Equipment authentication method and device, Internet of Things equipment and storage medium

Abstract

The invention relates to an equipment authentication method and device, Internet of Things equipment and a storage medium, and the method comprises the steps: determining a working key from at least one key, encrypting data through employing the working key, and obtaining an encrypted data package; a key addressing identifier corresponding to the working key is determined, and the at least one key and the key addressing identifier corresponding to the at least one key are obtained by the equipment from a key database in advance according to an equipment key uniqueness strategy and are burnt to the local of the equipment to be stored, so that the at least one key and the key addressing identifier corresponding to the at least one key are obtained; and sending the encrypted data packet and the key addressing identifier to a server, so that the server executes the following authentication operations: searching a working key corresponding to the key addressing identifier from a key database, decrypting the encrypted data packet by using the working key, and determining that the equipment authentication is successful under the condition that the decryption is successful. Therefore, the security and reliability of communication between the equipment and the server are improved, and the requirements of the development of the Internet of Things on high security and high reliability of the authentication technology are met.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a device authentication method, apparatus, Internet of Things device, and storage medium. Background Art

[0002] With the rapid growth of IoT devices, secure authentication between devices and servers has become crucial. Pre-shared key authentication was widely adopted in the early days of the IoT due to its ease of use. The principle is that devices and servers pre-store the same key for encrypted communication.

[0003] However, in real-world applications, IoT devices face complex usage scenarios and multiple risks, including cyberattacks and physical theft. Once the pre-shared key is leaked, attackers can disguise themselves as legitimate devices and use it to maliciously access servers, tamper with data, and perform other attacks, posing a serious threat to system security.

[0004] As security requirements in areas such as smart homes and industrial Internet of Things continue to increase, the security risks of pre-shared key authentication have become increasingly prominent. It is difficult to meet the development of the Internet of Things' demand for high security and high reliability in authentication technology, and improvement is urgently needed. Summary of the Invention

[0005] To address the aforementioned technical issues that urgently need improvement, such as the increasing security requirements in smart homes, industrial IoT, and other fields, where pre-shared key authentication is increasingly vulnerable to security risks, making it difficult to meet the IoT's demand for high security and high reliability in authentication technology, this application provides a device authentication method, apparatus, IoT device, and storage medium. The specific technical solutions are as follows:

[0006] In a first aspect, the present application provides a device authentication method, applied to a device, the method comprising:

[0007] Determining a working key from at least one key, and encrypting data using the working key to obtain an encrypted data packet;

[0008] Determining a key addressing identifier corresponding to the working key, wherein at least one of the keys and the key addressing identifier corresponding to each key are obtained by the device in advance from a key database according to a device key uniqueness policy and burned into the device for local storage;

[0009] Send the encrypted data packet and the key addressing identifier to the server, so that the server performs the following authentication operations:

[0010] The working key corresponding to the key addressing identifier is searched in the key database, the encrypted data packet is decrypted using the working key, and if the decryption is successful, it is determined that the device authentication is successful.

[0011] In an optional embodiment, determining the working key from at least one key includes:

[0012] For any key, obtain the environment adaptability score, object matching score, and device status compatibility score corresponding to the key;

[0013] determining a working score of the key according to the environmental adaptability score, the object matching score, and the device status compatibility score;

[0014] At least one of the keys is sorted according to the work score, and a working key is determined from the at least one key according to the sorting result.

[0015] In an optional embodiment, determining the key operation score according to the environment adaptability score, the object matching score, and the device status compatibility score includes:

[0016] Acquire a physical environment and a network environment, and determine an environmental factor weight of the environmental adaptability score according to the physical environment and the network environment;

[0017] Obtaining object identity data and object behavior data, and determining an object factor weight of the object matching score based on the object identity data and the object behavior data;

[0018] Acquire device operation data, and determine a device status factor weight of the device status compatibility score based on the device operation data;

[0019] The environmental adaptability score, the environmental factor weight, the object matching score, the object factor weight, the device status compatibility score, and the device status factor weight are weighted and summed to obtain the key working score.

[0020] In an optional embodiment, before executing the method, the method further includes:

[0021] Sending a key acquisition request to a production server, and receiving at least one key and the corresponding key addressing identifier returned by the production server in response to the key acquisition request;

[0022] Burn at least one of the keys and the key addressing identifiers corresponding to each key into the device for local storage;

[0023] The production server responds to the key acquisition request by performing the following operations to return at least one of the keys and the key addressing identifiers corresponding to each key:

[0024] Determining the security level of the device and searching for a key type corresponding to the security level;

[0025] Obtaining at least one key belonging to the key type from the key database according to a device key uniqueness policy;

[0026] Obtaining the key addressing identifier corresponding to at least one of the keys from the key database;

[0027] At least one of the keys and the key addressing identifier corresponding to each key are returned to the device.

