Identity authentication method, storage medium, Internet of Things equipment and identity authentication system

Abstract

The invention discloses an identity authentication method, a storage medium, Internet of Things equipment and an identity authentication system. The identity authentication method comprises the following steps: a terminal device sends a control request to an Internet of Things device; the Internet of Things device generates a first device password in a trusted execution environment in response to the control request; the Internet of Things device encrypts the first device password in the trusted execution environment to obtain identity authentication data; the Internet of Things equipment sends identity authentication data to the terminal equipment; the terminal equipment sends identity authentication data to the security server; the security server decrypts the identity authentication data to obtain a second device password; the security server sends the second device password to the terminal device; the terminal device sends the second device password to the Internet of Things device; and the Internet of Things equipment performs identity authentication on the terminal equipment according to the first equipment password and the second equipment password. According to the invention, the identity of the terminal equipment can be accurately authenticated, and the safe operation of the Internet of Things equipment is effectively guaranteed.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) technology, specifically to an identity authentication method, storage medium, IoT device, and identity authentication system. Background Technology

[0002] With the rapid development of IoT technology, users can conveniently control IoT devices via terminal devices, such as remotely turning them on or off, viewing data collected by the devices, and adjusting their parameters. The operation of IoT devices often involves user privacy or critical business processes, making terminal device authentication a crucial measure to ensure their secure operation. However, current technologies typically use a single, fixed password for authentication, which poses security risks such as password leakage and cracking. This makes it difficult to accurately authenticate the terminal device's identity and thus fails to effectively guarantee the security of IoT devices. Summary of the Invention

[0003] This application provides an identity authentication method, storage medium, IoT device, and identity authentication system, which can accurately authenticate the identity of terminal devices and effectively ensure the secure operation of IoT devices.

[0004] On one hand, embodiments of this application provide an authentication method applied to an Internet of Things (IoT) device. The authentication method includes: generating a first device password in a trusted execution environment (TEE) in response to a control request for the IoT device; encrypting the first device password in the TEE to obtain authentication data; sending the authentication data to a terminal device; and authenticating the terminal device based on the first device password and the second device password in response to a second device password from the terminal device. The second device password is obtained by decrypting the authentication data.

[0005] Optionally, generating the first device password in the trusted execution environment includes: generating the first device password in the trusted execution environment based on a random number generation method.

[0006] Optionally, encrypting the first device password in the trusted execution environment to obtain authentication data includes: sending a key negotiation request to a security server; and, in response to a device authentication key from the security server, encrypting the first device password in the trusted execution environment according to the device authentication key to obtain the authentication data.

[0007] Optionally, the key negotiation request includes the device identity identifier of the IoT device.

[0008] Optionally, the device authentication key is a key pair, which includes a first authentication key and a second authentication key; the identity authentication data is obtained by encrypting the first device password based on the first authentication key; and the second device password is obtained by decrypting the identity authentication data based on the second authentication key.

[0009] Optionally, the step of authenticating the terminal device based on the first device password and the second device password includes: comparing the first device password and the second device password; if the first device password and the second device password are the same, then the terminal device is determined to have passed the authentication; if the first device password and the second device password are different, then the terminal device is determined to have failed the authentication.

[0010] Optionally, after determining that the terminal device has passed the identity authentication, the method further includes: performing a control operation to respond to the control request.

[0011] On the other hand, embodiments of this application also provide a computer-readable storage medium storing a computer program or instructions thereon, which, when executed by a processor, implement the steps in the authentication method described above.

[0012] On the other hand, embodiments of this application also provide a computer program product, including a computer program or instructions, which, when executed by a processor, implement the steps in the authentication method described above.

[0013] On the other hand, embodiments of this application also provide an Internet of Things (IoT) device, including a memory and a processor. The memory stores a computer program or instructions. When the computer program or instructions are executed by the processor, the processor performs the following steps: in response to a control request for the IoT device, generating a first device password in a trusted execution environment; encrypting the first device password in the trusted execution environment to obtain authentication data; sending the authentication data to a terminal device; and in response to a second device password from the terminal device, authenticating the terminal device based on the first device password and the second device password. The second device password is obtained by decrypting the authentication data.

