Internet of Things terminal identity authentication method based on digital certificate

Abstract

The invention relates to an Internet of Things terminal identity authentication method based on a digital certificate, which comprises the following steps: firstly, a digital certificate system is utilized to sign and issue certificates in an Internet of Things system, the certificates comprise a root certificate, at least one intermediate certificate and a terminal certificate, and a first terminal and a second terminal respectively and correspondingly sign and issue a first terminal certificate and a second terminal certificate; generating a public key and a private key for the certificate, and signing the certificate by using the private key; then, the first terminal requests identity authentication from the second terminal and sends a first terminal certificate, and the second terminal confirms that the request and the first terminal certificate are successfully received; the second terminal establishes a certificate chain of the first terminal certificate and a certificate chain of the second terminal certificate; verifying signer signatures of the terminal certificate and the intermediate certificate in the two certificate chains and self-signatures of the intermediate certificate and the root certificate; finally, Hash comparison is carried out to judge whether the intersection has a problem; a challenge-response mechanism is utilized to judge a private key holding problem; the method can improve security and management flexibility.

Description

Technical Field

[0001] The invention relates to an Internet of Things terminal identity authentication method based on a digital certificate, and belongs to the technical field of the Internet of Things. Background Art

[0002] In the IoT system, it is crucial to authenticate the identity of terminal devices. Among the many identity authentication solutions, digital certificate authentication solutions based on public key infrastructure (PKI) have been widely used due to their security. However, the traditional PKI digital certificate system usually uses a tree structure to judge the credibility of terminal certificates. This structure relies on the root certificate as a trust anchor and requires the root certificate to be pre-stored in the terminal device. This authentication mechanism faces many challenges, such as the security of the root certificate and the complexity of certificate updates. Therefore, the traditional PKI system is difficult to adapt to the rapidly changing IoT environment, and a new identity authentication method is urgently needed to improve security and management flexibility. Summary of the invention

[0003] In order to solve the problems existing in the prior art, the present invention provides a safe and flexible Internet of Things terminal identity authentication method.

[0004] In order to achieve the above object, the technical solution proposed by the present invention is: an Internet of Things terminal identity authentication method based on digital certificates, the Internet of Things system includes at least two Internet of Things terminals, and the two interconnected Internet of Things terminals are respectively a first terminal and a second terminal, and the method includes the following steps:

[0005] S1. Use a digital certificate system to issue a certificate in the Internet of Things system. The certificate includes a root certificate, at least one intermediate certificate and a terminal certificate. The first terminal and the second terminal are respectively issued a first terminal certificate and a second terminal certificate;

[0006] Generate a public key and a private key for the certificate, sign the certificate with the private key, and verify the signature with the public key to verify the validity of the certificate;

[0007] S2, the first terminal requests identity authentication from the second terminal and sends the first terminal certificate, and the second terminal confirms that the request and the first terminal certificate are successfully received, and then proceeds to the next step;

[0008] S3. The second terminal establishes the certificate chains of the first terminal certificate and the second terminal certificate respectively; verifies the issuer signatures of the terminal certificate and the intermediate certificate in the two certificate chains, as well as the self-signatures of the intermediate certificate and the root certificate; if the verification is correct, proceed to the next step;

[0009] S4. Check the intermediate certificates and root certificates in one of the certificate chains to see if at least one intermediate certificate or root certificate exists in the other certificate chain. If so, proceed to the next step.

[0010] S5. Determine whether the first terminal holds the private key of the first terminal certificate. If so, the identity authentication is completed.

[0011] For further design of the above technical solution: In step S1, when issuing a certificate, a unique identifier is generated for each certificate:

[0012]

[0013] where ID is the unique identifier of the certificate, C is the certificate content, H(C) is the hash value, and R is a random number.

[0014] In step S1, the specific process of generating the public key and private key for the certificate is as follows:

[0015] Select two prime numbers p and q, calculate n = p×q, where n is the modulus, and calculate φ(n) = (p - 1)(q - 1);

[0016] Select an integer e such that 1 < e < φ(n) and e is relatively prime to φ(n);

[0017] Calculate d such that d ≡ e -1 mod φ(n), then the public key is (e, n) and the private key is (d, n).

