User identity authentication method for smart home equipment

Abstract

The invention discloses a user identity authentication method for smart home equipment, which comprises the steps that a target application responds to an identity authentication operation of target smart home equipment triggered by a user, and first source data is acquired; calling an SIM card of a user terminal to which a target application belongs to process the first source data to obtain an abstract ciphertext of the first source data and a first signature corresponding to an abstract of the first source data; sending the abstract ciphertext and a signature authentication request of the first signature to a control center server of the target application to obtain to-be-signed data, wherein the to-be-signed data is generated after the control center server verifies that the user is legal based on pre-registered binding information, the abstract ciphertext and the first signature; and signing the to-be-signed data based on the SIM card, and sending a signature result to the control center server for signature verification so as to determine the access authority of the user according to the signature verification result.

Description

Technical Field

[0001] The present application relates to the technical field of Internet of Things, and in particular to a user identity authentication method for smart home devices. Background Art

[0002] The development of mobile Internet and Internet of Things has led to a rapid increase in the types and number of network entities. The diversified and greatly increased identity management needs have brought new challenges to authentication technology. Users have evolved from using traditional household appliances to using a variety of smart home devices, such as smart sweepers, smart air conditioners, and even various sensor nodes (such as cameras, infrared sensors, etc.). Users have become more mobile and frequently switch devices, and applications have also become mobile.

[0003] Even if various smart home devices are relatively safe in a single environment, the interconnection of user accounts in different environments also exposes unpredictable security issues. Therefore, identity authentication technology needs to cope with increasingly complex environments.

[0004] After logging in to the smart home application (APP), the various connected smart home devices are managed and controlled. When the user intends to access the relevant privacy data of the target smart home device, he can log in to the device based on the user identity authentication method of the username and password, and then perform the access operation. However, the security of this user identity authentication method is very fragile and can be easily cracked, which reduces the security of smart home devices. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a user identity authentication method for a smart home device, so as to solve the problem of low security of the user identity authentication method of the smart home device.

[0006] In order to solve the above technical problems, this specification is implemented as follows:

[0007] In a first aspect, a method for authenticating a user identity of a smart home device is provided, which is applied to a target application, and the method comprises:

[0008] In response to a user triggering an identity authentication operation of a target smart home device, acquiring first source data, wherein the user is bound to at least the target smart home device on the target application;

[0009] Invoking a SIM card of a user terminal to which the target application belongs to process the first source data to obtain a digest ciphertext of the first source data and a first signature corresponding to the digest of the first source data;

[0010] Sending a signature authentication request of the digest ciphertext and the first signature to the control center server of the target application to obtain data to be signed, wherein the data to be signed is generated by the control center server after verifying the legitimacy of the user based on pre-registered binding information, the digest ciphertext and the first signature;

[0011] The data to be signed is signed based on the SIM card and the signature result is sent to the control center server for signature verification to determine the user's access rights according to the signature verification result.

[0012] Optionally, the calling of a SIM card of a user terminal to which the target application belongs to process the first source data to obtain a digest ciphertext of the first source data and a first signature corresponding to the digest of the first source data includes:

[0013] Determine an encryption method for the first source data, the encryption method comprising a digest algorithm for calculating a digest of the first source data, an encryption algorithm for encrypting the digest to obtain the digest ciphertext, and a signature algorithm for signing the digest to obtain the first signature;

[0014] Determine a key corresponding to the encryption algorithm and a key corresponding to the signature algorithm;

[0015] Encapsulating the encryption method, the key corresponding to the encryption method, and the first source data to obtain an encryption instruction;

[0016] The first source data is processed by calling the SIM card of the user terminal to which the target application belongs through the encryption instruction.

[0017] Optionally, the sending the signature authentication request of the digest ciphertext and the first signature to the control center server of the target application includes:

[0018] The encryption method, the digest ciphertext of the first source data returned by the SIM card and the first signature are encapsulated to obtain the signature authentication request and sent to the control center server.

[0019] Optionally, the first source data includes information of the target smart home device, information of a SIM card of a user terminal to which the target application belongs, and a user ID of the user.

[0020] The step of acquiring the first source data in response to the user triggering the identity authentication operation of the target smart home device includes:

[0021] Scan and obtain information of the target smart home device through the same wireless network accessed by the target application and the target smart home device, where the information of the target smart home device includes a universal unique identification code and a serial number;

[0022] Obtain information of the SIM card through the SIM card-type USB shield integrated in the target application, wherein the information of the SIM card includes a card number, an international mobile subscriber identity code, and a security environment identifier;

[0023] The user identification of the user is obtained through the operation of the user logging into the target application, where the user identification includes the mobile phone number and account ID bound when the user registers the target application.

[0024] In a second aspect, a user identity authentication method for a smart home device is provided, which is applied to a SIM card, and the method includes:

[0025] In response to a call of a target application, processing the first source data to obtain a digest ciphertext of the first source data and a first signature corresponding to the digest of the first source data;

[0026] Signing the data to be signed of the control center server to obtain a signature result, wherein the data to be signed is determined by the control center server after verifying the legitimacy of the user based on the pre-registered binding information, the digest ciphertext and the first signature;

[0027] The signature result is sent to the control center server for signature verification to determine the user's access rights according to the signature verification result.