[0014] On the other hand, this application embodiment also provides an identity authentication system, which includes a terminal device, an Internet of Things (IoT) device, and a security server. The terminal device is configured to: send a control request to the IoT device. The IoT device is configured to: in response to the control request, generate a first device password in a trusted execution environment; encrypt the first device password in the trusted execution environment to obtain identity authentication data; and send the identity authentication data to the terminal device. The terminal device is further configured to: send the identity authentication data to the security server. The security server is configured to: decrypt the identity authentication data to obtain a second device password; and send the second device password to the terminal device. The terminal device is further configured to: send the second device password to the IoT device. The IoT device is further configured to: authenticate the terminal device based on the first device password and the second device password.

[0015] Optionally, the device authentication key is a key pair, which includes a first authentication key and a second authentication key. The IoT device is further configured to: encrypt the first device password using the first authentication key to obtain the identity authentication data. The security server is further configured to: decrypt the identity authentication data using the second authentication key to obtain the second device password.

[0016] Optionally, the IoT device is further configured to: send a key negotiation request to the security server; the security server is further configured to: generate a device authentication key in response to the key negotiation request, and send the device authentication key to the IoT device; the IoT device is further configured to: encrypt the first device password according to the device authentication key in the trusted execution environment to obtain the identity authentication data.

[0017] Optionally, the key negotiation request includes the device identity identifier of the IoT device. The security server is further configured to: establish a mapping relationship between the device identity identifier and the device authentication key; and update key mapping data according to the mapping relationship. The key mapping data includes at least one set of mapping relationships between the device identity identifier and the device authentication key.

[0018] Optionally, the terminal device is further configured to: send the identity authentication data and the device identity identifier of the IoT device to the security server; the security server is further configured to: obtain the device authentication key based on the key mapping data and the device identity identifier, and decrypt the identity authentication data based on the device authentication key to obtain the second device password.

[0019] In summary, the technical solution provided in this application, during the authentication process of terminal devices, involves the IoT device generating a device password for authentication in real time within a trusted execution environment. This ensures that the device password is dynamically changing and that it is not exposed to insecure environments before encryption, reducing the risk of password leakage or cracking, improving password security, and consequently enhancing the reliability of authentication. This results in accurate authentication of the terminal device's identity and effectively guarantees the secure operation of IoT devices. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of an identity authentication system provided in an embodiment of this application; Figure 2 This is a flowchart of an identity authentication method provided in an embodiment of this application; Figure 3 This is a flowchart of another identity authentication method provided in the embodiments of this application; Figure 4 This is a flowchart of another identity authentication method provided in the embodiments of this application. Detailed Implementation

[0022] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] In the following description, specific embodiments of this application will be illustrated with reference to steps and symbols performed by one or more computers, unless otherwise stated. Therefore, these steps and operations will be referred to several times as being performed by a computer. Computer performance as referred to in this application includes operations performed by a computer processing unit on electronic signals represented by data in a structured format. This operation transforms the data or maintains it at a location in the computer's memory system, which can be reconfigured or otherwise alter the operation of the computer in a manner well known to those skilled in the art. The data structure maintained by the data is the physical location of the memory, which has specific characteristics defined by the data format. However, the principles of this application are illustrated with specific embodiments and are not intended to be limiting. Those skilled in the art will understand that many of the steps and operations described below can also be implemented in hardware.

[0024] The terms "module" or "unit" as used in this application can be considered as software objects executing on the computing system. The different components, modules, engines, and services described in this application can be considered as implementation objects on the computing system. While the apparatus and methods described in this application are preferably implemented in software, they can also be implemented in hardware, both of which are within the scope of protection of this invention.

[0025] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used in the embodiments of this application may also include the plural forms. It should be further understood that the term “comprising” as used in the specification of this application means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or combinations thereof. It should be understood that when an element is “connected” or “coupled” to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. Furthermore, “connected” or “coupled” as used herein may include wireless connection or wireless coupling. The term “and / or” as used herein includes all or any unit and all combinations of one or more associated listed items.

