A method and system for verifying the technology of intelligent gateway of Internet of Things

Abstract

The present invention relates to the technical field of Internet of Things gateways, and in particular to a method and system for verifying the technology of an Internet of Things smart gateway; the method for verifying the technology of an Internet of Things smart gateway comprises: step 1: when a device establishes a connection with an Internet of Things gateway for the first time, a method for verifying the device identity based on ID² is adopted for verification; after the verification is passed, the device and the Internet of Things gateway establish the first connection interaction; step 2: the Internet of Things gateway sends pass information to the device; the pass information is a ciphertext encrypted by a specific algorithm, and when the device establishes a connection with the Internet of Things gateway again, the pass information of the device is verified, and if it passes, a connection is directly established with the device, and the updated pass information is sent to the device; the above method for verifying the technology of an Internet of Things smart gateway has both security and efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things gateways, and in particular to a method and system for verifying the technology of an Internet of Things intelligent gateway. Background Art

[0002] In the IoT gateway system, third-party devices can enrich the functions of the IoT system, enabling it to meet more scenarios and needs. By introducing third-party devices, the IoT system can adapt to different scenarios and user needs more flexibly. Users can choose suitable third-party devices according to their needs to achieve personalized customization. In the IoT system, the access and management of third-party devices is an important link. The IoT cloud platform will provide device access interfaces and protocol support to enable third-party devices to access the system smoothly.

[0003] The Chinese patent with the authorization announcement number CN111901230B discloses an Internet of Things gateway, system and device access verification method supporting device access verification, wherein a method for third-party device access verification is disclosed, in which the Internet of Things gateway receives the device model sent by the security authentication service module through the information model application module. If the device is determined to be able to access the Internet of Things gateway based on the device model, the Internet of Things gateway returns the unique identifier corresponding to the device to the security authentication service module through the information model application module. The Internet of Things gateway generates an encrypted file based on the unique identifier through the security authentication service module, and sends the encrypted file to the device to complete the access verification, wherein the encrypted file can be the generated Secret. In the future, the interaction of the device and the Internet of Things gateway data needs to complete the security authentication through the Secret. After completing the access verification, that is, the device has the Secret, and each time it interacts with the gateway for data, including uploading or downloading, it can ensure secure data interaction with the Internet gateway through the Secret similar to a pass. Although this technical verification method improves the verification efficiency of device access, it also has security risks, such as the theft and misuse of the unique identifier information, so that the security authentication link can be bypassed and the unsafe device can be directly connected to the Internet of Things gateway system. Summary of the invention

[0004] The technical problem to be solved by the present invention is: how to improve the technical verification method for third-party device access in the Internet of Things smart gateway to achieve both security and efficiency.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0006] A method for verifying the technology of an Internet of Things intelligent gateway comprises the following steps:

[0007] Step 1: When the device establishes a connection with the IoT gateway for the first time, it uses the device identity authentication method based on ID² for verification; after the verification is passed, the device and the IoT gateway establish the first connection interaction;

[0008] Step 2: The IoT gateway sends the pass information to the device; the pass information is a ciphertext encrypted by a specific algorithm, and the encryption process of the ciphertext is as follows:

[0009] The IoT gateway randomly generates a unique tag string for each connected device, encrypts the tag string using the SHA-256 algorithm, and obtains the ciphertext as the first part of the pass information;

[0010] Take a+b as the item number of the first increasing sequence, and obtain the corresponding value c of the first increasing sequence, where a is the ath time the device establishes a connection with the IoT gateway, b is greater than 100, and b is a random number;

[0011] Decompose c through the second increasing sequence, and the decomposition method is to obtain the value d closest to c in the second increasing sequence, and d is greater than c, and obtain the difference e between d and c;

[0012] Continue to obtain the value f closest to e in the second increasing sequence. If f is greater than e, the difference g between f and e is obtained.

