Security authentication method and system for Internet of Things

Abstract

The invention discloses a security authentication method and system for the Internet of Things, and the method comprises the steps: receiving an external network access request of a terminal; performing white list verification on the external network access request according to the local white list to obtain a white list verification result; if the white list verification result is not passed, returning the authentication jump link to the terminal, so that the terminal performs device authentication with the authentication server according to the authentication jump link, and the terminal obtains verification information returned by the authentication server; receiving a directional service request containing verification information sent by the terminal, and generating an information verification request according to the directional service request; periodically sending an information verification request to the authentication server according to the interval time to obtain an information verification result returned by the authentication server; and returning a network interface corresponding to the information verification result to the terminal. According to the method, the security and traceability of network service can be improved, and the network service quality is improved. The invention relates to the technical field of Internet of Things.

Description

Technical Field

[0001] The present application relates to the technical field of Internet of Things, and in particular to a security authentication method and system for the Internet of Things. Background Art

[0002] MIFI (Mobile WIFI) is a portable broadband wireless device that integrates the functions of a modem, a router, and an access point. The MIFI wireless device is connected to the Internet through an internally installed Internet of Things card, so that the MIFI wireless device can provide Internet of Things services to third-party devices.

[0003] At present, the traditional IoT device security authentication method is often to perform security authentication on MIFI wireless devices. This method allows third-party devices to establish a connection with MIFI wireless devices to access the Internet by simply entering an account and password, and the traceability of network services is poor. In addition, this method often cannot promptly and effectively limit the flow or take the third-party devices offline for illegally accessed third-party devices, which can easily affect the quality of network services and make network service security low.

[0004] Therefore, the problems existing in the prior art still need to be solved and optimized. Summary of the invention

[0005] In order to solve at least one of the above technical problems, the present application provides a security authentication method and system for the Internet of Things, wherein the security authentication method can improve the security and traceability of network services and improve the quality of network services.

[0006] According to the first aspect of the present application, a security authentication method for an Internet of Things is provided, which is used at a gateway end. The security authentication method includes:

[0007] Receive external network access requests from terminals;

[0008] Obtaining a local whitelist, performing a first whitelist check on the external network access request according to the local whitelist, and obtaining a first whitelist check result, wherein the local whitelist is used to record securely authenticated terminals connected to the gateway end;

[0009] If the first whitelist verification result is that the whitelist verification fails, a preset authentication jump link is returned to the terminal, so that the terminal performs device authentication with the authentication server according to the authentication jump link, and the terminal obtains the first verification information returned by the authentication server, and the first verification information is used to record the binding mapping relationship between the address information of the terminal and the authentication token;

[0010] receiving a directed service request including the first verification information sent by the terminal, and generating an information verification request according to the directed service request;

[0011] Periodically sending the information verification request to the authentication server according to a preset interval time, and obtaining an information verification result returned by the authentication server, wherein the information verification result is used to indicate whether the first verification information of the terminal is valid;

[0012] Return a network interface corresponding to the information verification result to the terminal.

[0013] According to a second aspect of the present application, a security authentication method for an Internet of Things is provided, which is used for a terminal, and the terminal is used to communicate with the above-mentioned gateway end, and the security authentication method includes:

[0014] Sending an external network access request to a gateway end so that the gateway end obtains a local whitelist, performing a first whitelist check on the external network access request according to the local whitelist to obtain a first whitelist check result, wherein the local whitelist is used to record securely authenticated terminals connected to the gateway end; when the first whitelist check result is that the whitelist check fails, the gateway end returns a preset authentication jump link to the terminal;

[0015] Performing device authentication with the authentication server according to the authentication jump link to obtain first verification information returned by the authentication server, wherein the first verification information is used to record a binding mapping relationship between the address information of the terminal and the authentication token;

[0016] Sending a directed service request including the first verification information to the gateway end, so that the gateway end generates an information verification request according to the directed service request, and then periodically sends the information verification request to the authentication service end according to a preset interval time, and the gateway end obtains an information verification result returned by the authentication service end, and the information verification result is used to indicate whether the first verification information of the terminal is valid;

[0017] Receive the network interface corresponding to the information verification result returned by the gateway.

[0018] According to a third aspect of the present application, a security authentication method for an Internet of Things is provided, which is used for an authentication server, wherein the authentication server is used for communication connection with the above-mentioned gateway, and the security authentication method further includes:

[0019] Receiving an information verification request sent from the gateway according to a preset interval time period;

[0020] According to the information verification request, returning the information verification result corresponding to the information verification request to the gateway end, so that the gateway end returns a network interface corresponding to the information verification result; the information verification result is used to indicate whether the first verification information of the terminal is valid;

[0021] The information verification request is obtained through the following steps:

[0022] The gateway receives an external network access request from the terminal;

[0023] The gateway end obtains a local whitelist, performs a first whitelist check on the external network access request according to the local whitelist, and obtains a first whitelist check result, wherein the local whitelist is used to record securely authenticated terminals connected to the gateway end;

[0024] When the first whitelist check result is that the whitelist check fails, the gateway returns a preset authentication jump link to the terminal, so that the terminal performs device authentication with the authentication server according to the authentication jump link, and the terminal obtains the first verification information returned by the authentication server, and the first verification information is used to record the binding mapping relationship between the address information of the terminal and the authentication token;

[0025] Receive a directional service request including the first verification information sent by the terminal, and generate an information verification request according to the directional service request.

[0026] According to a third aspect of the present application, a security authentication system for an Internet of Things is provided, which is used at a gateway end, and the security authentication system includes:

[0027] A first processing unit, configured to receive an external network access request from a terminal;

[0028] A second processing unit is used to obtain a local whitelist, perform a first whitelist check on the external network access request according to the local whitelist, and obtain a first whitelist check result, wherein the local whitelist is used to record the securely authenticated terminals connected to the gateway end;

[0029] a third processing unit, configured to return a preset authentication jump link to the terminal if the first whitelist verification result is that the whitelist verification fails, so that the terminal performs device authentication with the authentication server according to the authentication jump link, and the terminal obtains first verification information returned by the authentication server, where the first verification information is used to record a binding mapping relationship between the address information of the terminal and the authentication token;

[0030] a fourth processing unit, configured to receive a directional service request including the first verification information sent by the terminal, and generate an information verification request according to the directional service request;

[0031] a fifth processing unit, configured to periodically send the information verification request to the authentication server according to a preset interval time, and obtain an information verification result returned by the authentication server, wherein the information verification result is used to indicate whether the first verification information of the terminal is valid;

[0032] The sixth processing unit is used to return a network interface corresponding to the information verification result to the terminal.

