Identity authentication method, electronic equipment and storage medium

Abstract

The invention discloses an identity authentication method, electronic equipment and a storage medium, and relates to the field of Internet of Things, the identity authentication method is applied to Internet of Things equipment in an Internet of Things system, the Internet of Things system is further deployed with central control equipment, and the method comprises the following steps: sending a registration request to the central control equipment, receiving a partial key generated by the central control device for the Internet of Things device based on the registration request; generating a registration public key of the Internet of Things equipment according to the system public parameter of the Internet of Things system, the equipment identifier of the Internet of Things equipment and a preset equipment random secret value; and according to the partial key, the device random secret value and a system public parameter of the Internet of Things system, generating a registration private key of the Internet of Things device, so that the Internet of Things device registered in the central control device performs identity authentication with a target to-be-authenticated Internet of Things device in the Internet of Things system based on the registration private key and the registration public key. The invention aims to solve the technical problem of low security of an Internet of Things system.

Description

Technical Field

[0001] The present application relates to the field of Internet of Things, and in particular to identity authentication methods, electronic devices and storage media. Background Art

[0002] In the IoT system, identity authentication between devices is the basis for ensuring data security and achieving trusted interaction between devices. For example, identity authentication technology based on identity cryptography (IBC) uses the user's identity information as the public key, without the need for additional certificate management, thereby simplifying the identity authentication process and reducing computing consumption. However, the generation and management of user keys in IBC technology are all performed in the key generation center (PKG). Once the PKG is compromised, all users' private keys will face the risk of leakage, which will affect the safe operation of IoT devices. Summary of the invention

[0003] The main purpose of this application is to provide an identity authentication method, an electronic device and a storage medium, aiming to solve the technical problem of low security of the Internet of Things system.

[0004] To achieve the above purpose, the present application provides an identity authentication method, wherein the IoT system is further equipped with a central control device, and the method comprises:

[0005] Sending a registration request to the central control device, and receiving a partial key generated by the central control device for the Internet of Things device based on the registration request;

[0006] Generate a registration public key for the Internet of Things device according to the system public parameters of the Internet of Things system, the device identification of the Internet of Things device and a preset device random secret value;

[0007] Generate a registration private key for the IoT device based on the partial key, the device random secret value, and the system public parameters of the IoT system, and generate a registration confirmation request based on the device identification of the IoT device;

[0008] A registration confirmation request is sent to the central control device to register the IoT device with the central control device, so that the IoT device registered with the central control device can perform identity authentication with the target IoT device to be authenticated in the IoT system based on the registration private key and the registration public key.

[0009] In a feasible embodiment, the step of sending a registration request to the central control device and receiving a partial key generated by the central control device for the IoT device based on the registration request includes: sending a parameter disclosure request to the central control device and receiving a system public parameter sent by the central control device based on the parameter disclosure request;

[0010] When the IoT device receives the system public parameters, a registration request is generated based on the device identification of the IoT device and a preset device random secret value, and the registration request is sent to the central control device, so that the central control device can calculate a partial key of the IoT device based on the device identification, a preset first hash function, a preset cyclic group order of the IoT system, a preset system master private key, and a preset private key generation identifier, and send the partial key to the IoT device; and receive the partial key sent by the central control device.

[0011] In a feasible embodiment, the method comprises:

[0012] In the case where the IoT device is registered with the central control device, receiving a first authentication request sent by a target IoT device to be authenticated registered with the central control device, and determining whether the first authentication request is valid;

[0013] When the first authentication request is valid, the target registration public key and target signature of the target IoT device to be authenticated are obtained from the first authentication request; based on the target registration public key, the target signature is verified to obtain a verification result; if the verification result is successful, it is determined that the identity authentication of the target IoT device to be authenticated in the IoT device is successful.

[0014] In a feasible embodiment, the step of determining whether the first authentication request is valid includes: obtaining a target preset authentication time threshold of the target IoT device to be authenticated and a first current timestamp of the first authentication request from the first authentication request; obtaining a reception timestamp of the IoT device receiving the first authentication request; if the duration between the reception timestamp and the first current timestamp is less than or equal to the target preset authentication time threshold, determining that the first authentication request is valid.

[0015] In a feasible embodiment, the Internet of Things system includes a first cyclic group and a second cyclic group, the generator of the first cyclic group is the first generator, and the generator of the second cyclic group is the second generator. After the step of determining that the identity authentication of the target Internet of Things device to be authenticated is successful in the Internet of Things device, the system also includes: determining the target device identifier and the first key negotiation parameter of the target Internet of Things device to be authenticated from the first authentication request; calculating the target hash value of the target Internet of Things device to be authenticated based on the target device identifier of the target Internet of Things device to be authenticated and a preset first hash function; calculating a random intermediate negotiation parameter based on the target hash value, the second generator and the system master public key; using the product of the first random number preset by the Internet of Things device and the random intermediate negotiation parameter as the second key negotiation parameter of the Internet of Things device; generating a first session negotiation key between the Internet of Things device and the target Internet of Things device to be authenticated based on the first key negotiation parameter of the target Internet of Things device to be authenticated, the target device identifier, the second key negotiation parameter of the Internet of Things device, the device identifier, the registered private key, the first random number, the device random secret value, the first generator of the Internet of Things system and the system master public key.

[0016] In a feasible embodiment, the step of generating a session negotiation key between the Internet of Things device and the target Internet of Things device to be authenticated based on the first key negotiation parameter of the target Internet of Things device to be authenticated, the target device identifier, the second key negotiation parameter of the Internet of Things device, the device identifier, the registration private key, the first random number, the device random secret value, the second generator of the second cyclic group of the Internet of Things system and the system master public key, and storing it in the Internet of Things device includes: calculating the first session negotiation parameter of the Internet of Things device based on a preset bilinear mapping relationship, the registration private key, the first key negotiation parameter, and the device random secret value; generating the second session negotiation parameter based on a preset bilinear mapping relationship, the first generator, the system master public key and the first random number of the Internet of Things device; using the power of the first random number of the first session negotiation parameter as the third session negotiation parameter of the Internet of Things device; calling a preset shared key derivation function, and calculating the first session negotiation key between the Internet of Things device and the target Internet of Things device to be authenticated according to the device identifier, the target device identifier, the first key negotiation parameter, the second key negotiation parameter, the first session negotiation parameter, the second session negotiation parameter and the third session negotiation parameter.

[0017] In a feasible embodiment, after the step of generating a first session negotiation key between the IoT device and the target IoT device to be authenticated based on the first key negotiation parameter of the target IoT device to be authenticated, the target device identifier, the second key negotiation parameter of the IoT device, the device identifier, the registration private key, the first random number, the device random secret value, the first generator of the IoT system and the system master public key, the step further includes: signing the device identifier, the preset random message, the second key negotiation parameter, the registration public key, the preset authentication time threshold and the second current timestamp of the IoT device based on the registration private key of the IoT device to obtain a signature of the IoT device; generating a second authentication request based on the signature, the device identifier, the preset random message, the second key negotiation parameter, the registration public key, the preset authentication time threshold and the second current timestamp, and sending the second authentication request to the target IoT device to be authenticated The target IoT device to be authenticated is a device for authenticating the target IoT device to be authenticated. When the second authentication request is valid, the registered public key and signature of the IoT device are obtained from the second authentication request, and the signature is verified based on the registered public key. If the signature verification is successful, it is determined that the IoT device has successfully authenticated the target IoT device to be authenticated. The target IoT device to be authenticated is also used to generate a second session negotiation key between the target IoT device to be authenticated and the IoT device based on the second key negotiation parameter of the IoT device, the device identifier, the first key negotiation parameter of the target IoT device to be authenticated, the target device identifier, the target registered private key, the preset second random number, the target device random secret value, the first generator of the IoT system and the system master public key when the IoT device has successfully authenticated the target IoT device to be authenticated.

[0018] In addition, to achieve the above-mentioned purpose, the present application provides an identity authentication method, which is applied to a central control device in an Internet of Things system, and the Internet of Things system is also deployed with an Internet of Things device, and the method includes: receiving a registration request sent by the Internet of Things device; determining the device identification of the Internet of Things device from the registration request, and generating a partial key of the Internet of Things device based on the device identification, a preset first hash function, and a system master private key of the Internet of Things system, and sending the partial key to the Internet of Things device; wherein the Internet of Things device is used to generate a registration private key of the Internet of Things device based on the partial key, a device random secret value preset by the Internet of Things device, and a system public parameter of the Internet of Things system; and is also used to generate a registration public key of the Internet of Things device based on the system public parameters, the device identification of the Internet of Things device and the device random secret value, so that the Internet of Things device can perform identity authentication with the target Internet of Things device to be authenticated in the Internet of Things system based on the registration private key and the registration public key.

