Internet of Things equipment authentication method and equipment based on block chain, and medium

Abstract

The invention discloses an Internet of Things equipment authentication method and equipment based on a block chain, and a medium, and relates to the technical field of security certification, and the method comprises the steps that the Internet of Things equipment generates an initial key by using a security chip, calculates a hash value, and registers the hash value of the initial key to a block chain smart contract; based on the edge computing gateway, using the dynamic rotation key in the distributed verification request, verifying the validity of the dynamic rotation key through a lightweight zero-knowledge proof algorithm, generating a verification conclusion, and submitting the verification conclusion to the block chain smart contract; and the Internet of Things equipment receives the authentication token, completes identity authentication by using the authentication token, and establishes a two-way secure communication session. According to the method, the initial key hash of the Internet of Things equipment is registered through the block chain smart contract, and dynamic rotation key derivation and Bluetooth broadcast are driven in combination with the timestamp, so that encryption diffusion and distributed acquisition of the equipment identity declaration in the edge network are realized.

Description

Technical Field

[0001] This invention relates to the field of security authentication technology, and in particular to a blockchain-based method, device, and medium for authenticating Internet of Things (IoT) devices. Background Technology

[0002] With the rapid growth of IoT devices, traditional centralized identity authentication mechanisms face single points of failure and scalability bottlenecks. In recent years, blockchain technology, due to its decentralized and immutable characteristics, has been widely used in the field of IoT device identity management. Combined with zero-knowledge proofs and dynamic key derivation technology, it can achieve privacy-preserving verification of device identities. The introduction of edge computing architecture further reduces authentication latency, meeting the real-time requirements of IoT scenarios.

[0003] However, existing blockchain-based authentication schemes mostly rely on static keys or fixed certificates, with keys remaining valid for a long time and lacking a periodic update mechanism. Once a key is leaked during transmission or storage, attackers can use it to impersonate a legitimate device, posing a persistent security threat. Furthermore, static keys are vulnerable to replay attacks. Existing schemes typically mitigate synchronization errors by extending the timestamp tolerance window, but this increases the risk of key replay exploitation, lacking a balance between dynamic key validity verification and low-latency authentication. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a blockchain-based IoT device authentication method to solve the problem of valid verification of dynamic rotating keys and low-latency authentication coordination in a distributed environment during IoT device authentication.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] In a first aspect, the present invention provides a blockchain-based Internet of Things (IoT) device authentication method, which includes: the IoT device using a security chip to generate an initial key and calculate a hash value, and registering the hash value of the initial key to a blockchain smart contract;

[0008] IoT devices derive a dynamic rotation key based on an initial key and the current timestamp, and broadcast an encrypted statement of the dynamic rotation key via Bluetooth;

[0009] The edge computing gateway in the distributed edge verification network receives the encryption statement, collects the dynamic rotation key in the encryption statement, and generates a distributed verification request.

[0010] Based on the edge computing gateway, the dynamic rotating key in the distributed verification request is used to verify the validity of the dynamic rotating key through a lightweight zero-knowledge proof algorithm, generate a verification conclusion and submit it to the blockchain smart contract.

[0011] A consensus mechanism is executed based on the verification results and the hash value of the initial key registered, an authentication token is generated, and the authentication token is returned to the IoT device.

[0012] IoT devices receive authentication tokens, use the authentication tokens to complete identity authentication, and establish a two-way secure communication session.

[0013] As a preferred embodiment of the blockchain-based IoT device authentication method of the present invention, the IoT device derives a dynamic rotating key based on an initial key and the current timestamp, and the specific steps are as follows.

[0014] IoT devices obtain the current timestamp from the Network Time Protocol service and verify the validity of the current timestamp;

[0015] Using the initial key and the verified timestamp, a dynamic rotation key is generated through a key derivation function.

[0016] As a preferred embodiment of the blockchain-based IoT device authentication method of the present invention, the specific steps of broadcasting the encrypted declaration of the dynamic rotation key via Bluetooth are as follows:

[0017] Based on a dynamic rotating key, an encrypted statement is generated by encrypting the device identifier and timestamp using a symmetric encryption algorithm.

[0018] IoT devices are configured with broadcast parameters and transmit power for the Bluetooth Low Energy protocol, and the encryption declaration is encapsulated into an encryption declaration data frame structure that conforms to the Bluetooth broadcast data format;

[0019] Internet of Things (IoT) devices periodically broadcast encrypted declaration data frames at fixed time intervals;

[0020] In a distributed edge authentication network, the edge computing gateway continuously scans and receives encrypted claims in the Bluetooth broadcast channel.