[0033] According to a fifth aspect of the present application, a computer device is provided, comprising:

[0034] at least one processor;

[0035] at least one memory for storing at least one program;

[0036] When the at least one program is executed by the at least one processor, the at least one processor implements the method as described in any one of the above aspects.

[0037] According to a sixth aspect of the present application, a computer-readable storage medium is provided, in which a program executable by a processor is stored. When the program executable by the processor is executed by the processor, it is used to implement the method described in any of the above aspects.

[0038] The beneficial effects of the technical solution provided by the embodiment of the present application are:

[0039] The present application provides a security authentication method and system for the Internet of Things, wherein the security authentication method for a gateway end receives an external network access request from a terminal; obtains a local whitelist, performs a first whitelist check on the external network access request according to the local whitelist, and obtains a first whitelist check result, wherein the local whitelist is used to record the securely authenticated terminals connected to the gateway end; if the first whitelist check result is that the whitelist check fails, a preset authentication jump link is returned to the terminal, so that the terminal performs device authentication with an authentication server according to the authentication jump link, and the terminal obtains first verification information returned by the authentication server, and the first verification information is used to record the binding mapping relationship between the address information of the terminal and the authentication token; receives a directional service request containing the first verification information sent by the terminal, and generates an information verification request according to the directional service request; periodically sends the information verification request to the authentication server according to a preset interval time, and obtains the information verification result returned by the authentication server, and the information verification result is used to indicate whether the first verification information of the terminal is valid; and returns a network interface corresponding to the information verification result to the terminal. This security authentication method returns the authentication jump link to the terminal for device authentication when the first whitelist verification result is different, so that each terminal connected to the gateway (such as a MIFI wireless device) can be authenticated with the authentication server, which can improve the traceability of network services. In addition, this security authentication method periodically obtains information verification results based on time intervals, which can timely and effectively capture third-party devices with expired authentication or illegal intrusion, thereby reducing the impact on network services and improving the quality and security of network services. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A flowchart of a security authentication method for an Internet of Things is provided for an embodiment of the present application;

[0041] Figure 2 The embodiments of the present application provide Figure 1 The corresponding timing flow chart;

[0042] Figure 3 A schematic diagram of a first optional flow chart of a security authentication method for the Internet of Things provided in an embodiment of the present application;

[0043] Figure 4 A second optional flow chart of a security authentication method for the Internet of Things provided in an embodiment of the present application;

[0044] Figure 5 A third optional flow chart of a security authentication method for the Internet of Things provided in an embodiment of the present application;

[0045] Figure 6The embodiments of the present application provide Figure 6 The corresponding timing flow chart;

[0046] Figure 7 A detailed flow chart of step S220 provided in an embodiment of the present application;

[0047] Figure 8 A fourth optional flow chart of a security authentication method for the Internet of Things provided in an embodiment of the present application;

[0048] Fig. 9 A schematic diagram of a security authentication system for the Internet of Things provided in an embodiment of the present application;

[0049] Fig.10 A structural block diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The present application is further described below in conjunction with the accompanying drawings and specific embodiments. The described embodiments should not be regarded as limiting the present application, and all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0051] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0052] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0053] At present, the traditional IoT device security authentication method is often to authenticate MIFI wireless devices. This method allows third-party devices to connect to the MIFI wireless device and access the Internet by simply entering an account and password. It is difficult to trace the access records of the actual users of the third-party devices, and the traceability of network services is poor. In addition, this method often cannot effectively and timely limit the flow or take the third-party devices offline for illegal access. If the illegal third-party devices generate a large amount of data traffic, or even visit illegal websites, the quality of network services is easily affected, and the network service security is not high. In addition, MIFI devices on the market do not support authentication connections for screenless devices (such as dumb terminals), and the scope of application of MIFI devices is not large.

[0054] In view of this, an embodiment of the present application provides a security authentication method for the Internet of Things. When the first whitelist verification result is different, the security authentication method returns the authentication jump link to the terminal for device authentication, so that each terminal connected to the gateway (such as a MIFI wireless device) can be authenticated with the authentication server, which can improve the traceability of network services; in addition, the security authentication method periodically obtains information verification results based on time intervals, and can timely and effectively capture third-party devices with expired authentication or illegally invaded. Specifically, it can capture third-party devices with expired authentication or illegally invaded the gateway (such as MIFI devices), and limit the flow or take these third-party devices offline, which can reduce the impact on network services and improve the quality and security of network services.

[0055] It is worth mentioning that the security authentication method is also based on obtaining the heartbeat response signal with the third whitelist returned by the authentication server, and updating the third whitelist in the authentication server through the fourth whitelist verification result, which can timely and effectively capture the third-party device that illegally invades the authentication server, and take the third-party device offline, which can reduce the impact on network services and improve the quality and security of network services. In addition, the security authentication method is based on the terminal and the first user device, and realizes the device authentication of the second user device (such as a screenless device) through the second verification code verification request, which can realize the authentication connection between the MIFI device and the second user device, effectively improving the scope of application of the MIFI device.

[0056] A security authentication method and system for the Internet of Things provided in an embodiment of the present application can be specifically illustrated by the following embodiments. First, a security authentication method for the Internet of Things in an embodiment of the present application is described.

[0057] The security authentication method of the Internet of Things provided in the embodiment of the present application can be applied to the application scenario of the Internet of Things. In the application scenario of the Internet of Things, the Internet of Things service provider can perform security authentication on the Internet of Things device through the security authentication method provided in the embodiment of the present application, which can improve the security and traceability of network services and improve the quality of network services.

[0058] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0059] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0060] Reference Figure 1 and Figure 2 , Figure 1 This is an optional flowchart of the first security authentication method for the Internet of Things provided in the embodiment of the present application. Figure 1 The method is used on the gateway side, which may include but is not limited to steps S110 to S160.

[0061] Step S110: receiving an external network access request from a terminal;

[0062] In the embodiment of the present application, the gateway end may be a MIFI device, which is loaded with an SDK plug-in (such as miot-plugin-sdk), which enables the gateway end to realize intelligent functions such as device connection, data communication, and remote control; the terminal may be an IoT device connected to the gateway end, and there are many types of specific IoT devices, which will not be described in detail in this application. It is understandable that step S110 may be to generate an external network access request when the terminal needs to access the network, and send the external network access request to the gateway end, and the external network access request specifically includes the terminal MAC address, the target access address, etc., and the example of this application is for illustration only.

