IoT identity authentication method based on IOTA

Abstract

This invention discloses an IoT identity authentication method based on IOTA, comprising the following steps: S1: registering nodes; S2: selecting nodes based on consensus to form a dynamic trusted sensing device group; S3: verifying the identity authentication request sent by the user device to the dynamic trusted sensing device group using zero-knowledge proofs. This invention utilizes the characteristics of IOTA, such as no transaction fees, fast transaction confirmation, and support for massively parallel processing, to achieve a lightweight authentication mechanism suitable for IoT devices. This method combines the concept of a dynamic trusted sensor group with zero-knowledge proofs to ensure effective identity authentication without compromising user privacy.

Description

Technical Field

[0001] This invention belongs to the field of IoT device authentication. More specifically, this invention relates to an IoT authentication method based on IOTA. Background Technology

[0002] In recent years, the Internet of Things (IoT) has permeated all industries. Every digital device can be considered an IoT device, and its potential applications cover almost every aspect of life. The IoT envisions a universe where all objects are interconnected, capable of sharing and receiving data in real time. With the explosive growth in the number of IoT devices, ensuring secure communication between them has become a challenge. Traditional methods often rely on centralized authentication mechanisms. Centralized data storage systems are susceptible to single points of failure and malicious attacks such as DDoS and Sybil attacks, and they consume excessive resources for IoT devices with limited computing power. Furthermore, while existing blockchain technology offers the advantages of decentralization and immutability, its consensus algorithm requires significant computing resources, making it unsuitable for the IoT environment. Therefore, we propose a distributed authentication scheme for IoT devices based on IOTA technology. Summary of the Invention

[0003] One object of the present invention is to solve at least the above-mentioned problems and to provide at least the advantages that will be described later.

[0004] One objective of this invention is to provide an IoT identity authentication method based on IOTA, which solves the problem of limited computing power of IoT devices and improves the efficiency of identity authentication.

[0005] To achieve these objectives and other advantages of the present invention, an IoT identity authentication method based on IOTA is provided, comprising the following steps:

[0006] S1: Register node;

[0007] S2: Consensus-based node selection to form a dynamic trusted sensing device group;

[0008] S3: Validate the authentication request sent by the user equipment to the dynamic trusted sensing device group using zero-knowledge proof.

[0009] Preferably, step S1 involves registering the identities of user devices and sensor terminal nodes, recording their identity information on the IOTA Tangle network for subsequent identity verification.

[0010] Preferably, step S2 involves using the tangle consensus mechanism to filter trusted nodes and adding them to the dynamic trusted sensing device group.

[0011] Preferably, the identity request verification in step S3 using zero-knowledge proof includes:

[0012] System initialization: Select an elliptic curve E and a base point G, as well as the parameters a, b, p of the elliptic curve; generate a private key d for each user device, and calculate the public key P = d * G; the public key P can be publicly used for authentication.

[0013] The setup of the graph and the secret permutation: The user selects two graphs K0 and K1 = δ(K0), and the user's goal is to prove that he possesses δ without revealing the permutation;

[0014] Commitment Phase: The user equipment randomly selects a permutation β and a random number k, calculates the commitment point R=k*G, and generates a commitment graph T=β(K0). The user equipment sends the commitment graph T and the commitment point R together to the verifier.

[0015] The validator initiates a challenge: The validator randomly selects one of K0 and K1 as the challenge graph Kchal and notifies the user device;

[0016] User equipment response: The user equipment responds based on the challenge graph Kchal selected by the validator.

[0017] If Kchal=K0: The user device returns α=β, that is, provides the permutation β, and calculates s=k+e*d where e is the challenge value chosen by the validator;

[0018] If Kchal=K1: The user equipment returns α=δ -1 β, that is, to reverse the application of the secret permutation δ to adjust β, and calculate s=k+e*d;

[0019] The user equipment will return the permutations α and s to the verifier;

[0020] Verifier's verification: The verifier uses the ECC formula to verify R=s*Ge*P, ensuring that s and the public key P are consistent, thereby verifying the validity of the commitment;

[0021] Verify the correctness of the permutation: If the verifier chooses K0, verify T = α(K0), that is, confirm whether T equals β(K0); if the verifier chooses K1, verify T = α(K1), that is, confirm whether T equals δ. -1 β(K1).

[0022] Preferably, the method further includes step S4: dynamically adjusting the dynamic trusted sensing device group to ensure the trustworthiness of the members within the device group.

