Data authentication method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a data authentication method and device, electronic equipment and a storage medium, and belongs to the technical field of block chains. The method comprises the following steps: performing data acquisition on a target object to obtain target acquisition data; obtaining a target identifier and a first key sent by the block chain system; wherein the target identifier is used for identifying the target equipment; encrypting the target collection data based on the first key to obtain first encrypted data; encrypting the first encrypted data and the target identifier based on a preset device private key to obtain second encrypted data; and sending the second encrypted data to the block chain system, so that the block chain system authenticates the target collection data based on the second encrypted data and the target identifier. According to the embodiment of the invention, the security of the data collected by the Internet of Things equipment can be improved.

Description

Technical Field

[0001] This application relates to the field of blockchain technology, and in particular, to a data authentication method and apparatus, an electronic device, and a storage medium. Background Art

[0002] An Internet of Things device may refer to a device that can perform at least one operation such as data collection, sharing, and processing. In the related art, Internet of Things devices are prone to being counterfeited, attacked, or maliciously controlled, etc., thus affecting the security of the data collected by the Internet of Things devices. Therefore, how to provide a data authentication method to improve the security of the data collected by Internet of Things devices has become an urgent technical problem to be solved. Summary of the Invention

[0003] The main purpose of the embodiments of this application is to propose a data authentication method and apparatus, an electronic device, and a storage medium, aiming to improve the security of the data collected by Internet of Things devices.

[0004] To achieve the above object, a first aspect of the embodiments of this application proposes a data authentication method. The method is applied to a target device, and the method includes:

[0005] Collect data on a target object to obtain target collected data;

[0006] Obtain a target identifier and a first key sent by a blockchain system; wherein, the target identifier is used to identify the target device;

[0007] Encrypt the target collected data based on the first key to obtain first encrypted data;

[0008] Encrypt the first encrypted data and the target identifier based on a preset device private key to obtain second encrypted data;

[0009] Send the second encrypted data to the blockchain system, so that the blockchain system authenticates the target collected data based on the second encrypted data and the target identifier.

[0010] In some embodiments, before obtaining the target identifier and the first key sent by the blockchain system, the method further includes:

[0011] Encrypt device registration data based on the device private key to obtain registration request data; wherein, the device registration data represents the registration data of the target device;

[0012] Send the registration request data to the blockchain system, so that after the blockchain system successfully verifies the signature of the registration request data based on a preset device public key, generate the target identifier and the first key based on the device registration data.

[0013] To achieve the above object, a second aspect of the embodiments of the present application provides a data authentication method, which is applied to a blockchain system. The method includes:

[0014] Sending a pre-generated target identifier and a first secret key to a target device, so that the target device executes the method described in the first aspect to obtain second encrypted data;

[0015] Obtaining the second encrypted data;

[0016] Authenticating the target acquisition data of the target device based on the second encrypted data and the target identifier.

[0017] In some embodiments, authenticating the target acquisition data of the target device based on the second encrypted data includes:

[0018] Decrypting the second encrypted data based on a preset device public key to obtain a first decryption result;

[0019] If the first decryption result indicates successful decryption of the second encrypted data, determining the device registration result of the target device based on the target identifier; wherein, the device registration result is used to indicate whether the target device is registered or not;

[0020] Authenticating the target acquisition data based on the device registration result.

[0021] In some embodiments, authenticating the target acquisition data based on the device registration result includes:

[0022] If the device registration result indicates that the target device is registered, obtaining the associated device of the target device based on the target identifier;

[0023] Sending the target identifier to the associated device to obtain an auxiliary authentication result generated by the associated device according to the target identifier; wherein, the auxiliary authentication result is used to indicate whether the associated device authenticates the target device or does not authenticate the target device;

[0024] Authenticating the target acquisition data based on the auxiliary authentication result.

[0025] In some embodiments, the method further includes:

[0026] If it is determined that the target acquisition data authentication is successful based on the device registration result, obtaining a second secret key based on the target identifier;

[0027] Decrypting the first encrypted data based on the second secret key to obtain a second decryption result;

[0028] If the second decryption result indicates successful decryption of the first encrypted data, send the target acquisition data to the IoT node.

[0029] In some embodiments, authenticating the target acquisition data based on the device registration result includes:

[0030] Obtain the acquisition time when the target device acquires the target acquisition data;

[0031] Based on the target identifier, obtain the registration time of the target device;

[0032] Determine the interval duration between the registration time and the acquisition time;

[0033] If the interval duration is less than a preset duration threshold, authenticate the target acquisition data based on the device registration result.