[0018] In step S1, the digital certificate system issues the root certificate, the root certificate issues the first-level intermediate certificate, the intermediate certificate issues the next-level intermediate certificate step by step, and the last-level intermediate certificate issues the terminal certificate; during the issuing process, the self-signature of the issuer and the issuer signature of the issued are generated; the self-signature constitutes the self-signature field, and the issuer signature constitutes the issuer signature field. The version number, serial number, validity period, issuer information, subject information, and public key of the certificate constitute the data field of the certificate.

[0019] In step S1, signing and verifying the certificate is specifically as follows:

[0020] Sign the hash value using the private key d to generate the signature value σ:

[0021] σ = H(C) d mod n

[0022] Verify using the public key:

[0023] H'(C) = σ e mod n

[0024] If H'(C) is equal to H(C), the signature is valid.

[0025] In the step S2, identity authentication is requested, specifically: the first terminal generates a request message, the content of which includes the requested information and the purpose of identity authentication; the first terminal reads its own first terminal certificate from its storage; the first terminal sends the request message and the first terminal certificate to the second terminal through the network; the second terminal receives the request message from the first terminal, parses the message content, and extracts the request information and the first terminal certificate; the second terminal confirms that the request information and the first terminal certificate are successfully received, and the identity authentication is successful.

[0026] In step S3, when establishing the certificate chain, the first terminal certificate and the second terminal certificate are respectively used as the starting point, and the issuer certificate is searched and verified step by step upward through the certificate unique identifier, and the intermediate certificates at all levels upward until the root certificate are obtained, thereby forming two certificate chains;

[0027] After obtaining the certificate chain, the structure of the certificate chain is used to determine whether the certificate chain is complete. When the certificate chain contains a terminal certificate, at least one intermediate certificate, and a root certificate, it indicates that the certificate chain is a complete certificate chain.

[0028] In the step S3, the issuer signatures of the terminal certificates and intermediate certificates in the two certificate chains are verified, specifically: obtaining the terminal certificates and all intermediate certificates in each certificate chain; reading the signature value in the data field and the issuer signature field of the current certificate, and reading the public key of the issuer certificate of the current certificate; using the public key of the issuer certificate of the current certificate and the signature value of the issuer of the current certificate, verifying the data field of the current certificate; when the terminal certificates and all intermediate certificates in each certificate chain can be successfully verified, it means that the issuer signature value has been verified correctly.

[0029] Verify the self-signature of the intermediate certificate and the root certificate, specifically: obtain all intermediate certificates and root certificates in each certificate chain; read the public key of the current certificate, the signature value in the self-signed domain, read the data domain and the issuer signature domain when the current certificate is an intermediate certificate, and read the data domain when the current certificate is a root certificate; when the current certificate is an intermediate certificate, use the public key of the current certificate and the signature value in the self-signed domain of the current certificate to verify the data domain and the issuer signature domain of the current certificate; when the current certificate is a root certificate, use the public key of the current certificate and the signature value in the self-signed domain of the current certificate to verify the data domain of the current certificate; when all intermediate certificates and root certificates in each certificate chain can be verified successfully, it means that the self-signed value verification is correct.

[0030] The step S4 specifically includes: using a hash algorithm to generate a unique hash value for the intermediate certificate and root certificate in each certificate chain; storing the hash values ​​of the intermediate certificate and root certificate in each certificate chain in a set; checking whether the hash value of the intermediate certificate or root certificate in a certificate chain is in the hash value set of another certificate chain; if so, it means that there is an intersection and proceed to the next step; otherwise, the identity authentication fails.

[0031] The step S5 specifically includes: the second terminal generates a random challenge value; uses the public key in the first terminal certificate to encrypt the challenge value; sends the encrypted challenge value to the first terminal; the first terminal uses its private key to decrypt the received encrypted challenge value and returns the decrypted challenge value; the second terminal compares the returned decrypted value with the original challenge value, and if they are consistent, it confirms that the first terminal holds its private key and the identity authentication is successful; otherwise, the identity authentication fails.

