Trusted identity authentication method, system and device for industrial internet equipment and medium

Abstract

The invention provides a trusted identity authentication method, system and device for industrial internet equipment and a medium, and belongs to the technical field of equipment authentication. The method comprises the following steps: analyzing a secondary node through an industrial internet identifier, and generating the industrial internet identifier for industrial internet equipment; writing the industrial internet identifier into a TEE safety area of an active identification chip built in the industrial internet equipment; registering the terminal information of the industrial internet equipment to an industrial internet platform; and when the industrial internet equipment is online, the signature verification and environment isolation technology of the trusted application TA of the OP-TEE is adopted to carry out the transmission of terminal information and the trusted verification of the industrial internet identifier. According to the method, the identity authentication security of the industrial internet equipment is effectively improved by adopting the technologies of industrial internet identifier analysis, TEE secure area storage, signature verification of OP-TEE trusted application TA and environment isolation and by utilizing data encryption and RPC message transmission.

Description

Technical Field

[0001] The present invention relates to the field of device authentication technology, and more specifically to a trusted identity authentication method, system, device and medium for industrial Internet devices. Background Art

[0002] With the rise of the industrial Internet, industrial Internet devices are growing exponentially, and the security issues that come with it are becoming more and more prominent. Due to the large number or limited resource and technical capabilities, the protection capabilities of industrial Internet devices are generally weak. Once a malicious intrusion occurs, it is easy to cause major security incidents such as business interruption, data leakage, network damage, and property loss.

[0003] At present, most authentication methods for industrial Internet devices to access cloud platforms are based on IMEI authentication or Token authentication. The more complex methods include encrypting the characteristic information of the device itself and then sending an access request to the cloud platform. IMEI, Token, and characteristic information are transmitted in plain text on the network, which poses a risk of being stolen or tampered with. The cloud platform determines whether it is a legitimate device by comparing the received identity authentication information with the pre-stored information. This authentication method is single, the authentication process is simple, and the identity authentication information of the device itself can be easily forged. Summary of the invention

[0004] In response to the above problems, the purpose of the present invention is to provide a trusted identity authentication method, system, device and medium for industrial Internet devices. By adopting industrial Internet identity resolution, TEE security zone storage, OP-TEE trusted application TA signature verification and environment isolation technology, and utilizing data encryption and RPC message transmission, the identity authentication security of industrial Internet devices is effectively improved, ensuring the integrity and confidentiality of data during storage and transmission, and providing a solid guarantee for the safe operation of the Industrial Internet.

[0005] In order to achieve the above object, the present invention is implemented through the following technical solutions: In a first aspect, the present invention discloses a trusted identity authentication method for an industrial Internet device, comprising: Generate an industrial Internet ID for industrial Internet devices through the industrial Internet ID resolution secondary node; Write the industrial Internet identity into the TEE security zone of the active identification chip built into the industrial Internet device; Register the terminal information of industrial Internet devices to the industrial Internet platform; When the industrial Internet device is online, the signature verification and environment isolation technology of OP-TEE's trusted application TA is used to transmit terminal information and verify the trustworthiness of the industrial Internet identity.

[0006] Further, the industrial Internet identifier is generated for the industrial Internet device through the industrial Internet identifier resolution secondary node, including: Through the secondary node of industrial Internet identity resolution based on the VAA identity resolution platform, the VAA coding standard is adopted to generate the VAA code of the device according to the industry code and enterprise code of the industrial Internet device as the industrial Internet identifier.

[0007] Furthermore, the VAA code of the device includes: a code issuing agency code, a country code, an industry code, an enterprise code and an internal enterprise code.

[0008] Furthermore, the step of writing the industrial Internet identification into the TEE security zone of the active identification chip built into the industrial Internet device includes: Install the OP-TEE operating system in the industrial Internet device and install the registered and adapted trusted application as a tool for writing the industrial Internet identity; Start the trusted application and enable the file system through preset commands; Obtain the industrial Internet identity and the identity credentials for accessing the industrial Internet IoT platform, and write them into persistent objects through the API provided by the TEE trusted storage service; Use the file system to encrypt data, and send file operation commands and encrypted data to the file requester through RPC messages; The encrypted data is stored in the TEE secure area through the file requester.

