Identity authentication method, device and equipment

Abstract

The embodiment of the invention discloses a plurality of identity authentication methods, devices and equipment, and the method comprises the steps: generating a first random authentication code corresponding to a current identity authentication period under the condition that the identity authentication of Internet of Things equipment is successful in the current identity authentication period, obtaining a first excitation corresponding to the current identity authentication period in pre-stored excitation; determining second excitation according to the first random authentication code and the first excitation, and inputting the second excitation into a physical unclonable function to generate a first response value; sending the first random authentication code and the first response value to the Internet of Things equipment; receiving an identity authentication result of the Internet of Things device for the server in the current identity authentication period; and determining whether to establish a communication connection with the Internet of Things device according to the first identity authentication result.

Description

Technical Field

[0001] This document relates to the field of computer technology, and in particular to identity authentication methods, devices and equipment. Background Art

[0002] With the vigorous development of Internet technology, various smart devices can be connected through the Internet, using the convenience of Internet information dissemination to achieve various functions such as automatic data reporting, remote access, and remote control management, thereby building an Internet of Things.

[0003] Since the traditional IoT security mechanism requires the use of relatively complex cryptographic mathematical operations, and these operations require sufficient storage space and high computing memory to support, but IoT devices have problems such as small size, limited hardware processing power and resources, the traditional user-driven complex security authentication protocol is difficult to play a role in the IoT. To this end, the embodiments of this specification provide a technical solution to improve the data transmission security of IoT devices. Summary of the invention

[0004] The purpose of the embodiments of this specification is to provide a technical solution to improve the data transmission security of IoT devices.

[0005] In order to implement the above technical solution, the embodiments of this specification are implemented as follows:

[0006] An authentication method provided by an embodiment of the present specification is applied to a server, and includes: in the case where an Internet of Things device is successfully authenticated in a current authentication cycle, generating a first random authentication code corresponding to the current authentication cycle, and obtaining a first stimulus corresponding to the current authentication cycle from pre-stored stimuli; determining a second stimulus according to the first random authentication code and the first stimulus, and inputting the second stimulus into a physical unclonable function to generate a first response value; sending the first random authentication code and the first response value to the Internet of Things device; receiving an authentication result of the Internet of Things device for the server in the current authentication cycle, the authentication result being determined by the Internet of Things device according to a matching detection result of the first response value and the second response value, the second response value being a response value corresponding to a third stimulus generated by the Internet of Things device according to the physical unclonable function, the third stimulus being determined by the Internet of Things device according to the first random authentication code and a fourth stimulus corresponding to the current authentication cycle from pre-stored stimuli; and determining whether to establish a communication connection with the Internet of Things device according to the first authentication result.

[0007] An identity authentication device provided by an embodiment of the present specification includes: a first generating module, which is used to generate a first random authentication code corresponding to the current identity authentication cycle and obtain a first stimulus corresponding to the current identity authentication cycle from pre-stored stimuli when the identity authentication of an Internet of Things device is successful in the current identity authentication cycle; a second generating module, which is used to determine a second stimulus according to the first random authentication code and the first stimulus, and input the second stimulus into a physical unclonable function to generate a first response value; a first sending module, which is used to send the first random authentication code and the first response value to the Internet of Things device; a first receiving module, which is used to receive an identity authentication result of the Internet of Things device for the identity authentication device in the current identity authentication cycle, the identity authentication result being determined by the Internet of Things device according to a matching detection result of the first response value and the second response value, the second response value being a response value corresponding to a third stimulus generated by the Internet of Things device according to the physical unclonable function, the third stimulus being determined by the Internet of Things device according to the first random authentication code and a fourth stimulus corresponding to the current identity authentication cycle from the pre-stored stimuli; and a result determining module, which is used to determine whether to establish a communication connection with the Internet of Things device according to the first identity authentication result.

[0008] An embodiment of the present specification provides an identity authentication device, the identity authentication device comprising: a processor; and a memory arranged to store computer executable instructions, wherein the executable instructions, when executed, cause the processor to: generate a first random authentication code corresponding to the current identity authentication cycle when the identity authentication of an Internet of Things device is successfully performed in the current identity authentication cycle, and obtain a first stimulus corresponding to the current identity authentication cycle from pre-stored stimuli; determine a second stimulus according to the first random authentication code and the first stimulus, and input the second stimulus into a physical unclonable function to generate a first response value; send the first random authentication code and the first response value to the Internet of Things device; receive an identity authentication result of the Internet of Things device for the identity authentication device in the current identity authentication cycle, the identity authentication result being determined by the Internet of Things device according to a matching detection result of the first response value and the second response value, the second response value being a response value corresponding to a third stimulus generated by the Internet of Things device according to the physical unclonable function, the third stimulus being determined by the Internet of Things device according to the first random authentication code and a fourth stimulus corresponding to the current identity authentication cycle from the pre-stored stimuli; and determine whether to establish a communication connection with the Internet of Things device according to the first identity authentication result.

[0009] The embodiment of the present specification also provides a storage medium, which is used to store computer-executable instructions. When the executable instructions are executed by the processor, the following process is implemented: when the Internet of Things device is successfully authenticated in the current authentication cycle, a first random authentication code corresponding to the current authentication cycle is generated, and a first stimulus corresponding to the current authentication cycle in the pre-stored stimulus is obtained; a second stimulus is determined according to the first random authentication code and the first stimulus, and the second stimulus is input into a physical unclonable function to generate a first response value; the first random authentication code and the first response value are sent to the Internet of Things device; an authentication result of the Internet of Things device for the server in the current authentication cycle is received, the authentication result is determined by the Internet of Things device according to the matching detection result of the first response value and the second response value, the second response value is a response value corresponding to a third stimulus generated by the Internet of Things device according to the physical unclonable function, the third stimulus is determined by the Internet of Things device according to the first random authentication code and a fourth stimulus corresponding to the current authentication cycle in the pre-stored stimulus; according to the first authentication result, it is determined whether to establish a communication connection with the Internet of Things device.

[0010] The embodiment of the present specification also provides a computer program product, including a computer program, which implements the following process when executed by a processor: when the Internet of Things device is successfully authenticated in the current authentication cycle, a first random authentication code corresponding to the current authentication cycle is generated, and a first stimulus corresponding to the current authentication cycle in the pre-stored stimulus is obtained; a second stimulus is determined according to the first random authentication code and the first stimulus, and the second stimulus is input into a physical unclonable function to generate a first response value; the first random authentication code and the first response value are sent to the Internet of Things device; an authentication result of the Internet of Things device for the server in the current authentication cycle is received, the authentication result is determined by the Internet of Things device according to the matching detection result of the first response value and the second response value, the second response value is a response value corresponding to a third stimulus generated by the Internet of Things device according to the physical unclonable function, the third stimulus is determined by the Internet of Things device according to the first random authentication code and a fourth stimulus corresponding to the current authentication cycle in the pre-stored stimulus; according to the first authentication result, it is determined whether to establish a communication connection with the Internet of Things device.

[0011] An authentication method provided by an embodiment of the present specification is applied to an Internet of Things device, and the method includes: receiving a first random authentication code and a first response value sent by a server when the server successfully authenticates the Internet of Things device in a current authentication cycle, the first response value being a response value generated by the server inputting the second stimulus into a physical unclonable function, the second stimulus being determined based on the first random authentication code and the first stimulus, and the first stimulus being a stimulus corresponding to the current authentication cycle among the stimuli pre-stored by the server; obtaining a fourth stimulus corresponding to the current authentication cycle, and determining a third stimulus based on the fourth stimulus and the first random authentication code; determining a second response value corresponding to the third stimulus based on the Internet of Things unclonable function; determining a first authentication result for the server based on a match detection result between the first response value and the second response value, and returning the first authentication result to the server, the first authentication result being used to trigger the server to determine whether to establish a communication connection with the Internet of Things device.

[0012] An identity authentication device provided by an embodiment of the present specification includes: a data receiving module, which is used to receive a first random authentication code and a first response value sent by a server when the server successfully authenticates the identity authentication device in a current identity authentication cycle, wherein the first response value is a response value generated by the server inputting a second stimulus into a physical unclonable function, the second stimulus is determined according to the first random authentication code and the first stimulus, and the first stimulus is a stimulus corresponding to the current identity authentication cycle among the stimuli pre-stored by the server; a data acquisition module, which is used to acquire a fourth stimulus corresponding to the current identity authentication cycle, and determine a third stimulus according to the fourth stimulus and the first random authentication code; a response value determination module, which is used to determine a second response value corresponding to the third stimulus according to the IoT unclonable function; and a result sending module, which is used to determine a first identity authentication result for the server according to a detection result of matching the first response value and the second response value, and return the first identity authentication result to the server, wherein the first identity authentication result is used to trigger the server to determine whether to establish a communication connection with the identity authentication device.