[0063] Step S120, obtaining a local whitelist, performing a first whitelist check on the external network access request according to the local whitelist, and obtaining a first whitelist check result, wherein the local whitelist is used to record securely authenticated terminals connected to the gateway end;

[0064] In an embodiment of the present application, when the gateway receives an external network access request, it can obtain a local whitelist stored inside the gateway; the first whitelist check can be to compare whether the terminal MAC address in the external network access request is recorded on the local whitelist. Specifically, if the MAC address of the terminal is not recorded on the local whitelist, a first whitelist check result indicating that the whitelist check fails is obtained; or, if the MAC address of the terminal is recorded on the local whitelist, a first whitelist check result indicating that the whitelist check passes is obtained.

[0065] Step S130: If the first whitelist verification result is that the whitelist verification fails, a preset authentication jump link is returned to the terminal, so that the terminal performs device authentication with the authentication server according to the authentication jump link, and the terminal obtains first verification information returned by the authentication server, where the first verification information is used to record the binding mapping relationship between the address information of the terminal and the authentication token;

[0066] In an embodiment of the present application, if the result of the first whitelist verification is that the whitelist verification is passed, the network interface can be accessed and returned to the terminal based on the target access address in the external network access request; if the result of the first whitelist verification is that the whitelist verification fails, the preset authentication jump link can be returned to the terminal, so that the terminal performs device authentication with the authentication server according to the authentication jump link, thereby obtaining the first verification information, which records the address information of the terminal (such as MAC address) and the corresponding authentication token (such as the token issued by the authentication server).

[0067] Step S140: receiving a directional service request including the first verification information sent by the terminal, and generating an information verification request according to the directional service request;

[0068] In an embodiment of the present application, after receiving the first verification information returned by the authentication server, the terminal can send a directed service request containing the first verification information to the gateway, so that the gateway constructs an information verification request based on the authentication token and terminal address information in the directed service request. The information verification request is used to request the authentication server to verify whether the authentication token is valid, and whether the terminal address information has a binding mapping relationship with the valid authentication token.

[0069] Step S150: periodically sending the information verification request to the authentication server according to a preset interval time, and obtaining the information verification result returned by the authentication server, wherein the information verification result is used to indicate whether the first verification information of the terminal is valid;

[0070] In an embodiment of the present application, the preset interval time can be set according to actual conditions, for example, any one of 3 seconds, 5 seconds, 10 seconds, etc. The embodiment of the present application takes an interval time of 5 seconds as an example; in addition, after the gateway end in the embodiment of the present application generates an information verification request, it can periodically send an information verification request to the authentication server end according to the interval time, specifically, the gateway end can send an information verification request to the authentication server end once every 5 seconds.

[0071] It can be understood that for an information verification request sent by the gateway at a certain time, the authentication server will parse and verify the authentication token in the information verification request based on the whitelist list built or updated when the first verification information is generated. Specifically, it can be to obtain the MIFI device information, terminal device information, authentication time, etc. in the authentication token, and then compare the obtained information based on the whitelist list to obtain the information verification result.

[0072] It should be noted that the whitelist of the authentication service end records the terminals registered on the authentication device end, and the authentication token corresponding to each terminal; illustratively, the authentication token can be a blank authentication token or a non-blank authentication token. When the authentication token in the whitelist is blank, it can represent that the corresponding terminal has been registered but not authenticated; or, when the authentication token in the whitelist is non-blank, it can represent that the corresponding terminal has been registered and authenticated. In addition, the examples of authentication tokens in this application are only for illustration and are not intended to limit this application. In other feasible methods, whether the terminal is authenticated can also be determined based on whether the authentication token is left blank, whether the authentication token has special characters, and other identifiers.

[0073] It is worth mentioning that the embodiment of the present application is based on the gateway end periodically sending information verification requests to the authentication server end, and obtaining the returned information verification results. It can capture these terminals in a timely and effective manner when the authentication of some terminals expires or the terminals illegally invade the gateway end, so as to facilitate subsequent current limiting or lower limit operations, which can reduce the impact on network services and improve the quality and security of network services.

[0074] Step S160: Return the network interface corresponding to the information verification result to the terminal.

[0075] In an embodiment of the present application, if the information verification result corresponding to the information verification request sent at a certain time is that the first verification information of the terminal is valid, the gateway can update the local whitelist of the gateway based on the information verification result, and then call the online record interface of the gateway to add a new online record and push the redirected authentication success page to the terminal; at the same time, the gateway can also release the external network access request, so that the gateway can return the network interface corresponding to the external network access request to the terminal.

[0076] It can be understood that after the gateway pushes the redirected authentication success page for the first time, the gateway can also send the next cycle's information verification request to the authentication server based on the second interval time. The second interval time can be the aforementioned interval time or a separately set interval time. If the information verification result remains unchanged, the gateway can only execute the operation of updating the local whitelist based on the information verification result corresponding to each cycle.

[0077] It should be noted that if the information verification result is that the first verification information of the terminal is invalid, it may mean that the authentication of the terminal sending the external network access request has expired, or the terminal sending the external network access request is an illegally intruded terminal. At this time, the authentication failure page can be pushed to the terminal, and the information verification request can be sent every 5 seconds. During this period, if the authentication token (such as token) expires, the gateway will remove the terminal MAC address corresponding to the authentication token from the local whitelist and kick the current terminal device offline.

[0078] Reference Figure 3 In some embodiments, the security authentication method further includes:

[0079] A1. constructing a gateway registration request according to the gateway device information of the gateway end, and sending the gateway registration request to the authentication server end, so that the authentication server end generates a gateway unique identifier according to the gateway registration request;

[0080] A2. Receive the gateway unique identifier returned by the authentication server;

[0081] A3. Construct a whitelist acquisition request according to the gateway unique identifier, and send the whitelist acquisition request to the authentication server to obtain a first whitelist list returned by the authentication server.

[0082] In the embodiment of the present application, the gateway device information may be the device information of the MIFI device, which may specifically include the MAC address of the MIFI device, the device model, the device internal management address, the device IMEI, the ICCID bound to the MIFI device, etc. Step A1 may be that the gateway constructs a corresponding gateway registration request based on the gateway device information, and sends the gateway registration request to the authentication service end.

