A security authentication method and system for the Internet of Things

Abstract

This application discloses a security authentication method and system for the Internet of Things (IoT). The method involves: receiving an external network access request from a terminal; performing a whitelist verification on the external network access request based on a local whitelist to obtain a whitelist verification result; if the whitelist verification result fails, returning an authentication redirect link to the terminal so that the terminal can perform device authentication with an authentication server via the authentication redirect link, and the terminal receiving verification information returned by the authentication server; receiving a targeted service request containing verification information sent by the terminal, and generating an information verification request based on the targeted service request; periodically sending information verification requests to the authentication server at regular intervals to obtain the information verification result returned by the authentication server; and returning the network interface corresponding to the information verification result to the terminal. This method can improve the security and traceability of network services and enhance the quality of network services. This application relates to the field of IoT technology.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) technology, and in particular to a security authentication method and system for IoT. Background Technology

[0002] MIFI (Mobile WiFi) is a portable broadband wireless device that integrates the functions of a modem, router, and access point. This MIFI wireless device connects to the Internet of Things (IoT) via an internal IoT card, enabling it to provide IoT services to third-party devices.

[0003] Currently, traditional IoT device security authentication methods often involve authenticating MiFi wireless devices. This method allows third-party devices to connect to the internet simply by entering their account and password, resulting in poor traceability of network services. Furthermore, this method often fails to promptly and effectively limit or disconnect unauthorized third-party devices, which can negatively impact network service quality and compromise network security.

[0004] Therefore, the problems existing in the current technology still need to be solved and optimized. Summary of the Invention

[0005] To address at least one of the aforementioned technical problems, this application provides a security authentication method and system for the Internet of Things (IoT), wherein the security authentication method can improve the security and traceability of network services and enhance the quality of network services.

[0006] According to a first aspect of this application, a security authentication method for an Internet of Things (IoT) is provided for a gateway, the security authentication method comprising:

[0007] Receive external network access requests from terminals;

[0008] Obtain a local whitelist, perform a first whitelist verification on the external network access request based on the local whitelist, and obtain the first whitelist verification result. The local whitelist is used to record the securely authenticated terminals connected to the gateway.

[0009] If the first whitelist verification result is that the whitelist verification fails, the preset authentication redirection link is returned to the terminal so that the terminal can perform device authentication with the authentication server according to the authentication redirection link. The terminal obtains the first verification information returned by the authentication server. The first verification information is used to record the binding mapping relationship between the terminal's address information and the authentication token.

[0010] Receive a targeted service request containing the first verification information sent by the terminal, and generate an information verification request based on the targeted service request;

[0011] The terminal periodically sends the information verification request to the authentication server at preset intervals and obtains the information verification result returned by the authentication server. The information verification result is used to indicate whether the terminal's first verification information is valid.

[0012] Return the network interface corresponding to the information verification result to the terminal.

[0013] According to a second aspect of this application, a security authentication method for an Internet of Things (IoT) is provided for a terminal, the terminal being used for communicative connection with the aforementioned gateway, the security authentication method comprising:

[0014] An external network access request is sent to the gateway so that the gateway can obtain a local whitelist. The gateway performs a first whitelist verification on the external network access request based on the local whitelist to obtain a first whitelist verification result. The local whitelist is used to record the securely authenticated terminals connected to the gateway. When the first whitelist verification result is that the whitelist verification fails, the gateway returns a preset authentication redirection link to the terminal.

[0015] Device authentication is performed with the authentication server based on the authentication redirection link, and the first verification information returned by the authentication server is obtained. The first verification information is used to record the binding mapping relationship between the terminal's address information and the authentication token.

[0016] A directed service request containing the first verification information is sent to the gateway, so that the gateway generates an information verification request based on the directed service request, and then periodically sends the information verification request to the authentication server at a preset interval. The gateway obtains the information verification result returned by the authentication server, and the information verification result is used to indicate whether the first verification information of the terminal is valid.

[0017] Receive the network interface returned by the gateway that corresponds to the information verification result.

[0018] According to a third aspect of this application, a security authentication method for the Internet of Things is provided, used for an authentication server, the authentication server being configured to communicate with the aforementioned gateway, the security authentication method further comprising:

[0019] Receive information verification requests sent from the gateway according to a preset time interval;

[0020] Based on the information verification request, the information verification result corresponding to the information verification request is returned to the gateway, so that the gateway returns a network interface corresponding to the information verification result; the information verification result is used to indicate whether the first verification information of the terminal is valid.

[0021] The information verification request is obtained through the following steps:

[0022] The gateway receives external network access requests from the terminal.

[0023] The gateway obtains a local whitelist, performs a first whitelist verification on the external network access request based on the local whitelist, and obtains a first whitelist verification result. The local whitelist is used to record securely authenticated terminals connected to the gateway.

[0024] When the gateway fails the first whitelist verification, it returns a preset authentication redirection link to the terminal, so that the terminal can perform device authentication with the authentication server according to the authentication redirection link. The terminal receives the first verification information returned by the authentication server. The first verification information is used to record the binding mapping relationship between the terminal's address information and the authentication token.

[0025] The system receives a targeted service request containing the first verification information sent by the terminal, and generates an information verification request based on the targeted service request.

[0026] According to a third aspect of this application, a security authentication system for the Internet of Things (IoT) is provided for a gateway, the security authentication system comprising:

[0027] The first processing unit is used to receive external network access requests from the terminal;

[0028] The second processing unit is used to obtain a local whitelist, perform a first whitelist verification on the external network access request based on the local whitelist, and obtain a first whitelist verification result. The local whitelist is used to record the securely authenticated terminals connected to the gateway.

[0029] The third processing unit is configured to return a preset authentication redirection link to the terminal if the first whitelist verification result is that the whitelist verification fails, so that the terminal can perform device authentication with the authentication server according to the authentication redirection link. The terminal obtains the first verification information returned by the authentication server. The first verification information is used to record the binding mapping relationship between the terminal's address information and the authentication token.

[0030] The fourth processing unit is configured to receive a targeted service request containing the first verification information sent by the terminal, and generate an information verification request based on the targeted service request.

[0031] The fifth processing unit is used to periodically send the information verification request to the authentication server according to a preset interval time, and obtain the information verification result returned by the authentication server. The information verification result is used to indicate whether the first verification information of the terminal is valid.