[0019] In addition, to achieve the above purpose, the present application also provides an Internet of Things system, which includes:

[0020] An Internet of Things device, used to send a registration request to the central control device, receive a partial key generated by the central control device for the Internet of Things device based on the registration request; generate a registration public key of the Internet of Things device according to the system public parameters of the Internet of Things system, the device identification of the Internet of Things device and a preset device random secret value; generate a registration private key of the Internet of Things device according to the partial key, the device random secret value and the system public parameters of the Internet of Things system, and generate a registration confirmation request based on the device identification of the Internet of Things device; send a registration confirmation request to the central control device to register the Internet of Things device to the central control device, so that the Internet of Things device registered with the central control device can perform identity authentication with a target Internet of Things device to be authenticated in the Internet of Things system based on the registration private key and the registration public key;

[0021] The central control device is used to receive the registration request sent by the Internet of Things device; determine the device identification of the Internet of Things device from the registration request, and generate a partial key of the Internet of Things device based on the device identification, a preset first hash function, and the system master private key of the Internet of Things system, and send the partial key to the Internet of Things device.

[0022] In addition, to achieve the above-mentioned purpose, the present application also provides an electronic device, which includes: a memory, a processor, and a program of the identity authentication method stored in the memory and executable on the processor. When the program of the identity authentication method is executed by the processor, the steps of the identity authentication method as described above can be implemented.

[0023] In addition, to achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium, on which is stored a program for implementing the identity authentication method, and when the program of the identity authentication method is executed by a processor, the steps of the identity authentication method as described above are implemented.

[0024] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned identity authentication method when executed by a processor.

[0025] One or more technical solutions proposed in the present application have at least the following technical effects: the present application is applied to an IoT device in an IoT system, and a central control device is also deployed in the IoT system. In the present application, the IoT device can send a registration request to the central control device in the IoT system, and receive a partial key generated by the central control device based on the registration request. The registration public key of the IoT device is generated based on system public parameters, the device identification of the IoT device and the device random secret value. The IoT device generates a registration private key of the IoT device based on the partial key of the central control device, the device random secret value preset by the IoT device, and the system public parameters of the IoT system, so that the registration private key is jointly generated by the central control device and the IoT device, thereby improving the security of the registration private key. Even if an attacker attacks the central control device, the complete key of the IoT device cannot be obtained, thereby improving the security of the user key.

[0026] After generating the registration private key and the registration public key, a registration confirmation request is generated through the device identification to register the IoT device to the central control device, and the registration private key will not be sent to the central control device, which also improves the security of the registration private key; the IoT device registered with the central control device can perform identity authentication based on the registration private key and the registration public key, and the registration private key is not easily leaked, thereby improving the security of the IoT system. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings herein are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the description, are used to explain the principles of the present application.

[0028] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0029] Figure 1 This is a flow chart of an embodiment of the identity authentication method of the present application;

[0030] Figure 2 A schematic diagram of the connection between the IoT device and the central control device in the identity authentication method of this application;

[0031] Figure 3 A schematic diagram of the interaction between the IoT device and the central control device in the identity authentication method of this application;

[0032] Figure 4 This is a schematic diagram of the program modules of the Internet of Things system in the identity authentication method of this application;

[0033] Figure 5 This is a schematic diagram of the registration process of the IoT device in the identity authentication method of this application;

[0034] Figure 6 This is a schematic diagram of the structure of the Internet of Things system for the identity authentication method of this application;

[0035] Figure 7 This is a schematic diagram of the device structure of the hardware operating environment involved in the identity authentication method in the embodiment of the present application.

[0036] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0037] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application. In order to better understand the technical solutions of the present application, the following will be described in detail in conjunction with the drawings and specific implementation methods of the specification. Due to the immaturity of IoT security technology, many IoT security incidents have occurred in recent years, posing huge threats to the personal and privacy security of users. How to improve the security of the IoT is an urgent problem to be solved. In the IoT, there are many limitations on the use of devices, such as limited memory, low power consumption, mobility, and support for multiple network protocols. Therefore, compared with the identity authentication technology in traditional networks, the identity authentication technology in the IoT is more complex and is considered to be a key technology for IoT security. Trusted identity authentication technology can ensure the normal operation of the IoT system and is crucial to the stability of the network.

[0038] There are two types of identity authentication methods: identity authentication based on PKI (Public Key Infrastructure) and identity authentication based on IBC (Identity-Based Cryptography); the core idea of ​​PKI is that a third-party institution, the Certification Authority (CA), binds the user's identity information (such as name, phone number, etc.) to the public key it holds. Before binding, the CA will verify the authenticity of the user's identity, and then use its signed certificate to ensure the authenticity of the user's public key. In this way, other users can use the public key to verify the user's identity and encrypt communications. IBC technology still uses an asymmetric cryptographic system, but unlike the traditional public key cryptographic system, the user's identity information (such as user ID (Identity), email address, phone number, etc.) is its public key, and the private key is generated by the private key generator combining the user's identity information and the system master key. In this way, the IBC system can achieve secure communication without the need for digital certificates.

[0039] Although PKI-based authentication technology has good flexibility and scalability. However, in the IoT system, IoT devices usually have the characteristics of simple CPU (Central Processing Unit) structure and weak computing and communication capabilities. PKI-based authentication schemes usually require complex certificate management and consume a lot of computing resources, which is not suitable for resource-constrained IoT (Internet of Things) environments. Although IBC-based authentication technology does not have certificate management, its security is too dependent on the key generation center PKG (Private Key Generation Center). If the PKG is compromised, all user keys will be leaked, putting the entire system at risk.

[0040] In addition, in the current IoT system, before two IoT devices need to communicate, they need to bind IoT devices. However, currently only one-to-one binding between two IoT devices is supported. If there are multiple IoT devices in the IoT system and each IoT device needs to bind to each other, multiple interactions are required. For example, it takes 10 bindings to connect five devices to each other, and the number of bindings increases exponentially with the number of system devices. In addition, at present, the binding between any two IoT devices requires interaction with the user, and the security of the interaction process depends in part on the user's operation, but there is no guarantee that all operations are from legitimate users, which increases the insecurity of the IoT system.

[0041] In addition, it is easily limited by the storage capacity of the device. When multiple IoT devices are connected in the IoT system, each device must store the public keys of all other trusted devices, which will occupy too much storage resources of the IoT devices.

[0042] Therefore, this embodiment proposes an identity authentication method, in which a central control device is deployed in the Internet of Things system, and all Internet of Things devices can be registered in the central control device, and the registered private key of the Internet of Things device is obtained by the Internet of Things device and the central control device, thereby improving the security of the registered private key of the Internet of Things device, thereby ensuring the security of the key, and the Internet of Things device registered in the central control device can perform identity authentication based on the registered private key and the registered public key, thereby improving the security of identity authentication, and the Internet of Things devices registered on the central control device can communicate directly with each other, without the need for one-to-one binding between Internet of Things devices, reducing the complexity of communication between Internet of Things devices, and also improving the security of binding. In the embodiment of the present application, the registered private key is used to sign the message, and the registered public key can be used to verify the signature.

[0043] This application embodiment provides an identity authentication method, referring to Figure 1, Figure 1 This is a flow chart of an embodiment of the identity authentication method of this application. This embodiment is applied to an IoT device in an IoT system, and the IoT system is also deployed with a central control device. The identity authentication method includes steps S10 to S40:

[0044] Step S10, sending a registration request to the central control device, and receiving a partial key generated by the central control device for the IoT device based on the registration request;

[0045] It should be noted that there may be multiple IoT devices in the IoT system, and a central control device is deployed in the IoT system. The central control device can be used to receive registration requests from IoT devices, and each IoT device in the IoT system can be registered with the central control device. The registration request is used to indicate that the IoT device needs to be registered with the central control device. Partial keys are generated by the central control device for IoT devices. Different IoT devices have different partial keys generated by the central control device for the IoT devices. It can be understood that IoT devices that need to be registered with the central control device have their own corresponding partial keys. The central control device can be a KGC. After the central control device completes initialization, the IoT devices in the IoT system can be registered with the central control device. Exemplarily, a registration request is sent to the central control device, and a partial key generated by the central control device for the IoT device based on the registration request is received.

[0046] In a feasible embodiment, step S10 further includes steps S11 to S13:

[0047] Step S11, sending a parameter disclosure request to the central control device, and receiving system public parameters sent by the central control device based on the parameter disclosure request;

[0048] Step S12, when the IoT device receives the system public parameters, a registration request is generated based on the device identification of the IoT device and a preset device random secret value, and the registration request is sent to the central control device, so that the central control device can calculate a partial key of the IoT device based on the device identification, the preset first hash function, the preset cyclic group order of the IoT system, the preset system master private key, and the preset private key generation identifier, and send the partial key to the IoT device;

[0049] Step S13: receiving a partial key sent by the central control device.

