Iot communication systems, methods, apparatus, and storage media

Abstract

The embodiment of the application provides a kind of Internet of Things communication system, method, device and storage medium, belong to Internet of Things technical field.The system includes Internet of Things device and authentication server, authentication server obtains the configuration parameter and transmission demand parameter of Internet of Things device, determines the device communication mode of Internet of Things device according to configuration parameter, generates challenge signal according to device communication mode, and challenge signal is sent to Internet of Things device, obtains communication key, determines the device communication mode of Internet of Things device as first communication mode according to transmission demand parameter, determines the first key in communication key according to first communication mode, and carries out identity authentication to Internet of Things device by first key.The embodiment of the application can realize lightweight identity authentication, adapt to the Internet of Things device of limited resource at the same time, and improve the security of communication.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) technology, and in particular to an IoT communication system, method, apparatus, and storage medium. Background Technology

[0002] As the scope of interconnection and interoperability of the power Internet of Things (IoT) continues to expand and the number of devices connected to the IoT continues to increase, the requirements for security protection of communication between various business terminals on the IoT are becoming increasingly stringent.

[0003] In related technologies, the way to achieve communication security in the power Internet of Things (IoT) is to add device authentication functionality using either the device's private or public key, and then establish a connection after successful authentication. However, public key security is not high enough, and private key security requires devices to have significant computing resources, which cannot meet the diverse communication security requirements of IoT devices.

[0004] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the Invention

[0005] The main objective of this application is to provide an Internet of Things (IoT) communication system, method, apparatus, and storage medium that can improve the communication security of IoT devices.

[0006] To achieve the above objectives, one aspect of this application provides an Internet of Things (IoT) communication system, which includes an IoT device and an authentication server. The IoT device includes a response module and a transmission module, and the authentication server includes an acquisition module, a parsing module, a challenge module, and an authentication module.

[0007] The acquisition module is used to acquire the configuration parameters of the IoT device;

[0008] The parsing module is used to determine the device communication mode of the IoT device based on the configuration parameters;

[0009] The challenge module is used to generate a challenge signal according to the device communication mode and send the challenge signal to the IoT device;

[0010] The response module is used to generate a communication key in response to the challenge signal and send the communication key to the authentication server;

[0011] The authentication module is used to obtain the transmission requirement parameters of the IoT device; determine the device communication mode of the IoT device as a first communication mode based on the transmission requirement parameters; determine the first key in the communication key based on the first communication mode, and authenticate the IoT device using the first key; if the authentication is successful, send a first authentication confirmation signal to the IoT device.

[0012] The transmission module is used to transmit data based on the first communication mode in response to the first authentication confirmation signal.

[0013] In some embodiments, the authentication server further includes a monitoring module and a switching module;

[0014] The monitoring module is used to monitor the communication channel of the first communication mode during data transmission and obtain monitoring data.

[0015] The switching module is used to perform quality assessment based on the monitoring data to obtain channel quality; determine whether to switch the first communication mode based on the channel quality change data; if it is determined to switch the first communication mode, then determine the second communication mode based on the device communication mode, and send the authentication signal of the second communication mode to the authentication module.

[0016] The authentication module is further configured to respond to the authentication signal, determine the second key in the communication key according to the first communication mode, and authenticate the IoT device using the second key; if the authentication is successful, a second authentication confirmation signal is sent to the IoT device.

[0017] The transmission module is further configured to, in response to the second authentication confirmation signal, stop data transmission based on the first communication mode and perform data transmission based on the second communication mode.

[0018] In some embodiments, the device communication mode includes a wired transmission mode and a wireless transmission mode, and the parsing module is specifically used for:

[0019] The device power consumption of the IoT device is determined based on the configuration parameters.

[0020] If the power consumption of the device is greater than or equal to the preset power consumption, then the device communication mode of the IoT device is determined to include wired transmission mode and wireless transmission mode.

[0021] If the power consumption of the device is less than the preset power consumption, then the device communication mode of the IoT device is determined to be wireless transmission mode.

[0022] In some embodiments, the parsing module is further configured to:

[0023] The transmission frequency band of the IoT device is determined based on the configuration parameters;

[0024] The device communication mode of the Internet of Things device is determined based on the transmission frequency band and the frequency band of the device communication mode.

[0025] In some embodiments, the challenge module is specifically used for:

[0026] Obtain the name of the device communication mode;

[0027] The name is vectorized to obtain a vectorized name;

[0028] Generate the first random number using a random number generator;

[0029] The vectorized name and the first random number are concatenated to obtain the first concatenation result;

[0030] The challenge signal is obtained by performing a hash operation on the first concatenation result.

