Security authentication method and system for Internet of Things

Abstract

The invention provides an Internet of Things security authentication method and system, the security authentication system comprises an Internet of Things server, a plurality of network connection clusters and a plurality of terminal devices, the Internet of Things server is connected with the plurality of network connection clusters, the network connection clusters are connected with the plurality of terminal devices, the Internet of Things server comprises an authentication database, and the authentication database is connected with the plurality of terminal devices. The identification code of the terminal device is taken as an index in the authentication database, the device state and authentication data corresponding to the terminal device are stored, the authentication data is provided with a reading password, the network connection cluster comprises a verification management device and a plurality of signal transmission devices, and the verification management device is respectively connected with the plurality of signal transmission devices. According to the invention, the authentication information is constructed according to the characteristics of the terminal device and the environment information of the terminal device, and dual authentication is carried out by reading the password and the authentication data, so that the security and reliability of security authentication are improved from multiple dimensions.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a security authentication method and system for Internet of Things. Background Art

[0002] With the large-scale development of the Internet of Things, the phenomenon of impersonation and malicious attacks on IoT terminals has become increasingly serious. The security authentication between the device modules and servers provided by some manufacturers is insufficient, or even there is no security authentication between the modules and servers, and data is directly transmitted in plain text, resulting in increasingly prominent security issues for IoT terminals. IoT terminal security issues are mostly focused on IoT terminal access security. Therefore, people are very concerned about the security authentication of the terminal identity when the terminal is accessed. However, the existing security authentication mostly uses artificially defined secret keys, which are weakly related to the characteristics of the IoT terminal itself, are easy to be stolen or imitated, and have poor security. Summary of the invention

[0003] In order to solve the technical problem that the secret key of security authentication in the prior art is easily stolen or imitated and has poor security, the security authentication system proposed by the present invention includes an Internet of Things server, multiple network connection clusters and multiple terminal devices, wherein the Internet of Things server is respectively connected to the multiple network connection clusters, and the network connection clusters are connected to the multiple terminal devices;

[0004] The Internet of Things server includes an authentication database, in which the identification code of the terminal device is used as an index to store the device status and authentication data corresponding to the terminal device, and the authentication data is provided with a reading password;

[0005] The network connection cluster includes a verification management device and a plurality of signal transmission devices, and the verification management device is respectively connected to the plurality of signal transmission devices.

[0006] Furthermore, the device status includes an internship period and a regularization period, the authentication data is composed of environmental noise intensity data 1 + processor model of the terminal device + environmental noise intensity data 2 + processor main frequency of the terminal device + environmental noise intensity data 3 + production date of the terminal device + environmental noise intensity data 4, and the reading password is composed of the processor model of the terminal device + production date of the terminal device.

[0007] Furthermore, after the terminal device is connected to the Internet of Things for the first time, it is in the internship period and the authentication data is empty. The Internet of Things server saves the audio signal of the surrounding environment uploaded by the terminal device during authentication. The Internet of Things server counts the number of business information uploaded by the terminal device that can run safely. When the number of business information exceeds the set threshold, the authentication data is calculated, the corresponding reading password is set, and the device status is changed from the internship period to the regular period.

[0008] Furthermore, the calculation process of the authentication data is to obtain audio signals of multiple surrounding environments corresponding to the terminal device, calculate the average intensity of each data sampling point in the audio signal, obtain the average audio signal, divide the average audio signal into four parts according to the time length, calculate the average intensity of each part, and obtain environmental noise intensity data 1 to environmental noise intensity data 4, and construct the authentication data in combination with the processor model, processor main frequency and production date of the terminal device.

[0009] Furthermore, the verification management device includes an identity authentication module and a signal forwarding module, and the identity authentication module is connected to the signal forwarding module.

[0010] Furthermore, a transmission mapping table is provided inside the signal forwarding module, and the transmission mapping table includes multiple pairing information. The format of each pairing information is the identification code of the terminal device + the interval code + the number of the signal transmission device. The existence time of each pairing information is set, and the pairing information that exceeds the existence time will be automatically deleted.

