IOTA-based Internet of Things identity authentication method

Abstract

The invention discloses an IOTA (Internet of Things)-based identity authentication method for the Internet of Things. The method comprises the following steps: S1, registering a node; s2, selecting nodes based on consensus to form a dynamic trusted sensing device group; and S3, verifying an identity verification request sent by the user equipment to the dynamic trusted sensing equipment group by using zero-knowledge proof. The lightweight authentication mechanism suitable for the IoT equipment is realized by utilizing the characteristics of the IOTA, such as no service charge, quick transaction confirmation and support of large-scale parallel processing. According to the method, a dynamic trusted sensor group concept and zero-knowledge proof are combined, so that effective identity verification is carried out on the premise that user privacy is not leaked.

Description

Technical Field

[0001] The present invention belongs to the field of Internet of Things device identity authentication. More specifically, the present invention relates to an Internet of Things identity authentication method based on IOTA. Background Art

[0002] In recent years, the Internet of Things (IoT) has penetrated into all walks of life. Every digital device can be considered an IoT device, and its potential uses cover almost every area of ​​life. The IoT envisions a universe in which all objects are interconnected and can share and receive data in real time. As the number of IoT devices surges, how to ensure secure communication between these devices becomes a challenge. Traditional methods often rely on centralized authentication mechanisms. Centralized data storage systems may suffer from single point failures and malicious attacks such as DDoS and Sybil attacks, and the resource consumption is too large for IoT devices with limited computing power. In addition, although the existing blockchain technology provides the advantages of decentralization and immutability, its consensus algorithm requires a lot of computing resources and is not suitable for the IoT environment. Therefore, we propose a distributed authentication scheme for IoT devices based on IOTA technology. Summary of the invention

[0003] An object of the present invention is to solve at least the above problems and to provide at least the advantages which will be described hereinafter.

[0004] An object of the present invention is to provide an IOTA-based IoT identity authentication method, which solves the problem of limited computing power of IoT devices and improves the efficiency of identity authentication.

[0005] In order to achieve these purposes and other advantages of the present invention, an IOTA-based IoT identity authentication method is provided, comprising the following steps: S1: registration node; S2: Consensus-based node selection to form a dynamic trusted sensor device group; S3: Use zero-knowledge proof to verify the authentication request sent by the user device to the dynamic trusted sensor device group.

[0006] Preferably, step S1: registering the identities of the user equipment and the sensor terminal node, and recording the identity information on the IOTA Tangle network for subsequent identity verification.

[0007] Preferably, step S2: adopt the tangle consensus mechanism to screen the trusted nodes and add the trusted nodes to the dynamic trusted sensor device group.

[0008] Preferably, the identity request verification of zero-knowledge proof in step S3 includes: System initialization: select an elliptic curve E and a base point G, as well as the parameters a, b, and p of the elliptic curve; each user device generates a private key d and calculates the public key P = d*G; the public key P can be publicly used for identity authentication; Setting of graph and secret arrangement: User selects two graphs K 0 and K 1 =δ(K 0 ), the user’s goal is to prove that he possesses δ without revealing the permutation; Commitment phase: The user device randomly selects a permutation β and a random number k, calculates the commitment point R=k*G, and generates a commitment graph T=β(K 0 ), the user device sends the commitment graph T and the commitment point R to the verifier; The verifier initiates a challenge: The verifier starts from K 0 and K 1 A random selection is made as the challenge image Kchal and the user device is notified; Response of the user device: The user device responds according to the challenge graph Kchal selected by the verifier: If Kchal=K 0 :The user device returns α=β, that is, provides the permutation β, and calculates s=k+e*d, where e is the challenge value selected by the verifier; If Kchal=K 1 :The user device returns α=δ -1 β, that is, apply the secret permutation δ in reverse to adjust β and calculate s=k+e*d; The user device returns the permutations α and s to the verifier; Verification by the verifier: The verifier uses the ECC formula to verify R=s*Ge*P, ensuring that s and the public key P are consistent, thereby verifying the validity of the commitment; Verify the correctness of the permutation: If the verifier chooses K 0 , verify that T = α(K 0 ), that is, confirm whether T is equal to β(K 0 ); If the validator chooses K 1 , verify that T = α(K 1 ), that is, confirm whether T is equal to δ -1 β(K 1 ).

