A device authentication method based on blockchain access control

Abstract

The present application discloses a device authentication method based on blockchain access control, which relates to the field of device authentication. The method includes: the key generation center initializes each device and gateway to obtain necessary parameters, master private key and master public key, and generates device identity, device public key and auxiliary authentication parameters for each device, and uploads parameter data involved in the authentication process to the blockchain for storage; the gateway sends gateway authentication data to the authentication device, and the authentication device authenticates the gateway using the authentication data; the authentication device is any device, and when the gateway authentication passes, the adjacent device of the authentication device is used as the device to be authenticated, and the device to be authenticated uses the device authentication data sent by the authentication device for authentication, and when the device to be authenticated passes, the device to be authenticated is used as the authentication device to authenticate the adjacent devices until all devices complete the authentication. The present application improves the authentication speed while ensuring the security of information.

Description

Technical Field

[0001] The present application relates to the field of device authentication, and in particular to a device authentication method based on blockchain access control. Background Art

[0002] The Internet of Things builds a network of widely distributed sensors and devices. These devices follow specific communication protocols and are connected to the Internet to provide users with efficient and secure smart services anytime and anywhere. However, with the popularization of IoT technology, it has penetrated into every corner of daily life. Although it greatly facilitates users, it also brings security challenges and risks of privacy leakage. According to a study by HP, most IoT devices are vulnerable to attacks, and cloud or mobile applications collect at least one user's personal information, which may be leaked when attacked or accessed without authorization. Therefore, it is very important to ensure the security of information during the authentication process. When a user has multiple devices at the same time, multiple authentication requests need to be initiated at the same time to authenticate each device. This process involves generating multiple group keys, which greatly increases the amount of calculation and communication costs. Summary of the invention

[0003] The purpose of this application is to provide a device authentication method based on blockchain access control, which can reduce the amount of calculation in the authentication process, improve the authentication speed and ensure the security of information.

[0004] To achieve the above objectives, this application provides the following solutions:

[0005] This application provides a device authentication method based on blockchain access control, which is applied to an authentication protocol in an IoT scenario. The protocol involves multiple devices, gateways, and blockchains, including:

[0006] The key generation center initializes each device and the gateway to obtain necessary parameters, a master private key and a master public key; wherein the necessary parameters include generators of the multiplication cyclic group and a bilinear mapping function corresponding to the multiplication cyclic group;

[0007] The key generation center generates the device identity and device public key of each device, performs hash calculation on the device identity to obtain the device identity hash value, and uploads the device identity hash value to the blockchain for storage;

[0008] The key generation center generates a device random number for each device, calculates the auxiliary authentication parameters of each device based on the device random number and the generator, and uploads the auxiliary authentication parameters to the blockchain for storage;

[0009] The gateway calculates gateway parameters according to the gateway random number and the generator, calculates a gateway temporary key according to the gateway random number and the master public key, and sends the gateway parameters, the gateway temporary key and the first timestamp to the authentication device; the authentication device is any device;

[0010] The authentication device receives the gateway parameter, the gateway temporary key and the first timestamp, and authenticates the gateway using the gateway parameter, the gateway temporary key and the first timestamp;

[0011] When the gateway authentication is passed, the adjacent device of the authentication device is used as the device to be authenticated, the authentication device generates an authentication random number and a second timestamp, generates authentication device parameters according to the authentication random number and the generator, obtains the auxiliary authentication parameters of the authentication device from the blockchain, and generates a temporary key of the device to be authenticated according to the auxiliary authentication parameters; encrypts the authentication device parameters using the temporary key of the device to be authenticated, and sends the encrypted authentication device parameters and the second timestamp to the device to be authenticated;

[0012] The device to be authenticated performs authentication using the encrypted authentication device parameters and the second timestamp;

[0013] When the device to be authenticated passes the authentication, the device to be authenticated is used as the authentication device to authenticate adjacent devices until all devices complete the authentication.

