Method and device for credible Internet of Things and credible Internet of Things system

Abstract

The invention provides a credible Internet of Things method, a credible Internet of Things device and a credible Internet of Things system, and the method comprises the steps that Internet of Things equipment generates a hardware identifier through an integrated PUF module; the Internet of Things equipment generates an equipment secret key pair through the configured TEE, wherein the equipment secret key pair comprises an equipment public key and an equipment private key; associating the hardware identifier with the equipment public key; and when the Internet of Things equipment is used for the first time, writing the associated hardware identifier and the equipment public key into the block chain of the block chain platform. And the security and the credibility of the Internet of Things system are improved.

Description

Technical Field

[0001] The present application relates to the technical field of Internet of Things, and in particular to a trusted Internet of Things method, device, electronic device and storage medium. Background Art

[0002] The Internet of Things system collects effective information such as sound, light, biology, and location through sensor collection equipment, and connects to the Internet through various networks to achieve efficient management and intelligent perception of devices. In the Internet of Things system, although some security technologies have been adopted, there are still the following shortcomings:

[0003] 1. Authentication vulnerability: Many existing IoT systems are vulnerable to device authentication and may be subject to impersonation and identity forgery attacks. Traditional authentication methods can be easily cracked or forged, resulting in insecure access to devices.

[0004] 2. Data privacy and security issues: Existing IoT systems may have privacy and security issues when transmitting and storing data, and are vulnerable to man-in-the-middle attacks or data tampering.

[0005] 3. Authenticity of interaction data: Existing IoT systems may lack transparency and authenticity when recording interactions between devices, because the source and integrity of the data are difficult to verify. In this case, the data may be tampered with or forged, affecting the credibility of the entire IoT system. Summary of the invention

[0006] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0007] To this end, the first purpose of this application is to propose a trusted Internet of Things method to achieve a more secure and trusted Internet of Things system.

[0008] The second objective of this application is to provide a trusted IoT device.

[0009] The third objective of this application is to propose a trusted Internet of Things system.

[0010] The fourth objective of the present application is to provide an electronic device.

[0011] A fifth objective of the present application is to provide a computer-readable storage medium.

[0012] A sixth object of the present application is to provide a computer program product.

[0013] To achieve the above-mentioned purpose, the first embodiment of the present application proposes a trusted IoT method, which is applied to IoT devices, including:

[0014] The IoT device generates a hardware identifier through an integrated PUF module;

[0015] The IoT device generates a device key pair through the configured TEE, wherein the device key pair includes a device public key and a device private key; and associates the hardware identifier with the device public key;

[0016] When the IoT device is used for the first time, the associated hardware identifier and the device public key are registered in the blockchain of the blockchain platform.

[0017] In some embodiments, the method further comprises:

[0018] The IoT device sends the associated hardware identifier and the device public key to the smart contract module of the blockchain platform through an integrated communication module;

[0019] So that the smart contract module can realize the identity authentication of the Internet of Things device by determining whether the associated hardware identifier and the device public key stored in the blockchain are consistent with the associated hardware identifier and the device public key received from the communication module.

[0020] In some embodiments, the method further comprises:

[0021] When the IoT device passes identity authentication, the TEE encrypts the data to be transmitted by using the platform public key provided by the blockchain platform to obtain first ciphertext data;

[0022] Sign the first ciphertext data using the device private key to obtain a first signature value;

[0023] Sending the first ciphertext data and the first signature value to the blockchain platform;

[0024] Receiving the verification and decryption processing of the first ciphertext data and the first signature value by the blockchain platform, to obtain the second ciphertext data and the second signature value; wherein the second ciphertext data is obtained by the blockchain platform encrypting the first decryption result by the device public key, and the first decryption result is obtained by the blockchain platform verifying and decrypting the first ciphertext data and the first signature value by the platform private key and the device public key; the second signature value is obtained by the blockchain platform signing the second ciphertext data by the platform private key;

[0025] The TEE verifies the second signature value by using the platform public key, and after the verification is passed, decrypts the second ciphertext data by using the device private key to obtain a first decryption result after decryption;

[0026] Based on the first decryption result after the decryption, it is confirmed whether the data to be transmitted is successfully transmitted.

[0027] In some implementations, sending the first ciphertext data and the first signature value to the blockchain platform includes:

[0028] The first ciphertext data and the first signature value are sent to the blockchain platform through a secure communication protocol.

