Identity authentication method and system, signing and issuing method, equipment, platform and server

Abstract

The invention discloses an identity authentication method, an identity authentication system, a certificate issuing method, terminal equipment, an Internet of Things platform, an authentication server, electronic equipment and a computer readable medium. The identity authentication method comprises the following steps: receiving an encryption certificate and a signature certificate sent by terminal equipment, and verifying the legality of the encryption certificate and the signature certificate based on a public key certificate sent by an authentication server in advance; extracting a first public key from the encrypted certificate and extracting a second public key from the signature certificate under the condition that the verification is passed; encrypting the first random number based on the first public key to generate a first ciphertext; sending the first ciphertext to the terminal equipment, so that the terminal equipment decrypts the first ciphertext and generates signature data; obtaining decryption data based on the second public key in response to the signature data; and matching the first random number with the decrypted data, and if the matching is successful, determining that the identity authentication of the terminal device is successful.

Description

Identity authentication method and system, issuance method, device, platform, and server Technical Field

[0001] The present disclosure relates to the technical field of Internet of Things, and in particular to an identity authentication method and system, a certificate issuance method, a terminal device, an Internet of Things platform, an authentication server, an electronic device, and a computer-readable medium. Background Art

[0002] In recent years, the Internet of Things (IoT) has developed rapidly, profoundly impacting fundamental sectors of human society, including agriculture, industry, and the service industry, and bringing about profound changes in production and lifestyles. IoT technology collects information from sensor devices in real time to enable device identification, monitoring, location, connection, tracking, and management, making devices, networks, and interactions more intelligent. As the scale of the IoT rapidly expands, the issue of device authentication within the IoT is gaining increasing attention.

[0003] Summary of the Invention

[0004] The present disclosure proposes an identity authentication method and an identity authentication system, a certificate issuance method, a terminal device, an Internet of Things platform, an authentication server, an electronic device, and a computer-readable medium.

[0005] In a first aspect, the present disclosure provides an identity authentication method applied to an Internet of Things platform, wherein the method comprises:

[0006] Receive the encryption certificate and signature certificate sent by the terminal device, and verify the legitimacy of the encryption certificate and the signature certificate based on the public key certificate sent in advance by the authentication server;

[0007] If the encryption certificate and the signature certificate are verified successfully, extracting the first public key of the terminal device from the encryption certificate and extracting the second public key of the authentication server from the signature certificate;

[0008] Encrypting a first random number based on the first public key to generate a first ciphertext; wherein the first random number is data randomly generated by the Internet of Things platform using a server cryptographic machine;

[0009] Sending the first ciphertext to the terminal device, so that the terminal device decrypts the first ciphertext and generates signature data;

[0010] In response to the signature data, obtaining decrypted data based on the second public key;

[0011] The first random number is matched with the decrypted data, and if the match is successful, it is determined that the identity authentication of the terminal device is successful.

[0012] In some embodiments, the signature data is generated by the terminal device after encryption and signing based on the fourth public key of the Internet of Things platform, the pre-obtained second private key, and the decryption result of the first ciphertext, and the second private key and the second public key are matched in pairs;

[0013] The decrypted data is obtained by verifying and decrypting the signature data based on the second public key and the fourth private key of the Internet of Things platform.

[0014] In some embodiments, the signature data is generated by the terminal device using the second private key to sign the second ciphertext; the second ciphertext is generated by the terminal device using the fourth public key to encrypt the second random number, and the second random number is the decryption result of the first ciphertext and the third random number concatenated together.

[0015] In some embodiments, in response to the signature data, obtaining decrypted data based on the second public key specifically includes:

[0016] In response to the signature data, verifying the signature data using the second public key;

[0017] If the signature verification is successful, the fourth private key is used to decrypt the second ciphertext obtained by the signature verification.

[0018] In some embodiments, when it is determined that the identity authentication of the terminal device is successful, the method further includes:

[0019] Using the decrypted data as a negotiation key;

[0020] The authentication success message is encrypted using the negotiated secret key to generate an authentication message ciphertext, and the authentication message ciphertext is sent to the terminal device.

[0021] In some embodiments, verifying the legitimacy of the encryption certificate and the signature certificate based on the public key certificate pre-sent by the authentication server specifically includes:

[0022] Obtaining a third public key of the authentication server from the public key certificate sent in advance by the authentication server;

[0023] Verifying the signature of the encryption certificate using the third public key;

[0024] If the encryption certificate passes the signature verification, the encryption certificate is determined to be legal, and the signature certificate is verified using the third public key; if the signature certificate passes the signature verification, the signature certificate is determined to be legal.

[0025] In some embodiments, before the step of receiving the encryption certificate and the signature certificate sent by the terminal device, the method further includes:

[0026] Receive and store the public key certificate sent by the authentication server; wherein the public key certificate records a third public key that is paired with the third private key;

[0027] Generate a fourth public key and a fourth private key that match in pair;

[0028] The fourth public key is sent to the authentication server, so that the authentication server signs the fourth public key using the third private key to generate a platform certificate.

[0029] In a second aspect, the present disclosure provides an identity authentication method, applied to a terminal device, wherein the method includes:

[0030] Submitting the encryption certificate and the signature certificate to the Internet of Things platform, so that the Internet of Things platform, upon determining that the encryption certificate and the signature certificate are legitimate, extracts the first public key from the encryption certificate and the second public key of the authentication server from the signature certificate;

[0031] When the encryption certificate and the signature certificate are verified, receiving a first ciphertext sent by the Internet of Things platform;

[0032] Decrypting the first ciphertext using a first private key of the terminal device, wherein the first public key and the first private key are paired;

[0033] generating signature data based on a decryption result of the first ciphertext;

[0034] The signature data is sent to the Internet of Things platform, so that the Internet of Things platform obtains decrypted data based on the second public key and authenticates the identity of the terminal device based on the decrypted data.

[0035] In some embodiments, generating signature data based on the decryption result of the first ciphertext specifically includes:

[0036] Encryption and signing are performed based on the fourth public key of the Internet of Things platform, the pre-obtained second private key, and the decryption result of the first ciphertext to generate the signature data; wherein the second public key and the second private key are matched in pair.

[0037] In some embodiments, encrypting and signing based on the fourth public key of the IoT platform, the pre-obtained second private key, and the decryption result of the first ciphertext to generate the signature data specifically includes:

[0038] Concatenate the decryption result of the first ciphertext and the third random number in series to generate a second random number;

[0039] Encrypting the second random number using the fourth public key to generate a second ciphertext;

[0040] The second ciphertext is signed using the second private key to generate the signature data.

[0041] In some embodiments, the method further comprises:

[0042] In response to the authentication message ciphertext sent by the Internet of Things platform, the second random number is used as a negotiated secret key to decrypt the authentication message ciphertext to obtain an authentication success message.

[0043] In some embodiments, before the step of submitting the encryption certificate and the signature certificate to the IoT platform, the method further includes:

[0044] Generate a first public key and a first private key that match in pair;

[0045] Sending the first public key to the authentication server, so that the authentication server signs the first public key using the third private key to generate an encryption certificate;

[0046] Receive and store the encryption certificate, signature certificate, and platform certificate sent by the authentication server; the platform certificate records the fourth public key of the Internet of Things platform, and the signature certificate is generated by the authentication server using the third private key to sign the second public key;

[0047] In response to the private key ciphertext sent by the authentication server, the private key ciphertext is decrypted using the first private key to obtain and store the second private key.