[0050] It should be noted that the IoT device that needs to register with the central control device can first send a parameter disclosure request to the central control device. The parameter disclosure request is used to request the central control device to send system public parameters, so as to facilitate the IoT device to generate a registration request. The parameter disclosure request can carry the device identifier of the IoT device. The device identifier is the ID of the IoT device. The system public parameters are parameters visible to all IoT devices that need to register. In this embodiment, the system public parameters may include R params =(N,G1,G2,P1,P2,P pub ,e,hid,H1,H2,H3,KDF), where R params is the system public parameter, N is the preset cyclic group order of the Internet of Things system, the cyclic group order is the number of different elements in the cyclic group, G1 is the first cyclic group of the Internet of Things system, G2 is the second cyclic group of the Internet of Things system, hid is the preset private key generation identifier, in the cyclic group, if there is an element m that can generate all other elements in the group through continuous operations, then m is called the generator of the cyclic group, and P1 is the first generator of the first cyclic group, which means that all elements in the first cyclic group can be generated by the power of P1; P2 is the second generator of the second cyclic group, which means that all elements in the second cyclic group can be generated by the power of P2; P pub is a system master public key preset for the Internet of Things system. The system master public key may be the product of a system master private key s of a control device preset by a central control device and a second generator P2. e is represented by a bilinear mapping function. H1, H2, and H3 are respectively a first hash function, a second hash function, and a third hash function preset by the central control device. The first hash function, the second hash function, and the third hash function may all be used for hash calculation. The first hash function, the second hash function, and the third hash function may be determined based on actual conditions, and this embodiment does not specifically limit this. N A set of integers representing modulo N, where N is the order of the cyclic group, and the first cyclic group and the second cyclic group have the same order. KDF (Key Derivation Function) is a key derivation function that facilitates IoT devices to negotiate session keys before communicating with other IoT devices registered with the central control device.

[0051] The control random number s is randomly selected by the central control device in [1, N-1]. The device random secret value includes a random device value and a device derived value. The random device value is randomly selected by the IoT device in [1, N-1]. The device derived value can be determined based on the device identification of the IoT device. The device derived value helps to ensure the uniqueness of the device random secret value. The random device value and the system master private key s can be different.

[0052] The registration request carries the device identifier of the IoT device and also carries the product of the random device value and the second generator.

[0053] The first Hash function may be H1, and the preset private key generation identifier may be determined in advance based on actual conditions, which is not specifically limited in this embodiment. The preset private key generation identifier is a preset private key generation function identifier.

[0054] Exemplarily, the IoT device sends a parameter disclosure request to the central control device, and the central control device sends the system public parameters to the IoT device based on the parameter disclosure request. After receiving the system public parameters, the IoT device generates a registration request based on the device identification and the product of the random device value in the device random secret value and the system master private key, and sends the registration request to the central control device. The central control device generates a partial key of the IoT device based on the device identification, the preset first hash function, the cyclic group order, the system master private key, and the private key generation identifier, and the central control device sends the partial key to the IoT device. For example, the steps for the central control device to generate a partial key of the IoT device are: calculating the partial key intermediate value t=s+H1(ID||hid,N), the partial key sk′=st -1 P1, where t is the intermediate value of the partial key, H1 is the first hash function, ID||hid represents the concatenation of the device ID of the IoT device and the preset private key generation ID hid, H1(ID||hid,N) means that the concatenated device ID of the IoT device and the preset private key generation ID are hashed by H1, and the length of the obtained hash value does not exceed N. If it exceeds N, the remainder of the hash value is taken. sk′ is the partial key, t -1 is the inverse of the intermediate value of the partial key, and P1 is the first generator of the first cyclic group. When t is 0, it is necessary to re-determine the system master private key s and calculate t again until t is not 0. When t is not 0, it can be determined that sk′=st -1 P1.

[0055] In this embodiment, part of the key is generated by the central control device for the IoT device, which improves the security of the part of the key, thereby facilitating the subsequent improvement of the security of the registered private key of the IoT registration device.

[0056] Step S20, generating a registration public key of the IoT device according to the system public parameters of the IoT system, the device identification of the IoT device and a preset device random secret value;

[0057] It should be noted that the device random secret value is pre-set by the IoT device, and different IoT devices may have different device random secret values. The registration public key can be used for identity authentication, etc. Exemplary formulas for generating the registration public key include:

[0058] h1=H1(ID||hid,N); pk′=h1P2+P pub ;y=H3(ID||hid||pk′,N);

[0059] PK=(x+y) -1 ·pk′;

[0060] Where PK is the registered public key, x is the random device value in the device random secret value, and P pub is the system master public key in the system public parameters, ID is the device identifier of the IoT device, hid is the preset private key generation identifier in the system public parameters, P2 is the second generator of the second cyclic group, h1 is the value obtained by performing hash calculation on the preset private key generation identifier and the device identifier of the IoT device based on the first hash function, and taking the modulus of N, pk′ is the registered private key intermediate value, and the registered private key intermediate value is the product of h1 and the second generator P2, and the product is the sum of the preset private key generation identifier. y is the device derived value in the device random secret value, and the key intermediate value is the value obtained by performing hash calculation on the spliced ​​device identifier, preset private key and parking private key intermediate value of the IoT device based on the preset third hash function, and taking the modulus of N. H1 is the first hash function, H3 is the third hash function, || represents splicing, and N is the order of the cyclic group.

[0061] Step S30, generating a registration private key for the IoT device based on the partial key, the device random secret value, and the system public parameters of the IoT system, and generating a registration confirmation request based on the device identification of the IoT device;

[0062] It should be noted that after determining the registration private key and the registration public key, the IoT device can generate a registration confirmation request based on the device identification. The registration confirmation request indicates that the IoT device has generated the registration public key and the registration private key and can be registered in the central control device. For example, the formula for calculating the registration private key is:

[0063] SK = (x + y) · sk′;

[0064] Wherein, SK is the registered private key, x is the random device value in the device random secret value of the IoT device, y is the device derived value, and sk′ is the partial key. Wherein, the device derived value y is determined based on the first hash function, the third hash function, the second generator, the system master public key, and the order of the cyclic group in the system public parameters. For details, please refer to the expression of the device derived value y in step S20, which will not be repeated in this embodiment.

[0065] Step S40, sending a registration confirmation request to the central control device, registering the IoT device to the central control device, so that the IoT device registered with the central control device can perform identity authentication with the target IoT device to be authenticated in the IoT system based on the registration private key and the registration public key.

[0066] It should be noted that after generating a registration confirmation request, the IoT device can send a registration confirmation request to the central control device, so that the IoT device can be registered in the central control device. For example, after the central control device receives the registration confirmation request of the IoT device, it can end the registration process and record the registration of the IoT device in the central control device. After the IoT device is recorded in the central control device, the IoT devices in the central control device can directly perform identity authentication and communicate with each other, without the need to bind each IoT device one-to-one.

[0067] Exemplarily, the IoT device sends a registration confirmation request to the central control device, the central control device ends the registration process of the IoT device, and records the device identification of the IoT device in the central control device to complete the registration of the IoT device, thereby facilitating identity authentication and communication between IoT devices registered on the central control device. In this embodiment, the registration public key and registration private key of the same IoT device cannot be derived from each other, thereby ensuring the security of the IoT device.

[0068] The embodiment of the present application is applied to an IoT device in an IoT system, and a central control device is also deployed in the IoT system. In the embodiment of the present application, the IoT device can send a registration request to the central control device in the IoT system, and receive a partial key generated by the central control device based on the registration request. The registration public key of the IoT device is generated based on the system public parameters, the device identification of the IoT device and the device random secret value. The IoT device generates the registration private key of the IoT device based on the partial key of the central control device, the device random secret value preset by the IoT device and the system public parameters of the IoT system, so that the registration private key is jointly generated by the central control device and the IoT device, which improves the security of the registration private key. Even if an attacker attacks the central control device, the complete key of the IoT device cannot be obtained, which improves the security of the user key. After generating the registration private key and the registration public key, a registration confirmation request is generated through the device identification to register the IoT device to the central control device, and the registration private key will not be sent to the central control device, which also improves the security of the registration private key; the IoT device registered in the central control device can realize identity authentication based on the registration private key and the registration public key, and the registration private key is not easy to leak, thereby improving the security of the IoT system.

[0069] In a feasible embodiment, the identity authentication method further includes steps A10 to A40:

[0070] Step A10, when the IoT device is registered with the central control device, receiving a first authentication request sent by the target IoT device to be authenticated registered with the central control device, and determining whether the first authentication request is valid;

[0071] It should be noted that the target IoT device to be authenticated is also an IoT device registered in the central control device. The target IoT device to be authenticated is a device that the IoT device needs to authenticate. When the identity authentication between the target IoT device to be authenticated and the IoT device is successful, the target IoT device to be authenticated can communicate with the IoT device. The first authentication request is an identity authentication request initiated by the target IoT device to be authenticated. The IoT device will detect whether the received first authentication request is valid, and then perform subsequent identity authentication, thereby facilitating the improvement of the security of identity authentication. IoT devices registered in the central control device can send authentication requests to each other. When one of the IoT devices receives the authentication request, it will first determine the validity of the authentication request. The target IoT device to be authenticated can be any IoT device registered in the central control device. The target IoT device to be authenticated is different from the IoT device that receives the first authentication request.

[0072] In a feasible embodiment, step A10 further includes steps A11 to A13:

[0073] Step A11, obtaining a target preset authentication time threshold of a target IoT device to be authenticated and a first current timestamp of the first authentication request from the first authentication request;

[0074] Step A12, obtaining a receiving timestamp of the IoT device receiving the first authentication request;

[0075] Step A13: If the duration between the received timestamp and the first current timestamp is less than or equal to the target preset authentication duration threshold, it is determined that the first authentication request is valid.

