Internet of Things authentication system and method

Abstract

The invention provides an Internet of Things authentication system and method. The method comprises the following steps: receiving an access authentication signal of Internet of Things equipment; extracting a channel authentication feature of each block chain node, and respectively masking each channel authentication feature to obtain an authentication masking feature of each block chain node; generating an authentication master key of the block chain node according to the authentication masking feature of the block chain node and the node attribute set, converting the block chain node into block chain encryption nodes based on the authentication master key and the channel impulse response to obtain a plurality of block chain encryption nodes, and determining an authentication ciphertext through all the block chain encryption nodes; and decrypting the authentication ciphertext according to the ciphertext authentication format to obtain a decrypted ciphertext of the Internet of Things equipment, and performing security authentication by using the decrypted ciphertext of the Internet of Things equipment. By adopting the scheme, the information of each piece of Internet of Things equipment can be verified in a decentration mode on the premise of ensuring the privacy information security of the Internet of Things equipment, so that the security authentication performance of the system is improved.

Description

Technical Field

[0001] The present application relates to the field of security authentication technology, and more specifically, to an Internet of Things authentication system and method. Background Art

[0002] The rapid development of the Internet of Things has brought about countless application scenarios, from smart homes and smart cities to industrial automation and healthcare. However, with the widespread deployment of IoT devices, the security and authentication of devices has become a key issue. IoT authentication is the basis for ensuring that devices, users and data are secure and trustworthy in the IoT ecosystem, involving multiple aspects such as identity authentication, data encryption, and access control.

[0003] The number of devices in the IoT network is huge, involving billions or even tens of billions of devices. The authentication and management of large-scale IoT devices is a huge project, especially in a distributed environment. Large-scale device management requires not only efficient authentication protocols, but also a powerful key management system to ensure that the authentication information of all devices can be distributed and stored securely and reliably. Traditional authentication mechanisms usually rely on centralized certification authorities (CA) or authentication servers. However, IoT networks are usually decentralized, which makes traditional centralized authentication models difficult to apply. Therefore, how to verify the information of each IoT device in a decentralized manner while ensuring the privacy information security of IoT devices to improve the security authentication performance of the system is a difficult problem faced by the industry. Summary of the invention

[0004] The present application provides an Internet of Things authentication system and method, which can verify the information of each Internet of Things device in a decentralized manner while ensuring the security of the privacy information of the Internet of Things device, so as to improve the security authentication performance of the system.

[0005] In a first aspect, the present application provides an Internet of Things authentication method, comprising the following steps: Receive access authentication signals from IoT devices corresponding to each blockchain node; Channel feature extraction is performed on all access authentication signals to obtain the channel authentication feature of each blockchain node, and then the channel authentication feature of each blockchain node is masked to obtain the authentication mask feature of each blockchain node; For each blockchain node, an authentication master key of the blockchain node is generated according to the authentication masking feature and the node attribute set of the blockchain node, and the blockchain node is converted into a blockchain encryption node based on the authentication master key and the channel impulse response of all blockchain nodes, thereby obtaining multiple blockchain encryption nodes, and the authentication ciphertext shared by each IoT device is determined through all blockchain encryption nodes; Obtain the probability distribution of the authentication masking features of all blockchain nodes, determine the ciphertext authentication format according to the probability distribution of the authentication masking features and the authentication ciphertext, decrypt the authentication ciphertext according to the ciphertext authentication format, obtain the decrypted ciphertext of the Internet of Things device, and use the decrypted ciphertext of the Internet of Things device to perform security authentication.

[0006] In some embodiments, channel feature extraction is performed on all access authentication signals to obtain the channel authentication features of each blockchain node, specifically including: For the access authentication signal of each blockchain node, the channel feature extraction is performed on the access authentication signal to obtain the channel feature set corresponding to the blockchain node; Performing statistical feature extraction on each channel feature in the channel feature set, thereby obtaining a frequency spectrum statistical feature vector corresponding to each channel feature; The channel authentication characteristics of the blockchain node are determined by all the spectrum statistical feature vectors, and then the channel authentication characteristics of each blockchain node are obtained.

[0007] In some embodiments, the channel authentication features of each blockchain node are masked respectively, and the authentication masking features of each blockchain node are obtained, specifically including: Get the set hash function and hash table length; For each blockchain node's channel authentication feature, the channel authentication feature of the blockchain node is initialized according to the hash function and the hash table length to obtain an initialization result; The hash seed of the initialization result is masked by a pseudo-random number sequence to obtain the authentication mask feature of the blockchain node, and then the authentication mask feature of each blockchain node is obtained.

[0008] In some embodiments, generating an authentication master key of a blockchain node according to the authentication masking feature and the node attribute set of the blockchain node specifically includes: Extracting the time attribute and random feature attribute of the blockchain node from the node attribute set of the blockchain node; The authentication master key of the blockchain node is generated by the authentication masking feature, the time attribute and the random feature attribute.

