Intelligent equipment security networking method and system based on dynamic key

Abstract

The invention relates to an intelligent device safe networking method and system based on a dynamic secret key, and the method comprises the steps: obtaining a device identifier and an initial secret key of an intelligent device, recording a current timestamp when the intelligent device is started, and generating a dynamic secret key through a Hash algorithm in combination with the device identifier and the initial secret key; generating a corresponding networking request based on the dynamic key, and sending the dynamic key and the networking request to a corresponding gateway; verifying the received networking request and the dynamic key through the gateway to obtain a verification result, and sending the verification result to the intelligent device; and generating a corresponding session key through the intelligent device according to a preset Diffie-Hellman algorithm in combination with the verification result, performing encrypted communication with the gateway based on the session key, and sending corresponding encrypted data to the gateway. According to the invention, flexible key management and efficient encryption communication can be realized.

Description

Technical Field

[0001] The present invention relates to the technical field of secure networking of smart devices, and in particular to a method and system for secure networking of smart devices based on dynamic keys. Background Art

[0002] With the rapid development of Internet of Things technology and the widespread application of smart devices, the issue of secure networking of smart devices has received increasing attention. As an important part of the Internet of Things, smart devices play an increasingly important role in daily life and industrial production. However, since smart devices usually have limited computing power and storage resources, traditional secure communication methods are often difficult to apply directly to these devices. At present, most secure networking solutions for smart devices mainly rely on static keys or simple authentication mechanisms, which are powerless in the face of increasingly complex network security threats. Static keys can be easily obtained by attackers through long-term monitoring or physical contact, while simple authentication mechanisms can be bypassed or forged. In addition, existing secure networking methods often ignore the dynamic characteristics and resource limitations of smart devices, making it difficult to achieve flexible key management and efficient encrypted communications. Summary of the invention

[0003] The main purpose of the present invention is to provide a method and system for secure networking of smart devices based on dynamic keys, which can achieve flexible key management and efficient encrypted communication.

[0004] To achieve the above object, the present invention provides a method for secure networking of smart devices based on dynamic keys, comprising: Obtaining a device identification and an initial key of a smart device, recording a current timestamp when the smart device is started, and generating a dynamic key by combining the device identification and the initial key through a hash algorithm; Generate a corresponding networking request based on the dynamic key, and send the dynamic key and the networking request to a corresponding gateway; Verifying the received networking request and the dynamic key through the gateway to obtain a verification result, and sending the verification result to the smart device; The smart device generates a corresponding session key according to a preset Diffie-Hellman algorithm in combination with the verification result, performs encrypted communication with the gateway based on the session key, and sends the corresponding encrypted data to the gateway.

[0005] Furthermore, the obtaining of the device identification and the initial key of the smart device, when the smart device is started, recording the current timestamp, and generating a dynamic key by combining the device identification and the initial key through a hash algorithm, includes: Reading a device identification and an initial key preset by the smart device, and recording a system clock of the smart device to obtain the current timestamp; Concatenate the device identifier, the initial key and the current timestamp to obtain an original string; Perform UTF-8 encoding on the original string to obtain an encoded byte array; Performing hash calculation on the byte array using the hash algorithm to obtain a byte hash value; Convert the byte hash value into a hexadecimal string to obtain an intermediate key; Perform Base64 encoding on the intermediate key to obtain an encoded string; The first 32 characters in the encoded string are extracted to obtain the dynamic key.

[0006] Further, the generating a corresponding networking request based on the dynamic key, and sending the dynamic key and the networking request to a corresponding gateway includes: Segmenting the dynamic key to obtain multiple key fragments; Filling the device identification and the current timestamp according to a preset networking request template to obtain an initial request; Performing a hash operation on the initial request to obtain a request digest; reordering the plurality of key fragments according to the request digest to obtain a key fragment sequence; Performing an XOR operation on the key fragment sequence to obtain an obfuscated key; Encrypting the initial request according to the obfuscation key to obtain an encrypted networking request; Processing the encrypted networking request in blocks to obtain multiple request data blocks; Encapsulating the multiple request data blocks according to a preset network protocol to obtain the networking request; The networking request and the dynamic key are sent to the corresponding gateway through a preset secure channel.

[0007] Further, the step of verifying the received networking request and the dynamic key through the gateway to obtain a verification result, and sending the verification result to the smart device includes: After sending the network connection request and the dynamic key to the gateway through the smart device, detecting whether the verification result sent by the gateway is received within a preset time period, and when the verification result is not received within the preset time period, resending the network connection request and the dynamic key to the gateway; The step of verifying the received networking request and the dynamic key through the gateway to obtain a verification result includes: When the gateway receives the networking request and the dynamic key, it extracts the timestamp of the networking request to obtain the request timestamp; Compare the current gateway time with the request timestamp to obtain a time difference; Comparing the time difference with a preset time threshold to obtain a time validity result; Screening and parsing the networking request according to the time validity result to obtain a requesting device identifier and the initial key; Performing a hash operation on the initial key, the requesting device identifier and the requesting timestamp to obtain a gateway dynamic key; The gateway dynamic key and the dynamic key sent by the smart device are compared and verified to obtain the verification result.

[0008] Further, the comparing and verifying the gateway dynamic key and the dynamic key sent by the smart device to obtain the verification result includes: Performing a hash operation on the requesting device identifier, the initial key and the request timestamp by the gateway to obtain a first verification value; Obtaining the gateway time of the gateway, and performing a secondary hash operation on the gateway time in combination with the first verification value to obtain a gateway dynamic key; Matching the gateway dynamic key with the dynamic key sent by the smart device to obtain a corresponding matching result, Determine whether the matching result matches, and generate a corresponding verification result; When the matching result indicates a match, generating a verification result of passing the verification and sending it to the smart device; When the matching result indicates a mismatch, a verification result indicating that the verification failed is generated and sent to the smart device.