[0028] In an optional embodiment, before executing the method, the method further includes:

[0029] Sending a key acquisition request to a production server, and receiving at least one key and the corresponding key addressing identifier returned by the production server in response to the key acquisition request;

[0030] Burn at least one of the keys and the key addressing identifiers corresponding to each key into the device for local storage;

[0031] The production server responds to the key acquisition request by performing the following operations to return at least one of the keys and the key addressing identifiers corresponding to each key:

[0032] Determine the region or function type of the device, and search for a key type corresponding to the region or function type;

[0033] Obtaining at least one key belonging to the key type from the key database according to a device key uniqueness policy;

[0034] Obtaining the key addressing identifier corresponding to at least one of the keys from the key database;

[0035] At least one of the keys and the key addressing identifier corresponding to each key are returned to the device.

[0036] In an optional embodiment, the device key uniqueness strategy includes a device key probabilistic uniqueness strategy;

[0037] The obtaining, from the key database, at least one key belonging to the key type according to the device key uniqueness policy comprises:

[0038] Determine an application scenario of the device, and search for a selection quantity of the key corresponding to the application scenario;

[0039] The selected number of keys belonging to the key type are obtained from the key database according to a device key probabilistic uniqueness strategy.

[0040] In an optional embodiment, the device key uniqueness strategy includes a device key probabilistic uniqueness strategy;

[0041] The obtaining, from the key database, at least one key belonging to the key type according to the device key uniqueness policy comprises:

[0042] Obtaining a total number of keys in the key database and a key collision probability threshold;

[0043] Determining the number of keys to be selected based on the total number of keys and the key collision probability threshold;

[0044] The selected number of keys belonging to the key type are obtained from the key database according to a device key probabilistic uniqueness strategy.

[0045] In an optional embodiment, the key and the corresponding key addressing identifier in the key database are generated by:

[0046] Obtaining a key type set, wherein the key type set includes a plurality of different key types;

[0047] For any of the key types, determining a key generation strategy corresponding to the key type, and generating a key belonging to the key type using the key generation strategy;

[0048] A key addressing identifier corresponding to the key is generated, and the key addressing identifier and the key are stored in a key database.

[0049] In a second aspect, the present application provides a device authentication apparatus, applied to a device, the apparatus comprising:

[0050] a key determination module, configured to determine a working key from at least one key, and encrypt data using the working key to obtain an encrypted data packet;

[0051] an identification determination module, configured to determine a key addressing identifier corresponding to the working key, wherein at least one of the keys and the key addressing identifier corresponding thereto are obtained by the device in advance from a key database according to a device key uniqueness policy and burned into the device for local storage;

[0052] The device authentication module is used to send the encrypted data packet and the key addressing identifier to the server so that the server performs the following authentication operations: searching the working key corresponding to the key addressing identifier from the key database, decrypting the encrypted data packet using the working key, and determining that the device authentication is successful if the decryption is successful.

[0053] In a third aspect, an Internet of Things device is provided, comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0054] Memory for storing computer programs;

[0055] The processor is configured to implement any one of the device authentication methods described in the first aspect above when executing a program stored in the memory.

[0056] In a fourth aspect, a storage medium is further provided, wherein instructions are stored in the storage medium, and when the storage medium is run on a computer, the computer executes any one of the device authentication methods described in the first aspect.

[0057] In a fifth aspect, a computer program product comprising instructions is also provided, which, when executed on a computer, enables the computer to execute any of the above-described device authentication methods.

[0058] The above-mentioned technical solution provided by the embodiment of the present application has the following advantages over the prior art: the device authentication method provided by the embodiment of the present application determines a working key from at least one key, encrypts data using the working key to obtain an encrypted data packet, and determines a key addressing identifier corresponding to the working key, wherein at least one key and each corresponding key addressing identifier are obtained by the device in advance from a key database in accordance with a device key uniqueness policy, and burned into the device for local storage, and the encrypted data packet and the key addressing identifier are sent to the server so that the server performs the following authentication operation: searching for the working key corresponding to the key addressing identifier from the key database, decrypting the encrypted data packet using the working key, and determining that the device authentication is successful if the decryption is successful.

[0059] In this way, the device obtains a batch of keys and their corresponding key addressing identifiers from the key database in advance according to the device key uniqueness policy, and burns them to the device for local storage. This ensures the uniqueness of each device key and reduces the risk of duplication, thereby greatly reducing the risk of key leakage and increasing the security and reliability of communication between the device and the server, which can meet the development of the Internet of Things for high security and high reliability of authentication technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0061] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0062] One or more embodiments are exemplarily illustrated by pictures in the corresponding drawings. These exemplifications do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings are represented as similar elements. Unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0063] Figure 1 A schematic diagram of an implementation flow of a device authentication method provided in an embodiment of the present application;

[0064] Figure 2 A schematic diagram of an implementation flow of another device authentication method provided in an embodiment of the present application;

[0065] Figure 3 A schematic diagram of an implementation flow of a key generation method provided in an embodiment of the present application;

[0066] Figure 4 A schematic diagram of an implementation flow of a key storage method provided in an embodiment of the present application;

[0067] Figure 5 A schematic diagram of an implementation flow of another device authentication method provided in an embodiment of the present application;

[0068] Figure 6 A schematic diagram of the structure of a device authentication apparatus provided in an embodiment of the present application;

[0069] Figure 7 A schematic diagram of the structure of an Internet of Things device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0070] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0071] The disclosure below provides many different embodiments or examples for implementing different structures of the present application. In order to simplify the disclosure of the present application, the components and settings of specific examples are described below. Of course, these are merely examples and are not intended to limit the present application. In addition, the present application may repeat reference numbers and / or letters in different examples. Such repetition is for the purpose of simplicity and clarity and does not in itself indicate the relationship between the various embodiments and / or settings discussed.