[0032] The sixth processing unit is used to return the network interface corresponding to the information verification result to the terminal.

[0033] According to a fifth aspect of this application, a computer device is provided, comprising:

[0034] At least one processor;

[0035] At least one memory for storing at least one program;

[0036] When the at least one program is executed by the at least one processor, the at least one processor performs the method as described in any of the above aspects.

[0037] According to a sixth aspect of this application, a computer-readable storage medium is provided, wherein a processor-executable program is stored, which, when executed by the processor, is used to implement the method as described in any of the preceding aspects.

[0038] The beneficial effects of the technical solutions provided in this application are:

[0039] This application provides a security authentication method and system for the Internet of Things (IoT). The security authentication method for a gateway receives an external network access request from a terminal; obtains a local whitelist; performs a first whitelist verification on the external network access request based on the local whitelist to obtain a first whitelist verification result; the local whitelist records securely authenticated terminals connected to the gateway; if the first whitelist verification result indicates a whitelist verification failure, a preset authentication redirection link is returned to the terminal, enabling the terminal to perform device authentication with an authentication server based on the authentication redirection link; the terminal receives first verification information returned by the authentication server, the first verification information recording the binding mapping relationship between the terminal's address information and the authentication token; receives a directed service request containing the first verification information sent by the terminal, and generates an information verification request based on the directed service request; periodically sends the information verification request to the authentication server at preset intervals, obtaining an information verification result returned by the authentication server, the information verification result indicating whether the terminal's first verification information is valid; and returns a network interface corresponding to the information verification result to the terminal. This security authentication method returns an authentication redirect link to the terminal for device authentication when the verification results of the first whitelist are different. This allows each terminal connected to the gateway (such as a MIFI wireless device) to authenticate with the authentication server, improving the traceability of network services. In addition, this security authentication method obtains information verification results periodically based on time intervals, which can promptly and effectively detect third-party devices with expired authentication or illegal intrusion, thereby mitigating the impact on network services and improving the quality and security of network services. Attached Figure Description

[0040] Figure 1 A flowchart of an IoT security authentication method is provided in this application embodiment;

[0041] Figure 2 The embodiments provided in this application are related to Figure 1 The corresponding timing flowchart;

[0042] Figure 3 This is a schematic diagram of a first optional process for a security authentication method for the Internet of Things provided in an embodiment of this application;

[0043] Figure 4 A schematic diagram of a second optional process for a security authentication method for the Internet of Things provided in this application embodiment;

[0044] Figure 5 A schematic diagram of a third optional process for a security authentication method for the Internet of Things provided in this application embodiment;

[0045] Figure 6The embodiments provided in this application are related to Figure 5 The corresponding timing flowchart;

[0046] Figure 7 A detailed flowchart of step S220 provided for an embodiment of this application;

[0047] Figure 8 A schematic diagram of a fourth optional process for a security authentication method for the Internet of Things provided in this application embodiment;

[0048] Figure 9 A schematic diagram of the framework of an Internet of Things (IoT) security authentication system provided in this application embodiment;

[0049] Figure 10 This is a structural block diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0050] The present application will be further described below with reference to the accompanying drawings and specific embodiments. The described embodiments should not be considered as limitations on the present application, and all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of the present application.

[0051] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0052] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0053] Currently, traditional IoT device security authentication methods often involve authenticating MiFi wireless devices. This method allows third-party devices to easily connect and access the internet simply by entering a username and password, making it difficult to trace the actual user's access history and resulting in poor traceability of network services. Furthermore, this method often fails to effectively limit or disconnect unauthorized third-party devices in a timely manner. If such devices generate significant data traffic or access illegal websites, network service quality can be negatively impacted, leading to low network security. Additionally, most MiFi devices on the market do not support authentication connections for screenless devices (such as dumb terminals), limiting their applicability.

[0054] In view of this, this application provides a security authentication method for the Internet of Things (IoT). When the verification results of the first whitelist differ, this method returns an authentication redirection link to the terminal for device authentication. This allows each terminal connected to the gateway (such as a MiFi wireless device) to authenticate with the authentication server, improving the traceability of network services. Furthermore, this security authentication method periodically acquires information verification results based on time intervals, enabling timely and effective detection of third-party devices with expired authentication or illegal intrusion. Specifically, it can detect third-party devices with expired authentication or illegal intrusion into the gateway (such as a MiFi device) and perform rate limiting or offline operations on these devices, mitigating the impact on network services and improving the quality and security of network services.

[0055] It's worth noting that this security authentication method also relies on obtaining a heartbeat response signal containing a third whitelist returned by the authentication server. By updating the third whitelist in the authentication server using the fourth whitelist verification result, it can effectively and promptly detect third-party devices illegally intruding into the authentication server and take those devices offline, mitigating the impact on network services and improving network service quality and security. Furthermore, this security authentication method, based on the terminal and the first user device, uses a second verification code request to authenticate the second user device (such as a screenless device). This enables authentication connections between MiFi devices and the second user device, effectively expanding the applicability of MiFi devices.

[0056] This application provides a security authentication method and system for the Internet of Things (IoT), which can be specifically described through the following embodiments. First, a security authentication method for the Internet of Things (IoT) in this application is described.

[0057] The IoT security authentication method provided in this application can be applied to IoT application scenarios. In IoT application scenarios, IoT service providers can use the security authentication method provided in this application to perform security authentication on IoT devices, which can improve the security and traceability of network services and improve the quality of network services.

[0058] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0059] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments acquired.

[0060] Reference Figure 1 and Figure 2 , Figure 1 This is an optional flowchart of the first IoT security authentication method provided in the embodiments of this application. Figure 1 The method described herein is used on the gateway side and may include, but is not limited to, steps S110 to S160.

[0061] Step S110: Receive an external network access request from the terminal;

[0062] In this embodiment, the gateway can be a MIFI device loaded with an SDK plugin (such as miot-plugin-sdk), which enables the gateway to perform intelligent functions such as device connection, data communication, and remote control. The terminal can be an IoT device connected to the gateway; various types of IoT devices exist, and will not be elaborated upon here. It is understood that step S110 can involve generating an external network access request when the terminal needs to access the network and sending the request to the gateway. This external network access request specifically includes the terminal's MAC address, the target access address, etc. The example in this application is for illustrative purposes only.