[0034] To achieve the above object, a third aspect of the embodiments of the present application proposes a data authentication device, which is applied to a target device, and the device includes:

[0035] A data acquisition module, configured to acquire data from a target object to obtain target acquisition data;

[0036] A data acquisition module, configured to obtain a target identifier and a first key sent by the blockchain system; wherein, the target identifier is used to identify the target device;

[0037] A first encryption module, configured to encrypt the target acquisition data based on the first key to obtain first encrypted data;

[0038] A second encryption module, configured to encrypt the first encrypted data and the target identifier based on a preset device private key to obtain second encrypted data;

[0039] A data sending module, configured to send the second encrypted data to the blockchain system, so that the blockchain system authenticates the target acquisition data based on the second encrypted data.

[0040] To achieve the above object, a fourth aspect of the embodiments of the present application proposes an electronic device, which includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect or the method described in the second aspect is implemented.

[0041] To achieve the above object, a fifth aspect of the embodiments of the present application proposes a computer-readable storage medium storing a computer program, which when executed by a processor implements the method described in the first aspect or the method described in the second aspect above.

[0042] For the data authentication method, device, electronic device and storage medium provided by the present application, the target device encrypts the target collected data with the target identifier and the first key sent by the blockchain system to obtain the first encrypted data. The target device sends the second encrypted data obtained based on the first encrypted data to the blockchain system, so that the blockchain system authenticates the target collected data based on the second encrypted data and the target identifier. It can be seen that the embodiments of the present application can authenticate the target collected data based on the blockchain system. Based on the immutable characteristic of the blockchain system, the embodiments of the present application can improve the security of the target collected data. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 is a flowchart of the data authentication method applied to the target device provided by the embodiments of the present application;

[0044] Figure 2 is a schematic diagram of data authentication provided by the embodiments of the present application;

[0045] Figure 3 is another flowchart of the data authentication method applied to the target device provided by the embodiments of the present application;

[0046] Figure 4 is a flowchart of the data authentication method applied to the blockchain system provided by the embodiments of the present application;

[0047] Figure 5 is Figure 4 a flowchart of step S403 in

[0048] Figure 6 is Figure 5 a flowchart of step S503 in

[0049] Figure 7 is Figure 5 another flowchart of step S503 in

[0050] Figure 8 is another flowchart of the data authentication method applied to the blockchain system provided by the embodiments of the present application;

[0051] Figure 9 is a schematic structural diagram of the data authentication device applied to the target device provided by the embodiments of the present application;

[0052] Figure 10It is a schematic structural diagram of a data authentication device applied to a blockchain system provided by an embodiment of the present application;

[0053] Figure 11 It is a schematic hardware structure diagram of an electronic device provided by an embodiment of the present application. Detailed implementation manners

[0054] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] It should be noted that although functional module division is performed in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different module division in the device or a different order in the flowchart. Terms such as "first" and "second" in the specification, claims and the above-mentioned drawings are used to distinguish similar objects and do not necessarily need to describe a specific order or sequence.

[0056] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0057] First, several nouns involved in the present application are analyzed:

[0058] Blockchain: A blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithms. Essentially, a blockchain is a decentralized database, a string of data blocks generated by using cryptographic methods. Each data block contains information about a batch of transactions, which is used to verify the validity (anti-counterfeiting) of the information and associate with the previous block.

[0059] Signature algorithm: The signature algorithm is an important part of blockchain security. The address, public key, private key, etc. of the blockchain are all related to the signature algorithm. The ownership of the blockchain is realized through the private key, blockchain address, and digital signature. The private key is only owned by the object itself and is only stored in the object terminal. The authentication and management of ownership are all based on the signature algorithm. Therefore, it can also be said that the trust of the blockchain is based on the successful verification of the signature algorithm.

[0060] Smart contract: It is a piece of code written on the blockchain. Once a certain event triggers the execution of the terms in the contract in the blockchain, the code will be automatically executed.

[0061] An Internet of Things device may refer to a device capable of performing at least one operation such as data collection, sharing, and processing. In related technologies, Internet of Things devices are prone to being counterfeited, attacked, or maliciously controlled, etc., thereby affecting the security of the data collected by the Internet of Things devices.

[0062] Based on this, the embodiments of the present application provide a data authentication method, apparatus, electronic device, and storage medium, aiming to improve the security of the data collected by Internet of Things devices.

[0063] The data authentication method, apparatus, electronic device, and storage medium provided by the embodiments of the present application are specifically described through the following embodiments. First, the data authentication method in the embodiments of the present application is described.

[0064] The data authentication method, apparatus, electronic device, and storage medium provided by the embodiments of the present application relate to the field of blockchain technology. The data authentication method, apparatus, electronic device, and storage medium provided by the embodiments of the present application can be applied to terminals, can also be applied to server sides, and can also be software running on terminals or server sides. In some embodiments, the terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, etc.; the server side can be configured as an independent physical server, can also be configured as a server cluster or distributed system composed of multiple physical servers, and can also be configured as a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application implementing the data authentication method, apparatus, electronic device, and storage medium, etc., but is not limited to the above forms.