[0031] In some embodiments, the response module is specifically used for:

[0032] In response to the challenge signal, a challenge response is generated;

[0033] The device identifier of the IoT device is generated using a physically unclonable function;

[0034] The challenge response is concatenated with the device identifier to obtain the pattern response;

[0035] Send a random number generation request to the authentication server to obtain a second random number;

[0036] The pattern response is concatenated with the second random number to obtain the second concatenation result;

[0037] The second concatenation result is hashed to obtain the communication key.

[0038] In some embodiments, the monitoring data includes signal power, data packet loss rate, and transmitted data volume, and the switching module is specifically used for:

[0039] The channel quality change record is determined based on the signal power, the data packet loss rate, and the amount of transmitted data;

[0040] Based on the change records, predict the change data of the channel quality;

[0041] Based on the change data, determine whether the channel quality is lower than a preset value;

[0042] If the channel quality is lower than a preset value, the first communication mode is switched and a switching warning is sent to the front end.

[0043] To achieve the above objectives, another aspect of this application proposes an Internet of Things (IoT) communication method, which includes the following steps:

[0044] Obtain the configuration parameters and transmission requirements of IoT devices;

[0045] The device communication mode of the IoT device is determined based on the configuration parameters;

[0046] A challenge signal is generated according to the device communication mode, and the challenge signal is sent to the IoT device to obtain a communication key;

[0047] Based on the transmission requirement parameters, the device communication mode of the IoT device is determined to be the first communication mode;

[0048] The first key in the communication key is determined according to the first communication mode, and the IoT device is authenticated using the first key.

[0049] To achieve the above objectives, another aspect of the present application provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method described above.

[0050] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods described above.

[0051] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer program product, including a computer program that, when executed by a processor, implements the aforementioned method.

[0052] The embodiments of this application include at least the following beneficial effects: This application provides an Internet of Things (IoT) communication system, method, apparatus, and storage medium. This scheme obtains the configuration parameters of an IoT device through an authentication server, determines the device communication mode of the IoT device based on the configuration parameters, generates a challenge signal based on the device communication mode, and sends the challenge signal to the IoT device. The response module of the IoT device responds to the challenge signal, generates a communication key, and sends the communication key to the authentication server. The authentication server determines the device communication mode of the IoT device as a first communication mode based on the transmission requirement parameters of the IoT device, determines a first key in the communication key based on the first communication mode, and authenticates the IoT device using the first key. If authentication is successful, the IoT device transmits data based on the first communication mode. This scheme authenticates the device communication mode based on the communication key generated autonomously by the IoT device, achieving lightweight identity authentication for the communication mode of the IoT device, adapting to diverse IoT devices while improving communication security. Attached Figure Description

[0053] Figure 1This is a flowchart of the IoT communication method provided in the embodiments of this application;

[0054] Figure 2 This is a schematic diagram of the structure of the Internet of Things communication system provided in the embodiments of this application;

[0055] Figure 3 This is a schematic diagram of IoT communication interaction provided in an embodiment of this application;

[0056] Figure 4 This is a sequence diagram of device identity authentication based on PUF technology provided in the embodiments of this application;

[0057] Figure 5 This is a schematic diagram of the power Internet of Things communication process provided in the embodiments of this application;

[0058] Figure 6 This is a schematic diagram of the hardware structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0060] It is understood that the terms “first,” “second,” etc., used in this application may be used herein to describe various concepts, but unless otherwise stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to a determination” as used herein may be interpreted as “when…” or “when…” or “in response to a determination.”

[0061] As used in this application, the terms "at least one", "multiple", "each", "any", etc., "at least one" includes one, two or more, "multiple" includes two or more, "each" refers to each of the corresponding multiples, and "any" refers to any one of the multiples.

[0062] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0063] Before providing a detailed description of the embodiments of this application, some of the nouns and terms involved in the embodiments of this application will be explained first. The nouns and terms involved in the embodiments of this application are subject to the following interpretations.

[0064] 1) A Physically Unclonable Function (PUF) is a technology based on physical hardware characteristics that generates unique identifiers. It utilizes minute, random differences in the hardware manufacturing process, such as the inhomogeneities of materials like transistors, wires, and dielectrics, to generate a unique "physical fingerprint." These differences arise naturally during production and are therefore unclonable and unpredictable. PUFs can be used for device authentication and key generation, offering high security and resistance to attacks. They are widely used in the Internet of Things (IoT), Hardware Security Modules (HSMs), and anti-counterfeiting technologies.

