Access security verification method of Internet of Things equipment

Abstract

The invention discloses an access security verification method for Internet of Things equipment, which belongs to the technical field of communication, and comprises the following steps: S1, the Internet of Things equipment applies for a certificate, generates encrypted information and sends the encrypted information to gateway equipment; s2, the gateway device carries out processing, and the gateway device receives and verifies the encrypted information sent by the Internet of Things device; s3, the authentication server carries out processing, and the authentication server receives and verifies the encrypted information sent by the gateway equipment; generating a device certificate of the Internet of Things device; s4, certificate distribution and storage: the Internet of Things verification server verifies and stores the received certificate information; and after receiving the certificate information, the gateway equipment forwards the certificate information to the corresponding Internet of Things equipment, the corresponding Internet of Things equipment verifies the certificate information, and the certificate information is stored after the verification is passed. According to the method, the problems that in a traditional scheme, a static voucher is prone to being attacked, heterogeneous equipment is poor in compatibility, and data privacy protection is insufficient are effectively solved.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to an access security verification method for an Internet of Things device. Background Art

[0002] With the continuous evolution of IoT technology, the number of IoT devices is growing exponentially. Industry research data indicates that by 2025, the number of connected devices worldwide is expected to exceed 100 billion. Faced with this massive influx of device connectivity, the development of a network security protection system has become a critical technical challenge. In particular, during the connection and transmission between network terminal devices (including computer clusters, server arrays, and mobile terminals) and the Internet / LAN, data communication security and device identity authentication urgently need to be systematically addressed.

[0003] Over 10,000 device manufacturers worldwide adopt divergent hardware architectures and communication protocol standards, leading to complex authentication and compatibility issues when integrating heterogeneous devices. Furthermore, traditional authentication mechanisms based on trusted hardware are limited by the heterogeneous nature of device hardware, making it difficult to build a cross-platform secure authentication system. This dual technical dilemma poses a severe challenge to device security management in large-scale IoT environments. Building a highly adaptable and secure device access authentication mechanism has become a core research topic in IoT security. Summary of the Invention

[0004] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a method for verifying access security of an Internet of Things device.

[0005] The object of the present invention is achieved through the following technical solutions:

[0006] The present invention discloses a method for access security verification of an Internet of Things device, comprising the following steps:

[0007] S1. The IoT device applies for a certificate, obtains and encrypts the first PCR value and the first system operation log of the IoT device, obtains the second PCR value and the second system operation log, performs a hash operation on the second PCR value and the second system operation log through SM3 to obtain a second hash value, encrypts the key, and obtains an encryption key; the second PCR value, the second system operation log, the second hash value, and the encryption key are combined to form a final encrypted message, and the IoT device then sends the encrypted message to the gateway device; the first and second PCR values represent the first hash values that record the system startup process and runtime components;

[0008] S2. Gateway device processing: The gateway device receives and verifies the encrypted information sent by the IoT device. If the verification is successful, the gateway device sends the encrypted information to the authentication server; if the verification is unsuccessful, the encrypted information is discarded;

[0009] S3. The authentication server receives and verifies the encrypted information sent by the gateway device; if the verification is successful, the security of the gateway device is verified; if the security of the encrypted information and the gateway device are both verified, a device certificate for the IoT device is generated and the authentication server sends the certificate information, including the device certificate and the certificate public key, to the gateway device and the IoT authentication server.

[0010] S4. Certificate distribution and storage. The IoT verification server verifies and stores the received certificate information. After receiving the certificate information, the gateway device forwards the certificate information to its corresponding IoT device. The corresponding IoT device verifies the certificate information and stores the certificate information after the verification is passed.

[0011] Furthermore, step S1 specifically includes the following steps:

[0012] S11. Combine random numbers to obtain IoT device D in a random manner i The first PCR value Specifically include: generating 128-bit random numbers through the random number generator RNG RNG , and the number of PCR registers PCR count Perform a modulo operation, and then obtain the first PCR value based on the index obtained after the modulo operation.

