A log signing method, device and system

Abstract

The present application relates to a log signing method, device and system. A device log message packet is sent to a cloud server, wherein the cloud server verifies the timeliness of the device log message packet according to the time when the device log message packet is obtained and verifies the reliability through the intermediate value in the device log message packet; a second verification message packet sent by the cloud server is received; wherein the second verification message packet is generated by the cloud server after the timeliness verification and the reliability verification are passed, and the cloud server updates the historical device log corresponding to the IoT device in the cloud server according to the device log in the device log message packet; the second verification message packet is verified for timeliness according to the time when the second verification message packet is obtained, and the reliability is verified through the intermediate value in the second verification message packet, and when the timeliness verification and the reliability verification are passed, the two-way authentication between the IoT device and the cloud server is completed. The use of this application can improve the security of message packet transmission.

Description

Technical Field

[0001] The present application relates to the field of identity authentication technology, and in particular to a log signing method, device and system. Background Art

[0002] With the rapid development of IoT technology, the number of IoT devices has increased dramatically, which has brought huge challenges to the existing centralized architecture, including limited expansion capabilities, complex inter-network collaboration, and high difficulty in security and privacy protection. PUF (Physical Unclonable Function) counting provides unique identity identification and key management methods for Internet devices by identifying the natural fingerprint of the chip. Combined with blockchain technology, PUF can further enhance the security and credibility of IoT devices.

[0003] The common IoT event recorders based on PUF and blockchain in the prior art are mostly, the internal logic of the PUF module includes a logging mechanism, which is set to automatically record the challenge and / or the corresponding log in the log medium such as the blockchain. In actual application, the first message to be recorded on the blockchain is sent, and the query is submitted to check that the first message has been recorded on the blockchain and has not been manipulated. Under this condition, the second message delivery transaction to be recorded on the blockchain is sent. In summary, the security of the current prior art is still relatively low. For example, the current technology uses PUF technology and records the log on the blockchain, which can only ensure that the log record is authentic and reliable after being recorded on the blockchain, but cannot guarantee the authenticity of the log record data source; the technology cannot realize the traceability of the log record; and the technology mainly relies on the public key cryptography system, etc.

[0004] Currently, no effective solution has been proposed for the problem of low security of log records in the prior art. Summary of the invention

[0005] Based on this, it is necessary to provide a log signing method, device and system to address the above technical issues.

[0006] In a first aspect, the present application provides a log signing method, which is applied to a preset IoT device. The method includes:

[0007] According to the user message information corresponding to the user terminal and the device message information corresponding to the IoT device, two-way authentication between the user terminal and the IoT device is completed;

[0008] Based on the device identification message package corresponding to the IoT device, complete the two-way authentication between the IoT device and the preset cloud server;

[0009] When it is detected that both the two-way authentication between the user terminal and the IoT device and the two-way authentication between the IoT device and the cloud server are passed, a device log message packet carrying the device log is sent to the cloud server, wherein the cloud server verifies the timeliness of the device log message packet according to the time when the device log message packet is obtained and verifies the reliability through the intermediate value in the device log message packet;

[0010] After the cloud server generates the second verification message packet, receiving the second verification message packet sent by the cloud server; wherein the second verification message packet is generated by the cloud server after both the timeliness verification and the reliability verification are passed, and the cloud server updates the historical device log corresponding to the IoT device in the cloud server according to the device log in the device log message packet;

[0011] The second verification message packet is verified for timeliness according to the time when the second verification message packet is obtained, and the reliability is verified through the intermediate value in the second verification message packet. When it is detected that both the timeliness verification and the reliability verification are passed, the two-way authentication between the IoT device and the cloud server is completed.

[0012] In one embodiment, before completing the two-way authentication between the user terminal and the IoT device according to the user message information corresponding to the user terminal and the device message information corresponding to the IoT device, the user terminal registers on the IoT device terminal, and the method further includes:

[0013] Based on the fuzzy extraction processing of the user information features by the user end, the user information features are obtained, wherein the user information features include feature keys and auxiliary characters;

[0014] The user public key is calculated based on the auxiliary character and the preset master public key, and the user private key is calculated based on the feature key and the preset master private key;

[0015] Based on the main public key, auxiliary characters and the characteristic key after hash calculation, the user's registration on the Internet of Things device is completed; based on the encryption module integrated on the Internet of Things device, the characteristic key is encrypted to obtain a challenge response pair.

[0016] In one embodiment, before completing the two-way authentication between the user terminal and the IoT device according to the user message information corresponding to the user terminal and the device message information corresponding to the IoT device, the method further includes:

[0017] The hardware address of the IoT device is pseudo-randomly calculated to obtain a device identification, and an identification challenge response message packet is obtained based on the device identification and the challenge response pair obtained from the user end. The identification challenge response message packet is sent to the cloud server to complete the registration on the cloud server end based on the identification challenge response message packet; wherein the challenge response pair is obtained based on the feature key.

[0018] In one embodiment, according to the user message information corresponding to the user terminal and the device message information corresponding to the IoT device, two-way authentication between the user terminal and the IoT device is completed, including:

[0019] Obtain a third verification message packet carrying a third verification field; wherein the third verification message packet is obtained by the user end based on a preset user end derived key to encrypt the user message information, the third verification field, and the timestamp information of the third verification message packet generation time; the third verification field is obtained by encrypting the encryption result of the user end derived key to the user message information using the user end derived key;

[0020] After completing the verification of the integrity of the third verification message packet, decrypting the encryption result of the user message information based on the user-side derived key to obtain the auxiliary character and the user-side timestamp, and after detecting that the auxiliary character and the user-side timestamp are valid, generating a device-side random number;

[0021] After encrypting the device message information based on the master public key and the device-side derived key, a fourth verification message packet carrying a fourth verification field is obtained, and the fourth verification message packet is sent to the user side; wherein the device message information includes auxiliary characters and a device-side timestamp;

[0022] After the user end completes the verification of the integrity of the fourth verification message packet, the device message information is decrypted based on the device-side derived key to obtain the auxiliary characters and the device-side timestamp. When the auxiliary characters and the device-side timestamp are verified to be valid, the two-way authentication between the user end and the IoT device is completed.

[0023] In one embodiment, based on the device identification message packet corresponding to the IoT device, two-way authentication between the IoT device and the preset cloud server is completed, including:

[0024] When the fifth verification message packet is obtained, the fifth verification message packet is subjected to timeliness verification. After the timeliness verification is passed, the fifth restoration verification field is obtained by calculating the intermediate value in the fifth verification message packet. When it is detected that the fifth restoration verification field is successfully compared with the fifth verification field in the fifth verification message packet, it is determined that the two-way authentication between the Internet of Things device and the cloud server is completed. The fifth verification message packet is that after the cloud server receives the device identification message packet sent by the Internet of Things device and verifies that the corresponding Internet of Things device has completed registration according to the device identification in the device identification message packet, it retrieves the challenge-response pair of the corresponding user according to the device identification, encrypts the challenge-response pair, the device identification and the fifth verification field, and generates the fifth verification message packet, which is sent to the Internet of Things device.

[0025] In one embodiment, when the fifth verification message packet is obtained, the fifth verification message packet is subjected to timeliness verification, including:

[0026] When the fifth verification message packet is obtained, a second timestamp is generated, and the first timestamp is obtained from the fifth verification message packet, and the timeliness of the fifth verification message packet is verified based on the first timestamp and the second timestamp, wherein if it is detected that the difference between the first timestamp and the second timestamp is less than the preset transmission delay, the fifth verification message packet is judged to be timely; wherein, the first timestamp is generated by the cloud server when the device representation message packet is received, and the fifth verification message packet includes the first timestamp.