[0072] like Figure 1 FIG. 1 is a schematic diagram of an implementation flow of a device authentication method provided in an embodiment of the present application. The method is applied to a device (e.g., an IoT device) and may specifically include the following steps:

[0073] S101, determining a working key from at least one key, and encrypting data using the working key to obtain an encrypted data packet.

[0074] In an embodiment of the present application, for a device, such as an IoT device, after the user determines to turn on the networking function, he needs to communicate with the IoT device server. To this end, he needs to determine a working key from at least one key, and use the working key to encrypt the data to obtain an encrypted data packet.

[0075] It should be noted that the data can be the data of the device, and the method of determining the working key can be random or pseudo-random. In this way, a key is randomly or pseudo-randomly selected from at least one key as the working key, and the data of the device is encrypted using the working key to obtain an encrypted data packet. The embodiments of the present application do not limit this.

[0076] For example, there are 10 keys. A key is randomly selected from the 10 keys as a working key. The working key is used to encrypt the data of the device to obtain an encrypted data packet.

[0077] S102, determining a key addressing identifier corresponding to a working key, wherein at least one key and its corresponding key addressing identifier are obtained by the device in advance from a key database according to a device key uniqueness policy and burned into the device for local storage.

[0078] In an embodiment of the present application, for each key, there is a corresponding key addressing identifier, for example, the key addressing identifier is a serial number (index), the serial number (index) corresponds one-to-one to the key, and a unique key can be determined based on the serial number.

[0079] Based on this, for the working key, the key addressing identifier corresponding to the working key can be determined. The key addressing identifier is used to inform the server which key the device used to encrypt the data, and the corresponding server also uses the key to decrypt the encrypted data packet.

[0080] The at least one key and the key addressing identifier corresponding thereto are obtained by the device in advance from a key database according to a device key uniqueness policy, and are burned into the device for local storage.

[0081] It should be noted that the device key uniqueness strategy includes the device key deterministic uniqueness strategy and the device key probabilistic uniqueness strategy. The device key deterministic uniqueness strategy, for example, refers to a key acquisition method with fixed rules or algorithms, which can theoretically ensure that the key obtained by each device is an absolutely unique key, and there is no possibility of duplication (the collision probability is 0). The device key probabilistic uniqueness strategy, for example, refers to a random or pseudo-random key acquisition method, which probabilistically guarantees the uniqueness of the key obtained by each device, and there is an extremely low probability of duplication (the collision probability is extremely low but non-zero). The embodiments of the present application do not limit this.

[0082] For example, the mainboard of an IoT device needs to be burned with an embedded program before it rolls off the production line. During this process, the device randomly queries a certain number (for example, 10) of keys from the key database through the production server, and burns the keys and their serial numbers into the device for storage.

[0083] S103, sending the encrypted data packet and the key addressing identifier to the server so that the server performs the following authentication operations: searching the working key corresponding to the key addressing identifier from the key database, decrypting the encrypted data packet using the working key, and determining that the device authentication is successful if the decryption is successful.

[0084] It should be noted that the encrypted data packet and key addressing identifier obtained in the above steps can be sent to the server. The encrypted data packet and key addressing identifier can be sent separately, for example, by adding the key addressing identifier to the URL of the request to the IoT server and placing the encrypted data packet in the request body.

[0085] For the server, it can receive the encrypted data packet and the key addressing identifier, search the working key corresponding to the key addressing identifier from the key database, use the working key to decrypt the encrypted data packet, and if the decryption is successful, it is determined that the device authentication is successful, and the authentication success can be returned to the device. In addition, if the decryption fails, it means that there is a problem with the device and it may be forged by an attacker. At this time, it can be determined that the device authentication has failed.

[0086] If the device authentication is successful, the device can conduct subsequent communication with the server, and the specific communication process is similar to the above authentication process. After obtaining the data, the device determines the working key from at least one key, uses the working key to encrypt the data to obtain an encrypted data packet, determines the key addressing identifier corresponding to the working key, and sends the encrypted data packet and the key addressing identifier to the server. The server searches the key database for the working key corresponding to the key addressing identifier, and uses the working key to decrypt the encrypted data packet to obtain the data.

[0087] In addition, the above decryption failure may be caused by a problem with the device, perhaps forged by an attacker, or by a server sending a key update command to the device, but the device did not update its own key after responding. Therefore, in the event of a decryption failure, the system checks whether a key update command has been sent to the device. If not, the device authentication is determined to have failed. Otherwise, the device is prompted to re-authenticate.