[0021] As a preferred embodiment of the blockchain-based IoT device authentication method of the present invention, the specific steps for generating the distributed verification request are as follows:

[0022] The edge computing gateway uses a dynamic rotating key to decrypt the received encrypted statement, extract the decrypted IoT device unique identifier and timestamp information, and verify the validity of the timestamp and the registration status of the IoT device unique identifier.

[0023] A lightweight zero-knowledge proof algorithm is used to verify the derivation relationship between the dynamic rotating key and the initial key, generating a distributed verification request containing the verification conclusion, timestamp, and digital signature.

[0024] As a preferred embodiment of the blockchain-based IoT device authentication method of the present invention, the specific steps for generating a verification response and submitting it to the blockchain smart contract using the dynamic rotation key information in the distributed verification request are as follows:

[0025] The blockchain smart contract receives distributed verification requests, parses the digital signature and timestamp information in the verification request, and compares the matching degree of the digital signature with the initial key hash value registered on the blockchain.

[0026] By verifying the validity of the timestamp and the validity of the distributed verification request, a verification conclusion containing the timestamp is generated and submitted to the blockchain smart contract.

[0027] As a preferred embodiment of the blockchain-based IoT device authentication method of the present invention, the specific steps for generating an authentication token and returning the authentication token to the IoT device are as follows:

[0028] The blockchain smart contract checks and verifies the result. When the verification result is passed, a token containing the unique identifier of the IoT device is generated.

[0029] When the verification result is unsuccessful, the smart contract generates an authentication failure response containing an error code and the unique identifier of the IoT device, and records the verification result operation to the blockchain;

[0030] A temporary session key is generated using the initial key hash value. The token identifier is then bound to the temporary session key to generate an authentication token, which is then returned to the IoT device.

[0031] As a preferred embodiment of the blockchain-based IoT device authentication method of the present invention, the specific steps for using an authentication token to complete identity authentication are as follows:

[0032] The IoT device receives the authentication token and verifies the integrity of the digital signature, extracting the temporary session key and the IoT device's unique identifier from the authentication token.

[0033] Based on the extracted temporary session key, a random value is generated as an encryption parameter, and the authentication request containing the authentication token is encrypted using the AES encryption algorithm.

[0034] A secure communication channel is established using a temporary session key and the AES encryption algorithm to send an authentication request containing an authentication token to the service provider.

[0035] As a preferred embodiment of the blockchain-based IoT device authentication method of the present invention, the specific steps for establishing a secure communication session are as follows:

[0036] Service providers verify the digital signature of the authentication token and the registration status of the unique identifier of the IoT device, and query the blockchain to confirm the validity and current status of the authentication token;

[0037] If the authentication token fails to be verified and the current status is unavailable, the service provider terminates the session establishment process and generates an authentication failure log.

[0038] If the authentication token is verified and its current status is available, the service provider uses the temporary session key in the authentication token to negotiate a key with the IoT device and establishes a two-way secure communication session based on the negotiated temporary session key.

[0039] In a second aspect, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the blockchain-based Internet of Things device authentication method as described in the first aspect of the present invention.

[0040] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the blockchain-based Internet of Things device authentication method as described in the first aspect of the present invention.

[0041] The beneficial effects of this invention are as follows: By registering the initial key hash of IoT devices through blockchain smart contracts, combined with timestamp-driven dynamic rotating key derivation and Bluetooth broadcasting, the encrypted diffusion and distributed collection of device identity declarations on the edge network are realized; by using a lightweight zero-knowledge proof protocol to perform the derivation relationship verification between the dynamic key and the on-chain registered key locally on the verification node, and using the Schnorr protocol to complete the cryptographic relationship proof under the premise of concealing the initial key, the blockchain consensus load is significantly reduced and the verification real-time performance is improved; based on the smart contract consensus, a time-sensitive authentication token is generated, and through the establishment of a two-way encrypted session and synchronization with the on-chain state, the trusted authentication of IoT device identity and dynamic protection of communication security are realized, achieving the coordinated protection of decentralized trust, low-latency response and privacy protection in the IoT device authentication process. Attached Figure Description

[0042] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a flowchart of a blockchain-based IoT device authentication method.

[0044] Figure 2 A flowchart generated for edge verification and proof.

[0045] Figure 3 A flowchart for blockchain consensus and authentication token issuance.

[0046] Figure 4 A flowchart for establishing a secure session. Detailed Implementation

[0047] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0048] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0049] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0050] Reference Figures 1-4 This is one embodiment of the present invention, which provides a blockchain-based IoT device authentication method, including the following steps:

[0051] S1: IoT devices use a security chip to generate an initial key and calculate a hash value, then register the hash value of the initial key to a blockchain smart contract.

