Identity verification method based on identity information of Internet of Things equipment

Abstract

The invention provides an identity verification method based on identity information of Internet of Things equipment, which comprises the following steps that: a hardware terminal of the Internet of Things equipment performs hash encryption on the identity information to generate a first hash value; wherein the identity information is automatically updated every preset time or when a specific event is triggered. And the hardware terminal performs digital signature on the first hash value by using a private key of the hardware terminal. And the hardware terminal sends the identity information and the signature to the authentication server. And the authentication server performs signature verification by using the public key, and decrypts the signature to obtain a second hash value. And the authentication server performs Hash operation on the identity information to obtain a third Hash value, compares the third Hash value with the second Hash value, and performs Hash value verification. And if both the signature verification and the hash value verification are passed, determining that the identity of the hardware terminal is credible, otherwise, determining that the identity of the hardware terminal is not credible. According to the invention, an anti-counterfeiting and anti-tampering authentication framework is constructed based on identity information in combination with asymmetric encryption and Hash encryption.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things device identity authentication, and in particular to an identity authentication method based on Internet of Things device identity information. Background Art

[0002] In the existing technology, identity authentication technology solutions mainly include password and token-based authentication, certificate and public key infrastructure-based authentication, hardware and physical characteristics-based authentication, and behavior and environmental factors-based authentication.

[0003] IoT devices typically use password-based authentication, which means proving their identity by entering a preset password or PIN code. This method is easy to implement, but has low security and is vulnerable to attacks, such as brute force or dictionary attacks. To improve security, multi-factor authentication can be used to combine passwords with other authentication factors, such as one-time passwords (OTPs) or physical tokens (such as smart cards or USB keys). OTPs are usually generated via SMS or dedicated applications, while physical tokens require physical access to the device. This method provides an additional layer of security in the IoT environment. Although it increases security, it also increases the complexity of user operations, especially when physical tokens or additional devices are required. It may be difficult to implement due to device limitations, resulting in a reduced user experience.

[0004] Certificate-based authentication uses digital certificates and public key infrastructure (PKI) to verify the identity of devices. Each device has a unique certificate that is used to encrypt communications and verify identity. This approach is very strong in terms of security because it relies on asymmetric cryptography, but requires a complex certificate management and renewal process. In an IoT environment, the distribution, management, and revocation of certificates become a challenge due to the large number of devices and their wide distribution. In addition, the lifecycle management of certificates adds an additional operational burden, requiring continuous monitoring and maintenance to ensure the validity and security of certificates. This also increases the complexity of the system.

[0005] Leveraging the hardware and physical characteristics of IoT devices for authentication, such as physically unclonable functions (PUFs) or true random number generators (TRNGs), is a highly secure authentication method. PUF is a technology that generates unique device identifiers based on tiny differences in the semiconductor manufacturing process, while TRNG uses physical phenomena (such as thermal noise or radioactive decay) to generate random numbers. These methods provide high security because they rely on the inherent characteristics of hardware rather than software implementation. However, this approach may require specific hardware support and may increase the cost of the device. In addition, these methods may not be suitable for all types of devices, especially those that are cost-sensitive or space-constrained, which limits their widespread application in the Internet of Things.

[0006] The behavior and environmental factors of IoT devices can also be used for authentication. For example, the device's behavioral patterns (such as communication patterns, access frequency and time) or environmental factors (such as geographic location, temperature and humidity) can be used to identify and authenticate the device. This approach can provide continuous security monitoring without interfering with the device, but this approach can be affected by environmental noise, which may lead to misjudgment and reduce the accuracy of authentication. In addition, this approach requires complex algorithms to analyze and identify behavioral patterns and environmental changes, and regularly update and adjust to adapt to new environmental conditions. This increases the demand for computing resources and may result in longer system response times.

[0007] Many existing methods do not have effective mechanisms to prevent the forgery of identity information or the tampering of data, which makes the system vulnerable to various attacks such as man-in-the-middle attacks or replay attacks. Traditional methods usually rely on centralized authentication servers or certificate authorities, which may lead to single points of failure, and if these central nodes are attacked, the security and trust of the entire system will be threatened. The lack of application of distributed ledger technology makes it impossible to ensure the immutability and transparency of data, which is particularly problematic in environments that require a high degree of trust.

