Secure communication method for internet of things system

Abstract

The application relates to the communication field and provides a security communication method of an Internet of Things system, which comprises the following steps: a first target node sends communication request information to a second target node in a communication range; after the second target node receives the communication request information, the second target node extracts mask information by using a first reversible function corresponding to a first inverse function, sends communication reply information encrypted by using an encryption function to the first target node after determining the security of the mask information; after the first target node receives the communication reply information, the first target node generates a public key pair based on a first random number and a second random number; and the first target node carries out security communication with the second target node based on the public key pair. The method is used for solving the problem that sensitive parameters are not protected in the transmission process and the password key is stored in the form of plaintext and is usually updated in a fixed time period, and the security has certain defects in the prior art, and the method can realize security communication of the Internet of Things system.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a secure communication method for an Internet of Things (IoT) system. Background Technology

[0002] With breakthroughs in key technologies such as 5G, the Internet of Things (IoT) has developed rapidly, and its market size has also grown quickly. IoT has permeated every aspect of our lives, from clothing and food to housing and transportation, with the number of connected devices increasing rapidly and massive numbers of devices accessing the internet. While the "Internet of Everything" brings convenience, frequent data breaches and cyberattacks involving smart devices threaten personal privacy and security, especially posing significant risks to the digital transformation of industries.

[0003] Some existing key management schemes have certain security deficiencies because sensitive parameters are not protected during transmission and cryptographic keys are stored in plaintext and are usually updated within fixed time periods. Summary of the Invention

[0004] This invention provides a secure communication method for an Internet of Things (IoT) system, which addresses the security deficiencies in existing conventional solutions due to the lack of protection for sensitive parameters during transmission and the storage of cryptographic keys in plaintext, which are typically updated within fixed time periods. The solution proposed in this application can achieve secure communication for IoT systems.

[0005] This invention provides a secure communication method for an Internet of Things (IoT) system, comprising: The first target node sends a communication request message to the second target node within the communication range. The communication request message includes the first identifier of the first target node, mask information encapsulated using the first inverse function corresponding to the first target node, and an encryption function. The mask information includes the mask information of the first identifier of the first target node and the mask information of the first random number generated by the first target node. After receiving the communication request information, the second target node uses a first invertible function corresponding to the first inverse function to extract the mask information. After determining the security of the mask information, it sends a communication reply information encrypted with the encryption function to the first target node. The communication reply information includes the second identifier of the second target node, the second random number generated by the second target node, and the first random number. After receiving the communication reply information, the first target node generates a public key pair based on the first random number and the second random number, while the second target node generates a public key pair based on the first random number and the second random number. The first target node communicates securely with the second target node based on the public key pair.

[0006] According to the secure communication method of the Internet of Things system provided by the present invention, the first target node sends a communication request message to a second target node within the communication range, which includes the following steps: The first target node determines the adjacent target nodes within the communication range through a broadcast identifier. The adjacent target nodes include the second target node. The broadcast identifier includes the first identifier of the first target node and the first inverse function corresponding to the first target node. After determining the adjacent target nodes, the first target node deletes the pre-stored node identifiers and corresponding invertible functions of other nodes besides the adjacent target nodes. The first inverse function and the first invertible function corresponding to the first inverse function are pre-generated, and the first target node pre-stores the first inverse function and the invertible functions of all nodes in the Internet of Things system.

[0007] According to the secure communication method for an Internet of Things (IoT) system provided by the present invention, the first target node determines adjacent target nodes within the communication range through a broadcast identifier, including: The first target node broadcasts the broadcast identifier to all nodes within its communication range; The node that receives the broadcast identifier determines the first identifier of the first target node based on the broadcast identifier; If the first identifier has been pre-stored, the first target node is determined to be an adjacent target node.

[0008] According to the secure communication method for an Internet of Things (IoT) system provided by the present invention, determining the security of the mask information includes: The mask information of the first identifier extracted from the mask information is compared with the first identifier contained in the communication request information. If they match, the mask information is determined to be secure.

[0009] According to the secure communication method for an Internet of Things (IoT) system provided by the present invention, before the first target node generates a public key pair based on the first random number and the second random number after receiving the communication reply information, the method further includes: The first random number in the communication reply information is compared with the first random number generated by the first target node. If they match, the communication reply information is determined to be secure.

[0010] According to the secure communication method for an Internet of Things (IoT) system provided by the present invention, the first target node communicates securely with the first target node based on the public key pair, and then further includes: The first target node updates the public key pair by regenerating a first random number after a set time.