[0088] Through the above description of the technical solution provided in the embodiment of the present application, a working key is determined from at least one key, data is encrypted using the working key to obtain an encrypted data packet, and a key addressing identifier corresponding to the working key is determined, wherein at least one key and each corresponding key addressing identifier are obtained by the device in advance from a key database in accordance with the device key uniqueness policy, and burned to the device for local storage. The encrypted data packet and the key addressing identifier are sent to the server so that the server performs the following authentication operation: search for the working key corresponding to the key addressing identifier from the key database, decrypt the encrypted data packet using the working key, and determine that the device authentication is successful if the decryption is successful.

[0089] In this way, the device obtains a batch of keys and their corresponding key addressing identifiers from the key database in advance according to the device key uniqueness policy, and burns them to the device for local storage. This ensures the uniqueness of each device key and reduces the risk of duplication, thereby greatly reducing the risk of key leakage and increasing the security and reliability of communication between the device and the server, which can meet the development of the Internet of Things for high security and high reliability of authentication technology.

[0090] In addition, in an embodiment of the present application, for determining the working key, in addition to randomly or pseudo-randomly selecting a key from at least one key as the working key, factors such as the key's environmental adaptability, object matching, and device status compatibility can also be comprehensively considered to obtain the key's working score, thereby selecting a suitable key as the working key based on the working score.

[0091] Based on this, Figure 2FIG. 1 is a schematic diagram of an implementation flow of another device authentication method provided in an embodiment of the present application. The method is applied to a device (e.g., an IoT device) and may specifically include the following steps:

[0092] S201: For any key, obtain the environment adaptability score, object matching score, and device status compatibility score corresponding to the key.

[0093] S202: Determine the working score of the key according to the environment adaptability score, the object matching score, and the device status compatibility score.

[0094] S203 , sorting the at least one key according to the work score, determining a working key from the at least one key according to the sorting result, and encrypting the data using the working key to obtain an encrypted data packet.

[0095] In an embodiment of the present application, for a device, such as an IoT device, after the user determines to turn on the networking function, the user needs to communicate with the IoT device server. To this end, a working key needs to be determined from at least one key. Here, factors such as the key's environmental adaptability, object matching, and device status compatibility can be comprehensively considered to obtain a working score of the key, and then a suitable key can be selected as the working key based on the working score.

[0096] During the device initialization phase, each key needs to be pre-configured with a multi-dimensional score, as follows:

[0097] Environmental adaptability score: The score is based on the security performance of the key in different physical and network environments, for example, the full score is 100.

[0098] For example, for high temperature and high humidity environments, keys designed to be resistant to high temperatures and moisture-proof have an environmental adaptability score of 90 points, while ordinary keys are easily affected by the environment and have a score of only 60 points.

[0099] For example, in a high-interference network environment, a quantum key distribution derived key with strong anti-interference capabilities can score up to 95 points; traditional symmetric keys may cause encryption instability due to signal interference and score 70 points.

[0100] Object matching score: The score is based on the user permission level to which the key applies.

[0101] For example, a key used only for ordinary user data queries has a permission matching score of 80 points due to its low encryption requirements.

[0102] Device status compatibility score: This score considers the adaptability of the key under different device operating states.

[0103] For example, a key that can still operate efficiently and consumes low power when the device is low on battery has a device status compatibility score of 90 points.

[0104] For example, a key that requires high computing resources and is prone to lag when the device is low on power or has insufficient performance will only be scored 50 points.

[0105] In addition, there are corresponding default weights for the environmental adaptability score, object matching score, and device status compatibility score. During device operation, the weights of each dimension are dynamically adjusted based on the real-time collected environment, object (such as user) and device status data.

[0106] To this end, for any key, the environmental adaptability score, object matching score, and device status compatibility score corresponding to the key are obtained, and the working score of the key is determined based on the environmental adaptability score, object matching score, and device status compatibility score. At least one key is sorted according to the working score, and a working key is determined from at least one key based on the sorting result. The data is encrypted using the working key to obtain an encrypted data packet.

[0107] It should be noted that at least one key is sorted from large to small according to the work score, and then the key ranked first can be selected as the working key, and the data can be encrypted using the working key to obtain an encrypted data packet. This embodiment of the present application does not limit this.

[0108] Among them, the environment adaptability score, object matching score, and device status compatibility score each have corresponding default weights. The environment adaptability score, object matching score, and device status compatibility score can be weighted and summed to obtain the key's working score.

[0109] In addition, given that the environment, objects (such as users) and device status data are changing in real time, the weights of each dimension can be dynamically adjusted based on the environment, objects (such as users) and device status data collected in real time.

[0110] Based on this, the physical environment and the network environment are obtained, and the environmental factor weights of the environmental adaptability score are determined according to the physical environment and the network environment. The object identity data and the object behavior data are obtained, and the object factor weights of the object matching score are determined according to the object identity data and the object behavior data. The device operation data is obtained, and the device status factor weights of the device status compatibility score are determined according to the device operation data. The environmental adaptability score, the environmental factor weights, the object matching score, the object factor weights, the device status compatibility score, and the device status factor weights are weighted and summed to obtain the working score of the key.