[0026] In related identity authentication schemes, traditional password-based authentication mechanisms often face security vulnerabilities such as password leakage, brute-force attacks, and man-in-the-middle attacks. To address this, related technologies have also proposed authentication mechanisms that encrypt passwords using keys; however, the key generation and management processes often rely on software solutions, posing significant security risks.

[0027] In related technologies, QTEE (Qualcomm Trusted Execution Environment)-based identity authentication schemes rely on the public key of the security server built into the IoT device for encrypted communication during the key exchange process between the IoT device and the security server. While this method ensures encrypted communication, the use of static or pre-embedded keys for each authentication can lead to keys remaining unchanged over a long period, increasing the risk of key leakage and man-in-the-middle attacks, especially in scenarios with long-term operation or frequent authentication. These technologies do not fully utilize the encryption and random number generation capabilities of the QTEE hardware, failing to implement a hardware-based dynamic key generation and negotiation mechanism for each authentication process. This lack of dynamic key negotiation and updates during each authentication process prevents the achievement of higher security. Therefore, these technologies cannot effectively prevent security threats such as key leakage and man-in-the-middle attacks in scenarios with high security requirements.

[0028] In view of this, embodiments of this application propose an identity authentication method, storage medium, IoT device, and identity authentication system. This is a QTEE-based identity authentication scheme that optimizes security during the identity authentication process by generating dynamic passwords within the QTEE environment and combining key negotiation and encryption technologies. Embodiments of this application can effectively prevent password and key leakage and man-in-the-middle attacks, while also improving the security of IoT devices, providing a more effective and accurate identity authentication solution for the Internet of Things (IoT).

[0029] Please see Figure 1 , Figure 1 This is a schematic diagram of an identity authentication system provided in an embodiment of this application. Figure 1 As shown, the identity authentication system includes a terminal device 100, an Internet of Things device 200, and a security server 300.

[0030] The Internet of Things (IoT) devices 200 include, but are not limited to, IoT devices in scenarios such as smart homes, smart healthcare, smart industrial manufacturing, smart transportation, and smart retail. Taking the smart home scenario as an example, the IoT devices 200 include, but are not limited to, cameras, speakers, robot vacuum cleaners, smart refrigerators, and smart door locks; taking the smart industrial scenario as an example, the IoT devices 200 include, but are not limited to, sensors, smart robots, and cameras; taking the smart retail scenario as an example, the IoT devices 200 include, but are not limited to, smart shelves and smart POS systems. Figure 1 The description uses a smart home scenario as an example only and should not be construed as limiting the embodiments of this application. When applied to other scenarios, the IoT device 200 can be implemented as other devices.

[0031] Terminal device 100 can control IoT device 200, for example, remotely turn IoT device 200 on or off, view data collected by IoT device 200, and adjust parameters of IoT device 200. Terminal device 100 includes, but is not limited to, mobile phones, tablets, desktop computers, smart wearable devices, and laptops. A communication connection can be established between terminal device 100 and IoT device 200, such as through a wired or wireless network.

[0032] The security server 300 provides background security services to the IoT device 200, such as negotiating device authentication keys with the IoT device 200 and assisting the IoT device 200 in authenticating the terminal device 100. Communication connections can be established between the security server, the IoT device 200, and the terminal device 100, respectively, such as via wired or wireless networks.

[0033] In this embodiment, the IoT device 200 can dynamically generate a device password and dynamically negotiate a device authentication key with the security server 300. The IoT device 200 can encrypt the device password based on the device authentication key to obtain authentication data and send the authentication data to the terminal device 100. The terminal device 100 forwards the authentication data to the security server 300, which decrypts the authentication data based on the device authentication key to obtain the device password and sends the device password to the terminal device 100. The terminal device 100 then forwards the device password to the IoT device 200. The IoT device 200 authenticates the terminal device 100 based on the device password from the terminal device 100 and its own generated device password.