[0013] S12, use the national secret SM4 and combine it with the CBC mode to check the first PCR value Encrypt and obtain the second PCR value Specifically, it includes: using a cryptographically secure pseudo-random number generator CSPRNG to generate a random number as the initialization vector IV in the CBC mode; obtaining the first PCR value Divide into two PCR groups of the same length, including the high part and the lower part Use the initialization vector IV as the high-order part The encryption parameter is the high part Perform XOR with the initialization vector IV to obtain the first XOR result, and use the SM4 encryption algorithm to encrypt the first XOR result to obtain the first encrypted block Block1: Then the first encrypted block Block1 and the low-order part Perform XOR to obtain the second XOR result, and use the SM4 encryption algorithm to encrypt the second XOR result to obtain the second encrypted block Block2: The number of random numbers generated by the cryptographically secure pseudo-random number generator CSPRNG is consistent with the number of bits in the encrypted PCR packet;

[0014] S13. Obtaining the first system operation log Use the public key of the authentication server pub Run log for the first system Encryption to obtain the second system operation log

[0015] S14, splicing the second PCR value and the second system operation log Use the national secret SM3 to perform a hash operation on the splicing result to obtain a second hash value; specifically including: obtaining the second PCR value After that, the initialization vector IV, the first encryption block Block1, the second encryption block Block2 are spliced in this order, and then combined with the second system operation log Directly splice to obtain the splicing result Char: Use the national secret SM3 to perform hash operation on the splicing result Char Get the second hash value

[0016] S15. The IoT device requests the public key of the authentication server from the gateway device. pub , using the public key of the authentication server pub , SM4 key used for encryption SM4 Encrypt to obtain the encryption key Key pub (Key SM4 ); Finally, the second PCR value, the second system operation log, the second hash value and the encryption key form an encrypted message Key pub (Key SM4 )),in IoT device D i Encrypted information Sent to the gateway device.

[0017] Preferably, step S2 specifically includes: the gateway device receives the encrypted information sent by the IoT device Use the national secret SM3 to encrypt information The second PCR value in and the second system operation log Key pub Perform security verification Get the first security verification result Hash GATE , Hash the security verification result GATE With encrypted information The second hash value in Perform a comparison. If the comparison results are consistent, the gateway device will encrypt the information. Forwarded to the authentication server, if the comparison results are inconsistent, the encrypted information Not secure, information will be encrypted throw away.

[0018] Preferably, step S3 specifically includes the following steps:

[0019] S31. The authentication server receives the encrypted information sent by the gateway device After that, the encrypted information The second PCR value in and the second system operation log Perform security verification: Get the second security verification result Hash server , Hash the second security verification result server With encrypted information The second hash value in Perform a comparison. If the comparison results are inconsistent, encrypt the information Not secure, information will be encrypted Discard; if the comparison results are consistent, the authentication server uses the private key to decrypt the encryption key Key pub (Key SM4 ) and the second system operation log Key pub Get the SM4 key SM4 and the first system operation log

[0020] S32, the authentication server reads the first n bits of the splicing result Char to obtain the initialization vector IV, and then obtains the first encryption block Block1 and the second encryption block Block2; through the initialization vector IV and the SM4 key Key SM4 Decrypt the first encrypted block Block1 and the second encrypted block Block2 to obtain the high-order part and the lower part Specifically including: through SM4 key SM4 Decrypt the first encrypted block Block1 to obtain the first intermediate data Decrypted_block1, perform XOR on the first intermediate data Decrypted_block1 and the initialization vector IV to obtain the high-order part Through SM4 key SM4 Decrypt the second encrypted block Block2 to obtain the second intermediate data Decrypted_block2, perform XOR on the second intermediate data Decrypted_block2 and the first encrypted block Block1 to obtain the low-order part The high part of the and the lower part Perform splicing to obtain the first PCR value

[0021] S33, the authentication server runs the log file of the first system Perform remote certification based on the first system operation log Calculate the PCR value of the entire system at that time system , check the PCR value at that time system Is there a difference between the first PCR value and the If there is no identical matching item, the IoT device is not secure; otherwise, the IoT device is secure and a certificate is issued to it.

[0022] Preferably, step S4 specifically includes the following steps:

[0023] S41. After the IoT verification server receives the certificate information sent by the authentication server, the IoT verification server calculates a third hash value using the hash algorithm corresponding to the certificate signature algorithm field, where the third hash value is the hash value of the body of the current certificate; then, the IoT verification server decrypts the certificate using the certificate public key to obtain a fourth hash value, where the fourth hash value is the hash value of the certificate content encrypted by the certificate authority CA using the private key; the IoT verification server compares the third hash value and the fourth hash value; if the comparison results are consistent, the IoT verification server remotely requests to obtain the device number corresponding to the device certificate, and upon remote request, the IoT verification server sends its public key to the IoT device; the device number and certificate are stored in a key-value pair, and the valid bit of the key-value pair is set to 0; the device number includes the serial number, IMEI number, and RFID tag;

[0024] S42. After receiving the certificate information sent by the authentication server, the gateway device sends the certificate information to the IoT device; the IoT device verifies whether the certificate information is secure. If it is secure, the IoT device stores the certificate and the certificate public key, specifically including: the IoT device calculates the third hash value and the fourth hash value, and then compares the third hash value and the fourth hash value. If the comparison results are consistent, the certificate information is stored; if the comparison results are inconsistent, a new certificate is applied for.