[0083] It is understandable that after receiving the gateway registration request, the authentication server can generate a unique device ID (i.e., gateway unique identifier) ​​corresponding to the gateway registration request in the authentication server based on the device model in the gateway registration request, and then return the unique device ID to the MIFI device loaded with the SDK plug-in. Step A2 can be that the gateway stores the returned unique device ID in the memory of the gateway.

[0084] It should be noted that step A3 may be that the gateway constructs a whitelist acquisition request based on the unique device ID in the memory, and the whitelist acquisition request is used to obtain the MAC address list of the current whitelist devices on the authentication server; specifically, after the authentication server receives the whitelist acquisition request, the authentication server can return the first whitelist list corresponding to the whitelist acquisition request, so that the gateway can update the local whitelist in the gateway network firewall based on the received first whitelist list.

[0085] Reference Figure 4 In some embodiments, the security authentication method further includes:

[0086] B1. receiving a gateway connection request from the terminal, and performing a second whitelist check on the terminal according to the local whitelist to obtain a second whitelist check result;

[0087] B2. If the result of the second whitelist verification is that the whitelist verification fails, the terminal information in the gateway connection request is sent to the authentication server, so that the authentication server updates the first whitelist in the authentication server according to the terminal information, and obtains the second whitelist returned by the authentication server;

[0088] B3. Perform a third whitelist check on the terminal according to the second whitelist to obtain a third whitelist check result;

[0089] B4. If the third whitelist verification result is that the whitelist verification is passed, then according to the gateway connection request, a network connection is established between the terminal and the gateway.

[0090] In an embodiment of the present application, after the user configures the SSID of the terminal to connect to the MIFI device, the gateway receives a gateway connection request from the terminal. At this time, the gateway can obtain the local whitelist from the network firewall and verify the MAC address of the terminal based on the local whitelist. If the current terminal MAC address is recorded in the local whitelist, a second whitelist verification result indicating that the whitelist verification has passed is returned, and the current terminal is successfully connected to the gateway; or, if the current terminal MAC address is not recorded in the local whitelist, a second whitelist verification result indicating that the whitelist verification has failed is returned. At this time, the gateway can report the terminal information (such as the current terminal MAC address) in the gateway connection request to the authentication server, so that the authentication server updates the first whitelist list corresponding to the gateway based on the terminal information, and finally obtains the second whitelist list returned by the authentication server.

[0091] It can be understood that after receiving the second whitelist, the gateway can update the local whitelist based on the second whitelist, and also perform a third whitelist check on the current terminal MAC address based on the second whitelist. If the current terminal MAC address is recorded in the second whitelist, the second whitelist check result indicating that the whitelist check has passed is returned, and a network connection between the terminal and the gateway is established based on the gateway connection request, so that the current terminal and the gateway are connected successfully.

[0092] It should be noted that the second whitelist returned by the authentication server in step B2 may be the second whitelist directly sent to the gateway after the authentication server updates the first whitelist based on the terminal information; or, the authentication server may update the first whitelist based on the terminal information, and after obtaining the second whitelist, the authentication server returns an update response signal to the gateway, and the gateway pulls the second whitelist stored in the authentication server based on the update response signal.

[0093] Reference Figure 5 and Figure 6 In some embodiments, the security authentication method further includes:

[0094] C1. Obtain a preset heartbeat cycle, and send a heartbeat initiation signal to the authentication server according to the heartbeat cycle, so that the authentication server generates a corresponding heartbeat response signal according to the heartbeat initiation signal, and the heartbeat response signal includes a third whitelist list corresponding to the current heartbeat initiation signal;

[0095] C2. Receive a heartbeat response signal returned by the authentication server, and perform a fourth whitelist check on the third whitelist according to the local whitelist to obtain a fourth whitelist check result, wherein the fourth whitelist check result is used to indicate whether the authentication server has an authenticated terminal that has illegally invaded;

[0096] C3. Sending the fourth whitelist verification result to the authentication server, so that the authentication server updates the third whitelist according to the fourth whitelist verification result.

[0097] In an embodiment of the present application, a MIFI device loaded with an SDK plug-in can periodically send a heartbeat initiation signal to the heartbeat detection interface of the authentication server based on the heartbeat cycle, and the heartbeat initiation signal can specifically include the device information of the MIFI device; after receiving the heartbeat initiation signal, the authentication server parses the device information in the heartbeat initiation signal. If certain specific information in the device information (such as a MAC address) does not exist, the MIFI device and the gateway can jump to execute steps A1 to A3; or, if the specific information in the device information exists, the authentication server can construct a heartbeat response signal corresponding to the heartbeat initiation signal from the current third whitelist list, and return the constructed heartbeat response signal to the gateway.

[0098] It can be understood that after the gateway receives the heartbeat response signal, the fourth whitelist check in step C2 can be based on the local whitelist of the gateway, and the current whitelist list (i.e., the third whitelist list) of the authentication server is compared. Specifically, it can be to compare the current terminal address information and the corresponding gateway device information in the third whitelist list to see whether they are consistent with the corresponding terminal address information and gateway device information in the local whitelist list. If they are consistent, the fourth whitelist check result can be obtained, indicating that there is no illegal intrusion of the authenticated terminal on the authentication server; or, if they are inconsistent, the fourth whitelist check result can be obtained, indicating that there is an illegal intrusion of the authenticated terminal on the authentication server.

[0099] It should be noted that after receiving the fourth whitelist verification result, the authentication server can update the third whitelist by deleting the illegally invaded authenticated terminals in the third whitelist based on the verification information in the fourth whitelist verification result, and kick the illegally invaded authenticated terminals to the lower limit.

[0100] It is worth mentioning that the heartbeat response signal of the embodiment of the present application may also include an SDK task, which can be used to trigger any one of the tasks such as remote download or local upgrade on the gateway side. There are many specific implementation methods, which will not be repeated in this application.

[0101] It should be added that in the heartbeat detection process between the gateway and the authentication server in the embodiment of the present application, the third whitelist in the authentication server can be updated through the fourth whitelist verification, and the third-party device that illegally invades the authentication server can be captured in a timely and effective manner, and the third-party device can be taken offline, which can reduce the impact on network services and improve the quality and security of network services.