[0013] Repeat the above calculation until the difference is less than the preset threshold h, then stop decomposition;

[0014] The second part of the pass information is the item numbers of each value in the decomposition of the second increasing sequence each time, arranged in order, and two adjacent item numbers are separated by a separator;

[0015] The first increasing number sequence and the second increasing number sequence are randomly selected from an increasing number sequence library consisting of a plurality of increasing number sequences, and each increasing number sequence in the increasing number sequence library corresponds to a unique mapping value;

[0016] The IoT gateway stores the random number b involved in the pass information, the item numbers of the first increasing number sequence and the second increasing number sequence in the increasing number sequence library, the threshold h, the second part of the pass information, and the label string;

[0017] Step 3: When the device reconnects with the IoT gateway, the IoT gateway obtains the device's pass information, decrypts the first part of the pass information using the SHA-256 algorithm to obtain a label string, compares it with the label string pre-stored in the IoT gateway, and compares the second part of the pass information with the second part pre-stored in the IoT gateway. If they are the same, a connection is established directly with the device, and the updated pass information is sent to the device.

[0018] Furthermore, in the above-mentioned IoT smart gateway technology verification method, the increasing number sequences stored in the increasing number sequence library include: Fibonacci sequence, square sequence, cubic sequence, geometric sequence, triangular sequence, and when the pass information is generated for the first time, the first increasing number sequence and the second increasing number sequence are two randomly selected number sequences in the increasing number sequence library.

[0019] Furthermore, in the above-mentioned IoT smart gateway technology verification method, in step 1, the verification based on the device identity authentication method of ID² includes:

[0020] In the first Client Hello handshake message, report the device ID² ID and apply for the authentication challenge word from the ID² server;

[0021] The ID² authentication challenge word is sent through the Hello Verify Request message, and the device generates the ID² device authentication code based on the challenge word;

[0022] In the second Client Hello handshake message, the ID² device authentication code is reported for device identity authentication;

[0023] When the ID² server authenticates the ID² device, it generates an ID² server authentication code and sends it to the device via a Server Hello message for server identity authentication.

[0024] The Server Hello message also carries the PresharedKey encrypted by the ID² server, which is decrypted by the device through the ID² interface.

[0025] The present invention also relates to an Internet of Things intelligent gateway technology verification system, comprising:

[0026] The first identity authentication module is used to verify the device's identity when it establishes a connection with the IoT gateway for the first time, using the device identity authentication method based on ID²;

[0027] The pass information generation module is used to generate corresponding pass information according to the corresponding algorithm after the device establishes a connection interaction with the IoT gateway; the pass information is a ciphertext encrypted by a specific algorithm, and the encryption process of the ciphertext is as follows:

[0028] The IoT gateway randomly generates a unique tag string for each connected device, encrypts the tag string using the SHA-256 algorithm, and obtains the ciphertext as the first part of the pass information;

[0029] Take a+b as the item number of the first increasing sequence, and obtain the corresponding value c of the first increasing sequence, where a is the ath time the device establishes a connection with the IoT gateway, b is greater than 100, and b is a random number;

[0030] Decompose c through the second increasing sequence, and the decomposition method is to obtain the value d closest to c in the second increasing sequence, and d is greater than c, and obtain the difference e between d and c;

[0031] Continue to obtain the value f closest to e in the second increasing sequence. If f is greater than e, the difference g between f and e is obtained.

[0032] Repeat the above calculation until the difference is less than the preset threshold h, then stop decomposition;

[0033] The second part of the pass information is the item numbers of each value in the decomposition of the second increasing sequence each time, arranged in order, and two adjacent item numbers are separated by a separator;

[0034] The first increasing number sequence and the second increasing number sequence are randomly selected from an increasing number sequence library consisting of a plurality of increasing number sequences, and each increasing number sequence in the increasing number sequence library corresponds to a unique mapping value;

[0035] The IoT gateway stores the random number b involved in the pass information, the item numbers of the first increasing number sequence and the second increasing number sequence in the increasing number sequence library, the threshold h, the second part of the pass information, and the label string;

[0036] Step 3: When the device reconnects to the IoT gateway, the IoT gateway obtains the device's pass information, decrypts the first part of the pass information using the SHA-256 algorithm to obtain a tag string, compares it with the tag string pre-stored in the IoT gateway, and compares the second part of the pass information with the second part pre-stored in the IoT gateway. If they are the same, the device is directly connected and the updated pass information is sent to the device.