[0009] In some embodiments, determining the authentication ciphertext shared by each IoT device through all blockchain encryption nodes is to use a set of encryption information of all blockchain encryption nodes as the authentication ciphertext shared by each IoT device.

[0010] In some embodiments, decrypting the authentication ciphertext according to the ciphertext authentication format to obtain the decrypted ciphertext of the IoT device specifically includes: Parsing the authentication ciphertext based on the ciphertext authentication format to obtain a parsing result; Get the symmetric key; Decrypting the authentication ciphertext using the symmetric key to obtain a decryption result; Using the parsing result to verify the decryption result, thereby obtaining a trusted decryption result; The trusted decryption result is used as the decrypted ciphertext by the IoT device.

[0011] In some embodiments, using the IoT device to decrypt ciphertext for security authentication specifically includes: Extracting identity authentication information of each IoT device from the IoT device decrypted ciphertext; Securely match the identity authentication information of each IoT device with the expected device identity; The successfully matched IoT devices are regarded as authorized IoT devices, and the failed matched IoT devices are regarded as unauthorized IoT devices, thus completing the security authentication of all IoT devices.

[0012] In a second aspect, the present application provides an Internet of Things authentication system, including a security authentication unit, wherein the security authentication unit includes: A collection module, used to receive access authentication signals from IoT devices corresponding to each blockchain node; A processing module is used to extract channel features from all access authentication signals to obtain channel authentication features of each blockchain node, and then mask the channel authentication features of each blockchain node to obtain authentication mask features of each blockchain node; The processing module is further used to generate an authentication master key of the blockchain node for each blockchain node according to the authentication masking feature and the node attribute set of the blockchain node, convert the blockchain node into a blockchain encryption node based on the authentication master key and the channel impulse response of all blockchain nodes, thereby obtaining multiple blockchain encryption nodes, and determining the authentication ciphertext shared by each IoT device through all blockchain encryption nodes; The execution module is used to obtain the probability distribution of the authentication masking features of all blockchain nodes, determine the ciphertext authentication format according to the probability distribution of the authentication masking features and the authentication ciphertext, decrypt the authentication ciphertext according to the ciphertext authentication format, obtain the decrypted ciphertext of the Internet of Things device, and use the decrypted ciphertext of the Internet of Things device to perform security authentication.

[0013] In a third aspect, the present application provides a computer device, comprising a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the computer device executes the above-mentioned Internet of Things authentication method.

[0014] In a fourth aspect, the present application provides a computer-readable storage medium, in which instructions or codes are stored. When the instructions or codes are run on a computer, the computer implements the above-mentioned Internet of Things authentication method when executed.

[0015] The technical solution provided by the embodiments disclosed in this application has the following beneficial effects: In an Internet of Things authentication system and method provided by the present application, an access authentication signal of an Internet of Things device corresponding to each blockchain node is received; channel feature extraction is performed on all access authentication signals to obtain the channel authentication feature of each blockchain node, and then the channel authentication feature of each blockchain node is respectively masked to obtain the authentication masked feature of each blockchain node; for each blockchain node, an authentication master key of the blockchain node is generated according to the authentication masked feature of the blockchain node and a node attribute set, the blockchain node is converted into a blockchain encryption node based on the authentication master key and the channel impulse response of all blockchain nodes, and then a plurality of blockchain encryption nodes are obtained, and an authentication ciphertext shared by each Internet of Things device is determined through all blockchain encryption nodes; the probability distribution of the authentication masked features of all blockchain nodes is obtained, the ciphertext authentication format is determined according to the probability distribution of the authentication masked features and the authentication ciphertext, the authentication ciphertext is decrypted according to the ciphertext authentication format to obtain the decrypted ciphertext of the Internet of Things device, and the decrypted ciphertext of the Internet of Things device is used for security authentication.