[0027] In one embodiment, the challenge response pair includes a challenge value and a response value corresponding to the user; sending a device log message packet carrying a device log to the cloud server includes:

[0028] Performing pseudo-random calculation processing on the challenge value in the challenge response pair, and updating the challenge value according to the pseudo-random calculation result of the challenge value;

[0029] Obtain the corresponding update response value according to the pseudo-random calculation result of the challenge value;

[0030] Generate a new device identifier based on the pseudo-random calculation result of the challenge value, the updated response value, and the timestamp corresponding to the device log message packet;

[0031] Based on the new device identification, the pseudo-random calculation result of the challenge value and the updated response value, a device identification message packet is obtained, and the device identification message packet is sent to the cloud server, wherein the cloud server updates the challenge-response pair corresponding to the IoT device stored in the cloud server based on the updated response value and the pseudo-random calculation result of the challenge value in the device identification message packet.

[0032] In one embodiment, when it is detected that the second restored verification field is successfully compared with the second verification field in the second verification message packet, after completing the two-way authentication between the IoT device and the cloud server, the method further includes:

[0033] Based on the new device identification, the pseudo-random calculation result of the challenge value and the updated response value, the historical device identification, historical challenge value and historical response value stored locally are updated respectively.

[0034] In a second aspect, the present application also provides a log signing device. The device includes:

[0035] An authentication module, used to complete the two-way authentication between the user terminal and the IoT device according to the user message information corresponding to the user terminal and the device message information corresponding to the IoT device; and complete the two-way authentication between the IoT device and the preset cloud server based on the device identification message packet corresponding to the IoT device;

[0036] A log update module, for, when it is detected that both the two-way authentication between the user terminal and the IoT device and the two-way authentication between the IoT device and the cloud server are passed, sending a device log message packet carrying a device log to the cloud server, wherein the cloud server verifies the timeliness of the device log message packet according to the time when the device log message packet is obtained and verifies the reliability through the intermediate value in the device log message packet; after the cloud server generates a second verification message packet, receiving the second verification message packet sent by the cloud server; wherein the second verification message packet is generated by the cloud server after the timeliness verification and the reliability verification of the device log message packet are passed and the historical device log corresponding to the IoT device in the cloud server is updated according to the device log in the device log message packet;

[0037] A verification module is used to verify the timeliness of the second verification message packet according to the time when the second verification message packet is obtained, and to verify the reliability through the intermediate value in the second verification message packet. When it is detected that both the timeliness verification and the reliability verification are passed, the two-way authentication between the Internet of Things device and the cloud server is completed.

[0038] In a third aspect, the present application also provides a log signing system, including a user terminal, an Internet of Things device and a cloud server; wherein the Internet of Things device is connected to the user terminal and the cloud server respectively, and the Internet of Things device is used to execute the method described above.

[0039] The above-mentioned log signature method, device and system first complete the two-way authentication between the user end and the IoT device, and the two-way authentication between the IoT device and the cloud server. Then, the IoT device sends a device log message packet carrying the device log to the cloud server, and the cloud server verifies the timeliness of the device log message packet according to the time when the device log message packet is obtained, and verifies the reliability through the intermediate value of the device log message packet; after the cloud server generates a second verification message packet, it receives the second verification message packet sent by the cloud server, wherein the second verification message packet is generated by the cloud server after the timeliness verification and reliability verification are passed, according to the device log in the device log message packet, the historical device log corresponding to the IoT device in the cloud server is updated, and finally, the second verification message packet is verified according to the time when the second verification message packet is obtained, and the reliability is verified through the intermediate value of the second verification message packet. After detecting that the timeliness verification and reliability verification are passed, the two-way authentication of the IoT device and the cloud server is completed. Through the verification process based on timeliness and reliability provided by this application, the security and reliability of message packet transmission can be effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A flow chart of a log signing method in one embodiment;

[0041] Figure 2 A flow chart of a log signing method in a preferred embodiment;

[0042] Figure 3 It is a structural block diagram of a log signing device in an embodiment;

[0043] Figure 4 FIG. 4 is a structural block diagram of a log signature system in an embodiment. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] In one embodiment, Figure 1 As shown, a log signing method is provided, comprising the following steps:

[0046] Step S110, completing two-way authentication between the user terminal and the IoT device according to the user message information corresponding to the user terminal and the device message information corresponding to the IoT device.

[0047] Specifically, the present application is applied to IoT devices, and is mainly oriented to scenarios where users access cloud servers through IoT devices to protect the integrity and authenticity of log data in the cloud servers.

[0048] In this embodiment, two-way authentication between the user terminal and the IoT device is completed based on the user message information corresponding to the user terminal and the device message information corresponding to the IoT device, wherein the user message information carries the auxiliary character θ uploaded by the user and obtained according to the user information characteristics of the user, and the timestamp TS when the user message information is generated, that is, the user message information Mu=(θ, TS), the user information characteristics of the user are generally the characteristics extracted from the user's iris, the characteristics extracted from the user's fingerprint, etc., the auxiliary character θ is composed of partial information of the biometric feature points of multiple users, that is, the auxiliary character represents the user's biometric features. The device message information carries the auxiliary character θ uploaded by the user and obtained according to the user information characteristics of the user, and the timestamp TS1 when the device message information is generated, that is, the device message information Md=(θ, TS1). In summary, the user end first sends the user message information to the IoT device end. Since the user end should have completed user registration on the IoT device end (i.e., registered through the user information characteristics of the user), when the IoT device end receives the user message information Mu sent by the user end, it can verify whether the auxiliary character θ in the user message information Mu already exists in the IoT device, thereby determining and verifying the user identity; further, according to the timestamp TS in the user message information, it is compared with the time when the IoT device obtains the user message information Mu, thereby verifying the timeliness of the user message information Mu. In some preferred embodiments, the timeliness verification includes but is not limited to, if the time indicated by the timestamp in the message packet is detected to be short compared with the time when the message packet is obtained, it indicates that the message packet is time-effective, otherwise, it indicates that the message packet is not time-effective. In some preferred embodiments, if the timestamp in the message packet is detected to be less than three times the average transmission delay when the message packet is obtained, it is considered that the message packet is time-effective. The timeliness verification in this application can use three times the average transmission delay as the judgment standard. In actual applications, those skilled in the art can adjust according to actual needs. After the verification is completed, the IoT device generates device message information Md based on the auxiliary character θ corresponding to the user and the timestamp, and sends it to the user. When the user detects that the auxiliary character θ in the device message information Md is correct and the timestamp is valid, the two-way authentication between the user and the IoT device is completed. In some preferred embodiments, when the user and the IoT device transmit message information bidirectionally, the user message information Mu and the device message information Md to be transmitted can be encrypted to ensure transmission security. For example, the user message information Mu can be encrypted according to the preset user private key and the derived key, and the integrity of the user message information Mu can be verified by using some characters in the derived key; similarly, the device message information Md can be encrypted according to the preset derived key and the user public key, and the integrity of the device message information Md can be verified by using some characters in the derived key.

[0049] Step S120, based on the device identification message packet corresponding to the IoT device, complete the two-way authentication between the IoT device and the preset cloud server.