[0034] Based on this, the terminal device 100, the IoT device 200, and the security server 300 can each be used to perform the following steps to implement the identity authentication method in this application embodiment.

[0035] Terminal device 100 is used to: send control requests to Internet of Things device 200; The IoT device 200 is used to: generate a first device password in a trusted execution environment in response to a control request; encrypt the first device password in the trusted execution environment to obtain authentication data; and send the authentication data to the terminal device 100. Terminal device 100 is also used to: send authentication data to security server 300; Security server 300 is used to: decrypt authentication data to obtain the second device password; and send the second device password to terminal device 100. Terminal device 100 is also used to: send a second device password to Internet of Things device 200; The Internet of Things device 200 is also used to: authenticate the terminal device 100 based on the first device password and the second device password.

[0036] In some embodiments, the device authentication key is a key pair, which includes a first authentication key and a second authentication key; the IoT device 200 is further configured to: encrypt a first device password according to the first authentication key to obtain identity authentication data; the security server 300 is further configured to: decrypt the identity authentication data according to the second authentication key to obtain a second device password.

[0037] In some embodiments, the IoT device 200 is further configured to: send a key negotiation request to the security server 300; the security server 300 is further configured to: generate a device authentication key in response to the key negotiation request and send the device authentication key to the IoT device 200; the IoT device 200 is further configured to: encrypt a first device password in a trusted execution environment based on the device authentication key to obtain identity authentication data.

[0038] In some embodiments, the key negotiation request includes a device identity identifier of the IoT device 200; the security server 300 is further configured to: establish a mapping relationship between the device identity identifier and the device authentication key; and update the key mapping data according to the mapping relationship. The key mapping data includes at least one set of mapping relationships between device identity identifiers and device authentication keys.

[0039] In some embodiments, the terminal device 100 is further configured to: send authentication data and device identity identifier of IoT device 200 to the security server 300; the security server 300 is further configured to: obtain device authentication key according to key mapping data and device identity identifier, and decrypt authentication data according to device authentication key to obtain second device password.

[0040] For further details regarding the data interaction between the terminal device 100, the IoT device 200, and the security server 300, as well as the steps they each perform and their beneficial effects, please refer to the following embodiments; these details will not be elaborated upon here.

[0041] Please see Figure 2 , Figure 2 This is a flowchart illustrating an authentication method provided in an embodiment of this application. This authentication method can be executed by the authentication system described in the above embodiments. Figure 2 As shown, the identity authentication method may include the following steps S201 to S209.

[0042] Step S201: The terminal device sends a control request to the IoT device.

[0043] When users need to control IoT devices, they can do so through terminal devices. This includes remotely turning the IoT device on or off, viewing the data collected by the device, and adjusting its parameters. The terminal device can display an interface, which users can use to trigger control requests from the terminal device to the IoT device.

[0044] Control requests can carry the device identification identifier of the terminal device, which is a unique identifier for the terminal device, such as a device ID, to facilitate data interaction between IoT devices and the terminal device. In addition, control requests can also carry control commands, which can be used to operate IoT devices.

[0045] Step S202: In response to the control request, the IoT device generates a first device password in a trusted execution environment.

[0046] To enhance the security of IoT devices, each time an IoT device receives a control request from a terminal device, it can first authenticate the terminal device to prevent attacks from hackers. Based on this, the IoT device can obtain the device password in response to the control request for authentication.

[0047] In this embodiment, the IoT device generates a first device password in real time within a trusted execution environment. The trusted execution environment is a securely isolated execution environment, including but not limited to the execution environment generated by the QTEE module.

[0048] Therefore, the first device password is dynamically generated, providing higher security and effectively preventing external theft. Furthermore, the first device password is generated and stored within a trusted execution environment, ensuring it is not exposed to insecure environments before encryption, further enhancing security.

[0049] In some embodiments, the generation of a first device password by an IoT device in a trusted execution environment may include: the IoT device generating the first device password based on random number generation within the trusted execution environment. The random number generation method includes, but is not limited to, methods based on random number functions, pseudo-random number generation algorithms, encryption algorithms, hardware random number generators, etc. Generating the first device password through random number generation is a simple and efficient method.

