Authentication method and device of Internet of Things equipment, and nonvolatile storage medium

Abstract

The invention discloses an authentication method and device of Internet of Things equipment and a nonvolatile storage medium. The method comprises the steps that an Internet of Things cloud platform receives an access request sent by Internet of Things equipment for the first time; physical fingerprint features corresponding to the Internet of Things equipment are searched in the radio frequency fingerprint feature metadata set, and if the physical fingerprint features corresponding to the Internet of Things equipment are searched in the radio frequency fingerprint feature metadata set, the random coding features are decrypted according to a preset decryption algorithm to obtain a decryption result; and when the decryption result is the target random number, determining that the Internet of Things device passes the authentication. According to the method and the device, the technical problem of relatively low security in an authentication process caused by a single authentication method of the Internet of Things cloud platform to the Internet of Things equipment is solved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular, to an authentication method and device for an Internet of Things device, and a non-volatile storage medium. Background Art

[0002] In recent years, with the rise of IoT communication technology, IoT devices have shown an exponential growth trend, and the security issues that come with it have become increasingly prominent. Due to the large number of IoT devices or the limitations of resource and technical capabilities, the protection capabilities of IoT devices are generally weak. Once a malicious intrusion occurs, it is easy to cause security incidents such as business interruption, data leakage, network damage, and property loss.

[0003] In the relevant authentication method for IoT devices to access the cloud platform, the characteristic information of the device itself is encrypted and then sends an access request to the cloud platform. The cloud platform determines whether it is a legitimate device by comparing the characteristic information with the pre-stored information. This authentication method is single and the authentication process is simple. The characteristic information of the device itself can be easily forged. Forged devices, the relevant authentication method cannot effectively screen them and the security is not high.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide an authentication method and device for an IoT device, and a non-volatile storage medium, so as to at least solve the technical problem of low security in the authentication process caused by the single authentication method for IoT devices by the IoT cloud platform.

[0006] According to one aspect of an embodiment of the present application, a method for authenticating an Internet of Things device is provided, comprising: an Internet of Things cloud platform receiving an access request sent for the first time by an Internet of Things device, wherein the access request at least includes: a physical fingerprint feature corresponding to the Internet of Things device, the physical fingerprint feature includes: a radio frequency fingerprint feature of the Internet of Things device and a random coding feature obtained by encrypting a target random number according to a preset encryption algorithm, and a radio frequency fingerprint feature metadata set is pre-stored in the Internet of Things cloud platform; searching for the physical fingerprint feature corresponding to the Internet of Things device in the radio frequency fingerprint feature metadata set, if the physical fingerprint feature corresponding to the Internet of Things device is found in the radio frequency fingerprint feature metadata set, decrypting the random coding feature according to a preset decryption algorithm to obtain a decryption result; when the decryption result is the target random number, it is determined that the Internet of Things device has passed the authentication.

[0007] Optionally, the access request also includes: identification information corresponding to the Internet of Things device; after the Internet of Things cloud platform receives the access request sent by the Internet of Things device for the first time, the method also includes: determining the device type of the Internet of Things device according to the identification information, wherein the device types include: low-importance level devices, medium-importance level devices and high-importance level devices, the low-importance level devices at least include: sensor devices whose access frequency within a preset time period is less than a preset threshold, the medium-importance level devices at least include: home Internet of Things devices, and the high-importance level devices at least include: medical Internet of Things devices.

[0008] Optionally, the method also includes: when the device type of the IoT device is a medium-importance level device, searching for a physical fingerprint feature corresponding to the IoT device in a radio frequency fingerprint feature metadata set; if the physical fingerprint feature corresponding to the IoT device is found in the radio frequency fingerprint feature metadata set, decrypting the random coding feature according to a preset decryption algorithm to obtain a decryption result; if the decryption result is a target random number, determining that the IoT device has passed the authentication, and allowing the IoT device to access the IoT cloud platform.

[0009] Optionally, the method also includes: when the device type of the IoT device is a low importance level device, searching for a physical fingerprint feature corresponding to the IoT device in a radio frequency fingerprint feature metadata set; if the physical fingerprint feature corresponding to the IoT device is found in the radio frequency fingerprint feature metadata set, determining that the IoT device has passed the authentication, and allowing the IoT device to access the IoT cloud platform.

[0010] Optionally, the method also includes: when the device type of the Internet of Things device is a high-importance level device, searching for the physical fingerprint feature corresponding to the Internet of Things device in the radio frequency fingerprint feature metadata set; if the physical fingerprint feature corresponding to the Internet of Things device is found in the radio frequency fingerprint feature metadata set, decrypting the random coding feature according to a preset decryption algorithm to obtain a decryption result; if the decryption result is a target random number, sending a verification instruction to the Internet of Things device, wherein the verification instruction is used to instruct the Internet of Things device to send facial information to the Internet of Things cloud platform; the Internet of Things cloud platform receives the facial information and searches for the facial information in a facial information library; if the facial information is found in the facial information library, it is determined that the Internet of Things device has passed the authentication, and the Internet of Things device is allowed to access the Internet of Things cloud platform.

