IoT Data Security Acquisition System and Method Based on Distributed Digital Identity

Abstract

The application discloses an Internet of Things data security acquisition system and method based on distributed digital identity, relates to the technical field of Internet of Things security, and comprises the following steps: generating and publishing the D ID identity information of device owners, data users and Internet of Things devices to a D ID infrastructure, and establishing the unique identity of each entity; when the data user subscribes to data from the device owner, completing two-way authentication based on the D ID identity information; after authentication, the data user provides the Internet of Things device node and the subscribed field to the device owner, the device owner issues the available Internet of Things device in an authorization voucher, and completes data access authorization; the data user accesses the Internet of Things device through the authorization voucher issued by the device owner, and the Internet of Things device verifies the data user according to the authorization voucher; end-to-end encryption technology is adopted to guarantee the privacy and integrity of data in the transmission process, and third-party secure storage is supported.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and more specifically to an IoT data security collection system and method based on distributed digital identity. Background Technology

[0002] With the widespread application of IoT technology, IoT devices face numerous security challenges during data collection, transmission, and use. Traditional solutions generally rely on centralized institutions (such as CAs) for identity authentication and access control, which poses a single point of failure risk and affects system availability and scalability. Meanwhile, at data collection nodes, some solutions introduce hardware such as security chips, FPGAs, and PUFs to ensure device trustworthiness. While this improves security, it increases equipment cost and energy consumption, making it difficult to meet the demands of low-cost, low-power IoT deployments.

[0003] In terms of data transmission, existing technologies mostly employ encrypted communication mechanisms, but they still face threats such as man-in-the-middle attacks and replay attacks. In terms of data storage, centralized architectures are prone to data leakage and service interruption. Although blockchain has the characteristic of being immutable, its consensus mechanism is complex and resource-intensive, which seriously affects data processing efficiency and makes it difficult to meet the needs of high-frequency, low-latency IoT services.

[0004] Decentralized identity (DID) technology has been explored for application in the Internet of Things (IoT) field in recent years, with initial progress made, particularly in device authentication and access control. However, existing research mainly focuses on authorization mechanisms and lacks systematic consideration of end-to-end secure transmission, efficient storage, and multi-role collaborative management, thus failing to form a security solution covering the entire process of data collection, transmission, and use.

[0005] Therefore, there is an urgent need for a new security architecture that is free from centralized dependence and does not rely on blockchain. This architecture should be able to ensure the security of data collection and sharing while also taking into account performance and flexibility, and support the construction of dynamic trust relationships between device owners, the devices themselves, and data users, thereby achieving a new model of efficient, secure, and scalable IoT data management. Summary of the Invention

[0006] In view of this, the present invention provides an IoT data security collection system and method based on distributed digital identity. It adopts a distributed architecture to solve the problem of central dependency and eliminates the dependence on blockchain at the business level based on the trust relationship between device owners, devices and data users, which greatly improves the security and efficiency of IoT data collection and application.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] An IoT data security collection system based on distributed digital identity includes:

[0009] The acquisition layer includes various IoT devices, all of which have a DID digital identity.

[0010] Transport layer: responsible for data aggregation and forwarding;

[0011] User layer: includes device owners and data users, with device owners and data users separated;

[0012] DID infrastructure: Open to the acquisition layer, transmission layer and user layer, providing storage and retrieval of DID identity information;

[0013] Storage infrastructure: Open to the acquisition layer, transmission layer and user layer, and supports third-party secure storage.

[0014] IoT data security collection methods based on distributed digital identity include:

[0015] Identity registration phase: Generate and publish DID identity information of device owners, data users and IoT devices to the DID infrastructure to establish a unique identity for each entity;

[0016] Data subscription phase: When a data user subscribes to data from a device owner, two-way authentication is completed based on the DID identity information; after successful authentication, the data user provides the device owner with the IoT device node and the subscribed fields, and the device owner issues the usable IoT device in the authorization credentials to complete the data access authorization;

[0017] Data access authentication phase: Data users access IoT devices through authorization credentials issued by the device owner, and the IoT devices verify the data users based on the authorization credentials;

[0018] Data security transmission and storage phase: End-to-end encryption technology is used to ensure the privacy and integrity of data during transmission, while also supporting third-party secure storage.