[0011] Furthermore, the signal transmission device includes a signal receiving module, a first switch module, a second switch module, a signal verification module, a service verification module and a signal output module, the signal receiving module is connected to the signal verification module, the signal verification module is connected to the service verification module via the first switch module, the signal verification module is connected to the signal output module via the second switch module, and the service verification module is connected to the signal output module.

[0012] Furthermore, the signal transmission device has two working modes, namely, a normal transmission mode and a secure transmission mode. In the normal transmission mode, the first switch module is turned off, the second switch module is turned on, and the service information sent by the terminal device passes through the signal verification module. In the secure transmission mode, the first switch module is turned on, the second switch module is turned off, and the service information sent by the terminal device passes through the signal verification module and the service verification module in turn.

[0013] Furthermore, in the initial state, half of the signal transmission devices in the network connection cluster are in normal transmission mode, and half are in secure transmission mode. During the operation of the security authentication system, the identity authentication module determines the load status of each signal transmission device based on the transmission mapping table, dynamically adjusts the working mode of the signal transmission device, and performs load balancing.

[0014] Based on the above-mentioned security authentication system of the Internet of Things, the security authentication method of the Internet of Things proposed by the present invention specifically includes the following steps:

[0015] S1. The terminal device sends the verification information and business information to the verification management device by encrypted transmission, and the identity authentication module sends the identification code, processor model and production date of the terminal device, as well as the audio signal of the surrounding environment of the terminal device to the Internet of Things server;

[0016] S2, the IoT server determines whether there is an identification code of the terminal device in the authentication database. If the identification code of the terminal device exists in the authentication database, the process proceeds to S3. If the identification code of the terminal device does not exist in the authentication database, the identification code of the terminal device is used as an index in the authentication database to create a device state and authentication data, set the device state to the internship period, set the authentication data to empty, and proceed to S5.

[0017] S3, the IoT server uses the terminal device's identification code as an index to obtain the corresponding device status. If the device status is in the regularization period, it proceeds to S4; if the device status is in the internship period, it proceeds to S5;

[0018] S4. Construct a read password according to the processor model and production date of the terminal device, and read the authentication data by reading the password. If the reading fails, end the security authentication. If the reading succeeds, obtain environmental noise intensity data 1 to environmental noise intensity data 4 from the authentication data according to the processor model, processor main frequency and production date of the terminal device, divide the audio signal of the environment around the terminal device into four parts according to the time length, calculate the average intensity of each part, and compare it with environmental noise intensity data 1 to environmental noise intensity data 4 respectively, calculate the corresponding error percentage, if the error percentage of at least three parts is less than the error threshold, query whether there is a corresponding signal transmission device in the transmission mapping table, if not, assign the terminal device to the signal transmission device in the normal transmission mode, verify that the management device transmits the business information to the corresponding signal transmission device, and end the security authentication. Otherwise, end the security authentication.

[0019] S5. Save the audio signal of the terminal device's surrounding environment for constructing authentication data, query whether there is a corresponding signal transmission device in the transmission mapping table, if not, assign the terminal device to the signal transmission device in secure transmission mode, verify that the management device transmits the business information to the corresponding signal transmission device, and end the security authentication.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] Authentication information is constructed based on the characteristics of the terminal device itself and the environmental information of the terminal device. Double authentication is performed by reading passwords and authentication data, thereby improving the security and reliability of security authentication from multiple dimensions. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1It is a structural schematic diagram of the security authentication system of the present invention;

[0023] Figure 2 It is a structural diagram of the verification management device of the present invention;

[0024] Figure 3 It is a structural schematic diagram of the signal transmission device of the present invention. DETAILED DESCRIPTION

[0025] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0026] like Figure 1 As shown, the security authentication system of the Internet of Things proposed by the present invention includes an Internet of Things server, multiple network connection clusters and multiple terminal devices. The Internet of Things server is connected to the multiple network connection clusters respectively, and the network connection clusters are connected to the multiple terminal devices.