[0048] In a third aspect, the present disclosure provides a certificate issuance method, applied to an authentication server, wherein the method includes:

[0049] Generate a third private key and a public key certificate, wherein the public key certificate records a third public key that is paired with the third private key;

[0050] In response to the first public key sent by the terminal device, signing the first public key with the third public key, generating an encryption certificate, and sending the encryption certificate to the terminal device;

[0051] Signing the second public key of the authentication server using the third private key, generating a signed certificate and sending the signed certificate to the terminal device;

[0052] The public key certificate is sent to the IoT platform so that the IoT platform can verify the legitimacy of the encryption certificate and signature certificate from the terminal device based on the public key certificate.

[0053] In some embodiments, the method further includes: encrypting the second private key to generate a private key ciphertext, and sending the private key ciphertext to the terminal device so that the terminal device can decrypt the private key ciphertext to obtain the second private key; wherein, the second private key is matched with the second public key in pairs.

[0054] In some embodiments, the method further comprises:

[0055] In response to a fourth public key sent by the Internet of Things platform, signing the fourth public key using the third private key to generate a platform certificate;

[0056] Send the platform certificate to the terminal device.

[0057] In a fourth aspect, the present disclosure provides an Internet of Things platform, including:

[0058] a verification module configured to receive the encryption certificate and the signature certificate sent by the terminal device, and verify the legitimacy of the encryption certificate and the signature certificate based on the public key certificate pre-sent by the authentication server;

[0059] an extraction module, configured to extract the first public key of the terminal device from the encryption certificate and the second public key of the authentication server from the signature certificate if the encryption certificate and the signature certificate are verified;

[0060] The first identity authentication module is configured to encrypt a first random number based on the first public key to generate a first ciphertext; send the first ciphertext to the terminal device so that the terminal device can decrypt the first ciphertext and generate signature data; obtain decrypted data based on the second public key in response to the signature data; match the first random number with the decrypted data, and if the match is successful, determine that the identity authentication of the terminal device is successful; wherein, the first random number is data randomly generated by the Internet of Things platform using a server cryptographic machine.

[0061] In a fifth aspect, the present disclosure provides a terminal device, including:

[0062] a sending module configured to submit the encryption certificate and the signature certificate to the Internet of Things platform, so that the Internet of Things platform, when determining that the encryption certificate and the signature certificate are valid, extracts the first public key from the encryption certificate and the second public key of the authentication server from the signature certificate;

[0063] The second identity authentication module is configured to, if the encryption certificate and the signature certificate are verified, receive the first ciphertext sent by the IoT platform; decrypt the first ciphertext using the first private key of the terminal device; generate signature data based on the decryption result of the first ciphertext; and send the signature data to the IoT platform so that the IoT platform can obtain decrypted data based on the second public key and authenticate the identity of the terminal device based on the decrypted data;

[0064] The first public key and the first private key are matched in pair.

[0065] In a sixth aspect, the present disclosure provides an authentication server, comprising:

[0066] a generating module configured to generate a third private key and a public key certificate, wherein the public key certificate records a third public key that is paired with the third private key;

[0067] The certificate issuing module responds to the first public key sent by the terminal device, signs the first public key using the third public key, generates an encryption certificate and sends it to the terminal device; signs the second public key of the authentication server using the third private key, generates a signature certificate and sends it to the terminal device; and sends the public key certificate to the Internet of Things platform so that the Internet of Things platform can verify the legitimacy of the encryption certificate and signature certificate from the terminal device based on the public key certificate.

[0068] In a seventh aspect, the present disclosure provides an identity authentication system, comprising: the above-mentioned Internet of Things platform, a terminal device, and an authentication server.

[0069] In an eighth aspect, the present disclosure provides an electronic device, comprising:

[0070] one or more processors;

[0071] The storage device stores one or more programs thereon, and when the one or more programs are executed by the one or more processors, the one or more processors implement the above method.

[0072] In a ninth aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which implements the above-mentioned method when the program is executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] The accompanying drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the following detailed description, they are used to explain the present disclosure but do not constitute a limitation of the present disclosure. In the accompanying drawings:

[0074] FIG1 is a schematic diagram of an identity authentication method provided in some embodiments of the present disclosure.

[0075] FIG2 is a flowchart of a specific implementation method of step S133 provided in some embodiments of the present disclosure.

[0076] FIG3 is a flowchart of verification of an encryption certificate and a signature certificate provided in some embodiments of the present disclosure.

[0077] FIG4 is a schematic diagram of an identity authentication method provided in other embodiments of the present disclosure.

[0078] FIG5 is a schematic diagram of a certificate issuance process provided in some embodiments of the present disclosure.

[0079] FIG6 is a schematic diagram of an identity authentication method provided in other embodiments of the present disclosure.

[0080] FIG7 is a flowchart of an optional implementation method of S223 provided in some embodiments of the present disclosure.

[0081] FIG8 is a flowchart of an identity authentication method provided in some other embodiments of the present disclosure.

[0082] FIG9 is a schematic diagram of a certificate issuance process provided in some embodiments of the present disclosure.

[0083] FIG10 is a flowchart of a certificate issuance method provided in some embodiments of the present disclosure.

[0084] FIG11 is a flowchart of a certificate issuing method provided in some other embodiments of the present disclosure.

[0085] Figure 12 is a schematic diagram of the interaction between the terminal device, the authentication server, and the IoT platform during the certificate issuance process.

[0086] FIG13 is a schematic diagram of the identity authentication process.

[0087] FIG14 is a schematic diagram of an Internet of Things platform provided in some embodiments of the present disclosure.

[0088] FIG15 is a schematic diagram of a terminal device provided in some embodiments of the present disclosure.

[0089] FIG16 is a schematic diagram of an authentication server provided in some embodiments of the present disclosure.

[0090] FIG17 is a schematic diagram of an identity authentication system provided in some embodiments of the present disclosure. DETAILED DESCRIPTION

[0091] The following describes the specific embodiments of the present disclosure in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only used to illustrate and explain the present disclosure and are not intended to limit the present disclosure.

[0092] To make the purpose, technical solutions, and advantages of the embodiments of the present disclosure more clear, the technical solutions of the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the described embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0093] Unless otherwise defined, technical or scientific terms used in the embodiments of the present disclosure should have the same ordinary meaning as those understood by persons of ordinary skill in the art to which the present disclosure pertains. The terms "first," "second," and similar terms used in the present disclosure do not denote any order, quantity, or importance, but are merely used to distinguish different components.