[0052] Specifically, IoT devices activate security chips (e.g., security chips provided by MODSEMI, such as the MOD5FM security chip). These chips use built-in resistors to capture molecular thermal motion in real time, generating thermal noise entropy values.

[0053] By utilizing the quantum well structure built into the security chip, electron tunneling events are counted within a fixed window (example: 100 microsecond window) to generate quantum random data. The entropy value and quantum random data are cross-fused using the SHA-256 algorithm, and a high-entropy pool is constructed through a cyclic counter mechanism.

[0054] The high-entropy pool is processed based on the HKDF-SHA256 algorithm, and the initial key is derived by combining the encryption salt value built into the security chip, and the hash value of the initial key is calculated.

[0055] IoT devices call the registration function of the blockchain smart contract, send a transaction request through the blockchain network interface, pass the hash value of the initial key to the smart contract, the smart contract executes the registration, and stores the hash value in the blockchain distributed ledger.

[0056] It should be noted that molecular thermal motion is captured by a built-in resistor (example: 1MHz sampling rate ±5%), generating a thermal noise entropy value. When consecutive sampling failures occur (example: 3 failures), the chip fuse protection is triggered, blocking the key generation process.

[0057] In the production process of security chips, a salt value with cryptographic strength is generated through a quantum random source, and the salt value is permanently burned into the chip's tamper-proof storage area using a laser filament method, thus establishing an immutable hardware-level trust anchor.

[0058] S2: The IoT device derives a dynamic rotation key based on the initial key and the current timestamp, and broadcasts an encrypted statement of the dynamic rotation key via Bluetooth.

[0059] S2.1: The IoT device obtains the current timestamp from the Network Time Protocol service and verifies the validity of the current timestamp.

[0060] Send a time request to the time server via the NTPv4 protocol, receive the service response returned by the time server, parse the returned service response, and extract the current UTC timestamp (Coordinated Universal Time timestamp);

[0061] The IoT device compares the current UTC timestamp obtained with the IoT device's local time and calculates the time difference between the IoT device and the time.

[0062] IoT devices check whether the time difference is within a predetermined tolerance range. If the time difference exceeds the predetermined tolerance range, the timestamp is discarded and reacquired; if the time difference is within the predetermined tolerance range, the timestamp is considered valid.

[0063] It should be noted that the predetermined tolerance range should cover typical error sources such as network timing (NTPv4 protocol service) latency and clock drift of IoT devices, and ensure that the window is much smaller than the effective period of the dynamic key to resist replay attacks. An example value for the predetermined tolerance range is set to ±30 seconds.

[0064] S2.2: Using the initial key and the verified timestamp, a dynamic rotation key is generated through the key derivation function.

[0065] The IoT device uses the verified timestamp as a dynamic derivation parameter and the initial key as input key material. It processes the initial key and timestamp through a key derivation function to perform one-way operations on the initial key and timestamp to generate a pseudo-randomized intermediate key.

[0066] Based on the key derivation function, the associated data composed of the intermediate key, the unique identifier of the IoT device and the verified timestamp are calculated in multiple rounds by repeatedly calling the cryptographic hash function. The output of each round constitutes part of the dynamic rotating key and is fed back as input to the next round of calculation. Through iterative calculation, a continuous key material byte stream is generated, and the dynamic rotating key is derived.

[0067] It should be noted that the unique identifier of an IoT device is a unique string preset during the manufacturing or initialization phase of the IoT device. The unique identifier of an IoT device can be read through the security chip storage or the inherent attributes of the hardware (such as the MAC address).

[0068] S2.3: Based on a dynamic rotating key, an encrypted statement is generated by encrypting the device identifier and timestamp using a symmetric encryption algorithm.

[0069] Based on the dynamic rotating key, the unique identifier of the IoT device is combined with the verified timestamp as plaintext. The IoT device uses the dynamic rotating key as the key to encrypt the plaintext using the AES-256 encryption algorithm, generating an encrypted statement. The encrypted statement contains the encrypted device identifier and timestamp information.

[0070] It should be noted that the unique identifier of an IoT device is a unique string preset during the manufacturing or initialization phase of the IoT device. The unique identifier of an IoT device can be read through the security chip storage or the inherent attributes of the hardware (such as the MAC address).

[0071] S2.4: Configure the broadcast parameters and transmit power of the Bluetooth Low Energy protocol for IoT devices, and encapsulate the encryption declaration into an encryption declaration data frame structure that conforms to the Bluetooth broadcast data format.