[0025] The beneficial effects of the present invention are:

[0026] 1) This application effectively solves the problems of static credentials being vulnerable to attacks, poor compatibility of heterogeneous devices, and insufficient data privacy protection in traditional solutions through multi-layer technical means such as device-side encryption of PCR values and system logs, gateway preliminary hash verification, deep decryption and integrity verification on the authentication server, final review on the IoT authentication server, and certificate distribution.

[0027] 2) The dynamic encryption and randomized PCR values of this application enhance the ability to resist replay attacks; dual verification of the gateway and server ensures the integrity of the data; end-to-end encryption and remote attestation mechanisms can prevent firmware-level tampering; the full-process national secret algorithm integration meets national information security compliance requirements, and provides a highly secure, highly compatible, and feasible device access solution for large-scale IoT environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a schematic diagram of the steps of a method for access security verification of an Internet of Things device according to an embodiment of the present invention;

[0029] Figure 2 A schematic diagram of the principles of a method for access security verification of an Internet of Things device according to an embodiment of the present invention;

[0030] Figure 3 A schematic diagram of the process of applying for a certificate for an IoT device according to an embodiment of the present invention;

[0031] Figure 4 A schematic diagram of a process for an IoT device to apply for access to an IoT authentication server according to an embodiment of the present invention;

[0032] Figure 5 A schematic diagram of a process for generating encrypted information for an IoT device according to an embodiment of the present invention;

[0033] Figure 6 A schematic diagram of a process for verifying encrypted information by a gateway device according to an embodiment of the present invention;

[0034] Figure 7 A schematic diagram of a process for generating a certificate by an authentication server according to an embodiment of the present invention;

[0035] Figure 8 This is a flowchart of the IoT authentication server storing certificates and authenticating device access according to an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The following will clearly and completely describe the technical solutions of the present invention in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work shall fall within the scope of protection of the present invention.

[0037] The present invention discloses a method for access security verification of an Internet of Things device, the principle diagram of which is as follows: Figure 2As shown, the device number and device certificate stored in the IoT device are used as request information for applying for access to the IoT verification server, and then the request information is sent to the gateway device. The IoT device number includes but is not limited to a serial number, IMEI number, RFID tag, and other codes that can uniquely identify an IoT device. The device certificate and device number are used when the IoT device communicates with the IoT verification server to indicate the security of the IoT device currently applying for access to the verification server. When the IoT device applies for access to the IoT verification server through the gateway device, it needs to provide request information for applying for access, wherein the request information includes the device number and device certificate. The gateway device sends the request information to the IoT verification server, and the IoT verification server performs security verification based on the device number and device certificate in the request information, and allows the device to access if it is safe.

[0038] The gateway device sends the request information to the IoT verification server. The gateway device does not check the security of the IoT device's access request. Instead, it forwards the request information to the IoT verification server, which then verifies the security of the IoT device. A gateway device is a computer system or device that provides data conversion services between multiple networks. Since the communication protocols of IoT devices on different networks may vary, the gateway device stores multiple communication protocols, such as wired and wireless. Once connected to an IoT device, the gateway device can communicate with the IoT device via wired or wireless communication protocols. The gateway device can normalize and forward data sent by IoT devices with different communication protocols, resolving the issue of interoperability between different systems. The IoT verification server verifies the security of the accessing device and accepts the device's access request if it is secure.

[0039] In this example, the IoT device sends the requested device certificate and encrypted device ID as a request message to the gateway device. The gateway device then sends the request message to the IoT verification server. The IoT verification server verifies the security of the device ID and device certificate in the request message. If the request is secure, the device's access request is accepted. All data used in the certificate application process is encrypted, preventing critical IoT device data from being accessed by external devices and ensuring data security. If the IoT device is secure, the IoT verification server approves the access request.