[0008] In summary, although existing authentication technologies are feasible in some scenarios, they have significant limitations in terms of security, cost-effectiveness, user experience, and management complexity, especially when facing the challenges of the rapid growth and diversification of the number of IoT devices. Summary of the invention

[0009] In order to solve the above problems, the present invention proposes an identity authentication method based on the identity information of IoT devices. The identity authentication method is based on the identity information and uses the digital signature mechanism of asymmetric encryption and the strong verification function of hash encryption to build an authentication framework that is anti-counterfeiting and anti-tampering. In addition, an automatic update mechanism for identity information is designed, and the update records are stored on the blockchain to further enhance the security and reliability of the system.

[0010] The present invention proposes an identity authentication method based on the identity information of an Internet of Things device, comprising:

[0011] The hardware terminal of the IoT device performs hash encryption on its own identity information to generate a first hash value, the identity information is automatically updated at preset intervals or when a specific event is triggered, and the first hash value is synchronously updated with the identity information;

[0012] The hardware terminal uses its own private key to digitally sign the first hash value to generate a signature;

[0013] The hardware terminal sends the identity information and the generated signature to the authentication server;

[0014] The authentication server uses the public key of the hardware terminal to perform signature verification on the signature, and uses the public key to decrypt the signature to obtain a second hash value;

[0015] The authentication server performs a hash operation on the identity information to obtain a third hash value, and compares the third hash value with the second hash value. If the third hash value is consistent with the second hash value, the hash value verification passes; otherwise, the hash value verification fails;

[0016] If both the signature verification and the hash value verification pass, the authentication server confirms that the identity of the hardware terminal is credible and allows subsequent operations to be performed. Otherwise, the authentication server considers that the identity of the hardware terminal is untrustworthy and refuses to perform subsequent operations.

[0017] In some embodiments, the method for obtaining the identity information is: combining and calculating the authentication code of each IoT device and multiple device related information to encrypt and obtain unique identity information of each IoT device;

[0018] Among them, each IoT device is configured with a unique authentication code, and the multiple device-related information includes system authorization data, device status data, interface call data and time-space data.

[0019] In some embodiments, an update record after each update of the identity information is stored on the blockchain.

[0020] The present invention also proposes an identity authentication method based on the identity information of the Internet of Things device, the identity authentication method is executed by a hardware terminal of the Internet of Things device, and the identity authentication method includes:

[0021] Hash-encrypt the identity information of the user to generate a first hash value, the identity information is automatically updated at preset intervals or when a specific event is triggered, and the first hash value is updated synchronously with the identity information;

[0022] Use its own private key to digitally sign the first hash value to generate a signature;

[0023] Send the identity information and the generated signature together to the authentication server, the signature is used to trigger the authentication server to use the public key of the hardware terminal to perform signature verification on the signature, and use the public key to decrypt the signature to obtain a second hash value, the identity information is used to trigger the authentication server to perform a hash operation on the identity information to obtain a third hash value, and compare the third hash value with the second hash value, if the third hash value is consistent with the second hash value, the hash value verification is passed, otherwise, the hash value verification fails;

[0024] If both the signature verification and the hash value verification pass, the identity of the hardware terminal is confirmed as credible by the authentication server and is allowed to perform subsequent operations. Otherwise, the identity of the hardware terminal is considered untrustworthy by the authentication server and is denied to perform subsequent operations.

[0025] In some embodiments, the method for obtaining the identity information is: combining and calculating the authentication code of each IoT device and multiple device related information to encrypt and obtain unique identity information of each IoT device;

[0026] Among them, each IoT device is configured with a unique authentication code, and the multiple device-related information includes system authorization data, device status data, interface call data and time-space data.

[0027] In some embodiments, an update record after each update of the identity information is stored on the blockchain.