[0029] In some implementations, registering the associated hardware identifier and the device public key in a blockchain of a blockchain platform includes:

[0030] Registering the associated hardware identifier and the device public key to an identity registration record chain in a blockchain of a blockchain platform.

[0031] To achieve the above-mentioned purpose, the second embodiment of the present application proposes a trusted IoT device, which is configured in an IoT device, including:

[0032] An identification generation module, used to generate a hardware identifier through a PUF module integrated in the IoT device;

[0033] A key association module, configured to generate a device key pair through the TEE configured by the IoT device, wherein the device key pair includes a device public key and a device private key; and associate the hardware identifier with the device public key;

[0034] An information registration module is used to register the associated hardware identifier and the device public key in the blockchain of the blockchain platform when the IoT device is used for the first time.

[0035] In some embodiments, the device further comprises an identity authentication module, which is used to:

[0036] The IoT device sends the associated hardware identifier and the device public key to the smart contract module of the blockchain platform through an integrated communication module;

[0037] So that the smart contract module can realize the identity authentication of the Internet of Things device by determining whether the associated hardware identifier and the device public key stored in the blockchain are consistent with the associated hardware identifier and the device public key received from the communication module.

[0038] In some embodiments, the device further comprises a data transmission module, configured to:

[0039] When the IoT device passes identity authentication, the TEE encrypts the data to be transmitted by using the platform public key provided by the blockchain platform to obtain first ciphertext data;

[0040] Sign the first ciphertext data using the device private key to obtain a first signature value;

[0041] Sending the first ciphertext data and the first signature value to the blockchain platform;

[0042] Receiving the verification and decryption processing of the first ciphertext data and the first signature value by the blockchain platform, to obtain the second ciphertext data and the second signature value; wherein the second ciphertext data is obtained by the blockchain platform encrypting the first decryption result by the device public key, and the first decryption result is obtained by the blockchain platform verifying and decrypting the first ciphertext data and the first signature value by the platform private key and the device public key; the second signature value is obtained by the blockchain platform signing the second ciphertext data by the platform private key;

[0043] The TEE verifies the second signature value by using the platform public key, and after the verification is passed, decrypts the second ciphertext data by using the device private key to obtain a first decryption result after decryption;

[0044] Based on the first decryption result after the decryption, it is confirmed whether the data to be transmitted is successfully transmitted.

[0045] In some implementations, when the data transmission module sends the first ciphertext data and the first signature value to the blockchain platform, it is specifically configured to:

[0046] The first ciphertext data and the first signature value are sent to the blockchain platform through a secure communication protocol.

[0047] In some embodiments, the information registration module, when registering the associated hardware identifier and the device public key in the blockchain of the blockchain platform, is specifically used to:

[0048] Registering the associated hardware identifier and the device public key to an identity registration record chain in a blockchain of a blockchain platform.

[0049] To achieve the above objectives, the third aspect of the present application proposes a trusted Internet of Things system, including:

[0050] An Internet of Things device, comprising an MCU module, a communication module and a PUF module, wherein the communication module and the PUF module are both connected to the MCU module, and the MCU module is configured with a TEE and a REE; the Internet of Things device is used to implement the trusted Internet of Things method according to any one of claims 1 to 6;

[0051] The blockchain platform includes a smart contract module and an encryption and decryption module. The blockchain platform is used to receive the registration information of the IoT device, perform authentication processing on the IoT device, decrypt and verify the encrypted data uploaded by the IoT device, and return the decryption result.

[0052] In some implementations, the blockchain platform is further used to:

[0053] Receiving first ciphertext data and a first signature value sent by the Internet of Things device;

[0054] Decrypting the first ciphertext data by using the platform private key to obtain decrypted data to be transmitted; storing the decrypted data to be transmitted and related information in the blockchain;

[0055] The blockchain platform encrypts the first decryption result used to indicate whether the decryption is successful or not through the device public key to obtain second ciphertext data; signs the second ciphertext data through the platform private key to obtain a second signature value; and sends the second ciphertext data and the second signature value to the IoT device.

[0056] To achieve the above-mentioned purpose, the fourth aspect embodiment of the present application proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method described in the first aspect.