[0019] Preferably, during the identity registration phase, device owners, data users, and IoT devices generate their own DID identity information, which includes a DID number, public key, private key, and DID document. The DID number, public key, private key, and DID document are stored locally, and the DID number, public key, and DID document are published to the DID infrastructure and made public.

[0020] Preferably, the two-way authentication process during the data subscription phase specifically includes:

[0021] Data users obtain the device owner's DID number, public key, and DID document from the DID infrastructure;

[0022] Data users encrypt their own D ID number and random number rand based on the device owner's public key. A And the serial number SN, and send the encrypted result E1 to the device owner;

[0023] Device owners obtain the data user's DID number, public key, and DID document from the DID infrastructure;

[0024] The device owner decrypts the encrypted result E1 using their private key, obtaining the data user's D ID number and random number rand. A and serial number SN;

[0025] The device owner encrypts a random number (rand) based on the data user's public key. B Random number rand A And sequence number SN+1, and send the encrypted result E2 to the data user;

[0026] The data user decrypts the encrypted result E2 using their private key to obtain a random number rand. B Random number rand A With serial number SN+1, the data user confirms the identity of the device owner;

[0027] Data users encrypt a random number rand again based on the device owner's public key. B And serial number SN+2, and send the encrypted result E3 to the device owner;

[0028] The device owner decrypts the encrypted result E3 using their private key, confirms the identity of the data user, and completes two-way authentication.

[0029] Preferably, data access authorization specifically includes:

[0030] Data users send a list of fields they need to subscribe to {s1,s2,...,s} to the device owner. h} and a list of IoT devices {IoT1, IoT2, ..., IoT k};

[0031] The hash H of the device owner's calculated field list s =H(s1,s2,...,s) h ,rand s ), where rand s Random numbers are used to obfuscate hash values;

[0032] The device owner independently calculates a hash for each subscribed IoT device using the IoT device's DID number, the IoT device's public key, and a random number as input, thus obtaining a list of device hashes.

[0033] The device owner calculates the hash using the data user's D ID number, the data user's public key, and a random number as input.

[0034] The device owner uses hash H s Device hash list and hash Calculate the hash H for the input vc ;

[0035] Encapsulate license credentials VC i :

[0036]

[0037] Encrypt(H vc Sk j (Sign the credential data) This consists of the data user's DID number, the data user's public key, and a random number. For each IoT device in the list of IoT devices, the D ID number, public key, and a random number are required.

[0038] The device owner encrypts authorization credentials (VC) based on the data user's public key. i It is then sent to the data user and saved.

[0039] Preferably, the data access authentication phase specifically includes:

[0040] When a data user submits their authorization credentials to an IoT device, authentication information related to the target IoT device is extracted from the authorization credentials and encapsulated into a verifiable credential (VP). i After encryption, the credentials (VP) are sent to the target IoT device for verification. i The list of fields containing the subscription {s1,s2,...,s} h}, DID information of the target IoT device, random number rand A Serial number (SN) and data user's DID information;

[0041] The target IoT device receives verifiable credentials (VP) i Then, using your own private key, you can decrypt the data and obtain the field information {s1,s2,...,s}. h ,rand s IoT device information Data user information Serial number (SN), hash list and credential data signing Encrypt(H vc Sk j );

[0042] Hash of the target IoT device's computed field list

[0043] IoT device information verification Verify that the information is correct for the target IoT device and calculate the target IoT device hash.

[0044] The target IoT device calculates the user identity information hash.

[0045] Hash H s H, target IoT device hash dx ′ and identity information hash Hash again to get

[0046] Encrypt(H) signature from credential data using the device owner's public key. vc Sk j Extract hash H from ) vc Verification with H vc If they match, the signature verification is successful; otherwise, the verification fails.

[0047] The target IoT device encrypts a random number (rand) using its own private key. A And sequence number SN+1, sent to the data user;

[0048] The data user decrypts the target IoT device's public key to obtain a random number rand. A The serial number SN+1 confirms the identity of the target IoT device.