[0011] Optionally, the physical fingerprint feature also includes business identification information and spatial location information, wherein the business identification information includes: functional information of the Internet of Things device; when the device type of the Internet of Things device cannot be determined based on the identification information, the method also includes: searching for the physical fingerprint feature corresponding to the Internet of Things device in the radio frequency fingerprint feature metadata set; if the physical fingerprint feature corresponding to the Internet of Things device is found in the radio frequency fingerprint feature metadata set, the business identification information and spatial location information are sent to the Internet of Things device management module to which the Internet of Things device is connected, wherein the Internet of Things device management module is used to control the Internet of Things devices in the target area, and is also used to authenticate the business identification information and spatial location information, and when the authentication is successful, a target message including authentication success information is sent to the Internet of Things cloud platform.

[0012] Optionally, after determining that the IoT device has passed the authentication, the method further includes: storing random coding features, and authenticating the IoT device by matching the stored random coding features with the random coding features in the first access request when it is not the first time to receive the first access request sent by the IoT device.

[0013] According to another aspect of the embodiment of the present application, an authentication device for an Internet of Things device is also provided, including: a receiving module, used to receive an access request sent for the first time by the Internet of Things device through an Internet of Things cloud platform, wherein the access request at least includes: a physical fingerprint feature corresponding to the Internet of Things device, the physical fingerprint feature includes: a radio frequency fingerprint feature of the Internet of Things device and a random coding feature obtained by encrypting a target random number according to a preset encryption algorithm, and a radio frequency fingerprint feature metadata set is pre-stored in the Internet of Things cloud platform; a decryption module, used to search for the physical fingerprint feature corresponding to the Internet of Things device in the radio frequency fingerprint feature metadata set, if the physical fingerprint feature corresponding to the Internet of Things device is found in the radio frequency fingerprint feature metadata set, the random coding feature is decrypted according to a preset decryption algorithm to obtain a decryption result; a determination module, used to determine that the Internet of Things device has passed the authentication when the decryption result is the target random number.

[0014] According to another aspect of the embodiments of the present application, a non-volatile storage medium is further provided, the storage medium including a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above authentication method for the Internet of Things device.

[0015] According to another aspect of the embodiments of the present application, an electronic device is provided, including: a memory and a processor, the processor being used to run a program stored in the memory, wherein the above authentication method for an Internet of Things device is executed when the program is run.

[0016] According to another aspect of the embodiments of the present application, a computer program is further provided, wherein when the computer program is executed by a processor, the above authentication method for an Internet of Things device is implemented.

[0017] According to another aspect of the embodiments of the present application, a computer program product is also provided, the computer program product comprising a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above authentication method for an Internet of Things device is implemented.

[0018] In an embodiment of the present application, an IoT cloud platform is used to receive an access request sent for the first time by an IoT device, wherein the access request at least includes: a physical fingerprint feature corresponding to the IoT device, the physical fingerprint feature includes: a radio frequency fingerprint feature of the IoT device and a random coding feature obtained by encrypting a target random number according to a preset encryption algorithm, and a radio frequency fingerprint feature metadata set is pre-stored in the IoT cloud platform; the physical fingerprint feature corresponding to the IoT device is searched in the radio frequency fingerprint feature metadata set, and if the physical fingerprint feature corresponding to the IoT device is found in the radio frequency fingerprint feature metadata set, the random coding feature is decrypted according to a preset decryption algorithm to obtain a decryption result; when the decryption result is the target random number, it is determined that the IoT device has passed the authentication method, thereby achieving the purpose of multi-factor authentication of the IoT device, thereby achieving the technical effect of improving the security of the authentication process, and further solving the technical problem of low security in the authentication process due to the single authentication method of the IoT cloud platform for IoT devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 is a flow chart of an authentication method for an Internet of Things device according to an embodiment of the present application;

[0021] Figure 2 is a structural diagram of an authentication device for an Internet of Things device according to an embodiment of the present application;

[0022] Figure 3 It is a hardware structure block diagram of a computer terminal according to an authentication method for an Internet of Things device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] According to an embodiment of the present application, a method embodiment of an authentication method for an Internet of Things device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0026] Figure 1 is a flow chart of an authentication method for an Internet of Things device according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0027] In step S102, the IoT cloud platform receives an access request sent for the first time by the IoT device, wherein the access request at least includes: a physical fingerprint feature corresponding to the IoT device, the physical fingerprint feature includes: a radio frequency fingerprint feature of the IoT device and a random coding feature obtained by encrypting a target random number according to a preset encryption algorithm, and a set of radio frequency fingerprint feature metadata is pre-stored in the IoT cloud platform.