[0009] Further, the smart device generates a corresponding session key according to a preset Diffie-Hellman algorithm in combination with the verification result, performs encrypted communication with the gateway based on the session key, and sends the corresponding encrypted data to the gateway, including: Parsing the verification result to obtain verification status information; Determine whether the verification is successful according to the verification status information, and execute subsequent steps when the verification is successful, otherwise terminate the networking process; Generate public parameters for the Diffie-Hellman algorithm: large prime numbers and primitive roots; Generate a random private key through the smart device and calculate a first public key; Sending the large prime number, the primitive root and the first public key to the gateway; Receive a second public key sent by the gateway, and calculate a shared key using the random private key and the second public key; Performing a hash operation on the shared key to obtain the session key; Sending a notification message of completion of session key generation to the gateway, and receiving a confirmation message returned by the gateway to establish encrypted communication; Encrypting the data to be sent based on the session key to obtain encrypted data; Sending the encrypted data to the gateway, and receiving response data sent by the gateway encrypted according to the session key; Decrypting the received response data using the session key to obtain decrypted response data; The formula for calculating the first public key is: A = g a mod p, the formula for calculating the shared key is: K = B a modp; A is the first public key, p is a large prime number, g is the primitive root, a is a random private key, K is the shared key, and B is the second public key; mod is the modulus operator, which means remainder operation.

[0010] Furthermore, the generation of the public parameters of the Diffie-Hellman algorithm: large prime numbers and primitive roots, includes: The steps to generate large prime numbers include: A large odd number is randomly selected within a preset range as a candidate prime number, and after subtracting 1 from the candidate prime number, the result is decomposed into the product of a power of 2 and an odd number to obtain a corresponding test cardinality set; A plurality of test bases are randomly selected from the test base set, and a Miller-Rabin primality test is performed on each of the test bases: Calculate the power module operation of the test base on the candidate prime number, and determine whether the candidate prime number is likely to be a prime number according to the power module operation result, and reselect the candidate prime number when any test fails; When all tests are passed, the candidate prime number is considered to be the large prime number; The steps of generating the primitive root include: Subtract 1 from the large prime number and then perform prime factorization to obtain a non-repeating set of prime factors; Set the initial value of the candidate primitive root to 2; Testing the candidate primitive roots: Perform the following steps on each prime factor in the prime factor set: Calculate a specific value, where the specific value is obtained by subtracting 1 from the large prime number and dividing it by the current prime factor; Calculate the exponential power of the candidate primitive root modulo the large prime number, where the exponent is the specific value; When the calculation result is equal to 1, it means that the current candidate primitive root is not the primitive root, the value of the current candidate primitive root is increased by 1, and a new test is started again; When all prime factors pass the test, that is, there is no situation where the calculation result is equal to 1, then the current candidate primitive root is the primitive root.

[0011] Furthermore, the method further comprises: Monitor the operating status of the smart device in real time and record the operating time and important events; Regularly analyzing the operation time and the important events according to a preset update strategy, and determining whether the key needs to be updated; When the update conditions are met, a key update trigger signal is generated, and the steps of the networking operation are re-executed to generate a new dynamic key and a new session key; Encrypting and storing the new dynamic key and the new session key to obtain a key backup file; Communicate according to the new session key and continuously monitor abnormal conditions during the communication process according to a preset security policy; When an anomaly is detected, the degree of the anomaly is analyzed and the corresponding safety mechanism is activated based on the analysis results; Identify the user's operation request in real time and add sensitive operations to the list of operations that require multi-factor authentication; When a sensitive operation request is detected, the multi-factor authentication data provided by the user is collected according to the operation list and verified; If the verification is successful, the sensitive operation request is allowed to be executed; otherwise, the sensitive operation request is rejected; When receiving a request for device reset, extracting original key information from the key backup file; The device is reconfigured according to the key information to restore the secure connection state of the smart device.

[0012] The present invention also provides a smart device secure networking system based on a dynamic key, which is applied to any one of the above-mentioned smart device secure networking methods based on a dynamic key, comprising: A collection module, the collection module is used to obtain the device identification and initial key of the smart device, when the smart device is started, record the current timestamp, and generate a dynamic key by combining the device identification and the initial key through a hash algorithm; An analysis module, the analysis module is used to generate a corresponding networking request based on the dynamic key, and send the dynamic key and the networking request to a corresponding gateway; An association module, the association module is used to obtain a verification result generated by the gateway after receiving the networking request and the dynamic key; A processing module, wherein the processing module is used to generate a corresponding session key through the smart device according to a preset Diffie-Hellman algorithm combined with the verification result, and to perform encrypted communication with the gateway based on the session key.

[0013] The present invention provides a method and system for secure networking of smart devices based on dynamic keys, which has the following beneficial effects: By combining the device identification and the initial key to generate a dynamic key, the security and unpredictability of the key are improved, the risk of the static key being stolen or cracked is effectively prevented, and the security protection capability of the smart device is enhanced. The dynamic key generation mechanism based on timestamp is adopted, so that the key can change dynamically over time, adapt to the dynamic operating environment of the smart device, and improve the security and flexibility of the system. The session key is generated by the Diffie-Hellman algorithm, which realizes the secure key exchange and negotiation process, avoids the risk of the key being intercepted during network transmission, and adapts to the resource-constrained characteristics of smart devices. The dual security mechanism of gateway verification and session key generation effectively prevents the access of unauthorized devices and improves the security and reliability of the entire Internet of Things system. The encrypted communication method based on session keys not only ensures the security of communication, but also reduces the computational complexity of the encryption and decryption process, which is suitable for the resource-constrained characteristics of smart devices. The entire networking process takes into account the characteristics and security requirements of smart devices, realizes efficient and dynamic secure networking, effectively responds to various network attack threats, and provides reliable security guarantees for the widespread application of smart devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a flow chart of a method for secure networking of intelligent devices based on dynamic keys provided by the present invention; Figure 2 The present invention provides a structure diagram of a smart device secure networking system based on dynamic keys.

