A Cloud-Edge Collaborative IoT Security Access Method

Abstract

This invention discloses a secure IoT access method based on cloud-edge collaboration, comprising the following steps: First, the IoT device and the edge server register with the CSC (Cloud Controller Service) to obtain smart cards or related data for information updates and storage; the device inserts a smart card to log in and sends data to the edge server after identity and password verification; the edge server verifies the timestamp and forwards the data to the CSC; the CSC verifies the timestamp and identity, generates session key parameters, and sends them to the edge server; the edge server verifies the CSC's identity, generates a session key, encrypts the data, and sends it back; after successful device verification, secure communication is established. This method employs mutual verification and encryption protection for identity verification; message transmission uses timestamps, random values, and strict verification to prevent replay and man-in-the-middle attacks; key management ensures security through dynamic changes in secret values, and combines PUF (Power-Only Function) to resist physical capture attacks, comprehensively ensuring communication security.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically a secure IoT access method based on cloud-edge collaboration. Background Technology

[0002] In recent years, the rapid development of new-generation information technologies, such as the Internet of Things (IoT) and 5G, has greatly promoted the development of the IoT industry. Cloud computing, due to its deployment methods, distance, and energy consumption limitations, has restricted its use in industry. Edge computing overcomes the disadvantage of cloud computing being far from terminal devices, making it a hot research topic. Cloud computing centrally uploads all tasks to the cloud for processing, leading to increased data transmission latency over the network; while edge computing establishes nodes at the network edge, close to the terminal, to provide services, alleviating the computational and network transmission pressures of cloud computing. In cloud-edge collaborative computing systems, the cloud service center deploys edge nodes, integrating intelligent applications and application service layer hardware, responsible for handling non-real-time, highly complex, and global data services, capable of meeting users' basic needs across diverse scenarios.

[0003] While cloud computing has matured significantly, security vulnerabilities persist. Edge computing, introduced not to replace cloud centers but to extend their capabilities, faces similar security challenges. Furthermore, its wider, more geographically dispersed, and multi-dimensional nature, coupled with complex communication processes, makes it more vulnerable to malicious attacks. Therefore, new cryptographic techniques are needed to ensure secure interaction in cloud-edge collaborative computing architectures. The transmission of large amounts of data over public channels in these architectures also raises concerns about privacy breaches and unauthorized access. Summary of the Invention

[0004] The purpose of this invention is to provide a secure IoT access method based on cloud-edge collaboration, in order to solve the problem in the prior art mentioned in the background that data is transmitted through public channels, which can easily lead to privacy leaks and unauthorized access.

[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0006] A secure IoT access method based on cloud-edge collaboration includes the following steps:

[0007] Step S1: IoT device registration. The device sends registration information to the CSC. After processing, the CSC issues a smart card, and the device completes the smart card content update.

[0008] Step S2: Edge server registration. The edge server sends a registration identifier to the CSC. After processing, the CSC returns the relevant data, and the edge server completes information storage.

[0009] Step S3: IoT device login. After inserting a smart card and completing identity and password verification, the device sends login-related data to the edge server.

[0010] Step S4: The edge server processes the request. After verifying the validity of the timestamp, the edge server generates relevant parameters and forwards the data to the CSC.

[0011] Step S5: Cloud server verification and session key preparation. CSC verifies the timestamp and device / edge server identity. After verification, session key related parameters are generated and sent to the edge server.

[0012] Step S6: Edge server verification and session key generation. The edge server verifies the CSC identity, generates a session key, and encrypts the data before returning it to the device. The device verifies the edge server identity and the session key, and establishes secure communication after confirming their legitimacy.