[0028] RF fingerprint feature metadata refers to the data set used to describe and store RF fingerprint feature information in the RF fingerprint recognition system. These metadata include various aspects of RF fingerprints, such as the unique patterns or deviations generated by the device when transmitting or receiving wireless signals. These patterns or deviations are caused by the physical characteristics of the device and slight differences in the manufacturing process. Therefore, the RF fingerprint of each device is unique. Among them, in the identity authentication scenario of IoT devices, the RF fingerprint feature metadata can specifically include the following types of information: 1. Device RF parameters: including but not limited to transmission power, frequency offset, phase deviation, delay characteristics, inter-symbol interference (ISI) and multipath effects, which are all reflections of the physical characteristics of the device on the RF signal. 2. Hardware information: such as the device's MAC address, IMEI number (for mobile devices), serial number, processor model, memory size, storage capacity, etc. 3. Operating system information: such as operating system version, kernel version, system language, etc. Although this information does not directly constitute the RF fingerprint, it can be used as auxiliary information for comprehensive judgment of the device identity. 4. Device usage environment information: including environmental factors such as the location, operating temperature, humidity, etc. of the device. In some cases, this information can affect the RF characteristics of the device, so it is also part of the RF fingerprint feature metadata. 5. Historical authentication information: such as the device’s past access records, authentication results, etc. This information can be used to analyze device behavior patterns and determine whether the device is normal or has been tampered with.

[0029] RF fingerprint metadata is pre-stored in the IoT cloud platform database and is used to compare with the RF fingerprint sent by the IoT device requesting access to determine the legitimacy of the device. The accuracy and integrity of the RF fingerprint metadata are directly related to the accuracy and security of the identity authentication system. In order to ensure the reliability of the system, these metadata need to be regularly updated and maintained to reflect the latest status of the device's RF characteristics.

[0030] Step S104, searching for the physical fingerprint feature corresponding to the IoT device in the RF fingerprint feature metadata set. If the physical fingerprint feature corresponding to the IoT device is found in the RF fingerprint feature metadata set, the random coding feature is decrypted according to a preset decryption algorithm to obtain a decryption result.

[0031] Step S106: When the decryption result is the target random number, it is determined that the IoT device has passed the authentication.

[0032] When an IoT device attempts to access the IoT cloud platform for the first time, it will send an access request. The access request contains at least one important piece of data: the physical fingerprint feature of the device. The physical fingerprint feature is generated through the inherent characteristics of the device hardware and software. It is globally unique and dynamic, ensuring that each device can be uniquely identified each time it accesses. Among them, the physical fingerprint feature consists of two parts: one is the radio frequency fingerprint feature of the IoT device, which reflects the subtle signal distortion caused by the hardware (such as antennas, modems, etc.) of the device when transmitting and receiving wireless signals. This distortion varies from device to device and is a reflection of the hardware differences of the device; the other is the random coding feature obtained by encrypting the target random number according to the preset encryption algorithm. This feature increases the dynamicity. Even if the device hardware information is copied, due to the addition of random coding, the forged device cannot pass the authentication smoothly. A new random number should be generated each time the device initiates an access request. The generated target random number is encrypted to form a random coding feature. The encryption algorithm can be AES (Advanced Encryption Standard) or other symmetric encryption algorithms, or asymmetric encryption algorithms such as RSA to ensure the security of random numbers during transmission.

[0033] In the IoT cloud platform, a set of RF fingerprint metadata is pre-stored. This set contains the RF fingerprint feature information of all known legitimate IoT devices, which is collected and stored when the device is registered or first connected. The metadata set is the basis for the cloud platform to perform the first authentication comparison, which is used to verify whether the RF fingerprint features in the access request match the features of the known legitimate devices.

[0034] After receiving the access request, the IoT cloud platform first decrypts and parses the physical fingerprint features in the request to extract the RF fingerprint features and random code features. The extracted RF fingerprint features are compared with the pre-stored RF fingerprint feature metadata set to check whether there is a matching record. If there is a match, it means that the hardware identity of the device has been preliminarily confirmed and can proceed to the next step of verification; if there is a mismatch, access is immediately denied because it may be an unregistered or forged device.

[0035] Next step verification: After the IoT cloud platform receives the access request from the IoT device, it uses a preset decryption algorithm (such as an RSA private key) to decrypt the random coding features carried and obtain the decryption result. The purpose of decryption is to restore the original target random number for subsequent authentication operations. The IoT cloud platform checks whether the decryption result is the target random number. If the decryption result matches the target random number, it means that the transmission process has not been maliciously tampered with and the random coding features are valid, thereby preliminarily determining that the IoT device has passed the dynamic feature authentication.

