Cloud and Fog Collaborative Authentication Key Agreement Method and Device Based on Elliptic Curve

Abstract

This application proposes a cloud and fog collaborative authentication key negotiation method and device based on elliptic curves, including the following steps: Build an Internet of Things system including user devices, cloud servers, fog nodes, and Internet of Things devices; The user device and the cloud server send registration requests to the fog node, and the Internet of Things device sends a request to the cloud server, and each generates corresponding registration parameters for storage; When the user calls the Internet of Things device, an authentication message is constructed using elliptic encryption, and it is verified sequentially by the fog node, the cloud server, and the Internet of Things device. After each link passes the verification, the Internet of Things device generates a message and sends it back to the user device. After the user device verifies it, the key is extracted to call the Internet of Things device. This solution transfers some of the computing tasks of the fog node to the cloud platform through the cloud and fog collaboration method, thereby reducing the burden on the fog node.

Description

Technical Field

[0001] This application relates to the field of information security, and particularly to a cloud and fog collaborative authentication key negotiation method and device based on elliptic curves. Background Art

[0002] With the rapid development of cloud computing and the Internet of Things, cloud computing and fog computing have become important computing architectures to cope with the increasing data processing and storage requirements. However, with the sharp increase in the number of Internet of Things devices and fog computing nodes, the communication between these devices faces unprecedented security challenges. First of all, most traditional security authentication and key negotiation protocols rely on centralized cloud computing resources or local high-performance computing capabilities, which often bring relatively large computational overhead and communication burdens to fog computing nodes with limited resources. Especially in the Internet of Things environment where a large number of devices need to participate, the security overhead of fog computing nodes (such as identity authentication, key negotiation, etc.) has become an important bottleneck affecting the overall system efficiency and response speed. Fog nodes are usually limited by computing power, storage space, and bandwidth. Directly undertaking too many encryption computing tasks not only increases energy consumption but also leads to a long authentication delay, thus affecting the system performance and user experience.

[0003] Therefore, how to reduce the computational burden of fog nodes and improve the response speed of the system while ensuring security is an urgent problem to be solved in the prior art. Summary of the Invention

[0004] The embodiments of this application provide a cloud and fog collaborative authentication key negotiation method and device based on elliptic curves, which transfer some of the computational tasks of fog nodes to the cloud platform through cloud and fog collaboration, thereby reducing the burden on fog nodes.

[0005] In a first aspect, the embodiments of this application provide a cloud and fog collaborative authentication key negotiation method based on elliptic curves, and the method includes:

[0006] Build an Internet of Things system, where the Internet of Things system includes user equipment, a cloud server, fog nodes, and Internet of Things devices. The user equipment and the cloud server respectively send user registration requests and cloud server registration requests to the fog nodes. The fog nodes respectively generate user registration parameters and cloud server registration parameters based on the user registration requests and the cloud server registration requests and store them in the fog node storage unit. The Internet of Things devices send device registration requests to the cloud server, and the cloud server generates device registration parameters based on the device registration requests and stores them in the cloud server storage unit;

[0007] When the user device invokes the Internet of Things device, an elliptic encryption method is used to construct a user authentication message and send it to the fog node. The fog node verifies the user authentication message based on the user registration parameters in the fog node storage unit. After successful verification, the fog node generates a fog node authentication message based on the cloud server registration parameters in the fog node storage unit and sends the fog node authentication message to the cloud server;

[0008] The cloud server verifies the fog node authentication message based on its own cloud server registration parameters. After successful verification, the cloud server generates a cloud server authentication message based on the Internet of Things device registration parameters in the cloud server storage unit and sends the cloud server authentication message to the Internet of Things device;

[0009] The Internet of Things device verifies the cloud server authentication message based on its own device registration parameters. After successful verification, the Internet of Things device generates a device authentication message and sends it to the user device. The user device verifies the device authentication message. After successful verification, the user device extracts the key from the device authentication message to invoke the Internet of Things device.