[0013] According to the above technical solution, in step S1, the registration of IoT devices includes:

[0014] Step S101, IoT device First, select a random number. Then enter the IoT device's identifier. ,calculate This represents the temporary public key, where P is the base point; the calculation result... Send it to the cloud server CSC via a secure channel;

[0015] Step S102, the cloud server center CSC receives Next, select a random number. Identity identifier of Cloud Server Center (CSC) Then calculate , , , , , , ; Represents the base point hash value. This represents a temporary public key. This represents the hash value of the temporary identity identifier. Indicates based on random numbers Intermediate value of temporary public key, Indicates the first hash value. Indicates the first intermediate value. Indicates signature, This represents the second hash value, where 's' represents the private key of the Cloud Service Center (CSC). This represents a hash operation;

[0016] CSC will Stored in the registry and issued as a smart card (SC), Stored in SC, and finally SC is sent to ;

[0017] Step S103, Upon receiving the smart card SC, a challenge is first generated. Calculate the corresponding response value In the formula, PUF represents a non-cloning function. , , , , In the formula, Indicates the first response value. This represents the first encrypted value. This represents the second encrypted value. Indicates the third hash value. Indicates signature, Represents a random number. Indicates the first intermediate value;

[0018] Then the information Update to smart card SC, where, The generated challenge value is used to generate the physical unclonable function value.

[0019] According to the above technical solution, in step S2, the edge server registration includes:

[0020] Step S201, Edge Server Select Identity and random numbers ,calculate Then send it to the CSC; in the formula Indicates the fourth hash value;

[0021] Step S202, CSC received Next, select a random number. ,calculate and and return it to In the formula, s represents the private key of the Cloud Service Center (CSC), and finally, the CSC stores... In the formula, This represents the fifth hash value. This represents the third encrypted value. Indicates the first identity value;

[0022] Step S203, when the edge server receive Then, calculate , Indicates the fourth encrypted value, then storage .

[0023] According to the above technical solution, in step S3, the IoT device login specifically involves: IoT device Insert their smart card SC and enter their identity. and password Through calculation In the formula, This represents the calculated hash value. This represents the hash value stored in SC. This represents the value calculated using the physically non-cloning function. This represents the first encrypted value. Represent the password value; then determine... Is it equal to ,judge Are your identity and password correct? and They are equal, then Login successful; Select random number and the current timestamp Then calculate , , , ,at last Will send To edge servers ;

[0024] In the formula, This represents the first temporary public key value. Represents the first secret value. This represents the fifth encrypted value. This represents the sixth hash value. Indicates signature, This means multiplying a point P on an elliptic curve by a scalar s using scalar multiplication; the value calculated here is... Represents the public key; ; This value It is saved to memory during registration.

[0025] According to the above technical solution, the edge server processes the request in step S4 as follows:

[0026] When the edge server take over Sent First, check the timestamp. Does it hold true? If not, then the edge server... Terminate communication immediately;

[0027] If true, select a random number. and current timestamp Then calculate , , , , , ,at last Will Send to cloud server CSC; where, This represents the second temporary public key value. This represents the second secret value. This represents the seventh hash value. This represents the sixth encrypted value. This represents the eighth hash value. Represents a random number.

[0028] According to the above technical solution, in step S5, the cloud server verification and session key preparation are specifically as follows:

[0029] When CSC receives the edge server Message sent First, check the timestamp. If the condition is not met, the CSC will immediately cease communication.

[0030] If true, CSC calculates , CSC approved Retrieve random numbers from the database ,calculate , , , , Then judge and Whether the above equation holds true; if the result is not equal, CSC will immediately terminate the communication; where, This represents the third secret value. This represents the fourth secret value. Indicates the second identity value. Indicates the third identity value. Indicates the verification value. This represents the ninth hash value. Represents the tenth hash value. This represents the eleventh hash value; The hash value is an intermediate value used to calculate the authentication value. ;

[0031] If the above equations are equal, then CSC will select a random number. and timestamp Then calculate , , , Finally, the CSC will Send to edge server In the formula, This represents the third temporary public key value. This represents the fifth secret value. This represents the twelfth hash value. This represents the thirteenth hash value.