[0016] It can be seen that in this application, the information of each IoT device can be verified in a decentralized manner under the premise of ensuring the privacy information security of IoT devices; wherein, by masking the channel authentication features, the true identity and sensitive information of the IoT device can be hidden, and the masked channel authentication features are difficult to be reversed to derive the original data, ensuring that the identity of the IoT device in the network will not be easily exposed; then, by utilizing the decentralized blockchain architecture, each blockchain encryption node can be independently verified, thereby effectively preventing the single point failure and centralized attack problems of the centralized system, and using the physical characteristics of the channel impulse response to make each authentication process unique and random, and through the generation of the authentication master key and the conversion of the encryption node, the privacy of the IoT device is effectively protected; finally, through the probability distribution of the authentication masking feature, the true identity information of the IoT device will not be directly exposed to the network, and the probability distribution of the authentication masking feature and the authentication ciphertext are used for decryption, which reduces the amount of sensitive data transmitted during the authentication process. The system only needs the probability distribution of the authentication masking feature and the authentication ciphertext for authentication without transmitting additional identity information, and improves the security authentication performance of the system. To sum up, the technical solution adopted in this application can verify the information of each IoT device in a decentralized manner while ensuring the privacy information security of IoT devices, so as to improve the security authentication performance of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0018] Figure 1 is an exemplary flow chart of an Internet of Things authentication method according to some embodiments of the present application; Figure 2 is an exemplary flow chart of determining authentication masking features according to some embodiments of the present application; Figure 3 is an exemplary flow chart for implementing security authentication according to some embodiments of the present application; Figure 4 is a schematic diagram of exemplary hardware and / or software of a security authentication unit according to some embodiments of the present application; Figure 5 It is a structural diagram of a computer device for implementing an Internet of Things authentication method according to some embodiments of the present application. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0020] The embodiment of the present application provides an Internet of Things authentication system and method, the core of which is to receive the access authentication signal of the Internet of Things device corresponding to each blockchain node; extract channel features of all access authentication signals to obtain the channel authentication features of each blockchain node, and then mask the channel authentication features of each blockchain node respectively to obtain the authentication masking features of each blockchain node; for each blockchain node, generate the authentication master key of the blockchain node according to the authentication masking features of the blockchain node and the node attribute set, convert the blockchain node into a blockchain encryption node based on the authentication master key and the channel impulse response of all blockchain nodes, and then obtain multiple blockchain encryption nodes, and determine the authentication ciphertext shared by each Internet of Things device through all blockchain encryption nodes; obtain the probability distribution of the authentication masking features of all blockchain nodes, determine the ciphertext authentication format according to the probability distribution of the authentication masking features and the authentication ciphertext, decrypt the authentication ciphertext according to the ciphertext authentication format, obtain the decrypted ciphertext of the Internet of Things device, and use the decrypted ciphertext of the Internet of Things device for security authentication. The above scheme can be used to verify the information of each Internet of Things device in a decentralized manner on the premise of ensuring the privacy information security of the Internet of Things device, so as to improve the security authentication performance of the system.

[0021] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods. Figure 1 , which is an exemplary flow chart of an Internet of Things authentication method according to some embodiments of the present application. The Internet of Things authentication method 100 mainly includes the following steps: In step 101, an access authentication signal of an IoT device corresponding to each blockchain node is received.

[0022] In specific implementation, first, each IoT device needs to be bound to a predetermined blockchain node to ensure that all information on device access and operation can be tracked and verified through the blockchain node. A unique identity identifier (such as device ID and node ID) is usually established between the IoT device and the blockchain node, and the relationship is recorded on the blockchain; then, when the IoT device attempts to access the network or perform an operation, the IoT device will generate an access authentication signal, which includes an access request and a digital signature, wherein the access request will contain the IoT device's identity information, timestamp, requested operation content and other data; finally, each blockchain node will monitor the access authentication signal issued by the IoT device to which it is bound in real time. When the IoT device issues an access authentication signal, the corresponding blockchain node will immediately collect and record the access authentication signal.

[0023] In step 102, channel feature extraction is performed on all access authentication signals to obtain the channel authentication feature of each blockchain node, and then the channel authentication feature of each blockchain node is masked to obtain the authentication mask feature of each blockchain node.

[0024] Optionally, in some embodiments, channel feature extraction is performed on all access authentication signals to obtain the channel authentication feature of each blockchain node in the following manner, namely: For the access authentication signal of each blockchain node, the channel feature extraction is performed on the access authentication signal to obtain the channel feature set corresponding to the blockchain node; Performing statistical feature extraction on each channel feature in the channel feature set, thereby obtaining a frequency spectrum statistical feature vector corresponding to each channel feature; The channel authentication characteristics of the blockchain node are determined by all the spectrum statistical feature vectors, and then the channel authentication characteristics of each blockchain node are obtained.

[0025] It should be noted that in this application, the channel authentication feature represents the feature of the access authentication signal corresponding to the blockchain node on the time-varying channel. In a complex environment, the channel feature is time-varying, while the extracted physical layer feature is static, which leads to low security authentication efficiency and robustness in a complex environment. By extracting the channel authentication feature, the robustness and efficiency of security authentication can be improved.

[0026] In the specific implementation, first, for the access authentication signal of each blockchain node, the channel feature extraction of the access authentication signal is performed, that is, the power spectral density of the access authentication signal is calculated by the autocorrelation function of the given access authentication signal, and the channel frequency response and channel impulse response of the access authentication signal are calculated by using the pilot signal and the minimum mean square error, and the set consisting of the power spectral density, the channel frequency response and the channel impulse response is used as the channel feature set corresponding to the blockchain node; then, statistical feature extraction is performed on each channel feature in the channel feature set, that is, the channel features in the channel feature set are normalized, so as to calculate all statistical features of the normalized channel features, and the statistical features can be the mean, variance, skewness and kurtosis of the channel features, and the feature vector composed of all statistical features can be used as the spectrum statistical feature vector corresponding to the channel feature, and the spectrum statistical feature vector corresponding to each channel feature can be obtained in the above manner; finally, all the spectrum statistical feature vectors can be dimensionally spliced ​​to obtain a multi-dimensional feature vector, so that the feature vector is used as the channel authentication feature of the blockchain node, and the channel authentication feature of each blockchain node can be obtained in the above manner.