[0065] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, small computers, large computers, distributed computing environments including any of the above systems or devices, and so on. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0066] Figure 1 is an alternative flowchart of the data authentication method provided by the embodiments of the present application. Figure 1The method in [it] may include but is not limited to steps S101 to S105.

[0067] Step S101, perform data acquisition on a target object to obtain target acquisition data;

[0068] Step S102, obtain a target identifier and a first key sent by a blockchain system; wherein, the target identifier is used to identify a target device;

[0069] Step S103, encrypt the target acquisition data based on the first key to obtain first encrypted data;

[0070] Step S104, encrypt the first encrypted data and the target identifier based on a preset device private key to obtain second encrypted data;

[0071] Step S105, send the second encrypted data to the blockchain system so that the blockchain system authenticates the target acquisition data based on the second encrypted data and the target identifier.

[0072] In steps S101 to S105 illustrated in the embodiments of the present application, the target device encrypts the target acquisition data through the target identifier and the first key sent by the blockchain system to obtain first encrypted data. The target device sends the second encrypted data obtained based on the first encrypted data to the blockchain system so that the blockchain system authenticates the target acquisition data based on the second encrypted data and the target identifier. It can be seen therefrom that the embodiments of the present application can authenticate the target acquisition data based on the blockchain system. Based on the immutable characteristic of the blockchain system, the embodiments of the present application can improve the security of the target acquisition data.

[0073] It should be noted that as Figure 2 shown, the data authentication method provided by the embodiments of the present application can be applied to a target device. The target device may refer to an Internet of Things device, and the target device may be a handheld terminal device, a vehicle device, an industrial production Internet of Things device, or a device accompanying goods, etc. The target device is used to acquire data, and the blockchain system is used to authenticate the data acquired by the target device to improve the security of the data acquired by the target device.

[0074] In step S101 of some embodiments, the target object may refer to the object from which the target device collects data. Depending on the application scenario, the target object may vary. For example, the target object may be a terminal device, an express delivery production line, a logistics transportation device, or goods, etc. The target device may collect data from the target object through wired communication or wireless communication to obtain target collection data. For example, when the target object is a logistics transportation device, the target collection data may include any one or more of the transportation route, transportation task, and cargo information loaded on the logistics transportation device. When the target object is goods, the target collection data may include any one or more of the information of the goods sender, the information of the goods recipient, and the transportation information of the goods.

[0075] Referring to Figure 3 , in some embodiments, before step S102, the data authentication method provided by the embodiments of the present application further includes, but is not limited to, steps S301 to S302.

[0076] Step S301: Encrypt the device registration data based on the device private key to obtain registration request data; wherein, the device registration data represents the registration data of the target device;

[0077] Step S302: Send the registration request data to the blockchain system so that after the blockchain system successfully verifies the signature of the registration request data based on the preset device public key, generate a target identifier and a first key based on the device registration data.

[0078] It should be noted that in the embodiments of the present application, in order to improve the security of the target collection data collected by the target device, the target device may be registered based on the blockchain system. The device registration operation of the target device will be described below.

[0079] In step S301 of some embodiments, the device registration data may refer to the data used by the target device for device registration operations. The device registration data may include any one or more of the following: International Mobile Equipment Identity (IMEI), MAC address of the WiFi network card, device manufacturer, operating system, kernel version number, SIM serial number, enterprise device serial number, Bluetooth MAC address, etc. Referring to Figure 2 , the target device may pre-obtain the device private key based on the public-private key certificate service of the Internet of Things management platform, and the target device encrypts the device registration data based on the device private key to obtain registration request data. It can be understood that the general rule of signature is to calculate the digest of the subject to be signed using a digest algorithm (such as a hash algorithm), and then encrypt the digest using the private key (or public key) of the signer. In the embodiments of the present application, the device registration data may be used as the subject to be signed.

[0080] In step S302 of some embodiments, the target device sends the registration request data to the blockchain system, which is used to verify the signature and decrypt the registration request data, and generate a target identifier and a first key corresponding to the device registration data when the signature verification result indicates that the signature verification of the registration request data is successful. Specifically, referring to Figure 2 , the blockchain system can obtain the device public key of the target device in advance based on the public-private key certificate service of the Internet of Things management platform. The blockchain system verifies the signature and decrypts the registration request data based on the device public key. It can be understood that the general rule of signature verification is to decrypt the signature with the public key (or private key) of the signer, calculate the digest of the subject to be signed using a digest algorithm (such as a hash algorithm), and compare the decryption result with the digest. If the two are consistent, the signature verification is successful. It can be understood that when the blockchain system generates the target identifier and the first key based on the device registration data, it indicates that the target device has completed the device registration operation. At this time, the device registration result of the target device can be registered.