[0032] According to the above technical solution, the edge server verification and session key generation in step S6 are as follows:

[0033] When the edge server Received a message from CSC First check Does it meet the requirements? Then calculate , , Then calculate and judge Whether or not Equal; in the formula, This represents the fourteenth hash value. This represents the sixth secret value. This represents the fifteenth hash value.

[0034] If they are equal, the edge server After verifying the CSC's identity, a timestamp was selected. ,calculate Session key Then calculate , Then Return to In the formula, This represents the seventh secret value. This represents the sixteenth hash value. Represents a symmetric encryption value. Indicated by The encryption function for the encryption key;

[0035] when Received from edge server Message sent First check ,if Within the time threshold range, then calculate Then through Decryption get and Session key , And judge Whether or not If they are equal; if they are not equal, Immediately terminate the connection; in the formula, Indicates the session key. This represents the seventeenth hash value;

[0036] If they are equal, it means Trust edge servers It is valid and the session keys are equal, then Session keys can be used to communicate with edge servers. To conduct communication.

[0037] According to the above technical solution, when To change your password, first enter your original password. and password Then calculate , , And judge with Are they equal? ​​If they are equal, then prove them. If it's valid, you can choose a new password. Then update the contents of SC, using... Replace SC ,So The latest content in SC is .

[0038] According to the above technical solution, each session key Among them, the seventh secret value It is computed using elliptic curve cryptography, and the computation is performed for each authentication. The values ​​are all different, and Each authentication is different, so each negotiated session key is different. Even if one session key is leaked, it will not affect the other session keys.

[0039] According to the above technical solution, system initialization is required before registering IoT devices. The specific system initialization operation is as follows:

[0040] Finite field Choose an elliptic curve group of order N. Let G be an elliptic curve. A cyclic subgroup of order n is given by P, which is the base point of group G; the Cloud Service Center (CSC) selects a random number s as the private key;

[0041] CSC selects a one-way secure hash function and calculate public key and publish parameters Each IoT device is equipped with a Physically Unclonable Function (PUF) for generating responses.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] The communication method provided by this invention comprehensively ensures the security of the communication process through multi-dimensional technical design. At the authentication level, a mutual verification mechanism for authentication information is adopted to effectively resist impersonation attacks; at the same time, identity information is encrypted to further protect user identity privacy and security.

[0044] During message transmission, the communicating entities use timestamps and random values ​​to ensure message freshness and prevent replay attacks; they also perform strict verification of transmitted messages, and verification will fail if the information is tampered with, thus resisting man-in-the-middle attacks.

[0045] Regarding key management, since the secret value used to generate the session key changes each time, even if the session key is leaked, it will not affect the security of subsequent communications. Furthermore, by utilizing the response value generated by the PUF, this method can also resist physical capture attacks and smart card loss attacks, providing a more robust guarantee for communication security. Attached Figure Description

[0046] Figure 1 This is a diagram illustrating the certification process of this invention.

[0047] Figure 2 This is a network architecture diagram of the present invention. Detailed Implementation

[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] Example 1

[0050] like Figure 2 As shown, a secure IoT access method based on cloud-edge collaboration includes the following steps:

[0051] Step S1: IoT device registration. The device sends registration information to the CSC. After processing, the CSC issues a smart card, and the device completes the smart card content update.

[0052] Step S2: Edge server registration. The edge server sends a registration identifier to the CSC. After processing, the CSC returns the relevant data, and the edge server completes information storage.

[0053] Step S3: IoT device login. After inserting a smart card and completing identity and password verification, the device sends login-related data to the edge server.

[0054] Step S4: The edge server processes the request. After verifying the validity of the timestamp, the edge server generates relevant parameters and forwards the data to the CSC.

[0055] Step S5: Cloud server verification and session key preparation. CSC verifies the timestamp and device / edge server identity. After verification, session key related parameters are generated and sent to the edge server.