[0015] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0017] The present invention is further described below in conjunction with the accompanying drawings and specific implementation methods.

[0018] Reference Figure 1 The present invention provides a method for secure networking of smart devices based on dynamic keys, comprising: Step S1: Obtain the device identification and initial key of the smart device, record the current timestamp when the smart device is started, and generate a dynamic key by combining the device identification and the initial key through a hash algorithm; Step S2: Generate a corresponding networking request based on the dynamic key, and send the dynamic key and the networking request to the corresponding gateway; Step S3: The gateway verifies the received network request and dynamic key, obtains a verification result, and sends the verification result to the smart device; Step S4: Generate a corresponding session key through the smart device according to the preset Diffie-Hellman algorithm combined with the verification result, perform encrypted communication with the gateway based on the session key, and send the corresponding encrypted data to the gateway.

[0019] Based on the above steps, the detailed process is as follows: Step S1: Each smart device has a unique device ID, which can be a device serial number, MAC address, etc. When the device is manufactured or initialized, the device ID is burned into the non-volatile memory of the device. When the device is started, the device ID is read from the memory.

[0020] The initial key is a pre-set key used to generate a dynamic key. The initial key can be preset when the device leaves the factory, or sent to the device through a secure channel. When the device starts, the initial key is read from the secure storage area.

[0021] When the device starts, get the current system time. Convert the time to a timestamp format, such as a Unix timestamp. Concatenate the device ID, initial key, and timestamp. Select a suitable hash algorithm, such as SHA-256. Use the hash algorithm to hash the concatenated string to obtain a hash value. Use the hash value as the dynamic key.

[0022] Step S2: Define the data format of the network request, including fields such as request type, device ID, and timestamp. Fill the acquired device ID and timestamp into the request. Generate a random number as the unique ID of this request. Use the dynamic key as the key to encrypt the request content.

[0023] Encapsulate the encrypted request content and dynamic key into a data packet and add necessary message headers, such as version number, data length, etc.

[0024] Get the pre-configured gateway address. Establish a network connection with the gateway, such as a TCP connection. Send the encapsulated data packet to the gateway through the established connection.

[0025] Start a timer and wait for the gateway's response. If no response is received within the timeout period, retry the request.

[0026] Step S3: The gateway monitors the designated port and receives the connection request from the smart device. The gateway receives the data packet sent by the device and extracts the network connection request and dynamic key therein.

[0027] The gateway pre-stores the device identification and initial key of all legitimate devices. Extract the device identification and timestamp from the received request. Generate a dynamic key based on the device identification, initial key and timestamp using the same method as the device. Compare the generated dynamic key with the received dynamic key.

[0028] If the dynamic key verification passes, use the key to decrypt the network request content. Check whether each field in the request is legal, such as whether the device identification matches, whether the timestamp is within the valid range, etc.

[0029] Based on the result of the verification process, a verification result data structure is generated. The result contains information such as whether the verification is passed and the cause of the error (if any). If the verification is passed, a session identifier is generated for subsequent communication.

[0030] The verification result is encrypted using a dynamic key and sent back to the smart device through the original connection.

[0031] Step S4: The device receives the verification result from the gateway. The verification result is decrypted using the dynamic key. The device checks whether the verification is passed. If not, the subsequent operation is terminated.

[0032] The device generates a large prime number p and a primitive root g. The device selects a random number as the random private key a and calculates the first public key A = g^a mod p. The device sends p, g, and A to the gateway. The gateway selects a random number b as its own random private key and calculates the second public key B. The gateway sends B to the device. The device calculates the shared key K1 = B amod p. The gateway calculates the shared key K2 = A b mod p.

[0033] Theoretically, K1 = K2, and both parties get the same session key.

[0034] The shared key K1 (or K2) generated by the Diffie-Hellman algorithm is used as the basis. Combined with the session identifier in the verification result. Use a predefined key derivation function (such as HKDF) to derive the final session key from the shared key and the session identifier. Multiple session keys can be generated for different purposes, such as encryption keys and authentication keys.

[0035] Use the generated session key to encrypt the data to be transmitted. Select an appropriate symmetric encryption algorithm, such as AES. Generate a unique initialization vector (IV) for each message. Encrypt the message content using the session key and IV. Calculate the message authentication code (MAC) to ensure message integrity.

[0036] Construct an encrypted data packet, including the encrypted message content, IV, MAC, etc. Send the encrypted data packet to the gateway through the established secure connection.

[0037] The key update mechanism is triggered periodically or after a certain amount of data is transmitted. It can re-execute the Diffie-Hellman key exchange or derive a new key using the current session key. The updated key is used for subsequent communications.

[0038] The invention provides a method for secure networking of smart devices based on dynamic keys. By combining device identification and initial keys to generate dynamic keys, the security and unpredictability of keys are improved, the risk of static keys being stolen or cracked is effectively prevented, and the security protection capability of smart devices is enhanced. A dynamic key generation mechanism based on timestamp is adopted, so that keys can change dynamically over time, adapt to the dynamic operating environment of smart devices, and improve the security and flexibility of the system. The Diffie-Hellman algorithm is used to generate session keys, and a secure key exchange and negotiation process is realized, which avoids the risk of keys being intercepted during network transmission and adapts to the resource-limited characteristics of smart devices. The dual security mechanism of gateway verification and session key generation effectively prevents access of unauthorized devices and improves the security and reliability of the entire Internet of Things system. The encrypted communication method based on session keys not only ensures the security of communication, but also reduces the computational complexity of the encryption and decryption process, and is suitable for the resource constraint characteristics of smart devices. The entire networking process takes into account the characteristics and security requirements of smart devices, realizes efficient and dynamic secure networking, effectively responds to various network attack threats, and provides reliable security guarantees for the wide application of smart devices.