[0027] Preferably, in some embodiments, reference Figure 2As shown in FIG. 1 , this figure is an exemplary flow chart of determining the authentication masking feature in some embodiments of the present application. In this embodiment, the channel authentication feature of each blockchain node is masked respectively, and the authentication masking feature of each blockchain node can be obtained by the following steps: First, in step 1021, a set hash function and hash table length are obtained; Then, in step 1022, for the channel authentication feature of each blockchain node, the channel authentication feature of the blockchain node is initialized according to the hash function and the hash table length to obtain an initialization result; Finally, in step 1023, the hash seed of the initialization result is masked by a pseudo-random number sequence to obtain the authentication mask feature of the blockchain node, and then the authentication mask feature of each blockchain node is obtained.

[0028] It should be noted that in the present application, the authentication masking feature represents the channel authentication feature corresponding to the blockchain node after being masked by the privacy information. The masking operation can effectively hide the original hash value, making it difficult for unauthorized entities to reversely derive the original channel authentication feature. The authentication masking feature can be used for further authentication and verification processes to ensure the security of the blockchain node while preventing the leakage of sensitive information.

[0029] In the specific implementation, first, you can choose a hash function that is suitable for the application scenario, such as SHA-256, MD5, etc. The hash table length determines the size of the hash table, that is, the range of the hash function output. A longer hash table can provide higher security. The hash table length can be set according to the security requirements and performance considerations of the system, which will not be repeated here; then, for the channel authentication feature of each blockchain node, the channel authentication feature of the blockchain node is initialized according to the hash function and the hash table length, that is, the channel authentication feature is used as the input of the hash function to generate a hash value. The hash value corresponds to a predetermined index position in the hash table. In this way, the information of each blockchain node can be initialized. The channel authentication feature is mapped to a unique position in the hash table to obtain an initial hash result, i.e., the initialization result; finally, a reliable pseudo-random number generator is used to generate a pseudo-random number sequence, which is usually based on an initial seed value and should have good randomness and be difficult to predict, so that the hash seed of the initialization result is masked by the pseudo-random number sequence, that is, the generated pseudo-random number sequence is applied to the hash result to mask the channel authentication feature of the blockchain node. In actual implementation, the pseudo-random number sequence can be XORed with the initialization result to obtain the authentication masked feature of the blockchain node. The authentication masked feature of each blockchain node can be obtained in the above manner.

[0030] It should be noted that by masking the channel authentication features, the true identity and sensitive information of the IoT device can be hidden. The masked channel authentication features are difficult to reversely derive the original data, ensuring that the identity of the IoT device in the network will not be easily exposed, preventing privacy violations such as device tracking and information leakage.

[0031] In step 103, for each blockchain node, an authentication master key of the blockchain node is generated according to the authentication masking feature and the node attribute set of the blockchain node, and the blockchain node is converted into a blockchain encryption node based on the authentication master key and the channel impulse response of all blockchain nodes, thereby obtaining multiple blockchain encryption nodes, and determining the authentication ciphertext shared by each IoT device through all blockchain encryption nodes.

[0032] Optionally, in some embodiments, the following method may be used to generate the authentication master key of the blockchain node according to the authentication masking feature and the node attribute set of the blockchain node, namely: Extracting the time attribute and random feature attribute of the blockchain node from the node attribute set of the blockchain node; The authentication master key of the blockchain node is generated by the authentication masking feature, the time attribute and the random feature attribute.

[0033] It should be noted that in the present application, the authentication master key is the key used for security authentication corresponding to the blockchain node; the node attribute set is a set including the time attribute and random characteristic attribute of the blockchain node; the time attribute refers to the current timestamp of the blockchain node and some time-related data in the blockchain. The introduction of the time attribute adds the dynamic nature of the time dimension to the generation of the authentication master key, which means that each generation of the authentication master key may be different because the time attribute is constantly changing, which increases the randomness and security of the authentication master key; the random characteristic attribute refers to the data randomly generated by the blockchain node. The random characteristic attribute provides unpredictable randomness, making the generated authentication master key more secure and unpredictable. Even if the attacker obtains part of the information, it is still difficult to deduce the entire content of the authentication master key.