[0028] The present invention also proposes an identity authentication method based on the identity information of an IoT device, the identity authentication method being executed by an authentication server, and the identity authentication method comprising:

[0029] Receive identity information and a signature sent by a hardware terminal of an IoT device, wherein the signature is obtained by digitally signing a first hash value using a private key of the hardware terminal itself, and the first hash value is obtained by hashing and encrypting the hardware terminal's own identity information, wherein the identity information is automatically updated at preset intervals or when a specific event is triggered, and the first hash value is synchronously updated with the identity information;

[0030] Using the public key of the hardware terminal to perform signature verification on the signature, and using the public key to decrypt the signature to obtain a second hash value;

[0031] Performing a hash operation on the identity information to obtain a third hash value, and comparing the third hash value with the second hash value. If the third hash value is consistent with the second hash value, the hash value verification passes; otherwise, the hash value verification fails.

[0032] If both the signature verification and the hash value verification are passed, the identity of the hardware terminal is confirmed to be credible and subsequent operations are allowed to be performed. Otherwise, the identity of the hardware terminal is considered to be untrustworthy and subsequent operations are refused to be performed.

[0033] In some embodiments, the method for obtaining the identity information is: combining and calculating the authentication code of each IoT device and multiple device related information to encrypt and obtain unique identity information of each IoT device;

[0034] Among them, each IoT device is configured with a unique authentication code, and the multiple device-related information includes system authorization data, device status data, interface call data and time-space data.

[0035] In some embodiments, an update record after each update of the identity information is stored on the blockchain.

[0036] The present invention also proposes a computer storage medium, in which program instructions are stored. When the program instructions are executed, they are used to implement any one of the identity authentication methods based on the identity information of the Internet of Things device as described above.

[0037] The present invention has the following beneficial effects:

[0038] The present invention provides a novel solution by combining asymmetric encryption and hash encryption technology, which not only improves the security and credibility of identity authentication, but also simplifies the management process, reduces the dependence on specific hardware, improves the adaptability and accuracy of the system, and enhances the reliability of the system through blockchain technology. These improvements enable the present invention to provide a more solid guarantee in the security authentication of IoT devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 The present invention is a flowchart of an identity authentication method based on the identity information of an Internet of Things device according to an embodiment of the present invention.

[0040] Figure 2 The present invention is a schematic diagram of the execution process of an identity authentication method based on the identity information of an Internet of Things device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the invention and are not used to limit the invention.

[0042] like Figure 1 and Figure 2 As shown, the present invention proposes an identity authentication method based on the identity information of an IoT device, comprising the following steps:

[0043] S1: The hardware terminal of the IoT device performs hash encryption on its own identity information (ID) to generate a first hash value H1 = Hash (ID). This hash value will serve as an important basis for verifying the identity of the device to ensure that the data has not been tampered with during transmission.

[0044] In order to cope with security threats in long-term use, the identity information is automatically updated at preset intervals or when a specific event is triggered, and the first hash value is updated synchronously with the identity information.

[0045] The specific event may be the end of a data upload action, an administrator manually issuing an update instruction to the device through the IoT platform, a device restart, a device system update, a device security policy update, and many other situations.

[0046] Furthermore, the update record of each identity information update is stored on the blockchain.

[0047] S2: The hardware terminal uses its own private key SK to digitally sign the first hash value H1 and generates a signature S=Sign(H1,SK) to ensure the authenticity of the device identity.

[0048] The digital signature generated by the present invention through asymmetric encryption technology ensures that only the private key owned by the device can generate a valid signature. Even if an attacker can obtain the public key of the device, he cannot forge a valid identity authentication request, thereby effectively preventing identity forgery attacks. In addition, the present invention utilizes the characteristics of hash encryption, and the hash value generated during the identity authentication process can ensure the integrity of the data. Any tampering with the authentication message will result in a mismatch in the hash value, which will be rejected by the authentication system, preventing the data from being maliciously modified or manipulated.

[0049] S3: The hardware terminal sends the identity information ID and the generated signature S to the authentication server.

[0050] S4: The authentication server uses the public key PK of the hardware terminal to verify the signature S, and uses the public key PK to decrypt the signature to obtain a second hash value H2=Verify(S,PK).

[0051] If the signature verification passes, it means that the signature is indeed generated by the device that owns the private key and the device identity is valid.