[0065] 2) High-speed power line carrier communication uses power lines as the transmission medium to transmit data signals. It has higher power consumption and usually requires grid power supply. It has higher bandwidth, usually reaching tens of Mbps or even higher, making it suitable for transmitting large amounts of data or scenarios with high real-time requirements. Its coverage is limited by the length and quality of the power lines, usually within a few kilometers, making it suitable for communication inside buildings or over short distances. It has lower latency, making it suitable for scenarios with high real-time requirements. It has higher reliability and is less affected by environmental interference. It mainly uses low-frequency bands (3kHz to 500kHz) and high-frequency bands (1MHz to 30MHz).

[0066] 3) Low-power wireless communication uses radio waves as the transmission medium to transmit data via wireless signals; it requires the deployment of wireless communication equipment (such as base stations and antennas); it has extremely low power consumption, making it suitable for battery-powered devices; it has relatively low bandwidth, typically a few Kbps to hundreds of Kbps, suitable for transmitting small amounts of data or non-real-time data; it has a wide coverage area, reaching several kilometers to tens of kilometers; it has relatively high latency, typically a few seconds to a few minutes; it is suitable for non-real-time data transmission; its reliability is greatly affected by the environment (such as building obstruction and weather conditions); it mainly uses the Sub-GHz band (such as 433MHz, 868MHz, 915MHz) and the 2.4GHz band.

[0067] As the scope of interconnection and interoperability of the power Internet of Things (IoT) continues to expand and the number of devices connected to the IoT continues to increase, in order to meet the security protection requirements of communication between various business terminals on the distribution IoT, it is necessary to integrate a secure and efficient authentication mechanism and communication mode switching into the communication system of the smart distribution business system to achieve remote and secure communication between various communication parties in the business system.

[0068] One way to ensure secure communication in the power Internet of Things (IoT) is to authenticate devices by adding authentication functionality using their private or public keys. Once authentication is successful, a connection is established, and the communication mode is determined based on the device's characteristics, employing the corresponding communication protocol. However, public keys offer insufficient security, while private keys require devices with substantial computing resources. Furthermore, with the ever-increasing volume of data transmitted, using a single communication protocol for data transmission suffers from inflexibility.

[0069] In related technologies, security authentication methods are not secure enough and are not suitable for resource-constrained devices. They can only transmit data through a single pre-determined communication protocol. When the communication mode fails, it cannot switch to other modes to continue transmission, resulting in a lack of flexibility in transmission methods.

[0070] In view of this, this application provides an Internet of Things (IoT) communication system, method, apparatus, and storage medium. This solution authenticates the communication mode of the IoT device based on the communication key generated autonomously by the IoT device, achieves lightweight identity authentication of the communication mode of the IoT device, adapts to a variety of IoT devices, improves communication security, and switches the communication mode of the device in combination with channel quality, thereby improving the flexibility of the communication method.

[0071] The IoT communication system provided in this application includes an IoT device and an authentication server. The IoT device includes a response module and a transmission module, and the authentication server includes an acquisition module, a parsing module, a challenge module, and an authentication module.

[0072] The acquisition module is used to acquire configuration parameters of IoT devices;

[0073] The parsing module is used to determine the device communication mode of IoT devices based on configuration parameters;

[0074] The challenge module is used to generate challenge signals based on the device communication mode and send the challenge signals to the IoT device;

[0075] The response module is used to respond to the challenge signal, generate a communication key, and send the communication key to the authentication server;

[0076] The authentication module is used to obtain the transmission requirement parameters of the IoT device; determine the device communication mode of the IoT device as the first communication mode based on the transmission requirement parameters; determine the first key in the communication key based on the first communication mode, and authenticate the IoT device using the first key; if the authentication is successful, send a first authentication confirmation signal to the IoT device.

[0077] The transmission module is used to transmit data based on a first communication mode in response to a first authentication confirmation signal.

[0078] Specifically, the IoT communication system includes IoT devices, authentication servers, and cloud servers. IoT devices are used to collect real-time data. Authentication servers are used to forward and transmit data collected by the sensing layer to the cloud server, such as a gateway. However, before data transmission, IoT devices need to authenticate with the gateway. The cloud server processes the received data and information from the device terminals. Configuration parameters include, but are not limited to, the operating power consumption and supported transmission frequency bands of the IoT devices. Device communication modes refer to the multiple communication methods supported by the device, determined based on the configuration parameters, including high-speed power line carrier communication and low-power wireless communication. Different device communication modes have different communication protocols. Each device communication mode generates a corresponding challenge signal. If the authentication server determines that the IoT device supports multiple device communication modes, the IoT device will receive multiple challenge signals and generate corresponding communication keys based on different challenge signals. Therefore, the communication keys include keys for multiple device communication modes. After receiving the communication keys, the authentication server determines the appropriate communication mode from the aforementioned device communication modes based on the transmission requirement parameters. Transmission requirement parameters refer to the data transmission requirements or device type of the IoT device. After confirming the first communication mode among the device's communication modes as the appropriate mode, a key for the first communication mode (the first key) is selected from the communication keys to authenticate the IoT device. Upon successful authentication, the IoT device can transmit data based on the communication protocol corresponding to the first communication mode.