[0063] Step S120: Obtain the local whitelist, perform a first whitelist verification on the external network access request based on the local whitelist, and obtain the first whitelist verification result. The local whitelist is used to record the securely authenticated terminals connected to the gateway.

[0064] In this embodiment of the application, when the gateway receives an external network access request, it can obtain a local whitelist stored inside the gateway. The first whitelist verification can be to compare whether the terminal MAC address in the external network access request is recorded in the local whitelist. Specifically, if the terminal's MAC address is not recorded in the local whitelist, a first whitelist verification result indicating that the whitelist verification failed is obtained; or, if the terminal's MAC address is recorded in the local whitelist, a first whitelist verification result indicating that the whitelist verification passed is obtained.

[0065] Step S130: If the first whitelist verification result is that the whitelist verification fails, the preset authentication redirection link is returned to the terminal so that the terminal performs device authentication with the authentication server according to the authentication redirection link. The terminal obtains the first verification information returned by the authentication server. The first verification information is used to record the binding mapping relationship between the terminal's address information and the authentication token.

[0066] In this embodiment of the application, if the first whitelist verification result is that the whitelist verification is successful, the target access address in the external network access request can be accessed and the network interface can be returned to the terminal; if the first whitelist verification result is that the whitelist verification is unsuccessful, the preset authentication redirection link can be returned to the terminal so that the terminal can perform device authentication with the authentication server according to the authentication redirection link, thereby obtaining the first verification information. The first verification information records the terminal's address information (such as MAC address) and the corresponding authentication token (such as the token issued by the authentication server).

[0067] Step S140: Receive a targeted service request containing the first verification information sent by the terminal, and generate an information verification request based on the targeted service request;

[0068] In this embodiment of the application, after receiving the first verification information returned by the authentication server, the terminal can send a targeted service request containing the first verification information to the gateway, so that the gateway can construct an information verification request based on the authentication token and terminal address information in the targeted service request. The information verification request is used to request the authentication server to verify whether the authentication token is valid and whether the terminal address information has a binding mapping relationship with the valid authentication token.

[0069] Step S150: Periodically send the information verification request to the authentication server according to a preset interval time, and obtain the information verification result returned by the authentication server. The information verification result is used to indicate whether the first verification information of the terminal is valid.

[0070] In this embodiment, the preset interval time can be set according to the actual situation, such as any one of 3 seconds, 5 seconds, 10 seconds, etc. In this embodiment, the interval time is 5 seconds as an example. In addition, after generating the information verification request, the gateway in this embodiment can periodically send the information verification request to the authentication server according to the interval time. Specifically, the gateway can send the information verification request to the authentication server once every 5 seconds.

[0071] Understandably, for a single information verification request sent by the gateway, the authentication server parses and verifies the authentication token in the information verification request based on the whitelist list built or updated when generating the first verification information. Specifically, it may obtain information such as MIFI device information, terminal device information, and authentication time from the authentication token. Then, based on the whitelist list, it compares the obtained information to obtain the information verification result.

[0072] It should be noted that the whitelist on the authentication server records the terminals registered on the authentication device and the authentication token corresponding to each terminal. For example, the authentication token can be a blank token or a non-blank token. When the authentication token in the whitelist is blank, it indicates that the corresponding terminal has been registered but not authenticated; or, when the authentication token in the whitelist is non-blank, it indicates that the corresponding terminal has been both registered and authenticated. Furthermore, the example of the authentication token in this application is for illustrative purposes only and does not constitute a limitation on this application. In other feasible methods, the authentication token's blankness or the presence of special characters can also be used to determine whether a terminal is authenticated.

[0073] It is worth mentioning that, based on the gateway periodically sending information verification requests to the authentication server and obtaining the returned information verification results, this embodiment can promptly and effectively capture certain terminals when their authentication expires or when terminals illegally intrude into the gateway, so as to facilitate subsequent rate limiting or lower limit operations, thereby reducing the impact on network services and improving the quality and security of network services.

[0074] Step S160: Return the network interface corresponding to the information verification result to the terminal.

[0075] In this embodiment, if the verification result of a certain information verification request is that the terminal's first verification information is valid, the gateway can update its local whitelist based on the verification result, then call the gateway's online record interface to add an online record and push a redirected authentication success page to the terminal; at the same time, the gateway can also allow the external network access request so that the gateway can return the network interface corresponding to the external network access request to the terminal.

[0076] It is understandable that after the gateway pushes the successful authentication page for the first time, the gateway can also send the information verification request for the next cycle to the authentication server based on the second interval. This second interval can be the aforementioned interval or an interval set by another party. If the information verification result remains unchanged, the gateway can simply perform the operation of updating the local whitelist based on the information verification result corresponding to each cycle.

[0077] It should be noted that if the information verification result is that the terminal's first verification information is invalid, it means that the terminal sending the external network access request has expired its authentication or that the terminal sending the external network access request is an unauthorized intrusion terminal. In this case, an authentication failure page can be pushed to the terminal, and an information verification request can be sent every 5 seconds. If the authentication token (such as a token) expires during this period, the gateway will remove the terminal MAC address corresponding to the authentication token from the local whitelist and kick the current terminal device offline.

[0078] Reference Figure 3 In some embodiments, the security authentication method further includes:

[0079] A1. Construct a gateway registration request based on the gateway device information at the gateway end, and send the gateway registration request to the authentication server so that the authentication server generates a unique gateway identifier based on the gateway registration request;

[0080] A2. Receive the gateway unique identifier returned by the authentication server;

[0081] A3. Construct a whitelist retrieval request based on the gateway's unique identifier, and send the whitelist retrieval request to the authentication server to obtain the first whitelist returned by the authentication server.

[0082] In this embodiment, the gateway device information can be the device information of a MIFI device, which specifically may include the MAC address, device model, internal management address, IMEI, and ICCID bound to the MIFI device. Step A1 may involve the gateway constructing a corresponding gateway registration request based on the gateway device information and sending the gateway registration request to the authentication server.

[0083] Understandably, after receiving a gateway registration request, the authentication server can generate a unique device ID (i.e., a unique gateway identifier) ​​corresponding to the gateway registration request based on the device model in the request, and then return this unique device ID to the MIFI device with the SDK plugin loaded. Step A2 could involve the gateway storing the returned unique device ID in its memory.