[0013] An embodiment of the present specification provides an identity authentication device, the identity authentication device comprising: a processor; and a memory arranged to store computer executable instructions, wherein the executable instructions, when executed, cause the processor to: receive a first random authentication code and a first response value sent by a server when the server successfully authenticates the identity authentication device in a current identity authentication cycle, the first response value being a response value generated by the server inputting a second stimulus into a physical unclonable function, the second stimulus being determined according to the first random authentication code and the first stimulus, the first stimulus being a stimulus corresponding to the current identity authentication cycle among the stimuli pre-stored by the server; obtain a fourth stimulus corresponding to the current identity authentication cycle, and determine a third stimulus according to the fourth stimulus and the first random authentication code; determine a second response value corresponding to the third stimulus according to the IoT unclonable function; determine a first identity authentication result for the server according to a match detection result between the first response value and the second response value, and return the first identity authentication result to the server, the first identity authentication result being used to trigger the server to determine whether to establish a communication connection with the identity authentication device.

[0014] The embodiments of the present specification also provide a storage medium, which is used to store computer-executable instructions. When the executable instructions are executed by the processor, the following process is implemented: receiving a first random authentication code and a first response value sent by the server when the server successfully authenticates the Internet of Things device in the current authentication cycle, the first response value being a response value generated by the server inputting a second stimulus into a physical unclonable function, the second stimulus being determined based on the first random authentication code and the first stimulus, and the first stimulus being a stimulus corresponding to the current authentication cycle among the stimuli pre-stored by the server; obtaining a fourth stimulus corresponding to the current authentication cycle, and determining a third stimulus based on the fourth stimulus and the first random authentication code; determining a second response value corresponding to the third stimulus based on the Internet of Things unclonable function; determining a first authentication result for the server based on a match detection result between the first response value and the second response value, and returning the first authentication result to the server, the first authentication result being used to trigger the server to determine whether to establish a communication connection with the Internet of Things device.

[0015] The embodiments of the present specification also provide a computer program product, including a computer program, which implements the following process when executed by a processor: receiving a first random authentication code and a first response value sent by a server when the server successfully authenticates the Internet of Things device in the current authentication cycle, the first response value being a response value generated by the server inputting a second stimulus into a physical unclonable function, the second stimulus being determined based on the first random authentication code and the first stimulus, and the first stimulus being a stimulus corresponding to the current authentication cycle among the stimuli pre-stored by the server; obtaining a fourth stimulus corresponding to the current authentication cycle, and determining a third stimulus based on the fourth stimulus and the first random authentication code; determining a second response value corresponding to the third stimulus based on the Internet of Things unclonable function; determining a first authentication result for the server based on a detection result of matching the first response value and the second response value, and returning the first authentication result to the server, the first authentication result being used to trigger the server to determine whether to establish a communication connection with the Internet of Things device. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the drawings required for use in the embodiments or the prior art description will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative labor.

[0017] Figure 1 This is an example of an identity authentication method in this specification;

[0018] Figure 2 This is another identity authentication method embodiment of this specification;

[0019] Figure 3 This is another identity authentication method embodiment of this specification;

[0020] Figure 4 This is a schematic diagram of an Internet of Things system structure in this specification;

[0021] Figure 5 This is a schematic diagram of an initialization phase of this manual;

[0022] Figure 6 This is a schematic diagram of the device registration stage of this manual;

[0023] Figure 7 This is a schematic diagram of the device authentication stage of this manual;

[0024] Figure 8This is another identity authentication method embodiment of this specification;

[0025] Fig. 9 This is another identity authentication method embodiment of this specification;

[0026] Fig.10 This is an embodiment of an identity authentication device of this specification;

[0027] Fig.11 This is another embodiment of the identity authentication device of this specification;

[0028] Fig.12 This is an example of an identity authentication device in this specification. DETAILED DESCRIPTION

[0029] The embodiments of this specification provide identity authentication methods, devices and equipment.

[0030] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be described clearly and completely below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0031] The embodiments of this specification provide identity authentication methods, devices and equipment. With the vigorous development of Internet technology, various intelligent devices can be connected through the Internet, and the convenience of Internet information dissemination can be used to realize various functions such as automatic data reporting, remote access and remote control management, thereby building an Internet of Things. Since the traditional Internet of Things security mechanism requires the use of more complex cryptographic mathematical operations, and these operations require sufficient storage space and high computing memory to support, however, the Internet of Things devices have the problems of small size, hardware processing power and limited resources. Therefore, the traditional user-driven complex security authentication protocol is difficult to play a role in the Internet of Things. To this end, the embodiments of this specification provide a technical solution to improve the data transmission security of Internet of Things devices. In this solution, on the one hand, the identity authentication security for Internet of Things devices can be guaranteed through the "incentive-response" mechanism, which solves the problem that complex security authentication collaboration is difficult to play a role in resource-constrained Internet of Things devices. On the other hand, through the two-way authentication between the server and the Internet of Things device, the data operation of the unauthorized party can be detected, and the unauthorized party is prevented from tampering with the communication data between the Internet of Things device and the server, thereby improving the data transmission security of the Internet of Things device. For specific processing, please refer to the specific content in the following embodiments.

[0032] like Figure 1As shown, the embodiment of this specification provides an identity authentication method, the execution subject of the method can be a server, wherein the server can be an independent server, or a server cluster composed of multiple servers, etc. The server can be a background server for financial services or online shopping services, or a background server for an application, etc. The method can specifically include the following steps:

[0033] In step S102, when the IoT device is successfully authenticated in the current authentication cycle, a first random authentication code corresponding to the current authentication cycle is generated, and a first incentive corresponding to the current authentication cycle in the pre-stored incentives is obtained.

[0034] Among them, the identity authentication period can be a preset authentication period, for example, the identity authentication period can be any authentication period such as 1 hour, 3 hours, etc., and the Internet of Things device can be a smart device including a sensor, for example, the Internet of Things device can be a smart device including a SIM card.

[0035] In implementation, the server may generate a corresponding random authentication code for each authentication cycle. For example, the server may generate a random authentication code of a preset length for each authentication cycle based on a preset random algorithm. In addition, the server may generate a corresponding incentive for each authentication cycle and send the generated incentive to the IoT device. The IoT device may receive and store the incentive corresponding to each authentication cycle.

[0036] The server can receive an authentication request from an IoT device and perform authentication on the IoT device. There are multiple ways for the server to perform authentication on the IoT device. For example, the IoT device can send a device identifier to the server, and the server can perform a match detection based on the received device identifier and the pre-stored device identifier. If there is a device identifier that matches the received device identifier in the pre-stored device identifiers, it is determined that the IoT device is successfully authenticated in the current authentication cycle.

[0037] In addition, there may be multiple methods for performing identity authentication processing on the IoT device, and different identity authentication processing methods may be selected according to different actual application scenarios, and the embodiments of this specification do not specifically limit this.

[0038] In step S104, a second stimulus is determined according to the first random authentication code and the first stimulus, and the second stimulus is input into a physical unclonable function to generate a first response value.

[0039] Among them, the physical unclonable function can use its inherent physical structure to uniquely identify itself, that is, when any stimulus is input, the physical unclonable function will output a unique and unpredictable response value.

[0040] In implementation, the server may perform an XOR logic operation on the first random authentication code and the first stimulus, and determine the operation result as the second stimulus.

[0041] The server may input the second stimulus into the physical unclonable function to obtain a first response value corresponding to the second stimulus.

[0042] In step S106, the first random authentication code and the first response value are sent to the Internet of Things device.

[0043] In implementation, the IoT device can determine the third stimulus based on the received first random authentication code and the fourth stimulus corresponding to the current identity authentication cycle in the pre-stored stimulus. A second response value corresponding to the third stimulus is generated according to the physical unclonable function, and then, the server can be authenticated according to the second response value and the received first response value.

[0044] In step S108, the identity authentication result of the IoT device for the server in the current identity authentication cycle is received.

[0045] Among them, the identity authentication result can be determined by the Internet of Things device based on the matching detection result of the first response value and the second response value, the second response value can be a response value corresponding to the third stimulus generated by the Internet of Things device according to a physical unclonable function, and the third stimulus can be determined by the Internet of Things device according to the first random authentication code and the fourth stimulus corresponding to the current identity authentication cycle in the pre-stored stimulus.

[0046] In step S110, it is determined whether to establish a communication connection with the IoT device according to the first identity authentication result.

[0047] In implementation, when it is determined that the IoT device has successfully authenticated the server side based on the first identity authentication result, the server side can establish a communication connection with the IoT device.