[0009] Preferably, the method further comprises step S4: dynamically adjusting the dynamic trusted sensor device group to ensure the trustworthiness of members in the device group.

[0010] Preferably, the dynamic adjustment mechanism includes monitoring network status, heartbeat detection, anomaly detection and fault detection; Heartbeat detection: Each DTSG member sends heartbeat signals regularly to indicate that they are still online and functioning properly. If a node does not respond in several consecutive heartbeat detections or is reported as unreachable by other nodes, it will be marked as a faulty node and removed from DTSG. Anomaly detection: Detecting abnormal activities by analyzing the behavior patterns of devices; Fault detection: If the behavior pattern of a node is detected as abnormal, it will be marked as an untrusted node and removed from DTSG.

[0011] Preferably, the method further includes step S5: the aggregation node optimizes the path for the user equipment to request identity authentication by using a DRR scheduling algorithm.

[0012] Preferably, the specific method for the aggregation node to optimize the path for the user equipment to request identity authentication by using the DRR scheduling algorithm is: First, the DRR algorithm analyzes the network topology and communication requirements of IoT devices to build a global view of all devices and their connection paths; Then, when the user initiates an authentication request, the DRR algorithm starts to work, searching for possible routing paths in the global view according to the current state of the device and the location of the target sensor node; Finally, after determining the possible routing paths, the DRR algorithm selects an optimal path from these possible routing paths in a random manner.

[0013] The present invention includes at least the following beneficial effects: First, the present invention realizes a lightweight authentication mechanism suitable for IoT devices by utilizing the characteristics of IOTA, such as no handling fee, fast transaction confirmation, and support for large-scale parallel processing. The method combines the concept of dynamic trusted sensor group (DTSG) and zero-knowledge proof (ZKP) to ensure effective identity authentication without leaking user privacy. Second, the method of the present invention selects IoT devices that use the consensus algorithm of the tangle structure to establish a dynamic trusted sensor device group (DT sensor group, DTSG) authentication mechanism for IoT devices, avoiding the low access efficiency and low user access rate caused by the one-to-one frequent authentication between the traditional user end and the sensor terminal node, realizing lightweight authentication, solving the problem of limited computing power of IoT devices, and improving the efficiency of identity authentication. Third, the present invention adopts zero-knowledge proof technology and Elliptic Curve Cryptography (ECC) to ensure the security of the user's privacy data during the verification process, while proving their identity, greatly reducing the risk of privacy leakage, especially preventing the data leakage problem caused by centralized storage or transmission of authentication information. Fourth, the Tangle consensus mechanism adopted by the present invention abandons the traditional miners and block structure in the blockchain, and no longer has a fixed block time and block size limit. In the Tangle consensus mechanism, the transaction of each device will verify the previous two transactions, and the transaction will gain consensus through the continuous accumulation of verification. For the Internet of Things, as the number of access devices increases, the network will not be congested, but can guarantee higher processing power. Fifth, the present invention adds the DRR (Deterministic Random Routing) algorithm in the identity recognition process. In resource-constrained IoT devices, DRR can reduce unnecessary communication overhead by optimizing the routing path, thereby saving energy. When a user initiates an identity authentication request, DRR can ensure that the request is delivered to the target sensor node with the shortest path and the lowest delay.

[0014] Other advantages, objectives and features of the present invention will be embodied in part through the following description, and in part will be understood by those skilled in the art through study and practice of the present invention. DETAILED DESCRIPTION

[0015] The present invention is described in further detail below so that those skilled in the art can implement it according to the description.