[0014] Furthermore, the device authentication method based on blockchain access control also includes:

[0015] When all devices pass authentication, each device generates a first bilinear mapping device parameter according to the device authentication parameter, device identity and device identity hash value, generates a second bilinear mapping device parameter according to the device authentication parameter, device identity and device public key, and uploads the first bilinear mapping device parameter and the second bilinear mapping device parameter to the blockchain for storage; wherein, when the device is used as an authentication device, the device authentication parameter is determined by the authentication device parameter of the adjacent device;

[0016] Each device obtains a first bilinear mapping device parameter from the blockchain, generates information to be verified according to the first bilinear mapping device parameter, and uploads the information to be verified to the blockchain for storage;

[0017] The gateway obtains the second bilinear mapping device parameters of each device from the blockchain, and generates an access structure function according to the second bilinear mapping device parameters; wherein the access structure function includes a bilinear verification formula and a device ciphertext;

[0018] The gateway obtains the information to be verified of each device from the blockchain, and adds the information to be verified to the access structure function for verification. If the verification is successful, the device ciphertext is sent to the corresponding device, and each device generates a device private key based on the device ciphertext;

[0019] Each device communicates with the gateway via the device private key.

[0020] Further, the authentication device receives the gateway parameter, the gateway temporary key and the first timestamp, and authenticates the gateway using the gateway parameter, the gateway temporary key and the first timestamp, specifically including:

[0021] The authentication device performs time verification using the first timestamp and the first reception time;

[0022] After the time verification is passed, the authentication device calculates the gateway temporary private key according to the gateway parameters and the master private key, and determines whether the gateway temporary private key is the same as the gateway temporary key; wherein the first receiving time is the time when the authentication device receives the gateway parameters, the gateway temporary key and the first timestamp;

[0023] If yes, the gateway authentication is successful; if no, the authentication is terminated.

[0024] Further, the authentication device performs time verification using the first timestamp and the first receiving time, specifically including:

[0025] The authentication device determines whether the time interval between the first timestamp and the first reception time is within a maximum time interval;

[0026] If yes, the time verification passes; if no, the time verification fails.

[0027] Further, the device to be authenticated performs authentication using the encrypted authentication device parameter and the second timestamp, specifically including:

[0028] The device to be authenticated performs time verification according to the second receiving time and the second timestamp; wherein the second receiving time is the time when the device to be authenticated receives the encrypted authentication device parameters and the second timestamp;

[0029] After the time verification is passed, the device to be authenticated obtains the auxiliary random parameter of the authentication device from the blockchain, calculates the private key of the device to be authenticated according to the auxiliary random parameter and the device random number of the device to be authenticated, and uses the private key of the device to be authenticated to decrypt the encrypted authentication device parameter to obtain the decrypted authentication device parameter;

[0030] The device to be authenticated determines whether the decrypted authentication device parameter is the same as the authentication device parameter of the authentication device;

[0031] If yes, the authentication is passed;

[0032] If not, the authentication is terminated.

[0033] Further, the device to be authenticated performs time verification according to the second receiving time and the second timestamp, specifically including:

[0034] The device to be authenticated determines whether the time interval between the second timestamp and the second receiving time is within the maximum time interval;

[0035] If yes, the time verification passes; if no, the time verification fails.

[0036] Furthermore, the calculation formula of the first bilinear mapping device parameter is:

[0037] ;

[0038] in, For the j The first bilinear map device parameters for the device, h is a hash function, For the j Device authentication parameters for each device. For the j The device identity of the device, For the j The device identity hash value of each device;

[0039] The calculation formula for the second bilinear mapping device parameters is:

[0040] ;

[0041] in, No. j The second bilinear mapping device parameters for the device, For the j The device public key of the device.

[0042] Furthermore, the calculation formula of the information to be verified is:

[0043] ;

[0044] in, For the j The device's verification information is pending. is a bilinear mapping function, is the master public key, The number of devices that have passed the authentication.