[0057] To achieve the above-mentioned purpose, the fifth aspect of the present application proposes a computer-readable storage medium, in which computer-readable storage medium is stored computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method described in the first aspect.

[0058] To achieve the above-mentioned purpose, the sixth aspect of the present application proposes a computer program product, including a computer program, which implements the method described in the first aspect when executed by a processor.

[0059] The trusted IoT method, device, electronic device, and storage medium provided in this application improve the security and credibility of the IoT system by combining PUF, TEE, and blockchain technology.

[0060] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0062] Figure 1 A flow chart of a trusted IoT method provided in an embodiment of the present application;

[0063] Figure 2 A flow chart of a trusted IoT method provided by another embodiment of the present application;

[0064] Figure 3 A flowchart of a trusted IoT method provided by another embodiment of the present application;

[0065] Figure 4 A schematic diagram of a trusted Internet of Things system processing flow provided as an example of this application;

[0066] Figure 5 A schematic diagram of a trusted Internet of Things system processing flow provided for another example of this application;

[0067] Figure 6 A block diagram of a trusted IoT device provided in an embodiment of the present application;

[0068] Figure 7 A block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0069] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0070] Terminology explanation:

[0071] Platform: refers to the system architecture.

[0072] PUF (Physical Unclonable Functions) technology: is a technology that uses tiny random differences between hardware components to generate unique hardware identifiers. This unique hardware identifier can be used to enhance hardware security because even the same hardware components will produce different outputs due to tiny differences.

[0073] Blockchain: It is a distributed database technology that ensures the security and immutability of data through encryption and consensus algorithms. It is often used to establish decentralized and traceable transaction records.

[0074] TEE (Trusted Execution Environment): A software runtime environment built based on hardware-level isolation and secure boot mechanisms to ensure the confidentiality, integrity, authenticity, and irreversibility of data and code related to security-sensitive applications. (Note: Hardware-level isolation refers to a security mechanism based on hardware security extension mechanisms that ensures that isolated resources are not accessed by rich execution environments through fixed division or dynamic sharing of computing resources).

[0075] REE (rich execution environment): a software runtime environment that provides basic functions and computing resources for applications (Note: a rich execution environment is an independent runtime environment relative to a trusted execution environment).

[0076] TEE and REE coexist, with TEE handling businesses that require high security and confidentiality, and REE handling businesses that require high functionality and openness.

[0077] The following describes the trusted IoT method, device, and system of the embodiments of the present application with reference to the accompanying drawings.

[0078] Figure 1 A flow chart of a trusted IoT method provided in an embodiment of the present application.

[0079] It should be noted that the executor of the trusted IoT method of the embodiment of the present application is the trusted IoT device of the embodiment of the present application, and the trusted IoT device can be configured in an electronic device such as an IoT device so that the electronic device can perform the trusted IoT function.

[0080] like Figure 1 As shown, the trusted IoT method includes the following steps:

[0081] Step 101: The IoT device generates a hardware identifier through an integrated PUF module.

[0082] It can be understood that before the IoT device is applied, the relevant information of the IoT device needs to be registered to complete the IoT device registration process. The information that needs to be registered includes the hardware identifier of the IoT device.

[0083] In some embodiments, each IoT device is integrated with a PUF module, and the IoT device generates a unique hardware identifier (referred to as device ID) through the PUF module during the production stage. The hardware identifier is generated based on tiny physical differences on the device, so the hardware identifier of each device is unique. The PUF feature ensures that the unique hardware identifier cannot be counterfeited or copied, and the PUF technology is used to generate a unique identity for the IoT device to prevent counterfeiting and identity forgery attacks.

[0084] Exemplarily, the IoT device includes an MCU module, a sensor module, a communication module and a PUF module, and the MCU module is configured with a TEE and a REE.

[0085] Step 102: The IoT device generates a device key pair through the configured TEE, where the device key pair includes a device public key and a device private key; and associates the hardware identifier and the device public key.

[0086] It can be understood that the information that IoT devices need to register includes the device public key.

[0087] In some embodiments, a controller with TEE function or a processor with TEE function is used in the IoT device. The IoT device generates a device public key and a device private key pair through TEE, associates the hardware identifier and the device public key, and stores the associated hardware identifier and device public key in TEE.

[0088] Step 103, when the IoT device is used for the first time, the associated hardware identifier and device public key are registered in the blockchain of the blockchain platform.