[0048] The embodiment of the present specification provides an identity authentication method, which generates a first random authentication code corresponding to the current identity authentication cycle when the Internet of Things device is successfully authenticated in the current identity authentication cycle, obtains the first stimulus corresponding to the current identity authentication cycle in the pre-stored stimulus, determines the second stimulus according to the first random authentication code and the first stimulus, inputs the second stimulus into a physical unclonable function to generate a first response value, sends the first random authentication code and the first response value to the Internet of Things device, receives the identity authentication result of the Internet of Things device for the server in the current identity authentication cycle, the identity authentication result is determined by the Internet of Things device according to the matching detection result of the first response value and the second response value, and the second response value is determined by the Internet of Things device according to the physical unclonable function Long function, generates a response value corresponding to the third incentive, the third incentive is determined by the Internet of Things device according to the first random authentication code and the fourth incentive corresponding to the current identity authentication cycle in the pre-stored incentive, and determines whether to establish a communication connection with the Internet of Things device according to the first identity authentication result. In this way, on the one hand, the identity authentication security of the Internet of Things device can be guaranteed through the "incentive-response value" mechanism, which solves the problem that complex security authentication collaboration is difficult to play a role in resource-constrained Internet of Things devices. On the other hand, through the two-way authentication between the server and the Internet of Things device, the data operation of the unauthorized party can be detected, which prevents the unauthorized party from tampering with the communication data between the Internet of Things device and the server, and improves the data transmission security of the Internet of Things device.

[0049] In practical applications, before the above step S102, the IoT device may be authenticated. The specific processing methods may be various. An optional processing method is provided below, such as Figure 2 and Figure 3 As shown, the process may specifically include the following steps S202 to S234.

[0050] In step S202, for each identity authentication cycle, a first device identifier and an incentive corresponding to the IoT device are generated.

[0051] Among them, the device identification corresponding to the current identity authentication cycle stored in the Internet of Things device may include a first device identification generated by the server for the Internet of Things device, and the device identification corresponding to the current identity authentication cycle stored in the server may include a second device identification generated by the Internet of Things device based on the first device identification.

[0052] In step S204, a first message is generated based on the first device identification and the stimulus.

[0053] In step S206, a first polynomial sent by the IoT device is received.

[0054] In step S208, a second polynomial is generated by using a first preset hash function.

[0055] In step S210, a first key is generated according to the first polynomial and the second polynomial, and the first key is sent to the IoT device.

[0056] The first key may include an encryption key and a decryption key. The encryption key may be determined according to a first polynomial and an inverse polynomial of a second polynomial, and the decryption key may be determined according to a second polynomial and an inverse polynomial of the second polynomial.

[0057] In step S212, a second key sent by the IoT device is received.

[0058] Among them, the second key can be generated for the Internet of Things device according to the first polynomial and the third polynomial, and the third polynomial can be generated for the Internet of Things device through a second preset hash function.

[0059] In step S214, the second key is stored.

[0060] In step S216, the first message is encrypted using the pre-constructed first key to obtain an encrypted first message.

[0061] In step S218, the encrypted first message is sent to the IoT device.

[0062] In step S220, the encrypted second message sent by the IoT device is received.

[0063] Among them, the encrypted second message can be obtained by encrypting the second message by the Internet of Things device through a pre-built second key, and the second message may include a second device identifier generated by the Internet of Things device according to the first device identifier, and a third response value generated according to the stimulus through a physically unclonable function.

[0064] In step S222, the encrypted second message is decrypted according to the pre-stored second key to obtain the second message.

[0065] In step S224, a fourth response value is generated according to the stimulus by using a physical unclonable function, and a match detection is performed on the third response value and the fourth response value.

[0066] In step S226, when the third response value and the fourth response value match successfully, the second device identification is stored.

[0067] In implementation, Figure 4 As shown, the IoT system can be composed of a server, a network, a network management system, and an IoT device with a built-in SIM card. The execution steps of the IoT device can be executed in the SIM card of the IoT device, and the data interaction between the IoT device and the server is realized through the network management system and the network.

[0068] The identity authentication process between IoT devices and servers can include an initialization phase and a device registration phase.

[0069] The purpose of the initialization stage is to define the second key of the IoT device and the first key of the server to prepare for the subsequent device registration stage, such as Figure 5 As shown, the initialization phase may include the following steps:

[0070] Step 1.1: Establish integer set and polynomial set in IoT device.

[0071] Integer sets and polynomial sets can be used as components of ciphertext parameters. Integer sets can be sets of multiple integers. For example, integer sets can be sets of three integers, Z(a, b, c), where a can be a positive prime number and b and c are mutually prime (i.e., the greatest common divisor of b and c is 1). Polynomial sets can be sets of multiple polynomials. For example, the polynomial set can be a set of four N-1 degree polynomials with integer coefficients, L(L j ,L k ,L m ,L n ).

[0072] Step 1.2: The IoT device generates the first polynomial K that meets the polynomial set format requirements, for example, K∈L k .

[0073] Step 1.3: The server generates a hash function set H(H j ,H k ,H m ,H n ).

[0074] Among them, the hash function in the hash function set can be used to map any input into an N-1 degree polynomial, and the mapped N-1 degree polynomial meets the above-mentioned polynomial set format requirements.

[0075] Step 1.4: The server randomly selects a hash function from the generated hash function set H(Hj, Hk, Hm, Hn) as the first preset hash function, and generates the second polynomial using the selected first preset hash mapping function. For example, the server can randomly select a hash mapping function Hj from the hash mapping function set H(Hj, Hk, Hm, Hn) as the first preset hash function, and then use the first preset hash function Hj to generate the second polynomial J, J∈L j .

[0076] The server can use the first polynomial K and the second polynomial J to generate the first key [h s,(J,J -1 )], the server can send the first key to the IoT device, where the encryption key h in the first key s =J -1 *K(mod),J -1 is the inverse polynomial of J.

[0077] Step 1.5: IoT devices can also select from the set of hash functions H(H j ,H k ,H m ,H n ) randomly selects a hash function as the second preset hash function, and uses the selected second preset hash function to generate the third polynomial. For example, the IoT device can select a hash function from the hash function set H(H j ,H k ,H m ,H n ) randomly selects a hash function as H m As the second preset hash function, and using the second preset hash function H m Correspondingly generate the third polynomial M, M∈L M .

[0078] The IoT device can generate a second key [h D ,(M,M -1 )], and send the second key to the server side. D =M -1 *K(mod),M -1 is the inverse polynomial of M,.

[0079] In this way, through the processing of the above-mentioned initialization phase of the device, the keys of the IoT device and the server can be defined, and the key exchange operation between the IoT device and the server can be realized to prepare for subsequent device registration and device authentication. In addition, during the key generation process, the IoT device and the server can generate keys based on the polynomial generated by the hash function, which can improve the security of key generation.

[0080] The purpose of the device registration phase is to ensure that data can be securely transmitted between IoT devices and the server. Figure 6 As shown, the device registration phase may include the following specific implementation steps:

[0081] Step 2.1: On the server side, a first device identifier and an incentive corresponding to the IoT device may be generated for each identity authentication cycle.

[0082] In addition, to prevent IoT devices from being attacked by synchronization or DoS attacks during the authentication process, the server can also generate a temporary identity ID corresponding to the IoT device for each authentication cycle. T and temporary incentive C T .

[0083] The server can package the first device identifier and the stimulus into a first message M1 and transmit the first key [h s ,(J,J -1 )] Encrypt the first message M1 to obtain the encrypted first message M1, and the server can send the encrypted first message M1 to the Internet of Things device.

[0084] Step 2.2: On the IoT device side, the IoT device can use the first key [h s ,(J,J -1 )] decrypts the received encrypted first message M1.

[0085] The IoT device can generate a second device identifier based on the first device identifier obtained by decryption (the second device identifier can be a pseudo-random identity identifier PID of the IoT device). The IoT device can generate a third response value R based on the incentive C through a physical unclonable function. In addition, if the encrypted first message M1 also includes a temporary incentive C T , then, the IoT device can also generate the temporary stimulus C through the physical unclonable function T The corresponding temporary response value R T The IoT device can use the second key [h D ,(M,M -1 )] encrypt the second message M2 consisting of the second device identifier and the third response value to obtain the encrypted second message M2, and send the encrypted second message M2 to the server. The IoT device can store the first device identifier and the incentive. In addition, if the first message M1 also includes a temporary identity ID T , then, IoT devices can also store temporary identity IDs T .

[0086] Step 2.3: On the server side, the server can decrypt the encrypted second message according to the pre-stored second key to obtain the second message, and generate a fourth response value according to the stimulus through a physical unclonable function. The server can perform a match detection on the third response value and the fourth response value, and store the second device identifier if the third response value and the fourth response value match successfully.

[0087] In step S228, a device authentication request sent by the IoT device in the current identity authentication cycle is received.

[0088] The device authentication request may carry first verifiable data generated by the IoT device in the security element for the current identity authentication cycle.

[0089] In step S230, second verifiable data corresponding to the current identity authentication cycle is obtained.