[0050] Step S203: The IoT device encrypts the first device password in a trusted execution environment to obtain identity authentication data.

[0051] To prevent password tampering, leakage, or cracking, the IoT device in this embodiment encrypts the password of the first device to obtain authentication data. The key used for encryption by the IoT device can be pre-stored in the IoT device or obtained by the IoT device in real time; this embodiment does not limit this.

[0052] In some embodiments, taking the example that the key used for encryption by the IoT device is obtained in real time, step S203 above may include: the IoT device sending a key negotiation request to the security server; the security server responding to the key negotiation request and generating a device authentication key; the security server sending the device authentication key to the IoT device; and the IoT device encrypting a first device password in a trusted execution environment based on the device authentication key to obtain identity authentication data. That is, the IoT device can negotiate the device authentication key with the security server in real time to ensure that the device authentication key is dynamically generated, improving the accuracy and security of the identity authentication process.

[0053] The key negotiation request may include the device identity identifier of the IoT device. This facilitates interaction between the security server and the IoT device, and also helps the security server manage device authentication keys. Based on this, in some embodiments, after the security server generates the device authentication key, the process may further include: the security server establishing a mapping relationship between the IoT device's identity identifier and the device authentication key; and the security server updating the key mapping data according to the mapping relationship. The key mapping data includes at least one set of mapping relationships between device identities and device authentication keys. Based on this key mapping data, the security server can quickly find the device authentication key corresponding to the IoT device, achieving efficient and accurate management of device authentication keys for different IoT devices.

[0054] In this embodiment, the device authentication key can be a key pair, including a first authentication key and a second authentication key. One of the first and second authentication keys can be a public key, and the other can be a private key. The security server can send both the first and second authentication keys to the IoT device, or it can send only the first authentication key or only the second authentication key to the IoT device. Taking the security server sending at least the first authentication key to the IoT device as an example, this first authentication key can be either a public key or a private key; the IoT device encrypting a first device password based on the device authentication key to obtain authentication data can include: the IoT device encrypting a first device password based on the first authentication key to obtain authentication data.

[0055] Step S204: The IoT device sends identity authentication data to the terminal device.

[0056] Step S205: The terminal device sends authentication data to the security server.

[0057] In this embodiment of the application, steps S204 and S205 can be executed automatically in the background of each device, or they can be executed in conjunction with user operations.

[0058] Taking user interaction as an example, when the terminal device receives authentication data from an IoT device, it can display the authentication data and / or the IoT device's device identification identifier for the user's understanding. Furthermore, the terminal device can display a first input interface, which is a web interface corresponding to the security server. By operating this first input interface, the user can input authentication data, causing the terminal device to send the authentication data to the security server. Additionally, the user can also input the IoT device's device identification identifier by operating this first input interface, causing the terminal device to simultaneously send the IoT device's device identification identifier to the security server.

[0059] Step S206: The security server decrypts the authentication data to obtain the password for the second device.

[0060] The security server can decrypt the authentication data to obtain the second device password. Specifically, the IoT device and the security server previously negotiated a device authentication key, and the IoT device used this key to encrypt the first device password to obtain the authentication data. Therefore, the security server can decrypt the authentication data using the device authentication key to obtain the second device password.

[0061] As can be seen from the above embodiments, the security server can store and manage key mapping data, which includes at least one mapping relationship between device identity identifiers and device authentication keys. Therefore, step S205 can include: the terminal device sending identity authentication data and the device identity identifier of the IoT device to the security server; step S206 can include: the security server obtaining the device authentication key based on the key mapping data and the device identity identifier of the IoT device, and decrypting the identity authentication data based on the device authentication key to obtain the second device password. The security server can find the device authentication key corresponding to the device identity identifier of the IoT device in the key mapping data, and then decrypt the identity authentication data based on the device authentication key to obtain the second device password.