[0056] Step S6: Edge server verification and session key generation. The edge server verifies the CSC identity, generates a session key, and encrypts the data before returning it to the device. The device verifies the edge server identity and the session key, and establishes secure communication after confirming their legitimacy.

[0057] The communication method provided by this invention comprehensively ensures the security of the communication process through multi-dimensional technical design. At the authentication level, a mutual verification mechanism for authentication information is adopted to effectively resist impersonation attacks; at the same time, identity information is encrypted to further protect user identity privacy and security.

[0058] During message transmission, the communicating entities use timestamps and random values ​​to ensure message freshness and prevent replay attacks; they also perform strict verification of transmitted messages, and verification will fail if the information is tampered with, thus resisting man-in-the-middle attacks.

[0059] Regarding key management, since the secret value used to generate the session key changes each time, even if the session key is leaked, it will not affect the security of subsequent communications. Furthermore, by utilizing the response value generated by the PUF, this method can also resist physical capture attacks and smart card loss attacks, providing a more robust guarantee for communication security.

[0060] Example 2

[0061] This embodiment provides a specific implementation of the method of the present invention.

[0062] Step 1, System Initialization. Finite Field Choose an elliptic curve group of order N. Let G be an elliptic curve. A cyclic subgroup of order n is given by the group G, where P is the base point of the group G; the Cloud Service Center (CSC) selects a random number s as the private key;

[0063] CSC selects a one-way secure hash function and calculate public key and publish parameters Each IoT device is equipped with a Physically Unclonable Function (PUF) to generate responses.

[0064] Step 2, Registration; Registration includes IoT device registration and edge server registration.

[0065] The specific steps for registering IoT devices are as follows:

[0066] Internet of Things (IoT) devices First, select a random number. Then enter your identity information. ,calculate This represents the temporary public key, where P is the base point; the calculation result... Send it to the cloud server CSC via a secure channel;

[0067] Cloud Server Center (CSC) received Next, select a random number. and identity identifier Then calculate , , , , ; Represents the base point hash value. This represents a temporary public key. This represents the hash value of the temporary identity identifier. Indicates based on random numbers Intermediate value of temporary public key, Indicates the first hash value. Indicates the first intermediate value. Indicates signature, This represents the second hash value, where 's' represents the private key of the Cloud Service Center (CSC). This represents a hash operation;

[0068] CSC will Stored in the registry and issued as a smart card (SC), Stored in SC, and finally SC is sent to ;

[0069] Upon receiving the smart card SC, a challenge is first generated. Calculate the corresponding response value PUF stands for non-clonable function. , , In the formula, Indicates the first response value. This represents the first encrypted value. This represents the second encrypted value. Indicates the third hash value. Indicates signature, Represents a random number. Indicates the first intermediate value;

[0070] Then the information Update to smart card SC, where, This represents the generated challenge value, used to generate the physical unclonable function value.

[0071] Edge server registration specifically involves: edge server Select Identity and random numbers ,calculate Then send it to the CSC; in the formula Indicates the fourth hash value;

[0072] CSC received Next, select a random number. ,calculate and and return it to In the formula, s represents the private key of the Cloud Service Center (CSC), and finally, the CSC stores... In the formula, This represents the fifth hash value. This represents the third encrypted value. Indicates the first identity value;

[0073] when receive Then, calculate ,Then storage .

[0074] Step 2, the certification stage, specifically involves the certification of IoT devices: IoT devices Insert their smart card SC and enter their identity. and password Through calculation , In the formula, This represents the calculated hash value. This represents the hash value stored in SC. This represents the value calculated using the physically non-cloning function. This represents the first encrypted value. This represents the password value.

[0075] Then determine Is it equal to It can be judged Are your identity and password correct? and They are equal, then Login successful; Select random number and the current timestamp Then calculate , , ,at last Will send To edge servers .

