Internet of Things equipment registration authentication and message transmission method and system

Abstract

The invention discloses an Internet of Things device registration authentication and message transmission method and system, and the method is characterized in that the method comprises the steps: carrying out the registration and authentication of an Internet of Things device; the authenticated Internet-of-Things equipment performs message transmission through common Internet-of-Things message protocols such as MQTT / CoAP and the like; a double-encryption mode is adopted in message transmission; and decrypting the message when the message is received.

Description

Technical Field

[0001] The present invention relates to the technical field, and in particular to a method and system for registration, authentication and message transmission of an Internet of Things device. Background Art

[0002] The Internet of Things refers to connecting various physical devices through the Internet, transmitting and processing data with the cloud or edge through various protocols and platforms, realizing information exchange and communication, and providing people with intelligent services and applications. The development of the Internet of Things has brought huge social and economic benefits, but it also faces challenges in data security. How to ensure the security and efficiency of identity authentication, data encryption and transmission of IoT devices is an important issue in IoT technology. Summary of the invention

[0003] To achieve the above-mentioned purpose and other related purposes, the present invention discloses a method for registration, authentication and message transmission of an Internet of Things device, comprising: IoT device registration and authentication; The authenticated IoT devices transmit messages through common IoT message protocols such as MQTT / CoAP; Use double encryption in message transmission; Decrypt the message when it is received.

[0004] Furthermore, during the device registration and authentication process, a dynamic key generation mechanism based on time and device characteristics is introduced, including: K=H(ID||T||S) Among them: K is the dynamically generated key, H is the hash function, ID is the unique identifier of the device, T is the current timestamp, and S is the device characteristic value.

[0005] Furthermore, the IoT device registration and authentication includes: For devices with built-in certificates that support SSL / TLS verification, you can configure Nginx's TLS 443 port for security authentication. After authentication, the message is forwarded to Netty's TLS 443 listening port for message processing, thus achieving registration authentication for devices with built-in certificates that support SSL / TLS verification. For common devices that do not have their own certificates and do not support SSL / TLS verification, a simple custom authentication method is used. It relies on the unique identification of the device. The registered authentication device is manually added directly through the authentication platform, and the data format is set to indicate that the device is a trusted and authenticated device. Then the IoT device terminal sends the message to Nginx through the non-TLS 443 port, and then Nginx reverse proxies to Netty's non-TLS listening port for message processing.

[0006] Further, decrypting the message when receiving the message includes: First, the message data is decrypted using the shared public key to obtain the unique identifier of the terminal device. If the decryption fails, it indicates that the message data is illegal and is discarded directly. If the decryption is successful, the distributed key-value non-relational database is queried using the unique identifier of the IoT device to obtain the corresponding key, and the SM4 decryption operation is performed to obtain the complete data content.

[0007] On the other hand, the present invention also provides an IoT device registration authentication and message transmission system, comprising: Device registration module, used for IoT device registration and authentication; Message transmission module, used for authenticated IoT devices to transmit messages through common IoT message protocols such as MQTT / CoAP; An encryption module, used to adopt a double encryption method in message transmission; The message receiving module is used to decrypt the message when receiving it.

[0008] By adopting the above technical solution, the registration and authentication, message encryption and decryption, message transmission and processing functions of IoT devices are realized, while ensuring the security and efficiency of data. Different authentication methods are adopted according to whether the IoT device carries a certificate to support SSL / TLS verification, thus realizing flexible management and secure access of IoT devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, among which:

[0010] Figure 1 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0011] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0012] Reference Figure 1 The embodiment of the present invention provides an Internet of Things device registration authentication and message transmission method, including: IoT device registration and authentication; The authenticated IoT devices transmit messages through common IoT message protocols such as MQTT / CoAP; Use double encryption in message transmission; Decrypt the message when it is received.

[0013] Among them, IoT device registration and authentication include: For devices with built-in certificates that support SSL / TLS verification, you can configure Nginx's TLS 443 port for security authentication. After authentication, the message is forwarded to Netty's TLS 443 listening port for message processing, thus achieving registration authentication for devices with built-in certificates that support SSL / TLS verification.