[0039] In one embodiment, a device identification and an initial key of a smart device are obtained, when the smart device is started, a current timestamp is recorded, and a dynamic key is generated by combining the device identification and the initial key through a hash algorithm, including: When the smart device starts, the pre-set device identification and initial key are read from the secure storage area of ​​the device. The device identification is usually a unique string used to distinguish different smart devices; the initial key is a pre-set string of passwords used for subsequent key generation. At the same time, the current system clock is read to obtain a timestamp accurate to milliseconds. This timestamp will be used as a dynamic factor to ensure that each generated key is unique.

[0040] The device ID, initial key and current timestamp are concatenated into a string in a predefined format. The order and format of concatenation affect the final generated key, so they need to be consistent throughout the system. After concatenation, the result is a raw string containing all the necessary information.

[0041] The original string is encoded in UTF-8. UTF-8 encoding can handle characters in various languages, ensuring the versatility of the method. After encoding, the original string is converted into a byte array.

[0042] Use a pre-selected hash algorithm (such as SHA-256) to hash the encoded byte array. The choice of hash algorithm needs to consider the balance between security and computational efficiency. The result of the hash calculation is a fixed-length byte hash value.

[0043] Convert the byte hash value to a hexadecimal string representation. This step converts the binary data into a readable character form. The resulting string is called the intermediate key.

[0044] Base64 encoding is performed on the intermediate key to convert it into another character representation. The main purpose of Base64 encoding is to increase the complexity of the key while ensuring that the generated key contains only printable characters.

[0045] Extract the first 32 characters from the Base64-encoded string as the final dynamic key. 32 characters are chosen to strike a balance between security and ease of use. This length is sufficient to provide sufficient security strength while not placing excessive storage and computing burden on the device.

[0046] This embodiment greatly improves the communication security by combining the device identification, initial key and timestamp to generate a dynamic key. The introduction of the timestamp ensures that even the keys generated by the same device at different times are different, effectively preventing replay attacks. The use of UTF-8 encoding and hash algorithm to process the original information enhances the versatility and security of the method. The application of Base64 encoding ensures that the generated key contains only printable characters, improving the availability of the key. Extracting characters of a fixed length as the final key strikes a balance between security strength and device burden. The entire process does not require additional hardware support and is applicable to various types of smart devices, with strong practicality and promotion value.

[0047] In one embodiment, generating a corresponding networking request based on the dynamic key, and sending the dynamic key and the networking request to a corresponding gateway includes: The dynamic key is segmented to obtain multiple key fragments. The segmentation can be performed according to a preset segmentation rule, such as segmentation by fixed length or segmentation by specific delimiters, to increase the complexity and security of the key.

[0048] The device ID and current timestamp are filled in according to the preset networking request template to obtain the initial request. The networking request template contains a fixed format and variable parameter bits, and the device ID and timestamp are filled in the variable parameter bits to ensure the uniqueness and timeliness of the request.

[0049] Perform a hash operation on the initial request to obtain a request digest. The hash operation uses a secure hash algorithm, such as SHA-256, to convert the variable-length initial request into a fixed-length digest for subsequent key reordering.

[0050] The multiple key fragments are reordered according to the request digest to obtain a key fragment sequence. The reordering process utilizes the characteristics of the request digest, such as converting the digest value into a numerical sequence, to guide the rearrangement of the key fragments and increase the randomness of the key.

[0051] Perform an XOR operation on the key fragment sequence to obtain an obfuscated key. The XOR operation combines all key fragments into a new key, further enhancing the complexity and security of the key.

[0052] The initial request is encrypted according to the obfuscation key to obtain an encrypted network request. The encryption process uses a symmetric encryption algorithm, such as AES, to encrypt the initial request using the obfuscation key to ensure the confidentiality of the request content.

[0053] The encrypted network request is processed in blocks to obtain multiple request data blocks. Block processing divides the encrypted request into a size suitable for transmission according to the needs of network transmission, which is convenient for network transmission and processing.

[0054] According to the preset network protocol, multiple request data blocks are encapsulated to obtain network requests. The encapsulation process follows a specific network protocol, such as TCP / IP, and adds necessary protocol headers and tails to the data block to ensure the correctness of network transmission.

[0055] The network request and dynamic key are sent to the corresponding gateway through a preset secure channel. The secure channel can be a VPN or SSL / TLS encrypted channel to ensure the security of the network request and dynamic key during transmission.

[0056] This embodiment significantly increases the complexity and randomness of the key and greatly improves the security of the system by segmenting and reordering the dynamic key. The request summary is used to guide the key reordering, so that each request generates a unique obfuscated key, which effectively prevents replay attacks. By encrypting and blocking the initial request, the confidentiality and integrity of the network request during transmission are ensured. The preset network protocol encapsulation and secure channel transmission mechanism further enhance the reliability and security of data transmission. This multi-level and multi-link security measure effectively reduces the risk of network attacks on smart devices during networking, while maintaining the flexibility and adaptability of the system, and can adapt to different network environments and security requirements. Overall, this method significantly improves the security, reliability and efficiency of smart device networking.

[0057] In one embodiment, the gateway verifies the received networking request and the dynamic key, obtains a verification result, and sends the verification result to the smart device, including: After the network request and dynamic key are sent to the gateway through the smart device, a timer is started to detect whether the verification result sent by the gateway is received within the preset time period. The preset time period is set based on the estimation of network delay and processing time, usually ranging from a few seconds to tens of seconds. If the verification result is not received within the preset time period, the smart device will automatically resend the network request and dynamic key to the gateway. This retransmission mechanism ensures the reliability of communication and prevents connection failures caused by network fluctuations or data packet loss.

[0058] When the gateway receives the network request and the dynamic key, it extracts the timestamp of the network request to obtain the request timestamp. The timestamp is usually parsed from a specific field in the request message to determine the timeliness of the request.