[0076] When the edge server take over Sent First, check the timestamp. Does it hold true? If not, then the edge server... Terminate communication immediately;

[0077] If true, select a random number. and current timestamp Then calculate , , , , Last edge server Will Send to the cloud server CSC, where, This represents the second temporary public key value. This represents the second secret value. This represents the seventh hash value. This represents the sixth encrypted value. This represents the eighth hash value. Represents a random number.

[0078] When CSC receives the edge server Message sent First, check the timestamp. If the condition is not met, the CSC will immediately cease communication.

[0079] If true, CSC calculates , CSC approved Retrieve from database ,calculate , , , , Then judge and Whether the above equation holds true; if the result is not equal, CSC will immediately terminate the communication; where, This represents the third secret value. This represents the fourth secret value. Indicates the second identity value. Indicates the third identity value. Indicates the verification value. Show the ninth hash value, Represents the tenth hash value. This represents the eleventh hash value; The hash value is an intermediate value used to calculate the authentication value. ;

[0080] If the above equations are equal, then CSC will select a random number. and timestamp Then calculate , , , Finally, the CSC will Send to edge server .

[0081] When the edge server Received a message from CSC First check Does it meet the requirements? Then calculate , , Then calculate and judge Whether or not Equal; in the formula, This represents the fourteenth hash value. This represents the sixth secret value. This represents the fifteenth hash value.

[0082] If they are equal, the edge server After verifying the CSC's identity, a timestamp was selected. ,calculate Session key Then calculate Then Return to ;

[0083] when Received from edge server Message sent First check ,if Within the time threshold range, then calculate Then through Decryption get and Session key , And judge Whether or not If they are equal; if they are not equal, Immediately terminate the connection; in the formula, Indicates the session key. This represents the seventeenth hash value.

[0084] If they are equal, it means Trust edge servers It is valid and the session keys are equal, then Session keys can be used to communicate with edge servers. To conduct communication.

[0085] Step 4, Password update; when To change your password, first enter your original password. and password Then calculate , , And judge with Are they equal? ​​If they are equal, then prove them. If it's valid, you can choose a new password. Then update the contents of SC, using... Replace SC ,So The latest content in SC is .

[0086] Furthermore, IoT devices Message request to be authenticated To edge servers Edge server New authentication request Send to the cloud server CSC. CSC first checks the message's timeliness, then compares... Whether it is true or not, the CSC will verify and determine. and edge servers The identity of the edge server. Received a message from CSC ,judge Whether or not equal.

[0087] If they are equal, the edge server The identity of CSC has been verified. receive Message sent ,judge Whether or not equal. The edge server was verified. Identity. Therefore, this invention enables mutual identity authentication between entities.

[0088] Furthermore, adding a timestamp to the first stage of authentication for each entity ensures the freshness of messages sent by all three parties, guaranteeing the validity of transmitted messages and resisting replay attacks. On the other hand, a random value is used to calculate the authentication value. As each session progresses, the authentication value is different each time. This increases the difficulty for an attacker to replay the event, thus this invention can resist replay attacks.

[0089] Furthermore, through the method described in this invention, attackers can intercept... Messages transmitted in public passages However, attackers cannot obtain... The secret value calculated using the chaotic mapping algorithm Therefore, even if an attacker tampers with the transmitted message Subsequent transmissions to the CSC also failed authentication. Similarly, attackers could intercept and modify the message. However, attackers also cannot obtain [the information]. The secret value calculated using the chaotic mapping algorithm Therefore, CSC cannot complete the verification. This method can therefore resist man-in-the-middle attacks.

[0090] Furthermore, during the registration phase go through After processing, it is sent to the CSC, and it has been processed. The IoT devices registered with the CSC are not stored in the CSP's database. of Therefore, there is no issue of obtaining user identity by cracking the CSC's database during the registration phase, thus ensuring user anonymity during registration. Secondly, during the authentication phase... go through The data is encrypted, processed, and then transmitted over a public channel. However, even if the information transmitted over the public channel is intercepted, it is impossible to calculate the result. Because if you want to get Therefore, it is necessary to calculate And calculation The Diffie-Hellman problem for elliptic curve calculation needs to be solved, therefore it cannot be calculated. That is, it is impossible to obtain The value of .