[0049] Preferably, the data security transmission and storage phase specifically includes:

[0050] IoT devices generate data encryption key K i ;

[0051] IoT devices use the data user's public key to encrypt the key K i Encrypted as information M;

[0052] The IoT device sends information M to the storage device;

[0053] The storage device saves the information M after receiving it.

[0054] IoT devices will use encryption key K iAll collected data is encrypted, and the encrypted data C is sent to the storage device;

[0055] The storage device saves the encrypted data C after receiving it.

[0056] As can be seen from the above technical solutions, compared with the prior art, the present invention discloses an IoT data security collection system and method based on distributed digital identity, realizing the data access authorization, transmission and storage process based on distributed trusted infrastructure; the business layer does not require on-chain operation, and the authentication speed is improved by 90%; end-to-end encryption and dynamic authorization mechanisms ensure data security throughout the entire life cycle; it is applicable to multiple scenarios and supports complex requirements such as separation of device owners and users. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0058] Figure 1 The flowchart illustrates the IoT data security collection method based on distributed digital identity provided by this invention.

[0059] Figure 2 The system architecture diagram provided for this invention.

[0060] Figure 3 The flowchart of the two-way authentication process provided by this invention.

[0061] Figure 4 A flowchart for data access authorization provided for this invention.

[0062] Figure 5 The flowchart for verifying user identity data provided by this invention.

[0063] Figure 6 A flowchart illustrating the data security storage process provided for this invention. Detailed Implementation

[0064] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] This embodiment addresses the security issues of data acquisition, transmission, and storage during the Internet of Things (IoT) data collection process by proposing an innovative solution based on distributed digital identity (DID). Therefore, it adopts... Figure 2 The system architecture shown is divided into a data acquisition layer, a transmission layer, and a user layer, distributing the collection, transmission, and use of data. Considering complex application scenarios such as smart cities, smart healthcare, and smart transportation, device owners and data users are separated. Simultaneously, the DID infrastructure and storage infrastructure are open to all layers. **Acquisition Layer:** This layer consists of various IoT devices, all of which possess a DID digital identity. This digital identity information is written into the hardware at the factory and cannot be tampered with. IoT devices are responsible for collecting data, and the data user's authorization credentials send the corresponding information to a designated location via an encrypted channel. **Transmission Layer:** Responsible for data aggregation and forwarding. This invention uses point-to-point encryption for data transmission, and there are no special requirements for the transmission method and topology used in the transmission layer; therefore, it includes various network transmission forms and topologies such as Wi-Fi and ADHOC. **User Layer:** Includes users such as device owners and data users. **DID Infrastructure:** Provides storage and retrieval of DID identity information. The infrastructure can be based on technologies such as blockchain or distributed ledgers, and its functions and structure comply with relevant W3C standards. **Storage Infrastructure:** Provides computing facilities for IoT device storage, including databases and cloud services.

[0066] This invention discloses a method for secure data collection in the Internet of Things (IoT) based on distributed digital identity, such as... Figure 1 As shown, it includes:

[0067] Identity registration phase: Generate and publish DID identity information of device owners, data users and IoT devices to the DID infrastructure to establish a unique identity for each entity;

[0068] Data subscription phase: When a data user subscribes to data from a device owner, two-way authentication is completed based on the DID identity information; after successful authentication, the data user provides the device owner with the IoT device node and the subscribed fields, and the device owner issues the usable IoT device in the authorization credentials to complete the data access authorization;

[0069] Data access authentication phase: Data users access IoT devices through authorization credentials issued by the device owner, and the IoT devices verify the data users based on the authorization credentials;

[0070] Data security transmission and storage phase: End-to-end encryption technology is used to ensure the privacy and integrity of data during transmission, while also supporting third-party secure storage.

[0071] During the identity registration phase, all entities that need to register a DID generate their own DID identity information and publish their DID documents to the DID infrastructure. Define a set E = {e1, e2, ..., e...}. m} represents all entities in the system, where E did This represents the set of entities that need to register DID identity information, where For example, E = {Device Owner, Data User, Cloud Storage, IoT-1, IoT-2, K, IoT-n}, where IoT-1, IoT-2, K, and IoT-n represent multiple IoT devices. Cloud storage does not affect system security even without registering a DID, therefore E... did ={Device Owner, Data User, IoT-1, IoT-2, K, IoT-n}. After successful registration... The value of d ranges from (1, m). It stores its D ID number, public key, private key, and D ID document locally, while also exposing the D ID number, public key, and D ID document in the D ID infrastructure.