[0023] Preferably, the dynamic adjustment mechanism includes monitoring network status, heartbeat detection, anomaly detection, and fault detection;

[0024] Heartbeat detection: Each DTSG member periodically sends a heartbeat signal to indicate that they are still online and functioning properly. If a node fails to respond in several consecutive heartbeat detections, or is reported as unreachable by other nodes, it is marked as a faulty node and removed from the DTSG.

[0025] Anomaly detection: Detects abnormal activity by analyzing the behavior patterns of the equipment;

[0026] Fault detection: If a node's behavior pattern is detected as abnormal, it is marked as an untrusted node and removed from DTSG.

[0027] Preferably, the method also includes step S5: the aggregation node optimizes the path for user equipment to request authentication using the DRR scheduling algorithm.

[0028] Preferably, the specific method by which the aggregation node optimizes the path for user equipment authentication requests using the DRR scheduling algorithm is as follows:

[0029] First, the DRR algorithm analyzes the network topology and communication requirements of IoT devices to build a global view that includes all devices and their connection paths.

[0030] Then, when a user initiates an authentication request, the DRR algorithm starts working, searching for possible routing paths in the global view based on the current state of the device and the location of the target sensor node;

[0031] Finally, after determining the possible routing paths, the DRR algorithm selects the optimal path from these possible routing paths in a randomized manner.

[0032] This invention offers at least the following advantages: First, by leveraging the characteristics of IOTA, such as no transaction fees, fast transaction confirmation, and support for massively parallel processing, this invention achieves a lightweight authentication mechanism suitable for IoT devices. This method combines the concept of Dynamic Trusted Sensor Groups (DTSG) and Zero-Knowledge Proofs (ZKP) to ensure effective authentication without compromising user privacy. Second, this invention selects IoT devices using a consensus algorithm with a tangle structure to establish a Dynamic Trusted Sensor Group (DTSG) authentication mechanism for IoT devices. This avoids the low access efficiency and low user access rate problems caused by frequent one-to-one authentication between traditional user terminals and sensor terminal nodes, achieving lightweight authentication, solving the problem of limited computing power in IoT devices, and improving authentication efficiency. Third, this invention employs Zero-Knowledge Proof technology and Elliptic Curve Cryptography (ECC) to ensure the security of user privacy data during the authentication process. While proving their identity, it greatly reduces the risk of privacy leakage, especially preventing data leakage problems caused by centralized storage or transmission of authentication information. Fourth, the Tangle consensus mechanism adopted in this invention abandons the traditional miner and block structure in blockchain, eliminating fixed block time and block size limitations. In the Tangle consensus mechanism, each device's transaction verifies the previous two transactions, and consensus is achieved through continuous accumulation of verifications. For the Internet of Things (IoT), as the number of connected devices increases, the network will not become congested; instead, it can guarantee higher processing capacity. Fifth, this invention incorporates the DRR (Deterministic Random Routing) algorithm into the identity recognition process. In resource-constrained IoT devices, DRR can reduce unnecessary communication overhead by optimizing routing paths, thereby saving energy. When a user initiates an authentication request, DRR can ensure that the request is delivered to the target sensor node with the shortest path and lowest latency.

[0033] Other advantages, objectives and features of the present invention will become apparent in part from the following description, and in part from those skilled in the art through study and practice of the invention. Detailed Implementation

[0034] The present invention will now be described in further detail so that those skilled in the art can implement it based on the description.

[0035] It should be understood that terms such as “having”, “including” and “comprising” used herein do not preclude the existence or addition of one or more other elements or combinations thereof.

[0036] This invention provides an IOTA-based IoT device authentication method, which is established in a distributed environment where physical devices constitute an IOTA Tangle network. These physical devices specifically include the following three types of devices:

[0037] Sink node (SN): Responsible for managing and controlling IoT devices, typically servers, computers, or gateways; responsible for collecting and processing data from the ST and coordinating access requests from user devices.

[0038] Sensor terminal (ST): Internet of Things (IoT) devices that connect to the aggregation node via WiFi, ZigBee, or wired networks; collect environmental data and report it to the SN.

[0039] User device (U): A mobile device used by the user, such as a mobile phone or tablet, to access and control IoT devices. It interacts with the SN and ST via the IOTA Tangle network to enable remote control of IoT devices.

[0040] The present invention provides an IoT device authentication method based on IOTA, which specifically includes the following steps:

[0041] S1: Register node;

[0042] Register the identities of user devices and sensor terminal nodes, and record the identity information on the IOTA Tangle network for subsequent authentication.

[0043] S2: Consensus-based node selection to form a Dynamic Trusted Sensing Device Group (DTSG).