[0084] It should be noted that step A3 can be that the gateway constructs a whitelist retrieval request based on the unique device ID in memory. This whitelist retrieval request is used to obtain the MAC address list of the whitelisted devices currently held by the authentication server. Specifically, after the authentication server receives the whitelist retrieval request, it can return a first whitelist list corresponding to the whitelist retrieval request, so that the gateway can update the local whitelist in the gateway's network firewall based on the received first whitelist list.

[0085] Reference Figure 4 In some embodiments, the security authentication method further includes:

[0086] B1. Receive a gateway connection request from the terminal, and perform a second whitelist verification on the terminal according to the local whitelist to obtain the second whitelist verification result;

[0087] B2. If the second whitelist verification result is that the whitelist verification fails, the terminal information in the gateway connection request is sent to the authentication server so that the authentication server updates the first whitelist in the authentication server according to the terminal information and obtains the second whitelist returned by the authentication server.

[0088] B3. Based on the second whitelist, perform a third whitelist verification on the terminal to obtain the third whitelist verification result;

[0089] B4. If the third whitelist verification result is that the whitelist verification is successful, then a network connection between the terminal and the gateway is established according to the gateway connection request.

[0090] In this embodiment, after the user configures the SSID of the terminal to connect to the MIFI device, the gateway receives a gateway connection request from the terminal. At this time, the gateway can obtain a local whitelist from the network firewall and verify the MAC address of the terminal based on the local whitelist. If the current terminal MAC address is recorded in the local whitelist, a second whitelist verification result indicating that the whitelist verification has passed is returned, and the current terminal connects successfully with the gateway. Alternatively, if the current terminal MAC address is not recorded in the local whitelist, a second whitelist verification result indicating that the whitelist verification has failed is returned. At this time, the gateway can report the terminal information (such as the current terminal MAC address) in the gateway connection request to the authentication server, so that the authentication server can update the first whitelist corresponding to the gateway based on the terminal information and finally obtain the second whitelist returned by the authentication server.

[0091] Understandably, after receiving the second whitelist, the gateway can update its local whitelist based on the second whitelist and also perform a third whitelist check on the current terminal's MAC address based on the second whitelist. If the current terminal's MAC address is recorded in the second whitelist, it returns a second whitelist check result indicating that the whitelist check has passed, and establishes a network connection between the terminal and the gateway based on the gateway connection request, so that the current terminal can successfully connect to the gateway.

[0092] It should be noted that the second whitelist returned by the authentication server in step B2 can be either the authentication server updating the first whitelist based on the terminal information and then directly sending the updated second whitelist to the gateway; or, the authentication server updating the first whitelist based on the terminal information and obtaining the second whitelist, then returning an update response signal to the gateway, which then retrieves the second whitelist stored in the authentication server based on the update response signal.

[0093] Reference Figure 5 and Figure 6 In some embodiments, the security authentication method further includes:

[0094] C1. Obtain a preset heartbeat cycle and send a heartbeat initiation signal to the authentication server according to the heartbeat cycle, so that the authentication server generates a corresponding heartbeat response signal according to the heartbeat initiation signal, wherein the heartbeat response signal includes a third whitelist list corresponding to the current heartbeat initiation signal.

[0095] C2. Receive the heartbeat response signal returned by the authentication server, and perform a fourth whitelist verification on the third whitelist list according to the local whitelist to obtain the fourth whitelist verification result. The fourth whitelist verification result is used to indicate whether there is an unauthorized intrusion of the authenticated terminal in the authentication server.

[0096] C3. Send the fourth whitelist verification result to the authentication server so that the authentication server updates the third whitelist based on the fourth whitelist verification result.

[0097] In this embodiment, a MIFI device with an SDK plugin can periodically send a heartbeat initiation signal to the heartbeat detection interface of the authentication server based on a heartbeat cycle. The heartbeat initiation signal may specifically include the device information of the MIFI device. After receiving the heartbeat initiation signal, the authentication server parses the device information in the heartbeat initiation signal. If a specific piece of information (such as a MAC address) does not exist in the device information, the MIFI device and the gateway can jump to steps A1 to A3. Alternatively, if the specific piece of information in the device information exists, the authentication server can construct a heartbeat response signal corresponding to the heartbeat initiation signal from the current third whitelist and return the constructed heartbeat response signal to the gateway.

[0098] Understandably, after receiving the heartbeat response signal at the gateway, the fourth whitelist verification in step C2 can be based on the gateway's local whitelist and compare it with the current whitelist list (i.e., the third whitelist list) of the authentication server. Specifically, it can compare the current terminal address information and corresponding gateway device information in the third whitelist list with the corresponding terminal address information and gateway device information in the local whitelist list. If they match, the fourth whitelist verification result can be obtained, indicating that there are no unauthorized terminals on the authentication server; or, if they do not match, the fourth whitelist verification result can be obtained, indicating that there are unauthorized terminals on the authentication server.

[0099] It should be noted that after receiving the verification result of the fourth whitelist, the authentication server can update the third whitelist by deleting the unauthorized authenticated terminals from the third whitelist based on the verification information in the fourth whitelist verification result, and perform a "kick-down" operation on the unauthorized authenticated terminals.

[0100] It is worth mentioning that the heartbeat response signal in this application embodiment may also include an SDK task. The SDK task can be used to trigger any one of the tasks such as remote download or local upgrade on the gateway. There are many specific implementation methods, which will not be described in detail here.

[0101] It should be added that, in the heartbeat detection process between the gateway and the authentication server in this embodiment, the third whitelist in the authentication server can be updated through the fourth whitelist verification. This can effectively and promptly capture third-party devices that illegally intrude into the authentication server and take them offline, thereby mitigating the impact on network services and improving the quality and security of network services.

[0102] In some embodiments, this application also provides a security authentication method for an Internet of Things (IoT) for a terminal, the terminal being used to communicate with the aforementioned gateway, which may include, but is not limited to, steps S210 to S240.

[0103] Step S210: Send an external network access request to the gateway so that the gateway can obtain a local whitelist, perform a first whitelist verification on the external network access request based on the local whitelist, and obtain a first whitelist verification result. The local whitelist is used to record the securely authenticated terminals connected to the gateway. When the first whitelist verification result is that the whitelist verification fails, the gateway returns a preset authentication redirection link to the terminal.