[0090] In step S234, identity authentication is performed on the IoT device based on the first verifiable data and the second verifiable data.

[0091] Among them, the first verifiable data may include a second random authentication code and a first device authentication code generated by the Internet of Things device, and the first device authentication code may be generated based on the second random authentication code and a pre-stored device identifier corresponding to the current identity authentication cycle; the second verifiable data may include a second device authentication code, and the second device authentication code may be generated by the server based on the second random authentication code and the device identifier corresponding to the current identity authentication cycle stored in the server.

[0092] In practical applications, the specific processing methods for performing identity authentication on the IoT device according to the first verifiable data and the second verifiable data in the above step S234 can be varied. An optional processing method is provided below, which can specifically include the processing of the following step A1.

[0093] In step A1, the IoT device is authenticated according to the first device authentication code and the second device authentication code.

[0094] In step S236, when the IoT device fails to perform identity authentication in the current identity authentication cycle, an identity authentication failure message is sent to the IoT device, and third verifiable data sent by the IoT device is received.

[0095] The third verifiable data may be verifiable data generated by the IoT device in the security element for a previous identity authentication cycle.

[0096] In step S238, identity authentication is performed on the IoT device based on the second verifiable data and the third verifiable data.

[0097] In this way, the Internet of Things device can be subjected to secondary identity authentication processing based on the second verifiable data and the third verifiable data, wherein, if the identity authentication based on the first verifiable data and the second verifiable data fails, and the identity authentication based on the second verifiable data and the third verifiable data succeeds, it can be determined that the first verifiable data may have been tampered with; if the identity authentication based on the first verifiable data and the second verifiable data fails, and the identity authentication based on the second verifiable data and the third verifiable data fails, it can be determined that there may be a risk of impersonating the identity of the Internet of Things device.

[0098] In practical applications, when the identity authentication of the IoT device fails according to the second verifiable data and the third verifiable data, a temporary identity identifier can be generated. The specific processing methods can be various. The following is an optional processing method, such as Figure 2 and Figure 3 As shown, the process may specifically include the following steps S240 to S242.

[0099] In step S240, when the identity authentication of the IoT device fails based on the second verifiable data and the third verifiable data, a first temporary identity corresponding to the server, a second temporary identity corresponding to the IoT device, and a temporary incentive are generated in the current identity authentication cycle.

[0100] In step S242, the first temporary identity, the second temporary identity and the temporary incentive are sent to the Internet of Things device.

[0101] In implementation, after sending the first temporary identity, the second temporary identity, and the temporary incentive to the IoT device, the server can delete the locally stored first temporary identity, the second temporary identity, and the temporary incentive to resist DoS attacks and desynchronization attacks, thereby ensuring the anonymity and untraceability of the server.

[0102] After the device registration phase, the device authentication phase can also be included. The device authentication phase can realize two-way authentication between the IoT device and the server. Figure 7 As shown, two-way authentication may include the following specific implementation steps:

[0103] Step 3.1: On the IoT device side, the IoT device can generate a second random authentication code P D The IoT device can generate a first device verification code A according to the second random authentication code and a pre-stored device identifier corresponding to the current identity authentication cycle. D , where A D =P D ⊕PID i ⊕ID i , PD is the second random authentication code corresponding to the i-th round of identity authentication cycle, PID i and ID i is the device identifier corresponding to the i-th round of identity authentication cycle (i.e., pseudo-random identifier and temporary identifier).

[0104] The IoT device can use the second random authentication code P D and the first device authentication code A D The determined second verifiable data is written into the device authentication request Q1, and the device authentication request Q1 is sent to the server side.

[0105] Step 3.2: On the server side, the server may authenticate the device authentication request Q1.

[0106] (1) The steps for authenticating the device authentication request Q1 may be as follows:

[0107] Step 3.21.1: The server obtains the device identifier corresponding to the current authentication cycle;

[0108] Step 3.21.2: The server generates a second device authentication code A based on the second random authentication code and the device identifier corresponding to the current identity authentication period stored in the server. S , A S =P D ⊕PID i ⊕ID i .

[0109] Step 3.21.3: Extract the first device authentication code A from the received device authentication request Q1 D , and the first device authentication code A D With the second device authentication code A S Compare; if the first device authentication code A D With the second device authentication code A S If the first device authentication code A is the same, the device identity authentication is successful; D With the second device authentication code A S If they are not the same, the authentication fails and continue with steps 3.21.31 to 3.21.34.

[0110] Step 3.21.31: Send the authentication failure message to the IoT device.

[0111] Step 3.21.32: On the IoT device side, use the device ID of the current authentication round and the device authentication code A calculated during the previous authentication process D The generated third verifiable data is written into the device authentication request Q2 for the second time, and the device authentication request Q2 is sent to the server side.

[0112] Step 3.21.33: On the server side, extract the device authentication code A calculated in the previous authentication process from the received device authentication request Q2 D , and the device authentication code A calculated in the previous authentication process D The second device authentication code A corresponding to the current identity authentication cycle S Compare; if the device authentication code A calculated in the previous identity authentication process D The second device authentication code A corresponding to the current identity authentication cycle S If the device authentication code A calculated in the previous identity authentication process is the same, the authentication is successful, and the authentication success message is sent to the IoT device. D The second device authentication code A corresponding to the current identity authentication cycle S If they are not the same, authentication fails.

[0113] Step 3.21.34: On the IoT device side, if the device authentication succeeds in step 3.22.23, the device authentication code A calculated in the current authentication round is D Replaced with the device authentication code A calculated during the previous authentication process D .

[0114] In this way, a lightweight public key encryption algorithm is used in the system initialization phase, which can resist quantum computing attacks while improving authentication efficiency. In the device registration phase, a physical unclonable function is introduced, and its "incentive-response value" mechanism is used to ensure key security and prevent attackers from modeling attacks on the device. In the device authentication phase, a two-way authentication method between the IoT device and the server is used to resist DoS attacks and desynchronization attacks. Among them, the use of backup authentication codes in the two-way authentication process can prevent inconsistent authentication code updates from affecting the authentication results.

[0115] In addition, in the event of identity authentication failure, an emergency authentication process can be performed, which may include the following specific steps:

[0116] Step 3.22.1: On the server side, extract the stored temporary incentive C T and the temporary response value R T .

[0117] Step 3.22.2: The server generates a new pseudo-random identity PID and extracts the temporary incentive C T and the temporary response value R T And the new pseudo-random identity PID is sent to the IoT device side.

[0118] Step 3.22.3: Delete temporary incentive CT and the temporary response value R T , to resist DoS attacks and desynchronization attacks, thereby ensuring the anonymity and untraceability of the server.

[0119] In practical applications, the specific processing methods for determining the second stimulus according to the first random authentication code and the first stimulus in the above step S104 can be various. An optional processing method is provided below, such as Figure 8 As shown, the processing may specifically include the following steps S1042 and S1044.

[0120] In step S1042, the first stimulus is split into a first sub-stimulus and a second sub-stimulus according to a preset splitting rule.

[0121] In step S1044, a second stimulus is determined according to the first random authentication code and the first sub-stimulus.

[0122] In implementation, the server may split the first stimulus into the first sub-stimulus C according to the bit selection method. i1 and the second sub-stimulus C i2 . And bring the first random authentication code and the first sub-stimulus into the formula,

[0123] C Di =C i1 ⊕P S ,

[0124] The second excitation is obtained, where C Di is the second incentive corresponding to the i-th round of identity authentication cycle, P S is the first random authentication code.

[0125] In practical applications, the specific processing methods for sending the first random authentication code and the first response value to the IoT device in the above step S106 can be various. An optional processing method is provided below, such as Figure 8 As shown, the processing may specifically include the following step S1062.

[0126] In step S1062, the preset splitting rule, the first random authentication code and the first response value are sent to the Internet of Things device.

[0127] In implementation, the server may package the preset splitting rule, the first random authentication code, and the first response value into a server authentication message M, and send the server authentication message M to the IoT device.

[0128] In practical applications, after the above step S106, if the two-way authentication is successful, a communication connection can be established between the IoT device and the server to transmit according to the communication connection, such as Figure 8As shown, the process may specifically include the following steps S802 to S806.

[0129] In step S802, when it is determined to establish a communication connection with the IoT device based on the first identity authentication result, a communication connection with the IoT device is established.

[0130] In step S804, when a processing request for a target service sent by the IoT device is received, the target service is processed to determine a service processing result.

[0131] The target service may be any service, for example, the target service may be a user identity authentication service, a resource transfer service, an instant messaging service, etc.

[0132] In step S806, the business processing result is encrypted using the first key to obtain the encrypted business processing result, and the encrypted business processing result is returned to the Internet of Things device through the communication connection.

