Lightweight identity authentication and confidential communication method based on Internet of Things security

Abstract

The present invention discloses a lightweight identity authentication and confidential communication method based on Internet of Things security, which relates to the field of Internet of Things technology and includes the following steps: Step 1: Smart devices and users register with a security service provider and assign security parameters; Step 2: When the smart device or user, as the requesting party, requests a service, a request message is calculated based on the security parameters and sent to the receiving party's smart device; Step 3: The receiving party verifies the request message and generates an authentication response based on the security parameters and feeds it back to the requesting party; Step 4: After receiving the authentication response, the requesting party generates session information and sends it to the receiving party; Step 5: The receiving party decrypts and verifies the session information to complete key negotiation. The present invention is used to ensure user privacy data, user access security, and the normal operation of devices, thereby improving the security of the Internet of Things and reducing Internet of Things communication and computing costs.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and more particularly to a lightweight identity authentication and confidential communication method based on Internet of Things security. Background Art

[0002] With the emergence and development of the Internet of Things (IoT), the underlying technologies—including IoT, network communications, cloud computing, and human-computer interaction—are becoming increasingly powerful. IoT devices and applications are now widely used in our daily lives and work. However, this comes with numerous security issues that impact every aspect of life, potentially leading to information leaks, property damage, and even serious threats to human life.

[0003] Therefore, how to improve the security of the entire link of the Internet of Things system is an urgent problem that technical personnel in this field need to solve. Summary of the Invention

[0004] In view of this, the present invention provides a lightweight identity authentication and confidential communication method based on the security of the Internet of Things. It implements a lightweight session process and completes identity authentication and key negotiation through symmetric encryption, message authentication code, hash function, etc., reduces communication costs while ensuring security performance, and adds a timestamp to prevent replay attacks. The present invention is used to ensure user privacy data, user access security, normal operation of equipment, etc., improve the security of the Internet of Things, and reduce the communication and computing costs of the Internet of Things.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] A lightweight identity authentication and confidential communication method based on IoT security includes the following steps:

[0007] Step 1: Smart devices and users register with a security service provider and assign security parameters.

[0008] Step 2: When a smart device or user requests a service as the requester, the request message is calculated based on the security parameters and sent to the recipient's smart device;

[0009] Step 3: The receiver verifies the request message and generates an authentication response based on the security parameters and feeds it back to the requester.

[0010] Step 4: After receiving the authentication response, the requester generates session information and sends it to the recipient;

[0011] Step 5: The receiver decrypts and verifies the session information to complete key negotiation.

[0012] Preferably, the specific implementation process of step 1 is:

[0013] Step 11: Smart device D or user U acts as a communication node and submits a registration request to the security service provider ISP through the gateway GW after initialization;

[0014] Step 12: The security service provider ISP assigns a node identity to the communication node based on the registration request (device serial number or user serial number, nature, etc.) , and the node identity and the gateway identity of the gateway GW where the communication node is located , private key Return the security parameters to the communication node through the secure channel and store the security parameters in the node memory;

[0015] Step 13: The security service provider ISP sends the gateway identity of the gateway GW , private key and node identity Store to the gateway memory.

[0016] Preferably, the implementation process of calculating the request message in step 2 is:

[0017] Step 21: The requester selects a one-time random number , determine the identity of the receiving node , and get the current sending timestamp ;

[0018] Step 22: Utilize the stored requester node identity , private key and the recipient node identity Calculate authentication message , h represents the hash function; Represents the concatenation of strings;

[0019] Step 23: Based on the authentication message and gateway identity Calculate the request authentication code , MAC represents the message authentication code;

[0020] Step 24: Based on the request authentication code C and the identity of the requesting node , receiving node identity , current sending timestamp and random number generation request message .