[0009] Further, enabling the file system through a preset command includes: Enable the REE file system by command CFG_RPMB_FS=y.

[0010] Furthermore, the terminal information of the industrial Internet device includes but is not limited to: product type, product name, product model, production date, factory number, and industrial Internet identification. Furthermore, when the industrial Internet device is online, the signature verification and environment isolation technology of the trusted application TA of OP-TEE is used to transmit terminal information and verify the trustworthiness of the industrial Internet identity, including: When the REE embedded program of the industrial Internet device is powered on and started, it obtains the industrial Internet identity and the identity credentials for accessing the industrial Internet IoT platform through the CA and TA secure communication channels of OP-TEE, sends them to the industrial Internet platform through the MQTT protocol, and initiates an identity authentication request; In response to the industrial Internet platform receiving the identity authentication request, verify whether the industrial Internet identity has been registered in the platform database; If not, the verification fails; if so, the consistency of the corresponding user name, password and industrial Internet identifier is verified according to the identity credentials; If the username and password are correct and correspond to the Industrial Internet ID, the verification is successful.

[0011] In a second aspect, the present invention further discloses a trusted identity authentication system for industrial Internet devices, comprising: An identification creation module is used to generate an industrial Internet identification for an industrial Internet device through an industrial Internet identification resolution secondary node; The identification storage module is used to write the industrial Internet identification into the TEE security zone of the active identification chip built into the industrial Internet device; The device registration module is used to register the terminal information of the industrial Internet device to the industrial Internet platform; The platform verification module is used to transmit terminal information and verify the trustworthiness of industrial Internet identification by using the signature verification and environment isolation technology of OP-TEE's trusted application TA when the industrial Internet equipment is online. In a third aspect, the present invention further discloses a trusted identity authentication device for an industrial Internet device, comprising: A memory device for storing a trusted identity authentication program for an industrial Internet device; A processor is used to implement the steps of the trusted identity authentication method for an industrial Internet device as described in any of the above items when executing the trusted identity authentication program of the industrial Internet device.

[0012] In a fourth aspect, the present invention further discloses a readable storage medium, on which a trusted identity authentication program for an industrial Internet device is stored. When the trusted identity authentication program for the industrial Internet device is executed by a processor, the steps of the trusted identity authentication method for the industrial Internet device as described in any of the above items are implemented.

[0013] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention generates an industrial Internet identity for a device through an industrial Internet identity resolution secondary node, and writes it into the TEE (Trusted Execution Environment) security zone of the active identification chip built into the device, effectively preventing the risk of the identity being tampered with or misused, and enhancing the identity authentication security of the device.

[0014] 2. The present invention adopts the signature verification and environment isolation technology of OP-TEE's trusted application TA (Trusted Application) to perform the transmission of terminal information and the trusted verification of the industrial Internet identity when the device is online. This technology ensures the security and integrity of the information transmission process, while improving the efficiency and accuracy of identity authentication.

[0015] 3. The present invention registers and manages the terminal information of the equipment through the industrial Internet platform, including key information such as product type, name, model, etc., making equipment management more convenient and efficient. At the same time, the generation and use of industrial Internet identification also facilitates the tracking and tracing of equipment.

[0016] 4. The present invention generates an industrial Internet identifier based on the VAA (Variable Asset Allocation) coding standard. This coding method has good flexibility and scalability and can adapt to the changing needs of different industries and enterprises.

[0017] 5. When writing the industrial Internet identification and access credentials into the TEE security zone, the present invention ensures the security of data during storage and transmission through data encryption and RPC (Remote Procedure Call) message transmission.

[0018] It can be seen that compared with the prior art, the present invention has outstanding substantive features and significant progress, and the beneficial effects of its implementation are also obvious. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0020] Figure 1 It is a method flow chart of a specific implementation mode of the present invention.

[0021] Figure 2 It is a system structure diagram of a specific implementation mode of the present invention.

[0022] Figure 3 It is a schematic diagram of the device structure of a specific embodiment of the present invention.

[0023] In the figure, 1. identification creation module; 2. identification storage module; 3. device registration module; 4. platform verification module; 101. processor; 102. memory; 103. input interface; 104. output interface; 105. communication unit; 106. keyboard; 107. display; 108. mouse. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0025] See also Figure 1 As shown, this embodiment provides a trusted identity authentication method for an industrial Internet device, including the following steps: S1: Generate an industrial Internet identifier for the industrial Internet device through the industrial Internet identifier resolution secondary node.