[0104] Step S220: Perform device authentication with the authentication server according to the authentication redirection link, and obtain the first verification information returned by the authentication server. The first verification information is used to record the binding mapping relationship between the terminal's address information and the authentication token.

[0105] Step S230: Send a directed service request containing the first verification information to the gateway, so that the gateway generates an information verification request according to the directed service request, and then periodically sends the information verification request to the authentication server according to a preset interval. The gateway obtains the information verification result returned by the authentication server. The information verification result is used to indicate whether the first verification information of the terminal is valid.

[0106] Step S240: Receive the network interface returned by the gateway that corresponds to the information verification result.

[0107] In the embodiments of this application, steps S210 to S240 are similar to the aforementioned steps S110 to S160, and can be easily deduced by analogy. This application will not elaborate further here.

[0108] Reference Figure 7 In some embodiments, step S220, performing device authentication with the authentication server based on the authentication redirection link and obtaining the first verification information returned by the authentication server, includes:

[0109] D1. Based on the authentication redirection link, send a terminal authentication request to the authentication server and obtain the authentication page data returned by the authentication server;

[0110] D2. Generate a first verification code acquisition request based on the authentication page data. The first verification code acquisition request records the first user device that receives the verification code.

[0111] D3. Send the first verification code acquisition request to the authentication server, so that the authentication server generates a first verification code according to the first verification code acquisition request and sends the first verification code to the first user device;

[0112] D4. Receive a first verification code from the first user equipment and send a first verification code verification request containing the first verification code to the authentication server, so that the authentication server verifies the first verification code verification request based on the generated first verification code and obtains the first verification information returned by the authentication server.

[0113] In this embodiment of the application, step D1 may be that the terminal constructs a terminal authentication request based on the authentication redirection link and sends the terminal authentication request to the authentication server, so that the authentication server returns the authentication page data corresponding to the terminal authentication request, and the authentication page data may specifically be the portal authentication page.

[0114] It is understandable that step D2 can be a terminal responding to the device data entered by the user in the authentication page data to construct a first verification code acquisition request. The device data entered by the user is used to identify the first user device receiving the verification code, which can be a mobile terminal (such as a mobile phone), a computer device (such as a computer), etc. Step D3 can be the authentication server generating a first verification code (such as an SMS verification code or an image verification code) and sending the generated first verification code to the user's first user device through the authentication server's verification code service call interface.

[0115] It should be noted that step D4 may involve the terminal generating a first verification code verification request containing the first verification code based on the first verification code entered by the user in the authentication page data, and then sending the first verification code verification request to the authentication server. After receiving the first verification code verification request, the authentication server may verify the first verification code. If the verification fails, it may return verification information indicating verification failure to the terminal; or, if the verification succeeds, it may return the first verification information to the terminal.

[0116] Reference Figure 8 In some embodiments, the security authentication method further includes:

[0117] E1. Obtain the network service identifier of the second user device and send the network service identifier to the authentication server through the gateway so that the authentication server updates the fourth whitelist based on the network service identifier and the authentication server obtains the fifth whitelist.

[0118] E2. Send a device configuration request corresponding to the second user device to the authentication server, so that the authentication server generates a configuration page for the fifth whitelist based on the device configuration request, and obtains the configuration page data returned by the authentication server;

[0119] E3. Generate a second verification code acquisition request based on the configuration page data, and send the second verification code acquisition request to the authentication server, so that the authentication server generates a second verification code based on the second verification code acquisition request, and sends the second verification code to the first user device;

[0120] E4. Receive a second verification code from the first user equipment and send a second verification code verification request containing the second verification code to the authentication server, so that the authentication server verifies the second verification code verification request according to the generated second verification code and obtains the second verification information corresponding to the second user equipment returned by the authentication server.

[0121] In this embodiment, the second user equipment can be a screenless device or a dumb terminal. The terminal and the first user equipment in steps E1 to E4 can be the same device or different devices. The terminal and the first user equipment can be any one of mobile terminals, computer devices, etc. Step E1 can first involve the terminal obtaining the network service identifier (such as a service set identifier SSID) that the second user equipment is connected to the gateway, and then synchronously sending the obtained network service identifier to the authentication server, so that the authentication server adds the network service identifier corresponding to the second user equipment to the fourth whitelist, thereby obtaining the fifth whitelist. The authentication token corresponding to the second user equipment in the fifth whitelist is blank, that is, the second user equipment has been registered but not authenticated.

[0122] It is understandable that step E2 can be as follows: after the second user device is linked to the gateway based on the network service identifier, the terminal sends a device configuration request to the authentication server. This device configuration request is used to obtain the configuration page corresponding to the second user device. Then, after receiving the device configuration request, the authentication server constructs the corresponding device configuration page based on the terminal and authentication token recorded in the fifth whitelist, and identifies this device configuration page as the configuration page data returned by the authentication server.

[0123] In one feasible implementation, if the terminal and the first user equipment are the same device, step E3 may involve the terminal generating a corresponding second verification code acquisition request based on the list of all unauthenticated second user equipments of the current MIFI device in the configuration page data. The list of second user equipments can be obtained directly from the configuration page data or indirectly through a list QR code in the configuration page data. The second verification code acquisition request is used to represent the authentication request of any number of second user equipments. Then, the remaining content of step E3 and the content of step E4 are similar to the aforementioned steps D2 to D4 and can be easily deduced by analogy.

[0124] It should be noted that, in special cases such as when the terminal and the first user device are the same device, and the terminal is an authenticated terminal device, the authentication server, after receiving the second verification code retrieval request sent by the terminal, can return the second verification information for each second user device that made the second verification code retrieval request, based on steps D2 to D4 that the terminal has already executed and are similar to steps E3 and E4. For example, in the special case where the terminal and the first user device are the same device, and the terminal is an authenticated terminal device, the configuration page data received by the terminal may specifically be an authentication success page hyperlink. The terminal can respond to the user's input instructions to construct second verification code retrieval requests for any number of specific second user devices on the authentication success page, so that the authentication server directly returns the corresponding second verification information.