[0089] In some embodiments, when the IoT device is used for the first time, the associated hardware identifier and device public key information are written into the identity registration record chain in the blockchain through the blockchain service provided by the blockchain platform to form the identity registration record of the IoT device.

[0090] The trusted IoT method of the embodiment of the present application utilizes PUF technology to generate a unique hardware identifier for an IoT device, and registers the hardware identifier and the device public key information generated by TEE to a blockchain platform. Since the unique identifier generated by PUF is difficult to copy, counterfeiting and identity forgery attacks are prevented, thereby improving the credibility of device identity authentication; thereby, by combining PUF, TEE and blockchain technology, the security and credibility of the IoT system are improved.

[0091] The above embodiment describes the registration process of the IoT device. Each interaction of the IoT device in the IoT system must be authenticated by the PUF technology to ensure the uniqueness of the IoT device identity. The following describes the implementation method of the IoT device identity authentication.

[0092] Figure 2 This is a flow chart of a trusted IoT method provided by another embodiment of the present application. Figure 2 As shown, the trusted IoT method includes the following steps:

[0093] In step 201, the IoT device sends the associated hardware identifier and device public key to the smart contract module of the blockchain platform through the integrated communication module.

[0094] So that the smart contract module can realize the identity authentication of the IoT device by determining whether the associated hardware identifier and device public key stored in the blockchain are consistent with the associated hardware identifier and device public key received from the communication module.

[0095] In some embodiments, the IoT device sends the associated hardware identifier and device public key information to the smart contract module of the blockchain platform through the integrated communication module. The smart contract module compares the relevant data stored in the identity registration record chain with the hardware identifier and device public key information of the IoT device received. If they are consistent, it means that the authentication is passed.

[0096] Therefore, the identity and permissions of IoT devices can be verified through the smart contract module on the blockchain platform. Only after the smart contract confirms that the identity is valid, that is, after the authentication is passed, can the user access specific resources or perform specific operations through the IoT device.

[0097] The trusted IoT method of the embodiment of the present application authenticates the unique hardware identifier of the IoT device generated by PUF technology through the smart contract of the blockchain, builds a more complete identity authentication process, prevents counterfeiting and identity forgery attacks, and improves the accuracy and credibility of the IoT system for device identity.

[0098] The above embodiment describes the registration process and identity authentication process of the IoT device. The following describes the implementation method of data transmission of the IoT device.

[0099] Figure 3 This is a flow chart of a trusted IoT method provided by another embodiment of the present application. Figure 3 As shown, the trusted IoT method includes the following steps:

[0100] Step 301: When the IoT device passes identity authentication, TEE encrypts the data to be transmitted using the platform public key provided by the blockchain platform to obtain the first ciphertext data.

[0101] It should be noted that when the IoT device passes identity authentication, the encryption and decryption module of the blockchain platform sends the platform public key to the IoT device. The platform public key and platform private key are the key pair generated by the encryption and decryption module of the blockchain platform.

[0102] The TEE of the IoT device encrypts the data to be transmitted using the platform public key to obtain the first ciphertext data.

[0103] Step 302: Sign the first ciphertext data using the device private key to obtain a first signature value.

[0104] As an implementation method, the TEE of the IoT device signs the first ciphertext data using the device private key to obtain a first signature value.

[0105] As the data sender, the IoT device uses the receiver's public key to encrypt the data and uses the sender's own private key to digitally sign the data to ensure the integrity and authenticity of the data.

[0106] Step 303: Send the first ciphertext data and the first signature value to the blockchain platform.

[0107] In some embodiments, the first ciphertext data and the first signature value are sent to the blockchain platform via a secure communication protocol.

[0108] Exemplarily, the secure communication protocol may be a TLS / SSL communication protocol, which is not limited here.

[0109] In the embodiment of the present application, a secure communication protocol is used to implement data encryption, decryption, signing, and signature verification operations between the IoT device and the blockchain platform.

[0110] Therefore, secure communication protocols are used to protect the confidentiality and integrity of data during transmission, ensuring that data is encrypted during transmission from sender to receiver.