[0044] Terminal devices may contain fake or illegitimate nodes. To ensure the trustworthiness of nodes in the network, the system employs a tangle consensus mechanism to filter trusted nodes for inclusion in the DTSG device group. Only trusted nodes verified through consensus can join the Dynamic Trusted Sensor Group (DTSG), ensuring that all selected sensing terminals are trustworthy. From the trusted nodes verified by the consensus mechanism, suitable nodes are selected to join the DTSG device group.

[0045] Tangle consensus mechanism: Whenever a new transaction or authentication request (authentication itself is a type of transaction) enters the network, two unconfirmed transactions must be selected for verification. The new transaction checks the validity of these two transactions, including verifying the transaction signature, checking whether the transaction conforms to network rules, and whether it conflicts with other transactions. In Tangle, each transaction has a "weight" value. Initially, all transactions have the same base weight. Each time a new transaction confirms and references the original transaction, its weight increases. When a transaction's accumulated weight reaches a certain threshold, it is considered a "confirmed" transaction.

[0046] S3: Validate the authentication request sent by the user equipment to the dynamic trusted sensing device group using zero-knowledge proof;

[0047] When a user wants to access an IoT device, they send an authentication request to a node in the DTSG through their user device. This request triggers the subsequent zero-knowledge proof verification process.

[0048] Zero-knowledge proof authentication includes:

[0049] System initialization: Select an elliptic curve E and a base point G, as well as the parameters a, b, p of the elliptic curve; generate a private key d for each user device, and calculate the public key P = d * G; the public key P can be publicly used for authentication.

[0050] Elliptic Curve E: Select an elliptic curve E. The form of an elliptic curve is usually y 2 =x 3 The curve +ax+b mod p defines a mathematical structure that supports specific addition and multiplication operations.

[0051] Base point G: Select a base point G, which is a predefined point on the elliptic curve. The base point G is used to generate the public and private key pair.

[0052] Private key d: Each user generates a private key d, which is a random large integer.

[0053] Public key P: Calculate the public key P using the private key d and the base point G, i.e., P = d * G. The multiplication here is a doubling operation on an elliptic curve.

[0054] Graph and Secret Permutation Setup: The user device selects two graphs K0 and K1 = δ(K0), and the user device's goal is to prove that it possesses δ without revealing the permutation.

[0055] Commitment Phase: The user equipment randomly selects a permutation β and a random number k, calculates the commitment point R=k*G, and generates a commitment graph T=β(K0). The user equipment sends the commitment graph T and the commitment point R together to the verifier.

[0056] K is a random number selected by the user equipment; R is generated based on the random number k and the base point G, and is used to hide some information of the user equipment.

[0057] The validator initiates a challenge: The validator randomly selects one of K0 and K1 as the challenge graph Kchal and notifies the user device.

[0058] User equipment response: The user equipment responds based on the challenge graph Kchal selected by the validator.

[0059] If Kchal=K0: The user device returns α=β, that is, provides the permutation β, and calculates s=k+e*d where e is the challenge value chosen by the validator;

[0060] If Kchal=K1: The user equipment returns α=δ -1 β, that is, to reverse the application of the secret permutation δ to adjust β, and calculate s=k+e*d;

[0061] The user equipment will return the permutations α and s to the verifier.

[0062] Verifier's verification: The verifier uses the ECC formula to verify R=s*Ge*P, ensuring that s and the public key P are consistent, thereby verifying the validity of the commitment.

[0063] Verify the correctness of the permutation: If the verifier chooses K0, verify T = α(K0), that is, confirm whether T equals β(K0); if the verifier chooses K1, verify T = α(K1), that is, confirm whether T equals δ. -1 β(K1).

[0064] Commitment Graph T: The user equipment selects a permutation β and generates a commitment graph T=β(K0). This commitment graph T is used to hide the true permutation δ of the prover.

[0065] S4: Dynamically adjust the dynamic trusted sensing device group to ensure the trustworthiness of the members within the device group.

[0066] Once the DTSG device group is established, a dynamic adjustment mechanism is needed. When the IoT environment changes, such as the addition of new devices, the failure or removal of existing devices, the DTSG needs to be updated accordingly, removing untrusted nodes and adding new trusted nodes to maintain the trustworthiness of members within the device group.

[0067] The dynamic adjustment mechanism includes monitoring network status, heartbeat detection, anomaly detection, and fault detection. Network status monitoring employs conventional methods, which will not be elaborated upon here.

[0068] Heartbeat detection: Each DTSG member periodically sends a heartbeat signal to indicate that it is still online and functioning properly. If a node fails to respond in several consecutive heartbeat detections, or is reported as unreachable by other nodes, it is marked as a faulty node and removed from the DTSG.