[0079] For example, if an IoT device supports high-speed power line carrier communication and low-power wireless communication, the authentication server will generate challenge signals for high-speed power line carrier communication and low-power wireless communication respectively. Subsequently, after receiving the challenge signals, the authentication server will generate communication keys for high-speed power line carrier communication and low-power wireless communication respectively. Based on the data transmission requirements of the IoT device, it will determine that the appropriate communication mode for the data to be transmitted is high-speed power line carrier communication. Then, it will use the key for high-speed power line carrier communication to perform identity authentication under high-speed power line carrier communication. After successful authentication, the device can transmit data based on the communication protocol of high-speed power line carrier communication.

[0080] In some embodiments, the authentication server further includes a monitoring module and a switching module;

[0081] The monitoring module is used to monitor the communication channel of the first communication mode during data transmission and obtain monitoring data.

[0082] The switching module is used to perform quality assessment based on monitoring data to obtain channel quality; determine whether to switch the first communication mode based on the change data of channel quality; if it is determined to switch the first communication mode, the second communication mode is determined based on the device communication mode, and an authentication signal of the second communication mode is sent to the authentication module.

[0083] The authentication module is also used to respond to the authentication signal, determine the second key in the communication key according to the first communication mode, and authenticate the IoT device using the second key; if the authentication is successful, a second authentication confirmation signal is sent to the IoT device.

[0084] The transmission module is also used to stop data transmission based on the first communication mode in response to the second authentication confirmation signal, and to transmit data based on the second communication mode.

[0085] Specifically, due to interference from noise, electromagnetic waves, and other factors in the channel during data transmission, as well as the increase in the amount of data transmitted, the reliability of the transmission result may not be guaranteed if the IoT device continues to communicate in the first communication mode. Therefore, a monitoring module is needed to monitor the channel in real time. During data transmission, the channel quality of the device's transmission channel in the first communication mode is assessed by real-time monitoring of signal power, data packet loss rate, and the amount of data transmitted. Based on the changes in channel quality, it is predicted whether a switch is necessary. If the current channel quality continues to deteriorate to the point of failing to meet the minimum service requirements, or if a better quality channel becomes available, the authentication server initiates a channel switching process. During the channel switching process, the authentication server reselects a second communication mode from the device's communication modes. Since the aforementioned communication key includes a key for the second communication mode, the key for the second communication mode (the second key) is used to authenticate the IoT device in the second communication mode. After successful authentication, a communication connection is directly established in the second communication mode to switch the device from the current first communication mode to the second communication mode. The IoT device then uses the communication protocol corresponding to the second communication mode for data transmission.

[0086] In some embodiments, the monitoring data includes monitoring signal power, data packet loss rate, and transmitted data volume, and the switching module is specifically used for:

[0087] Based on the monitored signal power, data packet loss rate, and transmitted data volume, the channel quality change record is determined;

[0088] Based on the change records, predict the changes in channel quality;

[0089] Determine whether the channel quality is lower than the preset value based on the changing data;

[0090] If the channel quality is lower than the preset value, the first communication mode will be switched and a switching warning will be sent to the front end.

[0091] Specifically, based on indicators such as the absolute value, fluctuation amplitude, and trend of signal power in the communication channel, absolute packet loss rate, packet loss rate trend, and data transmission volume trend, the channel quality is comprehensively evaluated, resulting in a channel quality change record. The weights of each indicator can be determined based on the actual transmitted data. The switching module can predict channel quality changes over a future period based on the change record and compare the changes with preset values. If the changes consistently fall below the preset values, it indicates that the channel quality will continue to deteriorate to the point where it cannot meet the minimum service requirements, easily leading to data loss and increased transmission latency. Therefore, the authentication server issues a switching warning in advance, switching the device's current first communication mode to the second communication mode to maximize data transmission quality and stability, as well as communication flexibility.

[0092] In some embodiments, the data transmission endpoint when the device communication mode is switched is determined based on the timestamp, so that data is not missed or retransmitted.