[0125] It should be added that if the terminal and the first user device are different devices, the same principle applies and can be easily deduced from the above. Furthermore, this application embodiment, based on the terminal and the first user device, uses a second verification code verification request to achieve device authentication of the second user device (such as a screenless device), which can realize the authentication connection between the MIFI device and the second user device, effectively improving the applicability of MIFI devices.

[0126] In some embodiments, this application also provides a security authentication method for the Internet of Things, used for an authentication server, which is used to communicate with the aforementioned gateway, and may include, but is not limited to, steps S310 to S320.

[0127] Step S310: Receive an information verification request sent from the gateway according to a preset time interval.

[0128] Step S320: Based on the information verification request, return the information verification result corresponding to the information verification request to the gateway, so that the gateway returns a network interface corresponding to the information verification result; the information verification result is used to indicate whether the first verification information of the terminal is valid;

[0129] The information verification request is obtained through the following steps:

[0130] The gateway receives external network access requests from the terminal.

[0131] The gateway obtains a local whitelist, performs a first whitelist verification on the external network access request based on the local whitelist, and obtains a first whitelist verification result. The local whitelist is used to record securely authenticated terminals connected to the gateway.

[0132] When the gateway fails the first whitelist verification, it returns a preset authentication redirection link to the terminal, so that the terminal can perform device authentication with the authentication server according to the authentication redirection link. The terminal receives the first verification information returned by the authentication server. The first verification information is used to record the binding mapping relationship between the terminal's address information and the authentication token.

[0133] The system receives a targeted service request containing the first verification information sent by the terminal, and generates an information verification request based on the targeted service request.

[0134] In the embodiments of this application, steps S310 to S320 are similar to the aforementioned steps S110 to S160, and can be easily deduced by analogy. This application will not repeat them here.

[0135] Figure 9 This application provides a schematic diagram of the framework of an Internet of Things (IoT) security authentication system for a gateway, the security authentication system comprising:

[0136] The first processing unit 810 is used to receive external network access requests from the terminal;

[0137] The second processing unit 820 is used to obtain a local whitelist, perform a first whitelist verification on the external network access request based on the local whitelist, and obtain a first whitelist verification result. The local whitelist is used to record the securely authenticated terminals connected to the gateway.

[0138] The third processing unit 830 is configured to return a preset authentication redirection link to the terminal if the first whitelist verification result is that the whitelist verification fails, so that the terminal can perform device authentication with the authentication server according to the authentication redirection link, and the terminal obtains the first verification information returned by the authentication server. The first verification information is used to record the binding mapping relationship between the terminal's address information and the authentication token.

[0139] The fourth processing unit 840 is configured to receive a targeted service request containing the first verification information sent by the terminal, and generate an information verification request based on the targeted service request.

[0140] The fifth processing unit 850 is used to periodically send the information verification request to the authentication server according to a preset interval time, and obtain the information verification result returned by the authentication server. The information verification result is used to indicate whether the first verification information of the terminal is valid.

[0141] The sixth processing unit 860 is used to return the network interface corresponding to the information verification result to the terminal.

[0142] In some embodiments, the security authentication system further includes:

[0143] The seventh processing unit 870 is used to obtain a preset heartbeat cycle and send a heartbeat initiation signal to the authentication server according to the heartbeat cycle, so that the authentication server generates a corresponding heartbeat response signal according to the heartbeat initiation signal, and the heartbeat response signal includes a third whitelist list corresponding to the current heartbeat initiation signal.

[0144] The eighth processing unit 880 is used to receive the heartbeat response signal returned by the authentication server, and perform a fourth whitelist verification on the third whitelist according to the local whitelist to obtain a fourth whitelist verification result. The fourth whitelist verification result is used to indicate whether there is an unauthorized intrusion of the authenticated terminal in the authentication server.

[0145] The ninth processing unit 890 is used to send the fourth whitelist verification result to the authentication server so that the authentication server updates the third whitelist based on the fourth whitelist verification result.

[0146] It is understood that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0147] Figure 10 A schematic diagram of the structure of a computer device provided in this application embodiment includes:

[0148] At least one processor 980;

[0149] At least one memory 920 is used to store at least one program;

[0150] When the at least one program is executed by the at least one processor 980, the at least one processor 980 performs the method as described in the foregoing embodiments.

[0151] This application also provides a computer-readable storage medium storing a processor-executable program, which, when executed by the processor 980, is used to implement the methods described in the foregoing embodiments.

[0152] Figure 10 Specifically, computer equipment can be either a user terminal or a server.

[0153] This application uses a computer device as a user terminal as an example, as detailed below:

[0154] like Figure 10 As shown, the computer device 900 may include an RF (Radio Frequency) circuit 910, a memory 920 including one or more computer-readable storage media, an input unit 930, a display unit 940, a sensor 950, an audio circuit 960, a WiFi module 970, a processor 980 including one or more processing cores, and a power supply 990, among other components. Those skilled in the art will understand that... Figure 10 The device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0155] The RF circuit 910 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink information from the base station and hands it over to one or more processors 980 for processing; additionally, it transmits uplink data to the base station. Typically, the RF circuit 910 includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a Subscriber Identity Module (SIM) card, a transceiver, a coupler, an LNA (Low Noise Amplifier), a duplexer, etc. Furthermore, the RF circuit 910 can also communicate wirelessly with networks and other devices. Wireless communication can use any communication standard or protocol, including but not limited to GSM (Global System for Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), email, SMS (Short Messaging Service), etc.

[0156] The memory 920 can be used to store software programs and modules. The processor 980 executes various functional applications and data processing by running the software programs and modules stored in the memory 920. The memory 920 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the device 900 (such as audio data, telephone directory, etc.). In addition, the memory 920 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 920 may also include a memory controller to provide access to the memory 920 for the processor 980 and the input unit 930. Although Figure 10 The RF circuit 910 is shown, but it is understood that it is not a necessary component of the device 900 and can be omitted as needed without changing the nature of the invention.

[0157] The input unit 930 can be used to receive input digital or character information, and to generate keyboard, mouse, joystick, optical, or trackball signal inputs related to user settings and function control. Specifically, the input unit 930 may include a touch-sensitive surface 932 and other input devices 931. The touch-sensitive surface 932, also known as a touch display screen or touchpad, can collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near the touch-sensitive surface 932), and drive the corresponding connection device according to a pre-set program. Optionally, the touch-sensitive surface 932 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, sends it to the processor 980, and can receive and execute commands from the processor 980. In addition, the touch-sensitive surface 932 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch-sensitive surface 932, the input unit 930 may also include other input devices 931. Specifically, other input devices 931 may include, but are not limited to, one or more of the following: physical keyboard, function keys (such as volume control buttons, power buttons, etc.), trackball, mouse, joystick, etc.