[0050] Specifically, the device identification message packet carries the device identification PID of the IoT device. In some preferred embodiments, the device identification message packet may also carry an identification character W1 obtained by the device identification PID and a random number. The identification character W1 may be set to W1=z1⊕PID⊕PID, where z1 is a random number randomly selected by the IoT device, and z1∈ (a positive integer field), in summary, the above-mentioned device identification message packet can be {PID, W1}, and it can be understood that adding W1 can effectively improve the security of the device identification message packet. The two-way authentication between the IoT device and the cloud server generally includes that the IoT device sends the above-mentioned device identification information packet to the cloud server, and the cloud server detects whether the device has completed registration based on the device identification PID. In some preferred embodiments, after the cloud server completes the verification of the IoT device, the cloud server also needs to generate a verification message packet and send it to the IoT device, and then the IoT device verifies whether the message packet of the cloud server is valid, thereby realizing the two-way authentication between the cloud server and the IoT device. Specifically, the cloud server generates a verification message packet based on the device identification PID and the challenge response pair (CH, R) corresponding to the user information characteristics of the user, and sends it to the IoT device. The IoT device then verifies the timeliness of the message packet and the reliability of the data therein. If the verification is successful, the two-way authentication of the IoT device and the cloud server is completed.

[0051] Step S130, when it is detected that both the two-way authentication between the user terminal and the IoT device and the two-way authentication between the IoT device and the cloud server are passed, a device log message packet carrying the device log is sent to the cloud server, wherein the cloud server verifies the timeliness of the device log message packet according to the time when the device log message packet is obtained and verifies the reliability through the intermediate value in the device log message packet.

[0052] Specifically, when the two-way authentication between the user end and the IoT device and the two-way authentication between the IoT device and the cloud server are detected to be passed, the authentication process of the user end, the IoT device and the cloud server is completed, and the device log upload and update can begin. The IoT device sends a device log message packet carrying the device log to the cloud server, where the device log message packet carries TS3, the device log message packet intermediate value Auth3 and the device log<Dlog,LogSign> , where Dlog is the device log, LogSign is the device log signature, and the device log signature is written by the log signature hardware module when the device log is just generated; the device log message packet intermediate value Auth3 is obtained based on the device log and the challenge response pair; TS3 is the time when the IoT device obtains the fifth verification message packet (for the sake of ease of explanation, the specific parameters included in the fifth verification message packet will be described in detail below), and the fifth verification message packet is the authentication message packet that the cloud server feeds back to the IoT device when the cloud server and the IoT device are in the two-way authentication stage. In some preferred embodiments, the above-mentioned device log message packet also includes the parameter W6 for authentication and enhanced security. In summary, the device log message packet can be {TS3, W6, Auth3,<Dlog, LogSign>}, in some preferred embodiments, W6 = R1⊕h(R1||TS3), Auth3= H1(CH1||TS3||W6||Dlog||LogSign), where CH1 is the pseudo-random calculation result of the challenge value obtained through pseudo-random processing, and R1 is the updated response value calculated based on the pseudo-random calculation result of the challenge value. That is, when generating a device log message packet, the IoT device generates an updated pseudo-random calculation result of the challenge value and an updated response value, and sends them to the cloud server together with the device log message packet. The cloud server updates the challenge-response pair corresponding to the IoT device stored on the cloud server based on the updated pseudo-random calculation result of the challenge value and the updated response value. After the IoT device and the cloud server complete the two-way authentication, the IoT device also updates the locally stored challenge-response pair based on the updated pseudo-random calculation result of the challenge value and the updated response value, so as to facilitate the use of the next message transmission.

[0053] The above-mentioned cloud server verifies the timeliness of the device log message packet according to the time of the acquired device log message packet and verifies the reliability through the intermediate value in the device log message packet, including: when the cloud server acquires the device log message packet, it generates a device timestamp TS4, and obtains the above-mentioned TS3 from the device log message packet, and verifies the timeliness of the device log message packet based on the difference between the device timestamps TS4 and TS3; wherein, if it is detected that the difference between the device timestamps TS4 and TS3 is less than the preset transmission delay, the device log message packet is judged to be timely; TS3 is the time when the Internet of Things device acquires the fifth verification message packet, and the fifth verification message packet is the authentication message packet that the cloud server feeds back to the Internet of Things device when the cloud server and the Internet of Things device are in the two-way authentication stage. Furthermore, verifying the reliability of the device log message packet includes calculating the device restoration verification field Auth3' in the device log message packet through the intermediate value of the device log message packet, and obtaining the device verification field Auth3 from the device log message packet. When it is detected that the device restoration verification field Auth3' is the same as the device verification field Auth3, the device log message packet is judged to be reliable, which specifically includes that the reliability of the message packet can be verified through the intermediate value Auth3 in the device log message packet, wherein the reliability verification includes but is not limited to, the cloud server restores the verification field Auth3' from the device log message packet according to the intermediate value, the specific method of restoration calculation is Auth3'=H1(CH1||TS3||W6), and detects whether the Auth3' restored by the cloud server is equal to the initial Auth3 in the message packet. If they are equal, the reliability verification of the device log message packet is completed, wherein CH1 is the updated challenge value, and the specific method for updating the challenge value will be described in the following text.

[0054] Step S140, after the cloud server generates the second verification message packet, receiving the second verification message packet sent by the cloud server; wherein the second verification message packet is generated by the cloud server after the timeliness verification and reliability verification of the device log message packet are passed, and the historical device log corresponding to the Internet of Things device in the cloud server is updated according to the device log in the device log message packet.

[0055] Specifically, the IoT device obtains the second verification message packet sent by the cloud server, wherein the second verification message packet is generated by the cloud server after the timeliness verification and reliability verification in step S130 are passed, and the cloud server updates the device log stored in the cloud server that needs to be updated according to the device log in the device log message packet. In some preferred embodiments, the second verification message packet includes the timestamp TS4 when the second verification message packet is generated, and the second verification message packet intermediate value Auth4 obtained based on the user's challenge response. In summary, the second verification message packet includes {TS4, Auth4}, wherein specifically, the calculation method of Auth4 is: Auth4=H1(CH1||R1||TS3), wherein R1 is the response value obtained based on the updated challenge value CH1, and R1 = PUF(CH1). After the cloud server generates the second verification message packet, it sends the second verification message packet to the IoT device.

[0056] Step S150, verify the timeliness of the second verification message packet according to the time when the second verification message packet is obtained, and verify the reliability through the intermediate value in the second verification message packet. When it is detected that both the timeliness verification and the reliability verification are passed, the two-way authentication between the IoT device and the cloud server is completed.

[0057] Specifically, after obtaining the second verification message packet, the IoT device verifies the second verification message packet, thereby completing the two-way authentication between the IoT device and the cloud server. Specifically, when the IoT device obtains the second verification message packet, it immediately generates a second verification timestamp TS5, and verifies the timeliness of the second verification message packet through TS5 and TS4 in the message packet. That is, when it is detected that the difference between the second verification timestamp TS5 and the device timestamp TS4 is less than the preset transmission delay, the second verification message packet is judged to be timely. After the validity check is passed, the reliability verification is performed through the intermediate value Auth4 of the second verification message packet. Similarly, the reliability verification includes that the IoT device calculates the second restoration verification field Auth4' based on the intermediate value of the second verification message packet, and compares the second restoration verification field Auth4' with the second verification field Auth4 obtained in the message packet. If the two are the same, the comparison is passed, and the second verification message packet is reliable, which means that during the transmission of the second verification message packet, the message therein has not been tampered with, thereby completing the reliability verification of the second verification message packet, wherein the specific calculation method of Auth4' is: Auth4'= H1 (CH1||R1||TS3). Thus, the two-way authentication of the IoT device and the cloud server is completed in the process of uploading and updating the device log. In some preferred embodiments, after completing the device log update and the overall process of two-way authentication of the IoT device and the cloud server, the IoT device will clear all parameters and caches generated during the entire process of this authentication and device log upload.