[0111] For example, physical environment data includes sensor data such as temperature, humidity, geographic location (via GPS or Bluetooth positioning), and vibration frequency; network environment data includes signal strength, latency, connected base station / AP ID, and current network bandwidth. When a device detects a high-risk physical environment (e.g., temperature exceeding 80°C, humidity greater than 90%), the weight of environmental factors is increased from the default 30% to 40%, highlighting the importance of environmental adaptability scores in key selection. If the network environment is unstable (e.g., network latency > 500ms, signal strength < -80dBm), the weight of environmental factors is also increased to 40%, prioritizing keys that perform well in poor network conditions.

[0112] For example, user identity data includes user ID, permission level (e.g., administrator / normal user), and device group; and user behavior data includes operation frequency, historical access history, and the type of task currently being performed (e.g., data collection / device control). If an administrator is detected performing a sensitive operation (e.g., modifying device parameters or deleting data), the user's permission weight is increased from the default 30% to 35% to ensure key security. If the user is performing routine data viewing, the user's permission weight remains at 30% or is appropriately reduced.

[0113] For example, device operation data includes: device online time, remaining battery life, firmware version, and whether it is in an abnormal alarm state. When the device battery life is below 20%, the device status weight is increased from the default 40% to 45%, giving priority to low-power keys. If the device is in an abnormal alarm state (such as a firmware version vulnerability), the device status weight is increased to 50%, ensuring that keys compatible with the device status are selected to reduce security risks.

[0114] For example, the environmental adaptability score of a key is 80 points, the user matching score is 70 points, the device status compatibility score is 90 points, the current environment weight is 40%, the user authority weight is 30%, and the device status weight is 30%. The total weighted score is 80×0.4+70×0.3+90×0.3=32+21+27=80.

[0115] S204, determining a key addressing identifier corresponding to the working key, wherein at least one key and its corresponding key addressing identifier are obtained by the device in advance from a key database according to a device key uniqueness policy and burned into the device for local storage.

[0116] In the embodiment of the present application, this step is similar to the above-mentioned step S102, and the embodiment of the present application will not be repeated here.

[0117] S205, sending the encrypted data packet and the key addressing identifier to the server so that the server performs the following authentication operations: searching the working key corresponding to the key addressing identifier from the key database, decrypting the encrypted data packet using the working key, and determining that the device authentication is successful if the decryption is successful.

[0118] In the embodiment of the present application, this step is similar to the above-mentioned step S103, and the embodiment of the present application will not be repeated here.

[0119] By comprehensively considering factors such as the key's environmental adaptability, object matching, and device status compatibility, a key's working score is obtained, and then a suitable key is selected as the working key based on the working score. In addition, by pre-obtaining a batch of keys and their corresponding key addressing identifiers from the key database according to the device key uniqueness policy and burning them into the device for local storage, the uniqueness of each device key is ensured, the risk of duplication is reduced, and the risk of key leakage is greatly reduced. This increases the security and reliability of communication between the device and the server, meeting the demand for high security and high reliability of authentication technology in the development of the Internet of Things.

[0120] In the embodiments of the present application, the keys and corresponding key addressing identifiers in the key database can be randomly generated, meaning that the key database contains a large number of pre-randomly generated keys and corresponding key addressing identifiers. Furthermore, given that the data encrypted by the keys may be either confidential or ordinary data, the corresponding keys should be differentiated, for example, using a more secure and complex key to encrypt confidential data, while using a relatively secure and complex key to encrypt ordinary data.

[0121] Based on this, Figure 3 FIG. 1 is a schematic diagram of an implementation flow of a key generation method provided in an embodiment of the present application. The method is applied to a server and may specifically include the following steps:

[0122] S301: Acquire a key type set, where the key type set includes multiple different key types.

[0123] In an embodiment of the present application, a key type set is obtained, wherein the key type set includes multiple different key types. For example, the key type can be a common key or a confidential key.

[0124] S302: For any key type, determine a key generation strategy corresponding to the key type, and generate a key belonging to the key type using the key generation strategy.

[0125] In the embodiment of the present application, each key type in the key type set has its own corresponding key generation strategy, and the key generation strategies of different key types are different.

[0126] To this end, for any key type, a key generation strategy corresponding to the key type is determined, and keys belonging to the key type are generated using the key generation strategy. A preset number (e.g., 100,000) of keys belonging to the key type are generated using the key generation strategy.

[0127] For example, for a common-level key, a random number can be generated as the key; for a confidential-level key, a key can be generated based on the device ID, MAC address, etc.

[0128] For example, for a common-level key, a 20-bit random number may be generated as the key, and for a confidential-level key, a 28-bit random number may be generated as the key.

[0129] S303: Generate a key addressing identifier corresponding to the key, and store the key addressing identifier and the key in a key database.

[0130] In an embodiment of the present application, for the key generated above, a key addressing identifier corresponding to the key is generated, and the key addressing identifier and the key are stored in a key database. The key addressing identifier corresponding to the key can be generated in a random manner.

[0131] Based on this, different key types are generated, and different devices have different security levels, requiring different keys. Therefore, before a device leaves the production line, it can request the key type and key addressing identifier corresponding to its security level from the production server, and then burn it to the device for local storage.