[0010] In a second aspect, an embodiment of the present application provides a cloud and fog collaborative authentication key negotiation device based on an elliptic curve, including:

[0011] A registration module for building an Internet of Things system. The Internet of Things system includes a user device, a cloud server, a fog node, and an Internet of Things device. The user device and the cloud server respectively send a user registration request and a cloud server registration request to the fog node. The fog node respectively generates user registration parameters and cloud server registration parameters based on the user registration request and the cloud server registration request and stores them in the fog node storage unit. The Internet of Things device sends a device registration request to the cloud server. The cloud server generates device registration parameters based on the device registration request and stores them in the cloud server storage unit;

[0012] A fog node authentication module. When the user device invokes the Internet of Things device, an elliptic encryption method is used to construct a user authentication message and send it to the fog node. The fog node verifies the user authentication message based on the user registration parameters in the fog node storage unit. After successful verification, the fog node generates a fog node authentication message based on the cloud server registration parameters in the fog node storage unit and sends the fog node authentication message to the cloud server;

[0013] A cloud server authentication module. The cloud server verifies the fog node authentication message based on its own cloud server registration parameters. After successful verification, the cloud server generates a cloud server authentication message based on the Internet of Things device registration parameters in the cloud server storage unit and sends the cloud server authentication message to the Internet of Things device;

[0014] User device authentication module. The IoT device verifies the cloud server authentication message based on its own device registration parameters. After successful verification, the IoT device generates a device authentication message and sends it to the user device. The user device verifies the device authentication message and extracts the key from the device authentication message to invoke the IoT device after successful verification.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, including a memory and a processor. A computer program is stored in the memory, and the processor is configured to run the computer program to execute a cloud and fog collaborative authentication key negotiation method based on elliptic curves.

[0016] The main contributions and innovations of the present invention are as follows:

[0017] In the registration process of the embodiment of the present application, the real identity information of the user is encrypted and hashed, avoiding direct exposure of the user's identity information. By using mechanisms such as pseudo passwords, random numbers, and biometric features, the user's identity information is ensured to be protected during transmission and storage; the embodiment of the present application adopts encryption technology based on elliptic curve cryptography to ensure the security of the authentication and key negotiation processes and can effectively resist various attacks; the fog node in the embodiment of the present application delegates computationally intensive authentication and key negotiation tasks to the cloud computing platform, thereby reducing the computational burden on the fog node, reducing energy consumption and authentication latency, and since the fog node no longer needs to bear overly heavy computational tasks alone, the overall efficiency and response speed of the system have been significantly improved, especially in a large-scale IoT environment; the user authentication message generated by the user device in the embodiment of the present application is generated through a combination of information such as user identifiers, timestamps, and random numbers, and through hash functions and encryption processing, so that the user's identity information is not directly exposed during the authentication process, achieving anonymous authentication.

[0018] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more concise and understandable. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and form a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation of the present application. In the drawings:

[0020] Figure 1 is a schematic diagram of a cloud and fog collaborative authentication key negotiation method based on elliptic curves according to an embodiment of the present application;

[0021] Figure 2 is a structural block diagram of a cloud and fog collaborative authentication key negotiation device based on elliptic curves according to an embodiment of the present application;

[0022] Figure 3 It is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present application. Detailed implementation manners

[0023] Here, the exemplary embodiments will be described in detail, and the examples are shown in the drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all implementation manners consistent with one or more embodiments of this specification. On the contrary, they are merely examples of devices and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0024] It should be noted that: In other embodiments, the steps of the corresponding methods are not necessarily executed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may also be combined into a single step for description in other embodiments.

[0025] Embodiment 1

[0026] The embodiment of the present application provides a cloud - fog collaborative authentication key negotiation method based on elliptic curves. By means of cloud - fog collaboration, part of the computing tasks of fog nodes are handed over to the cloud platform, thereby reducing the burden on fog nodes. Specifically, referring to Figure 1 , the method includes:

[0027] Build an Internet of Things system. The Internet of Things system includes user equipment, a cloud server, fog nodes, and Internet of Things devices. The user equipment and the cloud server respectively send user registration requests and cloud server registration requests to the fog nodes. The fog nodes respectively generate user registration parameters and cloud server registration parameters based on the user registration requests and cloud server registration requests and store them in the fog node storage unit. The Internet of Things devices send device registration requests to the cloud server, and the cloud server generates device registration parameters based on the device registration requests and stores them in the cloud server storage unit;

