Internet of Things data processing method and system based on blockchain

Abstract

The present invention provides a blockchain-based Internet of Things data processing method and system, which relates to the field of blockchain technology, including: an Internet of Things device uses a pre-stored private key to digitally sign the authentication request to generate a signed authentication request; a smart contract in a blockchain network receives the signed authentication request, and the smart contract generates an authentication token including an authentication result, a validity period and an authorization level based on the historical authentication record, a reputation score, a current timestamp and a challenge value; the Internet of Things device receives the encrypted authentication token and the smart contract address; the Internet of Things device configures its own access rights and function restrictions according to the authentication result, validity period and authorization level; and the Internet of Things device uses the smart contract address as an identity credential during the validity period for subsequent secure communication and data exchange with other Internet of Things devices or applications.

Description

Technical Field

[0001] The present invention relates to blockchain technology, and in particular to a blockchain-based Internet of Things data processing method and system. Background Art

[0002] With the rapid development of IoT technology, the number of smart devices connected to the network has increased exponentially. These devices are widely used in smart homes, industrial control, medical health, smart cities and other fields, bringing great convenience to people's lives and work. However, the security issues of IoT devices are becoming increasingly prominent, becoming an important factor restricting the further development of IoT.

[0003] Traditional IoT device security authentication methods mainly rely on centralized authentication servers. This method has the following problems:

[0004] Single point failure risk: Once the centralized authentication server is attacked or fails, the security of the entire IoT system will be seriously threatened. Poor scalability: With the surge in the number of IoT devices, the processing capacity of the centralized authentication server may not be able to meet the needs of large-scale authentication. Insufficient privacy protection: The centralized authentication server stores a large amount of sensitive information and is easily targeted by hackers. Once the information is leaked, it will cause serious privacy leakage problems. Difficult to confirm the identity of the device: In a complex IoT environment, it is difficult to ensure the true identity of each device, and there is a risk of device forgery and identity theft. Lack of transparency in the authentication process: The traditional authentication process is opaque to users, difficult to trace and audit, and is not conducive to establishing a trust mechanism.

[0005] In order to solve the above problems, researchers began to explore the application of blockchain technology to IoT device security authentication. Blockchain technology has the characteristics of decentralization, immutability, and traceability, which provides a new idea for IoT device security authentication. However, the application of blockchain technology to IoT device security authentication still faces the following challenges:

[0006] Performance bottleneck: The transaction processing capacity of the blockchain system is limited, and it is difficult to meet the real-time authentication requirements of large-scale IoT devices. Resource constraints: Most IoT devices have limited computing power and storage space, making it difficult to directly participate in complex blockchain operations.

[0007] Privacy protection: Although blockchain is anonymous, the disclosure of transaction information may lead to the analysis of device usage patterns, thereby leaking user privacy. Key management: The key management of IoT devices is complex, and how to securely store and update keys is a challenge.

[0008] Therefore, there is an urgent need for a new blockchain-based IoT device security authentication method that can fully utilize the advantages of blockchain technology, solve the above challenges, and provide an efficient, secure, and scalable authentication mechanism for IoT devices. Summary of the invention

[0009] The embodiments of the present invention provide a blockchain-based Internet of Things data processing method and system, which can solve the problems in the prior art.

[0010] According to a first aspect of the embodiments of the present invention,

[0011] Provides a blockchain-based IoT data processing method, including:

[0012] The IoT device generates an authentication request, the authentication request including a unique identifier of the IoT device, a current timestamp, and a randomly generated challenge value; the IoT device digitally signs the authentication request using a pre-stored private key to generate a signed authentication request; the IoT device sends the signed authentication request to a smart contract in the blockchain network;

[0013] The smart contract in the blockchain network receives the signed authentication request, and the smart contract verifies the validity of the signed authentication request using the pre-stored public key of the IoT device; the smart contract queries the historical authentication record and reputation score of the IoT device in the blockchain according to the unique identifier of the IoT device; the smart contract generates an authentication token including the authentication result, validity period and authorization level based on the historical authentication record, reputation score, current timestamp and challenge value; the smart contract encrypts the authentication token using a predefined encryption algorithm to generate an encrypted authentication token; the smart contract packages the encrypted authentication token and a smart contract address dynamically generated based on the authentication result as an encrypted data packet and returns it to the IoT device;

[0014] The IoT device receives the encrypted authentication token and smart contract address; the IoT device decrypts the encrypted authentication token using a pre-agreed decryption algorithm to obtain the authentication result, validity period and authorization level; the IoT device configures its own access rights and functional restrictions based on the authentication result, validity period and authorization level; during the validity period, the IoT device uses the smart contract address as an identity credential for subsequent secure communication and data exchange with other IoT devices or applications; before each data exchange, the IoT device sends a verification request to the smart contract address, the smart contract verifies the current status and permissions of the IoT device, and returns the verification result; the IoT device decides whether to continue data exchange based on the verification result.

[0015] In an optional embodiment,

[0016] The IoT device uses a pre-stored private key to digitally sign the authentication request, and the generated signed authentication request includes:

[0017] The IoT device generates an authentication request including a unique device identifier, a current timestamp, and a randomly generated challenge value; the IoT device performs hash processing on the authentication request using a cryptographic hash function to generate a hash value of a fixed length;

[0018] The IoT device securely calls a pre-stored private key from the hardware security module; the IoT device encrypts the hash value using an asymmetric encryption algorithm to generate a digital signature;

[0019] The IoT device combines the authentication request and the digital signature to form a signed authentication request; wherein the signed authentication request includes an authentication request field and a signature field, the authentication request field contains a device unique identifier, a current timestamp, and a randomly generated challenge value, and the signature field contains a digital signature generated using a private key.

[0020] In an optional embodiment,

[0021] Based on the historical authentication records, reputation score, current timestamp and challenge value, the smart contract generates an authentication token containing the authentication result, validity period and authorization level, including:

[0022] The smart contract receives and verifies the signed authentication request sent by the IoT device; the smart contract retrieves the historical authentication record of the IoT device in the blockchain according to the device unique identifier in the signed authentication request; the smart contract uses a time series analysis algorithm to analyze the historical authentication record and evaluate the authentication mode of the IoT device;

[0023] The smart contract calculates the reputation score of the IoT device based on the historical authentication records, wherein the calculation of the reputation score takes into account the ratio of the number of successful authentications to the total number of authentications, the time weight of the most recent authentication behavior, and the activity and contribution of the IoT device in the network; the smart contract normalizes the reputation score and maps it to a range of 0-100;

[0024] The smart contract verifies whether the timestamp in the signed authentication request is within a preset time window, and checks the uniqueness of the challenge value in the authentication request; the smart contract generates an authentication token based on the authentication mode, the reputation score, the timestamp and the challenge value, and the authentication token includes an authentication result, a validity period, an authorization level, a device unique identifier, a token generation time and a randomly generated token ID; wherein the validity period is dynamically set according to the reputation score, and the authorization level is determined according to the reputation score and the authentication mode; the smart contract constructs the authentication token using the JSON Web Token format.