[0058] Through steps S110 to S150, the IoT device and the cloud server are verified for timeliness and reliability before and after uploading the device log that needs to be updated to the cloud server, thereby ensuring the security of message transmission. Furthermore, in the process of authentication between the user end and the IoT device, the user authentication is completed based on the user information characteristics of the user. Compared with the existing user authentication method, the biometric authentication method in this application has higher security and reliability.

[0059] In some embodiments, the above method further includes a registration process of the user end on the IoT device, including:

[0060] Based on the fuzzy extraction processing of the user information features by the user end, the user information features are obtained, wherein the user information features include feature keys and auxiliary characters;

[0061] The user public key is calculated based on the auxiliary character and the preset master public key, and the user private key is calculated based on the feature key and the preset master private key;

[0062] Based on the main public key, auxiliary characters and the characteristic key after hash calculation, the user's registration on the Internet of Things device is completed; based on the encryption module integrated on the Internet of Things device, the characteristic key is encrypted to obtain a challenge response pair.

[0063] Specifically, the user terminal performs feature fuzzy extraction processing on the user information Bio, wherein the iris or fingerprint can be used as the user information Bio; the above-mentioned feature fuzzy extraction processing can be to use the feature fuzzy extraction function to obtain the relevant features and information of the user information, that is, to obtain GEN (Bio) = (σ, θ), wherein σ is the feature key, θ is the auxiliary character, and GEN is the generation algorithm, that is, a type of function for extracting or generating key operators.

[0064] The user public key UPK can be calculated based on the auxiliary character θ and the preset master public key MPK. In some preferred embodiments, UPK = H1 (θ || hid) P1 + MPK, where H1 is a cryptographically secure hash function used to generate a user public key containing user information, hid is a randomly selected function identifier of a string type, and P1 is a generator of G1, where G1 is a p-order cyclic addition group. It can be understood that P1 and G1 are both calculated intermediate values ​​and have no actual physical meaning. The user private key USK is calculated based on the characteristic key σ and the preset master private key MSK. In some preferred embodiments, the user terminal can send the characteristic key σ to the KGC (Key Generation Center) through a secure channel and obtain the user private key USK calculated by KGC, USK = [H1 (σ||hid) + MSK] · MSK -1 ·P2, where P2 is the generator of G2. As mentioned above, G2 is also a p-order cyclic additive group. P2 and G2 have no actual physical meaning.

[0065] Based on the master public key MPK, auxiliary characters θ and the characteristic key H1 (σ) calculated by hashing, registration is performed on the IoT device side, and if the IoT device finds that there is no identical H1 (σ) in the local registered information, the user is allowed to register and the registration information is written into the Trusted Execution Environment (TEE). In some preferred embodiments, the characteristic key σ is input into the IoT device as a challenge value, and the characteristic key is encrypted by the device's built-in encryption module, namely the PUF module (Physical Unclonable Function), to generate and store a set of challenge-response pairs (CH, R) corresponding to the user.

[0066] Through this embodiment, the user's biometric information is verified and stored as part of the log signature, which enables third-party audits to trace the operation of log records, facilitates the audit to directly find the corresponding user of the operation, and enables each device to have non-replicable key information.

[0067] In some embodiments, the method further comprises:

[0068] The hardware address of the IoT device is pseudo-randomly calculated to obtain a device identification, and an identification challenge response message packet is obtained based on the device identification and the challenge response pair obtained from the user end. The identification challenge response message packet is sent to the cloud server to complete the registration on the cloud server end based on the identification challenge response message packet; wherein the challenge response pair is obtained based on the feature key.

[0069] Specifically, the hardware address MAC (Media Access Control Address) of the IoT device is processed by pseudo-random calculation to obtain the device identification PID, that is, PID=PRNG(MAC), where PRNG is a pseudo-random generator module. Then, based on the device identification PID and the challenge response pair (CH, R) obtained from the user end, an identification challenge response message packet is obtained, that is, the identification challenge response message packet is {PID, (CH, R), RID}, where RID is the real serial code of the IoT device. After obtaining the challenge response message packet, the message packet and the registration request are sent to the cloud server through a secure channel.

[0070] After receiving the above-mentioned identification challenge response message packet, the cloud server detects whether the same RID has been registered before. If not, the cloud server registers the corresponding IoT device according to the device information in the identification challenge response message packet and returns a registration confirmation receipt; similarly, if the device is detected to have been registered according to the RID, the cloud server rejects the registration request. It can be seen from the above that the above-mentioned challenge response pair is to input the characteristic key σ corresponding to the user into the IoT device as the challenge value, and generate and store a set of challenge response pairs (CH, R) corresponding to the user through the built-in PUF module of the device.

[0071] After the IoT device registration is completed, the cloud server stores the above new registration sequence {PID, (CH, R), RID} locally.

[0072] Through this embodiment, the registration of the IoT device to the cloud server can be completed. After the registration is completed, if the same user accesses the cloud server again through the same IoT device in the future, it is only necessary to complete the authentication of the IoT device to the cloud server without the need for secondary registration.

[0073] In some embodiments, the method further comprises:

[0074] Obtain a third verification message packet carrying a third verification field; wherein the third verification message packet is obtained by the user end based on a preset user end derived key to encrypt the user message information, the third verification field, and the timestamp information of the third verification message packet generation time; the third verification field is obtained by encrypting the encryption result of the user end derived key to the user message information using the user end derived key;

[0075] After completing the verification of the integrity of the third verification message packet, decrypting the encryption result of the user message information based on the user-side derived key to obtain the auxiliary character and the user-side timestamp, and after detecting that the auxiliary character and the user-side timestamp are valid, generating a device-side random number;

[0076] After encrypting the device message information based on the master public key and the device-side derived key, a fourth verification message packet carrying a fourth verification field is obtained, and the fourth verification message packet is sent to the user side; wherein the device message information includes auxiliary characters and a device-side timestamp;

[0077] After the user end completes the verification of the integrity of the fourth verification message packet, the device message information is decrypted based on the device-side derived key to obtain the auxiliary characters and the device-side timestamp. When the auxiliary characters and the device-side timestamp are verified to be valid, the two-way authentication between the user end and the IoT device is completed.

[0078] Specifically, the user end first selects a user end random number r, where r∈[1, p-1], and calculates the intermediate value Cu=r·USK generated by the user end random number r and the user private key, as well as the above user end derived key Ku=KDF(e(MPK,P2)r, θ), where KDF is the key derivation function of the master private key and e is a bilinear mapping.

[0079] Then the user end uses the first half K1 of the user end derived key Ku to encrypt the user message Mu, and obtains KEM=Enc(K1,Mu). Then the user end calculates the third verification field to ensure the integrity of the message packet, and there is Auth=KDF(K2,KEM), where K2 is the second half of the user end derived key. It can be understood by those skilled in the art that K2 can be divided into equal parts to obtain the first half and the second half. In summary, the user end can generate the third verification message packet {Cu, KEM, Auth, TS} and send the third verification message packet to the IoT device.

[0080] After the IoT device obtains the third verification message packet, it verifies the integrity of the third verification message packet, including that the IoT device decrypts Cu in the third verification message packet through the user public key UPK = H1 (θ||hid) P1 + MPK, and calculates the shared key Kd = KDF (e (Cu, UPK), θ). The IoT device obtains K1 and K2 from the shared key, which are the first half and the second half of the user-side derived key, respectively, and verifies the integrity of the third verification message packet through K2. If the calculation and verification results are consistent, the device continues the subsequent processing, otherwise the authentication is terminated.