[0028] When the user equipment invokes an Internet of Things device, use the elliptic encryption method to construct a user authentication message and send it to the fog node. The fog node verifies the user authentication message based on the user registration parameters in the fog node storage unit. After passing the verification, the fog node generates a fog node authentication message based on the cloud server registration parameters in the fog node storage unit and sends the fog node authentication message to the cloud server;

[0029] The cloud server primitive verifies the fog node authentication message based on its own cloud server registration parameters. After successful verification, the cloud server generates a cloud server authentication message based on the Internet of Things device registration parameters in the cloud server storage list and sends it to the Internet of Things device;

[0030] The Internet of Things device verifies the cloud server authentication message based on its own device registration parameters. After successful verification, the Internet of Things device generates a device authentication message and sends it to the user device. The user device verifies the device authentication message. After successful verification, the user device extracts the key from the device authentication message and invokes the Internet of Things device.

[0031] In some embodiments, the user device selects a unique user identifier and password, performs a hash operation on the user identifier and password to generate a pseudo password, and uses the pseudo password and the user identifier as a user registration request.

[0032] Specifically, select a unique user identifier for the user device and password , where i represents the i-th user. The calculation formula for the pseudo password is:

[0033]

[0034] where, represents a one-way hash function, represents concatenation, is the user identifier, is the password.

[0035] Furthermore, the user device generates a user random number and performs an exclusive OR operation on the user random number and the pseudo password in the user registration request.

[0036] Specifically, introducing a user random number to perform an exclusive OR operation on the pseudo password can make the user registration request transmitted by the user device unique each time, thus ensuring the security of user identity information during transmission.

[0037] That is to say, the user registration request after introducing the random number is .

[0038] In some embodiments, when the fog node receives the user registration request, it generates a first fog node random number, calculates a user credential based on the first fog node random number and the user identifier, and uses the user credential, the user identifier, and the first fog node random number as user registration parameters.

[0039] Specifically, the formula for calculating the user credential is as follows:

[0040]

[0041] Among them, e is a preset parameter of the Internet of Things system, and is the user credential. represents a one-way hash function. represents concatenation. is the user identifier, b is the first fog node random number, is the user credential.

[0042] That is to say, the user registration parameter is expressed as .

[0043] In some specific embodiments, the registration credential parameter is calculated based on the user credential, the user random number, and the pseudo password and returned to the user device. The user device calculates the login parameter based on the registration credential and saves it in the storage unit of the user device. When the user logs in on the user device using the password, the login is successful when the login parameter calculated based on the password is equal to the login parameter in the storage unit of the user device.

[0044] Specifically, the calculation formula of the registration credential is as follows:

[0045]

[0046] Among them, is the pseudo password, is the user credential, is the user random number, is the registration credential parameter.

[0047] Specifically, the user device calculates the identity credential parameter , and . After the above calculations are completed, the login parameter is saved in the storage unit of the user device.

[0048] Specifically, when the user logs in on the user device using the password, the pseudo password is calculated based on the password input by the user, and then the login parameter is restored based on the pseudo password. The login is successful when the login parameter restored by the pseudo password is equal to the login parameter in the storage unit of the user device.

[0049] Specifically, the formula for restoring the login parameter through the pseudo password is expressed as follows:

[0050] , and

[0051] Specifically, the parameters in the above formula are explained in detail in the previous text and will not be repeated here.

[0052] That is to say, when the restored through the pseudo password is If they are equal, the login is successful.

[0053] In some specific embodiments, after the user device receives the registration credentials, the biometric feature is implanted in the user device and the biometric feature is used as one of the login methods.

[0054] Specifically, the formula for implanting biometrics is expressed as follows:

[0055]

[0056] in, is the generating function of the biometric fuzzy extractor, is a string corresponding to the user's biometric characteristics, is an auxiliary string used to restore the string, For biological characteristics.

[0057] Specifically, the formula for logging in using biometrics is as follows:

[0058]

[0059] in, is the recovery function of the biometric extractor, For biometrics, is an auxiliary string used to restore the string, is a string corresponding to the user's biometric characteristics, that is, if the above formula can be used to obtain If the biometrics are correct, the login is successful; otherwise, the login fails.