[0081] The advantages of steps S301 to S302 are that the device registration operation of the target device can be performed first based on the blockchain system, and the target identifier and the first key can be generated after the registration of the target device is completed, so that the target acquisition data collected by the target device can be authenticated according to the target identifier later, improving the security of the target acquisition data.

[0082] In step S102 of some embodiments, the target identifier may refer to an identifier used to uniquely identify the target device, and different target devices have different target identifiers. The blockchain system can generate the target identifier in advance based on the device registration operation of the target device. The first key may refer to a symmetric key generated by the blockchain system. The target device obtains the target identifier and the first key sent by the blockchain system.

[0083] In step S103 of some embodiments, the target device signs and encrypts the target acquisition data based on the first key to obtain the corresponding first encrypted data.

[0084] In step S104 of some embodiments, referring to Figure 2 , the target device can obtain the device private key in advance based on the public-private key certificate service of the Internet of Things management platform. The target device can sign and encrypt the first encrypted data and the target identifier based on the device private key to obtain the second encrypted data.

[0085] In step S105 of some embodiments, the target device sends the second encrypted data to the blockchain system, so that the blockchain system decrypts the second encrypted data and authenticates the target acquisition data based on the obtained target identifier. For example, the blockchain system may compare the obtained target identifier with the stored target identifier. If the obtained target identifier is equal to the stored target identifier, it indicates that the device registration result of the target device is registered and the device registration result has not been tampered with. At this time, it can be considered that the authentication of the target acquisition data passes, that is, the target acquisition data is considered secure. The blockchain system may send the secure target acquisition data to the IoT cloud platform, so that the IoT cloud platform performs corresponding service operations based on the target acquisition data. If the obtained target identifier is not equal to the stored target identifier, it indicates that the device registration result of the target device is not registered, or the target identifier sent by the target device has been tampered with. At this time, it can be considered that the authentication of the target acquisition data fails, that is, the target acquisition data is considered insecure. In this case, the blockchain system may send a corresponding error message to the target device.

[0086] Referring to Figure 4 , in some embodiments, the embodiments of the present application further provide a data authentication method applied to a blockchain system, and the method may include but is not limited to steps S401 to S403.

[0087] Step S401: Send the pre-generated target identifier and the first key to the target device, so that the target device executes the method of any of the above embodiments to obtain the second encrypted data;

[0088] Step S402: Obtain the second encrypted data;

[0089] Step S403: Authenticate the target acquisition data of the target device based on the second encrypted data and the target identifier.

[0090] In steps S401 to S402 of some embodiments, the blockchain system pre-generates a target identifier and a first key based on the device registration operation of the target device, and sends the target identifier and the first key to the target device. The target device is used to generate the second encrypted data according to the target identifier, the first key, and the method described in any of the above embodiments. The blockchain system obtains the second encrypted data sent by the target device.

[0091] In step S403 of some embodiments, the blockchain system determines whether the target device is registered based on the second encrypted data and the target identifier, or determines whether the target identifier sent by the target device is equal to the stored target identifier, that is, determines whether the target identifier sent by the target device has been tampered with, so as to realize the authentication of the target collected data. For example, when it is determined that the target identifier sent by the target device is equal to the stored target identifier, it indicates that the target device is registered and the target identifier sent by the target device has not been tampered with. At this time, it can be considered that the authentication of the target collected data is successful, that is, the target collected data is considered to be secure. When it is determined that the target identifier sent by the target device is not equal to the stored target identifier, it indicates that the target device is not registered or the target identifier sent by the target device has been tampered with. At this time, it can be considered that the authentication of the target collected data fails, that is, the target collected data is considered to be insecure.

[0092] Referring Figure 5 , in some embodiments, step S403 may include but is not limited to steps S501 to S503.

[0093] Step S501, decrypt the second encrypted data based on the preset device public key to obtain a first decryption result;

[0094] Step S502, if the first decryption result indicates that the decryption of the second encrypted data is successful, determine the device registration result of the target device based on the target identifier; wherein, the device registration result is used to indicate whether the target device is registered or not registered;

[0095] Step S503, authenticate the target collected data based on the device registration result.

[0096] In steps S501 to S502 of some embodiments, the blockchain system may pre-obtain the device public key of the target device based on the public-private key certificate service of the Internet of Things management platform. The blockchain system performs signature verification and decryption on the second encrypted data based on the device public key to obtain the corresponding first decryption result. It can be understood that the general rule of signature verification is to decrypt the signature with the public key (or private key) of the signer, calculate the digest of the subject to be signed using a digest algorithm (such as a hash algorithm), and compare the decryption result with the digest. If the two are consistent, the signature verification is successful. In the embodiments of the present application, the first encrypted data and the target identifier may be used as the subject to be signed. When it is determined that the signature verification is successful through the above method, a first decryption result indicating that the decryption of the second encrypted data is successful can be obtained. When it is determined that the signature verification fails through the above method, a first decryption result indicating that the decryption of the second encrypted data fails can be obtained.