[0016] It should be understood that the terms such as “having”, “including” and “comprising” used herein do not exclude the existence or addition of one or more other elements or combinations thereof.

[0017] The present invention provides an IOTA-based IoT device identity authentication method, which is established in a distributed environment. Physical devices constitute the IOTA Tangle network. The physical devices specifically include the following three types of devices: Sink node (SN): responsible for managing and controlling IoT devices, usually servers, computers or gateways; responsible for collecting and processing data from STs and coordinating access requests from user devices.

[0018] Sensor terminal (ST): IoT devices that are connected to the sink node via WiFi, ZigBee or wired network; collect environmental data and report to the SN.

[0019] User device (U): A mobile device used by users, such as mobile phones and tablets, to access and control IoT devices. It interacts with SN and ST through the IOTA Tangle network to achieve remote control of IoT devices.

[0020] The present invention provides an IOTA-based IoT device identity authentication method, which specifically comprises the following steps: S1: registration node; Register the identities of user devices and sensor end nodes, and record the identity information on the IOTA Tangle network for subsequent authentication.

[0021] S2: Consensus-based node selection to form a dynamic trusted sensor group (DTSG); There may be fake or illegal nodes in the terminal devices. In order to ensure that the nodes in the network are trustworthy, the system uses the tangle consensus mechanism to screen the trusted nodes to join the DTSG device group. Only those trusted nodes that have been verified by consensus can be added to the dynamic trusted sensor device group DTSG, so that the selected sensor terminals are all trustworthy, and the appropriate nodes are selected from the trusted nodes verified by the consensus mechanism to join the DTSG device group.

[0022] Tangle consensus mechanism: Whenever a new transaction or identity verification (identity verification is also a transaction) request enters the network, two unconfirmed transactions must be selected for verification. The new transaction will check the validity of these two transactions, including verifying the transaction signature, checking whether the transaction complies with network rules, and whether it conflicts with other transactions. In tangle, each transaction has a "weight" value. Initially, all transactions have the same basic weight. Whenever a new transaction confirms and references the transaction, its weight increases. When the cumulative weight of a transaction reaches a certain threshold, it is considered a "confirmed" transaction.

[0023] S3: Use zero-knowledge proof to verify the authentication request sent by the user device to the dynamic trusted sensor device group; When a user wants to access an IoT device, he or she will send an authentication request to a node in DTSG through his or her user device. This request will trigger the subsequent zero-knowledge proof verification process.

[0024] Zero-knowledge proof authentication includes: System initialization: select an elliptic curve E and a base point G, as well as the parameters a, b, and p of the elliptic curve; each user device generates a private key d and calculates the public key P=d*G; the public key P can be publicly used for identity authentication.

[0025] Elliptic curve E: Select an elliptic curve E. The form of the elliptic curve is usually y 2 =x 3 +ax+b mod p, this curve defines a mathematical structure that supports specific addition and multiplication operations.

[0026] Base point G: Select a base point G, which is a predefined point on the elliptic curve. Base point G is used to generate public and private key pairs.

[0027] Private key d: Each user generates a private key d, which is a random large integer.

[0028] Public key P: Use the private key d and the base point G to calculate the public key P, that is, P = d ∗ G. The multiplication here is the multiplication operation on the elliptic curve.

[0029] Setting of graph and secret arrangement: The user device selects two graphs K 0 and K 1 =δ(K 0 ), the goal of the user device is to prove that it owns δ without revealing the permutation.

[0030] Commitment phase: The user device randomly selects a permutation β and a random number k, calculates the commitment point R=k*G, and generates a commitment graph T=β(K 0 ), the user device sends the commitment graph T and the commitment point R to the verifier.

[0031] K is a random number selected by the user device; R is generated based on the random number k and the base point G, and is used to hide some information of the user device.