[0036] If both the RF fingerprint feature comparison and the random code feature verification are passed, the IoT cloud platform will send an access confirmation response to the IoT device, allowing the device to access and start data interaction. At the same time, the cloud platform will update the authentication status of the device and record the detailed information of this authentication, including the random code feature, as the basis for the next authentication. Through the above specific implementation methods, the IoT cloud platform can effectively distinguish and authenticate different IoT devices, ensure that only legitimate devices can access, and enhance the unforgeability and security of the authentication process through dynamic random code features.

[0037] The following Figure 1 The steps shown are exemplary and explanatory.

[0038] According to some optional embodiments of the present application, the access request also includes: identification information corresponding to the IoT device. Further, after the IoT cloud platform receives the access request sent by the IoT device for the first time, it can also perform the following steps: determine the device type to which the IoT device belongs based on the identification information, wherein the device types include: low-importance level devices, medium-importance level devices, and high-importance level devices, and the low-importance level includes at least: sensor devices whose access frequency within a preset time period is less than a preset threshold, the medium-importance level devices include at least: home IoT devices, and the high-importance level devices include at least: medical IoT devices.

[0039] Furthermore, when the device type of the IoT device is a medium-importance level device, the physical fingerprint feature corresponding to the IoT device is searched in the RF fingerprint feature metadata set; if the physical fingerprint feature corresponding to the IoT device is found in the RF fingerprint feature metadata set, the random coding feature is decrypted according to a preset decryption algorithm to obtain a decryption result; if the decryption result is the target random number, it is determined that the IoT device has passed the authentication, and the IoT device is allowed to access the IoT cloud platform.

[0040] Preferably, when the device type of the IoT device is a low-importance level device, the physical fingerprint feature corresponding to the IoT device is found in the RF fingerprint feature metadata set; if the physical fingerprint feature corresponding to the IoT device is found in the RF fingerprint feature metadata set, it is determined that the IoT device has passed the authentication, and the IoT device is allowed to access the IoT cloud platform.

[0041] Preferably, when the device type of the Internet of Things device is a high-importance level device, the physical fingerprint feature corresponding to the Internet of Things device is searched in the radio frequency fingerprint feature metadata set; if the physical fingerprint feature corresponding to the Internet of Things device is found in the radio frequency fingerprint feature metadata set, the random coding feature is decrypted according to a preset decryption algorithm to obtain a decryption result; if the decryption result is a target random number, a verification instruction is sent to the Internet of Things device, wherein the verification instruction is used to instruct the Internet of Things device to send facial information to the Internet of Things cloud platform; the Internet of Things cloud platform receives the facial information and searches for the facial information in a facial information library; if the facial information is found in the facial information library, it is determined that the Internet of Things device has passed the authentication, and the Internet of Things device is allowed to access the Internet of Things cloud platform.

[0042] When the IoT cloud platform receives the first access request from an IoT device, it first parses the device's identification information (such as device ID) from the request. Based on the device ID, the IoT cloud platform queries its internal database to determine the type of the device. Device types are classified based on the device's frequency of use, functional importance, maintenance and replacement costs, and security requirements, and are specifically divided into low-importance devices, medium-importance devices, and high-importance devices. Among them, low-importance devices refer to sensor devices whose access frequency within a preset time period (for example, one week) is less than a preset threshold (for example, 5 times). The functions of such devices are relatively simple and are not easily attacked or have a significant impact on the overall system. Medium-importance devices include at least home IoT devices, such as smart air conditioners and smart lighting systems. The frequency of use and functional importance of such devices are between low-importance and high-importance devices. High-importance devices include at least medical IoT devices, such as remote monitoring devices and medical diagnostic devices. Such devices are critical to business or life, and may cause serious consequences if attacked or misoperated.

[0043] The IoT cloud platform automatically selects the corresponding authentication strategy based on the type of device. For low-importance devices, only one verification is performed based on the physical fingerprint characteristics of the device, without the need for additional secondary authentication identification. This is suitable for devices that are used less frequently and are relatively safe, such as temporary cameras in conference rooms.

[0044] For medium-important level devices, a primary verification based on the physical fingerprint features of the device is performed to determine the identity of the device. Then, a secondary authentication is performed to decrypt the random code features according to the preset decryption algorithm to obtain the decryption result; if the decryption result is the target random number, it is determined that the IoT device has passed the authentication.

[0045] For high-importance devices, the cloud platform searches for physical fingerprint features that match the device in the RF fingerprint feature metadata set. Assume that the RF fingerprint features found by the cloud platform are exactly the same as the RF fingerprint features generated by the device terminal. The cloud platform uses a preset decryption algorithm (for example, AES decryption algorithm) to decrypt the random coded features and obtain the decryption result. If the decryption result matches the target random number preset in the cloud platform, it means that the device's identity authentication has passed the second step. In order to further verify the identity of the device user, the cloud platform sends a verification instruction to the IoT device, instructing the device to collect the current user's facial information. The facial information can be obtained through a built-in facial recognition sensor or an external facial recognition device. The IoT device responds to the verification instruction, captures and uploads the user's facial information to the IoT cloud platform. The facial information is sent through a secure transmission channel to prevent the information from being intercepted or tampered with during transmission. After receiving the facial information, the IoT cloud platform searches for the facial information in its facial information database. The facial information database contains the facial data of all legitimate users, which has been collected and stored when the device was registered. Assume that a record matching the uploaded facial information is found in the facial information database. This means that the identity of the device user is also verified as legitimate.