[0028] Optionally, in response to the call of the target application, processing the first source data to obtain a digest ciphertext of the first source data and a first signature corresponding to the digest of the first source data includes:

[0029] In response to the call of the target application, determining a digest algorithm, an encryption algorithm, and a signature algorithm for processing the first source data;

[0030] Using the digest algorithm, calculating the first source data to obtain a digest;

[0031] Using the encryption algorithm, encrypt the summary to obtain the summary ciphertext;

[0032] The digest is signed using the signature algorithm to obtain the first signature.

[0033] Optionally, the using the encryption algorithm to encrypt the digest to obtain the digest ciphertext includes:

[0034] If the encryption algorithm is an asymmetric encryption algorithm, encrypting the digest based on the public key certificate of the control center server and the encryption algorithm; or

[0035] If the encryption algorithm is a symmetric encryption algorithm, the digest is encrypted based on a session key pre-negotiated between the control center server and the target application and the encryption algorithm.

[0036] In a third aspect, a user identity authentication method for a smart home device is provided, which is applied to a control center server, and the method includes:

[0037] In response to a signature authentication request for a digest ciphertext and a first signature sent by a target application, processing the digest ciphertext and the first signature to obtain first source data;

[0038] If the first source data matches the binding information pre-registered on the control center server, verifying that the user is legitimate;

[0039] Sending the data to be signed of the binding information to the target application to obtain a signature result;

[0040] The signature result is verified to determine the access rights of the user according to the signature verification result.

[0041] Optionally, sending the data to be signed of the binding information to the target application includes:

[0042] Performing a digest calculation on the binding information using a digest algorithm to obtain a digest of the binding information;

[0043] Generate random numbers using chaotic random algorithm;

[0044] The summary of the binding information and the random number are concatenated to obtain the data to be signed and sent to the target application.

[0045] Optionally, the first source data includes information of a target smart home device bound by the user to the target application, information of a SIM card of a user terminal to which the target application belongs, and a user ID of the user,

[0046] The step of responding to the signature authentication request of the digest ciphertext and the first signature sent by the target application, and processing the digest ciphertext and the first signature to obtain the first source data, further includes:

[0047] receiving a registration instruction for the target smart home device sent by the target application, wherein the registration instruction carries information of the target smart home device, information of a SIM card of a user terminal to which the target application belongs, and a user ID of the user;

[0048] Based on the information of the target smart home device, the user identification and the information of the SIM card, binding information including a binding relationship between the smart home device, the user identification and the SIM card is obtained.

[0049] In an embodiment of the present application, a smart home device application obtains first source data by responding to a user triggering an identity authentication operation of a target smart home device, wherein the user is bound to at least the target smart home device on the target application; a SIM card of a user terminal to which the target application belongs is called to process the first source data to obtain a digest ciphertext of the first source data and a first signature corresponding to the digest ciphertext; a signature authentication request of the digest ciphertext and the first signature is sent to a control center server of the target application to obtain data to be signed, wherein the data to be signed is generated after the control center server verifies the legitimacy of the user based on pre-registered binding information, the digest ciphertext and the first signature; the data to be signed is signed based on the SIM card and the signature result is sent to the control center server for signature verification to determine the user's access rights according to the signature verification result, thereby realizing user identity authentication based on the SIM card encrypted signature after the smart home application logs in, accurately determining the trusted terminal user, and the authentication method is easy to use, thereby providing smart home devices with the ability to provide high-security login and security authentication services, and well ensuring the management security of smart home devices and the security of privacy data. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0051] Figure 1 It is a flowchart of a user identity authentication method for a smart home device according to the first embodiment of the present application.

[0052] Figure 2 It is a flowchart of a user identity authentication method for a smart home device according to the second embodiment of the present application.

[0053] Figure 3 It is a schematic diagram of the interaction process between the target application and the SIM card in an embodiment of the present application.

[0054] Figure 4 It is a flowchart of a user identity authentication method for a smart home device according to the third embodiment of the present application.

[0055] Figure 5 It is a flowchart of smart home device registration according to an embodiment of the present application.

[0056] Figure 6 It is the binding information model on the control center server of the embodiment of the present application.

[0057] Figure 7It is a schematic diagram of the overall process of the user identity authentication method of the smart home device in the embodiment of the present application.

[0058] Figure 8 It is an overall timing diagram of the user identity authentication method of the smart home device in the embodiment of the present application.

[0059] Fig. 9 It is a structural block diagram of a user identity authentication device of a smart home device in an embodiment of the present application. DETAILED DESCRIPTION

[0060] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application. The numbering of the drawings in this application is only used to distinguish the various steps in the scheme, and is not used to limit the execution order of the various steps. The specific execution order is subject to the description in the specification.

[0061] In order to solve the problems existing in the prior art, the present application provides a user identity authentication method and device, a system, a readable storage medium, and a computer program product for a smart home device.

[0062] Figure 1 is a flow chart of a method for user identity authentication of a smart home device according to a first embodiment of the present application. The method of this embodiment is applied to a target application, such as Figure 1 As shown, the following steps 102 to 108 are included.

[0063] Step 102: acquiring first source data in response to a user triggering an identity authentication operation of a target smart home device, wherein the user is bound to at least the target smart home device on the target application.

[0064] The target application is a smart home APP that is bound to at least one smart home device and manages it. Users can access and operate the smart home devices bound to the smart home APP, such as Internet of Things (IOT) devices, by operating the smart home APP.