[0045] Furthermore, the expression of the access structure function is:

[0046] ;

[0047] in, F To access the structure function, For the j The device ciphertext of the device, is the termination symbol. If the bilinear pairing verification formula holds, then The value is 1; if the bilinear pairing verification formula does not hold, then The value is 0.

[0048] Further, the bilinear pairing verification formula includes a first expression and a second expression;

[0049] The first expression is: ;

[0050] The second expression is: ;

[0051] like If established, The value is 1, if If not established, The value is 0;

[0052] in, For the generator.

[0053] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0054] The present application provides a device authentication method based on blockchain access control, in which each device and gateway is initialized and set to obtain necessary parameters, a master private key and a master public key through a key generation center, and a device identity and a device public key are generated for each device through the key generation center. The gateway initiates an authentication request to any one of the devices, namely the authentication device, and uses the authentication device to authenticate the gateway, and then uses the authentication device to authenticate adjacent devices until all devices are authenticated. During the authentication process, the gateway only needs to initiate an authentication request to any one device once, and does not need to authenticate each device and gateway, thereby reducing the amount of calculation in the authentication process and increasing the authentication speed. During the authentication process, the gateway and the device both obtain data from the blockchain, and use the blockchain to ensure the security of information and ensure the security of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0056] Figure 1 This is a flow chart of a device authentication method based on blockchain access control in one embodiment of the present application;

[0057] Figure 2 A schematic diagram of a device authentication method based on blockchain access control provided in one embodiment of the present application. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0059] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0060] The device authentication method based on blockchain access control provided in the embodiment of the present application can be applied to the authentication protocol in the IoT scenario, which involves multiple devices, gateways and blockchains. Compared with the previous authentication protocol, the present application uses any device as an authentication device, uses the authentication device to authenticate the gateway, and after the gateway authentication is passed, uses the authentication device to authenticate its adjacent devices, and performs authentication between devices until all authentications are completed. This process does not require the gateway to authenticate each device, which greatly reduces the amount of calculation and improves the authentication speed. At the same time, the data involved in the authentication process is uploaded to the blockchain for storage, ensuring the security of the information.

[0061] In an exemplary embodiment, Figure 1 As shown, a device authentication method based on blockchain access control is provided, comprising the following steps 101 to 108, wherein:

[0062] Step 101, the key generation center initializes each device and the gateway to obtain necessary parameters, a master private key and a master public key; wherein the necessary parameters include generators of the multiplication cyclic group and a bilinear mapping function corresponding to the multiplication cyclic group.

[0063] In step 102, the key generation center generates a device identity and a device public key for each device, performs a hash calculation on the device identity to obtain a device identity hash value, and uploads the device identity hash value to the blockchain for storage.

[0064] Step 103: The key generation center generates a device random number for each device. The auxiliary authentication parameters of each device are calculated based on the device random number and the generator, and the auxiliary authentication parameters are uploaded to the blockchain for storage.

[0065] Step 104, the gateway calculates gateway parameters according to the gateway random number and the generator, calculates the gateway temporary key according to the gateway random number and the master public key, and sends the gateway parameters, the gateway temporary key and the first timestamp to the authentication device; the authentication device is any device.

[0066] Step 105: The authentication device receives the gateway parameters, the gateway temporary key and the first timestamp, and authenticates the gateway using the gateway parameters, the gateway temporary key and the first timestamp.

[0067] Step 106, when the gateway authentication is passed, the adjacent device of the authentication device is used as the device to be authenticated, the authentication device generates an authentication random number and a second timestamp, generates authentication device parameters according to the authentication random number and the generator, obtains the auxiliary authentication parameters of the authentication device from the blockchain, and generates a temporary key for the device to be authenticated according to the auxiliary authentication parameters; the authentication device parameters are encrypted using the temporary key of the device to be authenticated, and the encrypted authentication device parameters and the second timestamp are sent to the device to be authenticated.