[0026] In a specific implementation, through the industrial Internet identity resolution secondary node based on the VAA identity resolution platform, the VAA encoding standard is adopted to generate the VAA code of the device according to the industry code and enterprise code of the industrial Internet device as the industrial Internet identity.

[0027] Among them, the bottom layer of the secondary node of the industrial Internet identity resolution is the deployed VAA identity resolution platform, which can ensure the uniqueness of the industrial Internet identity in the entire network. After the industrial Internet identity is generated and registered, it uniquely represents an industrial Internet device in the industrial Internet identity resolution system.

[0028] Currently, the industrial Internet identification coding standards include VAA, OID, HANDLE, Ecode, GS1, etc. This method uses VAA coding.

[0029] The VAA code includes five code segments, namely: the issuing agency code, the country code, the industry code, the enterprise code and the internal enterprise code. Among them, the country code, the industry code and the enterprise code can be collectively referred to as the service agency code.

[0030] Specifically, the code segment length of the issuing agency is 3 digits, using the fixed code "VAA". The country code segment length is 3 digits, and the data type can be uppercase English letters A-Z or numbers 0-9. In principle, a 3-digit fixed length is used, and if the number is insufficient, the leading zero is used; the country code must comply with the relevant requirements of the issuing agency. The industry code segment length is 3 digits, and the data type can be uppercase English letters A-Z or numbers 0-9, and is allocated by the VAA identification registration and management agency. The enterprise code segment length is less than or equal to 20 digits, and the data type can be uppercase English letters A-Z or numbers 0-9, and is allocated by the agency that obtains the industry code. The length of the enterprise's internal code is not fixed, and the data type can be English letters A-Z, az, numbers 0-9, and symbols "*, +, -, ., / , (,),!". Enterprises can encode according to their own needs.

[0031] S2: Write the industrial Internet identity into the TEE security zone of the active identification chip built into the industrial Internet device.

[0032] In a specific implementation manner, the specific process of this step is as follows: 1. Install the Op-TEE operating system in the industrial Internet device and install the registered and adapted trusted application as a tool for writing the industrial Internet identity.

[0033] Specifically, the chip with TEE function in the industrial Internet device is used as the MCU of the device. The purpose of this step is to write the industrial Internet identity into the security zone before leaving the factory, and the MCU becomes the active identity carrier. In order to achieve the above functions, the industrial Internet device needs to meet the following software and hardware environment requirements: Hardware: Chips that support ARM TrustZone as industrial terminal MCUs, such as ARM Cortex-A series processors.

[0034] Secure operating system: OP-TEE operating system, OP-TEE (Open Portable Trusted Execution Environment) is an open source trusted execution environment (TEE) framework designed for secure application execution in embedded systems. 2. Start the trusted application and enable the file system through preset commands.

[0035] At the tool level, it is necessary to develop a trusted application (TA) based on OP-TEE as a means of writing identification.

[0036] The trusted application uses programming languages ​​such as C or C++ to write the code of the trusted application. The code needs to follow the API specification of OP-TEE in order to interact with the protected environment. After the code is written, the written code is compiled into a binary file and signed using the signature tool provided by OP-TEE to verify the source of the trusted application and ensure that it is trusted. It should be noted that before signing, a key pair needs to be generated, including a private key and a public key. The private key is used for signing, and the public key is used to verify the signature. The private key must be kept confidential and properly stored to prevent unauthorized signing operations.

[0037] At this point, the compiled and signed trusted application binary can be installed on the OP-TEE-enabled Industrial Internet device. Then, register the trusted application in OP-TEE so that it can be recognized and loaded. The registration process includes adding the application's UUID (Universally Unique Identifier) ​​and other related information to the OP-TEE database.

[0038] 2. Start the trusted application and enable the file system through the preset command.

[0039] Currently, there are two secure storage implementations in OP-TEE: The first one relies on the regular world (REE) file system and is implemented by default. It is enabled at compile time with CFG_REE_FS=y.

[0040] The second method utilizes the Replay Protected Memory Block (RPMB) partition of the eMMC device, enabled by setting CFG_RPMB_FS=y.