[0065] When a user needs to control a smart home device, or query sensitive or private data on a smart home device, the user can click on the corresponding smart home device on the smart home app to trigger the identity authentication operation of the smart home device, which means that the user identity needs to be authenticated. The identity authentication operation needs to determine the user's access rights. Only when the user passes the identity authentication and has the corresponding access rights can the user perform subsequent control or query operations on the smart home device.

[0066] Optionally, the first source data includes information of the target smart home device, information of the SIM card of the user terminal to which the target application belongs, and a user identifier of the user. In response to the user triggering an identity authentication operation of the target smart home device, obtaining the first source data includes: scanning and obtaining information of the target smart home device through the same wireless network to which the target application and the target smart home device are connected, wherein the information of the target smart home device includes a universal unique identification code and a serial number; obtaining information of the SIM card through a SIM card-type U shield integrated in the target application, wherein the information of the SIM card includes a card number, an international mobile subscriber identity code, and a security environment identifier; obtaining the user identifier of the user through an operation of the user logging into the target application, wherein the user identifier includes a mobile phone number and an account ID bound to the user when registering the target application.

[0067] Specifically, the target smart home device information is scanned and acquired through the same wireless network to which the target application and the target smart home device are connected, such as WIFI. The target smart home device information includes a universally unique identifier (UUID) and a serial number (SID). Furthermore, the device model, device type and other information may also be acquired.

[0068] The information of the SIM card is obtained through the software development kit (SDK) of the SIM card type U shield integrated by the target application. The information of the SIM card includes the card number (Integrate circuit card identity, ICCID), the international mobile subscriber identification number (International Mobile Subscriber Identification Number, IMSI), the security environment identifier (Security environment identifier, SEID) and other information. The SIM card of the embodiment of the present application is a super SIM card with built-in storage, which has a security chip and key storage capability.

[0069] After the user logs in to the target application, the user's user identification is obtained. The user identification includes the mobile phone number and account ID bound when the user registers the target application, and is associated with the mobile phone number and account ID when binding the smart home device to the target application.

[0070] Step 104: calling the SIM card of the user terminal to which the target application belongs to process the first source data to obtain a digest ciphertext of the first source data and a first signature corresponding to the digest ciphertext.

[0071] After acquiring the first source data, the target application calls the SIM card on the user terminal to process the first source data. Specifically, the target application reports the first source data to the SIM card through the Application Protocol Data Unit (APDU) protocol, and the SIM card encrypts and signs the first source data.

[0072] Optionally, the calling of the SIM card of the user terminal to which the target application belongs to process the first source data to obtain a summary ciphertext of the first source data and a first signature corresponding to the summary ciphertext includes: determining an encryption method for the first source data, the encryption method including a summary algorithm for calculating a summary of the first source data, an encryption algorithm for encrypting the summary to obtain the summary ciphertext, and a signature algorithm for signing the summary ciphertext to obtain the first signature; determining a key corresponding to the encryption algorithm and a key corresponding to the signature algorithm; encapsulating the encryption method, the key corresponding to the encryption method, and the first source data to obtain an encryption instruction; and calling the SIM card of the user terminal to which the target application belongs to process the first source data through the encryption instruction.

[0073] The first source data includes a large amount of data, which will significantly increase the consumption of computing resources when encrypted. In order to reduce the consumption of data computing resources, in an embodiment of the present application, the summary of the first source data is first calculated by a summary algorithm, and the large amount of data in the first source data is converted into data of a fixed length, and then encryption and signing are performed based on the summary.

[0074] Then, based on the first source data, the encryption method and the corresponding key, the calling data of the target application is determined, and the format is shown in Table 1 below.

[0075] Table 1

[0076]

[0077]

[0078] When asymmetric encryption is used when encrypting the summary, the key includes the SIM card private key. By adding the index of the SIM card private key in Table 1, it is easy to locate the private key used for encryption. When asymmetric encryption is used when signing the summary ciphertext, the key includes the public key certificate of the control center server. When symmetric encryption is used when encrypting the summary, the key includes the session key pre-negotiated between the control center server and the target application.

[0079] The target application encapsulates the calling data including the encryption method, the corresponding key and the first source data to obtain the encryption instruction.

[0080] The target application defines a unique call data format according to a preset specification, and reports an encryption instruction to the SIM card through a preset protocol. The encryption instruction carries the call data (APP-DATA) in the format of Table 1, and requests the SIM card to encrypt the first source data according to the corresponding encryption method to obtain a corresponding signature result, i.e., the first signature.

[0081] The format of the encryption instruction is shown in Table 2 below:

[0082]

[0083] Step 106, sending a signature authentication request of the digest ciphertext and the first signature to the control center server of the target application to obtain the data to be signed, wherein the data to be signed is generated by the control center server after verifying the legitimacy of the user based on the pre-registered binding information, the digest ciphertext and the first signature.

[0084] The control center server is a server that uniformly connects and manages various smart home apps. The signature authentication request sent by the target application to the control center server is used to request the control center server to provide the data to be signed. The binding information corresponds to the first source data, and the binding information includes the binding relationship between the smart home device, the user identifier, and the SIM card on the user terminal.

[0085] Specifically, sending the signature authentication request of the summary ciphertext and the first signature to the control center server of the target application includes: encapsulating the encryption method, the summary ciphertext of the first source data returned by the SIM card, and the first signature to obtain the signature authentication request and sending it to the control center server.