[0046] According to some other optional embodiments of the present application, the physical fingerprint feature also includes business identification information and spatial location information, wherein the business identification information includes: functional information of the Internet of Things device.

[0047] Furthermore, when it is impossible to determine the device type of the IoT device based on the identification information, the following steps can also be performed: search for the physical fingerprint feature corresponding to the IoT device in the RF fingerprint feature metadata set; if the physical fingerprint feature corresponding to the IoT device is found in the RF fingerprint feature metadata set, send the business identification information and the spatial location information to the IoT device management module to which the IoT device is connected, wherein the IoT device management module is used to control the IoT devices in the target area, and is also used to authenticate the business identification information and the spatial location information, and when the authentication is successful, send a target message including the authentication success information to the IoT cloud platform.

[0048] The IoT device management module is a key component in the IoT system, and is mainly responsible for monitoring, controlling and managing devices connected to the IoT platform. It provides a series of functions and services to ensure the normal operation, security and efficiency of IoT devices. The following are some of the main functions of the IoT device management module: 1. Device registration and authentication: Ensure that only authorized devices can connect to the IoT platform. The device management module verifies the identity of the device through various authentication mechanisms (such as certificates, keys, or the physical fingerprint characteristics of the device in the present invention) to prevent unauthorized devices from accessing, thereby protecting the security of the network. 2. Device configuration and update: Allows remote configuration and updating of device software, firmware, and parameter settings. This includes the initial configuration of the device, updating of security settings, upgrading of software versions, etc., to ensure that the device runs in the latest and safest state.

[0049] Specifically, first collect the functional information of the IoT device, such as the device type (smoke alarm), usage scenario (conference room), and the current spatial location information of the device (for example, the latitude and longitude coordinates obtained by GPS or Wi-Fi positioning). Through the built-in sensor of the device or the external RF signal analysis device, obtain the physical fingerprint characteristics of the device when transmitting and receiving signals, including the power difference and signal distortion of the hardware components inside the device. Combine the RF fingerprint characteristics, business identification information (functional information) and spatial location information into the physical fingerprint characteristics of the device. After receiving the access request, the IoT cloud platform searches for the corresponding physical fingerprint characteristics in the RF fingerprint feature metadata set, and verifies the hardware identity of the device by comparing it with the pre-stored RF fingerprint feature metadata. If the RF fingerprint feature comparison is successful, further check the business identification information and spatial location information to ensure that the functional information and location information of the device meet expectations. If the authentication is successful, the IoT device management module sends a target message containing the "authentication passed" information to the IoT cloud platform.

[0050] When a smoke alarm is first connected to the Internet of Things, the power difference of its hardware components is detected and converted into a physical fingerprint feature. The power difference can be detected by analyzing the slight differences when the device transmits or receives signals. These differences include but are not limited to signal strength, frequency offset, modulation error, etc. These data are collected and converted into digital representations to form the device's RF fingerprint. In addition to the device's RF fingerprint, a business identifier is also added to indicate the type and function of the device, such as "smoke alarm". This identifier ensures that even if two different device types have similar RF characteristics, they can be distinguished by the business identifier. Integrating the location or space identifier of the smoke alarm into its physical fingerprint feature is a key step. When the smoke alarm is connected to the Internet of Things, it determines its current location or space through geolocation services or indoor positioning systems, and adds this information to its RF fingerprint feature in digital form, forming a business identifier + physical fingerprint generated based on the power difference + the location or space identifier of the device. The smoke alarm sends an access request to the Internet of Things cloud platform, which contains the encrypted physical fingerprint feature. The cloud platform first parses this feature to separate the business identifier, the physical fingerprint generated based on the power difference, and the location or space identifier of the device. The parsed business identifier is first verified to ensure that the device sending the request is a smoke alarm, not another type of device. Once the business identifier is verified, the cloud platform will compare the physical fingerprint generated based on the power difference with the pre-stored database of physical fingerprint features of the smoke alarm, and check whether the spatial identifier where the device is located has been included in the alarm range. This verification process ensures the uniqueness of the device and the legitimacy of the location. Only when the business identifier, physical fingerprint feature and spatial identifier are all verified, the cloud platform will consider the physical indicator feature to have passed the verification. At this point, the smoke alarm is officially authenticated as a legitimate device located in the correct location and can be activated and start working. After the smoke alarm passes the verification, the current authentication identifier stored in the cloud platform is updated to the combination of the physical fingerprint feature and location identifier extracted in this verification, which is used as the current authentication identifier for the next access authentication, ensuring that the device can be accurately identified during subsequent access.