[0059] The gateway compares the current gateway time with the request timestamp and calculates the time difference. This step is to detect the time validity of the request and prevent replay attacks. The calculation of the time difference takes into account the network transmission delay and the clock deviation that may exist between devices.

[0060] The calculated time difference is compared with the preset time threshold to obtain the time validity result. The preset time threshold is set based on the system security policy and usually ranges from a few minutes to tens of minutes. If the time difference exceeds the preset threshold, the request will be considered invalid to prevent potential security threats.

[0061] The network request is filtered and parsed according to the time validity result to obtain the request device identification and initial key. Only requests that pass the time validity check will enter the next step of processing. The parsing process extracts key information from valid requests to prepare for subsequent key generation and verification.

[0062] The gateway performs a hash operation on the parsed initial key, the requesting device ID, and the request timestamp to obtain the gateway dynamic key. The selection of the hash algorithm needs to consider security and computational efficiency, and commonly used ones include SHA-256 or SHA-3. This step reproduces the process of generating dynamic keys by smart devices on the gateway side.

[0063] The gateway compares and verifies the self-generated gateway dynamic key with the dynamic key sent by the smart device to obtain the verification result. The comparison process usually uses a secure string comparison method to prevent timing attacks. The verification result contains a success or failure status, as well as possible error codes or additional information.

[0064] This embodiment greatly enhances the complexity and randomness of the key and effectively improves the security of the system by segmenting and reordering the dynamic key and performing XOR operations on the request summary. The preset network request template and timestamp filling mechanism are adopted to ensure the uniqueness and timeliness of each request and effectively prevent replay attacks. The confidentiality of network requests and dynamic keys during transmission is guaranteed through multiple encryptions and secure channel transmission. The multiple verification mechanisms on the gateway side, including timestamp validity checks and dynamic key comparisons, effectively prevent potential security threats. The retransmission mechanism of smart devices and the timeliness check of the gateway improve the fault tolerance and communication stability of the system. The hash operation and secure string comparison method used in the whole process further enhance the system's ability to resist various network attacks.

[0065] In one embodiment, the gateway dynamic key and the dynamic key sent by the smart device are compared and verified to obtain a verification result, including: The gateway performs a hash operation on the requesting device identification, initial key, and request timestamp to obtain the first verification value. This step is intended to encrypt the key information of the device to increase security. The hash operation is a one-way encryption algorithm that can convert input data into a fixed-length output, and the probability of different inputs producing the same output is extremely low, which ensures the uniqueness and security of the verification process.

[0066] The gateway obtains its own gateway time and combines it with the first verification value for secondary hash operation to obtain the gateway dynamic key. The gateway time is introduced as a dynamic factor, so that each generated key is unique. Even if the initial information is the same, the keys generated at different times will be different, which greatly improves the security of the system and effectively prevents replay attacks.

[0067] The gateway matches the dynamic key generated by itself with the dynamic key sent by the smart device to obtain the corresponding matching result. This step is the core of the verification process. By comparing whether the two keys are consistent, the legality of the device is determined.

[0068] The gateway determines whether a match is found based on the matching results and generates the corresponding verification results. This judgment process is binary, either the match is successful or the match fails, and there is no intermediate state, which ensures the clarity of the verification results.

[0069] When the matching result indicates a match, the gateway generates a verification result of passed verification and sends it to the smart device. Passed verification means that the identity of the smart device is confirmed and subsequent communication and operation can be performed. This positive feedback will allow the device to continue to interact securely with the gateway.

[0070] When the matching result indicates a mismatch, the gateway generates a verification result of failed verification and sends it to the smart device. Failed verification indicates that there is a problem with the device identity or an abnormality occurs during the communication process, and the gateway will reject subsequent requests from the device.

[0071] This embodiment significantly improves the security of network communications by adopting a method for secure networking of smart devices based on dynamic keys. The introduction of multiple hash operations and timestamps makes each generated key unique, effectively preventing replay attacks and man-in-the-middle attacks. The generation process of the gateway dynamic key takes into account the device identification, initial key and time factors, ensuring the reliability and security of the verification process. By comparing the gateway dynamic key with the dynamic key sent by the device, fast and accurate identity authentication is achieved, effectively preventing the access of unauthorized devices. This embodiment not only improves the security of the system, but also ensures the efficiency of the verification process, and realizes fast and reliable access to smart devices.

[0072] In one embodiment, the smart device generates a corresponding session key according to a preset Diffie-Hellman algorithm combined with a verification result, performs encrypted communication with a gateway based on the session key, and sends the corresponding encrypted data to the gateway, including: The verification result is parsed by the smart device to obtain the verification status information. This step is to confirm the result of the device identity authentication and provide a basis for subsequent operations. The verification status information contains key information on whether the verification is successful, which is an important basis for deciding whether to continue secure communication.

[0073] Based on the parsed verification status information, the smart device determines whether the verification is successful. This is a critical decision point. Only when the verification is successful will the device perform the subsequent key generation and encrypted communication steps. If the verification fails, the device will immediately terminate the networking process to prevent unauthorized access.

[0074] After successful verification, the public parameters required for the Diffie-Hellman algorithm are generated through the smart device: large prime numbers and primitive roots. These parameters are the basis of the Diffie-Hellman key exchange protocol, and their selection directly affects the security of the generated key. The selection of large prime numbers needs to meet specific security requirements, and the primitive root needs to be calculated based on the selected large prime number.

[0075] A random private key is generated by the smart device, and the first public key is calculated using the private key and the previously generated public parameters. The randomness of the private key is a key factor in ensuring the security of key exchange, while the public key is an important parameter for secure communication with the gateway.

[0076] The generated large prime number, primitive root and first public key are sent to the gateway through the smart device. This step is the beginning of the Diffie-Hellman key exchange, which transmits these parameters through a secure channel and lays the foundation for subsequent key generation.

[0077] The second public key sent by the gateway is received through the smart device, and the shared key is calculated using its own random private key and the received second public key. This process is the core of the Diffie-Hellman algorithm. Through the private keys of both parties and the public keys of the other party, both parties can independently calculate the same shared key without transmitting the private key on the network.