[0021] Preferably, the specific process of step 3 is:

[0022] Step 31: The receiver sends the timestamp according to the current request message Calculate the time difference with the current receiving timestamp T ,if , If it is an arbitrarily small positive number, the current receiving timestamp T is determined to be within the trustworthy range, and the process goes to step 32; otherwise, the receiving party ends the session;

[0023] Step 32: Based on the stored private key and the requesting node identity in the request message , receiving node identity Calculate verification message ;

[0024] Step 33: Calculate the verification code based on the verification message ;

[0025] Step 34: Verify the authentication code Compare and verify with the request authentication code C in the request message. If they are consistent, proceed to step 35; otherwise, the recipient ends the session;

[0026] Step 35: The receiver selects a secret random number b and obtains the current response timestamp , and based on the stored private key Encrypt and calculate the response message , Indicates using private key An encryption function that serves as a key;

[0027] Step 36: Based on the secret random number b and the random number in the request message 、Request authentication code C to calculate response authentication code , HMAC represents a message authentication code based on a hash function;

[0028] Step 37: Response authentication code , response message and the current response timestamp Generate Authentication Response { } and feedback to the requester.

[0029] Preferably, the specific process of step 4 is:

[0030] Step 41: The requester uses the current response timestamp in the authentication response Calculate the time difference with the current receiving timestamp T ,if If it is established, the current receiving timestamp T is determined to be within the trustworthy range, and the process goes to step 42; otherwise, the requesting party terminates the session;

[0031] Step 42: The requester uses the stored private key Decrypt the response message in the authentication response , get the identity of the responding receiver node , secret random number b, response random number and response timestamp , and respond to the recipient node identity , response random number , response timestamp The receiver node identity determined in step 21 , random numbers , the current response timestamp in the authentication response Compare them, if they are consistent, go to step 43; otherwise, the requesting party terminates the session;

[0032] Step 43: The requester determines the recipient node identity in step 21. and the chosen random number , the stored requester node identity , the authentication message calculated in step 22 , the decrypted secret random number b and the current response timestamp Calculate and compare authentication codes , HMAC represents a message authentication code based on a hash function, and is compared with the response authentication code in the authentication response. If they are consistent, the process proceeds to step 44; otherwise, the requesting party terminates the session;

[0033] Step 44: Based on the current session timestamp Calculate the session key , and use the private key Encrypt the session key to obtain the session key ciphertext ;

[0034] Step 45: Based on the current session timestamp and the session key ciphertext Generate session information { } and sent to the recipient.

[0035] Preferably, the specific process of step 5 is:

[0036] Step 51: The receiver uses the current session timestamp in the session information Calculate the time difference with the current receiving timestamp T ,if If it is established, the current receiving timestamp T is determined to be within the trustworthy range, and the process goes to step 52; otherwise, the receiving party terminates the session;

[0037] Step 52: The receiver uses the stored private key Encrypt the session key in the session information Decrypt and obtain the decryption session key , decrypt random number and decrypted session timestamp , and compare the decrypted random numbers respectively , decrypted session timestamp The secret random number b selected by the receiver in step 35 and the current session timestamp when the session information is received Are they consistent? If they are consistent, then go to step 53; otherwise, the receiving party terminates the session;

[0038] Step 53: The receiver responds based on the current timestamp , Step 32-Step 34 Verify the authentication message with the requester Consistent validation messages , the requesting node identity obtained based on the request message and the recipient node identity , the selected secret random number b, the current session timestamp Calculate the session key and decrypt the session key with A comparison is performed for authentication. If they are consistent, key negotiation succeeds; otherwise, key negotiation fails.

[0039] Compared with the prior art, the above-mentioned technical solution discloses a lightweight identity authentication and confidential communication method based on the security of the Internet of Things. By analyzing the authentication schemes and key negotiation protocols of smart homes, smart terminals and other systems, a lightweight authentication and key negotiation scheme based on the security of the Internet of Things is proposed to realize the communication process between devices or between users and devices without going through a gateway, thereby realizing high communication security and low communication computing cost in the Internet of Things system. The method of the present invention includes three parties: smart devices, users, and security service providers. After the users and smart devices register with the security service provider, identity authentication and key negotiation are performed, which ultimately realizes information transmission and various instruction operation behaviors between devices and users and devices, avoiding the frequent use of gateways in the Internet of Things scenario, and realizing lightweight authentication and key negotiation adapted to the smart terminal devices of the Internet of Things. The present invention can be widely used in scenarios such as smart terminals, smart homes, smart industrial control, Internet of Vehicles, smart transportation, smart logistics, smart agriculture and the like in the field of the Internet of Things. The beneficial effects of the present invention specifically include:

[0040] 1. High security:

[0041] (1) Anti-masquerade attack: Only legitimate devices in the gateway can obtain the private key , and it is well hidden so that attackers cannot calculate , making it impossible to calculate ; In addition, the attacker cannot obtain the random number b, and thus cannot calculate the session key In summary, attackers cannot carry out forgery attacks and impersonation. Similarly, attackers cannot pretend to be the gateway, thereby achieving security protection for the entire process.