[0041] This method adopts the first method.

[0042] 3. Obtain the industrial Internet identity and identity credentials for accessing the industrial Internet IoT platform, and write them into persistent objects through the API provided by the TEE trusted storage service.

[0043] Specifically, the industrial Internet identity and the identity credentials for accessing the Industrial Internet IoT platform are written into the persistent object through the API (TEE_CreatePersistentObject, TEE_WriteObjectData) provided by the TEE trusted storage service.

[0044] 4. Use the file system to encrypt data, and send file operation commands and encrypted data to the file requester through RPC messages.

[0045] Specifically, the TEE file system encrypts the data and sends the REE file operation commands and encrypted data to the REE requester through a series of RPC messages.

[0046] 5. The encrypted data is stored in the TEE security zone through the file requester.

[0047] Specifically, the REE requester will receive the message and store the encrypted data in the TEE secure area.

[0048] S3: Register the terminal information of the industrial Internet equipment to the industrial Internet platform.

[0049] Among them, industrial terminal information includes but is not limited to product type, product name, product model, production date, production number, and industrial Internet identification. This step completes the registration of the corresponding relationship between the industrial Internet equipment, i.e., the active identification carrier, and the industrial Internet identification through the industrial Internet platform.

[0050] S4: When the industrial Internet device is online, the signature verification and environment isolation technology of OP-TEE's trusted application TA is used to transmit terminal information and verify the trustworthiness of the industrial Internet identity.

[0051] In a specific implementation, when the REE embedded program of the industrial Internet device is powered on and started, it first obtains the industrial Internet identity and the identity credentials for accessing the industrial Internet IoT platform through the CA and TA secure communication channels of OP-TEE, sends them to the industrial Internet platform through the MQTT protocol, and initiates an identity authentication request. After receiving the identity authentication request, the industrial Internet platform verifies whether the industrial Internet identity has been registered in the platform database; if not, the verification fails; if so, the consistency of the corresponding user name, password and industrial Internet identity is verified based on the identity credentials; if the user name and password are correct and correspond to the industrial Internet identity, the verification is successful.

[0052] As an example, after the REE embedded program of the industrial Internet device is powered on and started, it obtains the industrial Internet identification and identity credentials (user name and password) stored in the security zone through the CA and TA secure communication channel of OP-TEE, and sends them to the industrial Internet platform for verification through the MQTT protocol.

[0053] After receiving the identity authentication request, the Industrial Internet Platform first verifies whether the Industrial Internet ID has been registered in the platform database, and then verifies whether the username and password are correct and whether they correspond to the ID. If all verifications pass, the verification is successful, otherwise the verification fails.

[0054] In this method, the industrial Internet device ensures the credibility of the identity information sent to the IoT platform through the signature mechanism, non-arbitrary access, and environmental isolation of the trusted application TA of OP-TEE.

[0055] The present invention provides a trusted identity authentication method for industrial Internet devices. By adopting industrial Internet identity resolution, TEE security zone storage, OP-TEE trusted application TA signature verification and environment isolation technology, and utilizing data encryption and RPC message transmission, the identity authentication security of industrial Internet devices is effectively improved, the integrity and confidentiality of data during storage and transmission are ensured, and a solid guarantee is provided for the safe operation of the industrial Internet.

[0056] See also Figure 2 As shown, the present invention also discloses a trusted identity authentication system for industrial Internet devices, including: an identification creation module 1, an identification storage module 2, a device registration module 3 and a platform verification module 4. The identification creation module 1 is used to generate an industrial Internet identification for an industrial Internet device through an industrial Internet identification resolution secondary node.

[0057] The identification storage module 2 is used to write the industrial Internet identification into the TEE security area of ​​the active identification chip built into the industrial Internet device.

[0058] The device registration module 3 is used to register the terminal information of the industrial Internet device to the industrial Internet platform.

[0059] The platform verification module 4 is used to transmit terminal information and verify the trustworthiness of the industrial Internet identity by using the signature verification and environment isolation technology of the trusted application TA of OP-TEE when the industrial Internet device is online.

[0060] The specific implementation of the trusted identity authentication system for industrial Internet devices in this embodiment is basically the same as the specific implementation of the trusted identity authentication method for industrial Internet devices mentioned above, and will not be repeated here.