[0081] After completing the integrity verification of the third verification message packet, the encryption result of the user message information is decrypted based on the user-side derived key to obtain the auxiliary character θ and the user-side timestamp TS of the generation time of the third verification message packet in the third verification message packet, and the auxiliary character θ and the user-side timestamp TS are tested for validity, wherein the validity verification of the auxiliary character θ includes verifying whether the auxiliary character θ restored from the third verification message packet is consistent with the auxiliary character stored locally in the IoT device, and the validity verification of the user-side timestamp TS is to determine whether the message packet is valid based on the difference between the time when the third verification message packet is obtained and the generation time of the third verification message packet carried in the third verification message packet. If the difference between the two times is too long, the message packet is invalid, otherwise, it is valid. After detecting that the auxiliary character θ and the user-side timestamp are both valid, a device-side random number rd is generated, and rd∈[1, p-1].

[0082] The device calculates the response, Cd=rd·UPK, and obtains the device-side derived key Kd=KDF(e(MPK,P2) rd , θ), where the device message information Md on the device side is then encrypted, and C2=Enc(K3,Md), where Enc is generally the encrypted information, and K3 is the first half of the derived key on the device side. Further, the fourth verification field is calculated, and Auth1=PRNG(K4,C2), where K4 is the second half of the derived key on the device side. In summary, the fourth verification message packet includes the encryption result of the device message information, the fourth verification field, and the intermediate value calculated using the random number and the user public key, that is, the fourth verification message packet has {Cd,C2, Auth1}, and the fourth verification message packet is sent to the user side.

[0083] After obtaining the fourth verification message packet, the user terminal verifies the integrity of the fourth verification message packet, including the user using the user private key USK=[H1(θ||hid)+MSK]·MSK -1P2 decrypts Cd in the message packet and calculates the device-side derived key Ku=KDF(e(Cd,USK),θ), extracts K3 and K4 from the device-side derived key Ku, and uses K4 to verify the integrity of the above C2, that is, the integrity of the encryption result of the device message information, and after the verification, obtains the auxiliary character θ and the device-side timestamp TS1, and verifies whether the auxiliary character and timestamp are valid according to the auxiliary character and timestamp verification method mentioned above, and completes the two-way authentication between the user end and the IoT device after the auxiliary character and timestamp are detected to be valid. Through the embodiment, improvements are made on the basis of the existing SM9 (Secret Sharing Scheme for the Internet of Things) algorithm to achieve two-way authentication between the user end and the IoT device, so that the user can safely control the IoT device.

[0084] In some embodiments, the method further comprises:

[0085] When the fifth verification message packet is obtained, the fifth verification message packet is subjected to timeliness verification. After the timeliness verification is passed, the fifth restoration verification field is obtained by calculating the intermediate value in the fifth verification message packet. When it is detected that the fifth restoration verification field is successfully compared with the fifth verification field in the fifth verification message packet, it is determined that the two-way authentication between the Internet of Things device and the cloud server is completed. The fifth verification message packet is that after the cloud server receives the device identification message packet sent by the Internet of Things device and verifies that the corresponding Internet of Things device has completed registration according to the device identification in the device identification message packet, it retrieves the challenge-response pair of the corresponding user according to the device identification, encrypts the challenge-response pair, the device identification and the fifth verification field, generates the fifth verification message packet, and sends the fifth verification message packet to the Internet of Things device.

[0086] Specifically, the two-way authentication method between the cloud server and the IoT device includes: first, the IoT device sends a device identification message packet to the cloud server, and the device identification message packet is the above-mentioned {PID, W1}, and generates a timestamp TS2 when the device identification message packet is obtained. Through the device identification in the device identification message packet, the cloud server verifies whether the device has been registered by checking the registry. If the device identification PID is included in the registry, the authentication continues, otherwise the authentication fails, indicating that the device has not been registered.

[0087] After the cloud server detects that the IoT device has completed registration, it retrieves the corresponding user's challenge response pair (CH, R) locally according to the device identification PID, and encrypts the challenge response pair, the device identification PID, and the fifth verification field Auth2 to obtain the fifth verification message packet {TS2, W2, W3, W4, Auth2}, wherein the encryption process for the challenge response pair, the device identification, and the fifth verification field includes:

[0088] z1 = W1⊕PID⊕RID,

[0089] W2=z2·P1,

[0090] W3=CH+z1·W2,

[0091] W4 = H1(R||z1||TS2)⊕z2,

[0092] Auth2= H1(CH_1||W3||z1||z2).

[0093] Among them, W2 and W3 are calculated intermediate values ​​and have no actual physical meaning. W4 is the calculated check bit and has no actual physical meaning. z2 is a randomly selected z2∈ , CH is the challenge value in the challenge-response pair, H1 is a cryptographically secure hash function, R is the response value corresponding to the challenge value in the challenge-response pair, TS2 is the timestamp information when the cloud server obtains the device identification message packet, and CH_1 is the first half of the CH string after being divided equally.

[0094] After obtaining the above-mentioned fifth verification message packet, the fifth verification message packet is sent to the Internet of Things device. When the Internet of Things device receives the fifth verification message packet, it immediately generates a timestamp TS3 when the fifth verification message packet is obtained, and verifies the timeliness of the fifth verification message packet based on the timestamp TS3 and TS2 in the fifth verification message packet. In some preferred embodiments, if the difference between the two timestamps is within three times the average transmission delay, it indicates that the information packet is valid. Then, the fifth restoration verification field Auth2' is calculated through the intermediate value in the fifth verification message packet (i.e., W2 and W3 in the above text). The specific method for calculating the fifth restoration verification field is: the IoT device first calculates W5=z1·W2, CH'=W3-W5, and then the IoT device calculates R'=PUF(CH'), z2'=W4⊕H1(R'||TS2||z1), Auth2'= H1(CH||W3||z1||z2'), thereby calculating the fifth restoration verification field Auth2', and then obtaining the fifth verification field Auth carried in the fifth verification message packet. When it is detected that the fifth restoration verification field is the same as the fifth verification field, the two fields are successfully compared, indicating that the fifth verification message packet has not been tampered with during the transmission process and the content is valid. Thus, the two-way authentication of the IoT device and the cloud server is completed. This embodiment effectively ensures the security and reliability of data transmission through the verification field and timeliness verification in the message packet. In addition, the lightweight two-way authentication algorithm based on discrete logarithm problem, PUF and XOR calculation reduces the authentication interaction process and makes the authentication calculation more lightweight.

[0095] In some embodiments, the method further comprises:

[0096] When the fifth verification message packet is obtained, a second timestamp is generated, and the first timestamp is obtained from the fifth verification message packet, and the timeliness of the fifth verification message packet is verified based on the first timestamp and the second timestamp, wherein, if it is detected that the difference between the first timestamp and the second timestamp is less than the preset transmission delay, the fifth verification message packet is judged to be timely; wherein, the first timestamp is generated by the cloud server when the device identification message packet is received, and the fifth verification message packet includes the first timestamp.

[0097] Specifically, when the fifth verification message packet is obtained, the second timestamp TS3 described above is generated at the same time, and the first timestamp TS2 is obtained from the fifth verification message packet, and then the timeliness of the fifth verification message packet is verified based on the first timestamp TS2 and the second timestamp TS3. If it is detected that the difference between the first timestamp and the second timestamp is less than the preset transmission delay, it indicates that the fifth verification message packet is timely. In some preferred embodiments, the above transmission delay can be set by relevant technical personnel according to actual needs. In this embodiment, it can be set to three times the average transmission delay, and the average transmission delay can be the transmission delay of the last three data packets. Relevant technical personnel can adjust the setting of the transmission delay according to actual needs in actual application.