[0111] Step 304, the receiving blockchain platform obtains second ciphertext data and a second signature value based on the verification and decryption processing of the first ciphertext data and the first signature value; wherein the second ciphertext data is obtained by the blockchain platform encrypting the first decryption result with the device public key, and the first decryption result is obtained by the blockchain platform verifying and decrypting the first ciphertext data and the first signature value with the platform private key and the device public key; the second signature value is obtained by the blockchain platform signing the second ciphertext data with the platform private key.

[0112] It should be noted here that after the blockchain platform receives the first ciphertext data and the first signature value sent by the IoT device, it performs the following operations: decrypt the first ciphertext data through the platform private key to obtain the decrypted data to be transmitted; store the decrypted data to be transmitted and related information in the blockchain; the blockchain platform encrypts the first decryption result indicating whether the decryption is successful or not through the device public key to obtain the second ciphertext data; signs the second ciphertext data through the platform private key to obtain the second signature value; and sends the second ciphertext data and the second signature value to the IoT device. In other words, the blockchain platform will return the result of whether the IoT device successfully uploads data to the IoT device.

[0113] Exemplarily, after the encryption and decryption module of the blockchain platform successfully decrypts and obtains the data to be transmitted, it stores the data to be transmitted into the blockchain data recording module; at the same time, the relevant information of this data transmission is recorded on the blockchain.

[0114] In some embodiments, each data transfer should be recorded on the blockchain, including the sender, receiver, timestamp, and data signature. The distributed and tamper-proof nature of the blockchain ensures the traceability and security of data transmission.

[0115] Similarly, as the sender of data, the blockchain platform uses the receiver’s public key to encrypt the data and uses the sender’s own private key to digitally sign it to ensure the integrity and authenticity of the data.

[0116] The embodiment of the present application introduces blockchain technology to establish a decentralized, traceable transaction record, and through the distributed and encrypted characteristics of blockchain, improves data security and prevents human tampering with data in the data platform.

[0117] In step 305, TEE verifies the second signature value through the platform public key, and after the verification is passed, decrypts the second ciphertext data through the device private key to obtain the decrypted first decryption result.

[0118] That is to say, the TEE of the IoT device verifies the received second signature value through the platform public key, and after the verification, decrypts the second ciphertext data through the device private key to obtain the decrypted first decryption result.

[0119] The IoT device of the embodiment of the present application uses TEE encryption, decryption, signing, and signature verification. TEE provides a secure trusted execution environment and uses TEE technology to ensure the security of data during transmission and storage, preventing sensitive information leakage and data tampering. It prevents malicious attacks on sensitive data and operations of the device.

[0120] Step 306: based on the first decryption result after decryption, confirm whether the data to be transmitted is transmitted successfully.

[0121] The IoT device obtains the first decryption result obtained through decryption, that is, the response information of whether the decryption is successful or not fed back by the blockchain platform, thereby confirming whether the data to be transmitted is successfully transmitted.

[0122] The trusted IoT method of the embodiment of the present application encrypts data with the public key of the receiver and signs the encrypted data with the private key of the sender, thereby ensuring the integrity and authenticity of the data. The confidentiality and integrity of the data during transmission are protected by a secure communication protocol, ensuring that the data is encrypted and protected during transmission from the sender to the receiver.

[0123] In order to clearly illustrate the above embodiment, specific examples are now provided for illustration. Figure 4 , 5 This is an example diagram of a trusted Internet of Things system provided by an embodiment of the present application. Figure 4As shown, the trusted Internet of Things method of the present application is applied to a trusted Internet of Things system, which includes an Internet of Things device and a blockchain platform.

[0124] Among them, the Internet of Things device includes an MCU module, a communication module and a PUF module, the communication module and the PUF module are both connected to the MCU module, and the MCU module is configured with TEE and REE; it can implement the trusted Internet of Things method of any of the above embodiments, that is, realize the device registration process, the device identity authentication process and the data transmission process.

[0125] The blockchain platform includes a smart contract module and an encryption and decryption module. The blockchain platform is used to receive the registration information of IoT devices, authenticate IoT devices, decrypt and verify the encrypted data uploaded by IoT devices, and return the decryption results. Figure 5 As shown, the blockchain platform is also used to receive the first ciphertext data and the first signature value sent by the IoT device; decrypt the first ciphertext data by using the platform private key to obtain the decrypted data to be transmitted; store the decrypted data to be transmitted in the blockchain; the blockchain platform encrypts the first decryption result indicating whether the decryption is successful or not by using the device public key to obtain the second ciphertext data; sign the second ciphertext data by using the platform private key to obtain the second signature value; and send the second ciphertext data and the second signature value to the IoT device.