[0051] In some optional embodiments of the present application, after determining that the IoT device has passed the authentication, the following steps may also be performed: storing random coding features, and authenticating the IoT device by matching the stored random coding features with the random coding features in the first access request when it is not the first time to receive the first access request sent by the IoT device.

[0052] For devices that pass the initial RF fingerprint feature comparison, the IoT cloud platform will check the random code feature. Since no random code related to the device has been stored in the cloud platform during the first access, the cloud platform will store the current random code feature as the current authentication identifier of the device for secondary authentication during the next access. For the next and subsequent authentications, the IoT cloud platform will use the stored random code feature (i.e., the current authentication identifier) ​​for comparison to ensure that the physical fingerprint feature of the device is not only unique, but also changes with each access, thereby enhancing the security of authentication and preventing attacks based on static information.

[0053] Figure 2 is a structural diagram of an authentication device for an Internet of Things device according to an embodiment of the present application, such as Figure 2 As shown, the device comprises:

[0054] The receiving module 22 is used to receive the access request sent for the first time by the IoT device through the IoT cloud platform, wherein the access request at least includes: the physical fingerprint feature corresponding to the IoT device, the physical fingerprint feature includes: the radio frequency fingerprint feature of the IoT device and the random coding feature obtained by encrypting the target random number according to a preset encryption algorithm, and the IoT cloud platform pre-stores a set of radio frequency fingerprint feature metadata.

[0055] The decryption module 24 is used to search for the physical fingerprint feature corresponding to the IoT device in the RF fingerprint feature metadata set. If the physical fingerprint feature corresponding to the IoT device is found in the RF fingerprint feature metadata set, the random code feature is decrypted according to a preset decryption algorithm to obtain a decryption result.

[0056] The determination module 26 is used to determine whether the IoT device has passed the authentication when the decryption result is the target random number.

[0057] Optionally, the access request also includes: identification information corresponding to the Internet of Things device; after the Internet of Things cloud platform receives the access request sent by the Internet of Things device for the first time, the authentication device of the Internet of Things device is also used to perform the following steps: according to the identification information, determine the device type to which the Internet of Things device belongs, wherein the device types include: low-importance level devices, medium-importance level devices and high-importance level devices, the low-importance level devices at least include: sensor devices whose access frequency within a preset time period is less than a preset threshold, the medium-importance level devices at least include: household Internet of Things devices, and the high-importance level devices at least include: medical Internet of Things devices.

[0058] Optionally, the authentication device of the Internet of Things device is also used to perform the following steps: when the device type of the Internet of Things device is a medium-importance level device, searching for the physical fingerprint feature corresponding to the Internet of Things device in the radio frequency fingerprint feature metadata set; if the physical fingerprint feature corresponding to the Internet of Things device is found in the radio frequency fingerprint feature metadata set, the random coding feature is decrypted according to a preset decryption algorithm to obtain a decryption result; if the decryption result is a target random number, it is determined that the Internet of Things device has passed the authentication, and the Internet of Things device is allowed to access the Internet of Things cloud platform.

[0059] Optionally, the authentication device of the Internet of Things device is also used to perform the following steps: when the device type of the Internet of Things device is a low-importance level device, the physical fingerprint feature corresponding to the Internet of Things device is found in the radio frequency fingerprint feature metadata set; if the physical fingerprint feature corresponding to the Internet of Things device is found in the radio frequency fingerprint feature metadata set, it is determined that the Internet of Things device has passed the authentication, and the Internet of Things device is allowed to access the Internet of Things cloud platform.

[0060] Optionally, the authentication device of the Internet of Things device is also used to perform the following steps: when the device type of the Internet of Things device is a high-importance level device, searching for the physical fingerprint feature corresponding to the Internet of Things device in the radio frequency fingerprint feature metadata set; if the physical fingerprint feature corresponding to the Internet of Things device is found in the radio frequency fingerprint feature metadata set, the random coding feature is decrypted according to a preset decryption algorithm to obtain a decryption result; if the decryption result is a target random number, a verification instruction is sent to the Internet of Things device, wherein the verification instruction is used to instruct the Internet of Things device to send facial information to the Internet of Things cloud platform; the Internet of Things cloud platform receives the facial information and searches for the facial information in a facial information library; if the facial information is found in the facial information library, it is determined that the Internet of Things device has passed the authentication, and the Internet of Things device is allowed to access the Internet of Things cloud platform.

[0061] Optionally, the physical fingerprint feature also includes business identification information and spatial location information, wherein the business identification information includes: functional information of the Internet of Things device; when the device type of the Internet of Things device cannot be determined based on the identification information, the authentication device of the Internet of Things device is also used to perform the following steps: searching for the physical fingerprint feature corresponding to the Internet of Things device in the radio frequency fingerprint feature metadata set; if the physical fingerprint feature corresponding to the Internet of Things device is found in the radio frequency fingerprint feature metadata set, the business identification information and spatial location information are sent to the Internet of Things device management module to which the Internet of Things device is connected, wherein the Internet of Things device management module is used to control the Internet of Things devices in the target area, and is also used to authenticate the business identification information and spatial location information, and when the authentication is successful, send a target message including the authentication success information to the Internet of Things cloud platform.