[0042] (2) Anti-replay attack: Introducing timestamps into the solution design , and use The restriction effectively prevents replay attacks and avoids the situation where attackers publish duplicate commands after users issue instructions to devices or tasks between devices, thus ensuring security.

[0043] (3) Forward security: In the authentication session, both the user and the device must select a random number. , b, implement session key On this basis, even if the master key used for a long time is leaked, the past session keys will not be leaked.

[0044] 2. High efficiency:

[0045] When users communicate with devices and devices communicate with each other, the gateway will not be frequently accessed during information exchange, thus saving a lot of communication costs, achieving mutual authentication between the two parties and having a low computational cost, involving only two symmetric encryptions, two MAC message authentication codes, two HMAC message authentication codes, and two hash operations. , without using complex operations such as asymmetric encryption and bilinear mapping, to achieve lightweight authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0047] Figure 1 A schematic diagram of the lightweight identity authentication and confidential communication structure based on Internet of Things security provided by the present invention;

[0048] Figure 2 A schematic diagram of data transmission during the registration phase provided by the present invention;

[0049] Figure 3 This is a schematic diagram of data transmission during the identity authentication and key agreement phase provided by the present invention. DETAILED DESCRIPTION

[0050] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0051] The embodiment of the present invention discloses a lightweight identity authentication and confidential communication method based on Internet of Things security, such as Figure 1 As shown, the three parties, including smart devices, users, and security service providers, implement lightweight identity authentication and confidential communication in two phases: registration phase, identity authentication, and key negotiation phase. The following steps are included:

[0052] S1: Smart devices and users register with security service providers and assign security parameters;

[0053] S2: When a smart device or user requests a service as the requester, the request message is calculated based on the security parameters and sent to the recipient's smart device;

[0054] S3: The receiver verifies the request message and generates an authentication response based on the security parameters and feeds it back to the requester.

[0055] S4: After receiving the authentication response, the requester generates session information and sends it to the recipient;

[0056] S5: The receiver decrypts and verifies the session information and completes the key negotiation.

[0057] Furthermore, step 1 belongs to the registration phase, e.g. Figure 2 As shown, the specific implementation process is:

[0058] S11: Smart Device or user As a communication node, after initialization, it submits a registration request to the security service provider ISP through the gateway GW;

[0059] S12: The security service provider ISP assigns a node identity to the communication node based on the registration request (device serial number or user serial number, nature, etc.) , and the node identity and the gateway identity of the gateway GW where the communication node is located , private key Return the security parameters to the communication node through the secure channel and store the security parameters in the node memory;

[0060] S13: The security service provider ISP sends the gateway identity of the gateway GW , private key and node identity Store to the gateway memory.

[0061] The technical effect of the above technical solution is that the security service provider ISP, the node storage and the gateway storage all store { Smart devices connect to the system and store their information on the gateway. The security service provider (ISP) maintains a database of the entire system, recording the devices that have been connected. Furthermore, to protect the entire system from attacks, the ISP can set a key lifecycle and schedule key updates.

[0062] Furthermore, the implementation process of calculating the request message in S2 during the identity authentication and key agreement phase is as follows:

[0063] S21: The requester selects a one-time random number , determine the identity of the receiving node , and get the current sending timestamp ;

[0064] S22: Utilize the stored requester node identity , private key and the recipient node identity Calculate authentication message , h represents the hash function; Represents the concatenation of strings, 、 and Splice it together;

[0065] S23: Based on the authentication message and gateway identity Calculate the request authentication code , MAC represents the message authentication code;

[0066] S24: Based on the request authentication code C and the identity of the requesting node , receiving node identity , current sending timestamp and random number generation request message .

[0067] Furthermore, the specific process of S3 in the identity authentication and key negotiation phase is as follows:

[0068] S31: The receiver sends the timestamp according to the current request message Calculate the time difference with the current receiving timestamp T ,if , If it is an arbitrarily small positive number, the current receiving timestamp T is determined to be within the trustworthy range and the process goes to S32; otherwise, the receiving party ends the session.