[0086] After the signature authentication request reaches the control center server, the control center server can use the key corresponding to the encryption method to decrypt the summary ciphertext and verify the first signature, thereby obtaining the first source data.

[0087] The control center server verifies whether the user identity is legal based on the first source data, for example, whether the user who triggers the identity authentication operation of the target smart home device has been registered on the control center server. Specifically, the control center server obtains the binding information pre-registered by the user to determine the relevant information of the smart home device, user identification, and SIM card on the user terminal that has a binding relationship with the user, and matches and compares it with the first source data obtained after the summary ciphertext and the first signature decryption and verification. If it matches, the authenticated user identity is legal, otherwise it is illegal. And after the authenticated user identity is legal, the control center server will provide the data to be signed to the target application, and the data to be signed is generated based on the binding information of the corresponding user. The steps for generating the data to be signed will be described in detail below.

[0088] Step 108: Sign the data to be signed based on the SIM card and send the signature result to the control center server for signature verification to determine the user's access rights according to the signature verification result.

[0089] After receiving the data to be signed from the control center server, the target application needs to continue to call the SIM card to sign the data to be signed. In the embodiment of the present application, the target application sends the data to be signed to the SIM server corresponding to the SIM card, requesting to sign the data. After receiving the data to be signed, the SIM server forms a signature instruction to carry the data to be signed and sends it to the SIM card, requesting the SIM card to sign the data to be signed. The SIM server corresponding to the SIM card is the server provided by the operator where the SIM card is located.

[0090] After the SIM card signs the data to be signed, it returns the signature result to the SIM server, which forwards the signature result to the control center server for verification by the control center server. If the signature data is generated based on the binding information, the verification result matches the binding information of the user stored in the control center server, and the user's identity authentication is passed, the user's access rights are determined to be allowed to perform the next access operation. Otherwise, the user's identity authentication fails, and the user's access rights are determined to be that the user has no right to access the target smart home device.

[0091] In an embodiment of the present application, a smart home device application obtains first source data by responding to a user triggering an identity authentication operation of a target smart home device, wherein the user is bound to at least the target smart home device on the target application; a SIM card of a user terminal to which the target application belongs is called to process the first source data to obtain a digest ciphertext of the first source data and a first signature corresponding to the digest ciphertext; a signature authentication request of the digest ciphertext and the first signature is sent to a control center server of the target application to obtain data to be signed, wherein the data to be signed is generated after the control center server verifies the legitimacy of the user based on pre-registered binding information, the digest ciphertext and the first signature; the data to be signed is signed based on the SIM card and the signature result is sent to the control center server for signature verification to determine the user's access rights according to the signature verification result, thereby realizing user identity authentication based on the SIM card encrypted signature after the smart home application logs in, accurately determining the trusted terminal user, and the authentication method is easy to use, thereby providing smart home devices with the ability to provide high-security login and security authentication services, and well ensuring the management security of smart home devices and the security of privacy data.

[0092] Figure 2 1 is a flow chart of a user identity authentication method for a smart home device according to a second embodiment of the present application, and the method of this embodiment is applied to a SIM card. The steps performed by the components with the same names in this embodiment and the above embodiment are the same, and the relevant description is appropriately omitted to avoid repetition.

[0093] like Figure 2 As shown, the following steps 202 to 206 are included.

[0094] Step 202: In response to the call of the target application, the first source data is processed to obtain a digest ciphertext of the first source data and a first signature corresponding to the digest ciphertext.

[0095] The first source data includes information of the target smart home device bound by the user on the target application, information of the SIM card and the user's user ID, and is obtained by the target application in response to the user triggering the identity authentication operation of the target smart home device. The SIM card and the target application are installed on the same user terminal. After the target application initiates a call through an encryption instruction, the first source data is obtained for encryption and signature processing.

[0096] Specifically, in response to the call of the target application, processing the first source data to obtain a summary ciphertext of the first source data and a first signature corresponding to the summary ciphertext includes: in response to the call of the target application, determining a summary algorithm, an encryption algorithm, and a signature algorithm for processing the first source data; using the summary algorithm, calculating the first source data to obtain a summary; using the encryption algorithm, encrypting the summary to obtain the summary ciphertext; using the signature algorithm, signing the summary ciphertext to obtain the first signature.

[0097] First, the SIM card uses the cryptographic computing capability of the SIM card to perform digest computing on the first source data, and then encrypts the digest of the first source data calculated according to the encryption algorithm in the calling instruction to obtain a digest ciphertext.

[0098] Optionally, the use of the encryption algorithm to encrypt the digest to obtain the summary ciphertext includes: if the encryption algorithm is an asymmetric encryption algorithm, encrypting the digest based on the public key certificate of the control center server and the encryption algorithm; or if the encryption algorithm is a symmetric encryption algorithm, encrypting the digest based on the session key pre-negotiated between the control center server and the target application and the encryption algorithm.

[0099] If the call instruction sent by the target application contains the control center server certificate in Table 1 and the encryption algorithm is an asymmetric encryption algorithm, such as the HMAC algorithm, the summary of the first source data is encrypted using the set encryption algorithm and the control center server public key certificate. The private key certificate corresponding to the control center server public key certificate is used for the subsequent control center server to decrypt the summary ciphertext using the private key certificate after receiving the signature authentication request sent by the target application carrying the summary ciphertext encrypted by the SIM card.