[0040] Specifically, the steps are as follows: Figure 1As shown, the present application first obtains the PCR value of the IoT device in a random manner by combining a random number, and encrypts the PCR value using the SM4-CBC mode; obtains the system operation log, and encrypts the system operation log using the public key of the authentication server; then concatenates the encrypted PCR value and the system operation log, and hashes the concatenation result using the national secret SM3 algorithm; finally, uses the public key of the authentication server to encrypt the SM4 key used in the above process. The encrypted PCR value, the encrypted system operation log, the hash value, and the encryption key form the final encrypted information, and the encrypted information is sent to the gateway device. The gateway device verifies the security of the encrypted information, and under the premise of security, sends the encrypted information to the authentication server; after receiving the encrypted information, the authentication server verifies the security of the encrypted information, and decrypts it to obtain the initial data in the encrypted information after it is secure. Based on the initial data in the encrypted information, the security of the IoT device is verified. Under the premise of security, a device certificate for the device is generated, and the certificate information including the device certificate and certificate public key is sent to the gateway device and the IoT verification server; the IoT verification server receives the certificate information sent by the authentication server, verifies the security of the certificate, and stores the device certificate and certificate public key in the information locally; the gateway device receives the certificate information sent by the authentication server and sends the certificate information to the IoT device; the IoT device receives the certificate information sent by the gateway device, verifies the security of the certificate information, and stores the certificate and certificate public key. The specific steps include:

[0041] S1. The IoT device applies for a certificate, obtains and encrypts the first PCR value and the first system operation log of the IoT device, obtains the second PCR value and the second system operation log, performs a hash operation on the second PCR value and the second system operation log through SM3 to obtain a second hash value, encrypts the key, and obtains an encryption key; the second PCR value, the second system operation log, the second hash value, and the encryption key are combined to form a final encrypted message, and the IoT device then sends the encrypted message to the gateway device; the first and second PCR values represent the first hash values that record the system startup process and runtime components;

[0042] S2. Gateway device processing: The gateway device receives and verifies the encrypted information sent by the IoT device. If the verification is successful, the gateway device sends the encrypted information to the authentication server; if the verification is unsuccessful, the encrypted information is discarded;

[0043] S3. The authentication server receives and verifies the encrypted information sent by the gateway device; if the verification is successful, the security of the gateway device is verified; if the security of the encrypted information and the gateway device are both verified, a device certificate for the IoT device is generated and the authentication server sends the certificate information, including the device certificate and the certificate public key, to the gateway device and the IoT authentication server.

[0044] S4. Certificate distribution and storage. The IoT verification server verifies and stores the received certificate information. After receiving the certificate information, the gateway device forwards the certificate information to its corresponding IoT device. The corresponding IoT device verifies the certificate information and stores the certificate information after the verification is passed.

[0045] For example, the process diagram of IoT device applying for a certificate is as follows: Figure 3 As shown in Figure 1, IoT devices can only apply to access the IoT verification server if they hold a certificate. The steps for registering a certificate are as follows: Send encrypted information to the gateway device. The process diagram of IoT devices generating encrypted information is shown in Figure 1. Figure 5 As shown, the encrypted information includes: encrypted PCR value, encrypted system operation log, hash value, encryption key. The gateway device receives the encrypted information. Verify whether the encrypted information is safe. If it is not safe, do not forward the encrypted information. The gateway device concatenates the PCR value and the system operation log in the encrypted information and performs an SM3 hash operation, and compares the calculated hash value with the hash value in the original encrypted information. If the comparison is consistent, it means that the encrypted information is safe, otherwise it is unsafe. Under the premise that the encrypted information is safe, forward the encrypted information. Step S1 specifically includes the following steps:

[0046] S11. Combine random numbers to obtain IoT device D in a random manner i The first PCR value Specifically include: generating 128-bit random numbers through the random number generator RNG RNG , and the number of PCR registers PCR count Perform a modulo operation, and then obtain the first PCR value based on the index obtained after the modulo operation.

[0047] S12, use the national secret SM4 and combine it with the CBC mode to check the first PCR value Encrypt and obtain the second PCR value Specifically, it includes: using the random number generated by the cryptographically secure pseudo-random number generator CSPRNG as the initialization vector IV in CBC mode; since the maximum block length supported by the national encryption SM4 is 128 bits, the first PCR value obtained Divide into two PCR groups of the same length, including the high part and the lower part Use the initialization vector IV as the high-order part The encryption parameter is the high part Perform XOR with the initialization vector IV to obtain the first XOR result, and use the SM4 encryption algorithm to encrypt the first XOR result to obtain the first encrypted block Block1: Then the first encrypted block Block1 and the low-order part Perform XOR to obtain the second XOR result, and use the SM4 encryption algorithm to encrypt the second XOR result to obtain the second encrypted block Block2: The number of random numbers generated by the cryptographically secure pseudo-random number generator CSPRNG is consistent with the number of bits in the encrypted PCR packet;

[0048] S13. Obtaining the first system operation log Use the public key of the authentication server pub Run log for the first system Encrypt and obtain the second system operation log key pub

[0049] S14, splicing the second PCR value and the second system operation log Key pub Use the national secret SM3 to perform a hash operation on the splicing result to obtain a second hash value; specifically including: obtaining the second PCR value After that, the initialization vector IV, the first encryption block Block1, the second encryption block Block2 are spliced in this order, and then combined with the second system operation log Key pub Directly splice to obtain the splicing result Char: Use the national secret SM3 to perform hash operation on the splicing result Char Get the second hash value

[0050] S15. The IoT device requests the public key of the authentication server from the gateway device. pub , using the public key of the authentication server pub , SM4 key used for encryption SM4 Encrypt to obtain the encryption key Key pub (Key SM4 ); Finally, the second PCR value Second system operation log Key pub Second hash value and encryption key pub (Key SM4 ) to form encrypted information Key pub (Key SM4 )),in IoT device D i Encrypted information Sent to the gateway device.