[0060] Specifically, during the registration process, this solution encrypts and hashes the user's real identity information to avoid direct exposure of the user's identity information, and ensures that the user's identity information is protected during transmission and storage by using mechanisms such as pseudo-passwords, random numbers, and biometrics.

[0061] In some embodiments, the cloud server selects a unique cloud server identifier as a cloud server registration request and sends it to the fog node. When the fog node receives the cloud server registration request, it generates a second fog node random number, calculates the cloud server credential based on the cloud server registration request and the second fog node random number, and uses the cloud server identifier, the second fog node random number, and the cloud server credential as cloud server registration parameters.

[0062] Specifically, the calculation formula for cloud server credentials is as follows:

[0063]

[0064] in, For cloud server credentials, Represents a single - item hash function, Represents concatenation, is the cloud server identifier, and e is a preset parameter of the Internet of Things system, is the second fog - node random number.

[0065] That is to say, the cloud - server registration parameter is expressed as .

[0066] Specifically, when the fog node calculates the cloud - server credential, it returns the cloud - server credential to the cloud server through a secure channel. When the cloud server receives the cloud - server credential, it stores its own identity parameter in the local database.

[0067] In some embodiments, the Internet of Things device selects a unique Internet - of - Things device identifier as a device registration request and sends it to the cloud server. The cloud server generates a device credential based on the device registration request and the cloud - server credential, and uses the device identifier and the device credential as device registration parameters.

[0068] Specifically, the formula of the device credential is expressed as follows:

[0069]

[0070] Wherein, is the device credential, represents a single - item hash function, represents concatenation, is the cloud - server credential, is the device identifier.

[0071] That is to say, the device registration parameter is expressed as .

[0072] Specifically, when the cloud server calculates the device credential, it returns the device credential to the Internet of Things device through a secure channel. When the Internet of Things device receives the device credential, it saves it in the local memory of the Internet of Things device.

[0073] In some embodiments, the user device selects a first user random number m and sets a user - sending timestamp , and the user authentication message includes a first encryption parameter , an encrypted user identifier , a user authentication parameter and a user - sending timestamp . The formula of the first encryption parameter is expressed as , where P is the generator of the elliptic curve. The formula of the encrypted user identifier is expressed as , where is the user identifier, is the user sending timestamp, is the device identifier, represents a single - item hash function, represents concatenation, is the first encryption parameter, is the second encryption parameter, , , e is a preset parameter of the IoT system, the user authentication parameter is represented by the formula , where is the user credential.

[0074] It is worth mentioning that there may be multiple IoT devices in the IoT system, and the device identifier in the user authentication message is the device identifier of the IoT device that the user device wants to call.

[0075] Furthermore, obtain the fog node reception timestamp when the fog node receives the user authentication message, and judge the absolute value of the difference between the fog node reception timestamp and the user sending timestamp. If the absolute value is less than or equal to the verification time threshold, then verify the user authentication message.

[0076] Exemplarily, taking as the fog node reception timestamp, as the verification time threshold, judge whether holds. If it holds, then verify the user authentication message. If it does not hold, then do not perform subsequent verification steps.

[0077] Specifically, when the fog node verifies the user authentication message, calculate the second encryption parameter based on the first encryption parameter [ , and recalculate the user authentication parameter through the first encryption parameter , the second encryption parameter and the user registration parameter in the fog node storage unit. If the recalculated user authentication parameter is equal to the user authentication parameter in the received user authentication message, the verification passes; otherwise, the verification fails.

[0078] Specifically, in the verification stage, obtain by calculating as the recalculated user authentication parameter.

[0079] Specifically, this solution adopts an encryption technology based on elliptic curve cryptography, ensuring the security of the authentication and key negotiation processes and being able to effectively resist various attacks.

[0080] Specifically, the user authentication message generated by the user device is generated through a combination of information such as user identifiers, timestamps, and random numbers, and through hash functions and encryption processing, so that the user's identity information is not directly exposed during the authentication process, achieving anonymous authentication.

[0081] In some embodiments, after the fog node verifies the user authentication message, it obtains the timestamp sent by the fog node and generates a fog node authentication message, where the fog node authentication message includes a cloud server credential , a fog node identifier , fog node authentication parameters and the fog node sent timestamp , where the fog node identifier , fog node authentication parameters .