[0025] In an optional embodiment,

[0026] The smart contract encrypts the authentication token using a predefined encryption algorithm, and generates an encrypted authentication token including:

[0027] The smart contract generates a 256-bit advanced encryption standard key using a cryptographically secure random number generator; generates a 96-bit random initialization vector; uses the advanced encryption standard key and the random initialization vector to encrypt the authentication token using the Galois / Counter Mode of the advanced encryption standard to generate a ciphertext and an authentication tag;

[0028] The smart contract combines the ciphertext, the random initialization vector and the authentication tag into an encrypted token structure; uses a pre-stored IoT device public key to asymmetrically encrypt the advanced encryption standard key to generate an encrypted advanced encryption standard key;

[0029] The encrypted token structure and the encrypted Advanced Encryption Standard key are combined into a final encrypted data packet as an encrypted authentication token.

[0030] In an optional embodiment,

[0031] The IoT device decrypts the encrypted authentication token using a pre-agreed decryption algorithm to obtain the authentication result, validity period, and authorization level; the IoT device configures its own access rights and function restrictions based on the authentication result, validity period, and authorization level, including:

[0032] The IoT device receives an encrypted data packet, wherein the encrypted data packet also includes an encrypted authentication token structure and an encrypted advanced encryption standard key; the IoT device extracts the encrypted advanced encryption standard key from the encrypted data packet; and decrypts the encrypted advanced encryption standard key using a pre-stored asymmetric encryption private key to obtain a decrypted advanced encryption standard key;

[0033] The IoT device extracts the initialization vector, ciphertext and authentication tag from the encrypted authentication token structure; the IoT device creates an advanced encryption standard Galois / counter mode decryptor, the decryptor uses the decrypted advanced encryption standard key and the initialization vector; uses the decryptor to decrypt the ciphertext, and uses the authentication tag to verify the integrity of the decryption result, thereby obtaining a decrypted authentication token;

[0034] The IoT device verifies the digital signature of the decrypted authentication token to ensure the authenticity of the decrypted authentication token; the IoT device parses the decrypted authentication token to extract the authentication result, expiration time and authorization level; the IoT device compares the current time with the expiration time to determine whether the decrypted authentication token is valid; when the decrypted authentication token is valid, the IoT device configures its own access rights and function restrictions according to the authentication result and authorization level;

[0035] A periodic check thread is started, and the periodic check thread compares the current time with the expiration time at a predetermined time interval; when the current time is close to the expiration time, the periodic check thread triggers the IoT device to re-request a new authentication token; the IoT device receives a new encrypted data packet in response to the new authentication token request; and uses the information in the new encrypted data packet to update its own access rights and functional restrictions.

[0036] In an optional embodiment,

[0037] Before each data exchange, the IoT device sends a verification request to the smart contract address. The smart contract verifies the current status and permissions of the IoT device and returns the verification result. The IoT device decides whether to continue the data exchange based on the verification result, including:

[0038] The IoT device generates a verification request, the verification request including a device identifier, a current timestamp, a requested operation type, a random number, and a device signature, wherein the device signature is a signature of a hash value obtained by performing a hash operation on a combination of the device identifier, the current timestamp, the requested operation type, and the random number using a private key of the IoT device;

[0039] The IoT device sends the verification request to the smart contract address;

[0040] The smart contract receives the verification request, verifies the validity of the device signature using the public key of the IoT device, checks whether the current timestamp is within the valid time range, verifies whether the random number has not been used, obtains the current status information of the IoT device from the blockchain, and determines whether the IoT device has the authority to execute the operation type of the verification request based on the current status information and the operation type of the verification request;

[0041] The smart contract generates a verification response, the verification response includes a verification result, a smart contract processing timestamp, an operation permission, and a smart contract signature, wherein the smart contract signature is obtained by the smart contract signing a combination of the verification result, the smart contract processing timestamp, and the operation permission;

[0042] The smart contract sends the verification response to the IoT device; the IoT device receives the verification response, verifies the validity of the smart contract signature, checks whether the smart contract processing timestamp is within the valid time range, and parses the verification result and the operation authority;

[0043] The IoT device decides whether to continue data exchange according to the verification result. When the verification result is passed and the operation permission includes the required permission, the IoT device performs the data exchange operation. When the verification result is not passed or the operation permission does not include the required permission, the IoT device terminates the data exchange operation and records a log.

[0044] The IoT device starts a continuous monitoring thread, which repeats monitoring at a predetermined time interval. When the number of consecutive verification failures reaches a preset threshold, the IoT device enters a restricted mode and triggers a re-authentication process.

[0045] According to a second aspect of the embodiments of the present invention,

[0046] Provides a blockchain-based IoT data processing system, including:

[0047] The first unit is used for the IoT device to generate an authentication request, wherein the authentication request includes a unique identifier of the IoT device, a current timestamp, and a randomly generated challenge value; the IoT device digitally signs the authentication request using a pre-stored private key to generate a signed authentication request; and the IoT device sends the signed authentication request to a smart contract in a blockchain network;

[0048] The second unit is used for a smart contract in a blockchain network to receive the signed authentication request, and the smart contract uses a pre-stored public key of the IoT device to verify the validity of the signed authentication request; the smart contract queries the blockchain for the historical authentication record and reputation score of the IoT device according to the unique identifier of the IoT device; the smart contract generates an authentication token including the authentication result, validity period and authorization level based on the historical authentication record, reputation score, current timestamp and challenge value; the smart contract encrypts the authentication token using a predefined encryption algorithm to generate an encrypted authentication token; the smart contract packages the encrypted authentication token and a smart contract address dynamically generated based on the authentication result as an encrypted data packet and returns it to the IoT device;

[0049] The third unit is used for the IoT device to receive the encrypted authentication token and smart contract address; the IoT device uses a pre-agreed decryption algorithm to decrypt the encrypted authentication token to obtain the authentication result, validity period and authorization level; the IoT device configures its own access rights and functional restrictions according to the authentication result, validity period and authorization level; during the validity period, the IoT device uses the smart contract address as an identity credential for subsequent secure communication and data exchange with other IoT devices or applications; before each data exchange, the IoT device sends a verification request to the smart contract address, the smart contract verifies the current status and permissions of the IoT device, and returns the verification result; the IoT device decides whether to continue data exchange based on the verification result.