[0098] In some embodiments, the challenge-response pair includes a challenge value and a response value corresponding to the user, and the method further includes:

[0099] Performing pseudo-random calculation processing on the challenge value in the challenge response pair, and updating the challenge value according to the pseudo-random calculation result of the challenge value;

[0100] Obtain the corresponding update response value according to the pseudo-random calculation result of the challenge value;

[0101] Generate a new device identifier based on the pseudo-random calculation result of the challenge value, the updated response value, and the timestamp corresponding to the device log message packet;

[0102] Based on the new device identification, the pseudo-random calculation result of the challenge value and the updated response value, a device identification message packet is obtained, and the device identification message packet is sent to the cloud server, wherein the cloud server updates the challenge-response pair corresponding to the IoT device stored in the cloud server based on the updated response value and the pseudo-random calculation result of the challenge value in the device identification message packet.

[0103] Specifically, the IoT device performs pseudo-random calculation processing on the challenge value CH in the challenge-response pair to obtain a pseudo-random calculation result of the challenge value, and updates the original challenge value according to the pseudo-random calculation result of the challenge value, specifically including that the pseudo-random calculation result of the challenge value is CH1 = PRNG (CH), and then the original challenge value is updated according to the pseudo-random calculation result of the challenge value. Then, the response value is updated according to the pseudo-random calculation result of the challenge value to obtain an updated response value R1 = PUF (CH1). Then, based on the pseudo-random calculation result of the challenge value, the updated response value, and the second timestamp TS3 corresponding to the device log message packet, a new device identifier is calculated. The new device identifier is PID1 = H1 (CH1||R1||TS3). Based on the above-mentioned pseudo-random calculation result of the challenge value, the updated response value, and the second timestamp TS3 corresponding to the device log message packet, the device log message packet {TS3, W6, Auth3,<Dlog, LogSign> After the IoT device sends the device log message package to the cloud server, the cloud server verifies its timeliness and reliability. After the verification is passed, the challenge response pair corresponding to the IoT device and the user end stored in the cloud server is updated based on the pseudo-random calculation result of the challenge value and the updated response value. After the update, the challenge response stored in the cloud server corresponds to (CH1, R1), and the device log should be<Dlog,LogSign> .

[0104] A second verification message packet is obtained based on the new device identification, the pseudo-random calculation result of the challenge value and the updated response value, and the second verification message packet is sent to the IoT device. It can be understood from the above that in the authentication stage of the IoT device to the cloud server, the cloud server needs to verify whether the corresponding IoT device has completed registration based on the device identification PID in the device identification message packet sent by the IoT device, and retrieve the relevant challenge response pair (CH, R) based on the device identification. In this embodiment, after the IoT device generates a new device log each time, the device identification PID1 and the challenge response pair (CH1, R1) are updated once according to the method in this embodiment, and sent to the cloud server, so that the cloud server also updates the stored challenge response pair and device identification accordingly, and returns the new device identification PID1 and challenge response pair (CH1, R1) to the IoT device, and the IoT device then updates the new challenge response pair and device identification locally accordingly. When the IoT device uploads the device log next time, it needs to repeat the verification process in the above text based on the new device identification PID1 and the updated challenge response pair (CH1, R1) after the last update. In this embodiment, a new challenge-response pair and device identification are generated each time a device log is generated, thereby avoiding long-term use of the same device identification and challenge-response pair for identity authentication, and effectively improving the security and reliability of the device authentication stage.

[0105] In some embodiments, the method further comprises:

[0106] Based on the new device identification, the pseudo-random calculation result of the challenge value and the updated response value, the historical device identification, historical challenge value and historical response value stored locally are updated respectively.

[0107] Specifically, after the IoT device obtains the second verification message packet and the second verification message packet completes the timeliness and reliability verification, the IoT device updates the historical device identification PID, historical challenge value CH and historical response value R stored locally based on the new device identification PID1, challenge value pseudo-random calculation result CH1 and update response value R1 generated above, and the next time the device log needs to be uploaded, the updated device identification PID1, challenge value pseudo-random calculation result CH1 and update response value R1 are used to initiate authentication to the cloud server. Through this application, the identification information required for IoT devices to authenticate to the cloud server can be updated in a timely manner, reducing the risk of leakage of identification information required during the authentication process and improving the security of the authentication process. It can be understood by those skilled in the art that in actual applications, although the IoT device first generates a new device identification PID1, challenge value pseudo-random calculation result CH1 and update response value R1, it only meets procedural justice when the IoT device and the cloud server complete two-way authentication. Therefore, after completing the two-way authentication, the IoT device updates the historical device identification PID, historical challenge value CH and historical response value R stored this time.

[0108] The present application also includes a preferred embodiment of a log signing method, Figure 2 The figure is a flow chart of a log signing method in a preferred embodiment.

[0109] Step S210, initializing the IoT device, cloud server and user end in this application. Specifically, first, let κ be a security parameter, the system selects two p-order cyclic addition groups G1 and G2, and selects a p-order cyclic multiplication group G T , where p is a large prime number. Let P1, P2 and P3 be G1, G2 and G T Generator, where there exists a homomorphic mapping such that φ(P2)→P1 holds, and the bilinear pairing e: G1×G2→G T , choose two cryptographically secure hash functions, The key generation center (KGC) randomly selects MSK∈ As the master private key, calculate and publish the master public key MPK=MSK·P1, and retain the master key pair (MSK, MPK).

[0110] In step S220, the user registers with the IoT device using the biometric information feature, wherein a feature key σ is generated based on the biometric information, and the feature key is used as a challenge value to generate and store a challenge-response pair through the built-in PUF module.

[0111] Step S230: the device registers the device identification and the challenge response pair in the cloud server. After successful registration, the cloud server locally stores the new registration sequence {PID, (CH, R), RID}.

[0112] Step S240: The user and the IoT device perform two-way authentication. After successful authentication, the user can safely control the IoT device.

[0113] Step S250, the IoT device and the cloud server perform two-way authentication. After the authentication is successful, the IoT device sends the device log that needs to be updated to the cloud server. Specifically, the IoT device uploads a device log message package carrying the device log to the cloud server. After receiving the device log message package, the cloud server verifies the timeliness and reliability of the device log message package according to the method described above. After the verification is passed, the cloud server updates the historical device log stored in the cloud server based on the device log in the device log message package. The device log message package includes the new device identifier updated by the IoT device, the pseudo-random calculation result of the challenge value, and the update response value. After the cloud server obtains the device log message package, it updates the locally stored device identifier and challenge response pair accordingly.

[0114] Step S260: After the cloud server completes the update of the device log, it updates the locally stored challenge-response pair and device identification, and returns the second verification message packet to the IoT device, and the IoT device updates the locally stored device identification and challenge-response pair. Specifically, after the cloud server completes the update of the device log, it generates a second verification message packet, and then sends the second verification message packet to the IoT device; after the IoT device obtains the second verification message packet, it performs timeliness verification and reliability verification on the second verification message packet according to the method described above, and after the verification is passed, the two-way verification of the IoT device and the cloud server is completed, and the IoT device updates the locally stored device identification and challenge-response pair according to the second verification message packet.