[0102] In some embodiments, the embodiments of the present application also provide a security authentication method for the Internet of Things, which is used for a terminal, and the terminal is used to communicate with the above-mentioned gateway end, which may include but is not limited to steps S210 to S240.

[0103] Step S210: sending an external network access request to the gateway end so that the gateway end obtains a local whitelist, and performs a first whitelist check on the external network access request according to the local whitelist to obtain a first whitelist check result, wherein the local whitelist is used to record the securely authenticated terminals connected to the gateway end; when the first whitelist check result is that the whitelist check fails, the gateway end returns a preset authentication jump link to the terminal;

[0104] Step S220: Perform device authentication with the authentication server according to the authentication jump link to obtain first authentication information returned by the authentication server, where the first authentication information is used to record the binding mapping relationship between the address information of the terminal and the authentication token;

[0105] Step S230: sending a directed service request including the first verification information to the gateway end, so that the gateway end generates an information verification request according to the directed service request, and then periodically sends the information verification request to the authentication server end according to a preset interval time, and the gateway end obtains an information verification result returned by the authentication server end, and the information verification result is used to indicate whether the first verification information of the terminal is valid;

[0106] Step S240: Receive a network interface corresponding to the information verification result returned by the gateway.

[0107] In the embodiment of the present application, steps S210 to S240 are similar to the aforementioned steps S110 to S160 and can be simply deduced by analogy, and are not elaborated herein.

[0108] Reference Figure 7 In some embodiments, step S220, performing device authentication with the authentication server according to the authentication jump link to obtain first verification information returned by the authentication server, includes:

[0109] D1. Send a terminal authentication request to the authentication server according to the authentication jump link, and obtain authentication page data returned by the authentication server;

[0110] D2. Generate a first verification code acquisition request according to the authentication page data, wherein the first verification code acquisition request records a first user device that receives a verification code;

[0111] D3. Send the first verification code acquisition request to the authentication server, so that the authentication server generates a first verification code according to the first verification code acquisition request, and sends the first verification code to the first user device;

[0112] D4. Receive a first verification code from the first user device, and send a first verification code verification request containing the first verification code to the authentication server, so that the authentication server verifies the first verification code verification request according to the generated first verification code, and obtains first verification information returned by the authentication server.

[0113] In an embodiment of the present application, step D1 may be that the terminal constructs a terminal authentication request based on the authentication jump link, and sends the terminal authentication request to the authentication server, so that the authentication server returns authentication page data corresponding to the terminal authentication request, and the authentication page data may specifically be a portal authentication page.

[0114] It can be understood that step D2 can be that the terminal constructs a first verification code acquisition request in response to the device data entered by the user in the authentication page data, and the device data entered by the user is used to represent the first user device of the user to receive the verification code, which can specifically be a mobile terminal (such as a mobile phone), a computer device (such as a computer), etc. Step D3 can be that the authentication server generates a first verification code (such as a text message verification code, a picture verification code), and sends the generated first verification code to the user's first user device through the verification code service call interface of the authentication server.

[0115] It should be noted that step D4 can be that the terminal generates a first verification code verification request containing the first verification code based on the first verification code entered by the user in the authentication page data, and then sends the first verification code verification request to the authentication server; after receiving the first verification code verification request, the authentication server can verify the first verification code, and if the verification fails, return verification information indicating the verification failure to the terminal; or, if the verification is successful, it can return the first verification information to the terminal.

[0116] Reference Figure 8 In some embodiments, the security authentication method further includes:

[0117] E1. Obtain a network service identifier of a second user device, and send the network service identifier to the authentication server through the gateway, so that the authentication server updates the fourth white list according to the network service identifier, and the authentication server obtains a fifth white list;

[0118] E2. Sending a device configuration request corresponding to the second user device to the authentication server, so that the authentication server generates a configuration page for the fifth whitelist according to the device configuration request, and obtains configuration page data returned by the authentication server;

[0119] E3. Generate a second verification code acquisition request according to the configuration page data, and send the second verification code acquisition request to the authentication server, so that the authentication server generates a second verification code according to the second verification code acquisition request, and sends the second verification code to the first user device;

[0120] E4. Receive a second verification code from the first user device, and send a second verification code verification request containing the second verification code to the authentication server, so that the authentication server verifies the second verification code verification request according to the generated second verification code, and obtains second verification information corresponding to the second user device returned by the authentication server.

[0121] In the embodiment of the present application, the second user device may be a screenless device or a dumb terminal, the terminal and the first user device in steps E1 to E4 may be the same device or different devices, and the terminal and the first user device may be any one of a mobile terminal, a computer device, etc. Step E1 may first be that the terminal obtains the network service identifier (such as a service set identifier SSID) of the second user device connected to the gateway, and then synchronously sends the obtained network service identifier to the authentication server, so that the authentication server adds the network service identifier corresponding to the second user device to the fourth white list, thereby obtaining the fifth white list, and the authentication token corresponding to the second user device in the fifth white list is blank, that is, the second user device has been registered but not authenticated.

[0122] It can be understood that step E2 can be that after the second user device is linked to the gateway end based on the network service identifier, the terminal sends a device configuration request to the authentication server end, and the device configuration request is used to obtain the configuration page corresponding to the second user device; then, after receiving the device configuration request, the authentication server end constructs a corresponding device configuration page based on the terminal and authentication token recorded in the fifth whitelist list, and determines the device configuration page as the configuration page data returned by the authentication server end.

[0123] In a feasible implementation, if the terminal and the first user device are the same device, step E3 can be that the terminal generates a corresponding second verification code acquisition request based on the list of all unauthenticated second user devices of the current MIFI device in the configuration page data, wherein the second user device list can be directly obtained through the configuration page data, or indirectly obtained through the list QR code in the configuration page data, and the second verification code acquisition request is used to represent the authentication request of any number of second user devices; then, the rest of step E3 and the content of step E4 are similar to the contents of the aforementioned steps D2 to D4, and can be simply inferred.

[0124] It should be noted that, in special cases such as the terminal and the first user device are the same device, and the terminal is an authenticated terminal device, after receiving the second verification code acquisition request sent by the terminal, the authentication service end can return the second verification information of each second user device in the second verification code acquisition request based on the steps D2 to D4 previously executed by the terminal and similar to steps E3 and E4. Exemplarily, in the special case that the terminal and the first user device are the same device, and the terminal is an authenticated terminal device, the configuration page data received by the terminal can specifically be a hyperlink of the authentication success page, and the terminal can respond to the user's input instruction to construct a second verification code acquisition request for any number of specific second user devices in the authentication success page, so that the authentication service end directly returns the corresponding second verification information.