[0072] IoT devices configure the broadcast parameters for the Bluetooth Low Energy protocol, including broadcast interval, broadcast type, broadcast channel, and transmit power settings.

[0073] IoT devices encapsulate the encryption declaration into a data frame conforming to the Bluetooth broadcast data format. The data frame contains a broadcast header (AD Type and AD Data), and the AD Data field is filled with the encryption declaration. After encapsulation, an encryption declaration data frame structure is generated.

[0074] S2.5: IoT devices periodically broadcast encrypted claim data frames at fixed time intervals.

[0075] When an IoT device initiates Bluetooth Low Energy (BLE) broadcasting, it periodically sends encrypted claim data frames at fixed time intervals. The broadcast operation is performed through the BLE protocol stack, ensuring that the encrypted claim data frames are transmitted on the broadcast channel.

[0076] S2.6: In a distributed edge verification network, the edge computing gateway continuously scans and receives encrypted claims in the Bluetooth broadcast channel.

[0077] The edge computing gateway enables the Bluetooth Low Energy scanning function, and the edge computing gateway sets the scanning parameters, scanning interval, scanning window and scanning type.

[0078] The distributed edge verification network is dynamically composed of edge layer gateway devices. The Bluetooth broadcast listening range is divided by a regional sharding strategy. The edge computing gateway with the strongest signal in each shard acts as the master node, coordinating the aggregation of verification requests within the shard. The edge computing gateway nodes synchronize the registration status of the unique identifier of IoT devices through the lightweight MQTT protocol, reducing on-chain query latency.

[0079] The edge computing gateway continuously listens to the Bluetooth broadcast channel, receives encrypted declaration data frames, and parses and extracts the encrypted declarations.

[0080] S3: Receives encrypted claims from IoT devices in the distributed edge verification network, collects the dynamic rotation key from the encrypted claims, and generates a distributed verification request.

[0081] S3.1: The edge computing gateway uses a dynamic rotating key to decrypt the received encrypted statement, extracts the decrypted IoT device unique identifier and timestamp information, and verifies the validity of the timestamp and the registration status of the IoT device unique identifier.

[0082] In a distributed edge verification network, the edge computing gateway receives the encrypted statement, decrypts it using a dynamic rotating key, applies the AES-256 decryption algorithm, and outputs the decrypted plaintext. The plaintext contains the IoT device's unique identifier and timestamp information.

[0083] The edge computing gateway obtains the current UTC timestamp and calculates the time difference between the decrypted timestamp and the current timestamp at the edge computing gateway. It then checks if the time difference is within a predetermined tolerance range. If the time difference exceeds the predetermined tolerance range, the timestamp is discarded and re-obtained; if the time difference is within the predetermined tolerance range, the timestamp is considered valid.

[0084] Ideally, the edge computing gateway performs a second time stamp verification to detect delay injection attacks during transmission. Even if an attacker steals the encrypted declaration, the edge computing gateway will directly discard the data and block the replay link because the time stamp exceeds the predetermined tolerance range. The first time stamp verification verifies the absolute validity of the data, and the second verification verifies whether the transmission delay is reasonable. This identifies the injection attack that the attacker steals legitimate data and then maliciously delays forwarding the data within the validity window.

[0085] The edge computing gateway calls the query interface of the blockchain smart contract, passing in the decrypted unique identifier of the IoT device. The blockchain smart contract retrieves the registration record of the initial key hash value corresponding to the unique identifier of the IoT device in the distributed ledger. If a registration record exists, the identifier status is "registered"; otherwise, the identifier status is "unregistered".

[0086] S3.2: Use a lightweight zero-knowledge proof algorithm to verify the derivation relationship between the dynamic rotating key and the initial key, and generate a distributed verification request containing the verification conclusion, timestamp, and digital signature.

[0087] The edge computing gateway calls the blockchain smart contract interface, passes in the unique identifier of the IoT device, and queries the hash value of the initial key registered in the blockchain distributed ledger.

[0088] The edge computing gateway defines a zero-knowledge proof objective based on a key derivation function. The dynamically rotated key satisfies the derivation relation, and the initial key hash value serves as the public commitment value of the initial key. The verifiability of the derivation relation is ensured by binding it to blockchain registration records, while avoiding the exposure of the initial key plaintext.

[0089] The dynamic rotation key satisfies the derivation relation, expressed as:

[0090] K = HKDF(Z, T);

[0091] In the formula, HKDF is the key derivation function, Z is the public commitment value of the initial key, T is the timestamp, and K is the dynamic rotation key.