[0069] Anomaly detection: Detects abnormal activity by analyzing the behavior patterns of the device.

[0070] Fault detection: If a node's behavior pattern is detected as abnormal, it is marked as an untrusted node and removed from DTSG.

[0071] S5: The aggregation node uses the DRR scheduling algorithm to optimize the path for user equipment to request authentication.

[0072] When the number of devices is large, a large number of devices (potentially under malicious attack) may simultaneously request authentication, leading to network congestion and service delays. To mitigate this issue, the aggregation node employs the DRR scheduling algorithm to control and schedule authentication requests. DRR is a fair queue scheduling algorithm that allocates a certain amount of bandwidth to each flow and allows unused bandwidth to be borrowed by other flows, thus providing a more flexible quality of service control mechanism.

[0073] First, the DRR algorithm analyzes the network topology and communication needs of IoT devices to understand key information such as the location of each device, its connectivity, and the direction and frequency of data transmission. Based on this information, the DRR algorithm can construct a global view containing all devices and their connection paths.

[0074] Then, when a user initiates an authentication request, the DRR algorithm begins to work. It searches for possible routing paths in the global view based on the current state of the device (such as the device's workload) and the location of the target sensor node. Unlike traditional routing algorithms, the DRR algorithm not only considers the path length, but also takes into account multiple factors such as the load of devices along the path, energy consumption, and communication quality.

[0075] Finally, after determining the possible routing paths, the DRR algorithm selects the optimal path from these possible routing paths in a randomized manner.

[0076] The DRR algorithm selects the optimal path to ensure that authentication requests are delivered to the target sensor node with the shortest path and lowest latency. Simultaneously, because the DRR algorithm optimizes the routing path, it reduces unnecessary communication hops and overhead, thereby saving energy consumption. For resource-constrained IoT devices, this means more resources can be allocated to critical data processing and transmission, improving the overall performance and lifespan of the device. Furthermore, the optimized routing path also reduces communication latency, ensuring timely and accurate data transmission between devices, playing a crucial role in the efficient operation of IoT systems.

[0077] This invention leverages the characteristics of IOTA, such as no transaction fees, fast transaction confirmation, and support for massively parallel processing, to implement a lightweight authentication mechanism suitable for IoT devices. The method combines the concept of Dynamic Trusted Sensor Groups (DTSG) and zero-knowledge proofs (ZKP) to ensure effective authentication without compromising user privacy.

[0078] This invention achieves the following technological breakthroughs:

[0079] Lightweight Authentication: In IoT environments, device computing resources are often limited. This invention achieves lightweight authentication by employing Elliptic Cryptography (ECC). ECC has unique advantages; compared to traditional RSA or DH algorithms, it can use shorter keys while ensuring the same level of security. This characteristic significantly reduces computational burden and communication overhead during authentication. IoT devices no longer need to expend significant resources on complex encryption calculations, thus enabling more efficient authentication operations and meeting the lightweight authentication requirements of IoT devices. This lightweight authentication method not only improves device operating efficiency but also lays the foundation for overall performance enhancement of the IoT system.

[0080] Zero-Knowledge Proof Privacy Protection: This invention innovatively combines the GMW-ZKP protocol (a combination of zero-knowledge proof and ECC) to perform authentication through the graph isomorphism problem. In this process, the verifier can effectively verify the identity of the user device without obtaining any secret permutation information. This is thanks to the unique mechanism of zero-knowledge proof, which allows the user device to prove its identity to the verifier without revealing critical information. Furthermore, to further ensure privacy, the method employs a multi-round interactive challenge mechanism. In multiple authentication processes, each round of challenges increases the complexity and reliability of the verification, making it impossible for the verifier to infer any additional privacy information by analyzing multiple verification processes. This privacy protection mechanism is crucial in the IoT environment because data often involves privacy, and any information leakage can lead to serious consequences.

[0081] Decentralized Architecture: This invention employs a distributed authentication mechanism, eliminating the single point of failure problem inherent in traditional centralized authentication systems. Based on the IOTA Tangle consensus mechanism, the authentication process is completely independent of centralized servers. This means the system will not be paralyzed by the failure of a single server, avoiding potential DDoS attacks and single point of failure risks. In the IoT environment, with its numerous and widely distributed devices, this decentralized architecture ensures system stability and reliability. Even if some devices are attacked or malfunction, the system can still operate normally, guaranteeing the security and continuity of data transmission and device interaction in the IoT, greatly enhancing the system's durability and resilience.