[0125] It should be added that if the terminal and the first user device are different devices, it is similar to the above content and can be simply deduced. In addition, the embodiment of the present application is based on the terminal and the first user device, and implements device authentication of the second user device (such as a screenless device) through a second verification code verification request, which can realize the authentication connection between the MIFI device and the second user device, and effectively improve the scope of application of the MIFI device.

[0126] In some embodiments, the embodiments of the present application also provide a security authentication method for the Internet of Things, which is used for an authentication server, and the authentication server is used to communicate with the above-mentioned gateway, which may include but is not limited to steps S310 to S320.

[0127] Step S310: receiving an information verification request sent from the gateway according to a preset interval period;

[0128] Step S320: according to the information verification request, returning the information verification result corresponding to the information verification request to the gateway end, so that the gateway end returns a network interface corresponding to the information verification result; the information verification result is used to indicate whether the first verification information of the terminal is valid;

[0129] The information verification request is obtained through the following steps:

[0130] The gateway receives an external network access request from the terminal;

[0131] The gateway end obtains a local whitelist, performs a first whitelist check on the external network access request according to the local whitelist, and obtains a first whitelist check result, wherein the local whitelist is used to record securely authenticated terminals connected to the gateway end;

[0132] When the first whitelist check result is that the whitelist check fails, the gateway returns a preset authentication jump link to the terminal, so that the terminal performs device authentication with the authentication server according to the authentication jump link, and the terminal obtains the first verification information returned by the authentication server, and the first verification information is used to record the binding mapping relationship between the address information of the terminal and the authentication token;

[0133] Receive a directional service request including the first verification information sent by the terminal, and generate an information verification request according to the directional service request.

[0134] In the embodiment of the present application, steps S310 to S320 are similar to the aforementioned steps S110 to S160 and can be simply deduced by analogy, and are not further elaborated in the present application.

[0135] Fig. 9 A schematic diagram of a security authentication system for the Internet of Things provided in an embodiment of the present application, which is used on a gateway side, includes:

[0136] The first processing unit 810 is used to receive an external network access request from a terminal;

[0137] The second processing unit 820 is used to obtain a local whitelist, and perform a first whitelist check on the external network access request according to the local whitelist to obtain a first whitelist check result, wherein the local whitelist is used to record the securely authenticated terminals connected to the gateway end;

[0138] The third processing unit 830 is configured to return a preset authentication jump link to the terminal if the first whitelist verification result is that the whitelist verification fails, so that the terminal performs device authentication with the authentication server according to the authentication jump link, and the terminal obtains the first verification information returned by the authentication server, and the first verification information is used to record the binding mapping relationship between the address information of the terminal and the authentication token;

[0139] The fourth processing unit 840 is configured to receive a directional service request including the first verification information sent by the terminal, and generate an information verification request according to the directional service request;

[0140] The fifth processing unit 850 is used to periodically send the information verification request to the authentication server according to a preset interval time, and obtain the information verification result returned by the authentication server, wherein the information verification result is used to indicate whether the first verification information of the terminal is valid;

[0141] The sixth processing unit 860 is used to return a network interface corresponding to the information verification result to the terminal.

[0142] In some embodiments, the security authentication system further comprises:

[0143] The seventh processing unit 870 is used to obtain a preset heartbeat cycle, and send a heartbeat initiation signal to the authentication server according to the heartbeat cycle, so that the authentication server generates a corresponding heartbeat response signal according to the heartbeat initiation signal, and the heartbeat response signal includes a third whitelist list corresponding to the current heartbeat initiation signal;

[0144] an eighth processing unit 880, configured to receive a heartbeat response signal returned by the authentication server, and perform a fourth whitelist check on the third whitelist according to the local whitelist to obtain a fourth whitelist check result, wherein the fourth whitelist check result is used to indicate whether there is an authenticated terminal that has illegally invaded the authentication server;

[0145] The ninth processing unit 890 is configured to send the fourth whitelist verification result to the authentication server, so that the authentication server updates the third whitelist according to the fourth whitelist verification result.

[0146] It can be understood that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0147] Fig.10 A schematic diagram of the structure of a computer device provided in an embodiment of the present application includes:

[0148] at least one processor 980;

[0149] At least one memory 920, used to store at least one program;

[0150] When the at least one program is executed by the at least one processor 980, the at least one processor 980 implements the methods described in the foregoing embodiments.

[0151] An embodiment of the present application also provides a computer-readable storage medium, which stores a program executable by a processor. When the program executable by the processor is executed by the processor 980, it is used to implement the methods described in the above embodiments.

[0152] Fig.10 Specifically, the computer device may be a user terminal or a server.

[0153] The present application embodiment takes the computer device as a user terminal as an example, and the details are as follows:

[0154] like Fig.10 As shown, the computer device 900 may include an RF (Radio Frequency) circuit 910, a memory 920 including one or more computer-readable storage media, an input unit 930, a display unit 940, a sensor 950, an audio circuit 960, a WiFi module 970, a processor 980 including one or more processing cores, and a power supply 990. Those skilled in the art will appreciate that Fig.10 The device structure shown in the figure does not constitute a limitation on the electronic device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0155] The RF circuit 910 can be used for receiving and sending signals during information transmission or calls. In particular, after receiving the downlink information of the base station, it is handed over to one or more processors 980 for processing; in addition, the data related to the uplink is sent to the base station. Generally, the RF circuit 910 includes but is not limited to an antenna, at least one amplifier, a tuner, one or more oscillators, a user identity module (SIM) card, a transceiver, a coupler, an LNA (Low Noise Amplifier), a duplexer, etc. In addition, the RF circuit 910 can also communicate with the network and other devices through wireless communication. Wireless communication can use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), email, SMS (Short Messaging Service), etc.

[0156] The memory 920 can be used to store software programs and modules. The processor 980 executes various functional applications and data processing by running the software programs and modules stored in the memory 920. The memory 920 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the device 900 (such as audio data, a phone book, etc.), etc. In addition, the memory 920 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 920 may also include a memory controller to provide the processor 980 and the input unit 930 with access to the memory 920. Although Fig.10 The RF circuit 910 is shown, but it is understandable that it is not an essential component of the device 900 and can be omitted as required without changing the essence of the invention.