[0092] The edge computing gateway executes the Schnorr protocol to verify the derivation validity of the dynamic rotation key, generates a temporary private random number, performs modular exponentiation using a preset elliptic curve generator, and generates a temporary commitment value.

[0093] In the formula, the temporary commitment value is generated, and the expression is:

[0094] R = g r modp;

[0095] In the formula, R is the temporary commitment value, g is the elliptic curve generator, r is the temporary private random number, p is the prime number (group order modulus), modp is the modulo operation of the prime number p, and mod is the modulo operation.

[0096] It should be noted that the preset elliptic curve generators directly reference the generators and associated domain parameters explicitly defined in the secp256k1 curve.

[0097] The edge computing gateway concatenates the temporary commitment value, the initial key hash value, and the timestamp, and processes them using the SHA-256 hash function to generate a challenge value;

[0098] The expression for generating the challenge value is:

[0099] c = H(R||Z||T);

[0100] In the formula, c is the challenge value, H is the SHA-256 hash function, || is the data concatenation operation, and H(R||Z||T) is the byte concatenation of the temporary commitment value R, the public commitment value Z of the initial key, and the timestamp T in sequence.

[0101] The edge computing gateway performs linear operations of modular addition and modular multiplication based on temporary random numbers, challenge values, and dynamic rotation keys to generate private response values;

[0102] The expression for generating a private response value is as follows:

[0103] s = r + c·Kmodq;

[0104] In the formula, s is the private response value, q is the elliptic curve subgroup order (elliptic curve parameter), and Kmodq is the modulo operation of the dynamic rotation key K on the elliptic curve subgroup order q.

[0105] Perform modular exponentiation on the elliptic curve generator and the private response value, and output the modular exponentiation result of the elliptic curve generator and the private response value; perform modular exponentiation on the temporary commitment value and the dynamic rotation key, and generate the product of the modular exponentiation result of the temporary commitment value and the dynamic rotation key.

[0106] The equation verification is performed on the product of the modular exponentiation result of the generator and the response value and the modular exponentiation result of the public commitment value and the dynamic rotation key. The derivation validity of the dynamic rotation key is determined and the verification conclusion is output.

[0107] The equation verification is performed on the product of the modular exponentiation result of the generator and the response value and the modular exponentiation result of the public commitment value and the dynamic rotating key. The expression is as follows:

[0108]

[0109] In the formula, g sR·(g) is the modulo exponentiation result of the elliptic curve generator g and the private response value s. K ) c For the group multiplication of the temporary commitment value and the modular exponentiation result of the dynamic rotating key, g K The public verification point is obtained by performing a scalar multiplication operation between the elliptic curve generator g and the dynamic rotation key K. The public verification point is the cryptographic public key corresponding to the dynamic rotation key K. K ) c Let c be the challenge value of the cryptographic public key corresponding to the dynamic rotation key K. To verify the congruence symbol.

[0110] The verification conclusion for determining the derived validity of the dynamic rotation key is expressed as follows:

[0111] When (g) s modp)≡(R·(g K ) c When )modp, it means that the dynamic rotation key is correctly derived from the initial key and timestamp through the key derivation function, and the derivation relationship is valid.

[0112] when When this occurs, it indicates that the dynamic rotation key is invalid or the derivation relationship has been tampered with, rendering the derivation relationship invalid.

[0113] The edge computing gateway generates verification conclusions and timestamps based on the Schnorr protocol, serializes them into JSON strings, and performs SHA-256 hash operations on the JSON strings to generate fixed-length digests.

[0114] The edge computing gateway's private key is used to calculate the digest using the ECDSA algorithm, outputting a DER-encoded signature. The verification conclusion, timestamp, and DER-encoded signature are then encapsulated into a distributed verification request in JSON format.

[0115] It should be noted that invalid derivation relationships can occur if the dynamic rotating key is not correctly derived through the key derivation function, the timestamp exceeds the preset tolerance range leading to invalidation, or the initial key hash value is tampered with in the blockchain registration record.

[0116] S4: Based on the edge computing gateway, the dynamic rotating key in the distributed verification request is used to verify the validity of the dynamic rotating key through a lightweight zero-knowledge proof algorithm, generate the verification conclusion and submit it to the blockchain smart contract;

[0117] S4.1: The blockchain smart contract receives distributed verification requests, parses the digital signature and timestamp information in the verification request, and compares the matching degree of the digital signature with the initial key hash value registered on the blockchain.

[0118] The blockchain smart contract receives distributed verification requests from the edge computing gateway and extracts the DER-encoded signature, timestamp, and verification conclusion.