[0037] Pass information transceiver module, used to send and receive pass information;

[0038] A storage module, used to store the pass information, the random number b, the item numbers of the first increasing number sequence and the second increasing number sequence in the increasing number sequence library, the threshold h, the increasing number sequence library information, the label string, and the second part of the pass information;

[0039] A processing module is used to perform encryption and decryption calculations on the first part of the pass information.

[0040] The beneficial effect of the present invention is that when the Internet of Things device establishes a connection with the Internet of Things gateway for the first time, a device identity authentication method based on ID² is used for verification. ID² (Internet Device ID) is a trusted identity identifier of an Internet of Things device launched by Alibaba Cloud, which has the security attribute of being tamper-proof and non-forgeable. Through ID², the Internet of Things platform can support the device to use this identifier for identity authentication to ensure the authenticity and security of the device identity. After the verification is passed, a more efficient technical verification method is subsequently adopted, which is realized by sending pass information to the device that has passed the verification. The pass information is dynamic, and the device will update the pass information each time it establishes a connection. The pass information is a ciphertext encrypted by a specific encryption method, in which two random increasing series are used, and the important information of specific encryption and decryption is only stored in the memory of the Internet of Things gateway, which is not easy to be stolen or used fraudulently. It is no longer necessary to establish a complex identity authentication process with the server. After the device passes the first identity authentication, the pass information will be updated each time it establishes a connection with the Internet of Things gateway again, and the last pass information will be invalidated, which greatly reduces the risk of the pass information being used fraudulently or cracked. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 The present invention is a flowchart of a method for verifying the technology of an IoT smart gateway according to a specific implementation method of the present invention. DETAILED DESCRIPTION

[0042] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in conjunction with the implementation modes and the accompanying drawings.

[0043] Please refer to Figure 1 The specific implementation of the present invention relates to a method for verifying the technology of an Internet of Things smart gateway, comprising the following steps:

[0044] Step 1: When the device establishes a connection with the IoT gateway for the first time, it uses the device identity authentication method based on ID² for verification; after the verification is passed, the device and the IoT gateway establish the first connection interaction;

[0045] Step 2: The IoT gateway sends the pass information to the device; the pass information is a ciphertext encrypted by a specific algorithm, and the encryption process of the ciphertext is as follows:

[0046] The IoT gateway randomly generates a unique tag string for each connected device, encrypts the tag string using the SHA-256 algorithm, and obtains the ciphertext as the first part of the pass information;

[0047] Take a+b as the item number of the first increasing sequence, and obtain the corresponding value c of the first increasing sequence, where a is the ath time the device establishes a connection with the IoT gateway, b is greater than 100, and b is a random number;

[0048] Decompose c through the second increasing sequence, and the decomposition method is to obtain the value d closest to c in the second increasing sequence, and d is greater than c, and obtain the difference e between d and c;

[0049] In this step, the first increasing number sequence takes a triangular number sequence as an example, and the formula is F(n)=n(n+1) / 2; n is the item number, and F(n) is the value corresponding to the item number n;

[0050] Refer to Table 1:

[0051] Table 1

[0052]

[0053] Assume b=105, a=3 (the device establishes a connection with the IoT gateway for the third time); then the item number n=a+b=108, and the corresponding value c of the 108th item of the triangular number sequence queried from the memory is 5886;

[0054] In this step, the second increasing sequence takes the Fibonacci sequence as an example:

[0055] The formula of Fibonacci sequence: F(n)=F(n-1)+F(n-2); (n 2); where n is the item number, F is the numerical value corresponding to the item number.

[0056] Refer to Table 2:

[0057] Table 2

[0058]

[0059] Get the value d=6765 that is closest to c(5886) in the second increasing sequence (Fibonacci sequence), and the corresponding item number is 20; get the difference between d and c e=6765-5886=879.