[0062] The device authentication key can be a key pair, which includes a first authentication key and a second authentication key. One of the first authentication key and the second authentication key can be a public key, and the other can be a private key. Taking the example of an IoT device encrypting a first device password based on the first authentication key to obtain authentication data, the aforementioned security server decrypts the authentication data to obtain the second device password, or the aforementioned security server decrypts the authentication data according to the device authentication key to obtain the second device password. This can include: the security server decrypting the authentication data according to the second authentication key to obtain the second device password.

[0063] It should be understood that if the security server fails to decrypt authentication data, it can send decryption indication data to the terminal device to indicate the failure. This decryption indication data can also indicate the reason for the failure and possible solutions.

[0064] Step S207: The security server sends the second device password to the terminal device.

[0065] Step S208: The terminal device sends a second device password to the IoT device.

[0066] In this embodiment of the application, steps S207 and S208 can be executed automatically in the background of each device, or they can be executed in conjunction with user operations.

[0067] Taking user interaction as an example, when the terminal device receives a second device password from the security server, it can display the second device password for the user to understand. Furthermore, the terminal device can display a second input interface, which is the web interface corresponding to the IoT device. By operating this second input interface, the user can enter the second device password, causing the terminal device to send the second device password to the IoT device.

[0068] Step S209: The IoT device authenticates the terminal device based on the first device password and the second device password.

[0069] The first device password is a password generated by the IoT device. The IoT device encrypts the first device password to obtain authentication data, and the security server decrypts the authentication data to obtain the second device password. If the operating environment of the IoT device is secure and the identity of the terminal device is legitimate, then the first device password should be the same as the second device password. Therefore, in this embodiment, the IoT device authenticates the terminal device based on the first device password and the second device password.

[0070] In some embodiments, step S209 may include: the IoT device comparing a first device password and a second device password; if the first device password and the second device password are the same, the terminal device passes authentication; if the first device password and the second device password are different, the terminal device fails authentication. Here, "the first device password and the second device password are the same" can mean that the first device password and the second device password are exactly the same. If the first device password and the second device password are different, it may be due to the authentication data being tampered with or attacked, or the authentication data not being properly decrypted, causing the terminal device to send an incorrect device password to the IoT device. In this case, to ensure security, the IoT device will not authenticate the terminal device, and the terminal device's authentication will fail.

[0071] It should be understood that IoT devices can send authentication indication data to terminal devices to indicate whether the terminal device should pass authentication or fail authentication. In the event of authentication failure by the terminal device, the authentication indication data may also include the reason for the failure and possible solutions.

[0072] In some embodiments, after step S209, the process may further include: the IoT device performing a control operation in response to a control request. As can be seen from the above embodiments, the terminal device sends a control request to the IoT device to request the IoT device to perform a control operation, such as remotely turning the IoT device on or off, viewing data collected by the IoT device, or adjusting the parameters of the IoT device. If the terminal device's authentication is successful, the IoT device can perform the control operation requested in the control request to respond to the terminal device's control request and meet the user's control needs for the IoT device.

[0073] In summary, the technical solution provided in this application, during the authentication process of terminal devices, involves the IoT device generating a device password for authentication in real time within a trusted execution environment. This ensures that the device password is dynamically changing and that it is not exposed to insecure environments before encryption, reducing the risk of password leakage or cracking, improving password security, and consequently enhancing the reliability of authentication. This results in accurate authentication of the terminal device's identity and effectively guarantees the secure operation of IoT devices.

[0074] Furthermore, in this embodiment, the IoT device and the security server negotiate the device authentication key in real time to encrypt and decrypt the device password. Therefore, the device authentication key is also dynamically changing and is only perceived by the IoT device and the security server. This avoids the possibility of device passwords and communication data being cracked due to leakage of the device authentication key, further improving the reliability of identity authentication and providing a more robust guarantee for the security of IoT devices.

[0075] The following example illustrates the identity authentication method provided in this application.