[0032] The beneficial effects of the present invention are:

[0033] The present invention discloses an Internet of Things terminal identity authentication method based on digital certificates, which takes the terminal certificate as a trust anchor, and extends the trust chain to the opposite device through the certificate chain of the terminal certificate, the certificate chain of the terminal certificate and the intersection of the two certificate chains to complete the identity authentication. The authentication method does not require a root certificate pre-installed in the terminal, and can update the root certificate without replacing the terminal certificate; thereby adapting to the rapidly changing Internet of Things environment to improve security and management flexibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0035] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0036] Embodiment 1

[0037] like Figure 1 As shown, this embodiment changes the trust model of the traditional PKI system with the root certificate as the trust anchor, thereby changing the identity authentication method, and provides an IoT terminal identity authentication method based on a digital certificate, including the following steps:

[0038] S1. Use a digital certificate system to issue a certificate in the Internet of Things system. The certificate includes a root certificate, at least one intermediate certificate and a terminal certificate. The Internet of Things system includes at least two Internet of Things terminals. The two interconnected Internet of Things terminals are respectively a first terminal and a second terminal. The first terminal and the second terminal are respectively issued with a first terminal certificate and a second terminal certificate;

[0039] Generate a public key and a private key for the certificate, sign the certificate with the private key, and verify the signature with the public key to verify the validity of the certificate;

[0040] S2, the first terminal requests identity authentication from the second terminal and sends the first terminal certificate, and the second terminal confirms that the request and the first terminal certificate are successfully received, and then proceeds to the next step;

[0041] S3. The second terminal establishes the certificate chains of the first terminal certificate and the second terminal certificate respectively; verifies the issuer signatures of the terminal certificate and the intermediate certificate in the two certificate chains, as well as the self-signatures of the intermediate certificate and the root certificate; if the verification is correct, proceed to the next step;

[0042] S4. Check the intermediate certificates and root certificates in one of the certificate chains to see if at least one intermediate certificate or root certificate exists in the other certificate chain. If so, proceed to the next step.

[0043] S5. Determine whether the first terminal holds the private key of the first terminal certificate, and if so, complete identity authentication.

[0044] Embodiment 2

[0045] This embodiment is further designed on the basis of the first embodiment, specifically:

[0046] S1: Certificate issuance:

[0047] The digital certificate system is used to issue certificates in the IoT system, including root certificates, intermediate certificates, subordinate intermediate certificates or terminal certificates. The root certificate is the basis of the trust chain. First, it needs to be issued and self-signed by a certificate authority (CA). Use the root certificate to issue intermediate certificates. The issuance of intermediate certificates depends on the existence and validity of the root certificate. The intermediate certificate can further issue subordinate intermediate certificates or terminal certificates. This process depends on the validity of the upper intermediate certificate. Specifically: the digital certificate system issues a root certificate, the root certificate issues the first-level intermediate certificate, the intermediate certificate issues the next-level intermediate certificate step by step, and the last-level intermediate certificate issues the terminal certificate; the issuer's self-signature and the issuer's signature of the issuer are generated during the issuance process; the self-signature constitutes the self-signature domain, and the issuer's signature constitutes the issuer's signature domain. The certificate version number, serial number, validity period, issuer information, subject information and public key constitute the data domain of the certificate.

[0048] S11: Writing of unique identifier:

[0049] When each certificate is issued, a unique identifier for the certificate is written to ensure that each certificate is unique in the entire certificate chain. To generate a unique identifier for each certificate, you can use the following formula:

[0050]

[0051] Among them, ID is the unique identifier of the certificate, C is the certificate content (such as terminal information, issuer information, etc.). R is a random number (a 64-bit random number can be selected for generation).

[0052] S12: Verify the validity of the certificate:

[0053] S121: Generate keys;

[0054] Select two large prime numbers p and q. Calculate n = p × q, where n is the modulus and is used for encryption and signature. Then calculate φ(n) = (p - 1)(q - 1), which is the Euler's totient function of n. Then select an integer e such that 1 < e < φ(n) and e is relatively prime to φ(n) (usually selected as 65537). Finally, calculate d such that d ≡ e -1 mod φ(n), that is, d is the modular multiplicative inverse of e. Among them, the public key is (e, n), and the private key is (d, n).

[0055] S122: Generate the signature value σ;

[0056] First, prepare the data to be signed: Hash the certificate content C to be signed to generate a hash value H(C). Usually, a secure hash function such as SHA-256 is used. The obtained hash value H(C) is a fixed-length digest, representing the uniqueness of the certificate content.