[0068] Step 107: The device to be authenticated performs authentication using the encrypted authentication device parameters and the second timestamp.

[0069] Step 108: When the device to be authenticated passes the authentication, the device to be authenticated is used as an authentication device to authenticate adjacent devices until all devices complete the authentication.

[0070] Implementing the above steps 101 to 108 can increase the authentication speed and ensure the security of data during the authentication process.

[0071] In an exemplary embodiment, step 101 specifically includes:

[0072] The key generation center initializes each device and gateway to obtain the necessary parameters, including the generator of the multiplication cyclic group and the bilinear mapping function corresponding to the multiplication cyclic group. The multiplication cyclic group is two orders of q The multiplicative cyclic groups G1 and G2 of G1 and G2 are , and the multiplicative cyclic groups G1 and G2 correspond to the bilinear mapping function e:G1×G1→G2.

[0073] The key generation center selects a key random number As the private key parameter, calculate the master private key , is a hash function, and uses the master private key and generator to calculate the master public key .

[0074] The key generation center will The master private key is sent to each device and gateway through a secure channel.

[0075] In an exemplary embodiment, step 102 specifically includes:

[0076] The key generation center generates the device identity of each device , and perform a hash operation on the device identity to obtain the device identity hash value ; Calculate the device public key using the device identity hash value and the master private key ,in, is the device public key, The hash value of the device identity is the device identity, and the device identity, device public key and device identity hash value of each device are sent to the corresponding device, and the device identity hash value of each device is uploaded to the blockchain through a secure channel for storage.

[0077] Specifically, the Take the first device as an example to explain that the key generation center generates Device ID of the device , perform hash operation and get Device identity hash value of the device ; Use the The device identity hash value and master private key of the device are obtained The device public key of the device ,in, , is the number of devices, and Send to devices, and Upload to the blockchain for storage through a secure channel.

[0078] In an exemplary embodiment, step 103 specifically includes:

[0079] The key generation center generates a device random number for each device, calculates the auxiliary authentication parameters of each device, and sends the device random number and auxiliary authentication parameters of each device to the corresponding device. At the same time, the auxiliary authentication parameters of each device are uploaded to the blockchain through a secure channel for storage.

[0080] Specifically, the The key generation center is the first device. Generate a device random number for each device , calculate the Auxiliary authentication parameters for each device Q ; and Send to devices, and Upload to the blockchain for storage through a secure channel.

[0081] In addition, the key generation center also generates a gateway identity for the gateway G ID , and identify the gateway G ID Perform hash operation to obtain the gateway identity hash value , and calculate the gateway public key , and then Send to the gateway, and at the same time send Sent to the blockchain for storage.

[0082] In an exemplary embodiment, step 104 specifically includes:

[0083] The gateway generates a gateway random number and the first timestamp , and according to the gateway random number and Generator Compute Gateway Parameters B , according to the gateway random number and the master public key P pub Compute Gateway Temporary Key T GK ; Set the gateway parameters B and the gateway temporary key T GK Message M 1 and M 2 is sent to the authentication device, where the authentication device is any device, M 1 and M The expressions of 2 are , M 2 =T GK =bP pub , and Send to authentication device S D-i , S D-i For the Device.

[0084] In an exemplary embodiment, step 105 specifically includes steps 201 to 202:

[0085] Step 201, the authentication device performs time verification using a first timestamp and a first receiving time, where the first receiving time is the time when the authentication device receives the gateway parameters, the gateway temporary key and the first timestamp, specifically including:

[0086] The authentication device determines whether the time interval between the first timestamp and the first receiving time is within the maximum time interval, that is, whether the condition is met , is the first timestamp, is the first receiving time, is the maximum time interval;

[0087] If yes, the time verification passes; if no, the time verification fails.