[0076] It should be noted that the target preset authentication time threshold is set for the target IoT device to be authenticated, and the target preset authentication time threshold can be determined based on actual conditions, and this embodiment does not specifically limit this. The target preset authentication time threshold represents the longest time that the first authentication request is valid, and the first current timestamp may be the moment when the first authentication request is generated. Exemplarily, the receiving timestamp is the moment when the first authentication request is received. When the time between the first current timestamp and the receiving timestamp is greater than the preset authentication time threshold, it means that the first authentication request has expired, which may be an illegal operation and there is an unsafe risk, so it can be determined that the first authentication request is invalid; when the time between the receiving timestamp and the first current timestamp is less than or equal to the preset authentication time threshold, the first authentication request is determined to be valid. This embodiment improves the security of identity authentication by determining whether the first authentication request is valid.

[0077] Step A20, if the first authentication request is valid, obtaining a target registration public key and a target signature of the target IoT device to be authenticated from the first authentication request;

[0078] Step A30, based on the target registered public key, verify the target signature to obtain a verification result;

[0079] Step A40: If the verification result is successful, it is determined that the identity authentication of the target IoT device to be authenticated in the IoT device is successful.

[0080] It should be noted that the target registration public key is the registration public key of the target IoT device to be authenticated, and the target registration private key is the registration private key of the target IoT device to be authenticated.

[0081] The first authentication request includes the target device identification, target random message, target signature, first key negotiation parameter, first current timestamp and target preset authentication duration of the target IoT device to be authenticated. The target signature is a signature obtained by signing the target device identification, target random message, first key negotiation parameter, first current timestamp and target preset authentication duration of the target IoT device to be authenticated based on the target registered private key. The first key negotiation parameter is determined by the target IoT device to be authenticated based on the device identification of the IoT device, the second generator of the second cyclic group, the system master public key, the preset private key generation identifier and the order of the cyclic group of the IoT system. The order of the IoT cyclic group includes the first cyclic group and the second cyclic group.

[0082] Exemplarily, the step of generating a first authentication request by the target IoT device to be authenticated includes: calculating a first key negotiation parameter R of the target IoT device to be authenticated A , and then get the first current timestamp Time of the IoT system A , use the current timestamp as the first current timestamp, and set the target preset authentication timeoutA , and finally select the preset target random message M A , based on the registered private key of the target IoT device to be authenticated, A ||M A ||R A ||PK A ||Time A ||Timeout A ) to sign and get the target signature Sig A , where PK A Register the public key of the target IoT device to be authenticated, and then concatenate the target device identifier, target random message, target signature, first key negotiation parameter, first current timestamp and target preset authentication duration of the target IoT device to be authenticated to obtain the first authentication request Q A auth =(ID A ,M A ,Sig A ,R A ,PK A ,Time A ,Timeout A ) and sent to IoT devices. A auth For the first authentication request, ID A is the target device identifier, M A For the preset target random message, Sig A Sign the target, R A is the first key negotiation parameter, Time A is the first current timestamp, Timeout A The target random message can be determined based on actual conditions, and this embodiment does not make any specific limitation on this.

[0083] The steps for the IoT device registered with the central control device to generate an authentication request are the same as the steps for the target IoT device to be authenticated to generate a first authentication request. The verification result is used to characterize whether the target signature verification is successful. When the verification result is a verification failure, it means that the first authentication request may be changed. At this time, it is determined that the identity authentication of the target IoT device to be authenticated on the IoT device has failed. Exemplarily, when the verification result is a verification success, it means that the first authentication request has not been changed, and it can be determined that the identity authentication of the target IoT device to be authenticated on the IoT device has been successful. This embodiment verifies the target signature against the target registered public key in the first authentication request to determine whether the identity authentication of the target IoT device to be authenticated on the IoT device is successful, thereby improving the security of identity authentication.

[0084] In a feasible embodiment, the Internet of Things system includes a first cyclic group and a second cyclic group, the generator of the first cyclic group is a first generator, the generator of the second cyclic group is a second generator, and step A40 further includes steps A41 to A45:

[0085] Step A41, determining a target device identifier and a first key negotiation parameter of a target IoT device to be authenticated from the first authentication request;

[0086] Step A42, calculating a target hash value of the target IoT device to be authenticated based on the target device identifier of the target IoT device to be authenticated and a preset first hash function;

[0087] Step A43, calculating a random intermediate negotiation parameter based on the target hash value, the second generator and the system master public key;

[0088] Step A44, using the product of the first random number preset by the IoT device and the random intermediate negotiation parameter as the second key negotiation parameter of the IoT device;

[0089] It should be noted that the target device identifier is the device identifier of the target IoT device to be authenticated. The target hash value is calculated by the IoT device based on the target device identifier and the preset first hash function. For example, for ease of explanation, A is used to represent the target IoT device to be authenticated, and B is used to represent the IoT device. The formula for calculating the target hash value by the IoT device is:

[0090] h A =H1(ID A ||hid,N);

[0091] Among them, h A The target hash value of the target IoT device A to be authenticated calculated by IoT device B, ID A is the target device identifier of the target IoT device to be authenticated, N is the cyclic group order, hid is the preset private key generation identifier, and H1 is the first hash function. The random intermediate negotiation parameter can be the system master public key plus the product of the target hash value and the second generator. For example, the calculation formula of the random intermediate negotiation parameter is:

[0092] L A =h A P2 + P pub ;

[0093] Among them, L A Leveraging h for IoT devices A , the random intermediate negotiation parameter generated by the second generator and the system master public key, P2 is the second generator, P pubIt is understandable that in this embodiment, the random intermediate negotiation parameters generated by the IoT device are determined based on the target device identifier of the target IoT device to be authenticated, the system master public key of the IoT system, the second generator, the cyclic group order, the first Hash function, and the preset private key generation identifier, and the target random intermediate negotiation parameters of the target IoT device to be authenticated are determined based on the device identifier of the IoT device, the system master public key of the IoT system, the second generator, the cyclic group order, the first Hash function, and the preset private key generation identifier.

[0094] The second key negotiation parameter may be the product of the first random number and the random intermediate negotiation parameter. The first random number is randomly selected by the IoT device in [1, N-1]. The first random number may be expressed as r B The second key negotiation parameter may be used to negotiate a session key with the target IoT device to be authenticated, so as to improve the communication security between the target IoT device to be authenticated and the IoT device.

[0095] Step A45, based on the first key negotiation parameter of the target IoT device to be authenticated, the target device identifier, the second key negotiation parameter of the IoT device, the device identifier, the registered private key, the first random number, the device random secret value, the first generator of the IoT system and the system master public key, generate a first session negotiation key between the IoT device and the target IoT device to be authenticated.

[0096] It should be noted that a first session negotiation key between the IoT device and the target IoT device to be authenticated can be generated in the IoT device, and the first session negotiation key can be saved, so that the IoT device can communicate with the target IoT device to be authenticated based on the session negotiation key, thereby improving communication security. In the target IoT device to be authenticated, the target IoT device to be authenticated will also generate a second session negotiation key with the IoT device, and the second session negotiation key generated by the target IoT device to be authenticated is the same as the first session negotiation key generated by the IoT device. The difference between the first session negotiation key and the second session negotiation key is that the first session negotiation key is generated in the IoT device, and the second session negotiation key is generated in the target IoT device to be authenticated. This improves the communication security between the IoT device and the target IoT device to be authenticated.

[0097] Exemplarily, a preset bilinear mapping relationship can be called to calculate the first session negotiation key based on the first key negotiation parameter of the target IoT device to be authenticated, the target device identifier, the second key negotiation parameter of the IoT device, the device identifier, the registration private key, the first random number, the device random secret value, the first generator of the IoT system, and the system master public key.

[0098] In a feasible embodiment, step A45 further includes steps A451 to A454:

[0099] Step A451, calculating a first session negotiation parameter of the IoT device based on a preset bilinear mapping relationship, a registered private key, a first key negotiation parameter, and a device random secret value;

[0100] It should be noted that the preset bilinear mapping relationship is characterized as a bilinear mapping function, which can be represented by e. The bilinear mapping function allows the calculation of the public key without knowing the private key. The IoT device can register the private key, the second key negotiation parameter, and the device random secret value based on the preset bilinear mapping relationship to calculate the first session negotiation parameter. The first session negotiation parameter is an intermediate value generated in the process of calculating the first session negotiation key. For example, the formula for the IoT device to calculate the first session negotiation parameter is:

[0101] g1=e(SK B ,(x B +y B ) -1 R A )

[0102] Among them, g1 is the first session negotiation parameter, e represents the bilinear mapping function, SK B R is the registered private key of the IoT device. A is the first key negotiation parameter of the target IoT to be authenticated, (x B +y B ) is the random secret value of the IoT device, x B is the random device value of the IoT device, y B Device-derived value for IoT devices.

[0103] Step A452: Generate a second session negotiation parameter based on a preset bilinear mapping relationship, a first generator, a system master public key, and a first random number of the IoT device;

[0104] It should be noted that the first random number of the IoT device is selected from [1, N-1], and the first random number is generally different from the random device value of the IoT device. The second session negotiation parameter is also an intermediate value in the process of calculating the session negotiation key. For example, the formula for calculating the second session negotiation parameter by the IoT device is:

[0105] g2=e(P1,P pub ) rB

[0106] Where g2 is the second session negotiation parameter, e is represented by a bilinear mapping function, P1 is the first generator, P pub is the system master public key, rB is the first random number.