[0082] Specifically, the meanings of the same parameters have been described in detail above and will not be elaborated here.

[0083] Furthermore, obtain the cloud server received timestamp when the cloud server receives the fog node authentication message, and judge the absolute value of the difference between the cloud server received timestamp and the fog node sent timestamp. If the absolute value is less than or equal to the verification time threshold, then verify the fog node authentication message.

[0084] Exemplarily, taking as the cloud server received timestamp, judge whether holds. If it holds, then verify the fog node authentication message. If it does not hold, then do not perform subsequent verification steps.

[0085] Specifically, when the cloud server verifies the fog node authentication message, it recalculates the fog node authentication parameters through the cloud server registration parameters of the cloud server itself. If the recalculated fog node authentication parameters are equal to the fog node authentication parameters in the received fog node authentication message, the verification passes; otherwise, the verification fails.

[0086] Specifically, the fog node delegates computationally intensive authentication and key negotiation tasks to the cloud computing platform, thereby reducing the computational burden on the fog node, reducing energy consumption and authentication latency, and since the fog node no longer needs to bear overly heavy computational tasks alone, the overall efficiency and response speed of the system have been significantly improved, especially in a large-scale Internet of Things environment.

[0087] In some embodiments, after the cloud server verifies the fog node authentication message, it sets the cloud server sent timestamp and generates a cloud server authentication message, where the cloud server authentication message includes the cloud server sent timestamp , a third encryption parameter and the cloud server authentication parameter , where the third encryption parameter , the cloud server authentication parameter .

[0088] Further, obtain the device reception timestamp when the Internet of Things device receives the cloud server authentication parameter, and judge the absolute value of the difference between the device reception timestamp and the cloud server sending timestamp. If the absolute value is less than or equal to the verification time threshold, verify the cloud server authentication parameter.

[0089] Exemplarily, taking as the device reception timestamp, judge whether it holds. If it holds, verify the cloud server authentication message. If it does not hold, do not perform subsequent verification steps.

[0090] Specifically, in the verification of the cloud server authentication message by the Internet of Things device, calculate the first encryption parameter based on the device registration parameter of the Internet of Things device according to the third encryption parameter, that is , and then recalculate the cloud server authentication parameter according to the first encryption parameter and its own device registration parameter . If the recalculated cloud server authentication parameter is equal to the received cloud server authentication parameter, the verification passes; otherwise, the verification fails.

[0091] In some embodiments, after the Internet of Things device verifies the cloud server authentication message, generate a device random number n and a device sending timestamp , and use the device sending timestamp , the device encryption parameter and the device authentication parameter as the device authentication message, where the device encryption parameter , P is the generator of the elliptic function, the device authentication parameter , where represents a one-way hash function represents concatenation, SK is the key , F is the encryption parameter , m is the user random number is the first encryption parameter.

[0092] Further, obtain the user reception timestamp when the user device receives the device authentication message, and judge the absolute value of the difference between the user reception timestamp and the device sending timestamp. If the absolute value is less than or equal to the verification time threshold, verify the device authentication parameter.

[0093] Exemplarily, taking as the user reception timestamp, judge Whether it holds. If it holds, verify the device verification message; if not, do not perform subsequent verification steps.

[0094] Specifically, during the process of the user device verifying the device authentication message, the user device recalculates the encryption parameters using the user random number , the key and the device authentication parameter . If the recalculated device authentication parameter is equal to the device authentication parameter in the received device authentication message, use as the key.