[0088] Step 202: After the time verification is passed, the authentication device B and master private key s computing gateway temporary private key T SK= sB , and determine the gateway temporary private key T SK The gateway temporary key T GK Whether they are the same, that is, judging T SK and T GK Are they the same? If so, the gateway authentication is successful; if not, the authentication is terminated.

[0089] In an exemplary embodiment, step 106 specifically includes:

[0090] When the gateway passes the authentication, the authentication device S D-i The adjacent device is used as the device to be authenticated S D-i+1 , using authentication equipment S D-i Treating Authentication Devices S D-i+1 Authentication is performed, where S D-i+1 For thei +1 device.

[0091] Authentication equipment Generate a random number for authentication and the second timestamp ,calculate = ,in, Is a certified device Authentication device parameters, authentication device Get the device to be authenticated from the blockchain Auxiliary authentication parameters , calculate the temporary key of the device to be authenticated ,in, Temporary key for the device to be authenticated. For the The device is the device to be authenticated. For the The auxiliary authentication parameters of the device to be authenticated are the auxiliary authentication parameters of the device to be authenticated; and the temporary key of the device to be authenticated is used Parameters of the authentication device Encrypted, the encrypted authentication device parameters are sent as a message M 3, the expression is ,in, It is a symmetric encryption algorithm.

[0092] Authentication equipment Will Sent to the device to be authenticated ,in, For authentication equipment The message sent, Messages sent by devices; For authentication equipment The second timestamp, i.e. The second timestamp of the device.

[0093] In an exemplary embodiment, step 107 specifically includes:

[0094] Step 301, the device to be authenticated performs time verification according to a second receiving time and a second timestamp, where the second receiving time is the time when the device to be authenticated receives the encrypted authentication device parameters and the second timestamp, specifically including:

[0095] The device to be authenticated determines whether the time interval between the second timestamp and the second receiving time is within the maximum time interval, that is, whether the ,in, Is a device to be authenticated Receiving certified equipment The time of sending the encrypted authentication device parameters and the second timestamp, ie, the second receiving time.

[0096] If yes, the time verification passes; if no, the time verification fails.

[0097] Step 302, after the time verification is passed, the device to be authenticated obtains the auxiliary random parameter of the authentication device from the blockchain, and calculates the private key of the device to be authenticated according to the auxiliary random parameter and the device random number of the device to be authenticated, and uses the private key of the device to be authenticated to decrypt the encrypted authentication device parameter to obtain the decrypted authentication device parameter, which specifically includes:

[0098] Devices to be certified The calculation formula of the private key is: ,in, is the private key of the device to be authenticated. For the The device random number of the device to be authenticated; For the The auxiliary random parameters of the device are the auxiliary random parameters of the authentication device.

[0099] The encrypted authentication device parameters are decrypted using the private key of the device to be authenticated. The expression is: ,in, is the decryption function.

[0100] Step 303, the device to be authenticated determines whether the decrypted authentication device parameters are the same as the authentication device parameters of the authentication device; if so, the authentication is passed; if not, the authentication is terminated.

[0101] Specifically, for the The device gets the decrypted authentication device parameters ,judge With Authentication device parameters for each device Are they the same? If so, the authentication is successful; if not, the authentication is terminated.

[0102] The device authentication process only requires the use of any device to authenticate the gateway, and then authenticate between devices. There is no need to generate multiple sets of group keys to authenticate the gateway and each device, which greatly reduces the amount of calculation and improves the authentication speed.

[0103] In an exemplary embodiment, the device authentication method based on blockchain access control further includes:

[0104] Step 109, when all devices pass authentication, each device generates a first bilinear mapping device parameter according to the device authentication parameter, the device identity and the device identity hash value, generates a second bilinear mapping device parameter according to the device authentication parameter, the device identity and the device public key, and uploads the first bilinear mapping device parameter and the second bilinear mapping device parameter to the blockchain for storage; wherein, when the device is used as an authentication device, the device authentication parameter is determined by the authentication device parameter of the adjacent device.