[0032] The verifier initiates a challenge: The verifier starts from K 0 and K 1 A random one is selected as the challenge graph Kchal and notified to the user device.

[0033] Response of the user device: The user device responds according to the challenge graph Kchal selected by the verifier: If Kchal=K 0 :The user device returns α=β, that is, provides the permutation β, and calculates s=k+e*d, where e is the challenge value selected by the verifier; If Kchal=K 1 :The user device returns α=δ -1 β, that is, apply the secret permutation δ in reverse to adjust β and calculate s=k+e*d; The user device returns the permutations α and s to the verifier.

[0034] Verification by the verifier: The verifier uses the ECC formula to verify R=s*Ge*P, ensuring that s and the public key P are consistent, thereby verifying the validity of the commitment.

[0035] Verify the correctness of the permutation: If the verifier chooses K 0 , verify that T = α(K 0 ), that is, confirm whether T is equal to β(K 0 ); If the validator chooses K 1 , verify that T = α(K 1 ), that is, confirm whether T is equal to δ -1 β(K 1 ).

[0036] Commitment graph T: The user device selects a permutation β and generates a commitment graph T = β (K 0 ). This commitment graph T is used to hide the true permutation δ from the prover.

[0037] S4: Dynamically adjust the dynamic trusted sensor device group to ensure the trustworthiness of members in the device group.

[0038] Once the DTSG device group is established, a dynamic adjustment mechanism needs to be set up. When the IoT environment changes, such as new devices joining, existing devices failing or being removed, the DTSG needs to be updated accordingly, removing untrusted nodes and adding new trusted nodes to maintain the trustworthiness of members in the device group.

[0039] The dynamic adjustment mechanism includes monitoring network status, heartbeat detection, anomaly detection and fault detection. Monitoring network status adopts conventional monitoring methods, which will not be described here.

[0040] Heartbeat detection: Each DTSG member sends heartbeat signals regularly to indicate that they are still online and functioning properly. If a node does not respond in several consecutive heartbeat detections or is reported as unreachable by other nodes, it will be marked as a failed node and removed from DTSG.

[0041] Anomaly detection: Detects unusual activity by analyzing the behavior patterns of devices.

[0042] Fault detection: If the behavior pattern of a node is detected as abnormal, it will be marked as an untrusted node and removed from DTSG.

[0043] S5: The aggregation node optimizes the path for the user equipment to request identity authentication using the DRR scheduling algorithm.

[0044] When there are a large number of devices, a large number of devices (possibly malicious attacks) may request authentication at the same time, which will cause network congestion and service delays. To alleviate this problem, the aggregation node uses the DRR scheduling algorithm to control and schedule authentication requests. DRR is a fair queue scheduling algorithm that can allocate a certain bandwidth to each flow and allow unused bandwidth to be borrowed by other flows, thereby providing a more flexible service quality control mechanism.

[0045] First, the DRR algorithm analyzes the network topology and communication requirements of IoT devices. It understands key information such as the location of each device, its connection relationships, and the direction and frequency of data transmission. Based on this information, the DRR algorithm can build a global view of all devices and their connection paths.

[0046] Then, when the user initiates an authentication request, the DRR algorithm starts working, searching for possible routing paths in the global view based on the current state of the device (such as how busy the device is) and the location of the target sensor node. Unlike traditional routing algorithms, the DRR algorithm not only considers the length of the path, but also comprehensively considers multiple factors such as the load of the devices on the path, energy consumption, and communication quality.

[0047] Finally, after determining the possible routing paths, the DRR algorithm selects an optimal path from these possible routing paths in a random manner.

[0048] The optimal path selected by the DRR algorithm can ensure that the authentication request is delivered to the target sensor node with the shortest path and lowest latency. At the same time, because the DRR algorithm optimizes the routing path, it reduces unnecessary communication hops and overhead, thereby saving energy consumption. For resource-constrained IoT devices, this means that more resources can be used for critical data processing and transmission, improving the overall performance and service life of the device. Moreover, the optimized routing path can also reduce communication delays, ensuring that data can be transmitted between devices in a timely and accurate manner, which plays a key role in the efficient operation of the IoT system.