[0014] For common devices that do not have their own certificates and do not support SSL / TLS verification, a simple custom authentication method is used, which relies on the unique identifier of the device (such as MAC address). The device is manually added and registered for authentication through the authentication platform, and the data format is set to indicate that the device is a trusted and authenticated device. Then the IoT device terminal sends the message to Nginx through the non-TLS443 port, and then Nginx reverse proxies to Netty's non-TLS listening port for message processing.

[0015] When the message data of these two authentication methods are forwarded to Netty for message processing, the corresponding device key will be generated according to the unique identifier of the device, and the key expiration time will be set. Then the unique identifier of the device and the corresponding key will be saved in a distributed database that stores non-relational key values, which is convenient for subsequent acquisition of the key to decrypt the message data. At the same time, after the key is generated, the authentication status of the IoT device will be stored in the Redis bitmap according to the unique identifier of the device (0 status means that the device is not authenticated, and 1 status means that the device is authenticated), which is convenient for quickly judging whether the device has been authenticated during message transmission control, thereby directly filtering out the data of unauthenticated third-party unreliable source devices.

[0016] During the device registration and authentication process, a dynamic key generation mechanism based on time and device characteristics is introduced, including: K=H(ID||T||S) Among them: K is the dynamically generated key, H is the hash function, ID is the unique identifier of the device, T is the current timestamp, and S is the device characteristic value.

[0017] After authentication, IoT devices transmit messages through common IoT message protocols such as MQTT / CoAP, including: After authentication, IoT devices transmit messages through common IoT message protocols such as MQTT / CoAP. The previous message will first be load balanced to Nginx through LVS, and then Nginx will be reverse proxied to the Netty server for receiving IoT device connections and message processing.

[0018] In Netty, first determine whether the device has been authenticated based on the device's unique identifier, and query the Redis bitmap to verify the device's authentication status. If the device has been authenticated, query the key based on the device's unique identifier through the distributed key-value database, perform SM4 national encryption, and send the encrypted message to the cloud or other service middleware. If the device is not authenticated, first determine whether the device supports automatic authentication. If it does, automatically generate and save the key and authentication status. If it does not, directly return the status of message sending failure.

[0019] The double encryption method used in message transmission includes: Subsequent message transmission uses double encryption. After the message data is encrypted with SM4 national secret, the device unique identifier also needs to be simply symmetrically encrypted. The device unique identifier can be encrypted using the public key of the server, while the message data is encrypted with SM4 using the unique key corresponding to the IoT device. The encrypted data format is as follows:

[0020] {"id":"Device unique ID encrypted with public key","data":"Message data encrypted with device key SM4"}, The benefit of using double encryption is that it facilitates data transmission in multiple middleware or service applications, and facilitates the expansion of custom message decryption plug-ins, which can quickly and safely verify the reliability of the device. In addition, there is no need to separately integrate and configure SSL / TLS in each middleware or service application, thereby ensuring the secure and efficient transmission of data and facilitating subsequent message streaming processing, storage persistence, and computational analysis. If it is necessary to further ensure the security of data transmission, digital signatures, token authentication, or an overall encryption of the message can be added to the existing data format to verify the device identity and ensure the integrity of the data message.

[0021] Decrypting a message when it is received includes: After receiving the data in the cloud, middleware or service application, the data can be quickly decrypted. First, the message data is decrypted by sharing the public key to obtain the unique identifier of the terminal device. If the decryption fails, it indicates that the message data is illegal and is directly discarded; if the decryption is successful, the distributed key-value non-relational database is queried through the unique identifier of the IoT device to obtain the corresponding key, and then the SM4 decryption operation is performed to obtain the complete data content. The time consistency of the key needs to be ensured during decryption. If the key is expired, it can be directly discarded or the error message log can be recorded to wait for the message to be retransmitted.