[0078] The smart device performs a hash operation on the calculated shared key to obtain the final session key. The introduction of the hash operation increases the complexity of the key. At the same time, the hash operation can also convert the shared key of varying lengths into a fixed-length session key, which facilitates subsequent encryption operations.

[0079] After the session key is generated, the smart device sends a notification message to the gateway that the session key generation is complete, and waits to receive a confirmation message returned by the gateway.

[0080] After receiving the confirmation message from the gateway, the smart device uses the generated session key to encrypt the data to be sent to obtain encrypted data. This step converts the original data into ciphertext to ensure the security of the data during transmission.

[0081] The smart device sends the encrypted data to the gateway and receives the response data sent by the gateway after encryption using the same session key. This process realizes two-way encrypted communication and ensures the confidentiality of data transmission.

[0082] The formula for calculating the first public key is: A = g a mod p, the formula for calculating the shared key is: K = B a modp; A is the first public key, p is a large prime number, g is the primitive root, a is a random private key, K is the shared key, and B is the second public key; mod is the modulus operator, indicating the remainder operation.

[0083] In one embodiment, the public parameters of the Diffie-Hellman algorithm: large prime numbers and primitive roots are generated, including: The process of generating large prime numbers first randomly selects a large odd number within a preset range as a candidate prime number. The preset range is usually 2048 bits or larger to ensure sufficient security. After subtracting 1 from the candidate prime number, it is decomposed into the product of a power of 2 and an odd number to obtain the corresponding test cardinality set. This decomposition helps the subsequent Miller-Rabin primality test to be carried out efficiently.

[0084] Multiple test bases are randomly selected from the test base set, and the Miller-Rabin primality test is performed on each test base. The number of test bases is usually set to 20-30 to balance the accuracy and efficiency of the test. For each test base, its modular exponentiation operation on the candidate prime number is calculated, and the modular exponentiation result is used to determine whether the candidate prime number is likely to be prime. If any test fails, the candidate prime number is reselected. This iterative process ensures that the number finally selected has a high probability of primality. When all tests pass, the candidate prime number is considered to be a large prime number.

[0085] The process of generating primitive roots begins by factoring the large prime number minus 1 to obtain a set of non-repeating prime factors. This step lays the foundation for subsequent primitive root testing. The initial value of the candidate primitive root is set to 2, which is the smallest possible primitive root value.

[0086] When testing a candidate primitive root, traverse each prime factor in the prime factor set. For each prime factor, calculate a specific value, which is the result of the large prime number minus 1 divided by the current prime factor. This specific value is used for subsequent exponential operations. Calculate the exponential power of the candidate primitive root modulo the large prime number, and the exponent is the specific value calculated previously. When the calculation result is equal to 1, it means that the current candidate primitive root is not a primitive root. At this time, add 1 to the value of the current candidate primitive root and start a new test.

[0087] When all prime factors pass the test, that is, no calculation result equals 1, the current candidate primitive root is the required primitive root. This method ensures that the primitive root found satisfies the necessary mathematical properties and is suitable for the Diffie-Hellman key exchange algorithm.

[0088] The method for secure networking of smart devices based on dynamic keys in this embodiment provides a solid foundation for secure communication between smart devices by generating public parameters of the Diffie-Hellman algorithm. Large prime numbers are generated by randomly selecting large odd numbers and performing Miller-Rabin primality tests, ensuring the randomness and security of prime numbers. The primitive roots are found by prime factor decomposition and iterative testing to ensure the validity of the primitive roots. This embodiment not only improves the efficiency of key generation, but also enhances the security of the key. Through the flexible adjustment of the preset range and the number of test bases, this embodiment can strike a balance between security and efficiency to meet the needs of different application scenarios. In addition, the calculation process of this embodiment can be completed locally on the smart device, avoiding external dependence and improving the autonomy and reliability of the system.

[0089] In one embodiment, a method for secure networking of smart devices based on dynamic keys provided by the present invention further includes: According to the preset update strategy, the running time and important events are regularly analyzed to determine whether the key needs to be updated. The update strategy can be based on a time period (such as updating once every 7 days) or a specific event trigger (such as cumulative running time exceeding 100 hours). When the update conditions are met, a key update trigger signal is generated, and the networking operation steps are re-executed to generate a new dynamic key and a new session key.

[0090] The newly generated dynamic key and session key are encrypted and stored to obtain a key backup file. Encrypted storage uses a high-strength encryption algorithm, such as AES-256, to ensure the security of key information. The key backup file is stored in the secure storage area of ​​the device and can only be accessed by authorized programs.

[0091] Communicate based on the new session key and continuously monitor abnormalities during communication according to the preset security policy. Security policies include multiple dimensions such as traffic anomaly detection and protocol violation detection. When an anomaly is detected, the degree of anomaly is analyzed and the corresponding security mechanism is activated based on the analysis results. The degree of anomaly can be divided into three levels: minor, medium and severe, and corresponding security measures of different levels such as warning, temporary blocking and emergency isolation are taken.

[0092] Identify user operation requests in real time and add sensitive operations to the list of operations that require multi-factor authentication. Sensitive operations include high-risk operations such as modifying device configurations and updating firmware. When sensitive operation requests are detected, collect the multi-factor authentication data provided by the user based on the operation list and verify it. Multi-factor authentication can include passwords, biometrics, hardware tokens, and other forms. If the verification is successful, the sensitive operation request is allowed to be executed, otherwise the sensitive operation request is rejected.

[0093] When a device reset request is received, the original key information is extracted from the key backup file. The device reset may be triggered by the user or as part of the system's automatic recovery mechanism. The device is reconfigured based on the extracted key information to restore the secure connection state of the smart device. The reconfiguration process includes steps such as reinitializing the security module and rebuilding the encryption channel to ensure that the device is restored to a safe and usable state.