[0052] S5: The authentication server performs a hash operation on the identity information ID to obtain a third hash value H3 = Hash (ID). The third hash value H3 is compared with the second hash value H2. If the third hash value H3 is consistent with the second hash value H2, the hash value verification passes, proving that the data has not been tampered with. Otherwise, the hash value verification fails.

[0053] S6: If the signature verification in step S4 and the hash value verification in step S5 are both passed, the authentication server confirms that the identity of the hardware terminal is credible, and generates a trust result of True, allowing subsequent operations to be performed. Otherwise, the authentication server considers that the identity of the hardware terminal is untrustworthy, and generates a trust result of False, refusing to perform subsequent operations.

[0054] The present invention realizes the effect of multiple encryption of identity information through the composite application of hash algorithm and digital signature algorithm, and realizes the mechanism of final identity authentication process based on identity information.

[0055] In some embodiments, the method for obtaining identity information in step S1 is: the authentication code of each IoT device and multiple device-related information are combined and calculated and encrypted to obtain unique identity information of each IoT device. There are various combined calculation and encryption methods. There are many possible situations for selecting which combined calculation and encryption method to use in actual application, and it will be decided according to actual needs.

[0056] In the present invention, the information related to multiple devices includes but is not limited to system authorization data, device status data, interface call data and spatiotemporal data of each IoT device.

[0057] It should be understood that before performing identity authentication, an initialization phase is also included, and the allocation of authentication codes and the initial parameter settings of multiple device-related information are completed in the initialization phase. Specifically, in the initialization phase, a unique authentication code is allocated to each IoT device shipped out of the factory, and initial parameters are set for multiple device-related information, such as initial parameters {X1, X2, X3...} for system authorization data, device status data, interface call data, spatiotemporal data, etc.

[0058] In one embodiment of the present invention, the combined computing encryption method is: the authentication code, system authorization data, device status data, interface call data and spatiotemporal data of each IoT device are string-concatenated, and then the concatenated string is encrypted using the English code corresponding method.

[0059] The present invention does not limit the combined calculation encryption method, and there are many possible combined encryption methods.

[0060] Example 1: Data block encryption

[0061] The authentication code, system authorization data, device status data, interface call data and spatiotemporal data of the IoT device are divided into several groups of small data blocks with fixed lengths. Each group of data blocks is encrypted separately using different encryption algorithms (such as AES, DES, RSA, etc.) or keys (such as ECC, SM2, SM4, Blowfish, Twofish, etc.). Then the encrypted data blocks are combined together (such as sequential splicing, adding separator combinations, data block index combinations, data block nested combinations, etc.) to form an encrypted string.

[0062] Example 2: Block Cipher Encryption

[0063] First, the authentication code, system authorization data, device status data, interface call data and spatiotemporal data of the IoT device are divided into multiple groups of fixed length, such as using the block length of the block cipher algorithm (such as 3-DES). For each group, different block cipher working modes (such as CBC mode-ciphertext block chaining mode, CFB mode-ciphertext feedback mode, etc.) are used for encryption. In block cipher encryption, the encryption of each group depends on the ciphertext of the previous group, which can increase the correlation between data and the complexity of encryption. Finally, the groups encrypted by different block cipher working modes are combined in a predetermined order (such as sequential splicing, adding separator combinations, etc.) to obtain an encrypted string.

[0064] Example 3: XOR encryption combined with shift encryption

[0065] The authentication code, system authorization data, device status data, interface call data and time-space data of the IoT device are read in bytes in sequence. For each byte of data, it is first XORed with a preset key byte (the key byte can be generated according to certain rules or randomly set, etc.), and then the XORed byte is shifted (for example, cyclically shifted to the left or right by a certain number of bits, and the number of shifted bits can also be set according to established rules). All the byte data processed in this way are combined in the original order to form an encrypted string as a whole.

[0066] Example 4: Data encoding conversion encryption

[0067] The authentication code, system authorization data, device status data, interface call data and spatiotemporal data of the IoT device are subjected to specific encoding conversion, such as first converting the original character encoding (such as ASCII encoding, etc.) into Base64 encoding to obtain the converted string, and then performing character replacement operations on these converted strings (according to a pre-set replacement rule table, for example, replacing certain specific characters with other characters), and then concatenating the replaced parts of the string to form a final encrypted string.