[0094] To facilitate understanding of the embodiments of the present disclosure, before specifically introducing the embodiments of the present disclosure, the following special terms related to the present disclosure are explained in detail:

[0095] (1) CA (Certification Authority) is an internationally recognized certification body that issues, manages, and cancels digital certificates for digital certificate applicants. The role of a CA is to verify the legitimacy of the certificate holder's identity and issue a certificate (using mathematical methods to sign the certificate) to prevent the certificate from being forged or tampered with. The Digital Certificate Authority (CA) is a key link in the security of online electronic transactions. It is primarily responsible for generating, distributing, and managing the identity authentication digital certificates required by all entities participating in online transactions. Each digital certificate is associated with the digital signature certificate of the previous level, and is ultimately traced back through a security chain to a known and widely recognized secure, authoritative, and trustworthy institution—the root certification center (root CA).

[0096] (2) A server cryptographic machine is a server-side cryptographic computing device that provides general cryptographic services such as key generation, digital signatures, signature verification, data encryption, and data decryption. This device, under the action of a key, performs the conversion between plaintext and ciphertext, or vice versa. In the disclosed embodiments, this device provides basic security services such as data encryption and decryption for the IoT platform.

[0097] (3) A digital signature (also known as a public key digital signature) is a string of numbers that can only be generated by the sender of the information and cannot be forged by others. This string of numbers is also a valid proof of the authenticity of the information sent by the sender. It is a method for authenticating digital information, similar to an ordinary physical signature written on paper, but implemented using technology in the field of public key encryption. A set of digital signatures usually defines two complementary operations, one for signing and the other for verification (i.e., signature verification). The signature involved in the embodiments of this disclosure is private key issuance and public key verification.

[0098] In the disclosed embodiments, the process of signing data A using a private key a may include: processing data A' to be signed containing data A using a hash algorithm to generate a first hash value; encrypting the first hash value using private key a to generate a digital signature; and generating signed data D based on the digital signature and data A' to be signed. During signature verification, the digital signature is decrypted using public key a' paired with private key a, and data D is processed using a hash function to obtain a second hash value. This second hash value is compared with the decrypted result of the digital signature; if the two are identical, the signature verification is successful.

[0099] (4) A digital certificate (also known as a public key certificate) is a digitally signed statement that binds the value of a public key to the identity of the person, device, or service that holds the corresponding private key. Most general-purpose certificates are based on the X.509v3 certificate standard.

[0100] (5) Hash, commonly translated as hash, hash, or transliterated as hash, is a function that transforms an input of arbitrary length (also called a pre-image) into an output of fixed length through a hash algorithm. The output is the hash value. This conversion is a compression mapping, that is, the space of hash values ​​is usually much smaller than the space of inputs. Different inputs may hash to the same output, so it is impossible to determine the unique input value from the hash value. Simply put, it is a function that compresses a message of arbitrary length into a message digest of a fixed length.

[0101] (6) The IoT platform is an integrated platform that integrates capabilities such as device management, data security communication, and message subscription. It supports connecting to a large number of devices and collecting device data to the cloud. It also provides a cloud API, which allows the server to send commands to the device by calling the cloud API, enabling remote control. This system serves as a unified management platform for a large number of devices.

[0102] (7) Terminal devices are intermediate devices between the sensor network layer and the transmission network layer, and are also key devices in the Internet of Things. Through their conversion and collection, various external sensory data can be collected and processed, and the data can be transmitted to the Internet through various network interfaces. The terminal devices in the embodiments of the present disclosure are mainly display terminal devices, such as monitors, all-in-one conference machines, etc.

[0103] Figure 1 is a schematic diagram of an identity authentication method provided in some embodiments of the present disclosure, and the identity authentication method shown in Figure 1 is applied to an Internet of Things platform. As shown in Figure 1, the identity authentication method includes the following steps S110 to S130.

[0104] S110. The IoT platform receives the encryption certificate and signature certificate sent by the terminal device, and verifies the legitimacy of the encryption certificate and signature certificate based on the public key certificate sent in advance by the authentication server.

[0105] Before identity authentication, the terminal device can receive an encryption certificate and a signature certificate issued by the authentication server (i.e., the aforementioned CA all-in-one machine). The encryption certificate records the first public key PUB_A of the terminal device, and the signature certificate records the second public key PUB_C of the authentication server. In step S110, the IoT platform verifies the legitimacy of the encryption certificate and the signature certificate. That is, the IoT platform verifies whether the encryption certificate and the signature certificate actually sent by the terminal device are issued by the authentication server.

[0106] Among them, the public key certificate sent by the authentication server records the third public key PUB_B of the authentication server. When verifying the legitimacy of the encryption certificate and signature certificate, the IoT platform uses the third public key to verify the encryption certificate and signature certificate. If the verification is successful, it means that the encryption certificate and signature certificate are legal.

[0107] S120. When the encryption certificate and the signature certificate are verified, the IoT platform extracts the first public key PUB_A of the terminal device from the encryption certificate, and extracts the second public key PUB_C of the authentication server from the signature certificate.

[0108] S130. The IoT platform performs two-way identity authentication with the terminal device based on the first public key PUB_A, the second public key PUB_C, and the fourth public key PUB_D of the IoT platform.

[0109] In some embodiments, step S130 comprises steps S131 to S134.

[0110] S131. The IoT platform encrypts a first random number based on a first public key PUB_A to generate a first ciphertext, wherein the first random number is randomly generated by the IoT platform using a server cryptographic machine.

[0111] S132. The IoT platform sends the first ciphertext to the terminal device, so that the terminal device decrypts the first ciphertext and generates signature data.

[0112] It is understandable that the terminal device stores a first private key PRI_A that is paired with the first public key PUB_A. When decrypting the first ciphertext, the first private key PRI_A is used for decryption.

[0113] In some embodiments, the signature data is generated by encrypting and signing the terminal device based on the fourth public key PUB_D of the IoT platform, the pre-obtained second private key PRI_C, and the decryption result of the first ciphertext. The second private key PRI_C is paired with the second public key PUB_C. The terminal device can obtain the fourth public key PUB_D and the second private key PRI_C in advance before performing the identity authentication process.

[0114] Among them, when generating signature data, the terminal device can perform an encryption operation based on the decryption result of the first ciphertext and the fourth public key PUB_D, and then use the second private key PRI_C to perform a signing operation. For example, the terminal device can directly use the fourth public key PUB_D to encrypt the decryption result of the first ciphertext to generate first encrypted data; then use the second private key PRI_C to sign the first encrypted data to generate signature data (hereinafter referred to as method one). For another example, method two: the terminal device can concatenate the decryption result of the first ciphertext with another random number, and then use the fourth public key PUB_D to encrypt the concatenated data to generate second encrypted data, and then use the second private key PRI_C to sign the second encrypted data to generate signature data (hereinafter referred to as method two).

[0115] S133. The IoT platform obtains decrypted data based on the second public key PUB_C in response to the signature data.

[0116] Among them, the Internet of Things platform can verify the signature data, and then decrypt the ciphertext obtained after successful verification to obtain decrypted data.

[0117] S134. The IoT platform matches the first random number with the decrypted data. If the match is successful, it is determined that the identity authentication of the terminal device is successful; otherwise, it is determined that the identity authentication of the terminal device has failed.