[0119] Based on the unique identifier of the IoT device, query the blockchain distributed ledger to obtain the initial key hash value for registration;

[0120] The DER-encoded signature and timestamp in the distributed verification request are recombined into a JSON string in a fixed format, and the hash value of the recombined JSON string is calculated using the SHA-256 algorithm.

[0121] The hash value of the recombined JSON string is compared with the hash value of the initial key. ECDSA signature verification is performed using the public key of the edge computing gateway pre-installed on the blockchain. If the digital signature verification passes, the digital signature matches the hash value of the initial key highly. If the digital signature verification fails, the digital signature matches the hash value of the initial key highly.

[0122] Obtain the absolute difference between the current UTC timestamp and the current time on the blockchain, and calculate the time difference on the blockchain;

[0123] The system determines whether the time difference on the blockchain is within a predetermined tolerance range. If the time difference exceeds the predetermined tolerance range, the timestamp is invalid; if the time difference is within the predetermined tolerance range, the timestamp is considered valid.

[0124] S4.2: By verifying the validity of the timestamp and the validity of the distributed verification request, generate a verification conclusion containing the timestamp and submit it to the blockchain smart contract.

[0125] Based on the time stamp validity determination result and the digital signature verification result;

[0126] If the timestamp is valid and the digital signature has a high matching degree, the distributed verification request will generate a verification conclusion containing the verification conclusion and the timestamp and submit it to the blockchain smart contract.

[0127] If the timestamp expires or the digital signature has a low matching degree, mark the distributed verification request as invalid, terminate the process, and record the error log to the blockchain distributed ledger.

[0128] S5: Based on the verification conclusion and the hash value of the initial key registered, execute the consensus mechanism, generate an authentication token, and return the authentication token to the IoT device.

[0129] The S5.1 blockchain smart contract checks and verifies the results. When the verification result is passed, a token containing the unique identifier of the IoT device is generated.

[0130] The blockchain smart contract checks and verifies the verification conclusion in the response. When the verification conclusion is passed, it concatenates the unique identifier of the IoT device with the timestamp to generate a token identifier containing the unique identifier of the IoT device.

[0131] S5.2: When the verification result is unsuccessful, the smart contract generates an authentication failure response containing an error code and the unique identifier of the IoT device, and records the verification result operation to the blockchain;

[0132] S5.3: Generate a temporary session key using the initial key hash value, bind the token identifier to the temporary session key to generate an authentication token, and return the authentication token to the IoT device.

[0133] Use key derivation functions to process the initial key hash value and timestamp, and output a temporary session key to ensure the unpredictability and timeliness of the key;

[0134] The token identifier, temporary session key, and time validity period are encapsulated to generate a complete authentication token;

[0135] The authentication token is serialized into a JSON string, and the JSON string is hashed using SHA-256 hashing. The hash value of the JSON string is then processed using the ECDSA algorithm through the private key of the blockchain smart contract, and the authentication token and DER-encoded signature are output and returned to the IoT device.

[0136] It should be noted that the time validity period is a mandatory expiration point set when the blockchain smart contract generates the authentication token. The default example value is the current UTC time plus 300 seconds. By limiting the token's lifespan, the replay attack window is blocked, and together with the timestamp tolerance range, a dual time protection mechanism is formed. If the service provider detects that the current time has exceeded the time validity period when verifying the request, it will immediately terminate the session and record the security event to the blockchain.

[0137] S5.3: When the verification result is unsuccessful, the smart contract generates an authentication failure response containing an error code and the unique identifier of the IoT device, and records the verification result operation to the blockchain.

[0138] S6: IoT devices receive authentication tokens, use the authentication tokens to complete identity authentication, and establish a two-way secure communication session.

[0139] S6.1: The IoT device receives the authentication token and verifies the integrity of the digital signature, and extracts the temporary session key and the IoT device's unique identifier from the authentication token.

[0140] When an IoT device receives an authentication token, it performs structured data parsing to extract the token identifier, temporary session key, time validity period, and DER-encoded signature.

[0141] Reconstruct the authentication token JSON string and use the SHA-256 algorithm to calculate the hash value of the reconstructed authentication token JSON string;

[0142] ECDSA signature verification is performed using the blockchain public key based on the hash value of the JSON string of the recombined authentication token and the DER-encoded signature.

[0143] When the signature verification is successful, the temporary session key and the device's unique identifier are extracted. When the verification fails, the process is terminated and an error log is recorded.

[0144] S6.2: Based on the extracted temporary session key, generate a random value as an encryption parameter, and use the AES encryption algorithm to encrypt the authentication request containing the authentication token.