[0093] A timestamp is a timing stamp for data transmission. When the gateway finishes authenticating the device in another communication mode, the timestamp stops counting down. The gateway uses the data corresponding to this timestamp as the endpoint of the data transmission. After the gateway completes the communication connection of the device in the other available communication mode, it continues to transmit the data to be transmitted according to the endpoint of the data transmission, so that data is not missed or retransmitted when the communication mode is switched.

[0094] In some embodiments, the device communication mode includes a wired transmission mode and a wireless transmission mode, and the parsing module is specifically used for:

[0095] Determine the device power consumption of the IoT device based on the configuration parameters;

[0096] If the device power consumption is greater than or equal to the preset power consumption, then the device communication mode of the IoT device is determined to include wired transmission mode and wireless transmission mode.

[0097] If the device power consumption is less than the preset power consumption, then the device communication mode of the IoT device is determined to be wireless transmission mode.

[0098] Specifically, the configuration parameters of IoT devices include device power consumption. Wired transmission mode requires IoT devices to have higher power output, while wireless transmission mode requires lower power consumption. A preset power consumption is used as the boundary between the two modes. For example, the device communication mode supporting high-power devices is defined as high-speed power line carrier communication mode and low-power wireless communication mode, while the device communication mode supporting only low-power devices is defined as low-power wireless communication mode.

[0099] In some embodiments, the parsing module is further configured to:

[0100] Determine the transmission frequency band of the IoT device based on the configuration parameters;

[0101] The device communication mode of the IoT device is determined based on the transmission frequency band and the frequency band of the device communication mode.

[0102] Specifically, in addition to determining the device transmission mode of an IoT device based on its power consumption, the device transmission mode can also be determined based on the frequency bands it supports. High-speed power line carrier communication mainly uses low-frequency bands (3kHz to 500kHz) and high-frequency bands (1MHz to 30MHz), while low-power wireless communication mainly uses Sub-GHz bands (such as 433MHz, 868MHz, and 915MHz) and the 2.4GHz band. If the frequency bands supported by the IoT device fall within the above-mentioned ranges, it indicates that the device supports the corresponding communication mode.

[0103] In some embodiments, the challenge module is specifically used for:

[0104] Get the name of the device's communication mode;

[0105] The name is vectorized to obtain a vectorized name;

[0106] Generate the first random number using a random number generator;

[0107] The vectorized name and the first random number are concatenated to obtain the first concatenation result;

[0108] Perform a hash operation on the first concatenation result to obtain the challenge signal.

[0109] Specifically, the authentication server vectorizes the names of each available device communication mode, generates a random number using a random number generator, and concatenates the random number with the vectorized name of the device. The first concatenation result is then hashed to generate a challenge signal that incorporates the mode. Different modes correspond to different challenges, and these challenge signals are sent to the IoT devices respectively. The specific process for generating the challenge signal is as follows:

[0110] Pattern A1 is vectorized into its name, represented as:

[0111] A1 = [a1, a2, ..., a n ];

[0112] The formula for concatenating a random number with the vectorized name of pattern A1:

[0113] K = (A1||s1);

[0114] The formula for generating the challenge signal h1:

[0115] h1 = H(A1||s1);

[0116] Where H is the hash algorithm and s1 is the random number generated by the server.

[0117] In some embodiments, the response module is specifically used for:

[0118] In response to a challenge signal, a challenge response is generated;

[0119] Generate device identifiers for IoT devices using physically unclonable functions;

[0120] The challenge response is concatenated with the device identifier to obtain the pattern response;

[0121] Send a random number generation request to the authentication server to obtain a second random number;

[0122] The pattern response is concatenated with the second random number to obtain the second concatenation result;

[0123] A hash operation is performed on the second concatenation result to obtain the communication key.

[0124] Specifically, the response module includes a PUF (Physically Unclonable Function) module. IoT devices utilize their configured PUF module to generate corresponding challenge responses for different challenge signals. The device identifier is then concatenated with the challenge response to generate the device's mode response for each mode. The device identifier is a unique "physical fingerprint" generated by the PUF using minute random differences in the hardware manufacturing process. To increase the randomness of the mode key, the device sends a random number generation request to the authentication server. The authentication server, combining the request's timestamp, generates another random number and sends it back to the device. The device XORs the timestamp-based random number with its response, and hashes the result to obtain the device's mode key for each mode. The formula for the mode key is as follows:

[0125]

[0126] Where salt is a random number generated by the server set timestamp, δ is the device identifier, P1 is the device's challenge response to h1, and H is the hash algorithm.