[0011] The secure communication method for an Internet of Things (IoT) system provided by the present invention further includes: Load the public key pair into the memory of the new node; Assign an identifier, a reversible function, and a corresponding inverse function to the new node; The new node is deployed to the Internet of Things system.

[0012] The secure communication method for an Internet of Things (IoT) system provided by the present invention further includes: If the first target node fails to send a message for a period of time exceeding a set time, the first target node will be removed from the Internet of Things system. The second target node deletes the public key pair with the first target node.

[0013] According to the secure communication method for an Internet of Things (IoT) system provided by the present invention, after the first target node is removed from the IoT system, the method further includes: The IoT system is restructured by deleting the node information of the first target node in the IoT system.

[0014] According to the secure communication method for an Internet of Things (IoT) system provided by the present invention, the encryption function is pre-deployed on each node of the IoT system before communication.

[0015] In the secure communication method for the Internet of Things (IoT) system provided by this invention, a reversible function can be used to protect the established public key pair, avoiding the storage of the key in plaintext form and improving the security of communication between various nodes in the IoT system. On the other hand, the first target node and the second target node undergo two security verifications before finally establishing a communication connection, further enhancing security. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the secure communication method for an Internet of Things (IoT) system provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of the structure of the Internet of Things system provided in an embodiment of the present invention; Figure 3 This is one of the timing diagrams of the key creation process provided in the embodiments of the present invention; Figure 4This is the second timing diagram of the key creation process provided in the embodiments of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0019] Figure 1 This is a flowchart illustrating the secure communication method for an Internet of Things (IoT) system provided in an embodiment of the present invention.

[0020] like Figure 1 As shown, this embodiment provides a secure communication method for an Internet of Things (IoT) system, including: Step 101: The first target node sends a communication request message to the second target node within the communication range. The communication request message includes the first identifier of the first target node, mask information encapsulated using the first inverse function corresponding to the first target node, and an encryption function. The mask information includes the mask information of the first identifier of the first target node and the mask information of the first random number generated by the first target node. Step 102: After receiving the communication request information, the second target node uses the first invertible function corresponding to the first inverse function to extract the mask information. After determining the security of the mask information, it sends a communication reply information encrypted with the encryption function to the first target node. The communication reply information includes the second identifier of the second target node, the second random number generated by the second target node, and the first random number. Step 103: After receiving the communication reply information, the first target node generates a public key pair based on the first random number and the second random number, and at the same time, the second target node generates a public key pair based on the first random number and the second random number. In practical applications, the second target node can generate a public key pair based on the first random number and the second random number after sending a communication reply message. That is, both the first and second target nodes generate the public key pair locally, and the public key pair does not need to be transmitted in plaintext in the channel, thus avoiding the risk of leakage.

[0021] Step 104: The first target node communicates securely with the second target node based on the public key pair.

[0022] In practical applications, before performing step 101 above, the IoT system also needs to be initialized. The main purpose of initialization is to generate a unique identifier, reversible function, and corresponding inverse function for each node in the IoT system. It is also necessary to assign the identifier and reversible function of each node to each node in the IoT system, while storing the inverse function only in its own node. That is to say, after initialization, each node in the IoT system stores the identifiers and reversible functions of all nodes in the system, but only stores its own inverse function and does not store the inverse functions of other nodes.

[0023] In practice, after the IoT system is initialized, the first target node in the IoT system can determine the adjacent target nodes within the communication range. The first target node can be any node in the IoT system. Specifically, the first target node can determine the adjacent target nodes within the communication range through a broadcast identifier. The adjacent target nodes include the second target node. The broadcast identifier includes the first identifier of the first target node and the first inverse function corresponding to the first target node.

[0024] In practice, the first target node broadcasts the broadcast identifier to all nodes within its communication range; The node that receives the broadcast identifier determines the first identifier of the first target node based on the broadcast identifier; If the first identifier has been pre-stored, the first target node is determined to be an adjacent target node.

[0025] For example, node i receives a broadcast identifier (j, fj*) from node j. Node i checks if the received identifier j exists in its preloaded array. If it exists, node i retains the corresponding binary array (j, fj) for subsequent communication; otherwise, it ignores the node. After completion, node i destroys the irrelevant binary array, retaining only the neighbor information within the communication range to reduce storage overhead.

[0026] After determining the adjacent target nodes, the first target node deletes the pre-stored node identifiers and corresponding invertible functions of other nodes besides the adjacent target nodes.

[0027] In an exemplary embodiment, determining the security of the mask information includes: The mask information of the first identifier extracted from the mask information is compared with the first identifier contained in the communication request information. If they match, the mask information is determined to be secure.