[0133] The encryption and decryption of the lightweight public key encryption algorithm only use simple polynomial multiplication, which is faster than the point multiplication operation of the ECC algorithm and can resist quantum computing attacks. Compared with other public key encryption systems, the lightweight public key encryption algorithm requires less memory and is faster in encryption, decryption and signing.

[0134] In view of the large number of IoT devices with small size, low hardware processing power and limited resources, the use of lightweight physical unclonable functions can ensure key security properties, including anonymity, availability, confidentiality and forward / backward secrecy. In addition, the physical unclonable function can use the random process deviations that cannot be controlled during the manufacturing process of the chip to generate a unique digital signature of the device to ensure that attackers cannot obtain any information about the stimulus-response value, and can protect the privacy of sensitive information such as device identity and location. Attackers cannot track the behavior of the device from intercepted messages.

[0135] Bidirectional authentication is used between IoT devices and servers to detect data operations by unauthorized parties and prevent the modification of communication data in the IoT system. In addition, the backup authentication code is used in the bidirectional authentication process to ensure that the information of the previous session key cannot help attackers obtain the session key for subsequent authentication, thereby ensuring the security of future communications and preventing devices from being subjected to desynchronization attacks and DoS attacks during the authentication process.

[0136] As more and more devices are connected to the Internet of Things for remote access and remote control, various security mechanisms are needed to prevent malicious damage and use. As an emerging communication network, the Internet of Things realizes the interconnection and interoperability of any object based on the Internet, including sensors, tags and smart devices. The Internet of Things plays an important role in various application scenarios such as people's lives and work, including smart cities, smart malls, smart banks, smart agriculture, and home automation. Since most IoT devices are unattended, in many cases specific users are required to remotely manage and control the devices through the network, or the devices need to share the collected information with specific users. Therefore, various security mechanisms such as identity recognition and permission control need to be configured. The commonly used security mechanism is to set a unique identity mark for each IoT device and user to distinguish different users and IoT devices. When IoT devices and users are connected to different IoTs, a specific password is also required to prevent malicious users or identity forgery.

[0137] In view of this, this technical solution can effectively improve the efficiency of IoT device authentication, prevent malicious attacks during the authentication process, and ensure the security and timeliness of the authentication process.

[0138] The embodiment of the present specification provides an identity authentication method, which generates a first random authentication code corresponding to the current identity authentication cycle when the Internet of Things device is successfully authenticated in the current identity authentication cycle, obtains the first stimulus corresponding to the current identity authentication cycle in the pre-stored stimulus, determines the second stimulus according to the first random authentication code and the first stimulus, inputs the second stimulus into a physical unclonable function to generate a first response value, sends the first random authentication code and the first response value to the Internet of Things device, receives the identity authentication result of the Internet of Things device for the server in the current identity authentication cycle, the identity authentication result is determined by the Internet of Things device according to the matching detection result of the first response value and the second response value, and the second response value is determined by the Internet of Things device according to the physical unclonable function Long function, generates a response value corresponding to the third incentive, the third incentive is determined by the Internet of Things device according to the first random authentication code and the fourth incentive corresponding to the current identity authentication cycle in the pre-stored incentive, and determines whether to establish a communication connection with the Internet of Things device according to the first identity authentication result. In this way, on the one hand, the identity authentication security of the Internet of Things device can be guaranteed through the "incentive-response value" mechanism, which solves the problem that complex security authentication collaboration is difficult to play a role in resource-constrained Internet of Things devices. On the other hand, through the two-way authentication between the server and the Internet of Things device, the data operation of the unauthorized party can be detected, which prevents the unauthorized party from tampering with the communication data between the Internet of Things device and the server, and improves the data transmission security of the Internet of Things device.

[0139] like Fig. 9As shown, the embodiment of this specification provides an identity authentication method, and the execution subject of the method can be an Internet of Things device, wherein the Internet of Things device can be any Internet of Things device configured with a SIM card. The method can specifically include the following steps:

[0140] In step S902, a first random authentication code and a first response value sent by the receiving server when the authentication of the IoT device is successful in the current authentication cycle.

[0141] Among them, the first response value can be the response value produced by the server inputting the second stimulus into the physical unclonable function, the second stimulus can be determined based on the first random authentication code and the first stimulus, and the first stimulus can be the stimulus corresponding to the current identity authentication cycle among the incentives pre-stored by the server.

[0142] In step S904, a fourth stimulus corresponding to the current identity authentication cycle is obtained, and a third stimulus is determined according to the fourth stimulus and the first random authentication code.

[0143] In S906, a second response value corresponding to the third stimulus is determined according to the IoT unclonable function.

[0144] In S908, a first identity authentication result for the server is determined according to the matching detection result of the first response value and the second response value, and the first identity authentication result is returned to the server.

[0145] Among them, the first identity authentication result can be used to trigger the server to determine whether to establish a communication connection with the Internet of Things device.

[0146] The specific processing process of the above steps S902 to S908 can be found in the above related content and will not be repeated here.

[0147] An embodiment of the present specification provides an identity authentication method, which receives a first random authentication code and a first response value sent by a server when the server successfully authenticates an Internet of Things device in the current identity authentication cycle, wherein the first response value is a response value generated by the server inputting a second stimulus into a physical unclonable function, the second stimulus is determined based on the first random authentication code and the first stimulus, the first stimulus is a stimulus corresponding to the current identity authentication cycle among the stimuli pre-stored by the server, obtains a fourth stimulus corresponding to the current identity authentication cycle, and determines a third stimulus based on the fourth stimulus and the first random authentication code, determines a second response value corresponding to the third stimulus based on the Internet of Things unclonable function, determines a first identity authentication result for the server based on a detection result of matching the first response value and the second response value, and returns the first identity authentication result to the server, and the first identity authentication result is used to trigger the server to determine whether to establish a communication connection with the Internet of Things device. In this way, on the one hand, the "incentive-response value" mechanism can be used to ensure the security of identity authentication for IoT devices, solving the problem that complex security authentication collaboration is difficult to play a role in resource-constrained IoT devices. On the other hand, through two-way authentication between the server and the IoT device, data operations by unauthorized parties can be detected, preventing unauthorized parties from tampering with the communication data between the IoT device and the server, thereby improving the data transmission security of IoT devices.

[0148] The above is the identity authentication method provided in the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides an identity authentication device, such as Fig.10 shown.

[0149] The identity authentication device comprises: a first generating module 1001, a second generating module 1002, a first sending module 1003, a first receiving module 1004 and a result determining module 1005, wherein:

[0150] The first generating module 1001 is used to generate a first random authentication code corresponding to the current authentication period when the IoT device is successfully authenticated in the current authentication period, and obtain a first incentive corresponding to the current authentication period from the pre-stored incentives;

[0151] A second generating module 1002 is configured to determine a second stimulus according to the first random authentication code and the first stimulus, and input the second stimulus into a physical unclonable function to generate a first response value;

[0152] A first sending module 1003, configured to send the first random authentication code and the first response value to the Internet of Things device;

[0153] A first receiving module 1004 is configured to receive an identity authentication result of the IoT device for the identity authentication device in the current identity authentication cycle, wherein the identity authentication result is determined by the IoT device according to a matching detection result of the first response value and the second response value, wherein the second response value is a response value corresponding to a third stimulus generated by the IoT device according to the physical unclonable function, wherein the third stimulus is determined by the IoT device according to the first random authentication code and a fourth stimulus corresponding to the current identity authentication cycle in a pre-stored stimulus;

[0154] The result determination module 1005 is used to determine whether to establish a communication connection with the Internet of Things device according to the first identity authentication result.

[0155] In the embodiment of this specification, the device further includes:

[0156] A second receiving module is used to receive a device authentication request sent by the Internet of Things device in the current identity authentication cycle, wherein the device authentication request carries first verifiable data generated by the Internet of Things device in the security element for the current identity authentication cycle;

[0157] A first acquisition module, used to acquire second verifiable data corresponding to the current identity authentication cycle;

[0158] The first authentication module is used to perform identity authentication processing on the Internet of Things device according to the first verifiable data and the second verifiable data.

[0159] In the embodiment of this specification, the first verifiable data includes a second random authentication code and a first device authentication code generated by the IoT device, the first device authentication code is generated according to the second random authentication code and a pre-stored device identification corresponding to the current identity authentication period, and the second verifiable data includes a second device authentication code, the second device authentication code is generated by the identity authentication device according to the second random authentication code and the device identification corresponding to the current identity authentication period stored in the identity authentication device;

[0160] The first authentication module is used to perform identity authentication processing on the Internet of Things device according to the first device authentication code and the second device authentication code.

[0161] In the embodiment of this specification, the device identification corresponding to the current identity authentication period stored in the IoT device includes a first device identification generated by the identity authentication device for the IoT device, and the device identification corresponding to the current identity authentication period stored in the identity authentication device includes a second device identification generated by the IoT device based on the first device identification.