[0060] Continue to obtain the value f closest to e in the second increasing sequence. If f is greater than e, the difference g between f and e is obtained.

[0061] Taking e=879 as an example, we continue to obtain the value f=987 in the Fibonacci sequence that is closest to 879, and the corresponding item number is 16; we get the difference between f and e g=987-879=108;

[0062] Repeat the above calculation until the difference is less than the preset threshold h, then stop decomposition;

[0063] Assume that the threshold h is equal to 110; then g=108, which is less than 110, so the decomposition is stopped directly.

[0064] In this step, the item number is greater than 100. In the increasing sequence, if the item number is too small, the corresponding value is also very small. When it is subsequently decomposed through the second increasing sequence, the number of digits of the obtained pass information is too small, affecting security.

[0065] The second part of the pass information is the item numbers of each value in the decomposition of the second increasing sequence, which are arranged in order, and two adjacent item numbers are separated by a separator, such as ","; the first part and the second part are separated by "#";

[0066] In this embodiment, the first item number is 20, and the second item number is 16; that is, the corresponding part of the pass information is represented as "20, 16";

[0067] The first increasing number sequence and the second increasing number sequence are randomly selected from an increasing number sequence library consisting of a plurality of increasing number sequences, and each increasing number sequence in the increasing number sequence library corresponds to a unique mapping value;

[0068] The IoT gateway stores the random number b involved in the pass information, the item numbers of the first increasing number sequence and the second increasing number sequence in the increasing number sequence library, the threshold h, the second part of the pass information, and the label string;

[0069] Step 3: When the device reconnects to the IoT gateway, the IoT gateway obtains the device's pass information, decrypts the first part of the pass information using the SHA-256 algorithm to obtain a tag string, compares it with the tag string pre-stored in the IoT gateway, and compares the second part of the pass information with the second part pre-stored in the IoT gateway. If they are the same, the device is directly connected and the updated pass information is sent to the device.

[0070] In the updated pass information, since a (the number of times the device establishes connections with the IoT gateway) changes, the value of a+b also changes accordingly. In subsequent connections, the corresponding part of the pass information is updated accordingly and is no longer "20, 16".

[0071] As a preferred embodiment, the increasing number sequences stored in the increasing number sequence library include: Fibonacci sequence, square sequence, cubic sequence, geometric sequence, triangular sequence. When the pass information is generated for the first time, the first increasing number sequence and the second increasing number sequence are two randomly selected number sequences in the increasing number sequence library. For example, after device A establishes a connection with the IoT gateway, the first increasing number sequence uses a geometric sequence, and the second increasing number sequence uses a Fibonacci sequence; the increasing number sequence selected by device A subsequently remains unchanged; for example, after device B establishes a connection with the IoT gateway, the first increasing number sequence uses a cubic sequence, and the second increasing number sequence uses a triangular sequence; the increasing number sequence selected by device B subsequently remains unchanged.

[0072] It should be noted that the increasing number sequence library is pre-stored in the memory of the Internet of Things gateway. When generating pass information, one of the increasing number sequences stored in the memory is randomly retrieved as the first increasing number sequence, and one of the increasing number sequences is used as the second increasing number sequence.

[0073] As a preferred implementation, in step 1, the verification based on the device identity authentication method of ID² includes:

[0074] In the first Client Hello handshake message, report the device ID² ID and apply for the authentication challenge word from the ID² server;

[0075] The ID² authentication challenge word is sent through the Hello Verify Request message, and the device generates the ID² device authentication code based on the challenge word;

[0076] In the second Client Hello handshake message, the ID² device authentication code is reported for device identity authentication;

[0077] When the ID² server authenticates the ID² device, it generates an ID² server authentication code and sends it to the device via a Server Hello message for server identity authentication.

[0078] The Server Hello message also carries the PresharedKey encrypted by the ID² server, which is decrypted by the device through the ID² interface.