[0072] During the data subscription phase: Data users subscribe to the data they need from device owners. When subscribing, data users need to provide their DID (Digital ID) identity information, IoT device node details, and the fields they are subscribing to. The device owner verifies the data user's identity and issues authorization credentials containing information such as usable IoT devices and accessible data. The data user set is defined as follows: The set of device owners is k represents the total number of device owners, which is the same as the number of IoT devices. Towards The process of subscribing to data is as follows Figure 3 As shown, this invention proposes a two-way identity authentication mechanism based on distributed digital identity, comprising:

[0073] Data user u i Get device owner o j The DID number, public key, and DID document.

[0074] Data user u i Using the equipment owner o j public key Pk j Encrypt your own DID number (DID) i ), random number rand A And the serial number SN, and send the encrypted result E1 to the device owner. j .

[0075] Equipment owner o j Data user ui The DID number, public key, and DID document information.

[0076] Equipment owner o j Use your private key Sk j Decrypt E1 to obtain {DID} i ,rand A ,SN}.

[0077] Equipment owner o j Data user u i public key Pk i Encrypt your own random number rand B Random number rand A And sequence number SN+1, and send the encrypted result E2 to data user u. i .

[0078] Data user u i Use your private key Sk i Decrypt E2 to get {rand A rand B ,SN+1}. By correctly decrypting rand A Data user u i The owner of the equipment can be identified. j identity.

[0079] Data user u i Use the equipment owner o j public key Pk j Encrypt the random number rand again B And serial number SN+2, and send the encrypted result E3 to the device owner. j .

[0080] Equipment owner o j Use your private key Sk j Decrypt E3 to obtain rand correctly. B And SN+2, device owner o j It can be confirmed that the data user u i Identity verification completed.

[0081] Data access authorization process: Assume data user u i To the equipment owner j Subscribe to the collected data of h fields from k IoT devices, where the k devices are denoted as {IoT1, IoT2, K, IoT}. k}, where h fields are denoted as {s1, s2, ..., s h}, in data user u i and equipment owner o jAfter completing two-way authentication, data user u i To the equipment owner j The process of applying for and issuing authorization credentials is as follows: Figure 4 As shown.

[0082] Data user u i To the equipment owner j Send the list of fields to be subscribed to {s1,s2,...,s} h} and a list of IoT devices {IoT1, IoT2, ..., IoT k}

[0083] Equipment owner o j Calculate the list {s1,s2,...,s} h ,rand s The hash H of} s =H(s1,s2,...,s) h ,rand s ), where rand s The random number is used to obfuscate the hash value.

[0084] Equipment owner o j Using the IoT device's DID number, public key, and a random number as input, a hash is independently calculated for each subscribed IoT device to obtain a list of device hashes.

[0085] Equipment owner o j Data user u i The hash is calculated using the D ID, the data user's public key, and a random number as input. in and This allows data users and devices to obtain DID information from the blockchain without having to access it again during subsequent authentication processes.

[0086] With H s , and Calculate the hash H for the input vc .

[0087] Encapsulate verifiable credentials.

[0088]

[0089] Encrypt(H vc Sk j () is used to sign credential data for data integrity verification.

[0090] Equipment owner o jVC based on data user public key encryption authorization credentials i And sent to data user u i And save it.

[0091] Data access authentication process: In this stage, data users access IoT devices using authorization credentials issued by the device owner. The IoT device verifies the data user's identity and credentials before proceeding with the authentication process. During this process, the IoT device can only verify the data user's legitimacy and cannot access information about other collected devices. Data user u i IoT devices x When acquiring data, IoT x Will verify its controller. j The process of issuing the voucher is as follows: Figure 5 As shown.

[0092] Data user u i IoT devices x When submitting its authorization credentials, it is necessary to obtain them from the authorization credentials VC. i Extraction and target IoT devices x The relevant authentication information is encapsulated into a verifiable credential (VP). i Encrypted and sent to the target IoT device x .