[0094] This embodiment significantly improves the security of the system by real-time monitoring of the device operation status and regularly updating the key, effectively preventing the security risks that may be caused by the long-term use of the same key. The use of a multi-factor authentication mechanism to strictly control sensitive operations greatly reduces the possibility of unauthorized access and misoperation, and protects the core functions and data security of the device. The dynamic key generation and encryption storage mechanism in the embodiment ensures that the secure connection state can be quickly restored even if the device is reset or attacked, thereby improving the reliability and recovery capabilities of the system. By continuously monitoring abnormal situations during the communication process and initiating corresponding security mechanisms based on the degree of abnormality, timely discovery and processing of potential threats are achieved, enhancing the overall defense capabilities of the system.

[0095] Reference Figure 2 As shown, the present invention provides a smart device secure networking system based on dynamic keys, which is applied to any of the above-mentioned smart device secure networking methods based on dynamic keys, including: The acquisition module is used to obtain the device identification and initial key of the smart device. When the smart device is started, the current timestamp is recorded, and a dynamic key is generated by combining the device identification and the initial key through a hash algorithm; An analysis module, the analysis module is used to generate a corresponding networking request based on the dynamic key, and send the dynamic key and the networking request to a corresponding gateway; An association module, the association module is used to obtain a verification result generated after the gateway receives a network connection request and a dynamic key; The processing module is used to generate a corresponding session key through the smart device according to a preset Diffie-Hellman algorithm combined with the verification result, and perform encrypted communication with the gateway based on the session key.

[0096] The invention provides a smart device secure networking system based on dynamic keys. By combining device identification and initial keys to generate dynamic keys, the security and unpredictability of keys are improved, the risk of static keys being stolen or cracked is effectively prevented, and the security protection capability of smart devices is enhanced. A dynamic key generation mechanism based on timestamp is adopted, so that keys can change dynamically over time, adapt to the dynamic operating environment of smart devices, and improve the security and flexibility of the system. The Diffie-Hellman algorithm is used to generate session keys, and a secure key exchange and negotiation process is realized, which avoids the risk of keys being intercepted during network transmission and adapts to the resource-limited characteristics of smart devices. The dual security mechanism of gateway verification and session key generation effectively prevents access to unauthorized devices and improves the security and reliability of the entire Internet of Things system. The encrypted communication method based on session keys not only ensures the security of communication, but also reduces the computational complexity of the encryption and decryption process, which is suitable for the resource constraint characteristics of smart devices. The entire networking process takes into account the characteristics and security requirements of smart devices, realizes efficient and dynamic secure networking, effectively responds to various network attack threats, and provides reliable security guarantees for the wide application of smart devices.

[0097] It should be noted that technicians in the relevant technical field can clearly understand that for the convenience and conciseness of description, the specific working process of the system and each module described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0098] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for secure networking of smart devices based on dynamic keys, characterized in that: include: Obtaining a device identification and an initial key of a smart device, recording a current timestamp when the smart device is started, and generating a dynamic key by combining the device identification and the initial key through a hash algorithm; Generate a corresponding networking request based on the dynamic key, and send the dynamic key and the networking request to a corresponding gateway; Verifying the received networking request and the dynamic key through the gateway to obtain a verification result, and sending the verification result to the smart device; The smart device generates a corresponding session key according to a preset Diffie-Hellman algorithm in combination with the verification result, performs encrypted communication with the gateway based on the session key, and sends the corresponding encrypted data to the gateway.

2. The method for secure networking of smart devices based on dynamic keys according to claim 1, characterized in that: The step of obtaining a device identification and an initial key of the smart device, recording a current timestamp when the smart device is started, and generating a dynamic key by combining the device identification and the initial key through a hash algorithm includes: Reading a device identification and an initial key preset by the smart device, and recording a system clock of the smart device to obtain the current timestamp; Concatenate the device identifier, the initial key and the current timestamp to obtain an original string; Perform UTF-8 encoding on the original string to obtain an encoded byte array; Performing hash calculation on the byte array using the hash algorithm to obtain a byte hash value; Convert the byte hash value into a hexadecimal string to obtain an intermediate key; Perform Base64 encoding on the intermediate key to obtain an encoded string; The first 32 characters in the encoded string are extracted to obtain the dynamic key.

3. The method for secure networking of smart devices based on dynamic keys according to claim 1, characterized in that: The generating a corresponding networking request based on the dynamic key, and sending the dynamic key and the networking request to a corresponding gateway, comprises: Segmenting the dynamic key to obtain multiple key fragments; Filling the device identification and the current timestamp according to a preset networking request template to obtain an initial request; Performing a hash operation on the initial request to obtain a request digest; reordering the plurality of key fragments according to the request digest to obtain a key fragment sequence; Performing an XOR operation on the key fragment sequence to obtain an obfuscated key; Encrypting the initial request according to the obfuscation key to obtain an encrypted networking request; Processing the encrypted networking request in blocks to obtain multiple request data blocks; Encapsulating the multiple request data blocks according to a preset network protocol to obtain the networking request; The networking request and the dynamic key are sent to the corresponding gateway through a preset secure channel.

4. The method for secure networking of smart devices based on dynamic keys according to claim 1, characterized in that: The step of verifying the received networking request and the dynamic key through the gateway to obtain a verification result, and sending the verification result to the smart device includes: After sending the network connection request and the dynamic key to the gateway through the smart device, detecting whether the verification result sent by the gateway is received within a preset time period, and when the verification result is not received within the preset time period, resending the network connection request and the dynamic key to the gateway; The step of verifying the received networking request and the dynamic key through the gateway to obtain a verification result includes: When the gateway receives the networking request and the dynamic key, it extracts the timestamp of the networking request to obtain the request timestamp; Compare the current gateway time with the request timestamp to obtain a time difference; Comparing the time difference with a preset time threshold to obtain a time validity result; Screening and parsing the networking request according to the time validity result to obtain a requesting device identifier and the initial key; Performing a hash operation on the initial key, the requesting device identifier and the requesting timestamp to obtain a gateway dynamic key; The gateway dynamic key and the dynamic key sent by the smart device are compared and verified to obtain the verification result.