[0069] S32: According to the stored private key and the requesting node identity in the request message , receiving node identity Calculate verification message ;

[0070] S33: Calculate the verification code based on the verification message ;

[0071] S34: Verify the authentication code Compare and verify with the request authentication code C in the request message. If they are consistent, proceed to S35; otherwise, the recipient ends the session;

[0072] S35: The receiver selects a secret random number b and obtains the current response timestamp , and based on the stored private key Encrypt and calculate the response message , Indicates using private key An encryption function that serves as a key;

[0073] S36: Based on the secret random number b and the random number in the request message 、Request authentication code C to calculate response authentication code , HMAC represents a message authentication code based on a hash function;

[0074] S37: Based on the response authentication code , response message and the current response timestamp Generate Authentication Response { } and feedback to the requester.

[0075] Furthermore, the specific process of S4 in the identity authentication and key negotiation phase is as follows:

[0076] S41: The requester uses the current response timestamp in the authentication response Calculate the time difference with the current receiving timestamp T ,if If it is established, the current receiving timestamp T is determined to be within the trustworthy range, and the process proceeds to S42; otherwise, the requesting party terminates the session;

[0077] S42: The requester uses the stored private key Decrypt the response message in the authentication response , get the identity of the responding receiver node , secret random number b, response random number and response timestamp , and respond to the recipient node identity , response random number , response timestamp and the receiver node identity determined in step 21 , random numbers , the current response timestamp in the authentication response Compare them, if they are consistent, go to S43; otherwise, the requesting party terminates the session;

[0078] S43: The requester receives the recipient node identity determined in step 21 and the chosen random number , the stored requester node identity , the authentication message calculated in step 22 , the decrypted secret random number b and the current response timestamp Calculate and compare authentication codes , HMAC represents a message authentication code based on a hash function, and is compared with the response authentication code in the authentication response. If they are consistent, the process proceeds to S44; otherwise, the requesting party terminates the session;

[0079] S44: Based on the current session timestamp Calculate the session key , and use the private key Encrypt the session key to obtain the session key ciphertext ;

[0080] S45: Based on the current session timestamp and the session key ciphertext Generate session information { } and sent to the recipient.

[0081] Furthermore, the specific process of S5 in the identity authentication and key negotiation phase is as follows:

[0082] S51: The receiver uses the current session timestamp in the session information Calculate the time difference with the current receiving timestamp T ,if If it is established, the current receiving timestamp T is determined to be within the trustworthy range and the process goes to S52; otherwise, the receiving party terminates the session;

[0083] S52: The receiver uses the stored private key Encrypt the session key in the session information Decrypt and obtain the decryption session key , decrypt random number and decrypted session timestamp , and compare the decrypted random numbers respectively , decrypted session timestamp The secret random number b selected by the receiver in step 35 and the current session timestamp when the session information is received Are they consistent? If they are consistent, then proceed to S53; otherwise, the receiving party terminates the session.

[0084] S53: The receiver responds based on the current timestamp , Step 32-Step 34 Verify the authentication message with the requester Consistent validation messages , the requesting node identity obtained based on the request message and the recipient node identity , the selected secret random number b, the current session timestamp Calculate the session key and decrypt the session key with A comparison is performed for authentication. If they are consistent, key negotiation succeeds; otherwise, key negotiation fails.

[0085] In a specific embodiment, the Internet of Things system includes a smart device D, a user U and a security service provider ISP, and adopts a lightweight identity authentication method. and smart devices To access the IoT system, you must first register with the security service provider (ISP) by submitting a registration request through your smart device. The ISP will then respond and assign security parameters, storing them in the legitimate device's storage space to facilitate access to secret information for authentication during the subsequent authentication process. Specifically, in the IoT system, information exchange occurs between users and smart devices, or between devices. Therefore, users and smart devices serve as communication nodes in the system, and the registration process for both roles is the same. For example, the registration of a smart device:

[0086] S1: Smart Device As a communication node of the system, after initialization, it submits a registration request to the security service provider ISP;

[0087] S2: Security service provider ISP receives smart device After the registration request, an identity is assigned to the device based on the device serial number, nature and other information. , and the gateway where the device is located identity and private key Returned to the smart device via a secure channel, written to the device memory, and the device memory stores { , , };

[0088] S3: Security service provider ISP will and and the identity of the smart device Save to gateway In the gateway memory, { , , }.