[0107] Step A453, using the power of the first random number of the first session negotiation parameter as the third session negotiation parameter of the IoT device;

[0108] It should be noted that the third session negotiation parameter is also an intermediate value in the process of the IoT device calculating the session negotiation key. For example, the formula of the third session negotiation parameter is:

[0109] g3=g1 rB

[0110] Among them, is the third intermediate session key, and g1 is the first intermediate session key.

[0111] Step A454, calling a preset shared key derivation function, and calculating the first session negotiation key between the IoT device and the target IoT device to be authenticated based on the device identifier, the target device identifier, the first key negotiation parameter, the second key negotiation parameter, the first session negotiation parameter, the second session negotiation parameter, and the third session negotiation parameter.

[0112] It should be noted that the preset shared key derivation function is KDF (Key Derivation Function), the length of the first session negotiation key is a preset length, the preset length can be set based on actual conditions, and the preset shared key derivation function can generate a first session key of the preset length. For example, the calculation of the first session key can be expressed as:

[0113] ikB B =KDF(ID A ||ID B ||R A ||R B ||g1||g2||g3,klen)

[0114] Among them, ShK B Negotiate the key for the first session, KDF is the preset shared key derivation function, ID A Device ID B is the target device identifier, R B is the first key negotiation parameter, R A is the second key negotiation parameter, g1 is the first session negotiation parameter, g2 is the second session negotiation parameter, g3 is the third session negotiation parameter, and klen is the length of the first session key. || indicates concatenation.

[0115] This embodiment generates a first session negotiation key for interacting with the target IoT device to be authenticated on the IoT device, thereby facilitating subsequent communication between the IoT device and the target IoT device to be authenticated, thereby improving the security of communication between the target IoT device to be authenticated and the IoT device.

[0116] In a feasible embodiment, after step A40, steps X10 to X20 are further included:

[0117] Step X10, based on the registered private key of the IoT device, the device identification of the IoT device, the preset random message, the second key negotiation parameter, the registered public key, the preset authentication time threshold and the second current timestamp are signed to obtain the signature of the IoT device;

[0118] It should be noted that after the IoT device generates the second key negotiation parameter, it can continue to generate the first session negotiation key, and the IoT device can also send a second authentication request to the target IoT device to be authenticated, so as to authenticate the IoT device in the target IoT device to be authenticated. The random message preset by the IoT device can be determined based on the actual situation, and this embodiment does not make specific restrictions on this. The preset authentication time threshold is the authentication time threshold preset by the IoT device, and the preset authentication time threshold can also be determined based on the actual situation, and this embodiment does not make specific restrictions on this. The preset authentication time threshold of the IoT device can be the same as or different from the target preset authentication time threshold of the target IoT device to be authenticated, and this embodiment does not make specific restrictions on this.

[0119] The second current timestamp is the time currently obtained by the IoT device, for example, it can be the current timestamp corresponding to when the IoT device signs, etc. The registered private key can be used to sign the device identification, the preset random message, the second key negotiation parameter, the registered public key, the preset authentication time threshold and the second current timestamp to obtain the signature of the IoT device.

[0120] Step X20, based on the signature, device identification, preset random message, second key negotiation parameter, registration public key, preset authentication time threshold and second current timestamp, generate a second authentication request, send the second authentication request to the target IoT device to be authenticated, so that the target IoT device to be authenticated can obtain the registration public key and signature of the IoT device from the second authentication request if the second authentication request is valid, and verify the signature based on the registration public key. If the signature verification is successful, it is determined that the IoT device is successfully authenticated in the target IoT device to be authenticated.

[0121] Among them, the target IoT device to be authenticated is also used to generate a second session negotiation key between the target IoT device to be authenticated and the IoT device based on the second key negotiation parameter of the IoT device, the device identifier, the first key negotiation parameter of the target IoT device to be authenticated, the target device identifier, the target registration private key, a preset second random number, the target device random secret value, the first generator of the IoT system and the system master public key when the IoT device successfully authenticates the target IoT device.

[0122] It should be noted that the second authentication request generated by the IoT device includes a signature, a device representation, a preset random message, a second key negotiation parameter, a registered public key, a preset authentication duration threshold, and a second current timestamp. The second current timestamp can be sent to the target IoT device to be authenticated, and the target IoT device to be authenticated verifies the second authentication request. After receiving the second authentication request, the process of verifying the second authentication request by the target IoT device to be authenticated is the same as the process of verifying the first authentication request by the IoT device after receiving the first authentication request. The target device random secret value is the device random secret value of the target IoT device to be authenticated. The target device random secret value includes a target random device value and a target device derived value. The target random device value is randomly selected by the target IoT device to be authenticated in [1, N-1]. The device derived value can be determined based on the device identification of the target IoT device to be authenticated. The target device derived value helps to ensure the uniqueness of the target device random secret value. The random device value and the system master private key s may be different. The calculation method of the target device derived value is the same as the device derived value of the IoT device, which will not be repeated in this embodiment.

[0123] For example, in the target IoT device to be authenticated, the target IoT device to be authenticated will also obtain the preset authentication duration threshold and the second current timestamp of the IoT device from the second authentication request; obtain the reception timestamp of the target IoT device to be authenticated receiving the second authentication request; if the time between the reception timestamp of the second authentication request and the second current timestamp is less than or equal to the preset authentication duration threshold, the second authentication request is determined to be valid; if the time between the reception timestamp of the second authentication request and the second current timestamp is greater than the preset authentication duration threshold, the second authentication request is determined to be invalid, and the identity authentication process of the IoT device is terminated without performing session key negotiation.

[0124] If the second authentication request is valid, the target IoT device to be authenticated can calculate the second session negotiation key. For example, the mutual authentication and session key negotiation process between the IoT device and the target IoT device to be authenticated in this embodiment can be described with reference to the following example: (wherein, mutual authentication includes the IoT device performing identity authentication on the target IoT device to be authenticated, and the target IoT device to be authenticated performing identity authentication on the IoT device).

[0125] Target IoT device A to be authenticated: Target IoT device to be authenticated calculates hв=H1(ID B ||hid,N); calculate Lв=h B P2+P pub ; The target IoT device to be authenticated generates a second random number r A ∈[1,N-1]; calculate R A =r A L B , the target IoT device A to be authenticated generates a message including the target device identifier, the target random message preset by the target IoT device to be authenticated, the target registered public key, the target signature, the first current timestamp, the target preset authentication time threshold and the first key negotiation parameter R A The first authentication request is sent to IoT device B. Among them, hв is the hash value of the IoT device calculated by the target IoT device to be authenticated, ID B is the device identifier of IoT device A, hid is the preset private key generation identifier, Lв is the target random intermediate negotiation parameter calculated by the target IoT device to be authenticated, r A Generate a second random number for the target IoT device to be authenticated.

[0126] IoT device B: After receiving the first authentication request, IoT device B will authenticate the target IoT device A based on the first authentication request. After the IoT device successfully authenticates the target IoT device A, IoT device B will calculate the second key negotiation parameter. The calculation of the second key negotiation parameter by IoT device B includes: calculating h A =H(ID A ||hid,N); calculate L A =h A P2+P pub ; IoT device B generates a first random number r B ∈[1,N-1]; calculate R B =r B L A ; Determine the first key negotiation parameter R of the target IoT device to be authenticated A Whether it belongs to the second cycle group of the Internet of Things system, if R Adoes not belong to the second cycle group of the IoT system, then the session key negotiation fails. A The second cycle group belonging to the Internet of Things system calculates the first session negotiation parameter, the second session negotiation parameter and the third session negotiation parameter; calculates the first session key ShK B =KDF(ID A ||ID B ||R A ||R B ||g1||g2||g3, klen); IoT device B generates a second authentication request and sends the second authentication request to the target IoT device A to be authenticated.

[0127] Among them, h A The hash value of the target IoT device to be authenticated calculated by the IoT device, ID A is the target device identifier of the target IoT device B to be authenticated, hid is the preset private key generation identifier, L A The random intermediate negotiation parameter calculated for the IoT device, r B Generate the first random number for IoT devices.

[0128] After receiving the second authentication request, the target IoT device A to be authenticated performs identity authentication on the IoT device B based on the second authentication request. For example, if the second authentication request is valid, the registered public key and signature of the IoT device are obtained from the second authentication request, and the signature is verified based on the registered public key. If the verification succeeds, it is determined that the identity authentication of the IoT device in the target IoT device to be authenticated is successful. If the verification fails, it is determined that the identity authentication of the IoT device in the target IoT device to be authenticated fails. When the identity authentication of the IoT device in the target IoT device to be authenticated is successful, the target IoT device to be authenticated detects the second key negotiation parameter R of the IoT device. B Whether it belongs to the second cycle group of the Internet of Things system, if R B does not belong to the second cycle group of the IoT system, then the session key negotiation fails. B The second loop group belonging to the IoT system calculates the target first session negotiation parameter, the target second session negotiation parameter and the target third session negotiation parameter of the target IoT device to be authenticated. The calculation formula of the target first session negotiation parameter is:

[0129] g1′=e(P1,P pub ) rA

[0130] Where g2′ is the target second session negotiation parameter, e is represented by a bilinear mapping function, P1 is the first generator, P pub is the system master public key, r Ais the second random number. For example, the formula for the third session negotiation parameter is: For example, the formula for the target second session negotiation parameter calculated by the target IoT device to be authenticated is:

[0131] g2′=e(SK A ,(x A +y A ) -1 R B )

[0132] Where g1′ is the target first session negotiation parameter, e represents the bilinear mapping function, SK A Register the private key for the target IoT device, R B Negotiate the second key parameters for IoT devices, (x A +y A ) is the device random secret value of the target IoT device to be authenticated, x A is the random device value of the target IoT device to be authenticated, y A The device derived value for the target IoT device to be authenticated.