[0034] In the specific implementation, first, the time attribute and random feature attribute of the blockchain node are extracted from the node attribute set of the blockchain node. For example, the time attribute can be the time of block generation, the time when the node joins the network, the timestamp of the transaction, etc., and the random feature attribute can be a random number, a random identifier of the node, or random information generated based on hardware noise; then, the authentication mask feature, the time attribute and the random feature attribute can be used to generate the authentication master key of the blockchain node, that is, the authentication mask feature, the time attribute and the random feature attribute are used as the input of the key derivation function, so as to generate the authentication master key of the blockchain node through the key derivation function (such as PBKDF2, HMAC-SHA256, etc.).

[0035] Preferably, in some embodiments, the blockchain node is converted into a blockchain encryption node based on the authentication master key and the channel impulse response of all blockchain nodes in the following manner, namely: Determine the typical characteristics of channel impulses through the channel impulse responses of all blockchain nodes; The blockchain node is converted into a blockchain encryption node according to the typical characteristics of the channel impulse and the authentication master key.

[0036] It should be noted that in the present application, the channel impulse response is the characteristic response of the channel between the IoT device and the blockchain node, which can describe the path and attenuation of the access authentication signal during the transmission process. There is a unique channel impulse response between each IoT device and the blockchain node. The channel impulse response can be regarded as a physical layer feature for enhancing security; the typical characteristics of the channel impulse represent the typical representative channel impulse response; the blockchain encryption node refers to the blockchain node after encryption. The blockchain encryption node is a blockchain node with advanced encryption and authentication capabilities, which can use channel characteristics to ensure the confidentiality and integrity of communications.

[0037] In specific implementation, first, the typical characteristics of the channel impulse can be determined through the channel impulse responses of all blockchain nodes, that is, the mean of the channel impulse responses of all blockchain nodes can be used as the typical characteristics of the channel impulse, or the mode of the channel impulse responses of all blockchain nodes can be used as the typical characteristics of the channel impulse, which is not limited here; then, the blockchain node can be converted into a blockchain encryption node according to the typical characteristics of the channel impulse and the authentication master key, that is, the authentication master key is multiplied by the typical characteristics of the channel impulse, and the result is used as the encryption information of the blockchain node, so that the blockchain node with encrypted information is used as the blockchain encryption node.

[0038] It should be noted that after processing each blockchain node in the above manner, the blockchain encryption node corresponding to each blockchain node can be obtained, that is, multiple blockchain encryption nodes can be obtained.

[0039] Optionally, in some embodiments, the authentication ciphertext shared by each IoT device is determined through all blockchain encryption nodes by taking the set of encryption information of all blockchain encryption nodes as the authentication ciphertext shared by each IoT device; in specific implementation, the encryption information of each blockchain encryption node can be obtained, thereby taking the set of all encryption information as the authentication ciphertext shared by each IoT device, and the authentication ciphertext is the final credential for authentication of each IoT device.

[0040] It should be noted that by utilizing a decentralized blockchain architecture, each blockchain encryption node can be independently verified, thereby effectively preventing the single point failure and centralized attack problems of centralized systems. The physical characteristics of the channel impulse response are used to make each authentication process unique and random, which greatly improves the system's anti-attack ability and prevents replay attacks and forgery attacks. By generating the authentication master key and converting the encryption node, the privacy of IoT devices is effectively protected.

[0041] In step 104, the probability distribution of the authentication masking features of all blockchain nodes is obtained, the ciphertext authentication format is determined based on the probability distribution of the authentication masking features and the authentication ciphertext, the authentication ciphertext is decrypted according to the ciphertext authentication format, the IoT device decrypted ciphertext is obtained, and the IoT device decrypted ciphertext is used for security authentication.

[0042] In specific implementation, the authentication masking features of all blockchain nodes can be collected from the blockchain network to calculate the occurrence probability of each authentication masking feature. The probability distribution of the authentication masking features of all blockchain nodes can be calculated through the occurrence probability of each authentication masking feature. It should be noted that in this application, the probability distribution represents the distribution characteristics of the masking feature in the entire blockchain network.

[0043] Optionally, in some embodiments, determining the ciphertext authentication format based on the probability distribution of the authentication masking feature and the authentication ciphertext is to parse the probability distribution of the authentication masking feature and the authentication ciphertext in the blockchain network to obtain the ciphertext authentication format; it should be noted that the ciphertext authentication format defines how to use the authentication ciphertext for decryption and verification, and specifies the decryption algorithm, key usage method, data structure and other contents; in specific implementation, in the blockchain network, based on the probability distribution of the authentication masking feature, it is possible to infer the authentication format that the ciphertext may use. For example, if the distribution probability of a certain authentication masking feature is very high, the authentication ciphertext is likely to use an encryption format related to the authentication masking feature. This inference can be based on a statistical model or a machine learning algorithm. By training a model to identify the relationship between the probability distribution of the authentication ciphertext and the authentication masking feature, the most likely ciphertext authentication format is inferred, the inferred ciphertext authentication format is matched with the authentication ciphertext, and the correctness of the inference is verified by a decryption attempt. If the decryption is successful and the decryption result is as expected, the ciphertext authentication format is confirmed to be correct; otherwise, other possible ciphertext authentication formats can be tried.