[0115] In summary, it should be noted that administrators or third-party auditing agencies can audit by regularly reading device logs stored in cloud servers and verifying the integrity of logs by asking users to enter biometric information Bio' to ensure that device logs have not been tampered with since they were generated.

[0116] Furthermore, if the user denies the operation in the log, the biometric key can be recovered through the fuzzy extraction recovery function of the IoT device: Rep(Bio', θ) = σ, and the LogSign'=PRNG(σ||Dlog)⊕R1 can be verified to be consistent with the credentials in the cloud server. If they are consistent, it proves that the user has forged the credentials, which reflects the non-repudiation of the log signature.

[0117] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0118] Based on the same inventive concept, the embodiment of the present application also provides a log signing device for implementing the log signing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more log signing device embodiments provided below can refer to the limitations of the log signing method above, and will not be repeated here.

[0119] In one embodiment, Figure 3 As shown, a log signing device is provided, including: an authentication module, a log update module and a verification module, wherein:

[0120] The authentication module is used to complete the two-way authentication between the user terminal and the IoT device according to the user message information corresponding to the user terminal and the device message information corresponding to the IoT device; based on the device identification message package corresponding to the IoT device, complete the two-way authentication between the IoT device and the preset cloud server;

[0121] A log update module is used to send a device log message packet carrying a device log to a cloud server when it is detected that both the two-way authentication between the user terminal and the IoT device and the two-way authentication between the IoT device and the cloud server have passed, wherein the cloud server verifies the timeliness of the device log message packet according to the time when the device log message packet is obtained and verifies the reliability through the intermediate value in the device log message packet; after the cloud server generates a second verification message packet, receive the second verification message packet sent by the cloud server; wherein the second verification message packet is generated by the cloud server after the timeliness verification and reliability verification of the device log message packet have passed, and the cloud server updates the historical device log corresponding to the IoT device in the cloud server according to the device log in the device log message packet;

[0122] The verification module is used to verify the timeliness of the second verification message packet according to the time when the second verification message packet is obtained, and to verify the reliability through the intermediate value in the second verification message packet. When it is detected that both the timeliness verification and the reliability verification are passed, the two-way authentication of the Internet of Things device and the cloud server is completed.

[0123] Each module in the above-mentioned log signature device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module above.

[0124] In one embodiment, Figure 4 As shown, a log signature system is also provided, including a user terminal, an Internet of Things device and a cloud server; wherein the Internet of Things device is connected to the user terminal and the cloud server respectively, and the Internet of Things device is used to execute the method described above.

[0125] Specifically, the user end first authenticates the IoT device through the biometric key (it can be understood that the user end should have completed the registration process before authentication, see the user end registering with the IoT device above, which will not be repeated here), after the authentication is passed, the IoT device authenticates the device to the cloud server (similarly, the IoT device should have completed the registration process before authentication, see the IoT device registering with the cloud server above, which will not be repeated here), after the authentication is passed, the cloud server feedbacks to the IoT device, access control, and the IoT device sends the device log to the cloud server to update the historical device log in the cloud server. After the update is completed, the cloud server updates the challenge response pair and the device ID, and returns the updated challenge response pair and device ID to the IoT device, and uses the next IoT device to authenticate the cloud server.

[0126] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0127] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0128] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0129] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A log signing method, characterized in that: Applied to a preset IoT device, the method includes: According to the user message information corresponding to the user terminal and the device message information corresponding to the IoT device, the two-way authentication between the user terminal and the IoT device is completed; wherein the user message information carries the auxiliary characters obtained based on the user information characteristics and the timestamp when the user message information is generated; the device message information carries the auxiliary characters and the timestamp when the device message information is generated; the auxiliary characters represent the biometric characteristics of the user; Based on the device identification message packet corresponding to the IoT device, two-way authentication between the IoT device and the preset cloud server is completed; wherein, the IoT device sends the device identification message packet to the cloud server, and the cloud server completes the authentication of the IoT device through the device identification message packet; the cloud server sends a fifth verification message packet to the IoT device, and the IoT device completes the verification of the cloud server through the fifth verification message packet, wherein the device identification message packet includes a device identification, and an identification character obtained based on the acquired random number and the device identification; the fifth verification message packet is obtained based on the timestamp information when the cloud server obtains the device identification message packet, the challenge value in the challenge-response pair, and the response value corresponding to the challenge value; the challenge-response pair is obtained by encrypting a feature key based on the encryption module integrated on the IoT device, and the feature key is obtained based on feature fuzzy extraction processing of user information; When it is detected that both the two-way authentication between the user terminal and the IoT device and the two-way authentication between the IoT device and the cloud server are passed, a device log message packet carrying a device log is sent to the cloud server, wherein the cloud server verifies the timeliness of the device log message packet according to the time when the device log message packet is obtained and verifies the reliability through the intermediate value in the device log message packet, and the device log message packet includes the timestamp when the IoT device obtains the fifth verification message packet, the intermediate value of the device log message packet, and the device log, wherein the intermediate value of the device log message packet is obtained based on a pseudo-random calculation result of a challenge value obtained by pseudo-randomly processing the challenge value, the timestamp when the IoT device obtains the fifth verification message packet, parameters for enhancing security, the device log, and the device log signature; Wherein, updating the device identification includes: Performing pseudo-random calculation processing on the challenge value in the challenge-response pair, and updating the challenge value according to the pseudo-random calculation result of the challenge value; obtaining a corresponding updated response value according to the pseudo-random calculation result of the challenge value; and generating a new device identifier according to the pseudo-random calculation result of the challenge value, the updated response value, and a timestamp corresponding to the device log message packet; Wherein, the device log message packet includes a device log signature, the device log signature includes user information features, and the user information features include a feature key and auxiliary characters; After the cloud server generates the second verification message packet, receiving the second verification message packet sent by the cloud server; wherein the second verification message packet is generated by the cloud server after the timeliness verification and the reliability verification are passed, and the cloud server updates the historical device log corresponding to the IoT device in the cloud server according to the device log in the device log message packet; Performing timeliness verification on the second verification message packet according to the time when the second verification message packet is obtained, and performing reliability verification through an intermediate value in the second verification message packet, wherein the second verification message packet includes a timestamp when the second verification message is generated and the intermediate value of the second verification message packet obtained based on the challenge-response pair, and the intermediate value is calculated based on an updated challenge value, an updated response value corresponding to the updated challenge value, and a timestamp when the fifth verification message packet is obtained; When it is detected that both the timeliness verification and the reliability verification are passed, the two-way authentication between the IoT device and the cloud server is completed. The two-way authentication indicates that the message in the second verification message packet has not been tampered with during the transmission process.

2. The method according to claim 1, characterized in that Before completing the two-way authentication between the user terminal and the IoT device according to the user message information corresponding to the user terminal and the device message information corresponding to the IoT device, the user terminal registers with the IoT device terminal, and the method further includes: Based on the fuzzy extraction processing of the features of the user information by the user end, the user information features are obtained; Calculate the user public key based on the auxiliary character and the preset master public key, and calculate the user private key based on the feature key and the preset master private key; Based on the master public key, the auxiliary characters and the feature key after hash calculation, completing the registration of the user on the IoT device end; The characteristic key is encrypted based on the encryption module integrated on the IoT device to obtain a challenge-response pair.

3. The method according to claim 1, characterized in that Before completing the two-way authentication between the user terminal and the IoT device according to the user message information corresponding to the user terminal and the device message information corresponding to the IoT device, the method further includes: The hardware address of the IoT device is pseudo-randomly calculated to obtain the device identification, and an identification challenge response message packet is obtained based on the device identification and the challenge response pair obtained from the user end, and the identification challenge response message packet is sent to the cloud server to complete the registration on the cloud server end based on the identification challenge response message packet; wherein the challenge response pair is obtained based on the feature key.