[0132] Based on this, Figure 4 FIG. 1 is a schematic diagram of an implementation flow of a key storage method provided in an embodiment of the present application. The method is applied to a device (e.g., an IoT device) and may specifically include the following steps:

[0133] S401: Send a key acquisition request to a production server, and receive at least one key and their corresponding key addressing identifiers returned by the production server in response to the key acquisition request.

[0134] S402: Burn at least one key and its corresponding key addressing identifier to the device for local storage.

[0135] In an embodiment of the present application, a device (such as an IoT device) needs to have an embedded program burned before it comes off the production line. During this process, the device sends a key acquisition request to the production server, and receives at least one key and each corresponding key addressing identifier returned by the production server in response to the key acquisition request, and burns the at least one key and each corresponding key addressing identifier to the device locally for storage.

[0136] Among them, for the production server, in response to the key acquisition request, the following operations can be performed to return at least one key and the corresponding key addressing identifier: determine the security level of the device and find the key type corresponding to the security level; obtain at least one key belonging to the key type from the key database according to the device key uniqueness policy; obtain the key addressing identifier corresponding to at least one key from the key database; and return at least one key and the corresponding key addressing identifier to the device.

[0137] For example, for a production server, it can determine the security level of the IoT device: ordinary level, find the key type corresponding to the security level: ordinary level key, obtain at least one key belonging to this key type from the key database according to the device key uniqueness policy, obtain the key addressing identifier corresponding to at least one key from the key database, and return at least one key and the corresponding key addressing identifier to the IoT device.

[0138] Furthermore, corresponding to the aforementioned security levels, devices may be divided into different areas or functions. For example, some IoT devices belong to the core area, while others belong to the edge area. Or, some IoT devices are used only for video surveillance, while others are used for security. Therefore, devices in different areas or with different functions require different keys. Therefore, before a device leaves the production line, it can request the key and key addressing identifier corresponding to its area or function type from the production server, and then burn it to the device for local storage.

[0139] Based on this, for devices (such as IoT devices), embedded programs need to be burned before they come off the production line. During this process, the device sends a key acquisition request to the production server, and receives at least one of the keys and the corresponding key addressing identifiers returned by the production server in response to the key acquisition request, and burns at least one of the keys and the corresponding key addressing identifiers to the device locally for storage.

[0140] Among them, for the production server, in response to the key acquisition request, the following operations can be performed to return at least one of the keys and the corresponding key addressing identifiers: determine the region or function type of the device, search for the key type corresponding to the region or function type, obtain at least one of the keys belonging to the key type from the key database according to the device key uniqueness policy, obtain the key addressing identifier corresponding to at least one of the keys from the key database, and return at least one of the keys and the corresponding key addressing identifier to the device.

[0141] For example, for a production server, it is possible to determine the area to which the IoT device belongs: the core area, find the key type corresponding to the area: the confidential-level key, obtain at least one key of the key type from the key database according to the device key uniqueness policy, obtain the key addressing identifier corresponding to at least one key from the key database, and return the at least one key and the corresponding key addressing identifier to the IoT device.

[0142] In addition, in the embodiments of the present application, the device key uniqueness strategy includes a deterministic device key uniqueness strategy and a probabilistic device key uniqueness strategy. The probabilistic device key uniqueness strategy, for example, refers to a random or pseudo-random key acquisition method. The random or pseudo-random key acquisition method probabilistically guarantees the uniqueness of the key obtained by each device, with an extremely low probability of duplication (the probability of collision is extremely low but non-zero). To this end, the probabilistic device key uniqueness strategy can be adopted in the process of acquiring the key.

[0143] Based on this, the above-mentioned obtaining of at least one key belonging to the key type from the key database according to the device key uniqueness strategy can specifically be to determine the application scenario of the device, find the selected number of keys corresponding to the application scenario, and obtain the selected number of keys belonging to the above-mentioned key type from the key database according to the device key probabilistic uniqueness strategy.

[0144] For example, if the application scenario is a simple scenario (such as one-time device authentication), 10 keys are usually sufficient. Since the number of devices is limited and the key is only used for a single verification, the collision probability is acceptable. Therefore, 10 keys belonging to the above key types are randomly obtained from the key database.

[0145] For example, if the application scenario is a complex scenario (such as long-term communication encryption, large-scale device network), the number of keys needs to be increased (for example, 50 to 100) to support security strategies such as key rotation and group encryption, and reduce the risk of brute force cracking. To this end, 50 to 100 keys belonging to the above key types are randomly obtained from the key database.

[0146] In addition, an acceptable key collision probability threshold (e.g., Pmax = 10 -6 ), and the key collision probability threshold can ensure that the probability of key duplication between devices is within an acceptable range, thereby avoiding security vulnerabilities caused by key collisions. The total number of keys in the key database and the key collision probability threshold are obtained. Based on the total number of keys and the key collision probability threshold, a selection number of keys is determined. The selected number of keys belonging to the key type are obtained from the key database according to the device key probabilistic uniqueness strategy.