[0062] Optionally, after determining that the IoT device has passed the authentication, the authentication device of the IoT device is also used to perform the following steps: storing random coding features, and authenticating the IoT device by matching the stored random coding features with the random coding features in the first access request when it is not the first time to receive the first access request sent by the IoT device.

[0063] It should be noted that the above Figure 2 The modules in the embodiment may be program modules (e.g., a set of program instructions for implementing a specific function) or hardware modules. For the latter, they may be expressed in the following forms, but are not limited thereto: the expression form of the above modules is a processor, or the functions of the above modules are implemented by a processor.

[0064] It should be noted that Figure 2 The preferred implementation of the illustrated embodiment can be found in Figure 1 The relevant description of the illustrated embodiment will not be repeated here.

[0065] Figure 3 The hardware structure block diagram of a computer terminal for implementing an authentication method for an Internet of Things device is shown. Figure 3 As shown, the computer terminal 30 may include one or more (302a, 302b, ..., 302n are used to illustrate) processors 302 (the processor 302 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 303 for storing data, and a transmission module 306 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 3 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 3 More or fewer components as shown, or with Figure 3 Different configurations shown.

[0066] It should be noted that the one or more processors 302 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 30. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0067] The memory 303 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the authentication method of the Internet of Things device in the embodiment of the present application. The processor 302 executes various functional applications and data processing by running the software programs and modules stored in the memory 303, that is, realizing the authentication method of the Internet of Things device mentioned above. The memory 303 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 303 may further include a memory remotely arranged relative to the processor 302, and these remote memories may be connected to the computer terminal 30 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0068] The transmission module 306 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 30. In one example, the transmission module 306 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 306 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0069] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 30 .

[0070] It should be noted that, in some optional embodiments, the above Figure 3 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 3 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0071] It should be noted that Figure 3 The computer terminal shown is used to execute Figure 1 The authentication method of the Internet of Things device shown in the figure, therefore the relevant explanations in the execution method of the above command are also applicable to the electronic device and will not be repeated here.

[0072] The embodiment of the present application further provides a non-volatile storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above authentication method for the Internet of Things device.

[0073] A program for a non-volatile storage medium to perform the following functions: an Internet of Things cloud platform receives an access request sent for the first time by an Internet of Things device, wherein the access request at least includes: a physical fingerprint feature corresponding to the Internet of Things device, the physical fingerprint feature includes: a radio frequency fingerprint feature of the Internet of Things device and a random coding feature obtained by encrypting a target random number according to a preset encryption algorithm, and a radio frequency fingerprint feature metadata set is pre-stored in the Internet of Things cloud platform; the physical fingerprint feature corresponding to the Internet of Things device is searched in the radio frequency fingerprint feature metadata set, if the physical fingerprint feature corresponding to the Internet of Things device is found in the radio frequency fingerprint feature metadata set, the random coding feature is decrypted according to a preset decryption algorithm to obtain a decryption result; when the decryption result is the target random number, it is determined that the Internet of Things device has passed the authentication.

[0074] An embodiment of the present application also provides an electronic device, including: a memory and a processor, the processor is used to run a program stored in the memory, wherein the above authentication method for the Internet of Things device is executed when the program is running.

[0075] The processor is used to run a program that performs the following functions: the Internet of Things cloud platform receives an access request sent for the first time by the Internet of Things device, wherein the access request at least includes: a physical fingerprint feature corresponding to the Internet of Things device, the physical fingerprint feature includes: a radio frequency fingerprint feature of the Internet of Things device and a random coding feature obtained by encrypting a target random number according to a preset encryption algorithm, and the Internet of Things cloud platform pre-stores a radio frequency fingerprint feature metadata set; searching for the physical fingerprint feature corresponding to the Internet of Things device in the radio frequency fingerprint feature metadata set, if the physical fingerprint feature corresponding to the Internet of Things device is found in the radio frequency fingerprint feature metadata set, decrypting the random coding feature according to a preset decryption algorithm to obtain a decryption result; when the decryption result is the target random number, it is determined that the Internet of Things device has passed the authentication.