[0162] The device also includes:

[0163] A third generating module, configured to generate, for each identity authentication cycle, a first device identifier corresponding to the IoT device and the incentive;

[0164] A first encryption module, configured to generate a first message based on the first device identifier and the stimulus, and encrypt the first message using a pre-built first key to obtain an encrypted first message;

[0165] A second sending module, used to send the encrypted first message to the Internet of Things device;

[0166] A second receiving module is configured to receive an encrypted second message sent by the IoT device, where the encrypted second message is obtained by encrypting the second message by the IoT device using a pre-built second key, and the second message includes a second device identifier generated by the IoT device according to the first device identifier, and a third response value generated according to the stimulus by the physical unclonable function;

[0167] a first decryption module, configured to decrypt the encrypted second message according to the pre-stored second key to obtain the second message;

[0168] a matching detection module, configured to generate a fourth response value according to the stimulus by using the physical unclonable function, and perform matching detection on the third response value and the fourth response value;

[0169] The first storage module is configured to store the second device identifier when the third response value and the fourth response value match successfully.

[0170] In the embodiment of this specification, the device further includes:

[0171] A third receiving module, used to receive a first polynomial sent by the Internet of Things device;

[0172] A fourth generating module, used to generate a second polynomial by using a first preset hash function;

[0173] A second sending module, used to generate the first key according to the first polynomial and the second polynomial, and send the first key to the Internet of Things device;

[0174] A third receiving module is used to receive a second key sent by the Internet of Things device, where the second key is generated by the Internet of Things device according to the first polynomial and a third polynomial, and the third polynomial is generated by the Internet of Things device through a second preset hash function;

[0175] The second storage module is used to store the second key.

[0176] The device also includes:

[0177] a data acquisition module, configured to send an authentication failure message to the IoT device if the IoT device fails to authenticate itself in the current authentication cycle, and receive third verifiable data sent by the IoT device, wherein the third verifiable data is verifiable data generated by the IoT device in the security element for a previous authentication cycle;

[0178] The second authentication module is used to perform identity authentication processing on the Internet of Things device according to the second verifiable data and the third verifiable data.

[0179] In the embodiment of this specification, the device further includes:

[0180] A message sending module, configured to generate, in the current identity authentication cycle, a first temporary identity identifier corresponding to the server, a second temporary identity identifier corresponding to the Internet of Things device, and a temporary incentive when identity authentication of the Internet of Things device fails according to the second verifiable data and the third verifiable data;

[0181] A third sending module is used to send the first temporary identity identifier, the second temporary identity identifier and the temporary incentive to the Internet of Things device.

[0182] In the embodiment of this specification, the second generating module 1002 is used to:

[0183] According to a preset splitting rule, splitting the first stimulus into a first sub-stimulus and a second sub-stimulus;

[0184] Determining the second stimulus according to the first random authentication code and the first sub-stimulus;

[0185] The first sending module 1003 is used to send the preset splitting rule, the first random authentication code and the first response value to the Internet of Things device.

[0186] In the embodiment of this specification, the device further includes:

[0187] A connection establishing module, configured to establish a communication connection with the IoT device when it is determined to establish a communication connection with the IoT device according to the first identity authentication result;

[0188] A business processing module, configured to process the target business and determine a business processing result when receiving a processing request for the target business sent by the IoT device;

[0189] The result returning module is used to encrypt the business processing result by using the first key to obtain the encrypted business processing result, and return the encrypted business processing result to the Internet of Things device through the communication connection.

[0190] The embodiment of the present specification provides an identity authentication device, which generates a first random authentication code corresponding to the current identity authentication cycle when the Internet of Things device is successfully authenticated in the current identity authentication cycle, obtains the first stimulus corresponding to the current identity authentication cycle in the pre-stored stimulus, determines the second stimulus according to the first random authentication code and the first stimulus, inputs the second stimulus into a physical unclonable function to generate a first response value, sends the first random authentication code and the first response value to the Internet of Things device, receives the identity authentication result of the Internet of Things device for the server in the current identity authentication cycle, the identity authentication result is determined by the Internet of Things device according to the matching detection result of the first response value and the second response value, and the second response value is determined by the Internet of Things device according to the physical unclonable function Long function, generates a response value corresponding to the third incentive, the third incentive is determined by the Internet of Things device according to the first random authentication code and the fourth incentive corresponding to the current identity authentication cycle in the pre-stored incentive, and determines whether to establish a communication connection with the Internet of Things device according to the first identity authentication result. In this way, on the one hand, the identity authentication security of the Internet of Things device can be guaranteed through the "incentive-response value" mechanism, which solves the problem that complex security authentication collaboration is difficult to play a role in resource-constrained Internet of Things devices. On the other hand, through the two-way authentication between the server and the Internet of Things device, the data operation of the unauthorized party can be detected, which prevents the unauthorized party from tampering with the communication data between the Internet of Things device and the server, and improves the data transmission security of the Internet of Things device.

[0191] The above is the identity authentication method provided in the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides an identity authentication device, such as Fig.11 shown.

[0192] The identity authentication device comprises: a data receiving module 1101, a data acquiring module 1102, a response value determining module 1103 and a result sending module 1104, wherein:

[0193] The data receiving module 1101 is used to receive a first random authentication code and a first response value sent by the server when the server successfully authenticates the identity authentication device in the current identity authentication cycle, wherein the first response value is a response value generated by the server inputting the second stimulus into a physical unclonable function, the second stimulus is determined according to the first random authentication code and the first stimulus, and the first stimulus is a stimulus corresponding to the current identity authentication cycle among the stimuli pre-stored by the server;

[0194] The data acquisition module 1102 is used to acquire a fourth incentive corresponding to the current identity authentication cycle, and determine a third incentive according to the fourth incentive and the first random authentication code;

[0195] A response value determination module 1103, configured to determine a second response value corresponding to the third stimulus according to the IoT unclonable function;

[0196] The result sending module 1104 is used to determine a first identity authentication result for the server according to the matching detection result of the first response value and the second response value, and return the first identity authentication result to the server, wherein the first identity authentication result is used to trigger the server to determine whether to establish a communication connection with the identity authentication device.

[0197] An embodiment of the present specification provides an identity authentication device, which receives a first random authentication code and a first response value sent by a server when the server successfully authenticates an Internet of Things device in the current identity authentication cycle, wherein the first response value is a response value generated by the server inputting a second stimulus into a physical unclonable function, the second stimulus is determined based on the first random authentication code and the first stimulus, the first stimulus is a stimulus corresponding to the current identity authentication cycle among the stimuli pre-stored by the server, obtains a fourth stimulus corresponding to the current identity authentication cycle, determines a third stimulus based on the fourth stimulus and the first random authentication code, determines a second response value corresponding to the third stimulus based on the Internet of Things unclonable function, determines a first identity authentication result for the server based on a detection result of matching the first response value and the second response value, and returns the first identity authentication result to the server, wherein the first identity authentication result is used to trigger the server to determine whether to establish a communication connection with the Internet of Things device. In this way, on the one hand, the "incentive-response value" mechanism can be used to ensure the security of identity authentication for IoT devices, solving the problem that complex security authentication collaboration is difficult to play a role in resource-constrained IoT devices. On the other hand, through two-way authentication between the server and the IoT device, data operations by unauthorized parties can be detected, preventing unauthorized parties from tampering with the communication data between the IoT device and the server, thereby improving the data transmission security of IoT devices.

[0198] The above is an identity authentication device provided in the embodiment of this specification. Based on the same idea, the embodiment of this specification also provides an identity authentication device, such as Fig.12 shown.

[0199] The identity authentication device may provide a terminal device or a server, etc. for the above-mentioned embodiment.

[0200] The identity authentication device may have relatively large differences due to different configurations or performances, and may include one or more processors 1201 and memory 1202, and the memory 1202 may store one or more storage applications or data. Among them, the memory 1202 may be a short-term storage or a persistent storage. The application stored in the memory 1202 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the identity authentication device. Furthermore, the processor 1201 can be configured to communicate with the memory 1202 and execute a series of computer executable instructions in the memory 1202 on the identity authentication device. The identity authentication device may also include one or more power supplies 1203, one or more wired or wireless network interfaces 1204, one or more input and output interfaces 1205, and one or more keyboards 1206.