[0089] After completing the smart device registration process, the device is connected to the system and its information is stored on the gateway. The security service provider (ISP) maintains a database for the entire system, recording the devices connected to the system. Furthermore, to protect the entire system from attacks, the ISP can set a key lifecycle and schedule key updates.

[0090] In one embodiment, when the user Need to log in to the system to send specific smart devices When requesting a service, you need to use the stored gateway key and calculate the authentication message with the help of random numbers, timestamps, message authentication codes, etc., and then send the specific message to the specific smart device Smart devices Authenticate User message, and select its own parameters for authentication response and feedback to the user ;user After receiving the authentication response, the session key is calculated and encrypted and protected and fed back to the smart device. Smart devices Calculation of session key is done with user The two-way authentication and session key negotiation between the two parties ensures security. The process of authentication and key negotiation is as follows: Figure 3 As shown, the following steps are included:

[0091] S1: User Select a one-time random number , and get the current timestamp , all time in this system is synchronized with the time source to ensure that it meets the time accuracy standards of the National Time Service Center; use the stored information and target smart devices identity Calculate authentication message , after completion, calculate the request authentication code ; will calculate The identity information of both parties, timestamp and random number are sent to the target smart device ,user Send request information: };

[0092] S2: Smart Device Received by user The request information sent first calculates , For the current time, check Is it established, because It is an arbitrarily small positive number. The time difference is checked to determine whether the timestamp is within the trusted range. If it is not within the trusted range, the session is terminated. If it is within the trusted range, the stored information is used. and both parties' identity calculation and verification messages , further calculate the verification authentication code and the received request authentication code Compare and verify if they are the same, and then continue the authentication process; smart device Choose a secret random number , and get the current timestamp , using the private key Encrypt and calculate the response message ; Use random numbers 、 Calculate the message authentication code to authenticate the challenge response of the user and the smart device, and obtain the response authentication code After completing these devices Send authentication response: };

[0093] S3: User Upon receiving the authentication response, first check the timestamp ,calculate ,judge Is it true, then use the private key Decrypting the message ,get 、 、 、 ,Compare 、 、 With known data Are they consistent? If they are consistent, calculate Otherwise, the session ends and the and Compare and determine whether If the verification is successful, the identity authentication is achieved. If the verification fails, the user terminates the session; calculate the session key , while using Encrypt the session key and calculate the session key ciphertext ; Get the current timestamp ,user Send session information: };

[0094] S4: Smart Device Receive session information, first check the timestamp ,calculate judge Is it established, then use right Perform encryption and decryption to obtain 、 、 ,Compare 、 Is it equal to the known data? If so, calculate Otherwise, end the session and compare whether If they are equal, the verification is completed, otherwise the session ends; if the verification is completed, the user is realized With equipment Mutual authentication between the two parties and negotiation and confirmation of the session key success.

[0095] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0096] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A lightweight identity authentication and confidential communication method based on Internet of Things security, characterized in that: The following steps are involved: Step 1: Smart devices and users register with a security service provider and assign security parameters. Step 2: When a smart device or user requests a service as the requester, the request message is calculated based on the security parameters and sent to the recipient's smart device; Step 3: The receiver verifies the request message and generates an authentication response based on the security parameters and feeds it back to the requester. Step 4: After receiving the authentication response, the requester generates session information and sends it to the recipient; Step 5: The receiver decrypts and verifies the session information, completing key negotiation. The specific implementation process of step 1 is: Step 11: The smart device or user acts as a communication node and submits a registration request to the security service provider through the gateway after initialization; Step 12: The security service provider assigns a node identity ID to the communication node according to the registration request, and sends the node identity ID to the gateway identity Gid and private key K of the gateway where the communication node is located. GW Return the security parameters to the communication node through the secure channel and store the security parameters in the node memory; Step 13: The security service provider sends the gateway's gateway identity Gid and private key K GW and node identity id are stored in the gateway memory.