[0057] Then use the private key for signing: Use the RSA algorithm private key d to sign the hash value to generate the signature value σ. The signature calculation formula is:

[0058] σ = H(C) d mod n

[0059] Among them, H(C) is the hash value of the data to be signed, d is the exponent of the private key, and n is the modulus.

[0060] S13: Signature verification;

[0061] When verifying the signature, use the RSA public key for verification. First, receive the signature value σ and the original data C. Then calculate the hash value: Calculate the hash value H(C) of the received certificate content C. Finally, use the public key for verification:

[0062] H'(C) = σ e mod n

[0063] If H'(C) is equal to the calculated H(C), the signature is valid, indicating that the data has not been tampered with.

[0064] S2: Request identity authentication

[0065] The first terminal requests identity authentication from the second terminal and sends a first terminal certificate, and receives the first terminal certificate through the second terminal;

[0066] S21: Initiate request:

[0067] The first terminal (eg, terminal A) prepares an identity authentication request and generates a request message including requested information and the purpose of identity authentication.

[0068] S22: Additional certificates:

[0069] The first terminal reads its own digital certificate (first terminal certificate) from its storage and attaches the first terminal certificate to the request message.

[0070] S23: Send request:

[0071] The first terminal sends a request message to the second terminal (for example, terminal B) through the network, and the message includes: the requested information and the first terminal certificate

[0072] S24: Receiving and analyzing:

[0073] The second terminal receives the request message from the first terminal, parses the message content, and extracts the request information and the first terminal certificate.

[0074] S25: Confirmation of receipt:

[0075] The second terminal confirms that the request and certificate have been successfully received and is ready to proceed to the next step of the verification process.

[0076] S3: Get the certificate chain;

[0077] The second terminal establishes the certificate chains of the first terminal certificate and the second terminal certificate respectively. And verifies the issuer signatures of the terminal certificate and the intermediate certificate in the two certificate chains, as well as the self-signatures of the intermediate certificate and the root certificate. When both certificate chains are complete and the signatures are verified correctly, it proceeds to step S4, otherwise the identity authentication fails;

[0078] S31. When establishing a certificate chain, the first terminal certificate and the second terminal certificate are used as the starting points respectively, and the issuer certificate is searched and verified step by step upward through the unique identifier of the issuer certificate in the signature field of the certificate issuer, and the intermediate certificates at each level upward until the root certificate are obtained, thereby forming two certificate chains.

[0079] After S32 obtains the certificate chain, it determines whether the certificate chain is complete based on the structure of the certificate chain. When the certificate chain contains a terminal certificate, at least one intermediate certificate and a root certificate, it means that the certificate chain is a complete certificate chain, otherwise it is an incomplete certificate chain.

[0080] S33, verifying the issuer signatures of the terminal certificates and intermediate certificates in the two certificate chains;

[0081] S331: Obtain the terminal certificate and all intermediate certificates in each certificate chain;

[0082] S332: Read the signature value in the data field and the issuer signature field of the current certificate, and read the public key of the issuer certificate of the current certificate;

[0083] S333: Use the public key of the issuer certificate of the current certificate and the signature value in the issuer signature field of the current certificate to verify the signature of the data field of the current certificate;

[0084] S334: When the terminal certificate and all the intermediate certificates in each certificate chain can be successfully verified, it means that the issuer's signature value is verified correctly, otherwise it means that the signature value verification is wrong and the identity authentication fails.

[0085] S34. Verify the self-signatures of the intermediate certificate and the root certificate;

[0086] S341: Obtain all intermediate certificates and root certificates in each certificate chain;

[0087] S342: Read the public key of the current certificate, the signature value in the self-signed domain, and read the data domain and the issuer signature domain when the current certificate is an intermediate certificate, and read the data domain when the current certificate is a root certificate;

[0088] S343: When the current certificate is an intermediate certificate, the data domain and the issuer signature domain of the current certificate are verified using the public key of the current certificate and the signature value in the self-signature domain of the current certificate; when the current certificate is a root certificate, the data domain of the current certificate is verified using the public key of the current certificate and the signature value in the self-signature domain of the current certificate;

[0089] S344: When all intermediate certificates and root certificates in each certificate chain can be successfully verified, it means that the self-signed value verification is correct. Otherwise, it means that the self-signed value verification is wrong and the identity authentication fails.