[0127] Please refer to Figure 1 , Figure 1 This is an optional flowchart of an IoT communication method provided in some embodiments of this application. An IoT communication method according to embodiments of the present invention includes, but is not limited to, steps S100 to S500:

[0128] Step S100: Obtain the configuration parameters and transmission requirement parameters of the IoT device;

[0129] Step S200: Determine the device communication mode of the IoT device based on the configuration parameters;

[0130] Step S300: Generate a challenge signal according to the device communication mode, and send the challenge signal to the IoT device to obtain the communication key;

[0131] Step S400: Determine the device communication mode of the IoT device as the first communication mode based on the transmission requirement parameters;

[0132] Step S500: Determine the first key in the communication key according to the first communication mode, and authenticate the IoT device using the first key.

[0133] The IoT communication method in this application embodiment can be specifically applied to the authentication server of the aforementioned IoT communication system.

[0134] The IoT communication method provided in this application relates to the field of IoT technology. The IoT communication method provided in this application can be applied to a terminal, a server, or software running on a terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the IoT communication method, but is not limited to the above forms.

[0135] The following section provides a detailed introduction and explanation of the solutions in this embodiment of the invention, using specific power Internet of Things (IoT) scenarios as examples:

[0136] This application's embodiments can be applied to power IoT scenarios with a large number of access terminals. Based on physically unclonable physical function hardware-inherent security technology and a multi-mode communication unit integrating high-speed power line carrier communication and low-power wireless technology, it supports multi-path switching. The multi-mode communication unit is applied to distribution IoT terminals to achieve authentication, secure access, encrypted communication, and encrypted storage between the gateway and the IoT terminal. Combining the high security of PUF technology with the flexible communication capabilities of the multi-mode communication unit, it provides a secure and reliable communication solution for smart IoT applications. It can communicate flexibly in different network environments, improving device communication efficiency and enhancing the security and reliability of the entire IoT system.

[0137] To address the security issues of power Internet of Things (IoT) systems, this application proposes a PUF (Power Utility Function) security authentication communication mode switching method to strengthen the identity authentication and communication mode authentication mechanisms during device communication, providing a unique hardware identity for the communication mode used by each power distribution IoT terminal device.

[0138] Please refer to Figure 2 This is a diagram illustrating the architecture of a gateway, resource-constrained devices (IoT terminal devices), and the cloud network. As the device between the terminal device and the cloud network, the gateway forwards device data to the cloud and simultaneously transmits data from the cloud to the device. It plays a crucial role in authenticating IoT devices and selecting communication modes. Furthermore, the gateway can convert wireless data to wired data and vice versa.

[0139] Please refer to Figure 3 The Power Internet of Things (IoT) is an intelligent network that applies Internet of Things (IoT) technology to the power system. It achieves interconnectivity of power equipment through sensors, communication technologies, and data analysis, improving the efficiency, reliability, and security of the power system. The Power IoT covers power generation, transmission, distribution, and consumption, and is an important component of the smart grid. The Power IoT includes the following key components: device terminals, used to collect real-time data from the power system, real-time data from power-consuming equipment, and for fault monitoring; the network layer, used to forward and transmit data collected by the sensing layer, including gateways, employing wired communication such as power line communication (PLC) and fiber optic communication, or wireless communication such as low-power wide area network (LPWAN), cellular networks (4G / 5G), Wi-Fi, and Zigbee. Hybrid communication combining wired and wireless technologies can also be used to improve communication reliability; and cloud servers, used to provide intelligent applications and services for the power system, processing the received data and information from device terminals to achieve automated operation and optimized scheduling of the power grid.

[0140] In some embodiments, please refer to Figure 4When an IoT device communicates with the cloud network, it first needs to send a request to establish a communication connection. The gateway forwards the request to the authentication server. After receiving the request, the authentication server randomly generates a challenge and returns it to the IoT device through the gateway. The PUF module in the IoT device generates a response based on the challenge and the device's own physical characteristics. The gateway forwards the response to the server. At the same time, the authentication server also predicts a response based on the randomly generated challenge. Then, based on the response returned by the device and the predicted response, it determines whether the device can pass the authentication and establishes a communication connection for the device.

[0141] In some embodiments, please refer to Figure 5 This document describes the overall communication process of the power Internet of Things (IoT). The devices mentioned below refer to IoT device terminals.

[0142] S1. Read the device configuration parameters and determine the available modes of each device based on the device configuration parameters and the mode characteristics of multiple communication modes.

[0143] Multiple communication modes are communication transmission methods that utilize different technologies in the power Internet of Things (IoT). Among the most commonly used methods in the power IoT are high-speed power line carrier communication and low-power wireless communication.