[0118] For example, in some embodiments, the terminal device generates signature data using the aforementioned method 1. In this case, in step S134, if the IoT platform determines that the first random number and the decrypted data are identical, a match is successful. In other embodiments, the terminal device generates signature data using the aforementioned method 2. In this case, in step S134, if the IoT platform determines that a portion of the decrypted data is identical to the first random number, a match is successful.

[0119] When the first random number matches the decrypted data, it indicates that in S130 , the private keys used by the device terminal and the private keys used by the IoT platform are all safe, that is, the terminal device identity authentication is successful.

[0120] In the embodiment of the present disclosure, the Internet of Things platform verifies the encryption certificate and signature certificate sent by the terminal device, so as to determine whether the encryption certificate and signature certificate are certificates issued by the authentication server; after determining that both certificates are certificates issued by the authentication server, based on the first random number, the first public key PUB_A and the second public key PUB_C extracted from the two certificates, a two-way identity authentication is performed with the terminal device. When the decrypted data finally returned from the terminal device matches the initial first random number, it indicates that the private key used in the authentication process is safe, thereby determining that the identity authentication of the terminal device is successful, thereby ensuring the legality and security of the terminal device's access to the Internet of Things platform.

[0121] In a specific example, the signature data is generated by the terminal device using the second private key PRI_C to sign the second ciphertext; the second ciphertext is generated by the terminal device using the fourth public key PUB_D to encrypt the second random number R_S|R_D, and the second random number is the decryption result of the first ciphertext and the third random number concatenated together.

[0122] For example, the first random number is n-bit data, the third random number is m-bit data, and the second random number is the concatenation of the decrypted result of the first ciphertext and the third random number, with the third random number being located before the decrypted result of the first ciphertext. In this case, in step S134, if the IoT platform determines that the last n bits of the decrypted data are the same as the first random number, then the terminal device's identity authentication is determined to be successful.

[0123] FIG2 is a flowchart of a specific implementation method of step S133 provided in some embodiments of the present disclosure. As shown in FIG2 , step S133 may include the following steps S133a to S133b.

[0124] S133a. The IoT platform verifies the signature data using the second public key PUB_C.

[0125] When the signature verification succeeds, step S133b is performed: extracting the second ciphertext in the signature data, and decrypting the second ciphertext using the fourth private key to obtain decrypted data.

[0126] FIG3 is a flowchart of verification of an encryption certificate and a signature certificate provided in some embodiments of the present disclosure. As shown in FIG3 , the process of verifying the legitimacy of the encryption certificate and the signature certificate may include the following steps S110 a - S110 b .

[0127] S110a. The IoT platform obtains the third public key PUB_B of the authentication server from the public key certificate sent in advance by the authentication server.

[0128] S110b. The IoT platform uses the third public key to verify the signature of the encryption certificate; if the encryption certificate passes the verification, the encryption certificate is determined to be legal; the IoT platform uses the third public key to verify the signature of the signature certificate; if the signature certificate passes the verification, the signature certificate is determined to be legal.

[0129] The IoT platform uses the public key of the authentication server to verify the encryption certificate and signature certificate, so as to determine whether the encryption certificate and signature integer sent by the terminal device are issued by the authentication server.

[0130] FIG4 is a schematic diagram of an identity authentication method provided in some other embodiments of the present disclosure. As shown in FIG4 , in some embodiments, when it is determined that the identity authentication of the terminal device is successful, the identity authentication method further includes:

[0131] S140: Use the decrypted data obtained in step S133 as the negotiation key.

[0132] S150: Encrypt the authentication success message using the negotiated secret key to generate an authentication message ciphertext, and send the authentication message ciphertext to the terminal device.

[0133] The authentication success message is generated by the IoT platform and is used to indicate that the terminal device has been successfully authenticated.

[0134] If the identity authentication is successful, the decrypted data obtained by the IoT platform is identical to the second random number. After the IoT platform encrypts the authentication success message using the decrypted data, the terminal device can decrypt the authentication success message using the second random number, thereby confirming the identity authentication success. Subsequently, the terminal device can communicate with the IoT platform using the second random number (i.e., the decrypted data obtained in step S133).

[0135] In some embodiments, the identity authentication method may further include a certificate issuance process performed before step S110. FIG5 is a schematic diagram of a certificate issuance process provided in some embodiments of the present disclosure. As shown in FIG5 , the certificate issuance process includes:

[0136] S101. The IoT platform generates a fourth public key PUB_D and a fourth private key PRI_D that are matched in pair.

[0137] The IoT platform can use the server cryptographic machine to generate a fourth public key PUB_D and a fourth private key PRI_D. The fourth private key PRI_D is stored by the IoT platform itself.

[0138] S102. The Internet of Things platform sends the fourth public key PUB_D to the authentication server, so that the authentication server uses the third private key PRI_B to sign the fourth public key PUB_D to generate a platform certificate.

[0139] S103. The Internet of Things platform receives and stores the platform certificate and public key certificate sent by the authentication server.

[0140] The public key certificate records a third public key PUB_B that is paired with the third private key PRI_B.

[0141] Of course, in other embodiments, the authentication server may not send the platform certificate to the Internet of Things platform.

[0142] Figure 6 is a schematic diagram of an identity authentication method provided in some other embodiments of the present disclosure. The identity authentication method shown in Figure 6 is applied to a terminal device. The terminal device can be a display terminal device or other terminal device. The terminal device may include a security chip, and the identity authentication method can be performed by the security chip. As shown in Figure 6, the identity authentication method includes the following steps S210 to S220.

[0143] S210. The terminal device submits the encryption certificate and the signature certificate to the Internet of Things platform, so that the Internet of Things platform can extract the first public key PUB_A from the encryption certificate and the second public key PUB_C of the authentication server from the signature certificate when determining that the encryption certificate and the signature certificate are legal.

[0144] S220. When the encryption certificate and signature certificate are verified, the terminal device performs two-way identity authentication with the Internet of Things platform based on the pre-obtained second private key PRI_C of the authentication server, the fourth public key PUB_B of the Internet of Things platform, and the first private key PRI_A of the terminal device.

[0145] Step S220 may specifically include:

[0146] S221. When the encryption certificate and signature certificate are verified, the terminal device receives the first ciphertext sent by the Internet of Things platform.

[0147] S222: The terminal device decrypts the first ciphertext using its first private key, wherein the first public key PUB_A and the first private key PRI_A are paired.

[0148] S223. The terminal device generates signature data based on the decryption result of the first ciphertext.

[0149] S224: The terminal device sends the signed data to the IoT platform, so that the IoT platform can obtain decrypted data based on the second public key PUB_C. After obtaining the decrypted data, the IoT platform can authenticate the identity of the terminal device based on the decrypted data.

[0150] In some embodiments, step S223 may include: encrypting and signing based on the fourth public key PUB_D of the IoT platform, the pre-obtained second private key PRI_C, and the decryption result of the first ciphertext to generate the signature data. The second public key PUB_C and the second private key PRI_C are paired; and both the second private key PUB_C and the fourth public key PUB_D are pre-obtained by the terminal device.

[0151] FIG7 is a flow chart of an optional implementation of S223 provided in some embodiments of the present disclosure. As shown in FIG7 , step S223 may include the following steps S223a to S223c.