[0097] When the first decryption result indicates that the decryption of the second encrypted data is successful, determine the device registration result of the target device based on the target identifier obtained by decrypting the second encrypted data. Specifically, when the obtained target identifier is equal to the target identifier stored in the blockchain system, determine that the device registration result of the target device is registered and the device registration result has not been tampered with. When the obtained target identifier is not equal to the target identifier stored in the blockchain system, determine that the device registration result of the target device is not registered. In this case, it may be caused by the target identifier stored in the target device being tampered with, and at this time, the target device can be considered insecure.

[0098] In step S503 of some embodiments, when the device registration result indicates that the target device is registered, it can be determined that the authentication of the target acquisition data is successful. When the device registration result indicates that the target device is not registered, it can be determined that the authentication of the target acquisition data fails.

[0099] Refer to Figure 6 , in some embodiments, step S503 may include but is not limited to steps S601 to S604.

[0100] Step S601, obtain the acquisition time when the target device acquires the target acquisition data;

[0101] Step S602, obtain the registration time of the target device based on the target identifier;

[0102] Step S603, determine the interval duration between the registration time and the acquisition time;

[0103] Step S604, if the interval duration is less than the preset duration threshold, authenticate the target acquisition data based on the device registration result.

[0104] In steps S601 to S604 of some embodiments, the acquisition time may refer to the time when the target device acquires the target acquisition data. The registration time may refer to the time when the target device completes the device registration operation and the blockchain system generates the target identifier based on the device registration data of the target device. The acquisition time may be sent by the target device to the blockchain system. That is, in some embodiments, the target device may encrypt the first encrypted data, the target identifier, and the acquisition time based on the device private key to obtain the second encrypted data. The blockchain system decrypts the second encrypted data through the device public key to obtain the acquisition time. Calculate the difference between the registration time and the acquisition time to determine the interval duration between the registration time and the acquisition time. The preset duration threshold may be preset by the blockchain system, and the specific value of the preset duration threshold may be adaptively set according to actual needs, and the embodiments of the present application do not make specific limitations thereto. Compare the interval duration with the preset duration threshold. If the interval duration is less than the preset duration threshold, determine whether the authentication of the target acquisition data is successful or failed based on the device registration result. If the interval duration is greater than or equal to the preset duration threshold, it indicates that the target device performs the data acquisition operation after a long interval after registration. To ensure the security of the target acquisition data, in this case, the target device may be considered untrusted. The blockchain system may generate a corresponding error message and send it to the target device.

[0105] The advantages of steps S601 to S604 are that the effectiveness and accuracy of the authentication of the target acquisition data can be improved.

[0106] Refer to Figure 7 , in some embodiments, step S503 may include but is not limited to steps S701 to S703.

[0107] Step S701, if the device registration result indicates that the target device has been registered, obtain the associated device of the target device based on the target identifier;

[0108] Step S702, send the target identifier to the associated device to obtain the auxiliary authentication result generated by the associated device according to the target identifier; wherein, the auxiliary authentication result is used to indicate whether the associated device authenticates or does not authenticate the target device;

[0109] Step S703, authenticate the target acquisition data based on the auxiliary authentication result.

[0110] It should be noted that, as can be seen from the descriptions of the above embodiments, in the above embodiments, when the device registration result of the target device indicates that it is already registered, it can be considered that the authentication of the target acquisition data collected by the target device is successful. For scenarios with high authentication requirements, on the basis that the device registration result indicates that the target device is already registered, other verification operations can also be performed to improve the authentication security of the target acquisition data. It can be understood that it is possible to determine whether it is a scenario with high authentication requirements based on the device registration data of the target device or the application scenario of the target acquisition data, etc. The authentication method for the target acquisition data in a scenario with high authentication requirements will be described below.

[0111] In step S701 of some embodiments, when the device registration result indicates that the target device is already registered, the associated device of the target device can be determined based on the target identifier and the smart contract. It can be understood that during the device registration operation of the target device, the blockchain system can determine the associated device of the target device based on the data sent by the target device, and map the associated device to the generated target identifier. Therefore, when the device registration result indicates that the target device is already registered, the associated device of the target device can be determined based on the target identifier and the mapping relationship.