[0050] According to a third aspect of the embodiments of the present invention,

[0051] An electronic device is provided, comprising:

[0052] processor;

[0053] a memory for storing processor-executable instructions;

[0054] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0055] A fourth aspect of the embodiments of the present invention is:

[0056] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0057] The present invention builds a multi-level security authentication mechanism by combining the unique identifier of the IoT device, private key signature, smart contract verification and dynamically generated authentication tokens. The tamper-proof nature of the blockchain ensures the reliability of the authentication record, while the dynamic authorization mechanism based on historical authentication records and reputation scores can effectively prevent device identity forgery and unauthorized access. At the same time, the real-time verification mechanism before each data exchange further enhances the security of the system and effectively reduces potential security risks.

[0058] The present invention adopts smart contracts for authentication management, and realizes flexible permission control and identity management through dynamically generated authentication tokens and smart contract addresses. The validity period and authorization level contained in the authentication token enable the system to dynamically adjust its permissions according to the real-time status and reputation of the device, thereby improving the adaptability of the system. In addition, the distributed architecture based on blockchain and the programmable characteristics of smart contracts make the authentication method have good scalability and can easily adapt to the growing scale of IoT devices.

[0059] The present invention uses pre-stored keys, lightweight encryption algorithms and smart contract addresses as identity credentials, which reduces the computational burden in the authentication process and is suitable for resource-constrained IoT devices. The use of authentication tokens reduces the need for frequent authentication, while the real-time verification mechanism ensures security, achieving a good balance between security and efficiency. In addition, the entire authentication process is transparent to users and does not require manual intervention, greatly improving the user experience. At the same time, based on the distributed characteristics of blockchain, the availability and reliability of the system are improved, and the risk of single point failure of centralized authentication systems is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is a flowchart of a method for processing IoT data based on blockchain according to an embodiment of the present invention;

[0061] Figure 2 This is a schematic diagram of the structure of an Internet of Things data processing system based on blockchain according to an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0063] Figure 1 FIG. 1 is a flow chart of a method for processing IoT data based on blockchain according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0064] S101. The IoT device generates an authentication request, wherein the authentication request includes a unique identifier of the IoT device, a current timestamp, and a randomly generated challenge value; the IoT device digitally signs the authentication request using a pre-stored private key to generate a signed authentication request; the IoT device sends the signed authentication request to a smart contract in the blockchain network;

[0065] S102. The smart contract in the blockchain network receives the signed authentication request, and the smart contract verifies the validity of the signed authentication request using the pre-stored public key of the IoT device; the smart contract queries the blockchain for the historical authentication record and reputation score of the IoT device according to the unique identifier of the IoT device; the smart contract generates an authentication token including the authentication result, validity period and authorization level based on the historical authentication record, reputation score, current timestamp and challenge value; the smart contract encrypts the authentication token using a predefined encryption algorithm to generate an encrypted authentication token; the smart contract packages the encrypted authentication token and a smart contract address dynamically generated based on the authentication result as an encrypted data packet and returns it to the IoT device;

[0066] S103. The IoT device receives the encrypted authentication token and smart contract address; the IoT device decrypts the encrypted authentication token using a pre-agreed decryption algorithm to obtain the authentication result, validity period and authorization level; the IoT device configures its own access rights and functional restrictions based on the authentication result, validity period and authorization level; during the validity period, the IoT device uses the smart contract address as an identity credential for subsequent secure communication and data exchange with other IoT devices or applications; before each data exchange, the IoT device sends a verification request to the smart contract address, and the smart contract verifies the current status and permissions of the IoT device and returns the verification result; the IoT device decides whether to continue data exchange based on the verification result.

[0067] For example,

[0068] The IoT device first generates an authentication request. The authentication request includes three key pieces of information: the unique identifier of the IoT device, the current timestamp, and a randomly generated challenge value. The unique identifier can be a string that can uniquely identify the device, such as the device's MAC address or serial number, such as "IoT-Device-001". The current timestamp uses the Unix timestamp format, accurate to milliseconds, such as "1623456789000". The randomly generated challenge value is a 32-byte random string used to prevent replay attacks, such as "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6".

[0069] Next, the IoT device uses the private key pre-stored in its secure storage area to digitally sign the authentication request. The digital signature uses the ECDSA algorithm, and the private key length is 256 bits. The signing process generates a 64-byte signature value, which is attached to the original authentication request to form a signed authentication request.

[0070] Then, the IoT device sends the signed authentication request to the predefined smart contract address in the blockchain network through the HTTPS protocol. The smart contract address is a contract address on the Ethereum network, such as "0x1234567890123456789012345678901234567890".

[0071] After receiving the signed authentication request, the smart contract in the blockchain network first verifies the validity of the digital signature using the pre-stored public key corresponding to the IoT device. After the verification is passed, the smart contract will parse the unique identifier in the authentication request and query the historical authentication records and reputation score of the IoT device in the blockchain. The historical authentication records contain information such as the device's past authentication time and results. The reputation score is an integer between 0 and 100, reflecting the credibility of the device.

[0072] The smart contract then generates an authentication token based on the historical authentication records and reputation scores, combined with the current timestamp and challenge value. The token contains the authentication result (success / failure), validity period (e.g. 24 hours) and authorization level (e.g. integer 1-5, 5 represents the highest authority). The authentication token uses JSON format, for example: {"result":"success","expiry":1623543189000, "level":3}.

[0073] The smart contract then uses the predefined AES-256 encryption algorithm to encrypt the authentication token and generate an encrypted authentication token. The encryption key is pre-agreed by the smart contract and the IoT device. At the same time, the smart contract will also dynamically generate a new smart contract address based on the authentication result for subsequent interactions.

[0074] The smart contract packages the encrypted authentication token and the newly generated smart contract address into an encrypted data packet and returns it to the IoT device that initiated the authentication request through the blockchain network. The data packet is encoded in Base64 to ensure integrity during transmission.

[0075] After receiving the encrypted data packet, the IoT device first uses Base64 decoding to restore the original data. Then it uses the pre-agreed AES-256 decryption algorithm and key to decrypt the authentication token and obtain the authentication result, validity period, and authorization level information.

[0076] IoT devices configure their own access rights and functional restrictions based on the authentication results, validity period, and authorization level obtained through decryption. For example, authorization level 3 may allow devices to access certain sensitive data but not modify system configurations.