[0049] The present invention realizes a lightweight authentication mechanism suitable for IoT devices by utilizing the characteristics of IOTA, such as no handling fee, fast transaction confirmation, and support for large-scale parallel processing. The method combines the concept of dynamic trusted sensor group (DTSG) and zero-knowledge proof (ZKP) to ensure effective identity authentication without leaking user privacy.

[0050] The present invention achieves the following technical breakthroughs: Lightweight identity authentication: In the IoT environment, device computing resources are often limited. The method of the present invention achieves lightweight identity authentication by adopting elliptical cryptography (ECC). ECC has a unique advantage. Compared with traditional RSA or DH algorithms, it can use shorter keys while ensuring the same security level. This feature significantly reduces the computational burden and communication overhead during the identity authentication process. IoT devices no longer need to consume a lot of resources for complex encryption calculations, so they can perform identity authentication operations more efficiently, meeting the needs of IoT devices for lightweight identity-level authentication. This lightweight identity authentication method not only improves the operating efficiency of the device, but also lays the foundation for improving the overall performance of the IoT system.

[0051] Zero-knowledge proof privacy protection: The present invention innovatively combines the GMW-ZKP protocol (zero-knowledge proof combined with ECC) to perform identity authentication through graph isomorphism problems. In this process, the verifier can effectively verify the identity of the user device without obtaining any secret arrangement information of the user device. This is due to the unique mechanism of zero-knowledge proof, which allows the user device to prove its identity to the verifier without leaking key information. In addition, in order to further ensure privacy security, the method of the present invention also adopts a multi-round interactive challenge mechanism. In multiple identity authentication processes, each round of challenges increases the complexity and reliability of verification, making it impossible for the verifier to infer any additional privacy information by analyzing multiple verification processes. This privacy protection mechanism is crucial in the IoT environment, because data often involves privacy, and any information leakage may lead to serious consequences.

[0052] Decentralized architecture: This invention adopts a distributed identity authentication mechanism, which eliminates the single point failure problem of the traditional centralized identity authentication system. Based on the consensus mechanism of IOTA Tangle, the identity authentication process does not rely on centralized servers at all. This means that the system will not be paralyzed due to the failure of a single server, avoiding potential DDoS attacks and single point failure risks. In the IoT environment, there are a large number of devices and they are widely distributed. This decentralized architecture can ensure the stability and reliability of the system. Even if some devices are attacked or fail, the system can still operate normally, ensuring the security and continuity of data transmission and device interaction in the IoT, and greatly enhancing the durability and risk resistance of the system.

[0053] DRR algorithm optimizes routing paths: During the authentication process of IoT devices, the use of the DRR algorithm can effectively optimize routing paths. Unlike traditional routing algorithms, the DRR algorithm works by randomizing and determining the optimal path. In the IoT environment, communication between devices needs to take into account issues such as energy consumption and communication efficiency. The DRR algorithm can reduce unnecessary communication hops and overhead, thereby saving energy consumption. For resource-constrained IoT devices, this means that more resources can be used for critical data processing and transmission, improving the overall performance and service life of the device. At the same time, the optimized routing path can also reduce communication delays, ensuring that data can be transmitted between devices in a timely and accurate manner, which plays a key role in the efficient operation of the IoT system.

[0054] Although the embodiments of the present invention have been disclosed as above, they are not limited to the applications listed in the specification and the implementation modes. They can be fully applied to various fields suitable for the present invention. For those familiar with the art, additional modifications can be easily implemented. Therefore, without departing from the general concept defined by the claims and the scope of equivalents, the present invention is not limited to specific details.