[0112] In step S702 of some embodiments, the blockchain system can send the target identifier to the associated device and obtain the auxiliary authentication result generated by the associated device based on the target identifier. It can be understood that the auxiliary authentication result can indicate that the associated device authenticates or does not authenticate the target device. For example, when the associated device considers the target device to be a trusted device, it can generate an auxiliary authentication result for authenticating the target device. When the associated device considers the target device to be a non-trusted device, it can generate an auxiliary authentication result for not authenticating the target device.

[0113] It can be understood that the associated device can also be determined based on the business attribute corresponding to the target acquisition data. For example, in the logistics transportation scenario, the target device can be the terminal of the sender, the associated device is the terminal of the recipient, and the target acquisition data can be the recipient data of the recipient.

[0114] In step S703 of some embodiments, when the auxiliary authentication result indicates authentication of the target device, it can be determined that the authentication of the target acquisition data is successful. When the auxiliary authentication result indicates non-authentication of the target device, it can be determined that the authentication of the target acquisition data fails.

[0115] In some embodiments, for scenarios with high authentication requirements, on the basis of determining whether the target device is already registered, additional authentication of the target acquisition data can also be performed. For example, authenticate the ownership of the target acquisition data based on the smart contract of the blockchain system, that is, authenticate the ownership, usage rights, and privacy protection rights of the target acquisition data, etc.

[0116] Reference Figure 8 In some embodiments, the data authentication method provided by the embodiments of the present application may further include, but is not limited to, steps S801 to S803.

[0117] Step S801: If it is determined that the authentication of the target collected data is successful based on the device registration result, obtain a second key based on the target identifier.

[0118] Step S802: Decrypt the first encrypted data based on the second key to obtain a second decryption result.

[0119] Step S803: If the second decryption result indicates that the decryption of the first encrypted data is successful, send the target collected data to the Internet of Things node.

[0120] In step S801 of some embodiments, the second key may be another symmetric key generated by the blockchain system when generating the first key. There is a mapping relationship among the target identifier, the first key, and the second key. Therefore, when the authentication of the target collected data is successful, the blockchain system can determine the second key based on the target identifier and the mapping relationship.

[0121] In steps S802 to S803 of some embodiments, the blockchain system decrypts the first encrypted data based on the second key to obtain the corresponding second decryption result. When the second decryption result indicates that the decryption of the first encrypted data is successful, it means that the target collected data has not been tampered with. At this time, the target collected data can be sent to the Internet of Things node (such as the Internet of Things cloud platform) so that the Internet of Things node can perform corresponding business operations based on the target collected data.

[0122] In a specific embodiment, the method for authenticating the target collected data in the embodiments of the present application may include a target device registration process and a data authentication process.

[0123] Among them, with reference to Figure 2 , the target device registration process may include the following steps:

[0124] Step 1: The public-private key certificate service of the Internet of Things management platform generates a device private key and a device public key for the target device. The Internet of Things management platform sends the device private key to the target device and sends the device public key to the oracle system in the blockchain system. Among them, the oracle system is an entity used to connect the blockchain system and the external system.

[0125] Step 2: The target device encrypts the device registration information based on the device public key to obtain registration request data.

[0126] Step 3: The target device sends the registration request data to the blockchain system.

[0127] Step 4, after the blockchain system successfully decrypts the registration request data according to the device public key, it generates a target identifier and a registration time based on the smart contract and the registration request data.

[0128] Step 5, the blockchain system stores the target identifier and the registration time on the chain, saves the device information to the contract, and marks the target device as registered.

[0129] Step 6, the blockchain system generates a first key and a second key based on the target identifier and saves the second key.

[0130] Step 7, the blockchain system encrypts the device identifier and the first key based on the device public key and sends the encrypted data to the target device.

[0131] Step 8, the target device decrypts the received encrypted data based on the device private key to obtain the target identifier and the first key. The target device stores the target identifier and the first key in the device cache.

[0132] The data authentication process includes the following steps:

[0133] Step 1, the target device collects data on the target object to obtain target collection data. The target device encrypts the target collection data based on the first key to obtain first encrypted data.

[0134] Step 2, the target device encrypts the first encrypted data and the stored target identifier based on the device private key to obtain second encrypted data. The target device sends the second encrypted data to the blockchain system.

[0135] Step 3, the blockchain system decrypts the second encrypted data based on the device public key to obtain a first decryption result. When the first decryption result indicates successful decryption of the second encrypted data, the blockchain system matches the target identifier obtained when decrypting the second encrypted data with the stored target identifier. If the decrypted target identifier is equal to the stored target identifier, the blockchain system generates a device registration result indicating that the target device is registered. At this time, it can be considered that the authentication of the target collection data is successful. The blockchain system can decrypt the first encrypted data based on the stored second key to obtain the target collection data and send the target collection data to the IoT cloud platform. If the decrypted target identifier is not equal to the stored target identifier, the blockchain system generates a device registration result indicating that the target device is not registered. At this time, it can be considered that the authentication of the target collection data fails.