[0095] Embodiment 2

[0096] Based on the same concept, referring to Figure 2 , this application also proposes a cloud-fog collaborative authentication key negotiation device based on elliptic curves, including:

[0097] A registration module, used to build an Internet of Things system. The Internet of Things system includes user devices, cloud servers, fog nodes, and Internet of Things devices. The user device and the cloud server respectively send user registration requests and cloud server registration requests to the fog node. The fog node respectively generates user registration parameters and cloud server registration parameters based on the user registration request and the cloud server registration request and stores them in the fog node storage unit. The Internet of Things device sends a device registration request to the cloud server, and the cloud server generates device registration parameters based on the device registration request and stores them in the cloud server storage unit;

[0098] A fog node authentication module. When the user device calls the Internet of Things device, it constructs a user authentication message using elliptic encryption and sends it to the fog node. The fog node verifies the user authentication message based on the user registration parameters in the fog node storage unit. After verification, the fog node generates a fog node authentication message based on the cloud server registration parameters in the fog node storage unit and sends the fog node authentication message to the cloud server;

[0099] A cloud server authentication module. The cloud server verifies the fog node authentication message based on its own cloud server registration parameters. After verification, the cloud server generates a cloud server authentication message based on the Internet of Things device registration parameters in the cloud server storage unit and sends it to the Internet of Things device;

[0100] A user device authentication module. The Internet of Things device verifies the cloud server authentication message based on its own device registration parameters. After verification, the Internet of Things device generates a device authentication message and sends it to the user device. The user device verifies the device authentication message, and after verification, extracts the key from the device authentication message to call the Internet of Things device.

[0101] Embodiment 3

[0102] This embodiment also provides an electronic device. Referring to Figure 3 , it includes a memory 404 and a processor 402. A computer program is stored in the memory 404, and the processor 402 is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0103] Specifically, the above-mentioned processor 402 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0104] Among them, the memory 404 may include a mass memory 404 for data or instructions. By way of example and not limitation, the memory 404 may include a hard disk drive (HDD), a floppy disk drive, a solid state drive (SSD), a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 404 may include removable or non-removable (or fixed) media. Where appropriate, the memory 404 may be internal or external to the data processing device. In a particular embodiment, the memory 404 is non-volatile memory. In a particular embodiment, the memory 404 includes a read-only memory (ROM) and a random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically alterable ROM (EAROM), or a flash memory, or a combination of two or more of these. Where appropriate, the RAM may be a static random access memory (SRAM) or a dynamic random access memory (DRAM), where the DRAM may be a fast page mode dynamic random access memory (FPMDRAM), an extended date out dynamic random access memory (EDODRAM), a synchronous dynamic random access memory (SDRAM), etc.

[0105] The memory 404 can be used to store or cache various data files required for processing and / or communication, as well as possible computer program instructions executed by the processor 402.

[0106] The processor 402 reads and executes the computer program instructions stored in the memory 404 to implement any one of the elliptic curve-based cloud and fog collaborative authentication key agreement methods in the above embodiments.

[0107] Optionally, the above electronic device may further include a transmission device 406 and an input / output device 408, wherein the transmission device 406 is connected to the above processor 402, and the input / output device 408 is connected to the above processor 402.

[0108] The transmission device 406 can be used to receive or send data via a network. Specific examples of the above network may include a wired or wireless network provided by a communication provider of the electronic device. In one example, the transmission device includes a network adapter (Network Interface Controller, abbreviated as NIC), which can be connected to other network devices through a base station and thus communicate with the Internet. In one example, the transmission device 406 can be a radio frequency (Radio Frequency, abbreviated as RF) module, which is used to communicate with the Internet wirelessly.

[0109] The input / output device 408 is used to input or output information. In this embodiment, the input information can be a user registration request, a cloud server registration request, etc., and the output information can be a key, etc.

[0110] Optionally, in this embodiment, the above processor 402 can be set to execute the following steps through a computer program:

[0111] Build an Internet of Things system, the Internet of Things system includes user equipment, a cloud server, fog nodes, and Internet of Things devices, the user equipment and the cloud server respectively send a user registration request and a cloud server registration request to the fog node, the fog node respectively generates user registration parameters and cloud server registration parameters based on the user registration request and the cloud server registration request and stores them in the fog node storage unit, the Internet of Things device sends a device registration request to the cloud server, and the cloud server generates device registration parameters based on the device registration request and stores them in the cloud server storage unit;

[0112] When the user device invokes the Internet of Things device, it constructs a user authentication message using elliptic encryption and sends it to the fog node. The fog node verifies the user authentication message based on the user registration parameters in the fog node storage unit. After successful verification, the fog node generates a fog node authentication message based on the cloud server registration parameters in the fog node storage unit and sends the fog node authentication message to the cloud server;

[0113] The cloud server verifies the fog node authentication message based on its own cloud server registration parameters. After successful verification, the cloud server generates a cloud server authentication message based on the Internet of Things device registration parameters in the cloud server storage unit and sends the cloud server authentication message to the Internet of Things device;

[0114] The Internet of Things device verifies the cloud server authentication message based on its own device registration parameters. After successful verification, the Internet of Things device generates a device authentication message and sends it to the user device. The user device verifies the device authentication message, and after successful verification, extracts the key from the device authentication message to invoke the Internet of Things device.