[0051] For example, the flow chart of the gateway device verifying the encrypted information is as follows: Figure 6 As shown, the gateway device verifies the encrypted information. After receiving the encrypted information sent by the IoT device, the gateway device obtains the encrypted PCR value and the system operation log in the encrypted information, splices the encrypted PCR value and the system operation log, uses the national secret SM3 algorithm to perform a hash operation on the splicing result, and compares the hash value with the hash value in the original encrypted information. If the two hash values are the same, the gateway device forwards the encrypted information to the authentication server; otherwise, the encrypted information is unsafe, discarded, and not forwarded. Step S2 specifically includes: the gateway device receives the encrypted information sent by the IoT device Use the national secret SM3 to encrypt information The second PCR value in and the second system operation log Key pub Perform security verification Get the first security verification result Hash GATE , Hash the security verification result GATE With encrypted information The second hash value in Perform a comparison. If the comparison results are consistent, the gateway device will encrypt the information. Forwarded to the authentication server, if the comparison results are inconsistent, the encrypted information Not secure, information will be encrypted throw away.

[0052] For example, the flow chart of the authentication server generating a certificate is as follows: Figure 7 As shown, the authentication server verifies the security of the encrypted information and the device and generates a device certificate. After the authentication server receives the encrypted information sent by the gateway device, the authentication server first obtains the encrypted PCR value and the system operation log in the encrypted information, splices them, and then uses the national secret SM3 hash algorithm to perform a hash operation, and compares the hash value obtained by the operation with the hash value in the original encrypted information. If the two hash values are the same, the encrypted information is secure. Otherwise, the encrypted information is not secure, and the encrypted information is discarded without any processing. If the encrypted information is secure, continue to verify whether the device is secure. The authentication server continues to verify the security of the device, and if the device is secure, it issues a certificate for it. Step S3 specifically includes the following steps:

[0053] S31, the authentication server receives the encrypted information sent by the gateway device After that, the encrypted information The second PCR value in and the second system operation log Key pub Perform security verification: Get the second security verification result Hash server , Hash the second security verification result server With encrypted information The second hash value in Perform a comparison. If the comparison results are inconsistent, encrypt the information Not secure, information will be encrypted Discard; if the comparison results are consistent, the authentication server uses the private key to decrypt the encryption key Key pub (Key SM4 ) and the second system operation log Key pub Get the SM4 key SM4 and the first system operation log

[0054] S32, because the initialization vector IV, the first encryption block Block1 and the second encryption block Block2 are of equal length, all n bits, and are spliced in the order of IV+Block1+Block2, the initialization vector IV can be obtained by reading the first n bits of the splicing result Char, and then the first encryption block Block1 and the second encryption block Block2 are obtained; through the initialization vector IV and the SM4 key Key SM4 Decrypt the first encrypted block Block1 and the second encrypted block Block2 to obtain the high-order part and the lower part Specifically including: through SM4 key SM4 Decrypt the first encrypted block Block1 to obtain the first intermediate data Decrypted_block1, perform XOR on the first intermediate data Decrypted_block1 and the initialization vector IV to obtain the high-order part Through SM4 key SM4 Decrypt the second encrypted block Block2 to obtain the second intermediate data Decrypted_block2, perform XOR on the second intermediate data Decrypted_block2 and the first encrypted block Block1 to obtain the low-order part The high part of the and the lower part Perform splicing to obtain the first PCR value

[0055] S33, the authentication server runs the log file of the first system Perform remote certification based on the first system operation log Calculate the PCR value of the entire system at that time system, check the PCR value at that time system Is there a difference between the first PCR value and the If there is no matching item, the IoT device is not secure; otherwise, the IoT device is secure and a certificate is issued for the IoT device.