[0090] S4: There are problems with hash comparison to determine intersection points;

[0091] Check the intermediate certificates and root certificates in one of the certificate chains to see whether at least one of the intermediate certificates or root certificates exists in the other certificate chain. If so, proceed to step S5. Otherwise, the identity authentication fails.

[0092] S41: Generate hash value:

[0093] A unique hash value is generated using a hash algorithm (SHA-256) for each intermediate and root certificate in the certificate chain. The specific steps to generate the hash value are: first select SHA-256 as the hash algorithm; then determine the input data to generate the hash value. This can be any string, text content, or file content; then use the SHA-256 algorithm to create a hash object. This is a container for processing input data and generating hash values; then pass the prepared input data into the hash object. At this time, the input data needs to be converted to byte format (usually encoded in UTF-8). Then call the hash object method to generate the hash value. This will calculate the hash of the input data and obtain a fixed-length hash value. Finally, the generated hash value is output as a hexadecimal string.

[0094] S42: Store hash value:

[0095] Store the hashes of the intermediate and root certificates in each certificate chain in a collection.

[0096] S43: Compare:

[0097] Checks whether the hash value of an intermediate or root certificate in one certificate chain is in the set of hash values ​​of another certificate chain.

[0098] If it exists, it means there is an intersection and proceed to the next step; otherwise, the authentication fails.

[0099] S5: Challenge-response mechanism to determine the private key holding issue;

[0100] It is determined whether the first terminal holds the private key of the first terminal certificate. If so, the identity authentication is successful; otherwise, the identity authentication fails, thereby completing the identity authentication process.

[0101] S51: Generate challenge value:

[0102] The second terminal generates a random challenge value, which can be a random string, number or content of a specific structure. The challenge value should have a certain degree of randomness to prevent attacks.

[0103] S52: Encrypted challenge value:

[0104] The challenge value is encrypted using the public key in the first terminal certificate.

[0105] S53: Send challenge:

[0106] The encrypted challenge value is sent to the first terminal.

[0107] S54: Decryption challenge value:

[0108] The first terminal uses its private key to decrypt the received encrypted challenge value and returns the decrypted challenge value.

[0109] 1) Key generation (completed when the system is initialized): 1. Select two large prime numbers p and q. 2. Calculate the modulus n = p × q. 3. Calculate the Euler function φ(n) = (p-1)(q-1). 4. Select the public key exponent e (usually 65537). 5. Calculate the private key exponent d, so that d≡e - 1 modφ(n).6.The public key is (e,n) and the private key is (d,n).

[0110] 2) The second terminal generates a challenge value: 1. Randomly generate a challenge value C. 2. Use the public key (e, n) of the second terminal to encrypt the challenge value to generate an encrypted challenge value σ: σ = C e mod n. 3. Send the encrypted challenge value σ to the first terminal.

[0111] 3) Decryption by the first terminal: 1. The first terminal receives the encrypted challenge value σ sent by the second terminal. 2. Decrypt the received σ using the private key (d, n) of the first terminal: M = σ d mod n. Here, M is the original challenge value obtained after decryption.

[0112] 4) First terminal verification: 1. The first terminal returns the decrypted challenge value M to the second terminal. 2. The second terminal receives M and verifies: compares whether the received M is consistent with the initially generated challenge value C.

[0113] 5) Authentication result: If M (the decrypted value) matches C (the original challenge value), the authentication is successful; otherwise, the authentication fails.

[0114] S55: Verification results:

[0115] The second terminal compares the returned decrypted value with the original challenge value. If they are consistent, it is confirmed that the first terminal holds its private key and the identity authentication is successful; otherwise, the identity authentication fails. In other words, the success condition = (V1∧V2∧(H(C1)∈H(C2))). If the success condition is true, the identity authentication is successful; otherwise, the identity authentication fails.

[0116] S6: identity authentication result record;

[0117] After the identity authentication is completed, the authentication results are recorded for subsequent auditing and monitoring.

[0118] S61: record successful authentication;

[0119] If the identity authentication is successful, the authentication time, terminal information and authentication status are recorded.

[0120] S62: record failed authentication;

[0121] If any of the above steps fails, it will be considered as authentication failure. If identity authentication fails, the failure reason, time and terminal information will be recorded.