[0077] During the validity period of the authentication token, the IoT device uses the new contract address returned by the smart contract as an identity credential for subsequent secure communication and data exchange with other IoT devices or applications. Before each data exchange, the IoT device sends a verification request to the smart contract address, which contains its own unique identifier and current timestamp.

[0078] After receiving the verification request, the smart contract will check whether the device sending the request is within the validity period and verify whether its current status and permissions meet the requirements for data exchange. After the verification is passed, the smart contract returns a Boolean value to indicate the verification result.

[0079] The IoT device decides whether to continue data exchange based on the verification result returned by the smart contract. If the verification result is true, the subsequent data exchange will proceed; if it is false, the operation will be terminated and the re-authentication process may be triggered.

[0080] Through the above steps, the blockchain-based IoT data processing method realizes the security authentication, dynamic authorization and continuous verification of IoT devices, effectively improving the security and credibility of the IoT system.

[0081] In an optional implementation, the IoT device uses a pre-stored private key to digitally sign the authentication request, and generating the signed authentication request includes:

[0082] The IoT device generates an authentication request including a unique device identifier, a current timestamp, and a randomly generated challenge value; the IoT device performs hash processing on the authentication request using a cryptographic hash function to generate a hash value of a fixed length;

[0083] The IoT device securely calls a pre-stored private key from the hardware security module; the IoT device encrypts the hash value using an asymmetric encryption algorithm to generate a digital signature;

[0084] The IoT device combines the authentication request and the digital signature to form a signed authentication request; wherein the signed authentication request includes an authentication request field and a signature field, the authentication request field contains a device unique identifier, a current timestamp, and a randomly generated challenge value, and the signature field contains a digital signature generated using a private key.

[0085] When IoT devices are performing security authentication, they first need to generate a signed authentication request. The specific implementation process is as follows:

[0086] The IoT device first generates an authentication request that contains a unique device identifier, a current timestamp, and a randomly generated challenge value. The unique device identifier can be the device's MAC address or serial number, etc., which is used to uniquely identify the device. The current timestamp is the exact time when the device generates the authentication request, which can be accurate to milliseconds. The randomly generated challenge value is a random number used to prevent replay attacks.

[0087] For example, a device can generate the following authentication request:

[0088] Device unique identifier: 00:11:22:33:44:55; Current timestamp: 1621234567890; Random challenge value: 9876543210.

[0089] Next, the IoT device uses a cryptographic hash function to hash the authentication request and generate a hash value of fixed length. Common hash algorithms include SHA-256, SHA-3, etc.

[0090] Then, the IoT device needs to securely call the pre-stored private key from the hardware security module. The hardware security module can be a dedicated security chip or a trusted execution environment that is used to securely store private keys and perform cryptographic operations.

[0091] IoT devices use asymmetric encryption algorithms (such as RSA, ECDSA, etc.) to encrypt the previously generated hash value and generate a digital signature. Taking the RSA algorithm as an example, the hash value is encrypted using a private key.

[0092] Finally, the IoT device combines the authentication request and the digital signature to form a signed authentication request. The signed authentication request consists of two parts: the authentication request field and the signature field. The authentication request field contains the device unique identifier, the current timestamp, and the randomly generated challenge value; the signature field contains the digital signature generated using the private key.

[0093] The combined signature authentication request is as follows:

[0094] {

[0095] "authRequest": {

[0096] "deviceId": "00:11:22:33:44:55",

[0097] "timestamp": 1621234567890,

[0098] "challenge": 9876543210

[0099] },

[0100] "signature": "a1b2c3d4e5f6g7h8i9j0..."

[0101] }.

[0102] Through the above steps, the IoT device completes the process of generating a signed authentication request. This process ensures the authenticity and integrity of the authentication request and prevents replay attacks. After receiving the request, the authentication server can use the device's public key to verify the signature, thereby confirming that the request is indeed from a legitimate IoT device.

[0103] In an optional implementation, the smart contract generates an authentication token including the authentication result, validity period and authorization level based on the historical authentication record, reputation score, current timestamp and challenge value, including:

[0104] The smart contract receives and verifies the signed authentication request sent by the IoT device; the smart contract retrieves the historical authentication record of the IoT device in the blockchain according to the device unique identifier in the signed authentication request; the smart contract uses a time series analysis algorithm to analyze the historical authentication record and evaluate the authentication mode of the IoT device;

[0105] The smart contract calculates the reputation score of the IoT device based on the historical authentication records, wherein the calculation of the reputation score takes into account the ratio of the number of successful authentications to the total number of authentications, the time weight of the most recent authentication behavior, and the activity and contribution of the IoT device in the network; the smart contract normalizes the reputation score and maps it to a range of 0-100;

[0106] The smart contract verifies whether the timestamp in the signed authentication request is within a preset time window, and checks the uniqueness of the challenge value in the authentication request; the smart contract generates an authentication token based on the authentication mode, the reputation score, the timestamp and the challenge value, and the authentication token includes an authentication result, a validity period, an authorization level, a device unique identifier, a token generation time and a randomly generated token ID; wherein the validity period is dynamically set according to the reputation score, and the authorization level is determined according to the reputation score and the authentication mode; the smart contract constructs the authentication token using the JSON Web Token format.

[0107] First, the smart contract receives a signed authentication request from the IoT device. The request contains information such as the device's unique identifier, timestamp, and challenge value. The smart contract uses the device's public key to verify the validity of the signature to ensure that the request has not been tampered with and comes from a legitimate device.

[0108] After verification, the smart contract retrieves the historical authentication records of the IoT device in the blockchain based on the device's unique identifier. These records contain information such as the time, results, and authorization level of each past authentication. The smart contract uses time series analysis algorithms, such as the Autoregressive Integrated Moving Average (ARIMA) model, to analyze historical authentication data and identify authentication patterns and trends of the device. For example, the analysis may find that the device is usually authenticated between 9 am and 5 pm on weekdays, and rarely authenticated on weekends.

[0109] Next, the smart contract calculates the reputation score of the device based on historical authentication records. The calculation takes into account the following factors: (1) the ratio of successful authentication times to total authentication times, for example, if 90 authentications were successful in the past 100 times, the ratio is 0.9; (2) the time weight of the most recent authentication behavior, giving higher weight to authentications within the last 30 days; (3) the activity of the device in the network, such as the average number of interactions with other devices per day in the past 7 days; (4) the contribution of the device to the network, such as participating in consensus, providing data, etc. The smart contract takes these factors into consideration and calculates a raw score between 0 and 100, which is then mapped to the standard range of 0 to 100 using the min-max normalization method.

