit certificate Cert based on the device public key reconstruction value u ;

[0051] S56, registering the terminal device implicit certificate hash value h based on the terminal device implicit certificate u =hash(Cert u ), and based on the terminal device implicit certificate hash value h u Calculate and generate CA private key reconstruction value r CA =h u ×k CA +q CA .

[0052] In one embodiment of the present invention, the hash function uses the SM3 hash algorithm. In addition, the CA root certificate private key of the PKI / CA system is q CA and CA root certificate public key Q CA Together they form the CA root certificate key pair (q ca , Q CA ).

[0053] S57, encrypting the CA private key reconstruction value based on the terminal device pre-public key to obtain a private key reconstruction value ciphertext.

[0054] Use the terminal device pre-public key P u Encrypted private key reconstruction value r CA , get the private key reconstruction value ciphertext P u (r CA ).

[0055] S58, the PKI / CA system sends the terminal device implicit certificate Cert u , private key reconstruction value ciphertext P u (r CA ) and other information are packaged and sent to the terminal management platform.

[0056] S6, the terminal management platform backs up the implicit certificate of the terminal device, and generates a ciphertext of the platform private key reconstruction value based on the implicit certificate of the terminal device.

[0057] S61, verify the integrity of the implicit certificate of the terminal device, and verify the signature of the message of the implicit certificate of the terminal device received in response from the PKI / CA system.

[0058] In one embodiment of the present invention, by h u =hash(Cert u ) Verify the integrity of the terminal device's implicit certificate. And verify the integrity of the received message.

[0059] S62, the terminal device implicit certificate Cert after the integrity verification and signature verification is successful u Back up, thereby matching the terminal device with the terminal device implicit certificate.

[0060] S63, based on the terminal device implicit certificate Cert u 、Platform temporary private key k m Generate platform private key reconstruction value r m .

[0061] In one embodiment of the present invention, based on the terminal device implicit certificate Cert u 、Platform temporary private key k m and platform certificate private key q m Generate platform private key reconstruction value r m , the formula is r m =h u ×k m +q m .

[0062] Among them, the platform certificate private key q m and platform certificate public key Q m The terminal management platform itself already has a signature key pair (q m , Q m ).

[0063] S64, based on the terminal device pre-public key P u Reconstruct the value r of the platform private key m Encrypt to get the platform private key reconstruction value ciphertext P u (r m ).

[0064] S7, the terminal management platform will at least include the terminal device implicit certificate Cert u 、Platform private key reconstruction value ciphertext P u (r m ) and CA private key reconstruction value ciphertext P u (r CA) is sent to the terminal device.

[0065] S8, the terminal device uses the terminal device pre-private key k u Decrypt the received encapsulated message to obtain the platform private key reconstruction value r m and CA private key reconstruction value r CA , and based on the received terminal device implicit certificate Cert u Generate the device certificate private key and device certificate public key using the pre-key.

[0066] S81, verify the integrity of the received terminal device implicit certificate, and if the verification is successful, verify the signature of the received terminal device implicit certificate.

[0067] In one embodiment of the present invention, h u =hash(Cert u ) Verify the integrity of the terminal device’s implicit certificate.

[0068] S82, if the verification is successful, then based on the terminal device pre-private key k u Decrypt to get the platform private key reconstruction value r m and CA private key reconstruction value r CA .

[0069] S83, based on the hash value of the terminal device implicit certificate and the terminal device pre-private key k u , CA private key reconstruction value r CA 、Platform private key reconstruction value r m Calculate the device certificate private key q u .

[0070] Device certificate private keyq u =h u ×k u +r CA +r m .

[0071] S84, calculating the device certificate public key based on the terminal device implicit certificate and the terminal device public key reconstruction value.

[0072] In one embodiment of the present invention, based on the implicit certificate hash value h of the terminal device u , terminal device public key reconstruction value R u 、CA root certificate public key Q CA and platform certificate public key Q m Calculate the device certificate public key Q u .

[0073] Device certificate public key Q u =h u ×R u +QCA +Q m Among them, Q CA is the CA root certificate public key, Q m The public key of the platform certificate.

[0074] S9, the terminal device verifies the device certificate public key and obtains the device certificate key.

[0075] Verify that Q is satisfied u =q u G, if satisfied, then get the device certificate key (q u, ,Q u ). The obtained device certificate key is saved for subsequent identity authentication when interacting with other devices or platforms.

[0076] In another embodiment of the present invention, a multi-layer management system for IoT device identity authentication based on implicit certificates is also proposed. Figure 1 As shown, the above-mentioned method for authenticating the identity of an IoT device based on an implicit certificate is run, including several terminal devices, several terminal management platforms for managing the IoT terminal devices respectively, and a PKI / CA system connected to the terminal management platforms.

[0077] The terminal device is used to generate a terminal device pre-public key, and encapsulate the terminal device information and the terminal device pre-public key to send a certificate application request to the corresponding IoT terminal management platform, and generate a device certificate key based on the returned terminal device implicit certificate, platform private key reconstruction value and CA private key reconstruction value.