[0100] If the encryption algorithm in the call instruction sent by the target application is a symmetric encryption algorithm, the summary of the first source data is encrypted using the symmetric algorithm and the session key, and the session key is pre-negotiated between the control center server and the target application. After receiving the signature authentication request sent by the target application carrying the summary ciphertext encrypted by the SIM card, the control center server uses the session key to decrypt the summary ciphertext.

[0101] Then, the SIM card signs the summary ciphertext using the index where the SIM card private key is located according to the instructions of Table 1 included in the call instruction. When the SIM card is factory-set, multiple public key and private key pairs are pre-stored. Through the index where the SIM card private key is located, the SIM card can locate the private key required for this signature, and sign the summary ciphertext in combination with the signature algorithm indicated in Table 1 included in the call instruction, and obtain the first signature.

[0102] By storing the encryption operation key in the SIM card, it cannot be obtained from the outside, thus improving the security of the key and preventing the key from being leaked and causing security vulnerabilities.

[0103] The control center server stores the public key of the SIM card, and is used to verify the first signature using the corresponding SIM card public key after receiving a signature authentication request sent by the target application carrying the first signature signed by the SIM card.

[0104] After the above operation is successfully performed, the SIM card returns the relevant information including the digest ciphertext of the first source data and the first signature corresponding to the digest ciphertext to the target application. The data format of the returned information is shown in Table 3 below, including the status code, the digest ciphertext, and the first signature.

[0105] Table 3

[0106] Status Code Abstract Ciphertext First Signature

[0107] The status codes are shown in Table 4 below, represented by SW1 and SW2:

[0108] Table 4

[0109] SW1 SW2 describe 90 00 Correct execution 67 00 Wrong length (Lc is empty) 69 82 The referenced algorithm is not supported 6A 88 The referenced application does not exist 6A 94 The referenced index does not exist 6A 95 The corresponding key does not exist in the index

[0110] Subsequently, the target application sends a signature authentication request to the control center server according to the digest ciphertext and the first signature returned by the SIM card.

[0111] Step 204, signing the data to be signed of the control center server to obtain a signature result, wherein the data to be signed is determined by the control center server after verifying the legitimacy of the user based on the pre-registered binding information, the digest ciphertext and the first signature.

[0112] As described above, after receiving the signature authentication request from the target application, the control center server verifies the legitimacy of the user by matching the pre-registered binding information with the digest ciphertext and the first signature, and then determines the data to be signed and sends it to the target application. The target application can send a signature instruction to the SIM card via the SIM server, and the SIM card signs the data to be signed carried in the received signature instruction.

[0113] Specifically, the SIM card signs the data to be signed using the signature algorithm and the private key of the SIM card to obtain a corresponding signature result.

[0114] Step 206: Send the signature result to the control center server for signature verification to determine the user's access rights according to the signature verification result.

[0115] The signature result of the SIM card can be sent to the control center server through the SIM server. The control center server uses the corresponding SIM card private key to verify the signature result, thereby determining the user's access rights based on the verification result.

[0116] Figure 3 is a schematic diagram of a partial interaction process between the target application and the SIM card in an embodiment of the present application, such as Figure 3 As shown, the following steps are included:

[0117] Step 1002, the smart home APP, i.e. the target application, scans the code to obtain IOT device information, i.e. the smart home device information, and obtains SIM card related information through the APDU protocol;

[0118] Step 1004, the smart home APP reports SIM card information, IOT device information, mobile phone number and other data to the SIM card through the APDU protocol, and the SIM card completes the summary calculation, encryption and signature of the data;

[0119] Step 1006, after receiving the instruction sent by the smart home device, the application of the SIM card analyzes and executes the instruction;

[0120] Step 1008: The SIM card returns an encryption result including a digest ciphertext and a first signature, and the smart home APP uploads the encryption result to the control center server of the smart home device.

[0121] In an embodiment of the present application, the SIM card processes the first source data in response to a call of the target application to obtain a summary ciphertext of the first source data and a first signature corresponding to the summary ciphertext; signs the data to be signed of the control center server to obtain a signature result, wherein the data to be signed is determined by the control center server after verifying the legitimacy of the user based on pre-registered binding information, the summary ciphertext and the first signature; and sends the signature result to the control center server for signature verification to determine the user's access rights according to the signature verification result. As a result, after the smart home application is logged in, user identity authentication based on the SIM card encrypted signature can be implemented, and the trusted terminal user can be accurately determined. The authentication method is easy to use, thereby providing smart home devices with the ability to provide high-security login and security authentication services, and well ensuring the management security of smart home devices and the security of privacy data.

[0122] Figure 4 1 is a flowchart of a method for user identity authentication of a smart home device in the third embodiment of the present application, and the method of this embodiment is applied to a control center server. The steps performed by the components with the same names in this embodiment and the above embodiments are the same, and the relevant description is appropriately omitted to avoid repetition.

[0123] like Figure 4As shown, the following steps 302 to 308 are included.

[0124] Step 302: In response to a signature authentication request for a digest ciphertext and a first signature sent by a target application, the digest ciphertext and the first signature are processed to obtain first source data.

[0125] The control center server decrypts and verifies the digest ciphertext and the first signature used for user identity authentication according to the encryption method in the signature authentication request.