[0056] Exemplarily, after the IoT device receives the certificate information sent by the gateway device, it verifies whether the certificate is secure based on the hash algorithm specified by the certificate public key and the certificate algorithm field. The IoT device uses the hash algorithm specified in the certificate signature algorithm field to calculate the hash value of the body content of the current certificate, and then uses the certificate public key to decrypt the certificate to obtain the hash value of the certificate content encrypted by the CA with the private key. The two hash values are compared. If the two hash values are the same, the certificate information is secure, and the device certificate and certificate public key are stored. Otherwise, the certificate information is not secure, discarded, and a new certificate is applied for. In the communication with the IoT verification server, the IoT device accesses the IoT verification server and relies on the certificate to complete the security verification when the device accesses. Step S4 specifically includes the following steps:

[0057] S41. After the IoT verification server receives the certificate information sent by the authentication server, the IoT verification server calculates the third hash value through the hash algorithm corresponding to the certificate signature algorithm field, and the third hash value is the hash value of the current certificate body; then the certificate is decrypted according to the certificate public key to obtain the fourth hash value, and the fourth hash value is the hash value of the certificate content encrypted by the certificate authority CA with the private key; the third hash value and the fourth hash value are compared; if the comparison results are consistent, the IoT verification server remotely requests to obtain the device number corresponding to the device certificate, and when the remote request is made, the IoT verification server sends its public key to the IoT device. The device number and certificate are stored in the form of a key-value pair, and the valid bit of the key-value pair is set to 0; the device number includes the serial number, IMEI number and RFID tag; CA is the Certificate Authority, which is the authoritative organization responsible for issuing and managing digital certificates. The CA signature is the result of encrypting the hash value of the certificate body;

[0058] S42. After receiving the certificate information sent by the authentication server, the gateway device sends the certificate information to the IoT device; the IoT device verifies whether the certificate information is secure. If it is secure, the IoT device stores the certificate and the certificate public key, specifically including: the IoT device calculates the third hash value and the fourth hash value, and then compares the third hash value and the fourth hash value. If the comparison results are consistent, the certificate information is stored; if the comparison results are inconsistent, a new certificate is applied for.

[0059] For example, after holding the certificate, when the IoT device communicates with the IoT verification server, it needs to apply for access to the IoT verification server first; specifically, when the IoT device needs to communicate with the IoT verification server, it needs to apply for access to the server first, first send an access request, and enter its device ID. and device certificates Enter the request message msg request middle: Among them, the device number Do not transmit in plain text, use the public key of the IoT verification server to number the device Encrypt the request information msg request Send to the gateway device, the gateway device will request information msg request The IoT verification server then sends the device ID to the IoT verification server. The server then searches the locally stored certificate entries for the same device ID. If not, the device is deemed unsafe and access is denied. The server then verifies the security of the certificate. Based on the device certificate in the request, the server checks whether the certificate in the request matches the certificate stored in the matching entry. If they are identical and the valid bit is 0, the device is allowed access. If the certificates are different or the valid bit is 1, the device is deemed unsafe and access is denied.

[0060] For example, the flow chart of the IoT authentication server saving the certificate and authenticating the device access is as follows: Figure 8 As shown, the IoT verification server first checks whether the certificate information sent by the authentication server is indeed the one sent by the authentication server. If so, it performs the certificate storage operation. The IoT verification server calculates the hash value of the current certificate content using the hash algorithm specified in the certificate signature algorithm field. It then decrypts the certificate using the certificate's public key to obtain the hash value of the certificate content encrypted with the CA's private key. The two hash values are compared. If the two hash values are identical, the certificate is secure and the certificate and public key are stored. Otherwise, the certificate is insecure and discarded. Next, the device number corresponding to the device certificate is remotely obtained, and the IoT verification server's public key is sent to the IoT device for subsequent information transmission. The IoT device encrypts the device number using the IoT verification server's public key and sends it to the IoT verification server via the gateway device. The IoT verification server decrypts the device number and stores it with the certificate as a key-value pair, setting the valid bit of the key-value pair to 0.

[0061] For example, the process diagram of an IoT device applying to access an IoT verification server is as follows: Figure 4As shown in the figure, the steps for an IoT device to apply for access to the IoT verification server are as follows: Send a request message, where the request message includes the encrypted device number and device certificate. The key used for encryption is the public key of the IoT verification server; the gateway device forwards the request message to the IoT verification server; the IoT verification server accepts the request message and obtains the device number and device certificate. The process diagram of the IoT verification server saving the certificate and verifying device access is shown in the figure. Figure 8 As shown, after receiving the request information sent by the gateway device, the IoT verification server uses the private key to decrypt and obtain the device number, and then obtains the device certificate. Based on the device number, it searches for a matching entry corresponding to the device number. If a match is found, the device certificate in the matching entry is checked for consistency with the device certificate in the request information. If they are consistent and the valid bit is 0, the device is secure and the device is allowed to access. Otherwise, as long as the certificates are inconsistent or the valid bit is not 0, the device is unsafe and the device is denied access. If the device is secure, the IoT verification server sends feedback information to the gateway device to allow the device to access, and the gateway device forwards the feedback information to the IoT device. If the device is secure, the device's access request is accepted. If the device is secure, feedback information is sent to the gateway device to allow the device to access, and the gateway device forwards the feedback information to the IoT device.