[0110] The smart contract then verifies whether the timestamp in the authentication request is within a preset time window, such as 5 minutes before or after the current time. At the same time, it checks whether the challenge value is unique to prevent replay attacks. After verification, the smart contract generates an authentication token based on the above analysis results.

[0111] The token contains the following fields: authentication result (success / failure), validity period, authorization level, device unique identifier, token generation time, and randomly generated token ID. The validity period is set dynamically based on the reputation score, for example, a reputation score of 90-100 corresponds to a validity period of 24 hours, 80-89 corresponds to 12 hours, and so on. The authorization level is also determined based on the reputation score and authentication mode. For example, a device with a reputation score of 95 or above and that meets the normal authentication mode can obtain the highest level of authorization.

[0112] Finally, the smart contract constructs an authentication token using the JSON Web Token (JWT) format. JWT consists of three parts: header, payload, and signature. The header declares the token type and the encryption algorithm used, the payload contains the above authentication information, and the signature encrypts the header and payload using the private key of the smart contract. The generated JWT token can be securely transmitted and verified and used by other systems.

[0113] In this way, the smart contract implements a dynamic authentication mechanism based on historical authentication records, reputation scores, timestamps and challenge values, improving the security and flexibility of IoT device authentication.

[0114] In an optional implementation, the smart contract encrypts the authentication token using a predefined encryption algorithm, and generating the encrypted authentication token includes:

[0115] The smart contract generates a 256-bit advanced encryption standard key using a cryptographically secure random number generator; generates a 96-bit random initialization vector; uses the advanced encryption standard key and the random initialization vector to encrypt the authentication token using the Galois / Counter Mode of the advanced encryption standard to generate a ciphertext and an authentication tag;

[0116] The smart contract combines the ciphertext, the random initialization vector and the authentication tag into an encrypted token structure; uses a pre-stored IoT device public key to asymmetrically encrypt the advanced encryption standard key to generate an encrypted advanced encryption standard key;

[0117] The encrypted token structure and the encrypted Advanced Encryption Standard key are combined into a final encrypted data packet as an encrypted authentication token.

[0118] In this embodiment, the specific process of the smart contract encrypting the authentication token is as follows:

[0119] First, the smart contract uses a cryptographically secure random number generator to generate a 256-bit Advanced Encryption Standard (AES) key. This key is a random binary string with a length of 256 bits and is used for subsequent symmetric encryption. For example, the generated AES key is:

[0120] "101011011100001010101101110000101010101101110000101010110111000010" (to simplify the display, the actual length is 256 bits);

[0121] Next, the smart contract generates a 96-bit random initialization vector (IV). IV is also a random binary string with a length of 96 bits, which is used to increase the randomness of encryption. For example, the generated IV is:

[0122] "101011011100001010101101110000" (to simplify the display, the actual length is 96 bits);

[0123] Then, the smart contract uses the generated AES key and IV to encrypt the authentication token using the Galois / Counter (GCM) mode of AES. Assuming that the original authentication token is "AccessToken123", the encrypted ciphertext "En2xK8mP3q" and the authentication tag "Tag567" are obtained.

[0124] The smart contract combines the ciphertext, IV, and authentication tag into an encrypted token structure. For example:

[0125] {

[0126] "ciphertext": "En2xK8mP3q",

[0127] "iv": "101011011100001010101101110000",

[0128] "tag": "Tag567"

[0129] }.

[0130] Next, the smart contract uses the pre-stored public key of the IoT device to asymmetrically encrypt the AES key. Assuming the public key of the IoT device is "IoTDevicePubKey", the AES key is encrypted using the RSA algorithm to obtain the encrypted AES key "EncryptedAESKey789".

[0131] Finally, the smart contract combines the encrypted token structure and the encrypted AES key into the final encrypted data packet as the encrypted authentication token:

[0132] {

[0133] "encryptedToken": {

[0134] "ciphertext": "En2xK8mP3q",

[0135] "iv": "101011011100001010101101110000",

[0136] "tag": "Tag567"

[0137] },

[0138] "encryptedAESKey": "EncryptedAESKey789"

[0139] }.

[0140] This encrypted authentication token contains all the necessary information and can be securely transmitted to the IoT device. After receiving this encrypted data packet, the IoT device can use its own private key to decrypt the AES key, and then use the decrypted AES key and IV to decrypt the original authentication token.

[0141] The whole process uses a combination of symmetric encryption and asymmetric encryption, which not only ensures the efficiency of encryption, but also ensures the security of key transmission. The use of GCM mode also provides an authentication function to verify the integrity of the ciphertext. This multiple protection mechanism greatly improves the security of the authentication token and effectively prevents security threats such as man-in-the-middle attacks and replay attacks.

[0142] In an optional implementation, the IoT device decrypts the encrypted authentication token using a pre-agreed decryption algorithm to obtain an authentication result, validity period, and authorization level; the IoT device configures its own access rights and function restrictions according to the authentication result, validity period, and authorization level, including:

[0143] The IoT device receives an encrypted data packet, wherein the encrypted data packet also includes an encrypted authentication token structure and an encrypted advanced encryption standard key; the IoT device extracts the encrypted advanced encryption standard key from the encrypted data packet; and decrypts the encrypted advanced encryption standard key using a pre-stored asymmetric encryption private key to obtain a decrypted advanced encryption standard key;

[0144] The IoT device extracts the initialization vector, ciphertext and authentication tag from the encrypted authentication token structure; the IoT device creates an advanced encryption standard Galois / counter mode decryptor, the decryptor uses the decrypted advanced encryption standard key and the initialization vector; uses the decryptor to decrypt the ciphertext, and uses the authentication tag to verify the integrity of the decryption result, thereby obtaining a decrypted authentication token;

[0145] The IoT device verifies the digital signature of the decrypted authentication token to ensure the authenticity of the decrypted authentication token; the IoT device parses the decrypted authentication token to extract the authentication result, expiration time and authorization level; the IoT device compares the current time with the expiration time to determine whether the decrypted authentication token is valid; when the decrypted authentication token is valid, the IoT device configures its own access rights and function restrictions according to the authentication result and authorization level;

[0146] A periodic check thread is started, and the periodic check thread compares the current time with the expiration time at a predetermined time interval; when the current time is close to the expiration time, the periodic check thread triggers the IoT device to re-request a new authentication token; the IoT device receives a new encrypted data packet in response to the new authentication token request; and uses the information in the new encrypted data packet to update its own access rights and functional restrictions.

[0147] In this embodiment, the IoT device first receives an encrypted data packet. The encrypted data packet contains an encrypted authentication token structure and an encrypted Advanced Encryption Standard (AES) key. The IoT device extracts the encrypted AES key from the encrypted data packet, and then decrypts it using a pre-stored asymmetric encryption private key to obtain the decrypted AES key.