4. The method according to claim 1, characterized in that: The method of completing the two-way authentication between the user terminal and the IoT device according to the user message information corresponding to the user terminal and the device message information corresponding to the IoT device includes: Obtain a third verification message packet carrying a third verification field; wherein the third verification message packet is obtained by the user end based on a preset user end derived key to encrypt the user message information, the third verification field, and the timestamp information of the third verification message packet generation time; the third verification field is obtained by encrypting the encryption result of the user end derived key to the user message information using the user end derived key; After completing the verification of the integrity of the third verification message packet, decrypting the encryption result of the user message information based on the user-side derived key to obtain the auxiliary character and the user-side timestamp, and after detecting that the auxiliary character and the user-side timestamp are valid, generating a device-side random number; After encrypting the device message information based on the master public key and the device-side derived key, a fourth verification message packet carrying a fourth verification field is obtained, and the fourth verification message packet is sent to the user side; wherein the device message information includes auxiliary characters and a device-side timestamp; After the user end completes the verification of the integrity of the fourth verification message packet, the device message information is decrypted based on the device-side derived key to obtain the auxiliary characters and the device-side timestamp. When the auxiliary characters and the device-side timestamp are verified to be valid, the two-way authentication between the user end and the IoT device is completed.

5. The method according to claim 1, characterized in that The method of completing the two-way authentication between the IoT device and the preset cloud server based on the device identification message packet corresponding to the IoT device includes: When the fifth verification message packet is obtained, the fifth verification message packet is subjected to timeliness verification. After the timeliness verification is passed, the fifth restoration verification field is obtained by calculating the intermediate value in the fifth verification message packet. When it is detected that the fifth restoration verification field is successfully compared with the fifth verification field in the fifth verification message packet, it is determined that the two-way authentication between the Internet of Things device and the cloud server is completed. The fifth verification message packet is that after the cloud server receives the device identification message packet sent by the Internet of Things device and verifies that the corresponding Internet of Things device has completed registration according to the device identification in the device identification message packet, the cloud server retrieves the challenge-response pair of the corresponding user according to the device identification, encrypts the challenge-response pair, the device identification and the fifth verification field, and generates the fifth verification message packet, which is sent to the Internet of Things device.

6. The method according to claim 5, characterized in that When the fifth verification message packet is obtained, performing timeliness verification on the fifth verification message packet includes: When the fifth verification message packet is obtained, a second timestamp is generated, and a first timestamp is obtained from the fifth verification message packet, and the timeliness of the fifth verification message packet is verified based on the first timestamp and the second timestamp, wherein if it is detected that the difference between the first timestamp and the second timestamp is less than a preset transmission delay, the fifth verification message packet is judged to be timely; wherein, the first timestamp is generated by the cloud server when the device identification message packet is received, and the fifth verification message packet includes the first timestamp.

7. The method according to claim 1, characterized in that The challenge response pair includes a challenge value and a response value corresponding to the user; and the sending of a device log message packet carrying a device log to the cloud server includes: Based on the new device identification, the pseudo-random calculation result of the challenge value and the updated response value, the device identification message packet is obtained, and the device identification message packet is sent to the cloud server, wherein the cloud server updates the challenge-response pair corresponding to the Internet of Things device stored in the cloud server based on the updated response value in the device identification message packet and the pseudo-random calculation result of the challenge value.

8. The method according to claim 7, characterized in that When it is detected that both the timeliness verification and the reliability verification are passed, after completing the two-way authentication between the IoT device and the cloud server, the method further includes: Based on the new device identification, the challenge value pseudo-random calculation result and the updated response value, the locally stored historical device identification, historical challenge value and historical response value are updated respectively.

9. A log signing device, characterized in that: The device comprises: An authentication module is used to complete two-way authentication between the user terminal and the IoT device according to the user message information corresponding to the user terminal and the device message information corresponding to the IoT device; wherein the user message information carries auxiliary characters obtained based on the user information characteristics and the timestamp when the user message information is generated; the device message information carries the auxiliary characters and the timestamp when the device message information is generated; the auxiliary characters represent the user's biometric characteristics; based on the device identification message packet corresponding to the IoT device, complete the two-way authentication between the IoT device and the preset cloud server; wherein the IoT device sends the device identification message packet to the cloud server, and completes the cloud server authentication through the device identification message packet Authentication of the IoT device; the cloud server sends a fifth verification message packet to the IoT device, and the IoT device completes the verification of the cloud server through the fifth verification message packet, wherein the device identification message packet includes a device identification, and an identification character obtained based on the acquired random number and the device identification; the fifth verification message packet is obtained based on the timestamp information when the cloud server obtains the device identification message packet, the challenge value in the challenge-response pair, and the response value corresponding to the challenge value; the challenge-response pair is obtained by encrypting a feature key based on an encryption module integrated on the IoT device, and the feature key is obtained based on feature fuzzy extraction of user information; A log update module, for, when detecting that both the two-way authentication between the user terminal and the IoT device and the two-way authentication between the IoT device and the cloud server are passed, sending a device log message packet carrying a device log to the cloud server, wherein the cloud server verifies the timeliness of the device log message packet according to the time when the device log message packet is obtained and verifies the reliability through the intermediate value in the device log message packet; the device log message packet includes the timestamp when the IoT device obtains the fifth verification message packet, the intermediate value of the device log message packet and the device log, wherein the intermediate value of the device log message packet is obtained based on the pseudo-random calculation result of the challenge value obtained by pseudo-randomly processing the challenge value, the timestamp when the IoT device obtains the fifth verification message packet, the parameters for enhancing security, the device log and the device log signature; Wherein, updating the device identification includes: Performing pseudo-random calculation processing on the challenge value in the challenge-response pair, and updating the challenge value according to the pseudo-random calculation result of the challenge value; obtaining a corresponding updated response value according to the pseudo-random calculation result of the challenge value; and generating a new device identifier according to the pseudo-random calculation result of the challenge value, the updated response value, and a timestamp corresponding to the device log message packet; Wherein, the device log message packet includes a device log signature, the device log signature includes user information features, and the user information features include a feature key and auxiliary characters; The log update module is further used to receive the second verification message packet sent by the cloud server after the cloud server generates the second verification message packet; wherein the second verification message packet is generated by the cloud server after the timeliness verification and the reliability verification of the device log message packet are passed, and the cloud server updates the historical device log corresponding to the IoT device in the cloud server according to the device log in the device log message packet; A verification module is used to verify the timeliness of the second verification message packet according to the time when the second verification message packet is obtained, and to verify the reliability through the intermediate value in the second verification message packet, wherein the second verification message packet includes the timestamp when the second verification message is generated and the intermediate value of the second verification message packet obtained based on the challenge response pair, and the intermediate value is calculated based on the updated challenge value, the updated response value corresponding to the updated challenge value, and the timestamp when the fifth verification message packet is obtained; when it is detected that both the timeliness verification and the reliability verification are passed, the two-way authentication of the Internet of Things device and the cloud server is completed, and the two-way authentication indicates that the message in the second verification message packet has not been tampered with during the transmission process.

10. A log signature system, characterized in that: It includes a user terminal, an Internet of Things device and a cloud server; wherein the Internet of Things device is connected to the user terminal and the cloud server respectively, and the Internet of Things device is used to execute the method described in any one of claims 1 to 8.

Images