[0062] The present invention provides a method for verifying the security of access to an Internet of Things device, which is used to solve the problem that the security of the device cannot be guaranteed when the Internet of Things device communicates and transmits data with an Internet of Things verification server. The method comprises: encrypting the device number and the device certificate as request information, and then sending the request information to the gateway device; the gateway device sends the request information to the Internet of Things verification server; the Internet of Things verification server verifies the security of the device access, and accepts the device's access request if it is safe. This application effectively solves the problems of static credentials being vulnerable to attacks, poor compatibility of heterogeneous devices, and insufficient data privacy protection in traditional solutions through multi-layer technical means such as device-side encryption of PCR values and system logs, preliminary hash verification of the gateway, deep decryption and integrity verification of the authentication server, final review of the Internet of Things verification server, and certificate distribution. The dynamic encryption and randomized PCR values of this application improve the ability to resist replay attacks; dual verification of the gateway and the server ensures the integrity of the data; end-to-end encryption and remote attestation mechanisms can prevent firmware-level tampering; the integration of national secret algorithms throughout the entire process meets the security and compliance requirements of national information, and provides a highly secure, highly compatible, and implementable device access solution for large-scale Internet of Things environments.

[0063] The foregoing description is merely a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein and should not be construed as excluding other embodiments. Rather, the present invention can be used in various other combinations, modifications, and environments and can be modified within the scope of the concept described herein through the above teachings or techniques or knowledge in the relevant field. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention are intended to be protected by the appended claims.

Claims

1. A method for access security verification of an Internet of Things device, characterized in that: The following steps are involved: S1: The IoT device applies for a certificate, obtains and encrypts the first PCR value and the first system operation log of the IoT device, obtains the second PCR value and the second system operation log, performs a hash operation on the second PCR value and the second system operation log through SM3 to obtain a second hash value, and encrypts the key to obtain an encryption key; The second PCR value, the second system operation log, the second hash value and the encryption key are used to form a final encrypted message, and then the IoT device sends the encrypted message to the gateway device; the first PCR value and the second PCR value represent the first hash value of the components that record the system startup process and runtime; S2. Gateway device processing: The gateway device receives and verifies the encrypted information sent by the IoT device. If the verification is successful, the gateway device sends the encrypted information to the authentication server; if the verification is unsuccessful, the encrypted information is discarded; S3: The authentication server receives and verifies the encrypted information sent by the gateway device. If the verification is successful, the security of the gateway device is verified again; if the security of the encrypted information and the gateway device are both verified, a device certificate for the IoT device is generated, and the authentication server sends the certificate information to the gateway device and the IoT verification server. The certificate information includes the device certificate and the certificate public key; S4, certificate distribution and storage, the IoT verification server verifies and stores the received certificate information; After receiving the certificate information, the gateway device forwards the certificate information to its corresponding IoT device. The corresponding IoT device verifies the certificate information and stores the certificate information after the verification is passed.

2. The method for access security verification of an Internet of Things device according to claim 1, characterized in that: Step S1 specifically includes the following steps: S11. Combine random numbers to obtain IoT device D in a random manner i The first PCR value Specifically include: generating 128-bit random numbers through the random number generator RNG RNG , and the number of PCR registers PCR count Perform a modulo operation, and then obtain the first PCR value based on the index obtained after the modulo operation. S12, use the national secret SM4 and combine it with the CBC mode to check the first PCR value Encrypt and obtain the second PCR value Specifically, it includes: using a cryptographically secure pseudo-random number generator CSPRNG to generate a random number as the initialization vector IV in the CBC mode; obtaining the first PCR value Divide into two PCR groups of the same length, including the high part and the lower part Use the initialization vector IV as the high-order part The encryption parameter is the high part Perform XOR with the initialization vector IV to obtain the first XOR result, and use the SM4 encryption algorithm to encrypt the first XOR result to obtain the first encrypted block Block1: Then the first encrypted block Block1 and the low-order part Perform XOR to obtain the second XOR result, and use the SM4 encryption algorithm to encrypt the second XOR result to obtain the second encrypted block Block2: The number of random numbers generated by the cryptographically secure pseudo-random number generator CSPRNG is consistent with the number of bits in the encrypted PCR packet; S13. Obtaining the first system operation log Use the public key of the authentication server pub Run log for the first system Encryption, obtain the second system operation log S14, splicing the second PCR value and the second system operation log Use the national secret SM3 to perform a hash operation on the splicing result to obtain a second hash value; specifically including: obtaining the second PCR value After that, the initialization vector IV, the first encryption block Block1, the second encryption block Block2 are spliced in this order, and then combined with the second system operation log Directly splice to obtain the splicing result Char: Use the national secret SM3 to perform hash operation on the splicing result Char Get the second hash value S15. The IoT device requests the public key of the authentication server from the gateway device. pub , using the public key of the authentication server pub , SM4 key used for encryption SM4 Encrypt to obtain the encryption key Key pub (Key SM4 ); Finally, the second PCR value, the second system operation log, the second hash value and the encryption key form an encrypted message Key pub (Key SM4 )),in IoT device D i Encrypted information Sent to the gateway device.