[0079] The specific implementation of the present invention also relates to an Internet of Things intelligent gateway technology verification system, including:

[0080] The first identity authentication module is used to verify the device's identity when it establishes a connection with the IoT gateway for the first time, using the device identity authentication method based on ID²;

[0081] The pass information generation module is used to generate corresponding pass information according to the corresponding algorithm after the device establishes a connection interaction with the IoT gateway; the pass information is a ciphertext encrypted by a specific algorithm, and the encryption process of the ciphertext is as follows:

[0082] The IoT gateway randomly generates a unique tag string for each connected device, encrypts the tag string using the SHA-256 algorithm, and obtains the ciphertext as the first part of the pass information;

[0083] Take a+b as the item number of the first increasing sequence, and obtain the corresponding value c of the first increasing sequence, where a is the ath time the device establishes a connection with the IoT gateway, b is greater than 100, and b is a random number;

[0084] Decompose c through the second increasing sequence, and the decomposition method is to obtain the value d closest to c in the second increasing sequence, and d is greater than c, and obtain the difference e between d and c;

[0085] Continue to obtain the value f closest to e in the second increasing sequence. If f is greater than e, the difference g between f and e is obtained.

[0086] Repeat the above calculation until the difference is less than the preset threshold h, then stop decomposition;

[0087] The second part of the pass information is the item numbers of each value in the decomposition of the second increasing sequence each time, arranged in order, and two adjacent item numbers are separated by a separator;

[0088] The first increasing number sequence and the second increasing number sequence are randomly selected from an increasing number sequence library consisting of a plurality of increasing number sequences, and each increasing number sequence in the increasing number sequence library corresponds to a unique mapping value;

[0089] The IoT gateway stores the random number b involved in the pass information, the item numbers of the first increasing number sequence and the second increasing number sequence in the increasing number sequence library, the threshold h, the second part of the pass information, and the label string;

[0090] Step 3: When the device reconnects to the IoT gateway, the IoT gateway obtains the device's pass information, decrypts the first part of the pass information using the SHA-256 algorithm to obtain a tag string, compares it with the tag string pre-stored in the IoT gateway, and compares the second part of the pass information with the second part pre-stored in the IoT gateway. If they are the same, the device is directly connected and the updated pass information is sent to the device.

[0091] Pass information transceiver module, used to send and receive pass information;

[0092] A storage module, used to store the pass information, the random number b, the item numbers of the first increasing number sequence and the second increasing number sequence in the increasing number sequence library, the threshold h, the increasing number sequence library information, the label string, and the second part of the pass information;

[0093] A processing module is used to perform encryption and decryption calculations on the first part of the pass information.

[0094] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's specification and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for verifying the technology of an Internet of Things intelligent gateway, characterized in that: The following steps are involved: Step 1: When the device establishes a connection with the IoT gateway for the first time, it uses the device identity authentication method based on ID² for verification; after the verification is passed, the device and the IoT gateway establish the first connection interaction; Step 2: The IoT gateway sends the pass information to the device; the pass information is a ciphertext encrypted by a specific algorithm, and the encryption process of the ciphertext is as follows: The IoT gateway randomly generates a unique tag string for each connected device, encrypts the tag string using the SHA-256 algorithm, and obtains the ciphertext as the first part of the pass information; Take a+b as the item number of the first increasing sequence, and obtain the corresponding value c of the first increasing sequence, where a is the ath time the device establishes a connection with the IoT gateway, b is greater than 100, and b is a random number; Decompose c through the second increasing sequence, and the decomposition method is to obtain the value d closest to c in the second increasing sequence, and d is greater than c, and obtain the difference e between d and c; Continue to obtain the value f closest to e in the second increasing sequence. If f is greater than e, the difference g between f and e is obtained. Repeat the above calculation until the difference is less than the preset threshold h, then stop decomposition; The second part of the pass information is the item numbers of each value in the decomposition of the second increasing sequence each time, arranged in order, and two adjacent item numbers are separated by a separator; The first increasing number sequence and the second increasing number sequence are randomly selected from an increasing number sequence library consisting of a plurality of increasing number sequences, and each increasing number sequence in the increasing number sequence library corresponds to a unique mapping value; The IoT gateway stores the random number b involved in the pass information, the item numbers of the first increasing number sequence and the second increasing number sequence in the increasing number sequence library, the threshold h, the second part of the pass information, and the label string; Step 3: When the device reconnects with the IoT gateway, the IoT gateway obtains the device's pass information, decrypts the first part of the pass information using the SHA-256 algorithm to obtain a label string, compares it with the label string pre-stored in the IoT gateway, and compares the second part of the pass information with the second part pre-stored in the IoT gateway. If they are the same, a connection is established directly with the device, and the updated pass information is sent to the device.