[0158] Display unit 940 can be used to display information input by the user or information provided to the user, as well as various graphical user interfaces for controlling 900. These graphical user interfaces can be composed of graphics, text, icons, video, and any combination thereof. Display unit 940 may include display panel 941, optionally configured as LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode), etc. Further, touch-sensitive surface 932 may cover display panel 941. When touch-sensitive surface 932 detects a touch operation on or near it, it transmits the information to processor 980 to determine the type of touch event. Subsequently, processor 980 provides corresponding visual output on display panel 941 according to the type of touch event. Although in Figure 10 In this embodiment, the touch-sensitive surface 932 and the display panel 941 are implemented as two separate components to realize input and output functions. However, in some embodiments, the touch-sensitive surface 932 and the display panel 941 can be integrated to realize input and output functions.

[0159] The computer device 900 may also include at least one sensor 950, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 941 according to the ambient light level, and the proximity sensor can turn off the display panel 941 and / or backlight when the device 900 is moved to the ear. As a type of motion sensor, a gravity acceleration sensor can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity and can be used for applications that recognize the phone's posture (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition-related functions (such as pedometers, taps), etc. Other sensors that the device 900 may be equipped with, such as gyroscopes, barometers, hygrometers, thermometers, and infrared sensors, will not be described in detail here.

[0160] Audio circuitry 960, speaker 961, and microphone 962 provide an audio interface between the user and device 900. Audio circuitry 960 converts received audio data into electrical signals, which are then transmitted to speaker 961, where they are converted into sound signals for output. Conversely, microphone 962 converts collected sound signals into electrical signals, which are received by audio circuitry 960, converted back into audio data, and then processed by processor 980 before being transmitted via RF circuitry 910 to another control device, or output to memory 920 for further processing. Audio circuitry 960 may also include an earphone jack to facilitate communication between peripheral headphones and device 900.

[0161] Device 900 can transmit information with the wireless transmission module set up on the battle equipment via WiFi module 970.

[0162] Processor 980 is the control center of device 900. It connects various parts of the control device via various interfaces and lines. By running or executing software programs and / or modules stored in memory 920, and by calling data stored in memory 920, it performs various functions of device 900 and processes data, thereby providing overall monitoring of the control device. Optionally, processor 980 may include one or more processing cores; optionally, processor 980 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the aforementioned modem processor may not be integrated into processor 950.

[0163] The device 900 also includes a power supply 990 (such as a battery) that supplies power to the various components. Preferably, the power supply can be logically connected to the processor 980 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 990 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0164] Although not shown, device 900 may also include a camera, Bluetooth module, etc., which will not be described in detail here.

[0165] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the methods described in the foregoing embodiments.

[0166] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatuses.

[0167] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0168] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0169] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0170] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0171] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0172] The step numbers in the above method embodiments are set only for ease of explanation and do not limit the order of the steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0173] The above is a detailed description of the preferred embodiments of this application, but this application is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.

Claims

1. A security authentication method for the Internet of Things, characterized in that, For use at the gateway, the security authentication method includes: Receive external network access requests from terminals; Obtain a local whitelist, perform a first whitelist verification on the external network access request based on the local whitelist, and obtain the first whitelist verification result. The local whitelist is used to record the securely authenticated terminals connected to the gateway. If the first whitelist verification result is that the whitelist verification fails, the preset authentication redirection link is returned to the terminal so that the terminal can perform device authentication with the authentication server according to the authentication redirection link. The terminal obtains the first verification information returned by the authentication server. The first verification information is used to record the binding mapping relationship between the terminal's address information and the authentication token. Receive a targeted service request containing the first verification information sent by the terminal, and generate an information verification request based on the targeted service request; The terminal periodically sends the information verification request to the authentication server at preset intervals and obtains the information verification result returned by the authentication server. The information verification result is used to indicate whether the terminal's first verification information is valid. If the information verification result indicates that the terminal's first verification information is valid, then the local whitelist is updated based on the information verification result. Return the network interface corresponding to the information verification result to the terminal.

2. The security authentication method according to claim 1, characterized in that, The security authentication method further includes: A gateway registration request is constructed based on the gateway device information at the gateway end, and the gateway registration request is sent to the authentication server so that the authentication server generates a unique gateway identifier based on the gateway registration request; Receive the gateway's unique identifier returned by the authentication server; A whitelist retrieval request is constructed based on the gateway's unique identifier, and the whitelist retrieval request is sent to the authentication server to obtain the first whitelist returned by the authentication server; The local whitelist is updated based on the first whitelist list.

3. The security authentication method according to claim 1, characterized in that, The security authentication method further includes: Receive a gateway connection request from the terminal, and perform a second whitelist verification on the terminal according to the local whitelist to obtain the second whitelist verification result; If the second whitelist verification result is that the whitelist verification fails, the terminal information in the gateway connection request is sent to the authentication server, so that the authentication server updates the first whitelist in the authentication server according to the terminal information, and obtains the second whitelist returned by the authentication server. Based on the second whitelist, the terminal is subjected to a third whitelist verification to obtain the third whitelist verification result; If the third whitelist verification result is that the whitelist verification is successful, then a network connection between the terminal and the gateway is established according to the gateway connection request.

4. The security authentication method according to claim 1, characterized in that, The security authentication method further includes: A preset heartbeat cycle is obtained, and a heartbeat initiation signal is sent to the authentication server according to the heartbeat cycle, so that the authentication server generates a corresponding heartbeat response signal according to the heartbeat initiation signal. The heartbeat response signal includes a third whitelist list corresponding to the current heartbeat initiation signal. The system receives a heartbeat response signal returned by the authentication server and performs a fourth whitelist verification on the third whitelist based on the local whitelist to obtain a fourth whitelist verification result. The fourth whitelist verification result is used to indicate whether there is an unauthorized intrusion of the authenticated terminal. The fourth whitelist verification result is sent to the authentication server so that the authentication server updates the third whitelist based on the fourth whitelist verification result.