[0144] Based on the device's configuration parameters, the authentication server determines the device's power consumption. For devices that support high power consumption, the available modes are high-speed power line carrier communication mode and low-power wireless communication mode. For devices that only support low power consumption, the available mode is low-power wireless communication mode. Alternatively, the server determines the available communication mode for each device based on the available frequency bands in the device configuration and the bandwidth frequency bands corresponding to the two modes mentioned above.

[0145] S2. The device uses the PUF module to generate keys for each available mode, and the keys are different for different modes.

[0146] The server vectorizes the names of each available mode, generates a random number using a random number generator, concatenates the random number with the device's vectorized name, performs a hash operation on the concatenation result, and generates a challenge that combines the mode. Different modes correspond to different challenges, and the challenges are sent to the devices respectively.

[0147] The device uses its built-in PUF module to generate corresponding responses for different challenges. It then concatenates the device identifier with the response to generate the device's mode response for each mode. To increase the randomness of the mode key, the device sends another random number generation request to the server. The server generates a new random number based on the request's timestamp and sends it back to the device. The device XORs the timestamp-based random number with its response, and hashes the result to obtain the device's mode key for each mode.

[0148] S3. Determine the optimal communication mode of the device based on the data transmission requirements of the device, and perform identity authentication with the gateway under the optimal communication mode. Data transmission is carried out according to the communication protocol corresponding to the optimal communication mode. During the transmission process, the channel quality is monitored in real time. Based on the trend of channel quality changes, it is predicted whether a switch is needed and a switch warning is issued.

[0149] Ideally, the authentication server determines the device type or data transmission type based on the device configuration, determines the optimal communication mode for the data based on the data type, and uses the corresponding communication mode for data transmission. Before data transmission, the device needs to authenticate with the gateway. The gateway acts as an authentication server, storing the device's registration information during the device registration phase. This registration information includes necessary device information such as the device identifier, the device's mode key, and device parameters. The gateway issues an authentication challenge to the device. The device uses the aforementioned mode key to generate an encrypted response in the optimal mode, which the gateway decrypts for authentication in the optimal mode. After successful authentication by the gateway, the device can transmit data according to the communication protocol corresponding to the mode. Different communication modes have different communication protocols.

[0150] Due to interference from noise, electromagnetic waves, and other factors in the channel during data transmission, as well as the increase in the amount of data transmitted, the reliability of the transmission results may not be guaranteed when the devices continue to communicate using their optimal communication modes. Therefore, a gateway is needed to monitor the channel in real time.

[0151] During data transmission, the gateway performs channel quality assessment on the transmission channel of the device in optimal mode by real-time monitoring of signal power, data packet loss rate and the amount of data transmitted, predicts whether a handover is needed based on the trend of channel quality changes, and issues a handover warning.

[0152] S4. Authenticate the user in another communication mode based on the pre-generated key, establish a connection directly, and switch the communication protocol to switch the communication mode.

[0153] In step S2 above, the device pre-generates mode keys for each available mode before authentication by the gateway. Therefore, after issuing a switching warning, the gateway directly authenticates the device in the other available mode using the same optimal communication mode authentication method. Upon successful authentication, a communication connection is established between the device and the new available communication mode, switching the current optimal communication mode to the new one. The device then uses the communication protocol corresponding to the new communication mode for data transmission.

[0154] S5. Determine the data transmission endpoint during the switch based on the timestamp to ensure that no data is missed or retransmitted.

[0155] A timestamp is a timing stamp for data transmission. When the gateway finishes authenticating the device in another communication mode, the timestamp stops counting down. The data corresponding to this timestamp is taken as the endpoint of the data transmission. After the gateway completes the communication connection of the device in another available communication mode, the data to be transmitted continues to be transmitted according to the endpoint of the data transmission, so that data will not be missed or retransmitted when the communication mode is switched.

[0156] The embodiments of this application have at least the following beneficial effects:

[0157] A lightweight authentication system has been added to the communication mode adopted by the device, which improves the security of device communication;

[0158] Switching the device's communication mode based on channel quality improves the flexibility of communication methods.

[0159] This application also provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This computer device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0160] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented in the present device embodiments are the same as those in the above embodiments, and the beneficial effects achieved are also the same as those achieved in the above embodiments.

[0161] Please see Figure 6 , Figure 6 The hardware structure of a computer device according to another embodiment is illustrated. The computer device includes:

[0162] The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0163] The memory 902 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 902 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901 using the methods described in the embodiments of this application.