[0078] The terminal management platform is used to generate a platform temporary public key based on the certificate application request, and send a terminal device certificate application request to the PKI / CA system with the terminal device pre-public key, platform temporary public key and terminal device information, and generate a platform private key reconstruction value ciphertext based on the returned terminal device implicit certificate, and send the platform private key reconstruction value ciphertext and the terminal device implicit certificate to the terminal device.

[0079] The PKI / CA system registers the terminal device implicit certificate and CA private key reconstruction value based on the received terminal device certificate request, and sends it to the corresponding terminal management platform.

[0080] In one embodiment of the present invention, IoT terminal devices refer to some IoT data collection devices and data transmission devices with encryption functions, such as PLCs with encryption modules, VPN devices with encryption functions, etc. The PKI / CA system is a CA that supports implicit certificates or a CA that supports implicit certificates built by the enterprise itself. The terminal management platform is an application platform that can uniformly manage and control IoT terminal devices within the jurisdiction, and is usually a systematic platform deployed in the server. The terminal management platform should simultaneously deploy cryptographic devices, such as cryptographic machines, to support basic functions such as key management, data encryption and decryption, and signature verification.

[0081] It should be noted that the terminal management platform can adopt a multi-level setting. The bottom-level terminal management platform can apply to the upper-level terminal management platform in turn. The top-level terminal management platform communicates with the PKI / CA system and applies for terminal device certificates from the CA.

[0082] The present invention performs identity authentication on IoT devices based on multi-layer managed implicit certificates. Implicit certificates with small storage space and fast signature verification speed are used as signature certificates and encryption certificates of IoT devices. The calculation of public and private keys and identity authentication are completed through public and private key reconstruction, and certificate verification is completed through public and private key matching.

[0083] The upper-level system authenticates the device through the public and private key reconstruction value, and does not need to be directly responsible for the system or device information other than the directly subordinate lower-level system, which optimizes the identity authentication system architecture. In addition, it is compatible with the existing traditional digital certificate and implicit certificate schemes, and has a high degree of freedom in the number of multi-layer management side devices and authentication modes.

[0084] The multi-layer management strategy also effectively optimizes the security issues caused by the reconstruction value of the public and private keys of implicit certificates. In one embodiment of the present invention, other systems except the device body cannot restore the private key or even the complete private key reconstruction value, including the encryption key generation scheme generated by the device management platform. Since the constituent units of the public and private key reconstruction values ​​are complex, the systems involved in the reconstruction are jointly responsible for the certificate, which greatly reduces the security weight of the CA and the device management platform. Compared with a single authentication architecture, it has higher security and a more complete management system.

[0085] It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

Claims

1. A method for authenticating an IoT device based on an implicit certificate, characterized in that: include: The terminal device generates a terminal device pre-private key, and calculates a terminal device pre-public key and a terminal device pre-secret key based on the terminal device pre-private key; The terminal device at least encapsulates the device information of the terminal device and the information of the pre-public key of the terminal device and then initiates a certificate application request to the terminal management platform; The terminal management platform generates a platform temporary private key based on the certificate application request, and calculates a platform temporary public key based on the platform temporary private key, thereby obtaining a platform temporary key; The terminal management platform at least encapsulates the terminal device pre-public key, platform temporary public key and device information and sends them to the PKI / CA system to request an application for a terminal device certificate; The PKI / CA system generates a CA temporary private key based on the certificate application request, obtains a CA temporary public key based on the CA temporary private key, generates a terminal device implicit certificate and a CA private key reconstruction value ciphertext based on the terminal device pre-public key, the platform temporary public key and the CA temporary public key, and sends the terminal device implicit certificate and CA private key reconstruction value ciphertext to the terminal management platform; The terminal management platform backs up the implicit certificate of the terminal device, and generates the ciphertext of the platform private key reconstruction value based on the implicit certificate of the terminal device and the temporary private key of the platform; The terminal management platform sends packaged information including at least the terminal device implicit certificate, the platform private key reconstruction value ciphertext and the CA private key reconstruction value ciphertext to the terminal device; The terminal device decrypts the received encapsulated message based on the terminal device pre-private key to obtain the platform private key reconstruction value and the CA private key reconstruction value, and generates the device certificate private key and the device certificate public key based on the terminal device implicit certificate and the pre-key respectively; The terminal device obtains the device certificate key after verifying the device certificate public key.

2. According to claim 1, a method for authenticating an IoT device based on an implicit certificate is characterized in that: The terminal management platform generates a platform temporary private key based on the certificate application request, and calculates a platform temporary public key based on the platform temporary private key, thereby obtaining a platform temporary key, specifically including: The terminal management platform verifies the integrity of the certificate application request. If the integrity verification of the certificate application request is passed, the device information in the certificate application request is checked. If the check passes, the terminal management platform generates a random number as the platform's temporary private key. The temporary public key of the platform is calculated based on the temporary private key of the platform to obtain the temporary key of the platform. If the certificate application request verification fails or the device information check fails, the certificate application request message is discarded.