[0105] In step 1010, each device obtains a first bilinear mapping device parameter from the blockchain, generates information to be verified according to the first bilinear mapping device parameter, and uploads the information to be verified to the blockchain for storage.

[0106] Step 1011, the gateway obtains the second bilinear mapping device parameters of each device from the blockchain, and generates an access structure function according to the second bilinear mapping device parameters; wherein the access structure function includes a bilinear verification formula and a device ciphertext.

[0107] In step 1012, the gateway obtains the information to be verified of each device from the blockchain, and adds the information to be verified to the access structure function for verification. If the verification passes, the device ciphertext is sent to the corresponding device, and each device generates a device private key based on the device ciphertext.

[0108] Step 1013: Each device communicates with the gateway via the device private key.

[0109] Implement the above steps 109 to 1013, use the access structure function stored in the blockchain to verify each device, and send the corresponding device ciphertext to the verified device, so that each device can obtain the device private key using the device ciphertext, and then realize communication with the gateway. The data involved in this process are all obtained from the blockchain, which further ensures the security of the data.

[0110] In an exemplary embodiment, step 109 specifically includes:

[0111] Each device calculates its own device authentication parameters, the first bilinear mapping device parameters, and the second bilinear mapping device parameters, and uploads the first bilinear mapping device parameters and the second bilinear mapping device parameters to the blockchain for storage.

[0112] Specifically, for example, Devices have passed certification, ,and , calculate the j Device authentication parameters for each device , the first bilinear map device parameters and the second bilinear map device parameters ;

[0113] No. j Device authentication parameters for each device The calculation formula is:

[0114] ;

[0115] Among them, when j Devices S D-j As an authentication device, For equipment S D-j Authentication device parameters, For equipment S D-j The authentication device parameters of the authentication device performing authentication, that is, the authentication device parameters of the adjacent device.

[0116] No. j The first bilinear map device parameters for the device The calculation formula is:

[0117] ;

[0118] in, For the j The device identity of the device, For the j The device identity hash value of the device.

[0119] No. j Second bilinear map device parameters for the device The calculation formula is:

[0120] ;

[0121] in, For the j The device public key of the device.

[0122] In an exemplary embodiment, step 1010 specifically includes:

[0123] Each device obtains its own first bilinear mapping device parameters from the blockchain, generates its own information to be verified according to the first bilinear mapping device parameters, and uploads the information to be verified to the blockchain for storage.

[0124] For example, j The device retrieves the first j The first bilinear map device parameters for the device , and according to Generatej Devices to be verified , and Upload to blockchain for storage.

[0125] No. j The calculation formula for the information to be verified for each device is:

[0126] .

[0127] In an exemplary embodiment, step 1011 specifically includes:

[0128] The gateway obtains the second bilinear mapping device parameters of each device from the blockchain , and according to Generate an access structure function and upload the access structure function to the blockchain for storage.

[0129] The expression for accessing the structure function is:

[0130] ;

[0131] in, F To access the structure function, For the j The device ciphertext of the device, is the termination symbol. If the bilinear pairing verification formula holds, then The value is 1; if the bilinear pairing verification formula does not hold, then The value is 0.

[0132] The bilinear pairing verification formula includes a first expression and a second expression, specifically:

[0133] The first expression is: ;

[0134] The second expression is: ;

[0135] like If established, The value is 1, if If not established, The value is 0.

[0136] In an exemplary embodiment, step 1012 specifically includes:

[0137] The gateway obtains the information to be verified uploaded by each device from the blockchain and adds the information to be verified into the access structure function for verification. Is it established? If not, the authentication is terminated; if the authentication is established, the device will obtain the corresponding device ciphertext.

[0138] Specifically, the gateway obtains the first j Devices to be verified , and Add to the access structure function for verification. If verification If established, the device ciphertext Send to j Device.