[0126] First, the control center server decrypts the summary ciphertext sent by the target application. If the encryption algorithm in the signature authentication request is an asymmetric algorithm, the control center server's private key certificate is used to decrypt the summary ciphertext to obtain the summary; if the encryption algorithm in the signature authentication request is a symmetric algorithm, the session key is used to decrypt the summary ciphertext to obtain the summary.

[0127] Secondly, the control center server verifies the first signature sent by the target application using the public key of the SIM card to obtain a summary. The summary of the verification result is compared with the decrypted summary of the previous step. If the data is consistent, the data has not been tampered with and the data is credible. The first source data is decrypted based on the summary. If the data is inconsistent, the data is untrustworthy and the subsequent steps are terminated.

[0128] Step 304: If the first source data matches the binding information pre-registered on the control center server, the user is verified to be legitimate.

[0129] The binding information model established between the first source data and the control center server is used to identify whether the user in the signature authentication request is legitimate. Figure 5 As shown, it is established by the control center server when the user registers the target smart home device on the control center server.

[0130] Optionally, the first source data includes information of a target smart home device bound by the user on the target application, information of a SIM card of a user terminal to which the target application belongs, and a user identifier of the user. The response to the signature authentication request of the summary ciphertext and the first signature sent by the target application, before processing the summary ciphertext and the first signature to obtain the first source data, also includes: receiving a registration instruction for the target smart home device sent by the target application, the registration instruction carrying information of the target smart home device, information of the SIM card of the user terminal to which the target application belongs, and the user identifier of the user; and obtaining binding information including a binding relationship between the smart home device, the user identifier, and the SIM card based on the information of the target smart home device, the user identifier, and the SIM card.

[0131] The user can send a registration instruction to the control center server through the target application. The registration instruction carries information of the target smart home device, information of the SIM card of the user terminal to which the target application belongs, and user information of the user, including a user identifier. The registration instruction includes at least information consistent with the first source data.

[0132] Figure 5 : is a schematic diagram of the process of smart home device registration in an embodiment of the present application, such as Figure 5 As shown, the following steps are included:

[0133] Step 3002, the control center server of the smart home receives a registration instruction of a smart home device such as an IOT device. In this embodiment, the registration instruction includes information of the IOT device, information of the SIM card and user information of the user, which are encrypted and signed based on a preset password operation method.

[0134] Step 3004: the control center server of the smart home decrypts and verifies the ciphertext according to the cryptographic operation method to obtain the information of the IOT device, the information of the SIM card and the user information of the user.

[0135] Step 3006, based on the information of the IOT device, the information of the SIM card and the user information of the user, a user binding information model is established to complete the binding of the IOT device, the SIM card and the user.

[0136] Figure 6 It is the binding information model on the control center server of the embodiment of the present application.

[0137] After the control center server obtains the smart home device information 20, SIM card information 30 and user information 10, it establishes an association relationship between the three according to the designed binding information model, realizes the binding of the smart home device, SIM card and user registration, and forms complete user identity authentication information.

[0138] For example Figure 6 As shown, user information 10 includes user ID (userId), name (name), role (role), telephone number (telephone), email (email), department (department), and comment (comment); smart home device information 20 includes user ID, device SID (iot_sid), device UUID (iot_uuid), device type (iot_type), and device brand (iot_brand). SIM card information 30 includes user ID, card ICCID (sim_iccid), card IMSI (sim_imsi), card SEID (sim_seid), and card serial number (sim_sid).

[0139] When the target application is used for the first time, it is necessary to register the relevant account with the control center server and bind the user's mobile phone number. The direct data transmission between the target application and the control center server can adopt two-way authentication technology to ensure the confidentiality of the registration information.

[0140] If the first source data completely matches the binding information pre-registered on the control center server, the user's identity is verified to be legitimate and the next step is performed. Otherwise, the user's identity authentication fails and the user has no right to access the target smart home device.

[0141] Step 306: Send the data to be signed of the binding information to the target application to obtain a signature result.

[0142] Specifically, sending the data to be signed of the binding information to the target application includes: using a digest algorithm to perform a digest calculation on the binding information to obtain a digest of the binding information; using a chaotic random algorithm to generate a random number; splicing the digest of the binding information and the random number to obtain the data to be signed and sending it to the target application.

[0143] The control center server performs a summary operation on the user binding information model data, and uses the summary information and the random number generated by the chaotic random algorithm to form the data to be signed. The embodiment of the present application can generate a random sequence that effectively prevents the degradation of the limited word length through the chaotic random algorithm, improves the anti-degradation and randomness, and makes the data to be signed more unpredictable and more secure, while the summary information of the user binding information model data can provide the feasibility of authenticating the user.

[0144] The chaotic random algorithm of the embodiment of the present application adopts the basic formula for generating a chaotic random sequence that is resistant to degradation:

[0145]

[0146] X n =X n+1 (3)

[0147] Among them, X n is the feedback input value of the chaotic random sequence generator; b m is the chaotic sequence control parameter of the chaotic random sequence generator; X n+1 Output value for chaotic random sequence; is the correction coefficient, t0 is the starting time for generating random numbers; k is a constant used to correct t0.

[0148] By combining equations (1), (2), and (3), we can select appropriate initial values ​​and iteration coefficients b. m, under the condition of limited word length, a chaotic sequence of any length can be generated, and the random performance can still be guaranteed not to degrade, so as to ensure the quality of random sequence generation. The constraint condition is that when the number of iterations is m, it cannot satisfy π≤X n ≤0.6, restart the iteration until the condition is met.