[0044] Optionally, in some embodiments, the authentication ciphertext is decrypted according to the ciphertext authentication format to obtain the decrypted ciphertext of the IoT device, which may be specifically obtained in the following manner, namely: Parsing the authentication ciphertext based on the ciphertext authentication format to obtain a parsing result; Get the symmetric key; Decrypting the authentication ciphertext using the symmetric key to obtain a decryption result; Using the parsing result to verify the decryption result, thereby obtaining a trusted decryption result; The trusted decryption result is used as the decrypted ciphertext by the IoT device.

[0045] In the specific implementation, first, the authentication ciphertext is parsed based on the ciphertext authentication format, that is, metadata is extracted from the authentication ciphertext, and the metadata includes the version information of the ciphertext, the encryption algorithm identifier, the hash function used, and the key identifier, so that the metadata is used as the parsing result; then, the symmetric key pre-shared between the IoT device and the blockchain node can be obtained; then, the encrypted data segment of the authentication ciphertext is decrypted using the obtained symmetric key to obtain the decrypted result of the plaintext, and the decryption algorithm can be a symmetric encryption algorithm such as AES; secondly, the decryption result can be verified using the parsing result, that is, the hash value or digital signature of the decryption result is recalculated and compared with the verification information in the parsing result. If the verification is successful, the decryption result is deemed to be credible, that is, a trusted decryption result is obtained; finally, the trusted decryption result can be used as the IoT device decryption ciphertext, and the IoT device decryption ciphertext includes the identity information of the IoT device, encrypted operation instructions and other important data.

[0046] Preferably, in some embodiments, reference Figure 3 As shown, this figure is an exemplary flow chart for implementing security authentication in some embodiments of the present application. In this embodiment, the following steps can be used to implement security authentication by using the IoT device to decrypt ciphertext: First, in step 1041, the identity authentication information of each IoT device is extracted from the IoT device decrypted ciphertext; Then, in step 1042, the identity authentication information of each IoT device is securely matched with the expected device identification; Finally, in step 1043, the IoT devices that have been successfully matched are regarded as authorized IoT devices, and the IoT devices that have failed to be matched are regarded as unauthorized IoT devices, thereby completing the security authentication of all IoT devices.

[0047] In the specific implementation, first, the identity authentication information of each device is extracted from the decrypted ciphertext of the IoT device. The identity authentication information includes the device identification (ID): a string or code that uniquely identifies the device; a digital signature: generated by the private key of the IoT device, used to prove the authenticity of the identity information; a timestamp: records the time when the authentication information is generated, used to prevent replay attacks; then, the expected device identification is usually a legitimate device ID pre-registered in the network or system and stored in a secure device database. Each device identification corresponds to one or more specific IoT devices and is associated with other identity information of the IoT device (such as a digital certificate), so as to securely match the identity authentication information with the expected device identification. The device ID extracted from the decrypted ciphertext is compared with the expected device identification. If the device ID and the digital signature are If it completely matches the expected identification and the timestamp is within the allowed time range, the IoT device is considered legitimate and trusted; finally, if the identity authentication information matches the expected device identification successfully, the device is considered an authorized IoT device, and the authorized device will be allowed to access network resources, perform tasks, or participate in further communications and data exchanges; if the identity authentication information does not match the expected device identification, or the digital signature verification fails, and the timestamp expires, the device is considered an unauthorized IoT device, and the unauthorized device may be denied access, isolated, or trigger an alarm to notify the administrator for further inspection. The security authentication of all IoT devices can be completed in the above manner. This process can batch process authentication requests for multiple IoT devices to ensure that the device authentication process is quickly completed in a large-scale IoT environment.

[0048] It should be noted that through the probability distribution of authentication masking features, the real identity information of the IoT device will not be directly exposed to the network. Using the probability distribution of authentication masking features and authentication ciphertext for decryption reduces the amount of sensitive data transmitted during the authentication process. The system only needs the probability distribution of authentication masking features and authentication ciphertext for authentication without transmitting additional identity information, thereby improving the system's security authentication performance.

[0049] It can be seen that in this application, the information of each IoT device can be verified in a decentralized manner under the premise of ensuring the privacy information security of IoT devices; wherein, by masking the channel authentication features, the true identity and sensitive information of the IoT device can be hidden, and the masked channel authentication features are difficult to be reversed to derive the original data, ensuring that the identity of the IoT device in the network will not be easily exposed; then, by utilizing the decentralized blockchain architecture, each blockchain encryption node can be independently verified, thereby effectively preventing the single point failure and centralized attack problems of the centralized system, and using the physical characteristics of the channel impulse response to make each authentication process unique and random, and through the generation of the authentication master key and the conversion of the encryption node, the privacy of the IoT device is effectively protected; finally, through the probability distribution of the authentication masking feature, the true identity information of the IoT device will not be directly exposed to the network, and the probability distribution of the authentication masking feature and the authentication ciphertext are used for decryption, which reduces the amount of sensitive data transmitted during the authentication process. The system only needs the probability distribution of the authentication masking feature and the authentication ciphertext for authentication without transmitting additional identity information, and improves the security authentication performance of the system. To sum up, the technical solution adopted in this application can verify the information of each IoT device in a decentralized manner while ensuring the privacy information security of IoT devices, so as to improve the security authentication performance of the system.