[0147] The total number of keys and the key collision probability threshold can be input into the following formula to calculate the number of keys to be selected k.

[0148]

[0149] Where N is the total number of keys and Pmax is the key collision probability threshold. For example, N = 10 5 , Pmax=10 -6 When k≈15, 15 keys belonging to the above key types are randomly obtained from the key database.

[0150] The device authentication method provided by the embodiment of the present application is described below with reference to specific embodiments. Figure 5 As shown, the following steps are included:

[0151] First, the key database contains a large number of pre-generated keys, and the keys have corresponding serial numbers, and the two correspond one to one.

[0152] IoT device motherboards require an embedded program to be burned before they roll off the production line. During this process, each device randomly queries a certain number of keys (e.g., 10) from a key database on a production server and burns them into the device for storage. The motherboards are then assembled into complete devices and sold to users.

[0153] After a user purchases a device and confirms that it has enabled networking, the device communicates with the IoT server. It randomly selects a key from a pool of stored keys (e.g., 10) to encrypt its data and then sends the encrypted data packet to the server. However, when sending the data, the parameter index is added to the URL it uses to request the IoT server (e.g., https: / / www.bxx.com / iot / index=10002). The value of index is the serial number of the key just selected.

[0154] After receiving the encrypted data packet from the device, the IoT server searches the key database for the key with the corresponding serial number through the index, and then uses the key to decrypt the encrypted data packet just received from the device. If the key can be decrypted, it means that the device is normal; if the key cannot be decrypted, it means that there is a problem with the device and it may be forged by an attacker.

[0155] A pre-shared key is a key that is stored in advance on a device and a server. The device then uses this key for encrypted communication with the server. Once the key is leaked, an attacker can disguise themselves as a "device" and use the key to attack the server, posing a certain security risk.

[0156] In this application, a large number of keys (100,000 or even more) can be randomly generated. A batch (10) of keys can be randomly selected before the device leaves the factory. When the device is connected to the network, one key is randomly selected from its own batch (10) to communicate with the server for encrypted communication. The random process greatly reduces the risk of key leakage, completes the IoT device authentication process without network configuration, and greatly increases the security of the system.

[0157] Corresponding to the above method embodiment, the present application embodiment also provides a device authentication device, which is applied to a device, such as Figure 6 As shown, the apparatus may include: a key determination module 610 , an identification determination module 620 , and a device authentication module 630 .

[0158] A key determination module 610 is configured to determine a working key from at least one key, and encrypt data using the working key to obtain an encrypted data packet;

[0159] an identifier determination module 620 for determining a key addressing identifier corresponding to the working key, wherein at least one of the keys and the key addressing identifier corresponding thereto are obtained by the device in advance from a key database according to a device key uniqueness policy and burned into the device for local storage;

[0160] The device authentication module 630 is used to send the encrypted data packet and the key addressing identifier to the server so that the server performs the following authentication operations: searching for the working key corresponding to the key addressing identifier from the key database, decrypting the encrypted data packet using the working key, and determining that the device authentication is successful if the decryption is successful.

[0161] The present application also provides an Internet of Things device, such as Figure 7 As shown, it includes a processor 71, a communication interface 72, a memory 73 and a communication bus 74, wherein the processor 71, the communication interface 72, and the memory 73 communicate with each other through the communication bus 74.

[0162] Memory 73, for storing computer programs;

[0163] The processor 71 is configured to execute the program stored in the memory 73 to implement the following steps:

[0164] Determine a working key from at least one key, encrypt data using the working key to obtain an encrypted data packet; determine a key addressing identifier corresponding to the working key, wherein at least one of the keys and the corresponding key addressing identifier are obtained by the device in advance from a key database in accordance with a device key uniqueness policy, and burned into the device for local storage; send the encrypted data packet and the key addressing identifier to a server, so that the server performs the following authentication operation: search for the working key corresponding to the key addressing identifier from the key database, decrypt the encrypted data packet using the working key, and determine that the device authentication is successful if the decryption is successful.

[0165] The communication bus mentioned in the IoT devices mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into address buses, data buses, control buses, etc. For ease of illustration, the figure uses only a single thick line, but this does not mean that there is only one bus or only one type of bus.

[0166] The communication interface is used for communication between the above IoT devices and other devices.

[0167] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage. Alternatively, the memory may be at least one storage device located away from the processor.

[0168] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.

[0169] In another embodiment provided by the present application, a storage medium is further provided. The storage medium stores instructions, which, when executed on a computer, enable the computer to execute the device authentication method described in any one of the above embodiments.

[0170] In another embodiment provided by the present application, a computer program product including instructions is further provided, which, when executed on a computer, enables the computer to execute the device authentication method described in any one of the above embodiments.

[0171] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a storage medium or transmitted from one storage medium to another. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0172] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0173] Each embodiment in this specification is described in a related manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiment is generally similar to the method embodiment, so the description is relatively simple. For related parts, refer to the description of the method embodiment.

[0174] The above description is only a preferred embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the scope of protection of the present application.