[0061] See also Figure 3 As shown, the present invention also discloses a trusted identity authentication device for an industrial Internet device, comprising a processor 101 and a memory 102; wherein, when the processor 101 executes the trusted identity authentication program for the industrial Internet device stored in the memory, the steps of the trusted identity authentication method for the industrial Internet device as described in any one of the above items are implemented.

[0062] The trusted identity authentication device of the industrial Internet equipment provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer or a desktop computer.

[0063] Among them, the processor 101 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 101 can be implemented in at least one hardware form of a digital signal processor (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 101 may also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 101 may be integrated with a graphics processing unit (GPU), and the GPU is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 101 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0064] The memory 102 may include one or more computer-readable storage media, which may be non-transitory. The memory 102 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 102 is at least used to store the following computer program, wherein, after the computer program is loaded and executed by the processor 101, it can implement the relevant steps of the trusted identity authentication method for industrial Internet devices disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 102 may also include an operating system and data, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system may include Windows, Unix, Linux, etc. The data may include, but is not limited to, the data involved in the trusted identity authentication method for the above-mentioned industrial Internet device, etc.

[0065] Furthermore, the trusted identity authentication device of the industrial Internet device in this embodiment may also include: The input interface 103 is used to obtain the trusted identity authentication program of the industrial Internet device imported from the outside, and save the obtained trusted identity authentication program of the industrial Internet device to the memory 102. It can also be used to obtain various instructions and parameters transmitted by external terminal devices, and transmit them to the processor 101, so that the processor 101 can use the above various instructions and parameters to carry out corresponding processing. In this embodiment, the input interface 103 can specifically include but is not limited to a USB interface, a serial interface, a voice input interface, a fingerprint input interface, a hard disk reading interface, etc.

[0066] The output interface 104 is used to output various data generated by the processor 101 to a terminal device connected thereto, so that other terminal devices connected to the output interface can obtain various data generated by the processor 101. In this embodiment, the output interface 104 may specifically include but is not limited to a USB interface, a serial interface, and the like.

[0067] The communication unit 105 is used to establish a remote communication connection between the server operation business optimization configuration device and the external server, so that the trusted identity authentication device of the industrial Internet device can mount the image file to the external server. In this embodiment, the communication unit 105 may specifically include but is not limited to a remote communication unit based on wireless communication technology or wired communication technology.

[0068] The keyboard 106 is used to obtain various parameter data or instructions input by the user by tapping the keycaps in real time.

[0069] Display 107 is used to display relevant information of the trusted identity authentication process of running industrial Internet devices in real time.

[0070] The mouse 108 can be used to assist the user in inputting data and simplify the user's operation.

[0071] The present invention also discloses a readable storage medium, wherein the readable storage medium includes a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable hard disk, a CD-ROM or any other form of storage medium known in the technical field. The readable storage medium stores a trusted identity authentication program for an industrial Internet device, and when the trusted identity authentication program for the industrial Internet device is executed by a processor, the steps of the trusted identity authentication method for the industrial Internet device described in any one of the above items are implemented.

[0072] To summarize, the present invention effectively solves the technical problems existing in the current authentication method for industrial Internet equipment access to the cloud platform, such as plain text transmission of authentication information, single authentication method, and easy forgery of device identity authentication information, by introducing advanced technical means such as industrial Internet identity resolution, TEE security zone storage, signature verification and environment isolation technology of OP-TEE trusted application TA.

[0073] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. As for the method disclosed in the embodiment, since it corresponds to the system disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0074] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0075] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0076] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0077] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each module may exist physically separately, or two or more modules may be integrated into one unit.

[0078] Similarly, each processing unit in each embodiment of the present invention may be integrated into one functional module, or each processing unit may exist physically, or two or more processing units may be integrated into one functional module.

[0079] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0080] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0081] The above is a detailed introduction to the trusted identity authentication method, system, device and readable storage medium for industrial Internet devices provided by the present invention. This article uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, the present invention can also be improved and modified, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A trusted identity authentication method for industrial Internet devices, characterized in that: include: Generate an industrial Internet ID for industrial Internet devices through the industrial Internet ID resolution secondary node; Write the industrial Internet identity into the TEE security zone of the active identification chip built into the industrial Internet device; Register the terminal information of industrial Internet devices to the industrial Internet platform; When the industrial Internet device is online, the signature verification and environment isolation technology of OP-TEE's trusted application TA is used to transmit terminal information and verify the trustworthiness of the industrial Internet identity.