[0149] The control center server sends the data to be signed of the binding information to the target application, and the target application then sends the data to be signed to the SIM server. The SIM server forms an instruction and requests the SIM card to sign the data to be signed.

[0150] Step 308: Verify the signature result to determine the user's access rights according to the verification result.

[0151] The signature result obtained after the SIM card signs the data to be signed can be forwarded to the control center server through the SIM server. After receiving the signature result forwarded by the SIM server, the control center server uses the public key of the SIM card to verify the signature result, and compares the data obtained by the verification with the summary information and random number generated by the original binding information of the control center server. If they match, the user identity authentication is passed; otherwise, the user identity authentication fails and the user has no right to access the target smart home device.

[0152] In an embodiment of the present application, the control center server processes the summary ciphertext and the first signature in response to a signature authentication request for the summary ciphertext and the first signature sent by the target application to obtain the first source data; if the first source data matches the binding information pre-registered on the control center server, the user is verified to be legitimate; the data to be signed of the binding information is sent to the target application to obtain a signature result; the signature result is verified to determine the user's access rights based on the signature verification result, thereby realizing user identity authentication based on the SIM card encrypted signature after logging in to the smart home application, accurately determining the trusted terminal user, and the authentication method is easy to use, thereby providing smart home devices with the ability to provide high-security login and security authentication services, and well ensuring the management security of smart home devices and the security of privacy data.

[0153] Figure 7 FIG. 1 is a schematic diagram of the overall process of the user identity authentication method of the smart home device according to the embodiment of the present application. Figure 7 As shown, including:

[0154] Step 2002: When a user uses a smart home APP to control an IOT device, user identification or authentication is triggered to obtain information related to the IOT device and the SIM card;

[0155] Step 2004, the smart home APP reports SIM card information, obtains IOT device information, mobile phone number and other data to the SIM card through APDU protocol for encryption and signature;

[0156] Step 2006, after receiving the instruction sent by the smart home device, the SIM card application analyzes and executes the instruction;

[0157] Step 2008, the smart home APP sends a signature authentication request to the control center server of the smart home device;

[0158] Step 210, the control center server of the smart home device verifies the legitimacy of the authenticated user;

[0159] Step 212, the control center server of the smart home device generates data to be signed based on an anti-degradation chaotic random algorithm;

[0160] Step 2014: the smart home APP sends a signature request to the super SIM server, and the super SIM server sends a signature instruction to the SIM card;

[0161] Step 216: The SIM card signs the data and returns the signature result, and the super SIM server forwards the signature result to the control center server of the smart home device;

[0162] In step 2018, the control center server of the smart home device verifies the signature data.

[0163] Figure 8 is an overall timing diagram of the user identity authentication method of the smart home device in the embodiment of the present application, such as Figure 8 As shown, the following steps are included:

[0164] 1. When the user registers, the target application obtains the corresponding smart home device information from the smart home device;

[0165] 2. The target application obtains the corresponding SIM card information from the SIM card;

[0166] 3. The target application requests the SIM card to encrypt the information of the SIM card, smart home devices and users, and verify the signature of the information to obtain the corresponding ciphertext and signature;

[0167] 4. The target application uploads the ciphertext and signature to the control center server;

[0168] 5. The control center server obtains the user's registered SIM card, smart home device and user information by decrypting and verifying the signature, forming binding information;

[0169] 6. The user triggers the identity authentication operation of the smart home device through the target application;

[0170] 7. The target application obtains SIM card information and smart home device information and sends it to the control center server;

[0171] 8. The control center server verifies the legitimacy of the user's identity;

[0172] 9. When the user identity is legitimate, the control center server sends the data to be signed to the SIM server;

[0173] 10. The SIM server sends a signature instruction based on the data to be signed to the SIM card;

[0174] 11. The SIM card returns the signature result to the SIM server;

[0175] 12. The SIM server forwards the signature result to the control center server;

[0176] 13. The control center server verifies the signature result;

[0177] 14. The control center server returns the identity authentication result to the target application;

[0178] 15. Identity authentication is successful and the user can proceed to the next step.

[0179] The user identity authentication of the smart home device in the embodiment of the present application can perform identity authentication based on the SIM card when the user triggers the identity authentication operation of the target smart home device. The user does not need to enter a username and password, and the authentication-related data is not easy to crack. The security of smart home device data access is achieved while reducing the user's memory burden.

[0180] Optionally, an embodiment of the present application further provides a user identity authentication system for smart home devices, including the target application, SIM card and control center server of the above embodiment.