Claims

1. The IoT identity authentication method based on IOTA is characterized by: The following steps are involved: S1: registration node; S2: Consensus-based node selection to form a dynamic trusted sensor device group; S3: Use zero-knowledge proof to verify the authentication request sent by the user device to the dynamic trusted sensor device group.

2. The IOTA-based Internet of Things identity authentication method according to claim 1, characterized in that: Step S1: Register the identities of user devices and sensor end nodes, and record the identity information on the IOTA Tangle network for subsequent identity verification.

3. The IOTA-based Internet of Things identity authentication method according to claim 1, characterized in that: Step S2: Use the tangle consensus mechanism to screen trusted nodes and add trusted nodes to the dynamic trusted sensor device group.

4. The IOTA-based Internet of Things identity authentication method according to claim 1, characterized in that: Step S3: Identity verification of zero-knowledge proof includes: System initialization: select an elliptic curve E and a base point G, as well as the parameters a, b, and p of the elliptic curve; each user device generates a private key d and calculates the public key P = d*G; the public key P can be publicly used for identity authentication; Setting of graphs and secret permutations: The user chooses two graphs K0 and K1 = δ(K0). The user’s goal is to prove that he has δ without revealing the permutation. Commitment phase: The user device randomly selects a permutation β and a random number k, calculates the commitment point R=k*G, and generates a commitment graph T=β(K0). The user device sends the commitment graph T and the commitment point R to the verifier. The verifier initiates a challenge: The verifier randomly selects one from K0 and K1 as the challenge graph Kchal and notifies the user device; Response of the user device: The user device responds according to the challenge graph Kchal selected by the verifier: If Kchal=K0: the user device returns α=β, that is, provides the permutation β, and calculates s=k+e*d where e is the challenge value chosen by the verifier; If Kchal=K1: the user equipment returns α=δ -1 β, that is, apply the secret permutation δ in reverse to adjust β and calculate s=k+e*d; The user device returns the permutations α and s to the verifier; Verification by the verifier: The verifier uses the ECC formula to verify R=s*Ge*P, ensuring that s and the public key P are consistent, thereby verifying the validity of the commitment; Verify the correctness of the permutation: If the verifier chooses K0, verify that T = α(K0), that is, confirm whether T is equal to β(K0); if the verifier chooses K1, verify that T = α(K1), that is, confirm whether T is equal to δ -1 β(K1).

5. The IOTA-based Internet of Things identity authentication method according to claim 1, characterized in that: The method further includes step S4: dynamically adjusting the dynamic trusted sensor device group to ensure the trustworthiness of members in the device group.

6. The IOTA-based Internet of Things identity authentication method according to claim 5, characterized in that: Dynamic adjustment mechanisms include monitoring network status, heartbeat detection, anomaly detection, and fault detection; Heartbeat detection: Each DTSG member sends heartbeat signals regularly to indicate that they are still online and functioning properly. If a node does not respond in several consecutive heartbeat detections or is reported as unreachable by other nodes, it will be marked as a faulty node and removed from DTSG. Anomaly detection: Detecting abnormal activities by analyzing the behavior patterns of devices; Fault detection: If the behavior pattern of a node is detected as abnormal, it will be marked as an untrusted node and removed from DTSG.

7. The IOTA-based Internet of Things identity authentication method according to claim 1, characterized in that: The method further includes step S5: the aggregation node optimizes the path for the user equipment to request identity authentication by using the DRR scheduling algorithm.

8. The IOTA-based Internet of Things identity authentication method according to claim 7, characterized in that: The specific method by which the aggregation node optimizes the path for user equipment to request identity authentication using the DRR scheduling algorithm is as follows: First, the DRR algorithm analyzes the network topology and communication requirements of IoT devices to build a global view of all devices and their connection paths; Then, when the user initiates an authentication request, the DRR algorithm starts to work, searching for possible routing paths in the global view according to the current state of the device and the location of the target sensor node; Finally, after determining the possible routing paths, the DRR algorithm selects an optimal path from these possible routing paths in a random manner.