3. The method for access security verification of an Internet of Things device according to claim 2, characterized in that: Step S2 specifically includes: the gateway device receives the encrypted information sent by the IoT device Use the national secret SM3 to encrypt information The second PCR value in and the second system operation log Perform security verification Get the first security verification result Hash GATE , Hash the security verification result GATE With encrypted information The second hash value in Perform a comparison. If the comparison results are consistent, the gateway device will encrypt the information. Forwarded to the authentication server, if the comparison results are inconsistent, the encrypted information Not secure, information will be encrypted throw away.

4. The method for access security verification of an Internet of Things device according to claim 3, characterized in that: Step S3 specifically includes the following steps: S31, the authentication server receives the encrypted information sent by the gateway device After that, the encrypted information The second PCR value in and the second system operation log Perform security verification: Get the second security verification result Hash server , Hash the second security verification result server With encrypted information The second hash value in Perform a comparison. If the comparison results are inconsistent, encrypt the information. Not secure, information will be encrypted Discard; if the comparison results are consistent, the authentication server uses the private key to decrypt the encryption key Key pub (Key SM4 ) and the second system operation log Get the SM4 key SM4 and the first system operation log S32, the authentication server reads the first n bits of the splicing result Char to obtain the initialization vector IV, and then obtains the first encryption block Block1 and the second encryption block Block2; through the initialization vector IV and the SM4 key Key SM4 Decrypt the first encrypted block Block1 and the second encrypted block Block2 to obtain the high-order part and the lower part Specifically including: through SM4 key SM4 Decrypt the first encrypted block Block1 to obtain the first intermediate data Decrypted_block1, perform XOR on the first intermediate data Decrypted_block1 and the initialization vector IV to obtain the high-order part Through SM4 key SM4 Decrypt the second encrypted block Block2 to obtain the second intermediate data Decrypted_block2, perform XOR on the second intermediate data Decrypted_block2 and the first encrypted block Block1 to obtain the low-order part The high part of the and the lower part Perform splicing to obtain the first PCR value S33, the authentication server runs the log file of the first system Perform remote certification based on the first system operation log Calculate the PCR value of the entire system at that time system , check the PCR value at that time system Is there a difference between the first PCR value and the If there is no identical matching item, the IoT device is not secure; otherwise, the IoT device is secure and a certificate is issued to it.

5. The method for access security verification of an Internet of Things device according to claim 4, characterized in that: Step S4 specifically includes the following steps: S41. After the IoT verification server receives the certificate information sent by the authentication server, the IoT verification server calculates a third hash value using the hash algorithm corresponding to the certificate signature algorithm field, where the third hash value is the hash value of the body of the current certificate; then, the IoT verification server decrypts the certificate using the certificate public key to obtain a fourth hash value, where the fourth hash value is the hash value of the certificate content encrypted by the certificate authority CA using the private key; the IoT verification server compares the third hash value and the fourth hash value; if the comparison results are consistent, the IoT verification server remotely requests to obtain the device number corresponding to the device certificate, and upon remote request, the IoT verification server sends its public key to the IoT device; the device number and certificate are stored in a key-value pair, and the valid bit of the key-value pair is set to 0; the device number includes the serial number, IMEI number, and RFID tag; S42. After receiving the certificate information sent by the authentication server, the gateway device sends the certificate information to the IoT device; the IoT device verifies whether the certificate information is secure. If it is secure, the IoT device stores the certificate and the certificate public key, specifically including: the IoT device calculates the third hash value and the fourth hash value, and then compares the third hash value and the fourth hash value. If the comparison results are consistent, the certificate information is stored; if the comparison results are inconsistent, a new certificate is applied for.

Images