Claims

1. A device authentication method, characterized in that: Applied to a device, the method includes: Determining a working key from at least one key, and encrypting data using the working key to obtain an encrypted data packet; Determining a key addressing identifier corresponding to the working key, wherein at least one of the keys and the key addressing identifier corresponding to each key are obtained by the device in advance from a key database according to a device key uniqueness policy and burned into the device for local storage; Send the encrypted data packet and the key addressing identifier to the server, so that the server performs the following authentication operations: The working key corresponding to the key addressing identifier is searched in the key database, the encrypted data packet is decrypted using the working key, and if the decryption is successful, it is determined that the device authentication is successful.

2. The method according to claim 1, characterized in that Determining the working key from at least one key includes: For any key, obtain the environment adaptability score, object matching score, and device status compatibility score corresponding to the key; determining a working score of the key according to the environmental adaptability score, the object matching score, and the device status compatibility score; At least one of the keys is sorted according to the work score, and a working key is determined from the at least one key according to the sorting result.

3. The method according to claim 2, characterized in that The determining the working score of the key according to the environment adaptability score, the object matching score, and the device status compatibility score includes: Acquire a physical environment and a network environment, and determine an environmental factor weight of the environmental adaptability score according to the physical environment and the network environment; Obtaining object identity data and object behavior data, and determining an object factor weight of the object matching score based on the object identity data and the object behavior data; Acquire device operation data, and determine a device status factor weight of the device status compatibility score based on the device operation data; The environmental adaptability score, the environmental factor weight, the object matching score, the object factor weight, the device status compatibility score, and the device status factor weight are weighted and summed to obtain the working score of the key.

4. The method according to claim 1, wherein Before executing the method, the method further includes: Sending a key acquisition request to a production server, and receiving at least one key and the corresponding key addressing identifier returned by the production server in response to the key acquisition request; Burn at least one of the keys and the key addressing identifiers corresponding to each key into the device for local storage; The production server responds to the key acquisition request by performing the following operations to return at least one of the keys and the key addressing identifiers corresponding to each key: Determining a security level of the device and searching for a key type corresponding to the security level; Obtaining at least one key belonging to the key type from the key database according to a device key uniqueness policy; Obtaining the key addressing identifier corresponding to at least one of the keys from the key database; At least one of the keys and the key addressing identifier corresponding to each key are returned to the device.

5. The method according to claim 1, wherein Before executing the method, the method further includes: Sending a key acquisition request to a production server, and receiving at least one key and the corresponding key addressing identifier returned by the production server in response to the key acquisition request; Burn at least one of the keys and the key addressing identifiers corresponding to each key into the device for local storage; The production server responds to the key acquisition request by performing the following operations to return at least one of the keys and the key addressing identifiers corresponding to each key: Determine the region or function type of the device, and search for a key type corresponding to the region or function type; Obtaining at least one key belonging to the key type from the key database according to a device key uniqueness policy; Obtaining the key addressing identifier corresponding to at least one of the keys from the key database; At least one of the keys and the key addressing identifier corresponding to each key are returned to the device.

6. The method according to claim 4 or 5, characterized in that The device key uniqueness strategy includes a device key probabilistic uniqueness strategy; The obtaining, from the key database, at least one key belonging to the key type according to the device key uniqueness policy comprises: Determine an application scenario of the device, and search for a selection quantity of the key corresponding to the application scenario; The selected number of keys belonging to the key type are obtained from the key database according to a device key probabilistic uniqueness strategy.

7. The method according to claim 4 or 5, characterized in that The device key uniqueness strategy includes a device key probabilistic uniqueness strategy; The obtaining, from the key database, at least one key belonging to the key type according to the device key uniqueness policy comprises: Obtaining a total number of keys in the key database and a key collision probability threshold; Determining the number of keys to be selected based on the total number of keys and the key collision probability threshold; The selected number of keys belonging to the key type are obtained from the key database according to a device key probabilistic uniqueness strategy.

8. The method according to claim 4 or 5, characterized in that The keys and corresponding key addressing identifiers in the key database are generated in the following manner: Obtaining a key type set, wherein the key type set includes a plurality of different key types; For any of the key types, determining a key generation strategy corresponding to the key type, and generating a key belonging to the key type using the key generation strategy; A key addressing identifier corresponding to the key is generated, and the key addressing identifier and the key are stored in a key database.

9. A device authentication apparatus, characterized in that: Applied to equipment, the device comprises: a key determination module, configured to determine a working key from at least one key, and encrypt data using the working key to obtain an encrypted data packet; an identification determination module, configured to determine a key addressing identifier corresponding to the working key, wherein at least one of the keys and the key addressing identifier corresponding thereto are obtained by the device in advance from a key database according to a device key uniqueness policy and burned into the device for local storage; The device authentication module is used to send the encrypted data packet and the key addressing identifier to the server so that the server performs the following authentication operations: searching the working key corresponding to the key addressing identifier from the key database, decrypting the encrypted data packet using the working key, and determining that the device authentication is successful if the decryption is successful.

10. An Internet of Things device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory for storing computer programs; A processor, configured to implement the method according to any one of claims 1 to 8 when executing a program stored in a memory.

11. A storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images