[0068] Example 5: Hash chain encryption

[0069] First, the authentication code, system authorization data, device status data, interface call data, and spatiotemporal data of the IoT device are sequentially concatenated into an initial string. Then, a suitable hash function (such as the common SHA-256, MD5, etc.) is selected to perform the first hash operation on this initial string to obtain an intermediate hash value. Next, this intermediate hash value is concatenated with the previous initial string, and the same hash function is used again to perform a hash operation on the concatenated new string. This is repeated multiple times (the specific number of times can be pre-set based on security requirements and other factors) to form a final encrypted string.

[0070] Existing identity information technology mainly relies on a single data source, or uses the factory code of the device itself to obtain unique identity information, and uses a simple matching or verification method to confirm the device identity. It does not expand the data source to device status data, spatiotemporal data, etc. associated with the physical world, has low complexity, low security level, and is easy to be monitored and tampered with. The main difference from the prior art is that the identity information described in the present invention is a unique identifier obtained by composite calculation based on multiple data sources, and the data source comes from but is not limited to system authorization data, device status data, call data, spatiotemporal data, etc., making the identity information more difficult to forge or copy. Specifically, since the identity information is calculated through a combination of multiple data, the requests in the authentication process all contain unique identity information. This design effectively resists replay attacks, ensuring that even if an attacker intercepts a legitimate request, the request cannot be reused for authentication.

[0071] In a specific embodiment, the combined computation encryption includes the following steps:

[0072] S11: Assume that the authentication code editing rule is "factory time + factory batch (string concatenation)" (actually there are still many other possibilities). There is an IoT device with a factory time of 12:12:12 on December 12, 2024, and a factory batch of the 13th batch, the 13th box, and the 13th one. According to the authentication code editing rule, the device authentication code should be "202412121212131313".

[0073] S12: According to the actual use scenario of the device, perform initial parameter settings on the basic information of the device in terms of system authorization, device status, interface call, time and space (there are actually many other possibilities, only four are given here). Specifically, the steps include:

[0074] S121: System authorization: Assume that the system authorization editing rule is "enterprise number + department number + point number + system authorization time (string concatenation)" (there are still many other possibilities in reality). The device is currently dedicated to point 05 of the production department of a factory. In the IoT system, the factory number is 15, its production department is 1501, and the system authorization time is December 13, 2024. According to the editing rule, the system authorization data of the device should be "1515010520241213".

[0075] S122: Equipment status: Assume that the equipment status editing rule is the "working environment temperature" of the equipment (there are still many other possibilities in reality). The equipment is currently used exclusively in a cold storage, and the working environment temperature is always 5 degrees Celsius. According to the editing rule, the equipment status data of the equipment should be "5".

[0076] S123: Interface call: Assume that the interface call editing rule is the frequency of the interface call to the sensor when the device performs data collection (there are actually many other possibilities). The current call frequency of the device for collection is once every 300 seconds. According to the editing rule, the device interface call data should be "300".

[0077] S124: Time and space: Assume that the time and space editing rule is the device's "work location longitude + work location latitude + daily working hours (string concatenation)" (actually there are still many other possibilities). The current working location of the device is longitude 118.3487384°, latitude 29.2707676°, and the working hours are 24 hours a day. According to the editing rules, the device's time and space data should be "118.348738429.270767624".

[0078] S13: Based on the data obtained in the above steps S11 and S12, unique device identity information is obtained through a custom combination calculation encryption method.

[0079] S131: It is now stipulated that the custom combination calculation method is string concatenation (different data are separated by "-", that is, the combination calculation rule is the string concatenation of "authentication code + system authorization data + device status data + interface call data + time and space data". In this embodiment, the data obtained in step S11 and step S12 are combined to obtain the following original string: "202412121212131313-1515010520241213-5-300-118.348738429.270767624".

[0080] S132: The encryption method is specified as the English code corresponding encryption method. In this embodiment, the English code corresponding encryption method adopts: 0 corresponds to A, 1 corresponds to B, 2 corresponds to C..., and 9 corresponds to J. Therefore, after encrypting the original string in step S131, an encrypted string is obtained: "CACEBCBCBCBCBDBDBD-BFBFABAFCACEBCBD-F-DAA-BBI.DEIHDIECJ.CHAHGHGCE", which is the final unique device identity information.