[0091] Therefore, in summary, this method can guarantee user anonymity.

[0092] Furthermore, IoT devices Authentication requires using PUF to generate a response value to obtain the secret value. Therefore, even if an attacker obtains the smart card, they cannot obtain the secret value or successfully log in. Furthermore, if an IoT device is damaged or its hardware is tampered with, its PUF output will change. Due to the non-cloning nature of PUFs, attackers will also be unable to perform a PUF operation. Therefore, this method can resist physical capture attacks and smart card loss attacks through PUF.

[0093] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0094] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A secure IoT access method based on cloud-edge collaboration, characterized in that: Includes the following steps: Step S1: IoT device registration. The device sends registration information to the Cloud Service Center (CSC). After processing, the CSC issues a smart card, and the device completes the smart card content update. IoT device registration includes: Step S101, IoT device First, select a random number. Then enter the IoT device's identifier. ,calculate , This represents the temporary public key, where P is the base point; the calculation result... Send it to the cloud server CSC via a secure channel; Step S102, the cloud server center CSC receives Next, select a random number. Identity identifier of Cloud Server Center (CSC) Then calculate , , , , , , , ; Represents the base point hash value. This represents a temporary public key. This represents the hash value of the temporary identity identifier. Indicates based on random numbers Intermediate value of temporary public key, Indicates the first hash value. Indicates the first intermediate value. Indicates signature, The second hash value is represented by s, which represents the private key of the Cloud Service Center (CSC), and H() represents the hash operation. CSC will Stored in the registry and issued as a smart card (SC), Stored in SC, and finally SC is sent to ; Step S103, Upon receiving the smart card SC, a challenge is first generated. Calculate the corresponding response value In the formula, PUF represents a non-cloning function. , , , , In the formula, Indicates the first response value. This represents the first encrypted value. This represents the second encrypted value. Indicates the third hash value. Indicates signature, Represents a random number. Indicates the first intermediate value; Then the information Update to smart card SC, where, This represents the generated challenge value, used to generate the physical unclonable function value; Step S2, Edge Server Registration: The edge server sends a registration identifier to the CSC. After processing, the CSC returns relevant data, and the edge server completes information storage. Edge server registration includes: Step S201, Edge Server Select Identity and random numbers ,calculate Then send it to the CSC; in the formula Indicates the fourth hash value; Step S202, CSC received Next, select a random number. ,calculate and and return it to In the formula, s represents the private key of the Cloud Service Center (CSC), and finally, the CSC stores... In the formula, This represents the fifth hash value. This represents the third encrypted value. Indicates the first identity value; Step S203, when the edge server receive Then, calculate , Indicates the fourth encrypted value, then storage ; Step S3, IoT device login: The device inserts a smart card, completes identity and password verification, and then sends login-related data to the edge server; IoT device login specifically involves: IoT device... Insert their smart card SC and enter their identity. and password Through calculation , , In the formula, This represents the calculated hash value. This represents the hash value stored in SC. This represents the value calculated using a physically non-cloning function. This represents the first encrypted value. Represent the password value; then determine... Is it equal to ,judge Are your identity and password correct? and They are equal, then Login successful; Select random number and the current timestamp Then calculate , , , ,at last Will send To edge servers ; In the formula, This represents the first temporary public key value. Represents the first secret value. This represents the fifth encrypted value. This represents the sixth hash value. Indicates signature, This means multiplying a point P on an elliptic curve by a scalar s using scalar multiplication; the value calculated here is... Public key ; This value Saved to memory during registration; Step S4: The edge server processes the request. After verifying the validity of the timestamp, the edge server generates relevant parameters and forwards the data to the CSC. Step S5: Cloud server verification and session key preparation. CSC verifies the timestamp and device / edge server identity. After verification, session key related parameters are generated and sent to the edge server. Step S6: Edge server verification and session key generation. The edge server verifies the CSC identity, generates a session key, and encrypts the data before returning it to the device. The device verifies the edge server identity and the session key, and establishes secure communication after confirming their legitimacy.