[0133] g3′=(g2′) rA

[0134] Where g3′ is the target third intermediate session key, g2′ is the target second intermediate session key, and r A is the second random number. The formula for the target IoT device to be authenticated to calculate the second session negotiation key is:

[0135] ikB A =KDF(ID A ||ID B ||R A ||R B ||g1′||g2′||g3′, klen)

[0136] Among them, ShK B is the first session key, KDF is the preset shared key derivation function, ID A Device ID B is the target device identifier, R B is the first key negotiation parameter, R Ais the second key negotiation parameter, g1′ is the target first session negotiation parameter, g2′ is the target second session negotiation parameter, g3′ is the target third session intermediate key, and klen is the length of the second session key. || indicates concatenation. The length of the first session key is the same as the length of the second session key. At this point, the identity authentication and session key negotiation are completed between the IoT device and the target IoT device to be authenticated. The IoT device and the target IoT device to be authenticated can communicate through the first session negotiation key and the second session negotiation key to improve communication security. In addition, in the embodiment of the present application, the IoT device only needs to store its own registered public key and registered private key pair system public parameters, and does not need to store the identity and key information of other devices, saving the limited storage resources of the IoT device.

[0137] To better understand this embodiment, an example is given of a process in which an IoT device uses a registered private key to sign. For example, the IoT device signs a message m to be sent, and the signing steps include: (wherein the message m to be sent by the IoT device may be a device identifier of the IoT device, a preset random message, a second key negotiation parameter, a registered public key, a preset authentication duration threshold, and a second current timestamp, etc.)

[0138] Calculate g = e(P1, P pub ); IoT device generates a random number r B ∈[1,N-1], calculate ω=g rB , calculate h = H2 (ID B ||m||ω, N), calculate l=(r B -h)modN, and we get S=l·SK B , get the signature (h, S), h and S together constitute the signature. Among them, e is the bilinear mapping function, P1 is the first generator, P pub is the system master public key, r B is the second random number generated by the IoT device, H2 is the second hash function, m is the message, SK B is the registered private key of the IoT device, and g, ω, and l are all intermediate parameters in the signature generation process.

[0139] When an IoT device receives a signature (h′, S′) sent by another IoT device (e.g., a target IoT device to be authenticated), the IoT device may verify the signature (h′, S′). For example, the signature (h′, S′) verification process may include:

[0140] If h′ does not belong to [1, N-1], then the verification fails. If h′ belongs to [1, N-1], then calculate g=e(P1, P pub ), calculate t′=g h′ ; Calculate u = e(S′, PKB );calculate ω′=u·t;calculate h d =H2(ID A ||m′||ω′, N); if h d = h′, then the verification is successful. If h d If it is not equal to h′, the verification fails.

[0141] In this embodiment, the determination of the registered public key and the registered private key can be based on the SM9 algorithm. In this embodiment, the generation of the public key and the private key in the SM9 algorithm is improved. The SM9 algorithm directly uses the user identity information as the public key, and the private key is generated by PKG according to the user identity. In this embodiment, the registered public key and the registered private key are both involved in the Internet of Things device and the central control device, and the registered public key and the registered private key cannot be derived from each other. In this embodiment, on the basis of the SM9 algorithm, a device random secret value is introduced to participate in the calculation of the registered private key and the registered public key, but the device random secret value will not affect the verification signature link corresponding to the SM9 algorithm. For example, based on the bilinear mapping function, there exists a signature e(S,P)=e(l·ds A ,hP pub )=e(ds A ,P pub ) lh , where S and P are both part of the signature, and S can be expressed as S = l·ds A , P can be expressed as hP pub , l and h are intermediate values ​​in the signature calculation process and will not be discussed here. ds A It can be expressed as a registered private key, P pub is the system master public key. In the signature verification phase, there is e(S′,P′), and it is necessary to verify that e(S,P)=e(S′,P′) to prove that the signature is successful, and e(S′,P′)=e(l·SK,PK)=e(l(x+y)·ds A ,h(x+y) -1 P pub )=e(ds A ,P)^(l(x+y)h(x+y) -1 )=e(ds A ,P) lh ; and e(ds A ,P) lh =e(S,P), so it can be proved that e(S,P)=e(S′,P′), and further prove that the device random secret value will not affect the verification signature link. The solution of this embodiment can improve communication security. Wherein, x is the random device value in the device random secret value, and is the device derived value in the device random secret value.

[0142] In addition, key negotiation will be performed between two IoT devices registered on the central control device. It is necessary to ensure that the session negotiation keys negotiated between the two IoT devices are consistent in order to carry out the subsequent communication process. For example, when an IoT device negotiates a key session with a target IoT device to be authenticated, the first session negotiation key of the IoT device needs to be the same as the second session negotiation key. To prove that the first session negotiation key is the same as the second session negotiation key, it is only necessary to prove that g1=g1′, g2=g2′, g3=g3′. Since P pub = sP2, and SK A It can be expressed as SK A =(x A +y A )s·t A -1 P1, SK B It can be expressed as SK B =(x B +y B )s·t B -1 P1, and t A =s+h A , t B =s+h B .h A =H1(ID A ||hid,N),h B =h B =H1(ID B ||hid,N);R A =r A L B ,Lв=h B P2+P pub , R B =r B L A ,L A =h A P2+P pub Then there exists:

[0143] g1=e(SK B ,(x B +y B ) -1 R A )=e((X B +Y B )st B -1 P1,(x B +y B ) -1 r A (h B P2+P pub ))

[0144] =e((X B +Y B )s(s+h B ) -1 P1,(x B +y B ) -1 r A (h B +s)P2)

[0145] =e(P1,P2) SrA(XB+YB)(xB+yB)-1(hB+s)(s+hB)-1

[0146] ＝ e(P1,P2) SrA ;

[0147] g1′=e(P1,P pub ) rA =e(P1,P2) SrA =g1;

[0148] g2=e(SK A ,(x A +y A ) -1 R B )=e((X A +Y A )st A -1 P1,(x A +y A ) -1 r B (h A P2+P puA ))

[0149] =e((X A +Y A )s(s+h A ) -1 P1,(x A +y A ) -1 r B (h A +s)P2)

[0150] =e(P1,P2) SrB(XA+YA)(xA+yA)-1(hA+s)(s+hA)-1

[0151] =e(P1,P2) SrB ;

[0152] g2′=e(P1,P puA ) rB =e(P1,P2) SrB =g2;

[0153] g3=g1 rB =e(P1,P2) SrArB ;

[0154] g3′=(g2′) rA =e(P1,P2) SrArB =g3;

[0155] This proves that g1=g1′, g2=g2′, g3=g3′, and further proves that the first session negotiation key and the second session negotiation key are the same.

[0156] Furthermore, in another feasible embodiment, the identity authentication method is also applied to a central control device in an Internet of Things system, and the Internet of Things system is also deployed with Internet of Things devices. The method includes steps B10 to B20:

[0157] Step B10, receiving a registration request sent by the IoT device;

[0158] Step B20, determining the device identification of the IoT device from the registration request, and generating a partial key of the IoT device based on the device identification, a preset first hash function, and a system master private key of the IoT system, and sending the partial key to the IoT device;

[0159] Among them, the IoT device is used to generate a registered private key of the IoT device based on a partial key, a device random secret value preset by the IoT device, and a system public parameter of the IoT system; it is also used to generate a registered public key of the IoT device based on the system public parameters, the device identification of the IoT device, and the device random secret value, so that the IoT device can perform identity authentication with the target IoT device to be authenticated in the IoT system based on the registered private key and the registered public key.

[0160] It should be noted that the IoT device sends a parameter disclosure request to the central control device, and the central control device sends the system public parameters to the IoT device based on the parameter disclosure request. After receiving the system public parameters, the IoT device sends a registration request to the central control device, and the central control device generates a partial key for the IoT device based on the device identifier, a preset first hash function, a cyclic group order, a system master private key, and a private key generation identifier, and the central control device sends the partial key to the IoT device.

[0161] For example, the steps for the central control device to generate a partial key of the IoT device are: calculating the intermediate value of the partial key t=s+H1(ID||hid,N), the partial key SK′=st -1P1, where t is the intermediate value of the partial key, H1 is the first hash function, ID||hid represents the concatenation of the device ID of the IoT device and the preset private key generation ID hid, H1(ID||hid,N) means that the concatenated device ID of the IoT device and the preset private key generation ID are hashed by H1, and the length of the obtained hash value does not exceed N. If it exceeds N, the remainder of the hash value is taken. SK′ is the partial key, t -1 is the inverse of the intermediate value of the partial key, and P1 is the first generator of the first cyclic group. When t is 0, it is necessary to re-determine the system master private key s and calculate t again until t is not 0. When t is not 0, it can be determined that SK′=st -1 P1.