[0157] The input unit 930 can be used to receive input digital or character information, and generate keyboard, mouse, joystick, optical or trackball signal input related to user settings and function control. Specifically, the input unit 930 may include a touch-sensitive surface 932 and other input devices 931. The touch-sensitive surface 932, also known as a touch display screen or a touch pad, can collect user touch operations on or near it (such as operations performed by users using fingers, styluses, or any other suitable objects or accessories on or near the touch-sensitive surface 932), and drive corresponding connection devices according to a pre-set program. Optionally, the touch-sensitive surface 932 may include a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into touch point coordinates, and then sends it to the processor 980, and can receive and execute commands sent by the processor 980. In addition, the touch-sensitive surface 932 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves. In addition to the touch-sensitive surface 932, the input unit 930 may further include other input devices 931. Specifically, the other input devices 931 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like.

[0158] The display unit 940 can be used to display information input by the user or information provided to the user and various graphical user interfaces of the control 900, which can be composed of graphics, text, icons, videos and any combination thereof. The display unit 940 may include a display panel 941. Optionally, the display panel 941 may be configured in the form of LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode), etc. Further, the touch-sensitive surface 932 may be covered on the display panel 941. When the touch-sensitive surface 932 detects a touch operation on or near it, it is transmitted to the processor 980 to determine the type of touch event. Subsequently, the processor 980 provides a corresponding visual output on the display panel 941 according to the type of touch event. Although in Fig.10 In the embodiment, the touch-sensitive surface 932 and the display panel 941 are implemented as two independent components to implement input and output functions, but in some embodiments, the touch-sensitive surface 932 and the display panel 941 can be integrated to implement input and output functions.

[0159] The computer device 900 may also include at least one sensor 950, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 941 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 941 and / or the backlight when the device 900 is moved to the ear. As a type of motion sensor, the gravity acceleration sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, which can be used for applications that identify the posture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc. that can also be configured in the device 900, they will not be repeated here.

[0160] The audio circuit 960, the speaker 961, and the microphone 962 can provide an audio interface between the user and the device 900. The audio circuit 960 can transmit the electrical signal converted from the received audio data to the speaker 961, which is converted into a sound signal for output; on the other hand, the microphone 962 converts the collected sound signal into an electrical signal, which is received by the audio circuit 960 and converted into audio data, and then the audio data is processed by the output processor 980 and sent to another control device through the RF circuit 910, or the audio data is output to the memory 920 for further processing. The audio circuit 960 may also include an earplug jack to provide communication between an external headset and the device 900.

[0161] The device 900 can transmit information with the wireless transmission module set on the fighting device through the WiFi module 970.

[0162] The processor 980 is the control center of the device 900. It uses various interfaces and lines to connect various parts of the entire control device. It executes various functions of the device 900 and processes data by running or executing software programs and / or modules stored in the memory 920, and calling data stored in the memory 920, so as to monitor the control device as a whole. Optionally, the processor 980 may include one or more processing cores; optionally, the processor 980 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 950.

[0163] The device 900 also includes a power supply 990 (such as a battery) for supplying power to each component. Preferably, the power supply can be logically connected to the processor 980 through a power management system, so that the power management system can manage charging, discharging, and power consumption management. The power supply 990 can also include any components such as one or more DC or AC power supplies, recharging systems, power failure detection circuits, power converters or inverters, and power status indicators.

[0164] Although not shown, the device 900 may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0165] An embodiment of the present application further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes the method described in the above embodiments.

[0166] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein, for example. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0167] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0168] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0169] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0170] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0171] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program codes.

[0172] The step numbers in the above method embodiment are only provided for the convenience of explanation and description, and no limitation is imposed on the order of the steps. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0173] The above is a specific description of the preferred implementation of the present application, but the present application is not limited to the described embodiments. Technical personnel familiar with the field may make various equivalent modifications or substitutions without violating the spirit of the present application. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present application.

Claims

1. A security authentication method for the Internet of Things, characterized in that: For the gateway, the security authentication method includes: Receive external network access requests from terminals; Obtaining a local whitelist, performing a first whitelist check on the external network access request according to the local whitelist, and obtaining a first whitelist check result, wherein the local whitelist is used to record securely authenticated terminals connected to the gateway end; If the first whitelist verification result is that the whitelist verification fails, a preset authentication jump link is returned to the terminal, so that the terminal performs device authentication with the authentication server according to the authentication jump link, and the terminal obtains the first verification information returned by the authentication server, and the first verification information is used to record the binding mapping relationship between the address information of the terminal and the authentication token; receiving a directed service request including the first verification information sent by the terminal, and generating an information verification request according to the directed service request; Periodically sending the information verification request to the authentication server according to a preset interval time, and obtaining an information verification result returned by the authentication server, wherein the information verification result is used to indicate whether the first verification information of the terminal is valid; Return a network interface corresponding to the information verification result to the terminal.

2. The security authentication method according to claim 1, characterized in that: The security authentication method further comprises: Constructing a gateway registration request according to the gateway device information of the gateway end, and sending the gateway registration request to the authentication service end, so that the authentication service end generates a gateway unique identifier according to the gateway registration request; Receive the gateway unique identifier returned by the authentication server; A whitelist acquisition request is constructed according to the gateway unique identifier, and the whitelist acquisition request is sent to the authentication server to obtain a first whitelist list returned by the authentication server.

3. The security authentication method according to claim 1, characterized in that: The security authentication method further comprises: receiving a gateway connection request from the terminal, and performing a second whitelist check on the terminal according to the local whitelist to obtain a second whitelist check result; If the second whitelist verification result is that the whitelist verification fails, the terminal information in the gateway connection request is sent to the authentication server, so that the authentication server updates the first whitelist in the authentication server according to the terminal information, and obtains the second whitelist returned by the authentication server; According to the second whitelist, a third whitelist check is performed on the terminal to obtain a third whitelist check result; If the third whitelist verification result is that the whitelist verification is passed, a network connection between the terminal and the gateway is established according to the gateway connection request.