[0139] In an exemplary embodiment, when a new device is added, the key generation center generates a new device random number for each device and calculates the auxiliary authentication parameters of each device, then distributes the auxiliary authentication parameters of each device to the corresponding device and recalculates the device private key of each device.

[0140] When a device leaves or is damaged by an attack, the key generation center deletes all information containing the device and then recalculates the device's private key.

[0141] In an exemplary embodiment, Figure 2 As shown, before the authentication begins, the key generation center performs initialization settings, that is, executes the above step 101, and then enters the registration stage, that is, executes the above steps 102-103. During the authentication process, the gateway first initiates an authentication request to any device, that is, the authentication device, and uses the authentication device to authenticate the gateway, that is, executes the above steps 104-105. After that, the authentication device will authenticate with the adjacent device, that is, execute the above steps 106-108, and perform cyclic authentication between devices until all devices are authenticated. Next, enter the key generation link, that is, execute the above steps 109-1012, and finally each device communicates with the gateway through the device key, that is, step 1013. During this period, various parameter data, that is, device parameters and access structure functions, that is, access structures, will be uploaded to the blockchain for storage to prevent tampering and facilitate query. During this process, if a new device joins, the key generation center will regenerate a device random number for each device and perform corresponding calculations, and then distribute it to each device, recalculate and update all device private keys. Insecure devices will be kicked out, and newly authenticated devices will be allowed to join, thereby ensuring the communication security of the entire Internet of Things.

[0142] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0143] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0144] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A device authentication method based on blockchain access control, characterized in that: The authentication protocol applied to the Internet of Things scenario involves multiple devices, gateways and blockchains. The device authentication method based on blockchain access control includes: The key generation center initializes each device and the gateway to obtain necessary parameters, a master private key and a master public key; wherein the necessary parameters include generators of the multiplication cyclic group and a bilinear mapping function corresponding to the multiplication cyclic group; The key generation center generates the device identity and device public key of each device, performs hash calculation on the device identity to obtain the device identity hash value, and uploads the device identity hash value to the blockchain for storage; The key generation center generates a device random number for each device, calculates the auxiliary authentication parameters of each device based on the device random number and the generator, and uploads the auxiliary authentication parameters to the blockchain for storage; The gateway calculates gateway parameters according to the gateway random number and the generator, calculates a gateway temporary key according to the gateway random number and the master public key, and sends the gateway parameters, the gateway temporary key and the first timestamp to the authentication device; the authentication device is any device; The authentication device receives the gateway parameter, the gateway temporary key and the first timestamp, and authenticates the gateway using the gateway parameter, the gateway temporary key and the first timestamp; When the gateway authentication is passed, the adjacent device of the authentication device is used as the device to be authenticated, the authentication device generates an authentication random number and a second timestamp, generates authentication device parameters according to the authentication random number and the generator, obtains the auxiliary authentication parameters of the authentication device from the blockchain, and generates a temporary key of the device to be authenticated according to the auxiliary authentication parameters; encrypts the authentication device parameters using the temporary key of the device to be authenticated, and sends the encrypted authentication device parameters and the second timestamp to the device to be authenticated; The device to be authenticated performs authentication using the encrypted authentication device parameters and the second timestamp; When the device to be authenticated passes the authentication, the device to be authenticated is used as the authentication device to authenticate adjacent devices until all devices complete the authentication.

2. The device authentication method based on blockchain access control according to claim 1 is characterized in that: The device authentication method based on blockchain access control also includes: When all devices pass authentication, each device generates a first bilinear mapping device parameter according to the device authentication parameter, device identity and device identity hash value, generates a second bilinear mapping device parameter according to the device authentication parameter, device identity and device public key, and uploads the first bilinear mapping device parameter and the second bilinear mapping device parameter to the blockchain for storage; wherein, when the device is used as an authentication device, the device authentication parameter is determined by the authentication device parameter of the adjacent device; Each device obtains a first bilinear mapping device parameter from the blockchain, generates information to be verified according to the first bilinear mapping device parameter, and uploads the information to be verified to the blockchain for storage; The gateway obtains the second bilinear mapping device parameters of each device from the blockchain, and generates an access structure function according to the second bilinear mapping device parameters; wherein the access structure function includes a bilinear verification formula and a device ciphertext; The gateway obtains the information to be verified of each device from the blockchain, and adds the information to be verified to the access structure function for verification. If the verification is successful, the device ciphertext is sent to the corresponding device, and each device generates a device private key based on the device ciphertext; Each device communicates with the gateway via the device private key.