2. The method for verifying the technology of the Internet of Things intelligent gateway according to claim 1 is characterized in that: The increasing number sequences stored in the increasing number sequence library include: Fibonacci sequence, square sequence, cubic sequence, geometric sequence, triangular sequence. When the pass information is generated for the first time, the first increasing number sequence and the second increasing number sequence are two randomly selected number sequences in the increasing number sequence library.

3. The method for verifying the technology of the Internet of Things intelligent gateway according to claim 1 is characterized in that: In step 1, the verification based on the ID² device identity authentication method includes: In the first Client Hello handshake message, report the device ID² ID and apply for the authentication challenge word from the ID² server; The ID² authentication challenge word is sent through the Hello Verify Request message, and the device generates the ID² device authentication code based on the challenge word; In the second Client Hello handshake message, the ID² device authentication code is reported for device identity authentication; When the ID² server authenticates the ID² device, it generates an ID² server authentication code and sends it to the device via a Server Hello message for server identity authentication. The Server Hello message also carries the PresharedKey encrypted by the ID² server, which is decrypted by the device through the ID² interface.

4. An IoT smart gateway technology verification system, characterized in that: include: The first identity authentication module is used to verify the device's identity when it establishes a connection with the IoT gateway for the first time, using the device identity authentication method based on ID²; The pass information generation module is used to generate corresponding pass information according to the corresponding algorithm after the device establishes a connection interaction with the IoT gateway; the pass information is a ciphertext encrypted by a specific algorithm, and the encryption process of the ciphertext is as follows: The IoT gateway randomly generates a unique tag string for each connected device, encrypts the tag string using the SHA-256 algorithm, and obtains the ciphertext as the first part of the pass information; Take a+b as the item number of the first increasing sequence, and obtain the corresponding value c of the first increasing sequence, where a is the ath time the device establishes a connection with the IoT gateway, b is greater than 100, and b is a random number; Decompose c through the second increasing sequence, and the decomposition method is to obtain the value d closest to c in the second increasing sequence, and d is greater than c, and obtain the difference e between d and c; Continue to obtain the value f closest to e in the second increasing sequence. If f is greater than e, the difference g between f and e is obtained. Repeat the above calculation until the difference is less than the preset threshold h, then stop decomposition; The second part of the pass information is the item numbers of each value in the decomposition of the second increasing sequence each time, arranged in order, and two adjacent item numbers are separated by a separator; The first increasing number sequence and the second increasing number sequence are randomly selected from an increasing number sequence library consisting of a plurality of increasing number sequences, and each increasing number sequence in the increasing number sequence library corresponds to a unique mapping value; The IoT gateway stores the random number b involved in the pass information, the item numbers of the first increasing number sequence and the second increasing number sequence in the increasing number sequence library, the threshold h, the second part of the pass information, and the label string; Step 3: When the device reconnects to the IoT gateway, the IoT gateway obtains the device's pass information, decrypts the first part of the pass information using the SHA-256 algorithm to obtain a tag string, compares it with the tag string pre-stored in the IoT gateway, and compares the second part of the pass information with the second part pre-stored in the IoT gateway. If they are the same, the device is directly connected and the updated pass information is sent to the device. Pass information transceiver module, used to send and receive pass information; A storage module, used to store the pass information, the random number b, the item numbers of the first increasing number sequence and the second increasing number sequence in the increasing number sequence library, the threshold h, the increasing number sequence library information, the label string, and the second part of the pass information; A processing module is used to perform encryption and decryption calculations on the first part of the pass information.

Images