[0093] This includes the subscription field information {s1,s2,...,s h}, DID information of the target IoT device random number rand A Serial number (SN) and data user (u) i DID information

[0094] Target Internet of Things (IoT) devices x Receive verifiable credentials (VP) i Then, by decrypting with your own private key, you can obtain the subscription field information {s1,s2,...,s}. h ,rand s IoT device information Data user u i information and the hash list used for verification And device owner's credentials data signing Encrypt(H vc Sk j ).

[0095] The target IoT device computes the hash H of the list of subscribed fields. s =H(s1,s2,...,s) h ,rands ).

[0096] IoT device information verification Is it a target IoT device? x Correct information, and calculate the target IoT device hash.

[0097] Computational data user u i Identity information hash

[0098] Hash all hashes again to get

[0099] Using the device owner's public key within the device From credential data signing Encrypt(H vc Sk j Extract H from ) vc Verification with H vc Are they consistent?

[0100] Target Internet of Things (IoT) devices x Based on your own private key Sk x Encrypted random number rand A And sequence number SN+1, send to u i .

[0101] Data user u i Using target IoT devices x Public Key Pk x Decryption yields a random number {rand} A ,SN+1}, confirm the target IoT device x identity.

[0102] Due to the equipment owner o j The issued credentials encapsulate the IoT device. x and data user u i The DID information is obtained without needing to read it from the blockchain during the above process. This is because, according to the W3C standard, a DID can declare one or more controllers. In this invention... By declaring its controller in the "controller" and "publicKey" fields of the DID document. j Information ∈O, that is, the owner's public key Pk declared in its D ID document. j Verify device owner o j The issued certificate.

[0103] Secure data transmission and storage: Each subscriber's data will be independently encrypted. Data user ui IoT devices x After submitting the data collection authorization, if you specify that the collected data should be stored in device S l IoT devices x Data security will be protected through data encryption, the process of which is as follows: Figure 6 As shown.

[0104] Internet of Things (IoT) devices x Generate data encryption key K i .

[0105] Internet of Things (IoT) devices x Encryption key K i Data user u i Public Key Pk i Encrypted as M, only for data user u i Only M can be solved.

[0106] Internet of Things (IoT) devices x Send M to storage device S l .

[0107] Storage device S l After receiving M, save the data.

[0108] Internet of Things (IoT) devices x Encryption key K i All collected data (such as temperature, humidity, pressure, etc.) is encrypted, and the encrypted data C is sent to the storage device S. l .

[0109] Storage device S l After receiving C, save the data.

[0110] In the above process, since all transmitted data is encrypted, neither the transmission channel nor the storage provider can decrypt it, and the data user u... i The encryption key K can be obtained by decrypting M with the private key. i This allows the data to be restored.

[0111] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0112] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for secure collection of data of Internet of Things based on distributed digital identity, characterized in that, Comprise: Identity registration stage: generating and issuing D ID identity information of device owner, data user and Internet of Things device to DID infrastructure, establishing unique identity of each entity; Data subscription stage: when data user subscribes data to device owner, completing two-way authentication based on D ID identity information; after authentication, data user provides Internet of Things device node and subscribed field to device owner, and device owner issues available Internet of Things device in authorization voucher, completing data access authorization; Data access authentication stage: data user accesses Internet of Things device through authorization voucher issued by device owner, and Internet of Things device verifies data user according to authorization voucher; Data security transmission and storage stage: end-to-end encryption technology is adopted to guarantee privacy and integrity of data in transmission process, and third-party secure storage is supported; In the identity registration stage, the device owner, data user and Internet of Things device generate their own D ID identity information, which includes D ID number, public key, private key and D ID document, wherein the D ID number, public key, private key and D ID document are saved locally, and the D ID number, public key and D ID document are published to the DID infrastructure and are public; The two-way authentication process in the data subscription stage specifically comprises: The data user obtains the D ID number, public key and D ID document of the device owner from the DID infrastructure; Data users encrypt their own D ID number and random number rand based on the device owner's public key. A And the serial number SN, and send the encrypted result E1 to the device owner; The device owner obtains the D ID number, public key and D ID document of the data user from the DID infrastructure; The device owner decrypts the encrypted result El based on the private key of the device owner to obtain the D ID number and the random number rand of the data user A and the serial number SN; The device owner encrypts the random number rand based on the data user public key B , the random number rand A , and the serial number SN+1, and sends the encryption result E2 to the data user; The data user decrypts the encrypted result E2 based on the private key of the data user to obtain the random number rand B , the random number rand A , and the serial number SN+1, and the data user confirms the identity of the device owner. The data user re-encrypts the random number rand based on the device owner public key B and sequence number SN+2, and sends the encryption result E3 to the device owner; The device owner decrypts the encrypted result E3 based on the private key of the device owner, the device owner confirms the identity of the data user, and completes the two-way authentication.