[0081] The above is an example of any combination calculation encryption method. In this example, the combination calculation encryption method is: first concatenate the character strings (different data are separated by "-"), and then encrypt them using the English code corresponding method (0 corresponds to A, 1 corresponds to B, 2 corresponds to C..., until 9 corresponds to J). It should be understood that this embodiment is only used as an example, and there are still many other possibilities for combination calculation and encryption methods.

[0082] At the same time, during the initialization phase, the IoT device itself generates a pair of asymmetric public-private key pairs PK (public key) and SK (private key). There are many asymmetric encryption algorithms, such as RSA, DSA, ECDSA, etc. The asymmetric encryption algorithm for generating the public-private key pair here is selected according to the actual development situation.

[0083] The private key SK is then stored in a secure storage area inside the device, and the public key PK and basic information of the device (such as device number, model, etc.) are uploaded to the authentication center (CA) or authentication server and stored by the authentication server to ensure that the identity of the device can be successfully verified during subsequent authentication processes.

[0084] In step S1, the automatic update of identity information exists in the update stage, and the update stage is triggered at a preset time or a specific event after the first authentication. The dynamic update mechanism of the present invention ensures that even if the identity information of a certain period of time is obtained by an attacker, its effectiveness will decrease over time. The main difference from the prior art is that the identity information generated based on multiple data sources has a more secure anti-eavesdropping and forgery capability. Compared with the automatic update method of the prior art "relying on unique identity information generated by a single data source", it has stronger security capabilities and privacy protection capabilities.

[0085] Specifically, the update phase mainly includes the following steps:

[0086] The hardware terminal of the IoT device and the authentication server agree in advance on the ID update algorithm and update frequency. For example, the system can be set to automatically update the device ID at regular intervals or when a specific event is triggered, and the automatically updated ID = Change(). The update rules agreed upon by both parties have many possibilities in actual applications. The following examples only represent one of the feasibility:

[0087] 1) Identity information update: In one of the above embodiments, the combination calculation encryption rule of the identity information is "authentication code + system authorization data + device status data + interface call data + time and space data".

[0088] The hardware terminal and the authentication server agree that the update rule of identity information is that the system authorization time in the system authorization data is updated on a monthly basis, and other data remain unchanged. If the original system authorization time is December 13, 2024, then the system authorization time after the one-month expiration update is January 13, 2025. Since the system authorization time is updated, the identity information needs to be regenerated. It should be understood that there are also many possibilities for the selection rules of the update frequency, which are only used as an exemplary reference here.

[0089] Based on the initial identity information of the first time and the update rules agreed upon by both parties, each regenerated identity information from the second time onwards is uniquely predictable. At this time, the authentication server will know in advance the update of the next identity information. When the hardware terminal sends an authentication request to the authentication server next time and passes the digital signature authentication, the server will compare the obtained identity information with the previously known "updated identity information that complies with the update rules". If they are consistent, the authentication is passed. If they are inconsistent, a danger warning will be issued or the authentication will be rejected (only one of the two results exists each time, and the default is a danger warning).

[0090] In addition, after each ID update, the update record is stored on the blockchain to ensure that all identity authentication processes have tamper-proof evidence. The decentralized nature of the blockchain makes it difficult for attackers to forge or tamper with update records, further enhancing the security of the identity authentication process. In addition, the use of blockchain technology to store identity information update records also ensures the transparency of the update process.

[0091] 2) Hash algorithm update: The hardware terminal and the authentication server agree that when the identity information is updated, the hash encryption algorithm used by the hardware terminal and the server will be updated synchronously. The hash encryption algorithm used in this example is replaced with any other hash encryption algorithm to ensure that each communication is based on the latest ID to avoid security risks caused by long-term use. The hash encryption algorithm used after the update is selected according to the actual development.

[0092] 3) Public and private key update: The hardware terminal and the authentication server agree that when the identity information is updated, the asymmetric public and private keys used by the hardware terminal and the server will be updated synchronously, and the public and private keys used in this example will be replaced with any other asymmetric encryption algorithm. The key pair used after the update will be selected according to the actual development. The digital signature will be updated synchronously (i.e., the signature S will be recalculated) due to the change of identity information and public and private keys.