[0145] A secure communication channel for the AES-GCM encryption protocol is constructed based on the temporary session key in the authentication token, with the temporary session key serving as the core encryption credential.

[0146] IoT devices create a 12-byte random number (nonce) value as a unique identifier for encrypted sessions, ensuring unpredictability and resistance to replay attacks in each communication.

[0147] The authentication request for the authentication token (including the token identifier, temporary session key, time validity period, and DER-encoded signature) is encapsulated into a plaintext JSON data packet.

[0148] S6.3: Use a temporary session key to establish a secure communication channel using the AES encryption algorithm and send an authentication request containing an authentication token to the service provider.

[0149] The plaintext JSON data packet is encrypted using the AES-GCM encryption algorithm, with a temporary session key as the encryption key and a 12-byte random number nonce value as a dynamic parameter to generate encrypted request data.

[0150] IoT devices combine encrypted request data with nonce values ​​to reconstruct standardized JSON format data packets, establish an end-to-end secure communication channel through the HTTPS security protocol, and send standardized JSON transmission data packets to service providers.

[0151] S6.4: The service provider verifies the registration status of the digital signature of the authentication token and the unique identifier of the IoT device, and queries the blockchain to confirm the validity and current status of the authentication token.

[0152] After receiving the JSON format data packet, the service provider performs triple verification: decrypting the data using a temporary session key and a random value, restoring the plaintext token identifier, reassembling the token data, and verifying the DER-encoded signature.

[0153] The registration status of the unique identifier of the IoT device is queried and verified through the blockchain smart contract, the validity period of the authentication token is checked, and it is confirmed that the authentication token has not been marked as invalid.

[0154] S6.5: If the authentication token fails to pass verification and the current status is unavailable, the service provider terminates the session establishment process and generates an authentication failure log.

[0155] When any of the following occurs: DER encoded signature, IoT device unique identifier not registered, authentication token expired, or authentication token invalidated, the service provider immediately terminates the session, closes the connection channel, generates an error log containing error code, device identifier, and timestamp, and updates the token status to invalid on the blockchain to prevent malicious reuse.

[0156] S6.6: If the authentication token is verified and its current status is available, the service provider uses the temporary session key in the authentication token to negotiate a key with the IoT device and establishes a two-way secure communication session based on the negotiated temporary session key.

[0157] If the authentication token is verified and its current status is available, the service provider and the IoT device negotiate and derive a new session key based on the temporary session key through the HKDF function.

[0158] A two-way encrypted communication channel is established based on the new session key. The AES-GCM encryption protocol is used independently from the service provider to the IoT device and from the IoT device to the service provider. Each direction maintains an independent random number counter, and the corresponding random value of the counter is incremented each time data is sent to ensure the confidentiality and integrity of the two-way data stream.

[0159] This embodiment also provides a computer device applicable to the blockchain-based IoT device authentication method, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the blockchain-based IoT device authentication method proposed in the above embodiment.

[0160] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0161] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the blockchain-based IoT device authentication method proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0162] In summary, this invention achieves encrypted dissemination and distributed collection of device identity claims on the edge network by combining the initial key hash of the registered IoT device registration via blockchain smart contract with timestamp-driven dynamic rotating key derivation and Bluetooth broadcasting. A lightweight zero-knowledge proof protocol is used to locally verify the derivation relationship between the dynamic key and the on-chain registered key on the verification node. The Schnorr protocol is employed to complete the cryptographic relationship proof while concealing the initial key, significantly reducing the blockchain consensus load and improving verification real-time performance. Based on smart contract consensus, a time-sensitive authentication token is generated. Through bidirectional encrypted sessions and synchronization with the on-chain state, trusted authentication and dynamic security of IoT device identities are dynamically guaranteed, achieving a synergistic guarantee of decentralized trust, low-latency response, and privacy protection during the IoT device authentication process.