[0152] S223a. The terminal device concatenates the decryption result of the first ciphertext and the third random number to generate a second random number.

[0153] For example, the first random number is n-bit data, the third random number is m-bit data, and the decryption result of the first random number is concatenated with the third random number to obtain the second random number.

[0154] S223b. The terminal device encrypts the second random number using the fourth public key PUB_D to generate a second ciphertext.

[0155] S223c. The terminal device signs the second ciphertext using the second private key PRI_C to generate signature data.

[0156] FIG8 is a flow chart of an identity authentication method provided in some other embodiments of the present disclosure. As shown in FIG8 , the identity authentication method may further include step S230 in addition to the above steps S210 to S223 .

[0157] S230. The terminal device responds to the authentication message ciphertext sent by the Internet of Things platform, uses the second random number as the negotiated secret key, decrypts the authentication message ciphertext, and obtains an authentication success message.

[0158] It's understood that the ciphertext authentication message is generated by the IoT platform after it encrypts the authentication success message after confirming that the terminal device's identity has been successfully authenticated. Therefore, when the IoT platform generates and sends the ciphertext authentication message, the second random number is the same as the decryption data used by the IoT platform for encryption. After the terminal device decrypts the ciphertext authentication message using the second random number, it obtains the plaintext authentication success message generated by the IoT platform, thereby confirming that the device's identity has been successfully authenticated.

[0159] In some embodiments, the identity authentication method may further include a certificate issuance process performed before step S210. FIG9 is a schematic diagram of a certificate issuance process provided in some embodiments of the present disclosure. As shown in FIG9 , the certificate issuance process includes S201 to S204:

[0160] S201. The terminal device generates a first public key PUB_A and a first private key PRI_A that are matched in pair.

[0161] S202. The terminal device sends the first public key PUB_A to the authentication server, so that the authentication server uses the third private key PRI_B to sign the first public key PUB_A to generate an encryption certificate.

[0162] S203: The terminal device receives and stores the encryption certificate, signature certificate, and platform certificate sent by the authentication server. The platform certificate contains the fourth public key PUB_D of the IoT platform, and the signature certificate is generated by the authentication server signing the second public key PUB_C using the third private key PRI_B.

[0163] S204: In response to the private key ciphertext sent by the authentication server, the terminal device decrypts the private key ciphertext using the first private key PRI_A to obtain and store the second private key PRI_C. The private key ciphertext is generated by the authentication server encrypting the second private key PRI_C using the first public key PUB_A.

[0164] FIG10 is a flow chart of a certificate issuance method provided in some embodiments of the present disclosure, which is applied to an authentication server. As shown in FIG10 , the certificate issuance method includes the following steps S310 to S350:

[0165] S310: The authentication server generates a third private key PRI_B and a public key certificate. The public key certificate records a third public key PUB_B that is paired with the third private key PRI_B.

[0166] S320: In response to the first public key PUB_A sent by the terminal device, the authentication server signs the first public key PUB_A using the third public key PUB_B, generates an encryption certificate, and sends it to the terminal device. After receiving the encryption certificate, the terminal device saves it and sends it to the IoT platform during the identity authentication process.

[0167] S330: The authentication server signs its second public key PUB_C using its third private key PRI_B, generates a signed certificate, and sends it to the terminal device. The terminal device saves the signed certificate after receiving it and sends it to the IoT platform during the identity authentication process.

[0168] S340: The authentication server sends the public key certificate to the IoT platform, which verifies the legitimacy of the encryption certificate and signature certificate from the terminal device based on the public key certificate. The public key certificate contains a third public key, PUB_B. During the identity authentication process, the IoT platform can extract the third public key, PUB_B, from the public key certificate and use it to verify whether the encryption certificate and signature certificate uploaded by the terminal device were issued by the authentication server.

[0169] In some embodiments, the certificate issuance method further includes: S350, the authentication server encrypts the second private key PRI_C, generates a private key ciphertext, and sends the private key ciphertext to the terminal device, so that the terminal device decrypts the private key ciphertext to obtain the second private key PRI_C.

[0170] The authentication server can use the terminal device's first public key PUB_A to encrypt the second private key PRI_C, generating a private key ciphertext. Upon receiving the private key ciphertext, the terminal device decrypts it using its stored first private key PRI_A to obtain and store the second private key PRI_C. During subsequent identity authentication, the terminal device can use the second private key PRI_C to sign data.

[0171] The order of steps S320 to S350 is not particularly limited.

[0172] FIG11 is a flowchart of a certificate issuing method provided in some other embodiments of the present disclosure. As shown in FIG11 , the certificate issuing method further includes steps S325 to S326.

[0173] S325 . The authentication server responds to the fourth public key PUB_D sent by the IoT platform, signs the fourth public key PUB_D using the third private key PRI_B, and generates a platform certificate.

[0174] S326: The authentication server sends the platform certificate to the terminal device. The terminal device can extract the fourth public key PUB_D of the Internet of Things platform from the platform certificate.

[0175] The authentication server may also send the platform certificate to the IoT platform at the same time.

[0176] The following describes the identity authentication method of the identity authentication system. The identity authentication system includes a terminal device, an authentication server, and an IoT platform. The identity authentication method includes a certificate issuance process and an identity authentication process. Figure 12 illustrates the interaction between the terminal device, the authentication server, and the IoT platform during the certificate issuance process, while Figure 13 illustrates the identity authentication process. As shown in Figure 12, the certificate issuance process includes the following steps, S401 to S406.

[0177] S401: The IoT terminal generates a first public key PUB_A and a first private key PRI_A that are paired together. The authentication server generates a second public key PUB_C and a second private key PRI_C that are paired together, as well as a third private key PRI_B and a public key certificate CER_B. The public key certificate CER_B contains the third public key PUB_B that is paired together with the third private key PRI_B. The IoT platform generates a fourth public key PUB_D and a fourth private key PRI_D that are paired together.

[0178] S402. The terminal device submits the first public key PUB_A to the authentication server. The authentication server uses its third private key PRI_B to sign the first public key PUB_A, generates an encryption certificate CER_A, and sends the encryption certificate CER_A to the terminal device.

[0179] S403: The authentication server sends the public key certificate CER_B to the IoT platform.

[0180] S404: The IoT platform submits the fourth public key PUB_D to the authentication server. The authentication server signs the fourth public key PUB_D using the third private key PRI_B, generates a platform certificate CER_D for the IoT platform, and sends the platform certificate CER_D to the terminal device. Simultaneously, the platform certificate CER_D can also be sent to the IoT platform.

[0181] S405 : The authentication server signs the second public key PUB_C using the third private key PRI_B, generates a signature certificate CER_C, and returns the signature certificate CER_C to the terminal device.

[0182] S406. The authentication server uses the first public key PUB_A to encrypt the second private key PRI_C to generate a private key ciphertext PRI_C_ENR, and returns the private key ciphertext PRI_C_ENR to the terminal device. The terminal device uses its first private key PRI_A to decrypt the private key ciphertext PRI_C_ENR to obtain the second private key PRI_C and stores it.