[0093] This completes the entire update phase.

[0094] The steps S1, S2 and S3 described above can independently implement the identity authentication method performed by the IoT device hardware terminal, and the steps S4, S5 and S6 described above can independently implement the identity authentication method performed by the authentication server.

[0095] All symbols used in this article and their corresponding meanings are shown in Table 1 below.

[0096] Table 1 Symbols used in this article and their corresponding meanings

[0097]

[0098] The present invention also proposes a computer storage medium, in which program instructions are stored. When the program instructions are executed, they are used to implement any one of the identity authentication methods based on the identity information of the Internet of Things device as described above.

[0099] The present invention has the following beneficial effects:

[0100] 1. Improved security: Traditional authentication methods based on passwords and tokens are vulnerable to brute force or dictionary attacks, while this invention significantly improves security by combining asymmetric encryption and hash encryption. This method is not only difficult to crack, but hash encryption also ensures the integrity of the data, making any tampering easy to detect.

[0101] 2. Simplified management: Although identity authentication based on certificates and public key infrastructure is secure, the management and update process of certificates is complicated. This invention simplifies the certificate management process by automatically updating identity information and recording it on the blockchain, reducing the complexity of certificate distribution, management and revocation.

[0102] 3. Reduce hardware dependence: Authentication based on hardware and physical characteristics requires specific hardware support, which increases costs. The present invention does not rely on specific hardware characteristics, so it can be applied to various devices without additional hardware costs.

[0103] 4. Improve adaptability and accuracy: Authentication based on behavioral and environmental factors is easily affected by environmental noise and requires complex algorithms and regular updates. The present invention improves adaptability and accuracy and reduces reliance on complex algorithms by automatically updating identity information by combining multiple data (such as system authorization data, device status data, etc.).

[0104] 5. Anti-counterfeiting and anti-tampering: The present invention utilizes the digital signature mechanism of asymmetric encryption and the strong verification function of hash encryption to construct an authentication framework that is anti-counterfeiting and anti-tampering, which is difficult to achieve in traditional password- and token-based methods.

[0105] 6. Enhanced reliability: By storing update records on the blockchain, the present invention further enhances the security and reliability of the system, which is difficult to achieve in traditional methods because they usually do not involve distributed ledger technology to ensure the immutability of data.

[0106] In general, the present invention provides a novel solution by combining asymmetric encryption and hash encryption technology, which not only improves the security and credibility of identity authentication, but also simplifies the management process, reduces the dependence on specific hardware, improves the adaptability and accuracy of the system, and enhances the reliability of the system through blockchain technology. These improvements enable the present invention to provide a more solid guarantee in the security authentication of IoT devices.

[0107] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. The software module may reside in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. The storage medium is coupled to the processor so that the processor can read and write information from / to the storage medium. In an alternative, the storage medium may be integrated into the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In an alternative, the processor and the storage medium may reside in a user terminal as discrete components.

[0108] The above-described embodiments are only further explanations of the present invention, and are not intended to limit the present invention in other forms. The present invention may also have other various embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art may make various corresponding modifications and changes according to the present invention, but these corresponding modifications and changes should all fall within the protection scope of the present invention.

Claims

1. An identity authentication method based on the identity information of an Internet of Things device, characterized in that: include: The hardware terminal of the IoT device performs hash encryption on its own identity information to generate a first hash value, the identity information is automatically updated at preset intervals or when a specific event is triggered, and the first hash value is synchronously updated with the identity information; The hardware terminal uses its own private key to digitally sign the first hash value to generate a signature; The hardware terminal sends the identity information and the generated signature to the authentication server; The authentication server uses the public key of the hardware terminal to perform signature verification on the signature, and uses the public key to decrypt the signature to obtain a second hash value; The authentication server performs a hash operation on the identity information to obtain a third hash value, and compares the third hash value with the second hash value. If the third hash value is consistent with the second hash value, the hash value verification succeeds; otherwise, the hash value verification fails; If both the signature verification and the hash value verification pass, the authentication server confirms that the identity of the hardware terminal is credible and allows subsequent operations to be performed. Otherwise, the authentication server considers that the identity of the hardware terminal is untrustworthy and refuses to perform subsequent operations.