[0122] Application Examples

[0123] This example takes a smart home system as an example. In a smart home system, multiple IoT terminals (such as smart door locks, cameras, thermostats, etc.) need to be authenticated to ensure secure communication and data protection between devices.

[0124] 1. Certificate issuance:

[0125] The system administrator uses the digital certificate management system to issue certificates for each device, including root certificates, intermediate certificates, and terminal certificates.

[0126] Each device generates a pair of public and private keys and signs its certificate using the private key.

[0127] 2. Authentication request:

[0128] When the smart door lock (first terminal) is started, it sends an identity authentication request to the smartphone (second terminal) with its terminal certificate.

[0129] The smartphone parses the request and confirms receipt of the door lock's certificate.

[0130] 3 Build the certificate chain:

[0131] The smartphone searches for the certificate chain step by step based on the issuer information of the door lock certificate and establishes a complete certificate chain.

[0132] Verify all certificates in the certificate chain, including the signatures of the door lock's end certificate and intermediate certificates.

[0133] 4-intersection verification:

[0134] Check whether the certificate chain of the door lock has any intersection with the certificate chain of other devices (such as cameras) to ensure mutual trust. If there is an intersection, continue with identity authentication.

[0135] 5 Challenge-Response Mechanism:

[0136] The smartphone generates a random challenge value, encrypts it using the door lock's public key, and sends it to the door lock.

[0137] The door lock decrypts the challenge value using its private key and sends the decrypted value back to the smartphone.

[0138] The smartphone verifies that the decrypted value is consistent with the original challenge value.

[0139] 6Identity authentication results:

[0140] If the verification is successful, the smartphone confirms that the door lock holds its private key and the identity authentication is successful.

[0141] Record the certification results for subsequent audits.

[0142] The technical solutions of the present invention are not limited to the above-mentioned embodiments, and any technical solutions obtained by equivalent replacement methods fall within the scope of protection required by the present invention.

Claims

1. A method for authenticating an Internet of Things terminal based on a digital certificate, wherein the Internet of Things system includes at least two Internet of Things terminals, wherein the two interconnected Internet of Things terminals are respectively a first terminal and a second terminal, and wherein: The steps are as follows: S1. Use the digital certificate system to issue certificates in the Internet of Things system. The certificates include a root certificate, at least one intermediate certificate, and a terminal certificate. The first terminal and the second terminal are respectively issued with the first terminal certificate and the second terminal certificate; Generate a public key and a private key for the certificate, and use the private key to sign the certificate, and use the public key to verify the signature to verify the validity of the certificate; S2. The first terminal requests identity authentication from the second terminal and sends the first terminal certificate. If the second terminal confirms successful receipt of the request and the first terminal certificate, then proceed to the next step; S3. The second terminal respectively establishes the certificate chains of the first terminal certificate and the second terminal certificate; Verify the issuer signatures of the terminal certificates and intermediate certificates in the two certificate chains, as well as the self-signatures of the intermediate certificates and the root certificate; if the verification is correct, then proceed to the next step; S4. Check whether at least one intermediate certificate or root certificate in one of the certificate chains exists in the other certificate chain. If so, then proceed to the next step; S5. Determine whether the first terminal holds the private key of the first terminal certificate. If so, the identity authentication is completed.

2. The method for authenticating an IoT terminal based on a digital certificate according to claim 1, characterized in that: In the step S1, when issuing the certificate, generate a unique identifier for each certificate: where ID is the unique identifier of the certificate, C is the certificate content, H(C) is the hash value, and R is a random number.

3. The method for authenticating an Internet of Things terminal based on a digital certificate according to claim 2, characterized in that: In the step S1, the specific process of generating the public key and the private key for the certificate is as follows: Select two prime numbers p and q, calculate n = p×q, where n is the modulus, and calculate φ(n) = (p - 1)(q - 1); Select an integer e such that 1 < e < φ(n) and e is relatively prime to φ(n); Calculate d such that d≡e -1 modφ(n), then the public key is (e,n) and the private key is (d,n).