[0082] DRR Algorithm Optimizes Routing Paths: In the authentication process of IoT devices, the DRR algorithm effectively optimizes routing paths. Unlike traditional routing algorithms, the DRR algorithm works by randomizing and determining the optimal path. In IoT environments, communication between devices needs to consider energy consumption and communication efficiency. The DRR algorithm reduces unnecessary communication hops and overhead, thereby saving energy. For resource-constrained IoT devices, this means more resources can be allocated to critical data processing and transmission, improving overall device performance and lifespan. Simultaneously, the optimized routing path also reduces communication latency, ensuring timely and accurate data transmission between devices, playing a crucial role in the efficient operation of IoT systems.

[0083] Although the embodiments of the present invention have been disclosed above, they are not limited to the applications listed in the specification and embodiments. They can be applied to various fields suitable for the present invention. For those skilled in the art, other modifications can be easily made. Therefore, without departing from the general concept defined by the claims and their equivalents, the present invention is not limited to the specific details.

Claims

1. An IoT identity authentication method based on IOTA, characterized in that, Includes the following steps: S1: Register node; S2: Consensus-based node selection to form a dynamic trusted sensing device group; wherein, the tangle consensus mechanism is used to screen trusted nodes and add trusted nodes to the dynamic trusted sensing device group. S3: Validate the authentication request sent by the user equipment to the dynamic trusted sensing device group using zero-knowledge proof; Among them, zero-knowledge proof identity request verification includes: System initialization: Select an elliptic curve E and a base point G, as well as the parameters a, b, p of the elliptic curve; generate a private key d for each user device, and calculate the public key P = d * G; the public key P can be publicly used for authentication. The setup of the graph and the secret permutation: The user selects two graphs K0 and K1 = δ(K0), and the user's goal is to prove that he possesses δ without revealing the permutation; Commitment Phase: The user equipment randomly selects a permutation β and a random number k, calculates the commitment point R=k*G, and generates a commitment graph T=β(K0). The user equipment sends the commitment graph T and the commitment point R together to the verifier. The validator initiates a challenge: The validator randomly selects one of K0 and K1 as the challenge graph Kchal and notifies the user device; User equipment response: The user equipment responds based on the challenge graph Kchal selected by the validator. If Kchal=K0: The user device returns α=β, that is, provides the permutation β, and calculates s=k+e*d where e is the challenge value chosen by the validator; If Kchal=K1: The user equipment returns α=δ -1 β, that is, to reverse the application of the secret permutation δ to adjust β, and calculate s=k+e*d; The user equipment will return the permutations α and s to the verifier; Verifier's verification: The verifier uses the ECC formula to verify R=s*Ge*P, ensuring that s and the public key P are consistent, thereby verifying the validity of the commitment; Verify the correctness of the permutation: If the verifier chooses K0, verify T = α(K0), that is, confirm whether T equals β(K0); if the verifier chooses K1, verify T = α(K1), that is, confirm whether T equals δ. -1 β(K1).

2. The IoT identity authentication method based on IOTA according to claim 1, characterized in that, Step S1: Register the identities of user devices and sensor terminal nodes, and record the identity information on the IOTA Tangle network for subsequent authentication.

3. The IoT identity authentication method based on IOTA according to claim 1, characterized in that, It also includes step S4: dynamically adjusting the dynamic trusted sensing device group to ensure the trustworthiness of the members within the device group.

4. The IoT identity authentication method based on IOTA according to claim 3, characterized in that, The dynamic adjustment mechanism includes monitoring network status, heartbeat detection, anomaly detection, and fault detection; Heartbeat detection: Each DTSG member periodically sends a heartbeat signal to indicate that they are still online and functioning properly. If a node fails to respond in several consecutive heartbeat detections, or is reported as unreachable by other nodes, it is marked as a faulty node and removed from the DTSG. Anomaly detection: Detects abnormal activity by analyzing the behavior patterns of the equipment; Fault detection: If a node's behavior pattern is detected as abnormal, it is marked as an untrusted node and removed from DTSG.

5. The IoT identity authentication method based on IOTA according to claim 1, characterized in that, It also includes step S5: the aggregation node optimizes the path for user equipment to request authentication using the DRR scheduling algorithm.

6. The IoT identity authentication method based on IOTA according to claim 5, characterized in that, The specific method by which the aggregation node optimizes the path for user equipment authentication requests using the DRR scheduling algorithm is as follows: First, the DRR algorithm analyzes the network topology and communication requirements of IoT devices to build a global view that includes all devices and their connection paths. Then, when a user initiates an authentication request, the DRR algorithm starts working, searching for possible routing paths in the global view based on the current state of the device and the location of the target sensor node; Finally, after determining the possible routing paths, the DRR algorithm selects the optimal path from these possible routing paths in a randomized manner.