[0027] The Internet of Things server includes an authentication database. The authentication database uses the identification code of the terminal device as an index to store the device status and authentication data corresponding to the terminal device. The device status includes an internship period and a regularization period. The authentication data is composed of environmental noise intensity data 1 + processor model of the terminal device + environmental noise intensity data 2 + processor main frequency of the terminal device + environmental noise intensity data 3 + production date of the terminal device + environmental noise intensity data 4. The authentication data is set with a read password, and the read password is composed of the processor model of the terminal device + production date of the terminal device. After the terminal device is connected to the Internet of Things for the first time, it is in the internship period, and the authentication data is empty. The Internet of Things server saves the audio signal of the surrounding environment uploaded by the terminal device during authentication. The Internet of Things server counts the number of business information uploaded by the terminal device that can run safely. When the number of business information exceeds the set threshold, the authentication data is calculated, the corresponding read password is set, and the device status is changed from the internship period to the regularization period. The calculation process of the authentication data is to obtain audio signals of multiple surrounding environments corresponding to the terminal device, calculate the average intensity of each data sampling point in the audio signal, obtain the average audio signal, divide the average audio signal into four parts according to the time length, calculate the average intensity of each part, and obtain environmental noise intensity data 1 to environmental noise intensity data 4, and construct the authentication data in combination with the processor model, processor main frequency and production date of the terminal device.

[0028] The network connection cluster includes a verification management device and a plurality of signal transmission devices, and the verification management device is respectively connected to the plurality of signal transmission devices.

[0029] like Figure 2As shown, the verification management device includes an identity authentication module and a signal forwarding module, and the identity authentication module is connected to the signal forwarding module. The identity authentication module performs identity authentication according to the verification information sent by the terminal device, and the verification information includes the identification code, processor model, processor main frequency and production date of the terminal device, and an audio signal of a set time length (for example, 20 seconds) of the surrounding environment of the terminal device. A transmission mapping table is set inside the signal forwarding module, and the transmission mapping table is used to pair the terminal device and the signal transmission device, and transmit the service information of the terminal device to the corresponding signal transmission device. The transmission mapping table includes multiple pairing information, and the format of each pairing information is the identification code of the terminal device + interval code + signal transmission device number. In order to save space in the transmission mapping table, the existence time of each pairing information is set (for example, 7 days), and the pairing information that exceeds the existence time will be automatically deleted.

[0030] like Figure 3As shown, the signal transmission device includes a signal receiving module, a first switch module, a second switch module, a signal verification module, a service verification module and a signal output module. The signal receiving module is connected to the signal verification module, the signal verification module is connected to the service verification module through the first switch module, the signal verification module is connected to the signal output module through the second switch module, and the service verification module is connected to the signal output module. The signal transmission device has two working modes, namely, a normal transmission mode and a safe transmission mode. In the normal transmission mode, the first switch module is turned off, the second switch module is turned on, and the service information sent by the terminal device passes through the signal verification module. In the safe transmission mode, the first switch module is turned on, the second switch module is turned off, and the service information sent by the terminal device passes through the signal verification module and the service verification module in sequence. The signal verification module is used to verify whether there are any errors in the information transmission process. Specifically, the check code in the business information is extracted, and the MD5 algorithm is used to calculate the data in the business information except the check code (the terminal device also uses the MD5 algorithm to calculate the check code when generating business information) to obtain the comparison code. The comparison code and the check code are compared. If the two are the same, it means that there is no error in the business information transmission process, and the business information is transmitted backward. Otherwise, the business information is intercepted and no longer transmitted backward. The business verification module is used to verify the business security in the business information. Specifically, the keyword sentences in the business information are extracted, and the principal component analysis PCA algorithm is used to extract features from the keyword sentences. The security of the business is obtained based on the sensitive words in the features. The business information that meets the security requirements is transmitted backward, and the business information that does not meet the security requirements is intercepted and no longer transmitted backward. The signal output module transmits the verified business information to the Internet of Things server. In the initial state, half of the signal transmission devices in the network connection cluster are in normal transmission mode, and the other half are in secure transmission mode. During the operation of the security authentication system, the identity authentication module determines the load status of each signal transmission device based on the transmission mapping table, dynamically adjusts the working mode of the signal transmission device, and performs load balancing.