3. The device authentication method based on blockchain access control according to claim 1 is characterized in that: The authentication device receives the gateway parameter, the gateway temporary key and the first timestamp, and authenticates the gateway using the gateway parameter, the gateway temporary key and the first timestamp, specifically including: The authentication device performs time verification using the first timestamp and the first reception time; After the time verification is passed, the authentication device calculates the gateway temporary private key according to the gateway parameters and the master private key, and determines whether the gateway temporary private key is the same as the gateway temporary key; wherein the first receiving time is the time when the authentication device receives the gateway parameters, the gateway temporary key and the first timestamp; If yes, the gateway authentication is successful; if no, the authentication is terminated.

4. The device authentication method based on blockchain access control according to claim 3 is characterized in that: The authentication device performs time verification using the first timestamp and the first receiving time, specifically including: The authentication device determines whether the time interval between the first timestamp and the first reception time is within a maximum time interval; If yes, the time verification passes; if no, the time verification fails.

5. The device authentication method based on blockchain access control according to claim 1 is characterized in that: The device to be authenticated performs authentication using the encrypted authentication device parameter and the second timestamp, specifically including: The device to be authenticated performs time verification according to the second receiving time and the second timestamp; wherein the second receiving time is the time when the device to be authenticated receives the encrypted authentication device parameters and the second timestamp; After the time verification is passed, the device to be authenticated obtains the auxiliary random parameter of the authentication device from the blockchain, calculates the private key of the device to be authenticated according to the auxiliary random parameter and the device random number of the device to be authenticated, and uses the private key of the device to be authenticated to decrypt the encrypted authentication device parameter to obtain the decrypted authentication device parameter; The device to be authenticated determines whether the decrypted authentication device parameter is the same as the authentication device parameter of the authentication device; If yes, the authentication is passed; If not, the authentication is terminated.

6. The device authentication method based on blockchain access control according to claim 5 is characterized in that: The device to be authenticated performs time verification according to the second receiving time and the second timestamp, specifically including: The device to be authenticated determines whether the time interval between the second timestamp and the second receiving time is within the maximum time interval; If yes, the time verification passes; if no, the time verification fails.

7. The device authentication method based on blockchain access control according to claim 2 is characterized in that: The calculation formula of the first bilinear mapping device parameter is: ； in, For the j The first bilinear map device parameters for the device, h is a hash function, For the j Device authentication parameters for each device. For the j The device identity of the device, For the j The device identity hash value of each device; The calculation formula for the second bilinear mapping device parameters is: ； in, For the j The second bilinear mapping device parameters for the device, For the j The device public key of the device.

8. The device authentication method based on blockchain access control according to claim 7 is characterized in that: The calculation formula of the information to be verified is: ; in, For the j The device's verification information is pending. is a bilinear mapping function, is the master public key, n The number of devices that have passed the authentication.

9. The device authentication method based on blockchain access control according to claim 8 is characterized in that: The expression of the access structure function is: ； in, F To access the structure function, For the j The device ciphertext of the device, is the termination symbol. If the bilinear pairing verification formula holds, then The value is 1; if the bilinear pairing verification formula does not hold, then The value is 0.

10. The device authentication method based on blockchain access control according to claim 9 is characterized in that: The bilinear pairing verification formula includes a first expression and a second expression; The first expression is: ; The second expression is: ; like If established, The value is 1, if If not established, The value is 0; in, For the generator.

Images