[0148] Next, the IoT device extracts the initialization vector, ciphertext, and authentication tag from the encrypted authentication token structure. The IoT device creates an AES-GCM (Galois / Counter Mode) decryptor that uses the decrypted AES key and the extracted initialization vector. The decryptor is then used to decrypt the ciphertext and the authentication tag is used to verify the integrity of the decrypted result, ultimately yielding the decrypted authentication token.

[0149] To ensure the authenticity of the decrypted authentication token, the IoT device verifies its digital signature. After verification, the IoT device parses the authentication token and extracts information such as the authentication result, expiration time, and authorization level. The IoT device compares the current system time with the expiration time to determine whether the authentication token is still valid.

[0150] If the authentication token is valid, the IoT device configures its own access rights and functional restrictions based on the authentication result and authorization level. For example, for an authentication result with an authorization level of "Administrator", the IoT device may allow access to all functions and data; while for an authentication result with an authorization level of "Ordinary User", it may only allow access to some functions and data.

[0151] The IoT device also starts a periodic check thread, which compares the current time with the expiration time of the authentication token at a predetermined time interval (such as every 5 minutes). When the current time is close to the expiration time (for example, there are still 30 minutes to expiration), the thread triggers the IoT device to re-request a new authentication token.

[0152] The IoT device receives a new encrypted data packet in response to a request for a new authentication token. The device decrypts and verifies the new authentication token using the same method as before, and then uses the information in the new authentication token to update its own access permissions and functional restrictions.

[0153] For example, let's say the IoT device is a smart home controller. The initial authentication token might grant "normal user" level permissions, allowing control of lighting and temperature, but not access to security cameras. Once the user is authenticated as a "power user," a new authentication token might grant a higher level of permissions, allowing access to more sensitive features such as security cameras and door lock controls.

[0154] In this way, IoT devices can dynamically adjust their security policies to ensure that only properly authorized users can access specific functions, while also updating authentication status in a timely manner to maintain system security and flexibility.

[0155] In an optional implementation, before each data exchange, the IoT device sends a verification request to the smart contract address, and the smart contract verifies the current state and authority of the IoT device and returns a verification result; the IoT device decides whether to continue data exchange based on the verification result, including:

[0156] The IoT device generates a verification request, the verification request including a device identifier, a current timestamp, a requested operation type, a random number, and a device signature, wherein the device signature is a signature of a hash value obtained by performing a hash operation on a combination of the device identifier, the current timestamp, the requested operation type, and the random number using a private key of the IoT device;

[0157] The IoT device sends the verification request to the smart contract address;

[0158] The smart contract receives the verification request, verifies the validity of the device signature using the public key of the IoT device, checks whether the current timestamp is within the valid time range, verifies whether the random number has not been used, obtains the current status information of the IoT device from the blockchain, and determines whether the IoT device has the authority to execute the operation type of the verification request based on the current status information and the operation type of the verification request;

[0159] The smart contract generates a verification response, the verification response includes a verification result, a smart contract processing timestamp, an operation permission, and a smart contract signature, wherein the smart contract signature is obtained by the smart contract signing a combination of the verification result, the smart contract processing timestamp, and the operation permission;

[0160] The smart contract sends the verification response to the IoT device; the IoT device receives the verification response, verifies the validity of the smart contract signature, checks whether the smart contract processing timestamp is within the valid time range, and parses the verification result and the operation authority;

[0161] The IoT device decides whether to continue data exchange according to the verification result. When the verification result is passed and the operation permission includes the required permission, the IoT device performs the data exchange operation. When the verification result is not passed or the operation permission does not include the required permission, the IoT device terminates the data exchange operation and records a log.

[0162] The IoT device starts a continuous monitoring thread, which repeats monitoring at a predetermined time interval. When the number of consecutive verification failures reaches a preset threshold, the IoT device enters a restricted mode and triggers a re-authentication process.

[0163] When implementing a blockchain-based IoT device data exchange security verification method, you can follow the following steps:

[0164] First, the IoT device needs to generate a verification request. The verification request contains the device identifier, the current timestamp, the requested operation type, the random number, and the device signature. Among them, the device identifier can be the unique serial number of the device, such as "IOT-001". The current timestamp uses the Unix timestamp format, such as "1631234567". The requested operation type can be "read", "write", etc. The random number is a sufficiently long random string, such as "a7b3c9d2e8f1". For the device signature, first concatenate the device identifier, the current timestamp, the requested operation type, and the random number into a string, such as "IOT-0011631234567reada7b3c9d2e8f1", then perform a SHA256 hash operation on the string to obtain a hash value, and finally use the device private key to perform an ECDSA signature on the hash value to obtain the device signature.

[0165] Next, the IoT device sends the generated verification request to the smart contract address. The smart contract address is the unique identifier of the smart contract deployed on the blockchain network, usually a 42-character hexadecimal address, such as "0x742d35Cc6634C0532925a3b844Bc454e4438f44e".

[0166] After receiving the verification request, the smart contract first uses the public key of the IoT device to verify the validity of the device signature. The verification process is to reconstruct the device identifier, current timestamp, requested operation type and random number, calculate the SHA256 hash value, and then use the ECDSA algorithm and the device public key to verify whether the signature matches the hash value.

[0167] Then, the smart contract checks whether the current timestamp is within the valid time range. For example, a 5-minute validity period can be set, that is, verifying whether the difference between the current timestamp and the timestamp when the smart contract receives the request is less than 300 seconds.

[0168] Smart contracts also need to verify whether the random number has not been used. A set of used random numbers can be maintained in the smart contract, and each time the random number is verified, it is checked whether it is already in the set, and if not, it is added to the set.

[0169] Next, the smart contract obtains the current status information of the IoT device from the blockchain. The status information can include whether the device is online, disabled, etc. For example, a key-value pair can be stored on the blockchain: "IOT-001_status": "online".

[0170] Based on the current status information obtained and the operation type in the verification request, the smart contract determines whether the IoT device has the authority to perform the requested operation. For example, if the device status is "online" and the requested operation type is "read", it is determined to have the authority to perform.

[0171] After verification is completed, the smart contract generates a verification response. The verification response contains the verification result, smart contract processing timestamp, operation permissions, and smart contract signature. The verification result can be "pass" or "fail". The smart contract processing timestamp uses the Unix timestamp format. The operation permissions can be a permission list, such as ["read", "write"]. The process of generating the smart contract signature is to concatenate the verification result, smart contract processing timestamp, and operation permissions into a string, and use the private key of the smart contract to sign the string with ECDSA.