[0076] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0077] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0078] In the above-mentioned embodiments of the present application, the collected information is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary protection measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0079] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0080] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0081] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0082] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0083] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for authenticating an Internet of Things device, characterized in that: include: The IoT cloud platform receives an access request sent for the first time by an IoT device, wherein the access request at least includes: a physical fingerprint feature corresponding to the IoT device, the physical fingerprint feature includes: a radio frequency fingerprint feature of the IoT device and a random coding feature obtained by encrypting a target random number according to a preset encryption algorithm, and a set of radio frequency fingerprint feature metadata is pre-stored in the IoT cloud platform; Searching for a physical fingerprint feature corresponding to the IoT device in the RF fingerprint feature metadata set, and if the physical fingerprint feature corresponding to the IoT device is found in the RF fingerprint feature metadata set, decrypting the random code feature according to a preset decryption algorithm to obtain a decryption result; When the decryption result is the target random number, it is determined that the Internet of Things device has passed the authentication.

2. The method according to claim 1, characterized in that The access request also includes: identification information corresponding to the IoT device; After the IoT cloud platform receives the access request sent by the IoT device for the first time, the method further includes: According to the identification information, determine the device type to which the Internet of Things device belongs, wherein the device types include: low-importance level devices, medium-importance level devices and high-importance level devices, the low-importance level devices at least include: sensor devices whose access frequency within a preset time period is less than a preset threshold, the medium-importance level devices at least include: household Internet of Things devices, and the high-importance level devices at least include: medical Internet of Things devices.

3. The method according to claim 2, characterized in that The method further comprises: In a case where the device type of the Internet of Things device is a medium-importance level device, searching for a physical fingerprint feature corresponding to the Internet of Things device in the radio frequency fingerprint feature metadata set; If the physical fingerprint feature corresponding to the IoT device is found in the RF fingerprint feature metadata set, the random code feature is decrypted according to a preset decryption algorithm to obtain a decryption result; If the decryption result is the target random number, it is determined that the IoT device has passed the authentication, and the IoT device is allowed to access the IoT cloud platform.

4. The method according to claim 2, characterized in that: The method further comprises: In the case where the device type of the Internet of Things device is a low importance level device, searching for a physical fingerprint feature corresponding to the Internet of Things device in the radio frequency fingerprint feature metadata set; If the physical fingerprint feature corresponding to the IoT device is found in the RF fingerprint feature metadata set, it is determined that the IoT device has passed the authentication, and the IoT device is allowed to access the IoT cloud platform.

5. The method according to claim 2, characterized in that: The method further comprises: In a case where the device type of the IoT device is a high-importance level device, searching for a physical fingerprint feature corresponding to the IoT device in the RF fingerprint feature metadata set; If the physical fingerprint feature corresponding to the IoT device is found in the RF fingerprint feature metadata set, the random code feature is decrypted according to a preset decryption algorithm to obtain a decryption result; If the decryption result is the target random number, a verification instruction is sent to the IoT device, wherein the verification instruction is used to instruct the IoT device to send facial information to the IoT cloud platform; The IoT cloud platform receives the facial information and searches for the facial information in a facial information database; If the facial information is found in the facial information database, it is determined that the IoT device has passed the authentication, and the IoT device is allowed to access the IoT cloud platform.

6. The method according to claim 2, characterized in that The physical fingerprint feature also includes business identification information and spatial location information, wherein the business identification information includes: function information of the IoT device; In the case where the device type to which the IoT device belongs cannot be determined according to the identification information, the method further includes: searching for a physical fingerprint feature corresponding to the IoT device in the RF fingerprint feature metadata set; If the physical fingerprint feature corresponding to the IoT device is found in the RF fingerprint feature metadata set, the service identification information and the spatial location information are sent to the IoT device management module to which the IoT device is connected, wherein the IoT device management module is used to control the IoT device in the target area, and is also used to authenticate the service identification information and the spatial location information, and if the authentication is successful, send a target message including the authentication success information to the IoT cloud platform.

7. The method according to claim 1, characterized in that After determining that the IoT device has passed the authentication, the method further includes: storing the random coding feature, and authenticating the IoT device by matching the stored random coding feature with the random coding feature in the first access request when it is not the first time to receive the first access request sent by the IoT device.

8. An authentication device for an Internet of Things device, characterized in that: include: A receiving module, configured to receive an access request sent for the first time by an IoT device through an IoT cloud platform, wherein the access request at least includes: a physical fingerprint feature corresponding to the IoT device, the physical fingerprint feature includes: a radio frequency fingerprint feature of the IoT device and a random coding feature obtained by encrypting a target random number according to a preset encryption algorithm, and a set of radio frequency fingerprint feature metadata is pre-stored in the IoT cloud platform; A decryption module, used to search for the physical fingerprint feature corresponding to the IoT device in the RF fingerprint feature metadata set, and if the physical fingerprint feature corresponding to the IoT device is found in the RF fingerprint feature metadata set, decrypt the random code feature according to a preset decryption algorithm to obtain a decryption result; A determination module is used to determine that the Internet of Things device has passed the authentication when the decryption result is the target random number.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the authentication method for an Internet of Things device according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the authentication method for an Internet of Things device as described in any one of claims 1 to 7 when running.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the authentication method for an Internet of Things device described in any one of claims 1 to 7 is implemented.

Images