[0183] After the certificate issuance process is complete, the terminal device stores: the first private key PRI_A and the corresponding encryption certificate CER_A; the second private key PRI_C and the corresponding signature certificate CER_C; and the IoT platform's platform certificate CER_D. The authentication server stores: the third private key PRI_B and the corresponding public key certificate CER_B; the second private key PRI_C and the corresponding second public key PUB_C. The IoT platform stores: the fourth private key PRI_D and the platform certificate CER_D, and the authentication server's public key certificate CER_B.

[0184] As shown in Figure 13, the identity authentication process includes the following steps:

[0185] S501. The terminal device sends the encryption certificate CER_A and the signature certificate CER_C to the IoT platform.

[0186] S502: The IoT platform uses public key certificate CER_B to verify the signature of encryption certificate CER_A, verifying its legitimacy. Specifically, it verifies whether encryption certificate CER_A is a digital certificate issued by the authentication server. If verification succeeds, the IoT platform extracts the first public key PUB_A from encryption certificate CER_A and proceeds to step S503. If verification fails, the process ends.

[0187] S503: The IoT platform uses public key certificate CER_B to verify the signature of signature certificate CER_C, verifying its legitimacy. Specifically, it verifies whether signature certificate CER_C is a digital certificate issued by the authentication server. If verification of signature certificate CER_C succeeds, the IoT platform extracts the second public key PUB_C from signature certificate CER_C and proceeds to step 504. If verification of signature certificate CER_C fails, the process ends.

[0188] Through steps S501 to S503, the IoT platform completes the verification of the encryption certificate CER_A and signature certificate CER_C sent by the terminal device.

[0189] S504: The IoT platform generates a first random number R_S.

[0190] S505. The IoT platform encrypts the first random number R_S using the first public key PUB_A to generate a first ciphertext [R_S], and sends the first ciphertext [R_S] to the IoT terminal.

[0191] S506. The terminal device decrypts the first ciphertext [R_S] using its first private key PRI_A to obtain first decrypted data R_S'.

[0192] S507. The terminal device extracts the fourth public key PUB_D from the platform certificate CER_D, generates a third random number R_D, concatenates the third random number with the first decrypted data R_S' to obtain a second random number R_D|R_S', and then uses the fourth public key PUB_D to encrypt the second random number R_D|R_S' to generate a second ciphertext [R_D|R_S'].

[0193] S508. The terminal device signs the second ciphertext [R_D|R_S'] using the second private key PRI_C to generate signature data [R_D|R_S']|SIGN, and sends the signature data [R_D|R_S']|SIGN to the IoT platform.

[0194] S509: The IoT platform verifies the signature data [R_D|R_S']|SIGN using the second public key PUB_C. If the verification fails, the process ends. If the verification succeeds, the process proceeds to step S510.

[0195] S510. The IoT platform extracts the second ciphertext [R_D|R_S'] from the signature data [R_D|R_S']|SIGN, and decrypts the second ciphertext [R_D|R_S'] using the fourth private key PRI_D to obtain the second decrypted data R_D0|R_S0.

[0196] S511. The IoT platform determines whether the second decrypted data matches the first random number. If so, it determines that the identity authentication of the terminal device is successful.

[0197] Among them, since the Internet of Things platform cannot determine the real data of the third random number R_D, in step S511, the Internet of Things platform only needs to determine whether R_S0 in the second decrypted data is the same as the first random number R_S. If the two are the same, it is considered that the second decrypted data and the first random number match.

[0198] The IoT platform and the terminal device may pre-agreed on a concatenation rule for the first decrypted data and the third random number. For example, the first decrypted data may be concatenated after the third random number to generate the second random number. In this case, in step S511, the IoT platform can simply determine whether the last n bits of the second decrypted data are the same as the first random number R_S, where n is the number of bits in the first random number R_S.

[0199] When it is determined in step S511 that the identity authentication of the terminal device is successful, the IoT platform and the terminal device believe that the second decrypted data and the second random number R_D|R_S are the same, and thus use the second decrypted data (ie, the second random number R_D|R_S) as the negotiation key and execute step S512.

[0200] S512: The IoT platform generates an authentication success message, which indicates that the identity authentication of the device terminal is successful.

[0201] S513. The IoT platform encrypts the authentication success message using the negotiated key to generate a ciphertext message, and sends the ciphertext message to the terminal device.

[0202] S514: After receiving the ciphertext message, the terminal device decrypts the ciphertext message using the negotiated key to obtain the plaintext authentication success message. The terminal device can then determine that the identity authentication is successful. The negotiated key is used as the key for subsequent communications.

[0203] FIG14 is a schematic diagram of an Internet of Things platform provided in some embodiments of the present disclosure. As shown in FIG14 , the Internet of Things platform includes: a verification module 110 , an extraction module 120 and a first identity authentication module 130 .

[0204] The verification module 110 is configured to receive the encryption certificate and the signature certificate sent by the terminal device, and verify the legitimacy of the encryption certificate and the signature certificate based on the public key certificate sent in advance by the authentication server.

[0205] The extraction module 120 is configured to extract the first public key of the terminal device from the encryption certificate and extract the second public key of the authentication server from the signature certificate when the encryption certificate and the signature certificate are verified successfully.

[0206] The first identity authentication module 130 is configured to encrypt a first random number based on the first public key to generate a first ciphertext; send the first ciphertext to the terminal device so that the terminal device can decrypt the first ciphertext and generate signature data; obtain decrypted data based on the second public key in response to the signature data; match the first random number with the decrypted data, and if a match is successful, determine that the identity authentication of the terminal device is successful. The first random number is randomly generated by the IoT platform using a server cryptographic machine.

[0207] The signature data is generated by the terminal device through encryption and signing based on the fourth public key of the IoT platform, the pre-obtained second private key, and the decryption result of the first ciphertext; the second private key and the second public key are paired. When the decrypted data is obtained, the signature is verified and decrypted based on the second public key, the fourth private key of the IoT platform, and the signature data to obtain the decrypted data.

[0208] In some embodiments, the first identity authentication module 130 performs signature verification and decryption based on the second public key, the fourth private key of the IoT device and the signature data, specifically including: verifying the signature data using the second public key; and if the verification is successful, decrypting the second ciphertext obtained by the verification using the fourth private key.

[0209] In some embodiments, the Internet of Things platform may also include a message sending module, which is configured to use the decrypted data as a negotiation key when it is determined that the identity authentication of the terminal device is successful; use the negotiation key to encrypt the authentication success message, generate an authentication message ciphertext, and send the authentication message ciphertext to the terminal device.

[0210] In some embodiments, the verification module 110 verifies the legitimacy of the encryption certificate and the signature certificate based on the public key certificate pre-sent by the authentication server, specifically including: obtaining the third public key of the authentication server from the public key certificate pre-sent by the authentication server; using the third public key to verify the encryption certificate; if the encryption certificate passes the verification, it is determined that the encryption certificate is legal, and using the third public key to verify the signature certificate; if the signature certificate passes the verification, it is determined that the signature certificate is legal.