2. The distributed digital identity based IoT data security collection method of claim 1, wherein, The data access authorization specifically comprises: The data user sends to the device owner a list of fields {s1, s2,..., s h} that need to be subscribed and a list of IoT devices {IoT1, IoT2,..., IoT k}; The device owner computes a hash H of the list of fields s = H {s1, s2,..., s h , rand s}, where rand s is a random number used to obfuscate the hash value; The device owner independently calculates a hash for each subscribed IoT device with the D ID number of the IoT device, the public key of the IoT device, and a random number as input, obtaining a device hash list The device owner calculates a hash with the data user's D ID number, the data user's public key, and a random number as inputs The device owner computes a hash H s , a list of device hashes and a hash as input to compute a hash H vc ; Packaging authorization credentials VC i : Encrypt(H vc , Sk j ) is the signature of the credential data, DID i , rand u is the D ID number of the data user, the public key of the data user, and a random number, is the D ID number of each Internet of Things device in the Internet of Things device list, the public key of the Internet of Things device, and a random number; The device owner encrypts the authorization credential VC based on the public key of the data user i and sends to the data user and saves.

3. The distributed digital identity based IoT data security collection method of claim 2, wherein, The data access authentication stage specifically comprises: When a data user submits their authorization credentials to an IoT device, authentication information related to the target IoT device is extracted from the authorization credentials and encapsulated into a verifiable credential (VP). i After encryption, the credentials (VP) are sent to the target IoT device for verification. i The list of fields containing the subscription {s1,s2,...,s} h }, Information of the target IoT device, Random number rand A Serial number (SN) and information about the data user; Target IoT device receives verifiable credential VP i Post-uses own private key to decrypt, gets field information {s1, s2,..., s h , rand s}, IoT device information Data user information Serial number SN, hash list And credential data signature Encrypt(H vc , Sk j ); Target IoT device computes a hash H of the list of fields s H(s1,s2,...,s h ,rand s ); Verifying based on internet of things device information whether the information is correct for the target internet of things device, and computing a target internet of things device hash Target iot device computes data user identity information hash Hash H is computed s Target iot device hash H dx And identity information hash Hashed again to obtain Encrypt(H) signature from credential data using the device owner's public key. vc Sk j Extract hash H from ) vc Verification with H vc If they match, the signature verification is successful; otherwise, the verification fails. The target IoT device encrypts the random number rand based on its own private key A and the sequence number SN+1, and sends it to the data user; The data user decrypts the random number rand with the target IoT device public key A and the serial number SN+1, confirming the identity of the target IoT device.

4. The distributed digital identity based IoT data security collection method of claim 1, wherein, The data security transmission and storage stage specifically comprises: The IoT device generates a data encryption key K i ; The IoT device encrypts the key K based on the data user's public key i The encryption is the information M; The Internet of Things device sends information M to the storage device; The storage device saves the information M after receiving it; The IoT device will add the encryption key K i All collected data is encrypted and the encrypted data C is sent to the storage device; The storage device saves the encrypted data C after receiving it.

5. The system for secure data collection for IoT based on distributed digital identity, the system is used to implement the method of any one of claims 1-4, characterized in that, Comprise: Collection layer: including various Internet of Things devices, all of which have D ID digital identity; Transmission layer: responsible for data aggregation and forwarding; User layer: including device owner and data user, and the device owner and data user are separated; D ID infrastructure: open to collection layer, transmission layer and user layer, and provides storage and query of D ID identity information; Storage infrastructure: open to collection layer, transmission layer and user layer, and supports third-party secure storage.

Images