[0136] In some embodiments, refer to Figure 2, the Internet of Things management platform may further include a device whitelist service. For target devices on the device whitelist, the authentication process for the data collected by the target devices can be simplified to improve the authentication efficiency. It can be understood that the method for simplifying the authentication process can be adjusted according to actual needs based on the content described in any of the above embodiments, and the embodiments of the present application do not make specific limitations thereto.

[0137] In the data authentication method provided by the embodiments of the present application, the target device encrypts the target collected data with the target identifier and the first key sent by the blockchain system to obtain the first encrypted data. The target device sends the second encrypted data obtained based on the first encrypted data to the blockchain system, so that the blockchain system authenticates the target collected data based on the second encrypted data and the target identifier. It can be seen that the embodiments of the present application can verify the target collected data based on the blockchain system. Based on the immutable characteristic of the blockchain system, the embodiments of the present application can improve the security of the target collected data and reduce the risk of the target device being maliciously controlled.

[0138] Refer to Figure 9 , the embodiments of the present application further provide a data authentication device. The device can be applied to a target device and can implement the data authentication method applied to the target device as described above. The device includes:

[0139] A data collection module 901, configured to collect data from a target object to obtain target collected data;

[0140] A data acquisition module 902, configured to acquire the target identifier and the first key sent by the blockchain system; wherein, the target identifier is used to identify the target device;

[0141] A first encryption module 903, configured to encrypt the target collected data with the first key to obtain the first encrypted data;

[0142] A second encryption module 904, configured to encrypt the first encrypted data and the target identifier with a preset device private key to obtain the second encrypted data;

[0143] A data sending module 905, configured to send the second encrypted data to the blockchain system, so that the blockchain system authenticates the target collected data based on the second encrypted data.

[0144] The specific implementation manner of this data authentication device is basically the same as the specific embodiments of the data authentication method applied to the target device described above, and will not be elaborated herein.

[0145] Refer to Figure 10 , the embodiments of the present application further provide a data authentication device. The device can be applied to the blockchain system and can implement the data authentication method applied to the blockchain system as described above. The device includes:

[0146] An identification sending module 1001, configured to send a pre-generated target identification and a first secret key to a target device, so that the target device executes to obtain second encrypted data as in any of the foregoing embodiments;

[0147] An encrypted data acquisition module 1002, configured to acquire the second encrypted data;

[0148] A data authentication module 1003, configured to authenticate target acquisition data of the target device based on the second encrypted data and the target identification.

[0149] The specific implementation manner of this data authentication device is basically the same as the specific embodiments of the foregoing data authentication method applied to a blockchain, and will not be elaborated herein.

[0150] An embodiment of the present application further provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the foregoing data authentication method is implemented. The electronic device may be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0151] Please refer to Figure 11 , Figure 11 , which illustrates the hardware structure of an electronic device in another embodiment. The electronic device includes:

[0152] A processor 1101, which may be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, etc., and is configured to execute relevant programs to implement the technical solutions provided by the embodiments of the present application;

[0153] A memory 1102, which may be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM), etc. The memory 1102 may store an operating system and other application programs. When implementing the technical solutions provided by the embodiments of this specification through software or firmware, the relevant program codes are stored in the memory 1102, and the processor 1101 is called to execute the data authentication method of the embodiments of the present application;

[0154] An input / output interface 1103, configured to implement information input and output;

[0155] A communication interface 1104, which is used to implement the communication interaction between this device and other devices. It can achieve communication through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.);

[0156] A bus 1105, which transmits information between various components of the device (such as a processor 1101, a memory 1102, an input / output interface 1103, and a communication interface 1104);

[0157] Among them, the processor 1101, the memory 1102, the input / output interface 1103, and the communication interface 1104 achieve communication connections with each other inside the device through the bus 1105.

[0158] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above data authentication method is implemented.

[0159] As a non-transitory computer-readable storage medium, the memory can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory may optionally include a memory remotely provided relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above networks include, but are not limited to, the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0160] The embodiments described in the embodiments of the present application are for more clearly explaining the technical solutions of the embodiments of the present application, and do not constitute a limitation to the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0161] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation to the embodiments of the present application, and may include more or fewer steps than those shown, or combine some steps, or different steps.

[0162] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0163] Those of ordinary skill in the art will understand that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or a suitable combination thereof.

[0164] As used in the specification of this application and the above-mentioned drawings, the terms "first", "second", "third", "fourth", etc. (if any) are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged under appropriate circumstances so that the embodiments of this application described herein can be implemented in an order different from those illustrated or described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products, or devices.