[0172] The smart contract sends the generated verification response to the IoT device. After receiving the verification response, the IoT device first verifies the validity of the smart contract signature. The verification process is similar to the previous one, using the public key of the smart contract for ECDSA signature verification.

[0173] The IoT device then checks whether the smart contract processing timestamp is within the valid time range, which can usually be set to be valid within 5 minutes.

[0174] The IoT device parses the verification result and operation permissions. If the verification result is "pass" and the operation permissions include the required permissions, the data exchange operation is performed. For example, if the required permission is "read" and the operation permission list includes "read", the read operation is allowed.

[0175] If the verification result is "fail" or the operation permission does not include the required permission, the IoT device terminates the data exchange operation and records the log. The log content may include the reason for the verification failure, timestamp and other information.

[0176] The IoT device also needs to start a continuous monitoring thread. This thread repeats the verification request at a predetermined time interval (such as every 5 minutes). The thread maintains a counter to record the number of consecutive verification failures. When the number of consecutive verification failures reaches a preset threshold (such as 3 times), the IoT device enters restricted mode.

[0177] In restricted mode, IoT devices restrict certain operations and trigger a reauthentication process. Reauthentication may require manual intervention, such as re-entering authentication information or contacting an administrator.

[0178] Through the above steps, a blockchain-based IoT device data exchange security verification method can be implemented to improve the security and reliability of IoT device data exchange.

[0179] Figure 2 Schematic diagram of the structure of the Internet of Things data processing system based on blockchain according to an embodiment of the present invention. Figure 2 As shown, the system comprises:

[0180] The first unit is used for the IoT device to generate an authentication request, wherein the authentication request includes a unique identifier of the IoT device, a current timestamp, and a randomly generated challenge value; the IoT device digitally signs the authentication request using a pre-stored private key to generate a signed authentication request; and the IoT device sends the signed authentication request to a smart contract in a blockchain network;

[0181] The second unit is used for a smart contract in a blockchain network to receive the signed authentication request, and the smart contract uses a pre-stored public key of the IoT device to verify the validity of the signed authentication request; the smart contract queries the blockchain for the historical authentication record and reputation score of the IoT device according to the unique identifier of the IoT device; the smart contract generates an authentication token including the authentication result, validity period and authorization level based on the historical authentication record, reputation score, current timestamp and challenge value; the smart contract encrypts the authentication token using a predefined encryption algorithm to generate an encrypted authentication token; the smart contract packages the encrypted authentication token and a smart contract address dynamically generated based on the authentication result as an encrypted data packet and returns it to the IoT device;

[0182] The third unit is used for the IoT device to receive the encrypted authentication token and smart contract address; the IoT device uses a pre-agreed decryption algorithm to decrypt the encrypted authentication token to obtain the authentication result, validity period and authorization level; the IoT device configures its own access rights and functional restrictions according to the authentication result, validity period and authorization level; during the validity period, the IoT device uses the smart contract address as an identity credential for subsequent secure communication and data exchange with other IoT devices or applications; before each data exchange, the IoT device sends a verification request to the smart contract address, the smart contract verifies the current status and permissions of the IoT device, and returns the verification result; the IoT device decides whether to continue data exchange based on the verification result.

[0183] According to a third aspect of the embodiments of the present invention,

[0184] An electronic device is provided, comprising:

[0185] processor;

[0186] a memory for storing processor-executable instructions;

[0187] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0188] A fourth aspect of the embodiments of the present invention is:

[0189] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0190] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0191] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. The method for processing Internet of Things data based on blockchain is characterized in that: include: The IoT device generates an authentication request, the authentication request including a unique identifier of the IoT device, a current timestamp, and a randomly generated challenge value; The IoT device digitally signs the authentication request using a pre-stored private key to generate a signed authentication request; The IoT device sends the signed authentication request to the smart contract in the blockchain network; The smart contract in the blockchain network receives the signed authentication request, and the smart contract uses the pre-stored public key of the IoT device to verify the validity of the signed authentication request; The smart contract queries the blockchain for the IoT device’s historical authentication records and reputation score based on the IoT device’s unique identifier; The smart contract generates an authentication token including the authentication result, validity period and authorization level based on the historical authentication record, reputation score, current timestamp and challenge value; The smart contract encrypts the authentication token using a predefined encryption algorithm to generate an encrypted authentication token; The smart contract packages the encrypted authentication token and a smart contract address dynamically generated based on the authentication result as an encrypted data packet and returns it to the IoT device; The IoT device receives the encrypted authentication token and smart contract address; The IoT device uses a pre-agreed decryption algorithm to decrypt the encrypted authentication token and obtain the authentication result, validity period and authorization level; the IoT device configures its own access rights and functional restrictions based on the authentication result, validity period and authorization level; during the validity period, the IoT device uses the smart contract address as an identity credential for subsequent secure communication and data exchange with other IoT devices or applications; before each data exchange, the IoT device sends a verification request to the smart contract address, the smart contract verifies the current status and permissions of the IoT device, and returns the verification result; the IoT device decides whether to continue data exchange based on the verification result.

2. The method according to claim 1, characterized in that The IoT device uses a pre-stored private key to digitally sign the authentication request, and the generated signed authentication request includes: The IoT device generates an authentication request including a unique device identifier, a current timestamp, and a randomly generated challenge value; the IoT device performs hash processing on the authentication request using a cryptographic hash function to generate a hash value of a fixed length; The IoT device securely calls a pre-stored private key from the hardware security module; the IoT device encrypts the hash value using an asymmetric encryption algorithm to generate a digital signature; The IoT device combines the authentication request and the digital signature to form a signed authentication request; wherein the signed authentication request includes an authentication request field and a signature field, the authentication request field contains a device unique identifier, a current timestamp, and a randomly generated challenge value, and the signature field contains a digital signature generated using a private key.

3. The method according to claim 1, characterized in that Based on the historical authentication records, reputation score, current timestamp and challenge value, the smart contract generates an authentication token containing the authentication result, validity period and authorization level, including: The smart contract receives and verifies the signed authentication request sent by the IoT device; the smart contract retrieves the historical authentication record of the IoT device in the blockchain according to the device unique identifier in the signed authentication request; the smart contract uses a time series analysis algorithm to analyze the historical authentication record and evaluate the authentication mode of the IoT device; The smart contract calculates the reputation score of the IoT device based on the historical authentication records, wherein the calculation of the reputation score takes into account the ratio of the number of successful authentications to the total number of authentications, the time weight of the most recent authentication behavior, and the activity and contribution of the IoT device in the network; the smart contract normalizes the reputation score and maps it to a range of 0-100; The smart contract verifies whether the timestamp in the signed authentication request is within a preset time window, and checks the uniqueness of the challenge value in the authentication request; the smart contract generates an authentication token based on the authentication mode, the reputation score, the timestamp and the challenge value, and the authentication token includes an authentication result, a validity period, an authorization level, a device unique identifier, a token generation time and a randomly generated token ID; wherein the validity period is dynamically set according to the reputation score, and the authorization level is determined according to the reputation score and the authentication mode; the smart contract constructs the authentication token using the JSON Web Token format.