[0031] Based on the above security authentication system, the security authentication method of the Internet of Things specifically includes the following steps:

[0032] S1. The terminal device sends the verification information and business information to the verification management device through encrypted transmission. The identity authentication module sends the identification code, processor model and production date of the terminal device, as well as the audio signal of the terminal device's surrounding environment to the IoT server.

[0033] S2. The IoT server determines whether the identification code of the terminal device exists in the authentication database. If the identification code of the terminal device exists in the authentication database, the process proceeds to S3. If the identification code of the terminal device does not exist in the authentication database, the identification code of the terminal device is used as an index in the authentication database to create device status and authentication data, set the device status to the internship period, set the authentication data to empty, and proceed to S5.

[0034] S3. The IoT server uses the identification code of the terminal device as an index to obtain the corresponding device status. If the device status is in the regularization period, it proceeds to S4. If the device status is in the internship period, it proceeds to S5.

[0035] S4. Construct a read password according to the processor model and production date of the terminal device, and read the authentication data by reading the password. If the reading fails, it indicates that the authentication has failed, and the security authentication is terminated. If the reading is successful, obtain environmental noise intensity data 1 to environmental noise intensity data 4 from the authentication data according to the processor model, processor main frequency and production date of the terminal device, divide the audio signal of the environment around the terminal device into four parts according to the time length, calculate the average intensity of each part, and compare it with environmental noise intensity data 1 to environmental noise intensity data 4 respectively, calculate the corresponding error percentage, if the error percentage of at least three parts is less than the error threshold, it indicates that the authentication is successful, query whether there is a corresponding signal transmission device in the transmission mapping table, if not, assign the terminal device to the signal transmission device in the normal transmission mode, verify that the management device transmits the business information to the corresponding signal transmission device, and end the security authentication. Otherwise, it indicates that the authentication has failed, and the security authentication is ended.

[0036] S5. Save the audio signal of the terminal device's surrounding environment for constructing authentication data, query whether there is a corresponding signal transmission device in the transmission mapping table, if not, assign the terminal device to the signal transmission device in secure transmission mode, verify that the management device transmits the business information to the corresponding signal transmission device, and end the security authentication.

[0037] The above disclosure is only the preferred embodiment of the present invention, and certainly cannot be used to limit the scope of the present invention. It should be pointed out that for those skilled in the art, any equivalent changes made to the scheme of the present invention without departing from the design structure and principle of the present invention are considered to be within the protection scope of the present invention.

Claims

1. A security authentication system for the Internet of Things, characterized in that ,The security authentication system includes an Internet of Things server, a plurality of network connection clusters and a plurality of terminal devices, the Internet of Things server is respectively connected to a plurality of network connection clusters, and the network connection clusters are connected to a plurality of terminal devices; The Internet of Things server includes an authentication database, in which the identification code of the terminal device is used as an index to store the device status and authentication data corresponding to the terminal device, and the authentication data is provided with a reading password; The network connection cluster includes a verification management device and a plurality of signal transmission devices, and the verification management device is respectively connected to the plurality of signal transmission devices.

2. The security authentication system according to claim 1, characterized in that: The device status includes an internship period and a regularization period. The authentication data is composed of environmental noise intensity data 1 + processor model of the terminal device + environmental noise intensity data 2 + processor main frequency of the terminal device + environmental noise intensity data 3 + production date of the terminal device + environmental noise intensity data 4. The reading password is composed of the processor model of the terminal device + production date of the terminal device.

3. The security authentication system according to claim 2, characterized in that: After the terminal device is connected to the Internet of Things for the first time, it is in the internship period and the authentication data is empty. The Internet of Things server saves the audio signal of the surrounding environment uploaded by the terminal device during authentication. The Internet of Things server counts the number of business information uploaded by the terminal device that can run safely. When the number of business information exceeds the set threshold, the authentication data is calculated, the corresponding reading password is set, and the device status is changed from the internship period to the regular period.