[0164] The input / output interface 903 is used to implement information input and output;

[0165] The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0166] Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904);

[0167] The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0168] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0169] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0170] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0171] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0172] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0173] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0174] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0175] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0176] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0177] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0178] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0179] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0180] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0181] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0182] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0183] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. An Internet of Things (IoT) communication system, characterized in that, The system includes an Internet of Things (IoT) device and an authentication server. The IoT device includes a response module and a transmission module. The authentication server includes an acquisition module, a parsing module, a challenge module, and an authentication module. The acquisition module is used to acquire the configuration parameters of the IoT device; The parsing module is used to determine the device communication mode of the IoT device based on the configuration parameters; The challenge module is used to generate a challenge signal according to the device communication mode and send the challenge signal to the IoT device; The response module is used to generate a communication key in response to the challenge signal and send the communication key to the authentication server; The authentication module is used to obtain the transmission requirement parameters of the IoT device; determine the device communication mode of the IoT device as a first communication mode based on the transmission requirement parameters; determine the first key in the communication key based on the first communication mode; and perform identity authentication of the IoT device using the first key. If authentication is successful, a first authentication confirmation signal is sent to the IoT device; The transmission module is used to transmit data based on the first communication mode in response to the first authentication confirmation signal.

2. The system according to claim 1, characterized in that, The authentication server also includes a monitoring module and a switching module; The monitoring module is used to monitor the communication channel of the first communication mode during data transmission and obtain monitoring data. The switching module is used to perform quality assessment based on the monitoring data to obtain channel quality; and to determine whether to switch the first communication mode based on the changes in the channel quality. If it is determined that the first communication mode should be switched, then the second communication mode is determined according to the device communication mode, and the authentication signal of the second communication mode is sent to the authentication module; The authentication module is further configured to respond to the authentication signal, determine the second key in the communication key according to the first communication mode, and authenticate the IoT device using the second key; if the authentication is successful, a second authentication confirmation signal is sent to the IoT device. The transmission module is further configured to, in response to the second authentication confirmation signal, stop data transmission based on the first communication mode and perform data transmission based on the second communication mode.

3. The system according to claim 1, characterized in that, The device communication modes include wired transmission mode and wireless transmission mode, and the parsing module is specifically used for: The device power consumption of the IoT device is determined based on the configuration parameters. If the power consumption of the device is greater than or equal to the preset power consumption, then the device communication mode of the IoT device is determined to include wired transmission mode and wireless transmission mode. If the power consumption of the device is less than the preset power consumption, then the device communication mode of the IoT device is determined to be wireless transmission mode.

4. The system according to claim 1, characterized in that, The parsing module is also used for: The transmission frequency band of the IoT device is determined based on the configuration parameters; The device communication mode of the Internet of Things device is determined based on the transmission frequency band and the frequency band of the device communication mode.

5. The system according to claim 1, characterized in that, The challenge module is specifically used for: Obtain the name of the device communication mode; The name is vectorized to obtain a vectorized name; Generate the first random number using a random number generator; The vectorized name and the first random number are concatenated to obtain the first concatenation result; The challenge signal is obtained by performing a hash operation on the first concatenation result.

6. The system according to claim 1, characterized in that, The response module is specifically used for: In response to the challenge signal, a challenge response is generated; The device identifier of the IoT device is generated using a physically unclonable function; The challenge response is concatenated with the device identifier to obtain the pattern response; Send a random number generation request to the authentication server to obtain a second random number; The pattern response is concatenated with the second random number to obtain the second concatenation result; The second concatenation result is hashed to obtain the communication key.

7. The system according to claim 2, characterized in that, The monitoring data includes signal power, data packet loss rate, and transmitted data volume. The switching module is specifically used for: The channel quality change record is determined based on the signal power, the data packet loss rate, and the amount of transmitted data; Based on the change records, predict the change data of the channel quality; Based on the change data, determine whether the channel quality is lower than a preset value; If the channel quality is lower than a preset value, the first communication mode is switched and a switching warning is sent to the front end.

8. An Internet of Things (IoT) communication method, characterized in that, The method includes the following steps: Obtain the configuration parameters and transmission requirements of IoT devices; The device communication mode of the IoT device is determined based on the configuration parameters; A challenge signal is generated according to the device communication mode, and the challenge signal is sent to the IoT device to obtain a communication key; Based on the transmission requirement parameters, the device communication mode of the IoT device is determined to be the first communication mode; The first key in the communication key is determined according to the first communication mode, and the IoT device is authenticated using the first key.

9. A computer device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method as described in claim 8.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of claim 8.

Images