3. According to claim 1, a method for authenticating an IoT device based on an implicit certificate is characterized in that: The terminal management platform at least encapsulates the terminal device pre-public key, the platform temporary public key and the device information and sends them to the PKI / CA system to request an application for a terminal device certificate, including: The terminal management platform specifies the device information of the terminal device according to the preset implicit certificate format; The terminal device pre-public key, platform temporary public key and standardized device information are packaged and sent to the PKI / CA system.

4. According to claim 1, a method for authenticating an IoT device based on an implicit certificate is characterized in that: The PKI / CA system generates a CA temporary private key based on the certificate application request, obtains a CA temporary public key based on the CA temporary private key, and generates a terminal device implicit certificate and a CA private key reconstruction value ciphertext based on the terminal device pre-public key, the platform temporary public key and the CA temporary public key, specifically including: The PKI / CA system obtains the terminal device pre-public key and the platform temporary public key based on the certificate application request; The PKI / CA system randomly generates a random number as the CA temporary private key; Calculate the CA temporary public key based on the CA temporary private key to obtain the CA temporary key pair; Generate a terminal device public key reconstruction value based on the terminal device pre-public key, the platform temporary public key and the CA temporary public key; Register the terminal device implicit certificate based on the device information and the device public key reconstruction value; Registering a hash value of the terminal device's implicit certificate based on the terminal device's implicit certificate, and calculating and generating a CA private key reconstruction value based on the hash value of the terminal device's implicit certificate, the CA temporary private key, and the CA root certificate private key; The CA private key reconstruction value is encrypted based on the terminal device pre-public key to obtain the private key reconstruction value ciphertext.

5. According to claim 1, a method for authenticating an IoT device based on an implicit certificate is characterized in that: The terminal management platform backs up the terminal device implicit certificate, and generates a platform private key reconstruction value ciphertext based on the terminal device implicit certificate and the platform temporary private key, specifically including: Verify the integrity of the terminal device's implicit certificate and verify the signature of the terminal device's implicit certificate received in response to the PKI / CA system; The implicit certificate of the terminal device that has passed the integrity verification and signature verification is backed up, so as to correspond the terminal device with the implicit certificate of the terminal device; Generate a platform private key reconstruction value based on the terminal device implicit certificate, the platform temporary private key and the platform certificate private key; The platform private key reconstruction value is encrypted based on the terminal device pre-public key to obtain the private key reconstruction value ciphertext.

6. The method for authenticating an IoT device based on an implicit certificate according to claim 1, characterized in that: The terminal device decrypts the received encapsulated message based on the terminal device pre-private key to obtain the platform private key reconstruction value and the CA private key reconstruction value, and generates the device certificate private key and the device certificate public key based on the received terminal device implicit certificate and pre-key, specifically including: Verify the integrity of the implicit certificate of the received terminal device. If the verification is successful, verify the signature of the implicit certificate of the received terminal device. If the verification is successful, the platform private key reconstruction value and CA private key reconstruction value are obtained based on the terminal device pre-private key decryption. The device certificate private key is calculated based on the terminal device implicit certificate hash value, the terminal device pre-private key, the CA private key reconstruction value and the platform private key reconstruction value; The device certificate public key is calculated based on the terminal device implicit certificate hash value, the terminal device public key reconstruction value, the platform certificate public key and the CA root certificate public key.

7. The method for authenticating an IoT device based on an implicit certificate according to claim 6, characterized in that: The terminal device verifies the device certificate public key to obtain the device certificate key, which specifically includes: Verify whether the generated device certificate public key is equal to the device certificate public key calculated based on the device certificate private key and elliptic curve algorithm parameters. If they are equal, obtain the device certificate key including the device certificate private key and the device certificate public key.

8. A method for authenticating an IoT device based on an implicit certificate according to any one of claims 1 to 7, characterized in that: The public key cryptographic algorithm adopts the SM2 elliptic curve algorithm, and the terminal device, the terminal management platform and the PKI / CA system jointly agree on the elliptic curve algorithm parameters.

9. A method for authenticating an IoT device based on an implicit certificate according to any one of claims 1 to 7, characterized in that: The SM3 hash algorithm is used to calculate the hash value of the terminal device implicit certificate.

10. A multi-layer management system for IoT device identity authentication based on implicit certificates, running an IoT device identity authentication method based on implicit certificates as described in any one of claims 1 to 9, characterized in that: At least several terminal devices, several terminal management platforms that manage IoT terminal devices respectively, and a PKI / CA system connected to the terminal management platform. The terminal device is used to generate a terminal device pre-public key, and after encapsulating the terminal device information and the terminal device pre-public key, send a certificate application request to the corresponding IoT terminal management platform, and generate a device certificate key based on the returned terminal device implicit certificate, platform private key reconstruction value and CA private key reconstruction value; The terminal management platform is used to generate a platform temporary public key based on the certificate application request, and send a terminal device certificate application request to the PKI / CA system with the terminal device pre-public key, the platform temporary public key and the terminal device information, and generate a platform private key reconstruction value ciphertext based on the returned terminal device implicit certificate, and send the platform private key reconstruction value ciphertext and the terminal device implicit certificate to the terminal device; The PKI / CA system registers the terminal device implicit certificate and CA private key reconstruction value based on the received terminal device certificate request, and sends them to the corresponding terminal management platform.

Images