[0181] Alternatively, if Fig. 9 As shown, the embodiment of the present application also provides a user identity authentication device 2000 for a smart home device, including a processor 2400 and a memory 2200. The memory 2200 stores a program or instruction that can be run on the processor 2400. When the program or instruction is executed by the processor 2400, each step of the user identity authentication method embodiment of the above-mentioned smart home device is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0182] The embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of any of the above-mentioned user identity authentication methods for smart home devices can be implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. Among them, the readable storage medium includes a computer-readable storage medium, such as a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0183] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. The computer program can be operated to enable a computer to implement each process of any of the above-mentioned user identity authentication method embodiments of smart home devices when executed, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0184] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0185] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0186] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A user identity authentication method for a smart home device, characterized in that: Applied to the target application, the method comprises: In response to a user triggering an identity authentication operation of a target smart home device, acquiring first source data, wherein the user is bound to at least the target smart home device on the target application; Invoking a SIM card of a user terminal to which the target application belongs to process the first source data to obtain a digest ciphertext of the first source data and a first signature corresponding to the digest of the first source data; Sending a signature authentication request of the digest ciphertext and the first signature to the control center server of the target application to obtain data to be signed, wherein the data to be signed is generated by the control center server after verifying the legitimacy of the user based on pre-registered binding information, the digest ciphertext and the first signature; The data to be signed is signed based on the SIM card and the signature result is sent to the control center server for signature verification to determine the user's access rights according to the signature verification result.

2. The method according to claim 1, characterized in that The calling of the SIM card of the user terminal to which the target application belongs to process the first source data to obtain a digest ciphertext of the first source data and a first signature corresponding to the digest of the first source data, includes: Determine an encryption method for the first source data, the encryption method comprising a digest algorithm for calculating a digest of the first source data, an encryption algorithm for encrypting the digest to obtain the digest ciphertext, and a signature algorithm for signing the digest to obtain the first signature; Determine a key corresponding to the encryption algorithm and a key corresponding to the signature algorithm; Encapsulating the encryption method, the key corresponding to the encryption method, and the first source data to obtain an encryption instruction; The first source data is processed by calling the SIM card of the user terminal to which the target application belongs through the encryption instruction.

3. The method according to claim 2, characterized in that The sending of the signature authentication request of the digest ciphertext and the first signature to the control center server of the target application includes: The encryption method, the digest ciphertext of the first source data returned by the SIM card and the first signature are encapsulated to obtain the signature authentication request and sent to the control center server.

4. The method according to claim 1, characterized in that The first source data includes information of the target smart home device, information of a SIM card of a user terminal to which the target application belongs, and a user ID of the user, The step of acquiring the first source data in response to the user triggering the identity authentication operation of the target smart home device includes: Scan and obtain information of the target smart home device through the same wireless network accessed by the target application and the target smart home device, where the information of the target smart home device includes a universal unique identification code and a serial number; Obtain information of the SIM card through the SIM card-type USB shield integrated in the target application, wherein the information of the SIM card includes a card number, an international mobile subscriber identity code, and a security environment identifier; The user identification of the user is obtained through the operation of the user logging into the target application, where the user identification includes the mobile phone number and account ID bound when the user registers the target application.

5. A user identity authentication method for a smart home device, characterized in that: Applied to a SIM card, the method comprises: In response to a call of a target application, processing the first source data to obtain a digest ciphertext of the first source data and a first signature corresponding to the digest of the first source data; Signing the data to be signed of the control center server to obtain a signature result, wherein the data to be signed is determined by the control center server after verifying the legitimacy of the user based on the pre-registered binding information, the digest ciphertext and the first signature; The signature result is sent to the control center server for signature verification to determine the user's access rights according to the signature verification result.

6. The method according to claim 5, characterized in that The step of processing the first source data in response to the call of the target application to obtain a digest ciphertext of the first source data and a first signature corresponding to the digest of the first source data includes: In response to the call of the target application, determining a digest algorithm, an encryption algorithm, and a signature algorithm for processing the first source data; Using the digest algorithm, calculating the first source data to obtain a digest; Using the encryption algorithm, encrypt the summary to obtain the summary ciphertext; The digest is signed using the signature algorithm to obtain the first signature.

7. The method according to claim 6, characterized in that The step of using the encryption algorithm to encrypt the digest to obtain the digest ciphertext includes: If the encryption algorithm is an asymmetric encryption algorithm, encrypting the digest based on the public key certificate of the control center server and the encryption algorithm; or If the encryption algorithm is a symmetric encryption algorithm, the digest is encrypted based on a session key pre-negotiated between the control center server and the target application and the encryption algorithm.

8. A user identity authentication method for a smart home device, characterized in that: Applied to the control center server, the method includes: In response to a signature authentication request for a digest ciphertext and a first signature sent by a target application, processing the digest ciphertext and the first signature to obtain first source data; If the first source data matches the binding information pre-registered on the control center server, verifying that the user is legitimate; Sending the data to be signed of the binding information to the target application to obtain a signature result; The signature result is verified to determine the access rights of the user according to the signature verification result.

9. The method according to claim 8, characterized in that The sending the data to be signed of the binding information to the target application includes: Performing a digest calculation on the binding information using a digest algorithm to obtain a digest of the binding information; Generate random numbers using chaotic random algorithm; The summary of the binding information and the random number are concatenated to obtain the data to be signed and sent to the target application.

10. The method according to claim 8, characterized in that The first source data includes information of a target smart home device bound by the user to the target application, information of a SIM card of a user terminal to which the target application belongs, and a user ID of the user, The step of responding to the signature authentication request of the digest ciphertext and the first signature sent by the target application, and processing the digest ciphertext and the first signature to obtain the first source data, further includes: receiving a registration instruction for the target smart home device sent by the target application, wherein the registration instruction carries information of the target smart home device, information of a SIM card of a user terminal to which the target application belongs, and a user identifier of the user; Based on the information of the target smart home device, the user identification and the information of the SIM card, binding information including a binding relationship between the smart home device, the user identification and the SIM card is obtained.

Images