2. The IoT secure access method based on cloud-edge collaboration according to claim 1, characterized in that: In step S4, the edge server processes the request as follows: When the edge server take over Sent First, check the timestamp. Does it hold true? If not, then the edge server... Terminate communication immediately; If true, select a random number. and current timestamp Then calculate , , , , , ,at last Will Send to cloud server CSC; where, This represents the second temporary public key value. This represents the second secret value. This represents the seventh hash value. This represents the sixth encrypted value. This represents the eighth hash value. Represents a random number.

3. The IoT secure access method based on cloud-edge collaboration according to claim 2, characterized in that: In step S5, the cloud server verification and session key preparation are as follows: When CSC receives the edge server Message sent First, check the timestamp. If the condition is not met, the CSC will immediately cease communication. If true, CSC calculates , CSC approved Retrieve random numbers from the database ,calculate , , , Then judge , and Whether the above equation holds true; if the result is not equal, CSC will immediately terminate the communication; where, This represents the third secret value. This represents the fourth secret value. Indicates the second identity value. Indicates the third identity value. Indicates the verification value. This represents the ninth hash value. Represents the tenth hash value. This represents the eleventh hash value; The hash value is an intermediate value used to calculate the authentication value. ; If the above equations are equal, then CSC will select a random number. and timestamp Then calculate , , , Finally, the CSC will Send to edge server In the formula, This represents the third temporary public key value. This represents the fifth secret value. This represents the twelfth hash value. This represents the thirteenth hash value.

4. The IoT secure access method based on cloud-edge collaboration according to claim 3, characterized in that: Step S6, specifically the edge server verification and session key generation, is as follows: When the edge server Received a message from CSC First check Does it meet the requirements? Then calculate , , , Then calculate and judge Whether or not Equal; in the formula, This represents the fourteenth hash value. This represents the sixth secret value. This represents the fifteenth hash value; If they are equal, the edge server After verifying the CSC's identity, a timestamp was selected. ,calculate Session key Then calculate , Then Return to In the formula, This represents the seventh secret value. This represents the sixteenth hash value. Represents a symmetric encryption value. Indicates The encryption function for the encryption key; when Received from edge server Message sent First check ,if Within the time threshold range, then calculate Then through Decryption get and Session key , And judge Whether or not If they are equal; if they are not equal, Immediately terminate the connection; in the formula, Indicates the session key. This represents the seventeenth hash value; If they are equal, it means Trust edge servers It is valid and the session keys are equal, then Session keys can be used to communicate with edge servers. To conduct communication.

5. The IoT secure access method based on cloud-edge collaboration according to claim 4, characterized in that: when To change your password, first enter your original password. and password Then calculate And judge with Are they equal? ​​If they are equal, then prove them. If it's valid, you can choose a new password. Then update the contents of SC, using... Replace SC ,So The latest content in SC is .

6. The IoT secure access method based on cloud-edge collaboration according to claim 5, characterized in that: Each session key Among them, the seventh secret value It is computed using elliptic curve cryptography, and the computation is performed for each authentication. The values ​​are all different, and Each authentication is different, so each negotiated session key is different. Even if one session key is leaked, it will not affect the other session keys.

7. The IoT secure access method based on cloud-edge collaboration according to claim 1, characterized in that: Before registering IoT devices, system initialization is required. The specific system initialization steps are as follows: Finite field Choose an elliptic curve group of order N. Let G be an elliptic curve. A cyclic subgroup of order n is given by P, which is the base point of group G; the Cloud Service Center (CSC) selects a random number s as the private key; CSC selects a one-way secure hash function and calculate public key and publish parameters Each IoT device is equipped with a Physically Unclonable Function (PUF) for generating responses.

Images