[0126] The trusted Internet of Things system of the embodiment of the present application, through the comprehensive use of PUF, TEE and blockchain technology, the system can better resist various attacks and improve the credibility and stability of the entire Internet of Things system.

[0127] In order to implement the above embodiments, the present application also proposes a trusted IoT device. Figure 6 This is a schematic diagram of the structure of a trusted IoT device provided in an embodiment of the present application. Figure 6 As shown, the trusted IoT device may include: an identification generation module 601, a key association module 602 and an information registration module 603.

[0128] Wherein, the identification generation module 601 is used to generate a hardware identifier through a PUF module integrated in the IoT device;

[0129] The key association module 602 is used to generate a device key pair through the TEE configured by the IoT device, the device key pair including a device public key and a device private key; and associate the hardware identifier with the device public key;

[0130] The information registration module 603 is used to register the associated hardware identifier and device public key into the blockchain of the blockchain platform when the IoT device is used for the first time.

[0131] In some embodiments, the apparatus further includes an identity authentication module 604, configured to:

[0132] The IoT device sends the associated hardware identifier and device public key to the smart contract module of the blockchain platform through the integrated communication module;

[0133] So that the smart contract module can realize the identity authentication of the IoT device by determining whether the associated hardware identifier and device public key stored in the blockchain are consistent with the associated hardware identifier and device public key received from the communication module.

[0134] In some embodiments, the apparatus further includes a data transmission module 605, configured to:

[0135] When the IoT device passes identity authentication, TEE encrypts the data to be transmitted using the platform public key provided by the blockchain platform to obtain the first ciphertext data;

[0136] Sign the first ciphertext data using the device private key to obtain a first signature value;

[0137] Sending the first ciphertext data and the first signature value to the blockchain platform;

[0138] The receiving blockchain platform obtains second ciphertext data and a second signature value based on the verification and decryption processing of the first ciphertext data and the first signature value; wherein the second ciphertext data is obtained by the blockchain platform encrypting the first decryption result by using the device public key, and the first decryption result is obtained by the blockchain platform verifying and decrypting the first ciphertext data and the first signature value by using the platform private key and the device public key; the second signature value is obtained by the blockchain platform signing the second ciphertext data by using the platform private key;

[0139] The TEE verifies the second signature value through the platform public key, and after the verification is passed, decrypts the second ciphertext data through the device private key to obtain the decrypted first decryption result;

[0140] Based on the first decryption result after decryption, it is confirmed whether the data to be transmitted is transmitted successfully.

[0141] In some implementations, when the data transmission module 605 sends the first ciphertext data and the first signature value to the blockchain platform, it is specifically used to:

[0142] The first ciphertext data and the first signature value are sent to the blockchain platform through a secure communication protocol.

[0143] In some embodiments, the information registration module 603, when registering the associated hardware identifier and device public key into the blockchain of the blockchain platform, is specifically used to:

[0144] Register the associated hardware identifier and device public key to the identity registration record chain in the blockchain platform's blockchain.

[0145] It should be noted that the above explanation of the embodiment of the trusted IoT method is also applicable to the trusted IoT device of this embodiment and will not be repeated here.

[0146] In order to implement the above embodiment, the present application also proposes an electronic device. Figure 7 , Figure 7 Schematic diagram of the structure of the electronic device provided in the embodiment of the present application. Figure 7 As shown, the electronic device 700 includes: a processor 701, and a memory 702 communicatively connected to the processor 701; the memory 702 stores computer-executable instructions; the processor 701 executes the computer-executable instructions stored in the memory to implement the method provided in the aforementioned embodiment.

[0147] In order to implement the above embodiments, the present application also proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the methods provided by the above embodiments.

[0148] In order to implement the above embodiments, the present application also proposes a computer program product, including a computer program, which implements the methods provided by the above embodiments when executed by a processor.

[0149] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this application are in compliance with relevant laws and regulations and do not violate public order and good morals.

[0150] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. In addition, such collection / sharing should be carried out after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign the agreement / authorization including authorization of relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others who have access to personal information data comply with its privacy policy and procedures.