[0050] In addition, in another aspect of the present application, in some embodiments, the present application provides an Internet of Things authentication system, the Internet of Things authentication system includes a security authentication unit, reference Figure 4 , which is a schematic diagram of exemplary hardware and / or software of a security authentication unit according to some embodiments of the present application, the security authentication unit 400 includes: a collection module 401, a processing module 402 and an execution module 403, which are described as follows: Collection module 401, in this application, the collection module 401 is mainly used to receive the access authentication signal of the Internet of Things device corresponding to each blockchain node; Processing module 402, in the present application, is used to extract channel features from all access authentication signals to obtain channel authentication features of each blockchain node, and then respectively mask the channel authentication features of each blockchain node to obtain authentication mask features of each blockchain node; It should be noted that the processing module 402 in the present application is also used to generate an authentication master key of the blockchain node for each blockchain node according to the authentication masking feature and the node attribute set of the blockchain node, convert the blockchain node into a blockchain encryption node based on the authentication master key and the channel impulse response of all blockchain nodes, and then obtain multiple blockchain encryption nodes, and determine the authentication ciphertext shared by each IoT device through all blockchain encryption nodes; Execution module 403, in the present application, execution module 403 is mainly used to obtain the probability distribution of the authentication masking features of all blockchain nodes, determine the ciphertext authentication format according to the probability distribution of the authentication masking features and the authentication ciphertext, decrypt the authentication ciphertext according to the ciphertext authentication format, obtain the decrypted ciphertext of the Internet of Things device, and use the decrypted ciphertext of the Internet of Things device for security authentication.

[0051] The above describes in detail the examples of the Internet of Things authentication system and method provided by the embodiments of the present application. It can be understood that in order to realize the above functions, the corresponding device includes hardware structures and / or software modules corresponding to the execution of each function. It should be easily appreciated by those skilled in the art that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0052] In some embodiments, the present application also provides a computer device, comprising a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the computer device executes the above-mentioned Internet of Things authentication method.

[0053] In some embodiments, reference Figure 5 , the dotted line in the figure indicates that the unit or the module is optional, and the figure is a schematic diagram of the structure of a computer device according to an Internet of Things authentication method provided in an embodiment of the present application. The Internet of Things authentication method described in the above embodiment can be Figure 5 The computer device 500 shown in the figure is implemented, and the computer device 500 includes at least one processor 501, a memory 502 and at least one communication unit 505. The computer device 500 can be a terminal device, a server or a chip.

[0054] The processor 501 may be a general-purpose processor or a special-purpose processor. For example, the processor 501 may be a central processing unit (CPU), which may be used to control the computer device 500, execute software programs, and process data of the software programs. The computer device 500 may also include a communication unit 505 to implement signal input (reception) and output (transmission).

[0055] For example, the computer device 500 may be a chip, the communication unit 505 may be an input and / or output circuit of the chip, or the communication unit 505 may be a communication interface of the chip, and the chip may be a component of a terminal device, a network device, or other devices.

[0056] For another example, the computer device 500 may be a terminal device or a server, and the communication unit 505 may be a transceiver of the terminal device or the server, or the communication unit 505 may be a transceiver circuit of the terminal device or the server.

[0057] The computer device 500 may include one or more memories 502, on which a program 504 is stored. The program 504 can be executed by the processor 501 to generate instructions 503, so that the processor 501 performs the method described in the above method embodiment according to the instructions 503. Optionally, data (such as a target audit model) can also be stored in the memory 502. Optionally, the processor 501 can also read the data stored in the memory 502, and the data can be stored at the same storage address as the program 504, or the data can be stored at a different storage address from the program 504.

[0058] The processor 501 and the memory 502 may be provided separately or integrated together, for example, integrated on a system on chip (SOC) of the terminal device.

[0059] It should be understood that each step of the above method embodiment can be completed by a hardware-based logic circuit or software-based instructions in the processor 501. The processor 501 can be a central processing unit, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, such as discrete gates, transistor logic devices or discrete hardware components.

[0060] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0061] For example, in some embodiments, the present application also provides a computer-readable storage medium, in which instructions or codes are stored. When the instructions or codes are run on a computer, the computer implements the above-mentioned Internet of Things authentication method when executing.