[0028] In an exemplary embodiment, determining the security of the mask information includes: The mask information of the first identifier extracted from the mask information is compared with the first identifier contained in the communication request information. If they match, the mask information is determined to be secure.

[0029] In an exemplary embodiment, the first target node communicates securely with the first target node based on the public key pair, and then the process further includes: The first target node updates the public key pair by regenerating a first random number after a set time.

[0030] In an exemplary embodiment, the secure communication method of the Internet of Things system further includes: Load the public key pair into the memory of the new node; Assign an identifier, a reversible function, and a corresponding inverse function to the new node; The new node is deployed to the Internet of Things system.

[0031] In an exemplary embodiment, the secure communication method of the Internet of Things system further includes: If the first target node fails to send a message for a period of time exceeding a set time, the first target node will be removed from the Internet of Things system. The second target node deletes the public key pair with the first target node.

[0032] In an exemplary embodiment, after the first target node is removed from the Internet of Things system, the method further includes: The IoT system is restructured by deleting the node information of the first target node in the IoT system.

[0033] In an exemplary embodiment, the encryption function is pre-deployed on each node of the Internet of Things system before communication.

[0034] Figure 2 This is a schematic diagram of the structure of the Internet of Things system provided in an embodiment of the present invention.

[0035] like Figure 2 The illustration shows an embodiment of a specific Internet of Things (IoT) system provided in this application. In this embodiment, the IoT system includes a server S, a gateway G, and device nodes D (D1, D2, D3...). Device nodes D can be different types of sensing device terminals in the network, or they can be devices of the same type. The network structure changes based on factors such as signal strength, distance, and rules between adjacent nodes. The addition or removal of new device nodes also affects the network structure.

[0036] In this embodiment, the secure communication method of the IoT system can include five stages: (1) initialization, (2) key creation, (3) key refresh, (4) node addition, and (5) key destruction. Specifically, in the initialization stage, the server can randomly generate n functions f and calculate their corresponding inverse functions f*. Then, for each node i, the server assigns a one-to-one corresponding function fi and its corresponding inverse function fi*. Each device node i that makes up the network is preloaded with a 3-ary array (i, fi, fi*) and a 2 (n-1)-ary array (j, fj), where j = 1, 2, ..., n and j ≠ i. To ensure security, these nodes are also pre-distributed with a general SHA-256 encryption function h() and a refresh period Tr.

[0037] Figure 3 This is one of the timing diagrams of the key creation process provided in the embodiments of the present invention; Figure 4 This is the second timing diagram of the key creation process provided in the embodiments of the present invention.

[0038] The second stage is the key creation stage, which can be as follows: Figure 3 and Figure 4 As shown, assuming the network initialization finds three nodes (node ​​1, node 2, node 3), each node stores a ternary array (i, fi, fi*). Each node i uses its broadcast identifier (i, fi*) to find its neighboring device node j within its communication range. After finding a node, each node i retains only its ternary array (i, fi, fi*) and binary array (j, fj) in its memory, and destroys all remaining binary arrays. When node i and node j communicate securely, a random number ri is generated first, and the corresponding inverse function fi* is used to hide the original sensitive data. Then, node i sends a communication request message to node j. The communication request message includes its identifier i, the inverse function fi* (i||ri) containing node and random number mask information, and its SHA-256 encryption function ℎ (i||ri). After receiving the communication request, node j uses the function fi to extract the sender's hidden identifier and random number, and checks whether the request information has been tampered with during transmission. If verification is successful, the latter generates a new random number rj and replies with a message including the identifier j, fj*(j||rj||ri+1), and h(j||rj||ri+1). After receiving the reply from node j, node i checks the authenticity of the message. If verification is successful, node i and node j generate a public key pair Kij. Subsequently, node i replies to node j with a random number {ri||rj+1}Kij containing the key pair.

[0039] For example, after nodes 1, 2, and 3 identify their neighboring device nodes within their communication range and establish new network relationships, the stored content of the nodes changes. After nodes 1 and 2 communicate, in step S1, node 1 sends the message (1, f1*(1||12), h(1||12)) to node 2. Here, r1=12, r2=21, and so on. In step S2, after node 2 receives the message from node 1 and verifies its accuracy, it replies with the message (2, f2*(2||21||13), h(2||21||13)). After receiving the reply from node 2, node 1 checks the authenticity of the message. If the verification is successful, nodes 1 and 2 generate a public key pair K12. In step S3, node 1 replies to node 2 with a random number {12||22}K12 containing the key pair, completing the key creation.