5. A security authentication method for the Internet of Things, characterized in that, For use in a terminal, the terminal being configured to communicate with a gateway as described in any one of claims 1-4, the security authentication method comprising: An external network access request is sent to the gateway so that the gateway can obtain a local whitelist. The gateway performs a first whitelist verification on the external network access request based on the local whitelist to obtain a first whitelist verification result. The local whitelist is used to record the securely authenticated terminals connected to the gateway. When the first whitelist verification result is that the whitelist verification fails, the gateway returns a preset authentication redirection link to the terminal. Device authentication is performed with the authentication server based on the authentication redirection link, and the first verification information returned by the authentication server is obtained. The first verification information is used to record the binding mapping relationship between the terminal's address information and the authentication token. The gateway sends a targeted service request containing the first verification information to the gateway, so that the gateway generates an information verification request based on the targeted service request, and then periodically sends the information verification request to the authentication server at preset intervals. The gateway receives an information verification result returned by the authentication server, and the information verification result is used to indicate whether the first verification information of the terminal is valid. When the information verification result indicates that the first verification information of the terminal is valid, the gateway updates the local whitelist based on the information verification result. Receive the network interface returned by the gateway that corresponds to the information verification result.

6. The security authentication method according to claim 5, characterized in that, The step of authenticating the device with the authentication server via the authentication redirect link and obtaining the first verification information returned by the authentication server includes: Based on the authentication redirection link, a terminal authentication request is sent to the authentication server, and the authentication page data returned by the authentication server is obtained; A first verification code acquisition request is generated based on the authentication page data, and the first verification code acquisition request records the first user device that receives the verification code. The first verification code acquisition request is sent to the authentication server, so that the authentication server generates a first verification code based on the first verification code acquisition request and sends the first verification code to the first user device; The system receives a first verification code from the first user equipment and sends a first verification code verification request containing the first verification code to the authentication server, so that the authentication server verifies the first verification code verification request based on the generated first verification code and obtains the first verification information returned by the authentication server.

7. The security authentication method according to claim 5, characterized in that, The security authentication method further includes: Obtain the network service identifier of the second user device and send the network service identifier to the authentication server through the gateway so that the authentication server updates the fourth whitelist based on the network service identifier and the authentication server obtains the fifth whitelist. Send a device configuration request corresponding to the second user device to the authentication server, so that the authentication server generates a configuration page for the fifth whitelist based on the device configuration request, and obtains the configuration page data returned by the authentication server; A second verification code retrieval request is generated based on the configuration page data, and the second verification code retrieval request is sent to the authentication server, so that the authentication server generates a second verification code based on the second verification code retrieval request and sends the second verification code to the first user device; The system receives a second verification code from the first user equipment and sends a second verification code verification request containing the second verification code to the authentication server, so that the authentication server verifies the second verification code verification request based on the generated second verification code and obtains the second verification information corresponding to the second user equipment returned by the authentication server.

8. A security authentication method for the Internet of Things, characterized in that, The authentication server is used for communication connection with the gateway as described in any one of claims 1-4, and the security authentication method further includes: Receive information verification requests sent from the gateway according to a preset time interval; Based on the information verification request, the gateway returns the information verification result corresponding to the information verification request to the gateway, so that when the information verification result indicates that the terminal's first verification information is valid, the gateway updates the local whitelist based on the information verification result; the gateway returns the network interface corresponding to the information verification result to the terminal; the information verification result is used to indicate whether the terminal's first verification information is valid. The information verification request is obtained through the following steps: The gateway receives external network access requests from the terminal. The gateway obtains a local whitelist, performs a first whitelist verification on the external network access request based on the local whitelist, and obtains a first whitelist verification result. The local whitelist is used to record securely authenticated terminals connected to the gateway. When the gateway fails the first whitelist verification, it returns a preset authentication redirection link to the terminal, so that the terminal can perform device authentication with the authentication server according to the authentication redirection link. The terminal receives the first verification information returned by the authentication server. The first verification information is used to record the binding mapping relationship between the terminal's address information and the authentication token. The gateway receives a targeted service request containing the first verification information sent by the terminal, and generates an information verification request based on the targeted service request.

9. A security authentication system for the Internet of Things, characterized in that, For use at the gateway, the security authentication system includes: The first processing unit is used to receive external network access requests from the terminal; The second processing unit is used to obtain a local whitelist, perform a first whitelist verification on the external network access request based on the local whitelist, and obtain a first whitelist verification result. The local whitelist is used to record the securely authenticated terminals connected to the gateway. The third processing unit is configured to return a preset authentication redirection link to the terminal if the first whitelist verification result is that the whitelist verification fails, so that the terminal can perform device authentication with the authentication server according to the authentication redirection link. The terminal obtains the first verification information returned by the authentication server. The first verification information is used to record the binding mapping relationship between the terminal's address information and the authentication token. The fourth processing unit is configured to receive a targeted service request containing the first verification information sent by the terminal, and generate an information verification request based on the targeted service request. The fifth processing unit is configured to periodically send the information verification request to the authentication server according to a preset interval, and obtain the information verification result returned by the authentication server. The information verification result is used to indicate whether the first verification information of the terminal is valid. If the information verification result indicates that the first verification information of the terminal is valid, the local whitelist is updated according to the information verification result. The sixth processing unit is used to return the network interface corresponding to the information verification result to the terminal.

10. The security authentication system according to claim 9, characterized in that, The security authentication system also includes: The seventh processing unit is used to obtain a preset heartbeat cycle and send a heartbeat initiation signal to the authentication server according to the heartbeat cycle, so that the authentication server generates a corresponding heartbeat response signal according to the heartbeat initiation signal, wherein the heartbeat response signal includes a third whitelist list corresponding to the current heartbeat initiation signal. The eighth processing unit is used to receive the heartbeat response signal returned by the authentication server, and perform a fourth whitelist verification on the third whitelist according to the local whitelist to obtain a fourth whitelist verification result. The fourth whitelist verification result is used to indicate whether there is an unauthorized intrusion of the authenticated terminal in the authentication server. The ninth processing unit is used to send the fourth whitelist verification result to the authentication server, so that the authentication server updates the third whitelist based on the fourth whitelist verification result.

Images