[0062] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0063] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An Internet of Things authentication method, characterized in that: The steps include: Receive access authentication signals from IoT devices corresponding to each blockchain node; Channel feature extraction is performed on all access authentication signals to obtain the channel authentication feature of each blockchain node, and then the channel authentication feature of each blockchain node is masked to obtain the authentication mask feature of each blockchain node; For each blockchain node, an authentication master key of the blockchain node is generated according to the authentication masking feature and the node attribute set of the blockchain node, and the blockchain node is converted into a blockchain encryption node based on the authentication master key and the channel impulse response of all blockchain nodes, thereby obtaining multiple blockchain encryption nodes, and the authentication ciphertext shared by each IoT device is determined through all blockchain encryption nodes; Obtain the probability distribution of the authentication masking features of all blockchain nodes, determine the ciphertext authentication format according to the probability distribution of the authentication masking features and the authentication ciphertext, decrypt the authentication ciphertext according to the ciphertext authentication format, obtain the decrypted ciphertext of the Internet of Things device, and use the decrypted ciphertext of the Internet of Things device to perform security authentication.

2. The method according to claim 1, characterized in that Channel feature extraction is performed on all access authentication signals to obtain the channel authentication features of each blockchain node, including: For the access authentication signal of each blockchain node, the channel feature extraction is performed on the access authentication signal to obtain the channel feature set corresponding to the blockchain node; Performing statistical feature extraction on each channel feature in the channel feature set, thereby obtaining a frequency spectrum statistical feature vector corresponding to each channel feature; The channel authentication characteristics of the blockchain node are determined by all the spectrum statistical feature vectors, and then the channel authentication characteristics of each blockchain node are obtained.

3. The method according to claim 1, characterized in that The channel authentication features of each blockchain node are masked respectively, and the authentication masking features of each blockchain node are obtained, including: Get the set hash function and hash table length; For each blockchain node's channel authentication feature, the channel authentication feature of the blockchain node is initialized according to the hash function and the hash table length to obtain an initialization result; The hash seed of the initialization result is masked by a pseudo-random number sequence to obtain the authentication mask feature of the blockchain node, and then the authentication mask feature of each blockchain node is obtained.

4. The method according to claim 1, characterized in that The authentication master key of the blockchain node is generated according to the authentication masking characteristics of the blockchain node and the node attribute set, specifically including: Extracting the time attribute and random feature attribute of the blockchain node from the node attribute set of the blockchain node; The authentication master key of the blockchain node is generated by the authentication masking feature, the time attribute and the random feature attribute.

5. The method according to claim 1, characterized in that Determining the authentication ciphertext shared by each IoT device through all blockchain encryption nodes is to use a collection of encryption information of all blockchain encryption nodes as the authentication ciphertext shared by each IoT device.

6. The method according to claim 1, characterized in that Decrypting the authentication ciphertext according to the ciphertext authentication format to obtain the decrypted ciphertext of the IoT device specifically includes: Parsing the authentication ciphertext based on the ciphertext authentication format to obtain a parsing result; Get the symmetric key; Decrypting the authentication ciphertext using the symmetric key to obtain a decryption result; Using the parsing result to verify the decryption result, thereby obtaining a trusted decryption result; The trusted decryption result is used as the decrypted ciphertext by the IoT device.

7. The method according to claim 1, characterized in that Using the IoT device to decrypt the ciphertext for security authentication specifically includes: Extracting identity authentication information of each IoT device from the IoT device decrypted ciphertext; Securely match the identity authentication information of each IoT device with the expected device identity; The successfully matched IoT devices are regarded as authorized IoT devices, and the failed matched IoT devices are regarded as unauthorized IoT devices, thus completing the security authentication of all IoT devices.

8. An Internet of Things authentication system, comprising a security authentication unit, characterized in that: The security authentication unit comprises: A collection module, used to receive access authentication signals from IoT devices corresponding to each blockchain node; A processing module is used to extract channel features from all access authentication signals to obtain channel authentication features of each blockchain node, and then mask the channel authentication features of each blockchain node to obtain authentication mask features of each blockchain node; The processing module is further used to generate an authentication master key of the blockchain node for each blockchain node according to the authentication masking feature and the node attribute set of the blockchain node, convert the blockchain node into a blockchain encryption node based on the authentication master key and the channel impulse response of all blockchain nodes, thereby obtaining multiple blockchain encryption nodes, and determining the authentication ciphertext shared by each IoT device through all blockchain encryption nodes; The execution module is used to obtain the probability distribution of the authentication masking features of all blockchain nodes, determine the ciphertext authentication format according to the probability distribution of the authentication masking features and the authentication ciphertext, decrypt the authentication ciphertext according to the ciphertext authentication format, obtain the decrypted ciphertext of the Internet of Things device, and use the decrypted ciphertext of the Internet of Things device to perform security authentication.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the computer device executes the Internet of Things authentication method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions or codes, and when the instructions or codes are executed on a computer, the computer implements the Internet of Things authentication method as described in any one of claims 1 to 7.

Images