2. The lightweight identity authentication and confidential communication method based on Internet of Things security according to claim 1 is characterized in that: The implementation process of calculating the request message in step 2 is: Step 21: The requester selects a one-time random number a to determine the recipient node identity id j , and obtain the current sending timestamp T1; Step 22: Utilize the stored requester node identity id i 、Private key K GW and the receiver node identity id j Calculate the authentication message Q ij =h(K GW ||id i ||id j ), h represents a hash function; || represents string concatenation; Step 23: Calculate the request authentication code C=MAC(Q ij ,Gid||id i ||T1||a), MAC represents the message authentication code; Step 24: Based on the request authentication code C and the requesting node identity ID i , receiver node identity id j , current sending timestamp and random number generation request message {id i , id j , C, T1, a}.

3. The lightweight identity authentication and confidential communication method based on Internet of Things security according to claim 2 is characterized in that: The specific process of step 3 is: Step 31: The receiver calculates the time difference ΔT = T - T1 based on the current sending timestamp T1 and the current receiving timestamp T in the request message. If ΔT ≤ ε, where ε is an arbitrarily small positive number, the receiver determines that the current receiving timestamp T is within the trustworthy range and proceeds to step 32. Otherwise, the receiver ends the session. Step 32: Based on the stored private key K GW and the requesting node identity id in the request message i , receiver node identity id j Calculate the verification message Q ij ′=h(K GW ||id i ||id j ); Step 33: Calculate the verification authentication code C′=MAC(Q ij ′,Gid||id i ||T1||a); Step 34: Compare the verification code C' with the request authentication code C in the request message. If they are consistent, proceed to step 35; otherwise, the recipient ends the session. Step 35: Select a secret random number b, obtain the current response timestamp T2, and use the stored private key K GW Encrypt and calculate the response message Indicates using the private key K GW An encryption function that serves as a key; Step 36: Calculate the response authentication code tag=HMAC(Q ij , id i ||id j ||b||a||T2), HMAC represents a message authentication code based on a hash function; Step 37: Based on the response authentication code tag, response message N j and the current response timestamp T2 to generate the authentication response {N j , tag, T2} and feedback to the requester.

4. The lightweight identity authentication and confidential communication method based on Internet of Things security according to claim 3 is characterized in that: The specific process of step 4 is: Step 41: The requester calculates the time difference ΔT = T - T2 based on the current response timestamp T2 in the authentication response and the current reception timestamp T. If ΔT ≤ ε holds, the current reception timestamp T is determined to be within the trusted range and the process proceeds to step 42. Otherwise, the requester terminates the session. Step 42: Based on the stored private key K GW Decrypt the response message N in the authentication response j , get the identity id of the responding receiver node j ', secret random number b, response random number a' and response timestamp T2', and respond to the recipient node identity id j ', response random number a', response timestamp T2' and receiver node identity id j , random number a, and the current response timestamp T2 in the authentication response. If they are consistent, the process proceeds to step 43; otherwise, the requesting party terminates the session. Step 43: Calculate and compare the authentication code tag′=HMAX(Q ij , id i ||id j ||b||a||T2), HMAC represents a message authentication code based on a hash function, and is compared with the response authentication code in the authentication response. If they are consistent, the process proceeds to step 44; Otherwise, the requester terminates the session; Step 44: Calculate the session key sk=h(id i ||id j ||b||T3||T2||Q ij ), and use the private key K GW Encrypt the session key to obtain the session key ciphertext Step 45: Based on the current session timestamp T3 and the session key ciphertext N ij Generate session information ij ,T3} and sent to the receiver.

5. The lightweight identity authentication and confidential communication method based on Internet of Things security according to claim 4 is characterized in that: The specific process of step 5 is: Step 51: The receiver calculates the time difference ΔT = T - T3 based on the current session timestamp T3 in the session information and the current reception timestamp T. If ΔT ≤ ε holds, the receiver determines that the current reception timestamp T is within the trustworthy range and proceeds to step 52. Otherwise, the receiver terminates the session. Step 52: Use the stored private key K GW The session key ciphertext N in the session information ij Decryption is performed to obtain the decrypted session key sk′, the decrypted random number b′, and the decrypted session timestamp T3′. The decrypted random number b′ and the decrypted session timestamp T3′ are compared with the selected secret random number b and the current session timestamp T3 in the session information to see if they are consistent. If they are consistent, the process proceeds to step 53; otherwise, the recipient terminates the session. Step 53: Calculate the session key sk=h(id i ||id j ||b||T3||T2||Q ij ) and compares it with the decrypted session key sk′ for authentication. If they are consistent, the key negotiation is successful, otherwise the key negotiation fails.

Images