4. The security authentication system according to claim 3, characterized in that: The calculation process of the authentication data is to obtain audio signals of multiple surrounding environments corresponding to the terminal device, calculate the average intensity of each data sampling point in the audio signal, obtain the average audio signal, divide the average audio signal into four parts according to the time length, calculate the average intensity of each part, and obtain environmental noise intensity data 1 to environmental noise intensity data 4, and construct the authentication data in combination with the processor model, processor main frequency and production date of the terminal device.

5. The security authentication system according to claim 2, characterized in that: The verification management device comprises an identity authentication module and a signal forwarding module, and the identity authentication module is connected to the signal forwarding module.

6. The security authentication system according to claim 5, characterized in that: A transmission mapping table is provided inside the signal forwarding module, and the transmission mapping table includes multiple pairing information. The format of each pairing information is the identification code of the terminal device + the interval code + the number of the signal transmission device. The existence time of each pairing information is set, and the pairing information that exceeds the existence time will be automatically deleted.

7. The security authentication system according to claim 6, characterized in that: The signal transmission device includes a signal receiving module, a first switch module, a second switch module, a signal verification module, a service verification module and a signal output module. The signal receiving module is connected to the signal verification module, the signal verification module is connected to the service verification module via the first switch module, the signal verification module is connected to the signal output module via the second switch module, and the service verification module is connected to the signal output module.

8. The security authentication system according to claim 7, characterized in that: The signal transmission device has two working modes, namely, normal transmission mode and secure transmission mode. In the normal transmission mode, the first switch module is turned off, the second switch module is turned on, and the service information sent by the terminal device passes through the signal verification module. In the secure transmission mode, the first switch module is turned on, the second switch module is turned off, and the service information sent by the terminal device passes through the signal verification module and the service verification module in turn.

9. The security authentication system according to claim 8, characterized in that: In the initial state, half of the signal transmission devices in the network connection cluster are in normal transmission mode, and the other half are in secure transmission mode. During the operation of the security authentication system, the identity authentication module determines the load status of each signal transmission device based on the transmission mapping table, dynamically adjusts the working mode of the signal transmission device, and performs load balancing.

10. A security authentication method for the Internet of Things, based on the security authentication system for the Internet of Things as claimed in claim 8, characterized in that: The security authentication method specifically comprises the following steps: S1. The terminal device sends the verification information and business information to the verification management device by encrypted transmission, and the identity authentication module sends the identification code, processor model and production date of the terminal device, as well as the audio signal of the surrounding environment of the terminal device to the Internet of Things server; S2, the IoT server determines whether there is an identification code of the terminal device in the authentication database. If the identification code of the terminal device exists in the authentication database, the process proceeds to S3. If the identification code of the terminal device does not exist in the authentication database, the identification code of the terminal device is used as an index in the authentication database to create a device state and authentication data, set the device state to the internship period, set the authentication data to empty, and proceed to S5. S3, the IoT server uses the terminal device's identification code as an index to obtain the corresponding device status. If the device status is in the regularization period, it proceeds to S4; if the device status is in the internship period, it proceeds to S5; S4. Construct a read password according to the processor model and production date of the terminal device, and read the authentication data by reading the password. If the reading fails, end the security authentication. If the reading succeeds, obtain environmental noise intensity data 1 to environmental noise intensity data 4 from the authentication data according to the processor model, processor main frequency and production date of the terminal device, divide the audio signal of the environment around the terminal device into four parts according to the time length, calculate the average intensity of each part, and compare it with environmental noise intensity data 1 to environmental noise intensity data 4 respectively, calculate the corresponding error percentage, if the error percentage of at least three parts is less than the error threshold, query whether there is a corresponding signal transmission device in the transmission mapping table, if not, assign the terminal device to the signal transmission device in the normal transmission mode, verify that the management device transmits the business information to the corresponding signal transmission device, and end the security authentication. Otherwise, end the security authentication. S5. Save the audio signal of the terminal device's surrounding environment for constructing authentication data, query whether there is a corresponding signal transmission device in the transmission mapping table, if not, assign the terminal device to the signal transmission device in secure transmission mode, verify that the management device transmits the business information to the corresponding signal transmission device, and end the security authentication.

Images