[0211] In some embodiments, the IoT platform may further include: a first key generation module and a first storage module. The first key generation module is configured to generate a fourth public key and a fourth private key that are paired together, and send the fourth public key to an authentication server, for the authentication server to sign the fourth public key using a third private key to generate a platform certificate. The first storage module is configured to receive and store the public key certificate sent by the authentication server. The public key certificate records a third public key that is paired with the third private key.

[0212] FIG15 is a schematic diagram of a terminal device provided in some embodiments of the present disclosure. As shown in FIG15 , the terminal device includes: a sending module 210 and a second identity authentication module 220 .

[0213] The sending module 210 is configured to submit the encryption certificate and the signature certificate to the Internet of Things platform, so that the Internet of Things platform can extract the first public key from the encryption certificate and the second public key of the authentication server from the signature certificate when determining that the encryption certificate and the signature certificate are legal.

[0214] The second identity authentication module 220 is configured to, if the encryption certificate and the signature certificate are verified successfully, receive the first ciphertext sent by the IoT platform; decrypt the first ciphertext using the first private key of the terminal device; generate signature data based on the decryption result of the first ciphertext; and send the signature data to the IoT platform so that the IoT platform can obtain decrypted data based on the second public key and authenticate the identity of the terminal device based on the decrypted data. The first public key and the first private key are paired.

[0215] When generating the signature data, encryption and signing are performed based on the decryption result of the first ciphertext, the fourth public key of the IoT platform, and the pre-obtained second private key to generate the signature data. The second public key and the second private key are paired.

[0216] The terminal device may include a security chip, and the sending module 210 and the second identity authentication module 220 may be integrated into the security chip.

[0217] In some embodiments, the second identity authentication module 220 encrypts and signs based on the fourth public key of the Internet of Things platform, the second private key, and the decryption result of the first ciphertext, specifically including: concatenating the decryption result of the first ciphertext with the third random number to generate a second random number; encrypting the second random number using the fourth public key to generate a second ciphertext; and signing the second ciphertext using the second private key to generate the signature data.

[0218] In some embodiments, the terminal device further includes: a decryption module configured to respond to the authentication message ciphertext sent by the Internet of Things platform, use the second random number as a negotiated key, decrypt the authentication message ciphertext, and obtain an authentication success message.

[0219] In some embodiments, the terminal device further includes: a second key generation module and a second storage module, the second key generation module being configured to generate a pair of matching first public key and first private key; sending the first public key to the authentication server, so that the authentication server can sign the first public key using a third private key to generate an encryption certificate. The second storage module is configured to receive and store the encryption certificate, signature certificate, and platform certificate sent by the authentication server; and in response to the private key ciphertext sent by the authentication server, decrypt the private key ciphertext using the first private key to obtain and store the second private key.

[0220] FIG16 is a schematic diagram of an authentication server provided in some embodiments of the present disclosure. As shown in FIG16 , the authentication server includes a generation module 310 and a certificate issuance module 320 .

[0221] The generating module 310 is configured to generate a third private key and a public key certificate, wherein the public key certificate records a third public key that is paired with the third private key.

[0222] The certificate issuing module 320 is configured to, in response to the first public key sent by the terminal device, sign the first public key using the third public key to generate an encryption certificate and send it to the terminal device. It is also configured to sign the second public key of the authentication server using the third private key to generate a signed certificate and send it to the terminal device. Furthermore, the module sends the public key certificate to the IoT platform, so that the IoT platform can verify the legitimacy of the encryption certificate and signed certificate from the terminal device based on the public key certificate.

[0223] In some embodiments, the authentication server further includes an encryption module configured to encrypt the second private key, generate a private key ciphertext, and send the private key ciphertext to the terminal device so that the terminal device can decrypt the private key ciphertext to obtain the second private key.

[0224] In some embodiments, the certificate issuing module 320 is further configured to, in response to the fourth public key sent by the IoT platform, sign the fourth public key using the third private key to generate a platform certificate; and send the platform certificate to the terminal device and the IoT platform.

[0225] FIG17 is a schematic diagram of an identity authentication system provided in some embodiments of the present disclosure. As shown in FIG17 , the identity authentication system includes: the Internet of Things platform 100, the terminal device 200, and the authentication server 300 in the above-mentioned embodiments.

[0226] The present disclosure also provides an electronic device, comprising:

[0227] one or more processors;

[0228] A memory having one or more programs stored thereon, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the above-mentioned identity authentication methods or certificate issuance methods.

[0229] The electronic device also includes one or more I / O interfaces connected between the processor and the memory, and configured to implement information interaction between the processor and the memory.

[0230] Among them, the processor is a device with data processing capabilities, including but not limited to the central processing unit (CPU); the memory is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically such as SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH); the I / O interface (read-write interface) is connected between the processor and the memory, which can realize information exchange between the processor and the memory, including but not limited to the data bus (Bus), etc.

[0231] In some embodiments, the processor, memory, and I / O interface are connected to each other and, in turn, to other components of the computing device via a bus.

[0232] This embodiment also provides a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the identity authentication method or certificate issuance method provided in this embodiment is implemented. To avoid repeated description, the specific steps of the method are not repeated here.

[0233] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As is well known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable, and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0234] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0235] It is understood that the above embodiments are merely exemplary embodiments for illustrating the principles of the present disclosure, and the present disclosure is not limited thereto. Those skilled in the art may make various modifications and improvements without departing from the spirit and substance of the present disclosure, and such modifications and improvements are also considered to be within the scope of protection of the present disclosure.

Claims

1. An identity authentication method, applied to the Internet of Things platform, in, The method comprises: Receive the encryption certificate and signature certificate sent by the terminal device, and verify the legitimacy of the encryption certificate and the signature certificate based on the public key certificate sent in advance by the authentication server; When the encryption certificate and the signature certificate are verified, extracting the first public key of the terminal device from the encryption certificate, and extracting the second public key of the authentication server from the signature certificate; Encrypting the first random number based on the first public key to generate a first ciphertext; wherein the first random number is data randomly generated by the Internet of Things platform using a server cryptographic machine; Sending the first ciphertext to the terminal device, so that the terminal device decrypts the first ciphertext and generates signature data; In response to the signature data, obtaining decrypted data based on the second public key; The first random number is matched with the decrypted data, and if the match is successful, it is determined that the identity authentication of the terminal device is successful.

2. The identity authentication method according to claim 1, in, The signature data is generated by the terminal device after encryption and signing based on the fourth public key of the Internet of Things platform, the second private key obtained in advance, and the decryption result of the first ciphertext, and the second private key and the second public key are matched in pairs; The decrypted data is obtained by verifying and decrypting the signature data based on the second public key and the fourth private key of the Internet of Things platform.

3. The identity authentication method according to claim 1 or 2, in, The signature data is generated by the terminal device using the second private key to sign the second ciphertext; the second ciphertext is generated by the terminal device using the fourth public key to encrypt the second random number, and the second random number is the data of the decryption result of the first ciphertext and the third random number concatenated in series.

4. The identity authentication method according to claim 3, in, In response to the signature data, obtaining decrypted data based on the second public key specifically includes: In response to the signature data, verifying the signature data using the second public key; When the signature verification is successful, the fourth private key is used to decrypt the second ciphertext obtained by the signature verification.