[0201] Specifically in this embodiment, the identity authentication device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions in the identity authentication device, and the one or more programs are configured to be executed by one or more processors, including computer executable instructions for performing the following:

[0202] In the case where the IoT device is successfully authenticated in the current authentication cycle, a first random authentication code corresponding to the current authentication cycle is generated, and a first incentive corresponding to the current authentication cycle in the pre-stored incentives is obtained;

[0203] Determine a second stimulus according to the first random authentication code and the first stimulus, and input the second stimulus into a physical unclonable function to generate a first response value;

[0204] Sending the first random authentication code and the first response value to the Internet of Things device;

[0205] Receiving an identity authentication result of the Internet of Things device for the identity authentication device in the current identity authentication cycle, the identity authentication result is determined by the Internet of Things device according to a matching detection result of the first response value and the second response value, the second response value is a response value corresponding to a third stimulus generated by the Internet of Things device according to the physical unclonable function, the third stimulus is determined by the Internet of Things device according to the first random authentication code and a fourth stimulus corresponding to the current identity authentication cycle among pre-stored stimuli;

[0206] Determine whether to establish a communication connection with the Internet of Things device based on the first identity authentication result.

[0207] Specifically in this embodiment, the identity authentication device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions in the identity authentication device, and the one or more programs are configured to be executed by one or more processors, including computer executable instructions for performing the following:

[0208] receiving a first random authentication code and a first response value sent by the server when the server successfully authenticates the identity authentication device in the current identity authentication cycle, the first response value being a response value generated by the server inputting a second stimulus into a physical unclonable function, the second stimulus being determined according to the first random authentication code and the first stimulus, and the first stimulus being a stimulus corresponding to the current identity authentication cycle among the stimuli pre-stored by the server;

[0209] Acquire a fourth incentive corresponding to the current identity authentication cycle, and determine a third incentive according to the fourth incentive and the first random authentication code;

[0210] Determining a second response value corresponding to the third stimulus according to the IoT unclonable function;

[0211] According to the matching detection result of the first response value and the second response value, a first identity authentication result for the server is determined, and the first identity authentication result is returned to the server, and the first identity authentication result is used to trigger the server to determine whether to establish a communication connection with the identity authentication device.

[0212] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the identity authentication device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0213] The embodiment of the present specification provides an identity authentication device, which generates a first random authentication code corresponding to the current identity authentication cycle when the Internet of Things device is successfully authenticated in the current identity authentication cycle, obtains the first stimulus corresponding to the current identity authentication cycle in the pre-stored stimulus, determines the second stimulus according to the first random authentication code and the first stimulus, inputs the second stimulus into a physically unclonable function to generate a first response value, sends the first random authentication code and the first response value to the Internet of Things device, receives the identity authentication result of the Internet of Things device for the server in the current identity authentication cycle, the identity authentication result is determined by the Internet of Things device according to the matching detection result of the first response value and the second response value, and the second response value is determined by the Internet of Things device according to the physically unclonable Long function, generates a response value corresponding to the third incentive, the third incentive is determined by the Internet of Things device according to the first random authentication code and the fourth incentive corresponding to the current identity authentication cycle in the pre-stored incentive, and determines whether to establish a communication connection with the Internet of Things device according to the first identity authentication result. In this way, on the one hand, the identity authentication security of the Internet of Things device can be guaranteed through the "incentive-response value" mechanism, which solves the problem that complex security authentication collaboration is difficult to play a role in resource-constrained Internet of Things devices. On the other hand, through the two-way authentication between the server and the Internet of Things device, the data operation of the unauthorized party can be detected, which prevents the unauthorized party from tampering with the communication data between the Internet of Things device and the server, and improves the data transmission security of the Internet of Things device.

[0214] Furthermore, based on the above Figures 1 to 7 In one embodiment, the present specification further provides a storage medium for storing computer executable instruction information. In a specific embodiment, the storage medium may be a USB flash drive, an optical disk, a hard disk, etc. When the computer executable instruction information stored in the storage medium is executed by the processor, the following process can be implemented:

[0215] In the case where the IoT device is successfully authenticated in the current authentication cycle, a first random authentication code corresponding to the current authentication cycle is generated, and a first incentive corresponding to the current authentication cycle in the pre-stored incentives is obtained;

[0216] Determine a second stimulus according to the first random authentication code and the first stimulus, and input the second stimulus into a physical unclonable function to generate a first response value;

[0217] Sending the first random authentication code and the first response value to the Internet of Things device;

[0218] Receiving an identity authentication result of the Internet of Things device for the server in the current identity authentication cycle, the identity authentication result is determined by the Internet of Things device according to a matching detection result of the first response value and the second response value, the second response value is a response value corresponding to a third stimulus generated by the Internet of Things device according to the physical unclonable function, and the third stimulus is determined by the Internet of Things device according to the first random authentication code and a fourth stimulus corresponding to the current identity authentication cycle among pre-stored stimuli;

[0219] Determine whether to establish a communication connection with the Internet of Things device based on the first identity authentication result.

[0220] Furthermore, based on the above Figures 1 to 7 In one embodiment, the present specification further provides a storage medium for storing computer executable instruction information. In a specific embodiment, the storage medium may be a USB flash drive, an optical disk, a hard disk, etc. When the computer executable instruction information stored in the storage medium is executed by the processor, the following process can be implemented:

[0221] Receiving a first random authentication code and a first response value sent by the server when the server successfully authenticates the IoT device in the current authentication cycle, the first response value being a response value generated by the server inputting a second stimulus into a physical unclonable function, the second stimulus being determined according to the first random authentication code and the first stimulus, and the first stimulus being a stimulus corresponding to the current authentication cycle among the stimuli pre-stored by the server;

[0222] Acquire a fourth incentive corresponding to the current identity authentication cycle, and determine a third incentive according to the fourth incentive and the first random authentication code;

[0223] Determining a second response value corresponding to the third stimulus according to the IoT unclonable function;

[0224] According to the matching detection result of the first response value and the second response value, a first identity authentication result for the server is determined, and the first identity authentication result is returned to the server, and the first identity authentication result is used to trigger the server to determine whether to establish a communication connection with the Internet of Things device.

[0225] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the above-mentioned storage medium embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0226] The embodiment of the present specification provides a storage medium, which generates a first random authentication code corresponding to the current authentication cycle when the Internet of Things device is successfully authenticated in the current authentication cycle, obtains the first stimulus corresponding to the current authentication cycle in the pre-stored stimulus, determines the second stimulus according to the first random authentication code and the first stimulus, inputs the second stimulus into a physical unclonable function to generate a first response value, sends the first random authentication code and the first response value to the Internet of Things device, receives the authentication result of the Internet of Things device for the server in the current authentication cycle, the authentication result is determined by the Internet of Things device according to the matching detection result of the first response value and the second response value, and the second response value is determined by the Internet of Things device according to the physical unclonable function Function, generates a response value corresponding to the third incentive, the third incentive is determined by the Internet of Things device according to the first random authentication code and the fourth incentive corresponding to the current identity authentication cycle in the pre-stored incentive, and determines whether to establish a communication connection with the Internet of Things device according to the first identity authentication result. In this way, on the one hand, the identity authentication security of the Internet of Things device can be guaranteed through the "incentive-response value" mechanism, which solves the problem that complex security authentication collaboration is difficult to play a role in resource-constrained Internet of Things devices. On the other hand, through the two-way authentication between the server and the Internet of Things device, data operations by unauthorized parties can be detected, preventing unauthorized parties from tampering with the communication data between the Internet of Things device and the server, thereby improving the data transmission security of the Internet of Things device.

[0227] Furthermore, based on the above Figures 1 to 9 In one or more embodiments of the present specification, a computer program product is provided, including a computer program. When the computer program in the computer program product is executed by a processor, the following process can be implemented:

[0228] In the case where the IoT device is successfully authenticated in the current authentication cycle, a first random authentication code corresponding to the current authentication cycle is generated, and a first incentive corresponding to the current authentication cycle in the pre-stored incentives is obtained;

[0229] Determine a second stimulus according to the first random authentication code and the first stimulus, and input the second stimulus into a physical unclonable function to generate a first response value;

[0230] Sending the first random authentication code and the first response value to the Internet of Things device;

[0231] Receiving an identity authentication result of the Internet of Things device for the server in the current identity authentication cycle, the identity authentication result is determined by the Internet of Things device according to a matching detection result of the first response value and the second response value, the second response value is a response value corresponding to a third stimulus generated by the Internet of Things device according to the physical unclonable function, and the third stimulus is determined by the Internet of Things device according to the first random authentication code and a fourth stimulus corresponding to the current identity authentication cycle among pre-stored stimuli;

[0232] Determine whether to establish a communication connection with the Internet of Things device based on the first identity authentication result.

[0233] Furthermore, based on the above Figures 1 to 9 In one or more embodiments of the present specification, a computer program product is provided, including a computer program. When the computer program in the computer program product is executed by a processor, the following process can be implemented:

[0234] Receiving a first random authentication code and a first response value sent by the server when the server successfully authenticates the IoT device in the current authentication cycle, the first response value being a response value generated by the server inputting a second stimulus into a physical unclonable function, the second stimulus being determined according to the first random authentication code and the first stimulus, and the first stimulus being a stimulus corresponding to the current authentication cycle among the stimuli pre-stored by the server;

[0235] Acquire a fourth incentive corresponding to the current identity authentication cycle, and determine a third incentive according to the fourth incentive and the first random authentication code;

[0236] Determining a second response value corresponding to the third stimulus according to the IoT unclonable function;

[0237] According to the matching detection result of the first response value and the second response value, a first identity authentication result for the server is determined, and the first identity authentication result is returned to the server, and the first identity authentication result is used to trigger the server to determine whether to establish a communication connection with the Internet of Things device.