[0040] The third phase is the key refresh phase, in which the key must be refreshed periodically to prevent attacks. After each cycle, the node refreshes the key by generating a new random number and re-runs the key generation phase. Each device replaces the old inverse function with a suitable new function and executes the key generation phase.

[0041] The fourth phase is the node addition phase, used to add new nodes to the network. First, before deploying a new node to the network, the server preloads the current key into the new node's memory. The server generates and assigns a unique identifier, a one-to-one corresponding function, and its inverse function to the node. Once deployment is established, the new node generates a random number and then broadcasts a connection message. Upon receiving the previous message, the gateway continues to check its authenticity. If verification is successful, the gateway broadcasts subsequent messages sequentially, inviting current members to process the addition.

[0042] The fifth stage is the key destruction stage, which mainly handles key destruction and network reconstruction. When a node has not sent any messages for a long time, it will automatically leave the network. Its neighboring nodes will delete their paired keys and security parameters, the network will be reconstructed, information about nodes that have left the network will no longer be saved, and memory space will be cleaned up.

[0043] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0044] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A secure communication method for an Internet of Things (IoT) system, characterized in that, include: The first target node sends a communication request message to the second target node within the communication range. The communication request message includes the first identifier of the first target node, mask information encapsulated using the first inverse function corresponding to the first target node, and an encryption function. The mask information includes the mask information of the first identifier of the first target node and the mask information of the first random number generated by the first target node. After receiving the communication request information, the second target node uses a first invertible function corresponding to the first inverse function to extract the mask information. After determining the security of the mask information, it sends a communication reply information encrypted with the encryption function to the first target node. The communication reply information includes the second identifier of the second target node, the second random number generated by the second target node, and the first random number. After receiving the communication reply information, the first target node generates a public key pair based on the first random number and the second random number, while the second target node generates a public key pair based on the first random number and the second random number. The first target node communicates securely with the second target node based on the public key pair; Determining the security of the mask information includes: The mask information of the first identifier extracted from the mask information is compared with the first identifier contained in the communication request information. If they match, the mask information is determined to be secure.

2. The secure communication method for an Internet of Things system according to claim 1, characterized in that, The first target node sends a communication request message to the second target node within its communication range, which includes the following: The first target node determines the adjacent target nodes within the communication range through a broadcast identifier. The adjacent target nodes include the second target node. The broadcast identifier includes the first identifier of the first target node and the first inverse function corresponding to the first target node. After determining the adjacent target nodes, the first target node deletes the pre-stored node identifiers and corresponding invertible functions of other nodes besides the adjacent target nodes. The first inverse function and the first invertible function corresponding to the first inverse function are pre-generated, and the first target node pre-stores the first inverse function and the invertible functions of all nodes in the Internet of Things system.

3. The secure communication method for an Internet of Things system according to claim 2, characterized in that, The first target node determines neighboring target nodes within its communication range using a broadcast identifier, including: The first target node broadcasts the broadcast identifier to all nodes within its communication range; The node that receives the broadcast identifier determines the first identifier of the first target node based on the broadcast identifier; If the first identifier has been pre-stored, the first target node is determined to be an adjacent target node.

4. The secure communication method for an Internet of Things system according to claim 1, characterized in that, Before generating a public key pair based on the first random number and the second random number after the first target node receives the communication reply information, the process further includes: The first random number in the communication reply information is compared with the first random number generated by the first target node. If they match, the communication reply information is determined to be secure.

5. The secure communication method for an Internet of Things system according to claim 1, characterized in that, The first target node communicates securely with the first target node based on the public key pair, and then the process further includes: The first target node updates the public key pair by regenerating a first random number after a set time.

6. The secure communication method for an Internet of Things system according to claim 1, characterized in that, Also includes: Load the public key pair into the memory of the new node; Assign an identifier, a reversible function, and a corresponding inverse function to the new node; The new node is deployed to the Internet of Things system.

7. The secure communication method for an Internet of Things system according to claim 1, characterized in that, Also includes: If the first target node fails to send a message for a period of time exceeding a set time, the first target node will be removed from the Internet of Things system. The second target node deletes the public key pair with the first target node.

8. The secure communication method for an Internet of Things system according to claim 7, characterized in that, After removing the first target node from the Internet of Things system, the process further includes: The IoT system is restructured by deleting the node information of the first target node in the IoT system.

9. The secure communication method for an Internet of Things system according to claim 1, characterized in that, The encryption function is pre-deployed on each node of the IoT system before communication.

Images