4. The method according to claim 1, characterized in that: The smart contract encrypts the authentication token using a predefined encryption algorithm, and generates an encrypted authentication token including: The smart contract generates a 256-bit advanced encryption standard key using a cryptographically secure random number generator; generates a 96-bit random initialization vector; uses the advanced encryption standard key and the random initialization vector to encrypt the authentication token using the Galois / Counter Mode of the advanced encryption standard to generate a ciphertext and an authentication tag; The smart contract combines the ciphertext, the random initialization vector and the authentication tag into an encrypted token structure; uses a pre-stored IoT device public key to asymmetrically encrypt the advanced encryption standard key to generate an encrypted advanced encryption standard key; The encrypted token structure and the encrypted Advanced Encryption Standard key are combined into a final encrypted data packet as an encrypted authentication token.

5. The method according to claim 1, characterized in that The IoT device decrypts the encrypted authentication token using a pre-agreed decryption algorithm to obtain the authentication result, validity period, and authorization level; the IoT device configures its own access rights and function restrictions based on the authentication result, validity period, and authorization level, including: The IoT device receives an encrypted data packet, wherein the encrypted data packet also includes an encrypted authentication token structure and an encrypted advanced encryption standard key; the IoT device extracts the encrypted advanced encryption standard key from the encrypted data packet; and decrypts the encrypted advanced encryption standard key using a pre-stored asymmetric encryption private key to obtain a decrypted advanced encryption standard key; The IoT device extracts the initialization vector, ciphertext and authentication tag from the encrypted authentication token structure; the IoT device creates an advanced encryption standard Galois / counter mode decryptor, the decryptor uses the decrypted advanced encryption standard key and the initialization vector; uses the decryptor to decrypt the ciphertext, and uses the authentication tag to verify the integrity of the decryption result, thereby obtaining a decrypted authentication token; The IoT device verifies the digital signature of the decrypted authentication token to ensure the authenticity of the decrypted authentication token; the IoT device parses the decrypted authentication token to extract the authentication result, expiration time and authorization level; the IoT device compares the current time with the expiration time to determine whether the decrypted authentication token is valid; when the decrypted authentication token is valid, the IoT device configures its own access rights and function restrictions according to the authentication result and authorization level; A periodic check thread is started, and the periodic check thread compares the current time with the expiration time at a predetermined time interval; when the current time is close to the expiration time, the periodic check thread triggers the IoT device to re-request a new authentication token; the IoT device receives a new encrypted data packet in response to the new authentication token request; and uses the information in the new encrypted data packet to update its own access rights and functional restrictions.

6. The method according to claim 1, characterized in that Before each data exchange, the IoT device sends a verification request to the smart contract address. The smart contract verifies the current status and permissions of the IoT device and returns the verification result. The IoT device decides whether to continue data exchange based on the verification results, including: The IoT device generates a verification request, the verification request including a device identifier, a current timestamp, a requested operation type, a random number, and a device signature, wherein the device signature is a signature of a hash value obtained by performing a hash operation on a combination of the device identifier, the current timestamp, the requested operation type, and the random number using a private key of the IoT device; The IoT device sends the verification request to the smart contract address; The smart contract receives the verification request, verifies the validity of the device signature using the public key of the IoT device, checks whether the current timestamp is within the valid time range, verifies whether the random number has not been used, obtains the current status information of the IoT device from the blockchain, and determines whether the IoT device has the authority to execute the operation type of the verification request based on the current status information and the operation type of the verification request; The smart contract generates a verification response, the verification response includes a verification result, a smart contract processing timestamp, an operation permission, and a smart contract signature, wherein the smart contract signature is obtained by the smart contract signing a combination of the verification result, the smart contract processing timestamp, and the operation permission; The smart contract sends the verification response to the IoT device; the IoT device receives the verification response, verifies the validity of the smart contract signature, checks whether the smart contract processing timestamp is within the valid time range, and parses the verification result and the operation authority; The IoT device decides whether to continue data exchange according to the verification result. When the verification result is passed and the operation permission includes the required permission, the IoT device performs the data exchange operation. When the verification result is not passed or the operation permission does not include the required permission, the IoT device terminates the data exchange operation and records a log. The IoT device starts a continuous monitoring thread, which repeats monitoring at a predetermined time interval. When the number of consecutive verification failures reaches a preset threshold, the IoT device enters a restricted mode and triggers a re-authentication process.

7. A blockchain-based Internet of Things data processing system, used to implement the method described in any one of claims 1 to 6, characterized in that: include: A first unit is used for the IoT device to generate an authentication request, wherein the authentication request includes a unique identifier of the IoT device, a current timestamp, and a randomly generated challenge value; The IoT device digitally signs the authentication request using a pre-stored private key to generate a signed authentication request; The IoT device sends the signed authentication request to the smart contract in the blockchain network; The second unit is used for a smart contract in a blockchain network to receive the signed authentication request, and the smart contract uses a pre-stored public key of the IoT device to verify the validity of the signed authentication request; The smart contract queries the blockchain for the IoT device’s historical authentication records and reputation score based on the IoT device’s unique identifier; The smart contract generates an authentication token including the authentication result, validity period and authorization level based on the historical authentication record, reputation score, current timestamp and challenge value; The smart contract encrypts the authentication token using a predefined encryption algorithm to generate an encrypted authentication token; The smart contract packages the encrypted authentication token and a smart contract address dynamically generated based on the authentication result as an encrypted data packet and returns it to the IoT device; The third unit is used for the IoT device to receive the encrypted authentication token and smart contract address; The IoT device uses a pre-agreed decryption algorithm to decrypt the encrypted authentication token and obtain the authentication result, validity period and authorization level; the IoT device configures its own access rights and functional restrictions based on the authentication result, validity period and authorization level; during the validity period, the IoT device uses the smart contract address as an identity credential for subsequent secure communication and data exchange with other IoT devices or applications; before each data exchange, the IoT device sends a verification request to the smart contract address, the smart contract verifies the current status and permissions of the IoT device, and returns the verification result; the IoT device decides whether to continue data exchange based on the verification result.

8. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images