[0115] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementation manners, and will not be elaborated here.

[0116] Generally, various embodiments can be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. Some aspects of the present invention can be implemented in hardware, while other aspects can be implemented by firmware or software executed by a controller, microprocessor, or other computing device, but the present invention is not limited thereto. Although various aspects of the present invention can be shown and described as block diagrams, flowcharts, or using some other graphical representation, it should be understood that, as a non-limiting example, the blocks, devices, systems, technologies, or methods described herein can be implemented in hardware, software, firmware, dedicated circuits or logic, general hardware or a controller, or other computing devices, or some combination thereof.

[0117] Embodiments of the present invention can be implemented by computer software, which can be executed by a data processor of a mobile device, such as in a processor entity, or implemented by hardware, or implemented by a combination of software and hardware. A computer software or program (also referred to as a program product), including software routines, applets, and / or macros, can be stored in any device-readable data storage medium, and they include program instructions for performing specific tasks. The computer program product can include one or more computer-executable components configured to execute the embodiments when the program runs. The one or more computer-executable components can be at least one software code or a part thereof. Additionally, at this point, it should be noted that, as Figure 3Any box in the logical flow may represent a program step, or interconnected logic circuits, boxes and functions, or a combination of program steps and logic circuits, boxes and functions. Software may be stored on physical media such as memory chips or storage blocks implemented within a processor, magnetic media such as hard disks or floppy disks, and optical media such as, for example, DVDs and their data variants, CDs. The physical media is a non-transitory medium.

[0118] Those skilled in the art should understand that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as within the scope described in this specification.

[0119] The above embodiments merely represent several implementation manners of the present application, and the description thereof is relatively specific and detailed, but it should not be construed as a limitation on the scope of the present application. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A cloud and fog collaborative authentication key negotiation method based on elliptic curves, characterized in that Including the following steps: Build an Internet of Things (IoT) system, where the IoT system includes user devices, cloud servers, fog nodes, and IoT devices. Register the user devices and cloud servers with the fog nodes, and register the IoT devices with the cloud servers; When a user device calls an IoT device, construct a user authentication message using elliptic encryption and send it to the fog node. The fog node verifies the user authentication message. After successful verification, generate a fog node authentication message and send it to the cloud server; The cloud server verifies the fog node authentication message. After successful verification, the cloud server generates a cloud server authentication message and sends it to the IoT device; The IoT device verifies the cloud server authentication message. After successful verification, generate a device authentication message and send it to the user device. The user device verifies the device authentication message. After successful verification, extract the key from the device authentication message to call the IoT device.

2. The method for cloud and fog collaborative authentication key negotiation based on elliptic curve according to claim 1, wherein, The user device sends a user registration request to the fog node. The fog node generates user registration parameters based on the user registration request and stores them in the fog node storage unit to complete the registration of the user device in the fog node. Among them, the user device selects a unique user identifier and password, performs a hash operation on the user identifier and password to generate a pseudo-password, and sends the pseudo-password and user identifier as a user registration request to the fog node. When the fog node receives the user registration request, it generates a first fog node random number, calculates the user credentials based on the first fog node random number and the user identifier, and uses the user credentials, user identifier, and the first fog node random number as user registration parameters.

3. A cloud and fog collaborative authentication key negotiation method based on elliptic curves according to claim 1, wherein, Calculate the registration credential parameters based on the user credentials, user random number, and pseudo-password and return them to the user device. The user device calculates the login parameters based on the registration credentials and saves them in the storage unit of the user device. When the user logs in on the user device using the password, if the login parameters calculated based on the password are equal to the login parameters in the user device storage unit, the login is successful.