[0162] In this embodiment, the central control device can receive registration requests from multiple IoT devices, and multiple IoT devices can register on the central control device, and any two IoT devices registered on the central control device can communicate. Figure 2 and Figure 3 , Figure 2 The figure below is a schematic diagram of the number of bindings between IoT devices. Figure 2 Part a in the figure shows the number of bindings between IoT devices in the prior art when one-to-one binding is required. Figure 2 From part a of the diagram, when there are 5 IoT devices, 10 bindings are required to ensure that any two IoT devices can communicate securely. Figure 2 Part b shows the number of interconnections between devices in this application, for example, Figure 2 Part b shows five devices, of which b0 is the central control device, b1 to b4 are IoT devices. Figure 2 After all IoT devices are registered in the central control device, any two IoT devices can communicate securely, thereby reducing the number of interconnections between IoT devices and reducing the complexity of interconnection between IoT devices.

[0163] Figure 3 The connection relationship between multiple IoT devices and central control devices is shown in Figure 3 The IoT devices shown in the figure can be sensors, mobile phones, tablet computers, cameras, etc. Each IoT device can be registered in the central control device. Identity authentication and session key negotiation can be performed between two IoT devices registered in the central control device. For example, Figure 3 Identity authentication and session key negotiation can be performed between the tablet and the camera.

[0164] For a better understanding of this embodiment, refer to Figure 4The IoT system program architecture in this implementation is briefly described. The IoT system can be run in the hardware environment of OpenHarmony (open source Hongmeng). Figure 4 , Figure 4 The Internet of Things system may include a JS application module, a management service module, an authentication service module, a key service module, and a soft bus service module. Among them, the JS (JavaScript, a scripting language) application module can be used to interact with users, and the JS application can call the management service module. The management service module can be device_manager (management service), which is responsible for the management of all devices in the Internet of Things system, such as Internet of Things devices and central control devices, and can provide interfaces for identity authentication and key negotiation, device registration, etc. to the JS application module. For example, the system can be initialized in the management service module. For example, initializing the system includes determining the central control device in the Internet of Things system, and device registration refers to the registration of the Internet of Things device in the central control device.

[0165] The authentication service module may be deviceauth_service (authentication service), which is used to provide interfaces related to device authentication, such as key extraction, signing or signature verification, key calculation, and authentication. The key service module may be HUKS (OpenHarmonyUniversal KeyStore, hardware-based universal key storage), which can implement functions such as key management and key storage, and can also perform key generation and other operations in HUKS. The soft bus service module may be softbus_service (soft bus service): The soft bus service module can hide the specific connection mode between devices through soft bus encapsulation, and provide a unified distributed communication management for the Internet of Things system. For example, the soft bus service module can implement functions such as device discovery, device connection, data transmission, and session management. Device discovery may include the discovery of Internet of Things devices by a central control device, and Internet of Things devices may be registered in a central control device. Device connection may include the registration of Internet of Things devices in a central control device, and may also include connections between Internet of Things devices. Data transmission may include transmission between Internet of Things devices, and may also include transmission between a central control device and an Internet of Things device. Session management may include communication between Internet of Things devices, etc. Both the management service module and the authentication service module can call the soft bus service module, the authentication service module can call the key service module, and the JS application module can call the management service module.

[0166] Reference Figure 5, briefly describe the registration process of the IoT device in this embodiment: First, the user can start the device discovery function on the JS application module (the central control device can have a corresponding JS application module), call the device discovery interface of the management service module, and call the relevant interface in the soft bus service module to start scanning the surrounding devices, and return the scanned results to the management service module, which then returns to the JS application module and displays the scan results on the display interface corresponding to the JS application module. The scan results are the discovered IoT devices.

[0167] Then, the user can manually select the device to be registered in the JS application module corresponding to the central control device to start registration. The upper-level JS application module calls the device registration interface of the management service module, and the management service module establishes a registration session through the interface in the soft bus service module. This establishes a registration session between the central control device and the IoT device.

[0168] The IoT device sends a parameter disclosure request to the central control device through the interface in the management service module, and the central control device receives the parameter disclosure request sent by the IoT device through the interface in the management service module. The central control device queries the system disclosure parameters through the interface in the authentication service module, and sends the system disclosure parameters to the IoT device through the interface in the management service module. The IoT device receives the system disclosure parameters through the interface in the management service module, and saves the system disclosure parameters to the IoT device locally through the interface in the authentication service module. The IoT device determines the random device value in the device random secret value through the interface in the authentication service module. The IoT device sends a registration request to the central control device through the interface in the management service module, and the central control device receives the registration request through the interface in the management service module. The registration request is sent through the interface in the authentication service module, and the partial key of the IoT device is calculated through the interface in the authentication service module, and the registration response is constructed through the interface in the management service module. The registration response includes a partial key, which can be sent to the IoT device. The IoT device receives the partial key through the interface in the management service module, calculates the registration private key and the registration public key through the interface in the authentication service module, and stores the registration private key and the registration public key locally through the interface in the authentication service module. The registration confirmation request is constructed through the interface in the management service module and sent to the central control device. The central control device confirms the registration of the IoT device through the interface in the management service module, and adds the registered IoT device to the list of trusted devices, returns the registration result to the JS application module, and displays the registration result on the JS application module. After the IoT device sends the registration confirmation request to the central control device, the session can be closed, that is, the registration session is closed. It can be understood that the authentication service module, the management service module, and the soft bus service module can be called in both the central control device and the IoT device, and the central control device can also call the JS application module.

[0169] Reference Figure 6 The present application also provides an Internet of Things system, the Internet of Things system comprising:

[0170] The Internet of Things device 10 is used to send a registration request to the central control device, receive a partial key generated by the central control device for the Internet of Things device based on the registration request; generate a registration public key of the Internet of Things device according to the system public parameters of the Internet of Things system, the device identification of the Internet of Things device and a preset device random secret value; generate a registration private key of the Internet of Things device according to the partial key, the device random secret value and the system public parameters of the Internet of Things system, and generate a registration confirmation request based on the device identification of the Internet of Things device; send a registration confirmation request to the central control device to register the Internet of Things device to the central control device, so that the Internet of Things device registered in the central control device can perform identity authentication with the target Internet of Things device to be authenticated in the Internet of Things system based on the registration private key and the registration public key;

[0171] The central control device 20 is used to receive a registration request sent by the Internet of Things device; determine the device identification of the Internet of Things device from the registration request, and generate a partial key of the Internet of Things device based on the device identification, a preset first hash function, and a system master private key of the Internet of Things system, and send the partial key to the Internet of Things device.

[0172] The Internet of Things system provided by the present invention adopts the identity authentication method in the above embodiment, which can solve the technical problem of low security of the Internet of Things system. Compared with the prior art, the beneficial effects of the Internet of Things system provided by the embodiment of the present invention are the same as the beneficial effects of the identity authentication method provided by the above embodiment, and other technical features of the Internet of Things system are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0173] The Internet of Things system provided by the present application adopts the identity authentication method in the above-mentioned embodiment, aiming to solve the technical problem of low security of the Internet of Things system. Compared with the prior art, the beneficial effects of the identity authentication method provided by the embodiment of the present application are the same as the beneficial effects of the identity authentication method provided by the above-mentioned embodiment, and other technical features in the Internet of Things system are the same as the features disclosed by the above-mentioned embodiment method, which will not be repeated here. The embodiment of the present application provides an electronic device, which can be a playback device, and the electronic device includes: at least one processor; and a memory connected to communication with the at least one processor; wherein the memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor so that at least one processor can execute the identity authentication method in the above-mentioned embodiment.

[0174] Reference below Figure 7, which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure. The electronic device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0175] like Figure 7 As shown, the electronic device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM) 1004. In RAM 1004, various programs and data required for the operation of the electronic device are also stored. The processing device 1001, ROM 1002, and RAM 1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems may be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device may allow the electronic device to communicate wirelessly or wired with other devices to exchange data. Although the electronic device with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have instead.

[0176] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 1009, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0177] The electronic device provided by the present application adopts the identity authentication method in the above-mentioned embodiment 1 to solve the technical problem of low security of the Internet of Things system. Compared with the prior art, the beneficial effect of the product flow data distribution provided by the embodiment of the present application is the same as the beneficial effect of the identity authentication method provided by the above-mentioned embodiment, and the other technical features in the Internet of Things system are the same as the features disclosed by the above-mentioned embodiment method, which will not be repeated here. It should be understood that the various parts of the present disclosure can be implemented by hardware, software, firmware or a combination thereof. In the description of the above-mentioned implementation, specific features, structures, materials or characteristics can be combined in a suitable manner in any one or more embodiments or examples. The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims. The present embodiment provides a computer-readable storage medium having computer-readable program instructions stored thereon, and the computer-readable program instructions are used to execute the identity authentication method in the above-mentioned embodiment 1. The computer-readable storage medium provided in the embodiment of the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor devices, equipment or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable EPROM (ElectricalProgrammable Read Only Memory, read-only memory) or flash memory, an optical fiber, a portable compact disk CD-ROM (compact disc read-only memory, read-only memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution device, device or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency, radio frequency), etc., or any suitable combination of the above. The above-mentioned computer-readable storage medium may be contained in an electronic device; it may also exist alone without being assembled into an electronic device.The computer-readable storage medium carries one or more programs. When the one or more programs are executed by an electronic device, the electronic device: sends a registration request to a central control device, receives a partial key generated by the central control device for the Internet of Things device based on the registration request; generates a registration public key for the Internet of Things device based on the system public parameters of the Internet of Things system, the device identification of the Internet of Things device and a preset device random secret value; generates a registration private key for the Internet of Things device based on the partial key, the device random secret value and the system public parameters of the Internet of Things system, and generates a registration confirmation request based on the device identification of the Internet of Things device; sends a registration confirmation request to the central control device, registers the Internet of Things device to the central control device, so that the Internet of Things device registered in the central control device can perform identity authentication with the target Internet of Things device to be authenticated in the Internet of Things system based on the registration private key and the registration public key.