5. The method for secure networking of smart devices based on dynamic keys according to claim 4, characterized in that: The comparing and verifying the gateway dynamic key and the dynamic key sent by the smart device to obtain the verification result includes: Performing a hash operation on the requesting device identifier, the initial key and the request timestamp by the gateway to obtain a first verification value; Obtaining the gateway time of the gateway, and performing a secondary hash operation on the gateway time in combination with the first verification value to obtain a gateway dynamic key; Matching the gateway dynamic key with the dynamic key sent by the smart device to obtain a corresponding matching result, Determine whether the matching result matches, and generate a corresponding verification result; When the matching result indicates a match, generating a verification result of passing the verification and sending it to the smart device; When the matching result indicates a mismatch, a verification result indicating that the verification failed is generated and sent to the smart device.

6. The method for secure networking of smart devices based on dynamic keys according to claim 1, characterized in that: The smart device generates a corresponding session key according to a preset Diffie-Hellman algorithm in combination with the verification result, performs encrypted communication with the gateway based on the session key, and sends the corresponding encrypted data to the gateway, including: Parsing the verification result to obtain verification status information; Determine whether the verification is successful according to the verification status information, and execute subsequent steps when the verification is successful, otherwise terminate the networking process; Generate public parameters for the Diffie-Hellman algorithm: large prime numbers and primitive roots; Generate a random private key through the smart device and calculate a first public key; Sending the large prime number, the primitive root and the first public key to the gateway; Receive a second public key sent by the gateway, and calculate a shared key using the random private key and the second public key; Performing a hash operation on the shared key to obtain the session key; Sending a notification message of completion of session key generation to the gateway, and receiving a confirmation message returned by the gateway to establish encrypted communication; Encrypting the data to be sent based on the session key to obtain encrypted data; Sending the encrypted data to the gateway, and receiving response data sent by the gateway encrypted according to the session key; Decrypting the received response data using the session key to obtain decrypted response data; The formula for calculating the first public key is: A = g a mod p, the formula for calculating the shared key is: K = B a mod p; A is the first public key, p is a large prime number, g is the primitive root, a is a random private key, K is the shared key, and B is the second public key; mod is the modulus operator, which means remainder operation.

7. The method for secure networking of smart devices based on dynamic keys according to claim 6, characterized in that: The public parameters of the Diffie-Hellman algorithm are generated: large prime numbers and primitive roots, including: The steps to generate large prime numbers include: A large odd number is randomly selected within a preset range as a candidate prime number, and after subtracting 1 from the candidate prime number, the result is decomposed into the product of a power of 2 and an odd number to obtain a corresponding test cardinality set; A plurality of test bases are randomly selected from the test base set, and a Miller-Rabin primality test is performed on each of the test bases: Calculate the power module operation of the test base on the candidate prime number, and determine whether the candidate prime number is likely to be a prime number according to the power module operation result, and reselect the candidate prime number when any test fails; When all tests are passed, the candidate prime number is considered to be the large prime number; The steps of generating the primitive root include: Subtract 1 from the large prime number and then perform prime factorization to obtain a non-repeating set of prime factors; Set the initial value of the candidate primitive root to 2; Testing the candidate primitive roots: Perform the following steps on each prime factor in the prime factor set: Calculate a specific value, where the specific value is obtained by subtracting 1 from the large prime number and dividing it by the current prime factor; Calculate the exponential power of the candidate primitive root modulo the large prime number, where the exponent is the specific value; When the calculation result is equal to 1, it means that the current candidate primitive root is not the primitive root, the value of the current candidate primitive root is increased by 1, and a new test is started again; When all prime factors pass the test, that is, there is no situation where the calculation result is equal to 1, then the current candidate primitive root is the primitive root.

8. The method for secure networking of smart devices based on dynamic keys according to claim 1, characterized in that: The method also includes: Monitor the operating status of the smart device in real time and record the operating time and important events; Regularly analyzing the operation time and the important events according to a preset update strategy, and determining whether the key needs to be updated; When the update conditions are met, a key update trigger signal is generated, and the steps of the networking operation are re-executed to generate a new dynamic key and a new session key; Encrypting and storing the new dynamic key and the new session key to obtain a key backup file; Communicate according to the new session key and continuously monitor abnormal conditions during the communication process according to a preset security policy; When an anomaly is detected, the degree of the anomaly is analyzed and the corresponding safety mechanism is activated based on the analysis results; Identify the user's operation request in real time and add sensitive operations to the list of operations that require multi-factor authentication; When a sensitive operation request is detected, the multi-factor authentication data provided by the user is collected according to the operation list and verified; If the verification is successful, the sensitive operation request is allowed to be executed; otherwise, the sensitive operation request is rejected; When receiving a request for device reset, extracting original key information from the key backup file; The device is reconfigured according to the key information to restore the secure connection state of the smart device.

9. A smart device secure networking system based on dynamic keys, characterized in that: The method for secure networking of smart devices based on dynamic keys applied to any one of claims 1 to 8, comprising: A collection module, the collection module is used to obtain the device identification and initial key of the smart device, when the smart device is started, record the current timestamp, and generate a dynamic key by combining the device identification and the initial key through a hash algorithm; An analysis module, the analysis module is used to generate a corresponding networking request based on the dynamic key, and send the dynamic key and the networking request to a corresponding gateway; An association module, the association module is used to obtain a verification result generated by the gateway after receiving the networking request and the dynamic key; A processing module, wherein the processing module is used to generate a corresponding session key through the smart device according to a preset Diffie-Hellman algorithm combined with the verification result, and to perform encrypted communication with the gateway based on the session key.

Images