2. The trusted identity authentication method for industrial Internet devices according to claim 1 is characterized in that: The method of generating an industrial Internet identifier for an industrial Internet device through the industrial Internet identifier resolution secondary node includes: Through the secondary node of industrial Internet identity resolution based on the VAA identity resolution platform, the VAA coding standard is adopted to generate the VAA code of the device according to the industry code and enterprise code of the industrial Internet device as the industrial Internet identifier.

3. The trusted identity authentication method for industrial Internet devices according to claim 2 is characterized in that: The VAA encoding of the device includes: Issuing agency code, country code, industry code, enterprise code and enterprise internal code.

4. The trusted identity authentication method for industrial Internet devices according to claim 1 is characterized in that: The step of writing the industrial Internet identification into the TEE security zone of the active identification chip built into the industrial Internet device includes: Install the OP-TEE operating system in the industrial Internet device and install the registered and adapted trusted application as a tool for writing the industrial Internet identity; Start the trusted application and enable the file system through preset commands; Obtain the industrial Internet identity and the identity credentials for accessing the industrial Internet IoT platform, and write them into persistent objects through the API provided by the TEE trusted storage service; Use the file system to encrypt data, and send file operation commands and encrypted data to the file requester through RPC messages; The encrypted data is stored in the TEE secure area through the file requester.

5. The trusted identity authentication method for industrial Internet devices according to claim 4 is characterized in that: The enabling of the file system by using a preset command includes: Enable the REE file system by command CFG_RPMB_FS=y.

6. The trusted identity authentication method for industrial Internet devices according to claim 1 is characterized in that: The terminal information of the industrial Internet device includes but is not limited to: product type, product name, product model, production date, factory number, and industrial Internet identification.

7. The trusted identity authentication method for industrial Internet devices according to claim 5 is characterized in that: When the industrial Internet device is online, the signature verification and environment isolation technology of the trusted application TA of OP-TEE is used to transmit terminal information and verify the trustworthiness of the industrial Internet identity, including: When the REE embedded program of the industrial Internet device is powered on and started, it obtains the industrial Internet identity and the identity credentials for accessing the industrial Internet IoT platform through the CA and TA secure communication channels of OP-TEE, sends them to the industrial Internet platform through the MQTT protocol, and initiates an identity authentication request; In response to the industrial Internet platform receiving the identity authentication request, verify whether the industrial Internet identity has been registered in the platform database; If not, the verification fails; if so, the consistency of the corresponding user name, password and industrial Internet identifier is verified according to the identity credentials; If the username and password are correct and correspond to the Industrial Internet ID, the verification is successful.

8. A trusted identity authentication system for industrial Internet devices, characterized in that: The system adopts the trusted identity authentication method for industrial Internet devices as described in any one of claims 1 to 7; The system comprises: An identification creation module is used to generate an industrial Internet identification for an industrial Internet device through an industrial Internet identification resolution secondary node; The identification storage module is used to write the industrial Internet identification into the TEE security zone of the active identification chip built into the industrial Internet device; The device registration module is used to register the terminal information of the industrial Internet device to the industrial Internet platform; The platform verification module is used to transmit terminal information and verify the trustworthiness of industrial Internet identification by using the signature verification and environment isolation technology of OP-TEE's trusted application TA when the industrial Internet equipment is online.

9. A trusted identity authentication device for industrial Internet equipment, characterized in that: include: A memory device for storing a trusted identity authentication program for an industrial Internet device; A processor is used to implement the steps of the trusted identity authentication method for an industrial Internet device as described in any one of claims 1 to 7 when executing the trusted identity authentication program of the industrial Internet device.

10. A readable storage medium, characterized in that: The readable storage medium stores a trusted identity authentication program for an industrial Internet device, and when the trusted identity authentication program for an industrial Internet device is executed by a processor, the steps of the trusted identity authentication method for an industrial Internet device as described in any one of claims 1 to 7 are implemented.

Images