[0165] It should be understood that in this application, "at least one (item)" means one or more, and "a plurality" means two or more. "And / or" is used to describe the association relationship of associated objects and indicates that three relationships may exist. For example, "A and / or B" may mean: only A exists, only B exists, and both A and B exist at the same time. Here, A and B can be singular or plural. The character " / " generally means that the associated objects before and after are in an "or" relationship. "At least one (one) of the following" or its similar expressions refer to any combination of these items, including any combination of single items (ones) or plural items (ones). For example, at least one (one) of a, b, or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0166] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the above-mentioned unit division is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling, direct coupling, or communication connection to each other can be through some interfaces. The indirect coupling or communication connection of devices or units can be in electrical, mechanical, or other forms.

[0167] The units described above as separate components may or may not be physically separated. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0168] In addition, each functional unit in various embodiments of the present application may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

[0169] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in various embodiments of the present application. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks, or optical discs that can store programs.

[0170] The preferred embodiments of the embodiments of the present application have been described above with reference to the accompanying drawings, and thus do not limit the scope of the rights of the embodiments of the present application. Any modifications, equivalent replacements, and improvements made by those skilled in the art without departing from the scope and essence of the embodiments of the present application shall be within the scope of the rights of the embodiments of the present application.

Claims

1. A data authentication method, characterized in that, The method is applied to a target device, and the method includes: Collect data of a target object to obtain target collected data; Obtain a target identifier and a first secret key sent by a blockchain system; wherein, the target identifier is used to identify the target device; Encrypt the target collected data based on the first secret key to obtain first encrypted data; Encrypt the first encrypted data and the target identifier based on a preset device private key to obtain second encrypted data; Send the second encrypted data to the blockchain system so that the blockchain system authenticates the target collected data based on the second encrypted data and the target identifier.

2. The method according to claim 1, wherein Before obtaining the target identifier and the first secret key sent by the blockchain system, the method further includes: Encrypt device registration data based on the device private key to obtain registration request data; wherein, the device registration data represents the registration data of the target device; Send the registration request data to the blockchain system so that after the blockchain system successfully verifies the signature of the registration request data based on a preset device public key, generate the target identifier and the first secret key based on the device registration data.

3. A data authentication method, characterized in that, The method is applied to a blockchain system, and the method includes: Send a pre-generated target identifier and a first secret key to a target device so that the target device executes the method according to claim 1 or 2 to obtain second encrypted data; Obtain the second encrypted data; Authenticate the target collected data of the target device based on the second encrypted data and the target identifier.

4. The method according to claim 3, wherein The authenticating the target collected data of the target device based on the second encrypted data includes: Decrypt the second encrypted data based on a preset device public key to obtain a first decryption result; If the first decryption result indicates successful decryption of the second encrypted data, determine the device registration result of the target device based on the target identifier; wherein, the device registration result is used to indicate whether the target device is registered or not; Authenticate the target collected data based on the device registration result.

5. The method according to claim 4, characterized in that, The authenticating the target collected data based on the device registration result includes: If the device registration result indicates that the target device is registered, obtain the associated device of the target device based on the target identifier; Send the target identifier to the associated device to obtain an auxiliary authentication result generated by the associated device according to the target identifier; wherein, the auxiliary authentication result is used to indicate whether the associated device authenticates the target device or does not authenticate the target device; Authenticate the target collected data based on the auxiliary authentication result.

6. The method according to claim 4, wherein The method further includes: If it is determined that the authentication of the target collected data is successful based on the device registration result, obtain a second secret key based on the target identifier; Decrypt the first encrypted data based on the second secret key to obtain a second decryption result; If the second decryption result indicates successful decryption of the first encrypted data, send the target collected data to an Internet of Things node.

7. The method according to claim 4, characterized in that Authenticating the target collected data based on the device registration result includes: Obtaining the collection time when the target device collects the target collected data; Obtaining the registration time of the target device based on the target identifier; Determining the interval duration between the registration time and the collection time; If the interval duration is less than a preset duration threshold, authenticating the target collected data based on the device registration result.

8. A data authentication device, characterized in that, The device is applied to a target device, and the device includes: A data collection module for collecting data from a target object to obtain target collected data; A data acquisition module for obtaining a target identifier and a first key sent by a blockchain system; wherein the target identifier is used to identify the target device; A first encryption module for encrypting the target collected data based on the first key to obtain first encrypted data; A second encryption module for encrypting the first encrypted data and the target identifier based on a preset device private key to obtain second encrypted data; A data sending module for sending the second encrypted data to the blockchain system so that the blockchain system authenticates the target collected data based on the second encrypted data.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the method according to claim 1 or 2, or implements the method according to any one of claims 3 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the method according to claim 1 or 2, or implements the method according to any one of claims 3 to 7.

Images