2. The identity authentication method based on the identity information of the Internet of Things device according to claim 1 is characterized in that: The method for obtaining the identity information is as follows: the authentication code of each IoT device and multiple device related information are combined, calculated and encrypted to obtain the unique identity information of each IoT device; Among them, each IoT device is configured with a unique authentication code, and the multiple device-related information includes system authorization data, device status data, interface call data and time-space data.

3. The identity authentication method based on the identity information of the Internet of Things device according to claim 1 is characterized in that: The update record of each update of the identity information is stored on the blockchain.

4. An identity authentication method based on the identity information of an Internet of Things device, characterized in that: The identity authentication method is performed by a hardware terminal of an Internet of Things device, and the identity authentication method includes: Hash-encrypt the identity information of the user to generate a first hash value, the identity information is automatically updated at preset intervals or when a specific event is triggered, and the first hash value is updated synchronously with the identity information; Use its own private key to digitally sign the first hash value to generate a signature; Send the identity information and the generated signature together to the authentication server, the signature is used to trigger the authentication server to use the public key of the hardware terminal to perform signature verification on the signature, and use the public key to decrypt the signature to obtain a second hash value, the identity information is used to trigger the authentication server to perform a hash operation on the identity information to obtain a third hash value, and compare the third hash value with the second hash value, if the third hash value is consistent with the second hash value, the hash value verification is passed, otherwise, the hash value verification fails; If both the signature verification and the hash value verification pass, the identity of the hardware terminal is confirmed as credible by the authentication server and is allowed to perform subsequent operations. Otherwise, the identity of the hardware terminal is considered untrustworthy by the authentication server and is denied to perform subsequent operations.

5. The identity authentication method based on the identity information of the Internet of Things device according to claim 4 is characterized in that: The method for obtaining the identity information is as follows: the authentication code of each IoT device and multiple device related information are combined, calculated and encrypted to obtain the unique identity information of each IoT device; Among them, each IoT device is configured with a unique authentication code, and the multiple device-related information includes system authorization data, device status data, interface call data and time-space data.

6. The identity authentication method based on the identity information of the Internet of Things device according to claim 4 is characterized in that: The update record of each update of the identity information is stored on the blockchain.

7. An identity authentication method based on the identity information of an Internet of Things device, characterized in that: The identity authentication method is performed by an authentication server, and the identity authentication method includes: Receive identity information and a signature sent by a hardware terminal of an IoT device, wherein the signature is obtained by digitally signing a first hash value using a private key of the hardware terminal itself, and the first hash value is obtained by hashing and encrypting the hardware terminal's own identity information, wherein the identity information is automatically updated at preset intervals or when a specific event is triggered, and the first hash value is synchronously updated with the identity information; Using the public key of the hardware terminal to perform signature verification on the signature, and using the public key to decrypt the signature to obtain a second hash value; Performing a hash operation on the identity information to obtain a third hash value, and comparing the third hash value with the second hash value. If the third hash value is consistent with the second hash value, the hash value verification passes; otherwise, the hash value verification fails. If both the signature verification and the hash value verification are passed, the identity of the hardware terminal is confirmed to be credible and subsequent operations are allowed to be performed; otherwise, the identity of the hardware terminal is considered to be untrustworthy and subsequent operations are refused to be performed.

8. The identity authentication method based on the identity information of the Internet of Things device according to claim 7 is characterized in that: The method for obtaining the identity information is as follows: the authentication code of each IoT device and multiple device related information are combined, calculated and encrypted to obtain the unique identity information of each IoT device; Among them, each IoT device is configured with a unique authentication code, and the multiple device-related information includes system authorization data, device status data, interface call data and time-space data.

9. The identity authentication method based on the identity information of the Internet of Things device according to claim 7, characterized in that: The update record of each update of the identity information is stored on the blockchain.

10. A computer storage medium, characterized in that: The computer storage medium stores program instructions, which, when executed, are used to implement the identity authentication method based on the identity information of an Internet of Things device as described in any one of claims 1 to 9.

Images