[0238] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the above-mentioned computer program product embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0239] The embodiment of the present specification provides a computer program product, which generates a first random authentication code corresponding to the current authentication cycle when the Internet of Things device is successfully authenticated in the current authentication cycle, obtains a first stimulus corresponding to the current authentication cycle in the pre-stored stimulus, determines a second stimulus according to the first random authentication code and the first stimulus, inputs the second stimulus into a physical unclonable function to generate a first response value, sends the first random authentication code and the first response value to the Internet of Things device, receives the authentication result of the Internet of Things device for the server in the current authentication cycle, the authentication result is determined by the Internet of Things device according to the matching detection result of the first response value and the second response value, and the second response value is determined by the Internet of Things device according to the physical unclonable function A cloning function is used to generate a response value corresponding to a third incentive, where the third incentive is determined by the IoT device based on the first random authentication code and a fourth incentive corresponding to the current identity authentication cycle in the pre-stored incentives. Based on the first identity authentication result, it is determined whether to establish a communication connection with the IoT device. In this way, on the one hand, the identity authentication security for IoT devices can be guaranteed through the "incentive-response value" mechanism, which solves the problem that complex security authentication collaboration is difficult to play a role in resource-constrained IoT devices. On the other hand, through two-way authentication between the server and the IoT device, data operations by unauthorized parties can be detected to prevent unauthorized parties from tampering with the communication data between the IoT device and the server, thereby improving the data transmission security of IoT devices.

[0240] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0241] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0242] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0243] For the convenience of description, the above devices are described in terms of functions and are divided into various units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0244] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0245] The embodiments of this specification are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable fraud case serial and parallel device to produce a machine, so that the instructions executed by the processor of the computer or other programmable fraud case serial and parallel device generate instructions for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0246] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable fraud case serial and parallel device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0247] These computer program instructions may also be loaded onto a computer or other programmable device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0248] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0249] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0250] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0251] It should be understood by those skilled in the art that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, one or more embodiments of this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0252] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0253] The above description is only an embodiment of this specification and is not intended to limit this document. For those skilled in the art, this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification should be included in the scope of the claims of this specification.

Claims

1. An identity authentication method, characterized in that: The method is applied to the server, and the method includes: In the case where the IoT device is successfully authenticated in the current authentication cycle, a first random authentication code corresponding to the current authentication cycle is generated, and a first incentive corresponding to the current authentication cycle in the pre-stored incentives is obtained; Determine a second stimulus according to the first random authentication code and the first stimulus, and input the second stimulus into a physical unclonable function to generate a first response value; Sending the first random authentication code and the first response value to the Internet of Things device; Receiving an identity authentication result of the Internet of Things device for the server in the current identity authentication cycle, the identity authentication result is determined by the Internet of Things device according to a matching detection result of the first response value and the second response value, the second response value is a response value corresponding to a third stimulus generated by the Internet of Things device according to the physical unclonable function, and the third stimulus is determined by the Internet of Things device according to the first random authentication code and a fourth stimulus corresponding to the current identity authentication cycle among pre-stored stimuli; Determine whether to establish a communication connection with the Internet of Things device based on the identity authentication result.

2. The method according to claim 1, characterized in that In the case where the identity authentication of the Internet of Things device is successful in the current identity authentication cycle, before generating a first random authentication code corresponding to the current identity authentication cycle, the method further includes: Receiving a device authentication request sent by the IoT device in the current identity authentication cycle, wherein the device authentication request carries first verifiable data generated by the IoT device in the security element for the current identity authentication cycle; Acquire second verifiable data corresponding to the current identity authentication period; Perform identity authentication on the Internet of Things device according to the first verifiable data and the second verifiable data.

3. The method according to claim 2, characterized in that The first verifiable data includes a second random authentication code generated by the IoT device and a first device authentication code, the first device authentication code being generated according to the second random authentication code and a pre-stored device identifier corresponding to the current identity authentication period, and the second verifiable data includes a second device authentication code, the second device authentication code being generated by the server according to the second random authentication code and a device identifier corresponding to the current identity authentication period stored in the server; The performing identity authentication processing on the IoT device according to the first verifiable data and the second verifiable data includes: Perform identity authentication processing on the Internet of Things device according to the first device authentication code and the second device authentication code.

4. The method according to claim 3, characterized in that The device identification corresponding to the current identity authentication period stored in the IoT device includes a first device identification generated by the server for the IoT device, and the device identification corresponding to the current identity authentication period stored in the server includes a second device identification generated by the IoT device according to the first device identification. Before receiving the device authentication request sent by the IoT device in the current identity authentication cycle, the method further includes: For each identity authentication cycle, generating a first device identifier corresponding to the IoT device and the incentive; Based on the first device identifier and the stimulus, generate a first message, and encrypt the first message using a pre-built first key to obtain an encrypted first message; Sending the encrypted first message to the Internet of Things device; Receiving an encrypted second message sent by the IoT device, where the encrypted second message is obtained by encrypting the second message by the IoT device using a pre-built second key, and the second message includes a second device identifier generated by the IoT device according to the first device identifier, and a third response value generated according to the stimulus by the physical unclonable function; Decrypting the encrypted second message according to the pre-stored second key to obtain the second message; Generate a fourth response value according to the stimulus by using the physical unclonable function, and perform a matching detection on the third response value and the fourth response value; In the case where the third response value and the fourth response value match successfully, the second device identification is stored.

5. The method according to claim 4, characterized in that Before encrypting the first message by using the pre-built first key to obtain the encrypted first message, the method further includes: Receiving a first polynomial sent by the IoT device; Generate a second polynomial through a first preset hash function; Generate the first key according to the first polynomial and the second polynomial, and send the first key to the Internet of Things device; Receive a second key sent by the IoT device, where the second key is generated by the IoT device according to the first polynomial and a third polynomial, and the third polynomial is generated by the IoT device through a second preset hash function; The second key is stored.

6. The method according to claim 5, characterized in that The method further comprises: In the case that the IoT device fails to perform identity authentication in the current identity authentication cycle, sending an identity authentication failure message to the IoT device, and receiving third verifiable data sent by the IoT device, where the third verifiable data is verifiable data generated by the IoT device in the security element for the previous identity authentication cycle; Perform identity authentication on the Internet of Things device according to the second verifiable data and the third verifiable data.

7. The method according to claim 6, characterized in that The method further comprises: In the case where the identity authentication of the IoT device fails according to the second verifiable data and the third verifiable data, generating, in the current identity authentication cycle, a first temporary identity corresponding to the server, a second temporary identity corresponding to the IoT device, and a temporary incentive; The first temporary identity, the second temporary identity, and the temporary incentive are sent to the Internet of Things device.

8. The method according to claim 1, characterized in that The determining the second stimulus according to the first random authentication code and the first stimulus comprises: According to a preset splitting rule, splitting the first stimulus into a first sub-stimulus and a second sub-stimulus; Determine the second stimulus according to the first random authentication code and the first sub-stimulus; The sending the first random authentication code and the first response value to the Internet of Things device includes: The preset splitting rule, the first random authentication code and the first response value are sent to the Internet of Things device.

9. The method according to claim 8, characterized in that The method further comprises: In the case where it is determined to establish a communication connection with the IoT device according to the identity authentication result, establishing a communication connection with the IoT device; When receiving a processing request for a target service sent by the IoT device, processing the target service and determining a service processing result; The business processing result is encrypted by using the first key to obtain an encrypted business processing result, and the encrypted business processing result is returned to the Internet of Things device through the communication connection.

10. An identity authentication method, characterized in that: The method is applied to an Internet of Things device, and the method comprises: Receiving a first random authentication code and a first response value sent by the server when the server successfully authenticates the IoT device in the current authentication cycle, the first response value being a response value generated by the server inputting a second stimulus into a physical unclonable function, the second stimulus being determined according to the first random authentication code and the first stimulus, and the first stimulus being a stimulus corresponding to the current authentication cycle among the stimuli pre-stored by the server; Acquire a fourth incentive corresponding to the current identity authentication cycle, and determine a third incentive based on the fourth incentive and the first random authentication code; Determining a second response value corresponding to the third stimulus according to the IoT unclonable function; According to the matching detection result of the first response value and the second response value, a first identity authentication result for the server is determined, and the identity authentication result is returned to the server, and the identity authentication result is used to trigger the server to determine whether to establish a communication connection with the Internet of Things device.

Images