[0022] The present invention can realize functions such as registration and authentication, message encryption and decryption, message transmission and processing of IoT devices, while ensuring data security and efficiency; the present invention adopts different authentication methods according to whether the IoT device carries a certificate to support SSL / TLS verification, thereby realizing flexible management and secure access of IoT devices; the present invention generates a corresponding device key according to the unique identifier of the IoT device, sets the expiration time of the key, saves the device key in a distributed key-value database, and stores the registration and authentication status of the device in a Redis bitmap according to the unique identifier of the device, thereby realizing rapid authentication and key management of IoT devices; the present invention adopts a double encryption method for subsequent message transmissions, wherein the device unique identifier is encrypted using a public key, and the message data is encrypted using the device key SM4, thereby realizing efficient encryption and decryption of IoT data and domestically produced independent control; the present invention adopts a unified data format, which is convenient for data transmission in multiple middleware or service applications, and is convenient for the expansion of custom message decryption plug-ins, without the need to configure TLS separately for each middleware or service application, thereby realizing efficient transmission and processing of IoT data.

[0023] An embodiment of the present invention further provides an Internet of Things device registration authentication and message transmission system, comprising: Device registration module, used for IoT device registration and authentication; Message transmission module, used for authenticated IoT devices to transmit messages through common IoT message protocols such as MQTT / CoAP; An encryption module, used to adopt a double encryption method in message transmission; The message receiving module is used to decrypt the message when receiving it.

[0024] The execution subject of the electronic device control in the embodiment of the present invention may be an electronic device, or a functional module in the electronic device that can call and execute a program. The electronic device may obtain the firmware corresponding to the storage medium. The firmware corresponding to the storage medium is provided by the supplier. The firmware corresponding to different storage media may be the same or different, which is not limited here. After the electronic device obtains the firmware corresponding to the storage medium, the firmware corresponding to the storage medium may be written into the storage medium, specifically, the firmware corresponding to the storage medium may be burned into the storage medium. The process of burning the firmware into the storage medium may be implemented using existing technology, which will not be described in detail in the embodiment of the present invention.

[0025] For the convenience of description, the above devices are described in terms of functions and are divided into various units and modules. Of course, when implementing the present application, the functions of each unit and module can be implemented in the same or multiple software and / or hardware.

[0026] Those skilled in the art will appreciate that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art in the art to which the present invention belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined.

[0027] For the method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0028] It can be known from the description of the above implementation modes that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute the methods described in the various implementation modes of the present application or certain parts of the implementation modes.

[0029] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for registration, authentication and message transmission of an Internet of Things device, characterized in that: include: IoT device registration and authentication; The authenticated IoT devices transmit messages through common IoT message protocols such as MQTT / CoAP; Use double encryption in message transmission; Decrypt the message when it is received.

2. The method according to claim 1, characterized in that During the device registration and authentication process, a dynamic key generation mechanism based on time and device characteristics is introduced, including: K=H(ID||T||S); Among them: K is the dynamically generated key, H is the hash function, ID is the unique identifier of the device, T is the current timestamp, and S is the device characteristic value.

3. The method according to claim 1, characterized in that The IoT device registration and authentication includes: For devices with built-in certificates that support SSL / TLS verification, you can configure Nginx's TLS 443 port for security authentication. After authentication, the message is forwarded to Netty's TLS 443 listening port for message processing, thus achieving registration authentication for devices with built-in certificates that support SSL / TLS verification. For common devices that do not have their own certificates and do not support SSL / TLS verification, a simple custom authentication method is used. It relies on the unique identification of the device. The registered authentication device is manually added directly through the authentication platform, and the data format is set to indicate that the device is a trusted and authenticated device. Then the IoT device terminal sends the message to Nginx through the non-TLS 443 port, and then Nginx reverse proxies to Netty's non-TLS listening port for message processing.

4. The method according to claim 1, characterized in that: Decrypting the message when receiving the message includes: First, the message data is decrypted using the shared public key to obtain the unique identifier of the terminal device. If the decryption fails, it indicates that the message data is illegal and is discarded directly. If the decryption is successful, the distributed key-value non-relational database is queried using the unique identifier of the IoT device to obtain the corresponding key, and the SM4 decryption operation is performed to obtain the complete data content.

5. An IoT device registration authentication and message transmission system, characterized in that: include: Device registration module, used for IoT device registration and authentication; Message transmission module, used for authenticated IoT devices to transmit messages through common IoT message protocols such as MQTT / CoAP; An encryption module, used to adopt a double encryption method in message transmission; The message receiving module is used to decrypt the message when receiving it.

Images