[0151] The present application is expected to provide an implementation scheme for users to selectively block the use or access of personal information data. That is, the present disclosure is expected to provide hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, the risk can be minimized by limiting data collection and deleting the data. In addition, when applicable, such personal information is de-identified to protect the privacy of the user.

[0152] In the description of the aforementioned embodiments, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0153] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0154] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0155] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0156] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0157] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0158] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0159] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A trusted IoT method, characterized in that: Applied to IoT devices, including: The IoT device generates a hardware identifier through an integrated physical unclonable function PUF module; The IoT device generates a device key pair through a configured trusted execution environment TEE, wherein the device key pair includes a device public key and a device private key; and associates the hardware identifier with the device public key; When the IoT device is used for the first time, the associated hardware identifier and the device public key are registered in the blockchain of the blockchain platform.

2. The method according to claim 1, characterized in that The method further comprises: The IoT device sends the associated hardware identifier and the device public key to the smart contract module of the blockchain platform through an integrated communication module; So that the smart contract module can realize the identity authentication of the Internet of Things device by determining whether the associated hardware identifier and the device public key stored in the blockchain are consistent with the associated hardware identifier and the device public key received from the communication module.

3. The method according to claim 1, characterized in that The method further comprises: When the IoT device passes identity authentication, the TEE encrypts the data to be transmitted by using the platform public key provided by the blockchain platform to obtain first ciphertext data; Sign the first ciphertext data using the device private key to obtain a first signature value; Sending the first ciphertext data and the first signature value to the blockchain platform; Receiving the verification and decryption processing of the first ciphertext data and the first signature value by the blockchain platform, to obtain the second ciphertext data and the second signature value; wherein the second ciphertext data is obtained by the blockchain platform encrypting the first decryption result by the device public key, and the first decryption result is obtained by the blockchain platform verifying and decrypting the first ciphertext data and the first signature value by the platform private key and the device public key; the second signature value is obtained by the blockchain platform signing the second ciphertext data by the platform private key; The TEE verifies the second signature value by using the platform public key, and after the verification is passed, decrypts the second ciphertext data by using the device private key to obtain a first decryption result after decryption; Based on the first decryption result after the decryption, it is confirmed whether the data to be transmitted is successfully transmitted.

4. The method according to claim 3, characterized in that The sending of the first ciphertext data and the first signature value to the blockchain platform comprises: The first ciphertext data and the first signature value are sent to the blockchain platform through a secure communication protocol.

5. The method according to claim 1, characterized in that: The step of registering the associated hardware identifier and the device public key in a blockchain of a blockchain platform comprises: The associated hardware identifier and the device public key are written into the identity registration record chain of the blockchain platform.

6. A trusted IoT device, characterized in that: The device is configured in an IoT device and includes: An identification generation module, used to generate a hardware identifier through a physical unclonable function PUF module integrated in the IoT device; A key association module, configured to generate a device key pair through a trusted execution environment TEE configured in the IoT device, wherein the device key pair includes a device public key and a device private key; and associate the hardware identifier with the device public key; An information registration module is used to register the associated hardware identifier and the device public key in the blockchain of the blockchain platform when the IoT device is used for the first time.

7. A trusted Internet of Things system, characterized in that: include: An Internet of Things device, comprising an MCU module, a communication module and a physically unclonable function PUF module, wherein the communication module and the PUF module are both connected to the MCU module, and the MCU module is configured with a trusted execution environment TEE and a rich execution environment REE; the Internet of Things device is used to implement the trusted Internet of Things method according to any one of claims 1 to 5; The blockchain platform includes a smart contract module and an encryption and decryption module. The blockchain platform is used to receive the registration information of the IoT device, perform authentication processing on the IoT device, decrypt and verify the encrypted data uploaded by the IoT device, and return the decryption result.

8. The system according to claim 7, characterized in that The blockchain platform is also used to: Receiving first ciphertext data and a first signature value sent by the IoT device; Decrypt the first ciphertext data using the platform private key to obtain decrypted data to be transmitted; store the decrypted data to be transmitted and related information in the blockchain; The blockchain platform encrypts the first decryption result indicating whether the decryption is successful or not by using the device public key to obtain second ciphertext data; and signs the second ciphertext data by using the platform private key to obtain a second signature value; The second ciphertext data and the second signature value are sent to the IoT device.

9. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 5 when executed by a processor.

Images