4. The security authentication method according to claim 1, characterized in that: The security authentication method further includes: Obtain a preset heartbeat cycle, and send a heartbeat initiation signal to the authentication server according to the heartbeat cycle, so that the authentication server generates a corresponding heartbeat response signal according to the heartbeat initiation signal, and the heartbeat response signal includes a third whitelist list corresponding to the current heartbeat initiation signal; Receive a heartbeat response signal returned by the authentication server, and perform a fourth whitelist check on the third whitelist according to the local whitelist to obtain a fourth whitelist check result, wherein the fourth whitelist check result is used to indicate whether there is an authenticated terminal that has illegally invaded the authentication server; The fourth whitelist verification result is sent to the authentication server, so that the authentication server updates the third whitelist according to the fourth whitelist verification result.

5. A security authentication method for the Internet of Things, characterized in that: For a terminal, the terminal is used for communication connection with the gateway terminal according to any one of claims 1 to 4, and the security authentication method includes: Sending an external network access request to a gateway end so that the gateway end obtains a local whitelist, performing a first whitelist check on the external network access request according to the local whitelist to obtain a first whitelist check result, wherein the local whitelist is used to record securely authenticated terminals connected to the gateway end; when the first whitelist check result is that the whitelist check fails, the gateway end returns a preset authentication jump link to the terminal; Performing device authentication with the authentication server according to the authentication jump link to obtain first verification information returned by the authentication server, wherein the first verification information is used to record a binding mapping relationship between the address information of the terminal and the authentication token; Sending a directed service request including the first verification information to the gateway end, so that the gateway end generates an information verification request according to the directed service request, and then periodically sends the information verification request to the authentication service end according to a preset interval time, and the gateway end obtains an information verification result returned by the authentication service end, and the information verification result is used to indicate whether the first verification information of the terminal is valid; Receive the network interface corresponding to the information verification result returned by the gateway.

6. The security authentication method according to claim 5, characterized in that: The performing device authentication with the authentication server according to the authentication jump link to obtain first verification information returned by the authentication server includes: According to the authentication jump link, a terminal authentication request is sent to the authentication server, and authentication page data is returned by the authentication server; Generate a first verification code acquisition request according to the authentication page data, wherein the first verification code acquisition request records a first user device that receives a verification code; Sending the first verification code acquisition request to the authentication server, so that the authentication server generates a first verification code according to the first verification code acquisition request, and sends the first verification code to the first user device; Receive a first verification code from the first user device, and send a first verification code verification request containing the first verification code to the authentication server, so that the authentication server verifies the first verification code verification request according to the generated first verification code, and obtains first verification information returned by the authentication server.

7. The security authentication method according to claim 5, characterized in that: The security authentication method further includes: Obtaining a network service identifier of the second user equipment, and sending the network service identifier to the authentication server through the gateway, so that the authentication server updates the fourth white list according to the network service identifier, and the authentication server obtains a fifth white list; Sending a device configuration request corresponding to the second user equipment to the authentication server, so that the authentication server generates a configuration page for the fifth whitelist according to the device configuration request, and obtains configuration page data returned by the authentication server; Generate a second verification code acquisition request according to the configuration page data, and send the second verification code acquisition request to the authentication server, so that the authentication server generates a second verification code according to the second verification code acquisition request, and sends the second verification code to the first user device; Receive a second verification code from the first user device, and send a second verification code verification request containing the second verification code to the authentication server, so that the authentication server verifies the second verification code verification request according to the generated second verification code, and obtains second verification information corresponding to the second user device returned by the authentication server.

8. A security authentication method for the Internet of Things, characterized in that: Used for an authentication server, the authentication server is used to communicate with the gateway according to any one of claims 1 to 4, and the security authentication method further includes: Receiving an information verification request sent from the gateway according to a preset interval time period; According to the information verification request, returning the information verification result corresponding to the information verification request to the gateway end, so that the gateway end returns a network interface corresponding to the information verification result; the information verification result is used to indicate whether the first verification information of the terminal is valid; The information verification request is obtained through the following steps: The gateway receives an external network access request from the terminal; The gateway end obtains a local whitelist, performs a first whitelist check on the external network access request according to the local whitelist, and obtains a first whitelist check result, wherein the local whitelist is used to record securely authenticated terminals connected to the gateway end; When the first whitelist check result is that the whitelist check fails, the gateway returns a preset authentication jump link to the terminal, so that the terminal performs device authentication with the authentication server according to the authentication jump link, and the terminal obtains the first verification information returned by the authentication server, and the first verification information is used to record the binding mapping relationship between the address information of the terminal and the authentication token; Receive a directional service request including the first verification information sent by the terminal, and generate an information verification request according to the directional service request.

9. A security authentication system for the Internet of Things, characterized in that: For the gateway end, the security authentication system includes: A first processing unit, configured to receive an external network access request from a terminal; A second processing unit is used to obtain a local whitelist, perform a first whitelist check on the external network access request according to the local whitelist, and obtain a first whitelist check result, wherein the local whitelist is used to record the securely authenticated terminals connected to the gateway end; a third processing unit, configured to return a preset authentication jump link to the terminal if the first whitelist verification result is that the whitelist verification fails, so that the terminal performs device authentication with the authentication server according to the authentication jump link, and the terminal obtains first verification information returned by the authentication server, where the first verification information is used to record a binding mapping relationship between the address information of the terminal and the authentication token; a fourth processing unit, configured to receive a directional service request including the first verification information sent by the terminal, and generate an information verification request according to the directional service request; a fifth processing unit, configured to periodically send the information verification request to the authentication server according to a preset interval time, and obtain an information verification result returned by the authentication server, wherein the information verification result is used to indicate whether the first verification information of the terminal is valid; The sixth processing unit is used to return a network interface corresponding to the information verification result to the terminal.

10. The security authentication system according to claim 9, characterized in that: The security authentication system also includes: a seventh processing unit, configured to obtain a preset heartbeat cycle, and send a heartbeat initiation signal to the authentication server according to the heartbeat cycle, so that the authentication server generates a corresponding heartbeat response signal according to the heartbeat initiation signal, wherein the heartbeat response signal includes a third whitelist list corresponding to the current heartbeat initiation signal; an eighth processing unit, configured to receive a heartbeat response signal returned by the authentication server, and perform a fourth whitelist check on the third whitelist according to the local whitelist to obtain a fourth whitelist check result, wherein the fourth whitelist check result is used to indicate whether there is an authenticated terminal that has illegally invaded the authentication server; The ninth processing unit is used to send the fourth whitelist verification result to the authentication server, so that the authentication server updates the third whitelist according to the fourth whitelist verification result.

Images