4. The method for authenticating an IoT terminal based on a digital certificate according to claim 3 is characterized in that: In the step S1, the digital certificate system issues the root certificate, the root certificate issues the first-level intermediate certificate, the intermediate certificate issues the next-level intermediate certificate step by step, and the last-level intermediate certificate issues the terminal certificate; during the issuing process, generate the self-signature of the issuer and the issuer signature of the issued entity; the self-signature constitutes the self-signature field, and the issuer signature constitutes the issuer signature field; the version number, serial number, validity period, issuer information, subject information, and public key of the certificate constitute the data field of the certificate.

5. The method for authenticating an Internet of Things terminal based on a digital certificate according to claim 4 is characterized in that: In the step S1, the specific process of signing and verifying the certificate is as follows: Use the private key d to sign the hash value to generate the signature value σ: σ=H(C) d modern Use the public key for verification: H'H (C ) =σ e manner If H' ( C ) Equal to H ( C ) , the signature is valid.

6. The method for authenticating an Internet of Things terminal based on a digital certificate according to claim 5, characterized in that: In the step S2, the specific process of requesting identity authentication is as follows: The first terminal generates a request message, the content of which includes the requested information and the purpose of identity authentication; The first terminal reads its own first terminal certificate from its storage; The first terminal sends the request message and the first terminal certificate to the second terminal through the network; The second terminal receives the request message from the first terminal, and parses the message content to extract the request information and the first terminal certificate; If the second terminal confirms successful receipt of the request information and the first terminal certificate, the identity authentication is successful.

7. The method for authenticating an Internet of Things terminal based on a digital certificate according to claim 6, characterized in that: In the step S3, when establishing the certificate chain, respectively start from the first terminal certificate and the second terminal certificate, and search and verify the issuer certificate upward level by level through the certificate unique identifier to obtain the intermediate certificates at all levels above until the root certificate, thereby forming two certificate chains; After obtaining the certificate chain, the structure of the certificate chain is used to determine whether the certificate chain is complete. When the certificate chain contains a terminal certificate, at least one intermediate certificate, and a root certificate, it indicates that the certificate chain is a complete certificate chain.

8. The method for authenticating an Internet of Things terminal based on a digital certificate according to claim 7, characterized in that: In step S3, the issuer signatures of the terminal certificates and intermediate certificates in the two certificate chains are verified, specifically: Obtain the terminal certificate and all intermediate certificates in each certificate chain; Read the signature value in the data field and the issuer signature field of the current certificate, and read the public key of the issuer certificate of the current certificate; Use the public key of the issuer certificate of the current certificate and the signature value of the issuer of the current certificate to verify the data field of the current certificate; When the terminal certificate and all the intermediate certificates in each certificate chain can be successfully verified, it means that the issuer's signature value has been verified correctly; Verify the self-signature of the intermediate and root certificates, specifically: Get all intermediate and root certificates in each certificate chain; Read the public key of the current certificate, the signature value in the self-signed domain, read the data domain and the issuer signature domain when the current certificate is an intermediate certificate, and read the data domain when the current certificate is a root certificate; When the current certificate is an intermediate certificate, the data field and the issuer signature field of the current certificate are verified using the public key of the current certificate and the signature value in the self-signed field of the current certificate. When the current certificate is a root certificate, the data domain of the current certificate is verified using the public key of the current certificate and the signature value in the self-signed domain of the current certificate; When all intermediate certificates and root certificates in each certificate chain can be successfully verified, it means that the self-signed value is verified correctly.

9. The method for authenticating an Internet of Things terminal based on a digital certificate according to claim 8, characterized in that: The step S4 specifically includes: Use a hash algorithm to generate a unique hash value for each intermediate certificate and root certificate in the certificate chain; Store the hash values ​​of the intermediate and root certificates in each certificate chain in a collection; Check whether the hash value of the intermediate certificate or root certificate in a certificate chain is in the hash value set of another certificate chain; if so, it means there is an intersection and proceed to the next step; otherwise, identity authentication fails.

10. The method for authenticating an Internet of Things terminal based on a digital certificate according to claim 9, characterized in that: The step S5 specifically includes: The second terminal generates a random challenge value; Encrypting the challenge value using the public key in the first terminal certificate; Sending the encrypted challenge value to the first terminal; The first terminal uses its private key to decrypt the received encrypted challenge value and returns the decrypted challenge value; The second terminal compares the returned decrypted value with the original challenge value. If they are consistent, it confirms that the first terminal holds its private key and the identity authentication is successful; otherwise, the identity authentication fails.

Images