4. A cloud and fog collaborative authentication key negotiation method based on elliptic curve according to claim 1, characterized in that, The cloud server sends a cloud server registration request to the fog node. The fog node generates cloud server registration parameters based on the cloud server registration request and stores them in the fog node storage unit to complete the registration of the cloud server in the fog node. Among them, the cloud server selects a unique cloud server identifier as the cloud server registration request and sends it to the fog node. When the fog node receives the cloud server registration request, it generates a second fog node random number, calculates the cloud server credentials based on the cloud server registration request and the second fog node random number, and uses the cloud server identifier, the second fog node random number, and the cloud server credentials as cloud server registration parameters.

5. The method for cloud and fog collaborative authentication key negotiation based on elliptic curve according to claim 1, characterized in that The IoT device sends a device registration request to the cloud server. The cloud server generates device registration parameters based on the device registration request and stores them in the cloud server storage unit to complete the registration of the IoT device in the cloud server. Among them, the IoT device selects a unique IoT device identifier as the device registration request and sends it to the cloud server. The cloud server generates device credentials based on the device registration request and the cloud server credentials, and uses the device identifier and the device credentials as device registration parameters.

6. The method for cloud and fog collaborative authentication key negotiation based on elliptic curve according to claim 1, wherein, Obtain the fog node reception timestamp when the fog node receives the user authentication message, and judge the absolute value of the difference between the fog node reception timestamp and the user sending timestamp. If the absolute value is less than or equal to the verification time threshold, verify the user authentication message; Obtain the cloud server reception timestamp when the cloud server receives the fog node authentication message, and judge the absolute value of the difference between the fog node sending timestamp and the cloud server reception timestamp. If the absolute value is less than the verification time threshold, verify the fog node authentication message; Obtain the device reception timestamp when the Internet of Things device receives the cloud server authentication parameter, and judge the absolute value of the difference between the device reception timestamp and the cloud server sending timestamp. If the absolute value is less than or equal to the verification time threshold, verify the cloud server authentication parameter; Obtain the user reception timestamp when the user device receives the device authentication message, and judge the absolute value of the difference between the user reception timestamp and the device sending timestamp. If the absolute value is less than or equal to the verification time threshold, verify the device authentication parameter.

7. A cloud and fog collaborative authentication key negotiation method based on elliptic curves according to claim 1, characterized in that, After the IoT device successfully verifies the authentication message from the cloud server, it generates a device random number n and a device sending timestamp , and uses the device sending timestamp , device encryption parameters , and device authentication parameters as the device authentication message. Among them, the device encryption parameter , where P is the generator of the elliptic function, and the device authentication parameter , where represents a one-way hash function represents concatenation, SK is the key , F is the encryption parameter , m is the user random number is the first encryption parameter 8. A cloud and fog collaborative authentication key negotiation method based on an elliptic curve according to claim 7, characterized in that During the process of the user equipment verifying the device authentication message, the user equipment recalculates the encryption parameters using the user random number , the key and the device authentication parameter . If the recalculated device authentication parameter is equal to the device authentication parameter in the received device authentication message, then use as the key.

9. An elliptic curve-based cloud and fog collaborative authentication key negotiation device, characterized in that, It includes: A registration module for building an Internet of Things system. The Internet of Things system includes a user device, a cloud server, a fog node, and an Internet of Things device, and registers the user device and the cloud server into the fog node, and registers the Internet of Things device into the cloud server; A fog node authentication module. When the user device calls the Internet of Things device, it constructs a user authentication message using the elliptic encryption method and sends it to the fog node. The fog node verifies the user authentication message. After verification, it generates a fog node authentication message and sends it to the cloud server; A cloud server authentication module. The cloud server verifies the fog node authentication message. After verification, the cloud server generates a de-server authentication message and sends it to the Internet of Things device; A user device authentication module. The Internet of Things device verifies the cloud server authentication message. After verification, it generates a device authentication message and sends it to the user device. The user device verifies the device authentication message. After verification, it extracts the key from the device authentication message to call the Internet of Things device.

10. An electronic device, comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is set to run the computer program to execute a method for elliptic curve-based cloud and fog collaborative authentication key negotiation according to any one of claims 1-8.

Images