5. The identity authentication method according to claim 3, in, When it is determined that the identity authentication of the terminal device is successful, the method further includes: Using the decrypted data as a negotiation key; The authentication success message is encrypted using the negotiated secret key to generate an authentication message ciphertext, and the authentication message ciphertext is sent to the terminal device.

6. The identity authentication method according to any one of claims 1 to 5, in, The verification of the legitimacy of the encryption certificate and the signature certificate based on the public key certificate sent in advance by the authentication server specifically includes: Obtaining a third public key of the authentication server from the public key certificate sent in advance by the authentication server; Verifying the signature of the encryption certificate using the third public key; If the encryption certificate passes the signature verification, it is determined that the encryption certificate is legal, and the signature certificate is verified using the third public key; if the signature certificate passes the signature verification, it is determined that the signature certificate is legal.

7. The identity authentication method according to any one of claims 1 to 6, in, Before the step of receiving the encryption certificate and the signature certificate sent by the terminal device, the method further includes: Receive and store the public key certificate sent by the authentication server; wherein the public key certificate A third public key that matches the third private key in pair is recorded; Generate a fourth public key and a fourth private key that match in pair; The fourth public key is sent to the authentication server, so that the authentication server signs the fourth public key using the third private key to generate a platform certificate.

8. An identity authentication method, applied to a terminal device, in, The method comprises: Submitting the encryption certificate and the signature certificate to the Internet of Things platform, so that the Internet of Things platform, when determining that the encryption certificate and the signature certificate are legitimate, extracts the first public key from the encryption certificate and extracts the second public key of the authentication server from the signature certificate; When the encryption certificate and the signature certificate are verified, receiving a first ciphertext sent by the Internet of Things platform; Decrypting the first ciphertext using a first private key of the terminal device; wherein the first public key and the first private key are matched in pair; Generate signature data based on the decryption result of the first ciphertext; The signature data is sent to the Internet of Things platform so that the Internet of Things platform obtains decrypted data based on the second public key and authenticates the identity of the terminal device based on the decrypted data.

9. The identity authentication method according to claim 8, in, Generating signature data based on the decryption result of the first ciphertext specifically includes: Encryption and signing are performed based on the fourth public key of the Internet of Things platform, the second private key obtained in advance, and the decryption result of the first ciphertext to generate the signature data; wherein the second public key and the second private key are matched in pair.

10. The identity authentication method according to claim 9, in, Encrypting and signing based on the fourth public key of the Internet of Things platform, the second private key obtained in advance, and the decryption result of the first ciphertext to generate the signature data specifically includes: Concatenate the decryption result of the first ciphertext and the third random number in series to generate a second random number; Encrypting the second random number using the fourth public key to generate a second ciphertext; The second ciphertext is signed using the second private key to generate the signature data.

11. The identity authentication method according to claim 10, in, The method further comprises: In response to the authentication message ciphertext sent by the Internet of Things platform, the second random number is used as a negotiated secret key to decrypt the authentication message ciphertext to obtain an authentication success message.

12. The identity authentication method according to any one of claims 8 to 11, in, Before the step of submitting the encryption certificate and the signature certificate to the Internet of Things platform, the method further includes: Generate a first public key and a first private key that match in pair; Sending the first public key to the authentication server, so that the authentication server signs the first public key using a third private key to generate an encryption certificate; Receive and store the encryption certificate, signature certificate, and platform certificate sent by the authentication server; the platform certificate records the fourth public key of the Internet of Things platform, and the signature certificate is generated by the authentication server signing the second public key using the third private key; In response to the private key ciphertext sent by the authentication server, the private key ciphertext is decrypted using the first private key to obtain and store the second private key.

13. A certificate issuance method, applied to an authentication server, in, The method comprises: Generate a third private key and a public key certificate, wherein the public key certificate records a third public key that matches the third private key in pair; In response to the first public key sent by the terminal device, use the third public key to sign the first public key, generate an encryption certificate and send it to the terminal device; Sign the second public key of the authentication server using the third private key, generate a signed certificate and send it to the terminal device; The public key certificate is sent to the IoT platform so that the IoT platform can verify the legitimacy of the encryption certificate and signature certificate from the terminal device based on the public key certificate.

14. The certificate issuing method according to claim 13, in, The method further comprises: Encrypting the second private key to generate a private key ciphertext, and sending the private key ciphertext to the terminal device so that the terminal device can decrypt the private key ciphertext to obtain the second private key; The second private key and the second public key are matched in pair.

15. The certificate issuing method according to claim 13, in, The method further comprises: In response to the fourth public key sent by the Internet of Things platform, signing the fourth public key using the third private key to generate a platform certificate; The platform certificate is sent to the terminal device.

16. An Internet of Things platform, include: A verification module is configured to receive the encryption certificate and the signature certificate sent by the terminal device, and verify the legitimacy of the encryption certificate and the signature certificate based on the public key certificate sent in advance by the authentication server; an extraction module, configured to extract the first public key of the terminal device from the encryption certificate and the second public key of the authentication server from the signature certificate when the encryption certificate and the signature certificate are verified; A first identity authentication module is configured to encrypt a first random number based on the first public key to generate a first ciphertext; Sending the first ciphertext to the terminal device, so that the terminal device decrypts the first ciphertext and generates signature data; In response to the signature data, decrypted data is obtained based on the second public key; the first random number is matched with the decrypted data, and if the match is successful, it is determined that the identity authentication of the terminal device is successful; Among them, the first random number is randomly generated by the Internet of Things platform using the server cryptographic machine data.

17. A terminal device, include: A sending module is configured to submit an encryption certificate and a signature certificate to the Internet of Things platform, so that the Internet of Things platform, when determining that the encryption certificate and the signature certificate are legal, extracts a first public key from the encryption certificate and extracts a second public key of the authentication server from the signature certificate; The second identity authentication module is configured to receive the first ciphertext sent by the Internet of Things platform when the encryption certificate and the signature certificate are verified; decrypt the first ciphertext using the first private key of the terminal device; and generate signature data based on the decryption result of the first ciphertext; Sending the signature data to the Internet of Things platform, so that the Internet of Things platform obtains decrypted data based on the second public key, and authenticates the identity of the terminal device based on the decrypted data; The first public key and the first private key are matched in pair.

18. An authentication server, include: A generating module, configured to generate a third private key and a public key certificate, wherein the public key certificate records a third public key that matches the third private key in pair; a certificate issuing module, in response to the first public key sent by the terminal device, using the third public key to sign the first public key, generating an encrypted certificate and sending it to the terminal device; Sign the second public key of the authentication server using the third private key, generate a signed certificate and send it to the terminal device; The public key certificate is sent to the IoT platform so that the IoT platform can verify the legitimacy of the encryption certificate and signature certificate from the terminal device based on the public key certificate.

19. An identity authentication system, include: The Internet of Things platform as claimed in claim 16, the terminal device as claimed in claim 17, and the authentication server as claimed in claim 18.

20. An electronic device, wherein include: one or more processors; A storage device having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1-7, claims 8-12 or 13-15.

21. A computer readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method according to any one of claims 1 to 7, claims 8 to 12 or claims 13 to 15 is implemented.

Images