[0163] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A blockchain-based method for authenticating an Internet of Things device, the method comprising: The method comprises the steps of: The Internet of Things device generates an initial key and a hash value using a secure chip, and registers the hash value of the initial key to a blockchain smart contract; The Internet of Things device derives a dynamic rotating key based on the initial key and a current timestamp, and broadcasts an encrypted declaration of the dynamic rotating key through Bluetooth; An edge computing gateway in a distributed edge verification network receives the encrypted declaration and collects the dynamic rotating key in the encrypted declaration, and generates a distributed verification request; The edge computing gateway verifies the validity of the dynamic rotating key through a lightweight zero-knowledge proof algorithm based on the dynamic rotating key in the distributed verification request, generates a verification conclusion, and submits the verification conclusion to the blockchain smart contract; Based on the verification conclusion and the registered initial key hash value, a consensus mechanism is executed to generate an authentication token, and the authentication token is returned to the Internet of Things device; The Internet of Things device receives the authentication token, completes identity authentication using the authentication token, and establishes a two-way secure communication session. 2.The blockchain-based Internet of Things device authentication method of claim 1, wherein: The Internet of Things device derives a dynamic rotating key based on the initial key and a current timestamp, and the specific steps are as follows, The Internet of Things device obtains a current timestamp from a network time protocol service and verifies the validity of the current timestamp; The initial key and the verified timestamp are used to derive a dynamic rotating key through a key derivation function. 3.The blockchain-based Internet of Things device authentication method of claim 2, wherein: The specific steps of broadcasting the encrypted declaration of the dynamic rotating key through Bluetooth are as follows, Based on the dynamic rotating key, the device identifier and the timestamp are encrypted through a symmetric encryption algorithm to generate an encrypted declaration; The Internet of Things device configures the broadcast parameters and transmission power of the Bluetooth Low Energy protocol, encapsulates the encrypted declaration into an encrypted declaration data frame structure conforming to the Bluetooth broadcast data format, and periodically broadcasts the encrypted declaration data frame at a fixed time interval. The edge computing gateway in the distributed edge verification network continuously scans and receives the encrypted declaration in the Bluetooth broadcast channel. The specific steps of generating a distributed verification request are as follows, 4.The blockchain-based Internet of Things device authentication method of claim 3, wherein: The edge computing gateway decrypts the received encrypted declaration using the dynamic rotating key, extracts the decrypted Internet of Things device unique identifier and timestamp information, and verifies the validity of the timestamp and the registration status of the Internet of Things device unique identifier; The derivation relationship between the dynamic rotating key and the initial key is verified using a lightweight zero-knowledge proof algorithm, and a distributed verification request containing the verification conclusion, the timestamp, and a digital signature is generated. The specific steps of generating an authentication token and returning the authentication token to the Internet of Things device are as follows, 5.The blockchain-based Internet of Things device authentication method of claim 4, wherein: The blockchain smart contract receives the distributed verification request, parses the digital signature and timestamp information in the verification request, and compares the matching degree of the digital signature with the registered initial key hash value on the blockchain; The validity of the timestamp and the validity of the distributed verification request are verified, a verification conclusion containing the timestamp is generated, and the verification conclusion is submitted to the blockchain smart contract. The specific steps of generating an authentication token and returning the authentication token to the Internet of Things device are as follows, 6.The blockchain-based Internet of Things device authentication method of claim 5, wherein: The blockchain smart contract checks the verification conclusion, and when the verification conclusion is passed, a token identifier containing the Internet of Things device unique identifier is generated. ​ When the verification conclusion is failed, the smart contract generates an authentication failure response containing an error code and the unique identifier of the IoT device, and records the verification conclusion operation to the blockchain; An authentication token is generated by using the initial key hash value to generate a temporary session key, and binding the token identifier with the temporary session key, and the authentication token is returned to the IoT device. 7.The blockchain-based Internet of Things device authentication method of claim 6, wherein: The identity authentication is completed using the authentication token, and the specific steps are as follows, The IoT device receives the authentication token and verifies the integrity of the digital signature, extracts the temporary session key and the unique identifier of the IoT device in the authentication token; Based on the extracted temporary session key, a random number value is generated as an encryption parameter, and an identity authentication request containing the authentication token is encrypted using the AES encryption algorithm; A secure communication channel is established using the temporary session key through the AES encryption algorithm, and an identity authentication request containing the authentication token is sent to the service provider. 8.The blockchain-based Internet of Things device authentication method of claim 7, wherein: The specific steps of establishing a two-way secure communication session are as follows, The service provider verifies the digital signature of the authentication token and the registration status of the unique identifier of the IoT device, and queries the blockchain to confirm the validity and current state of the authentication token; If the authentication token fails the verification and the current state is unavailable, the service provider terminates the session establishment process and generates an authentication failure log; If the authentication token passes the verification and the current state is available, the service provider performs key negotiation with the IoT device using the temporary session key in the authentication token, and establishes a two-way secure communication session based on the negotiated temporary session key. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is characterized in that: The processor executes the computer program to realize the steps of the blockchain-based IoT device authentication method of any one of claims 1-8.

10. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by the processor to realize the steps of the blockchain-based IoT device authentication method of any one of claims 1-8.

Images