[0178] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a LAN (local area network) or WAN (Wide Area Network), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0179] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the equipment, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based device that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0180] The modules involved in the embodiments described in the present disclosure may be implemented by software or by hardware. The name of the module does not constitute a limitation on the unit itself under certain circumstances. The computer-readable storage medium provided in the present application stores computer-readable program instructions for executing the above-mentioned identity authentication method, aiming to solve the technical problem of low security of the Internet of Things system. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in the embodiments of the present application are the same as the beneficial effects of the identity authentication method provided in the above-mentioned embodiments, which will not be repeated here.

[0181] The present application also provides a computer program product, including a computer program, which implements the steps of the identity authentication method as described above when executed by a processor. The computer program product provided by the present application is intended to solve the technical problem of low security of the Internet of Things system. Compared with the prior art, the beneficial effects of the computer program product provided by the embodiment of the present application are the same as the beneficial effects of the identity authentication method provided by the above embodiment, which will not be repeated here. The above is only a preferred embodiment of the present application, and does not limit the patent scope of the present application. All equivalent structures or equivalent process transformations made using the contents of the specification and drawings of this application, or directly or indirectly used in other related technical fields, are similarly included in the patent processing scope of the present application.

Claims

1. An identity authentication method, characterized in that: An Internet of Things device applied to an Internet of Things system, wherein the Internet of Things system is also deployed with a central control device, the method comprising: Sending a registration request to the central control device, and receiving a partial key generated by the central control device for the Internet of Things device based on the registration request; Generate a registration public key for the Internet of Things device according to the system public parameters of the Internet of Things system, the device identification of the Internet of Things device and a preset device random secret value; Generate a registration private key for the IoT device based on the partial key, the device random secret value, and the system public parameters of the IoT system, and generate a registration confirmation request based on the device identification of the IoT device; A registration confirmation request is sent to the central control device to register the IoT device with the central control device, so that the IoT device registered with the central control device can perform identity authentication with the target IoT device to be authenticated in the IoT system based on the registration private key and the registration public key.

2. The method according to claim 1, characterized in that The step of sending a registration request to the central control device and receiving a partial key generated by the central control device for the IoT device based on the registration request comprises: Sending a parameter disclosure request to the central control device, and receiving system public parameters sent by the central control device based on the parameter disclosure request; When the IoT device receives the system public parameters, a registration request is generated based on the device identification of the IoT device and a preset device random secret value, and the registration request is sent to the central control device, so that the central control device can calculate a partial key of the IoT device based on the device identification, a preset first hash function, a preset cyclic group order of the IoT system, a preset system master private key, and a preset private key generation identifier, and send the partial key to the IoT device; Receive the partial key sent by the central control device.

3. The method according to claim 1, characterized in that The method includes: In the case where the IoT device is registered with the central control device, receiving a first authentication request sent by a target IoT device to be authenticated registered with the central control device, and determining whether the first authentication request is valid; If the first authentication request is valid, obtaining a target registration public key and a target signature of the target IoT device to be authenticated from the first authentication request; Based on the target registered public key, verify the target signature to obtain a verification result; If the verification result is successful, it is determined that the identity authentication of the target IoT device to be authenticated is successful in the IoT device.

4. The method according to claim 3, characterized in that The step of determining whether the first authentication request is valid includes: Acquire a target preset authentication time threshold of a target to-be-authenticated IoT device and a first current timestamp of the first authentication request from the first authentication request; Obtaining a reception timestamp of the first authentication request received by the IoT device; If the duration between the receiving timestamp and the first current timestamp is less than or equal to the target preset authentication duration threshold, it is determined that the first authentication request is valid.

5. The method according to claim 3, characterized in that The Internet of Things system includes a first cyclic group and a second cyclic group, the generator of the first cyclic group is a first generator, and the generator of the second cyclic group is a second generator, and after the step of determining that the identity authentication of the target Internet of Things device to be authenticated is successful in the Internet of Things device, the system further includes: Determine a target device identifier and a first key negotiation parameter of the target IoT device to be authenticated from the first authentication request; Based on the target device identifier of the target IoT device to be authenticated and a preset first hash function, a target hash value of the target IoT device to be authenticated is calculated; Calculate a random intermediate negotiation parameter based on the target hash value, the second generator and the system master public key; Using the product of the first random number preset by the Internet of Things device and the random intermediate negotiation parameter as the second key negotiation parameter of the Internet of Things device; Based on the first key negotiation parameter of the target IoT device to be authenticated, the target device identifier, the second key negotiation parameter of the IoT device, the device identifier, the registration private key, the first random number, the device random secret value, the first generator of the IoT system and the system master public key, a first session negotiation key is generated between the IoT device and the target IoT device to be authenticated.

6. The method according to claim 5, characterized in that The step of generating a session negotiation key between the Internet of Things device and the target Internet of Things device to be authenticated based on the first key negotiation parameter of the target Internet of Things device to be authenticated, the target device identifier, the second key negotiation parameter of the Internet of Things device, the device identifier, the registration private key, the first random number, the device random secret value, the second generator of the second cyclic group of the Internet of Things system, and the system master public key, and storing the key in the Internet of Things device includes: Based on a preset bilinear mapping relationship, the registered private key, the first key negotiation parameter, and the device random secret value, a first session negotiation parameter of the Internet of Things device is calculated; Generate a second session negotiation parameter based on a preset bilinear mapping relationship, the first generator, the system master public key, and a first random number of the Internet of Things device; Using the power of the first random number of the first session negotiation parameter as the third session negotiation parameter of the Internet of Things device; A preset shared key derivation function is called to calculate a first session negotiation key between the IoT device and the target IoT device to be authenticated based on the device identifier, the target device identifier, the first key negotiation parameter, the second key negotiation parameter, the first session negotiation parameter, the second session negotiation parameter, and the third session negotiation parameter.

7. The method according to claim 5, characterized in that After the step of generating a first session negotiation key between the Internet of Things device and the target Internet of Things device to be authenticated based on the first key negotiation parameter of the target Internet of Things device to be authenticated, the target device identifier, the second key negotiation parameter of the Internet of Things device, the device identifier, the registration private key, the first random number, the device random secret value, the first generator of the Internet of Things system, and the system master public key, the step further includes: Based on the registered private key of the IoT device, the device identification of the IoT device, the preset random message, the second key negotiation parameter, the registered public key, the preset authentication time threshold and the second current timestamp are signed to obtain the signature of the IoT device; Based on the signature, the device identifier, the preset random message, the second key negotiation parameter, the registration public key, the preset authentication time threshold and the second current timestamp, a second authentication request is generated, and the second authentication request is sent to the target IoT device to be authenticated, so that the target IoT device to be authenticated can obtain the registration public key and signature of the IoT device from the second authentication request if the second authentication request is valid, and verify the signature based on the registration public key. If the signature verification is successful, it is determined that the IoT device has successfully authenticated the identity of the target IoT device to be authenticated; Among them, the target IoT device to be authenticated is also used to generate a second session negotiation key between the target IoT device to be authenticated and the IoT device based on the second key negotiation parameter of the IoT device, the device identifier, the first key negotiation parameter of the target IoT device to be authenticated, the target device identifier, the target registration private key, a preset second random number, the target device random secret value, the first generator of the IoT system and the system master public key when the IoT device successfully authenticates the target IoT device to be authenticated.

8. An identity authentication method, characterized in that: A central control device applied to an Internet of Things system, wherein the Internet of Things system is also deployed with Internet of Things devices, wherein the method comprises: Receiving a registration request sent by the IoT device; Determine the device identification of the Internet of Things device from the registration request, generate a partial key of the Internet of Things device based on the device identification, a preset first hash function, and a system master private key of the Internet of Things system, and send the partial key to the Internet of Things device; Among them, the Internet of Things device is used to generate a registration private key of the Internet of Things device based on the partial key, the device random secret value preset by the Internet of Things device, and the system public parameters of the Internet of Things system; it is also used to generate a registration public key of the Internet of Things device based on the system public parameters, the device identification of the Internet of Things device and the device random secret value, so that the Internet of Things device can perform identity authentication with the target Internet of Things device to be authenticated in the Internet of Things system based on the registration private key and the registration public key.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the steps of the identity authentication method described in any one of claims 1 to 7.

10. A readable storage medium, characterized in that: The readable storage medium is a computer-readable storage medium, on which is stored a program for implementing the identity authentication method, and the program for implementing the identity authentication method is executed by a processor to implement the steps of the identity authentication method as described in any one of claims 1 to 7.

Images