[0076] Please see Figure 3 , Figure 3 This is a flowchart of another authentication method provided in an embodiment of this application. This authentication method can be executed by the authentication system described in the above embodiments. Figure 3 As shown, the identity authentication method may include the following steps S301 to S314.

[0077] Step S301: The IoT device starts up and initializes the trusted execution environment.

[0078] When an IoT device starts up or after it starts up, the trusted execution environment (such as a QTEE module) in the IoT device can be initialized to initialize its hardware security resources, such as the hardware random number generator, key derivation engine, and asymmetric key generation engine. Initialization prepares these hardware security resources for subsequent access to and retrieval of passwords and / or keys.

[0079] Step S302: The terminal device sends a control request to the IoT device.

[0080] Step S303: In response to the control request, the IoT device generates a first device password in a trusted execution environment.

[0081] IoT devices can use a QTEE module to generate a first device password through random number generation within a trusted execution environment, and store it inside the QTEE module, i.e., within the trusted execution environment. This first device password can be a one-time dynamic password.

[0082] Step S304: The IoT device sends a key negotiation request to the security server.

[0083] IoT devices can establish secure communication channels with secure servers, such as HTTPS connections, thereby ensuring the confidentiality and integrity of data transmission between the IoT devices and the secure servers. Based on this communication channel, IoT devices can interact with the secure servers.

[0084] Step S305: The security server responds to the key negotiation request and generates a device authentication key.

[0085] The device authentication key can be a key pair, which may include a first authentication key and a second authentication key. One of the first authentication key and the second authentication key can be a public key, and the other can be a private key.

[0086] Step S306: The security server sends the device authentication key to the IoT device.

[0087] During each authentication process, IoT devices can negotiate a key with a security server to ensure that the key is dynamically generated for each authentication process, thereby improving the security of the authentication process.

[0088] The security server can send both the first authentication key and the second authentication key to the IoT device, or it can send only one of them to the IoT device, such as sending only the first authentication key.

[0089] Step S307: The IoT device encrypts the first device password according to the first authentication key in the trusted execution environment to obtain identity authentication data.

[0090] Step S308: The IoT device sends identity authentication data to the terminal device.

[0091] Step S309: The terminal device sends authentication data to the security server.

[0092] Step S310: The security server decrypts the identity authentication data based on the second authentication key to obtain the second device password.

[0093] Step S311: The security server sends the second device password to the terminal device.

[0094] Step S312: The terminal device sends a second device password to the IoT device.

[0095] Step S313: The IoT device authenticates the terminal device based on the first device password and the second device password.

[0096] If the first device password and the second device password are the same, the IoT device confirms that the terminal device has passed authentication, meaning the terminal device's authentication is successful, and can continue to execute the following step S314. If the first device password and the second device password are different, the IoT device confirms that the terminal device has failed authentication, meaning the terminal device's authentication has failed. The IoT device can send authentication indication data to the terminal device to indicate the authentication failure and / or the reason for the failure, solutions, etc., to end the authentication process.

[0097] Step S314: The IoT device performs a control operation in response to the control request.

[0098] For further details regarding steps S301 to S314 and their beneficial effects, please refer to the above embodiments; they will not be repeated here.

[0099] It should be noted that the above embodiments describe the identity authentication method provided in this application from the perspective of the interaction between the terminal device, the IoT device, and the security server. In practical applications, the steps executed by the terminal device can be implemented as a separate identity authentication method on the terminal device side; the steps executed by the IoT device can be implemented as a separate identity authentication method on the IoT device side; and the steps executed by the security server can be implemented as a separate identity authentication method on the security server side.

[0100] Please see Figure 4 , Figure 4 This is a flowchart illustrating another authentication method provided in an embodiment of this application. This authentication method can be executed by an IoT device, such as the IoT device in the aforementioned authentication system. Figure 4 As shown, the identity authentication method may include the following steps S410 to S440.

[0101] Step S410: In response to a control request for an IoT device, generate a first device password in a trusted execution environment; Step S420: Encrypt the first device password in a trusted execution environment to obtain authentication data; Step S430: Send authentication data to the terminal device; Step S440: In response to the second device password from the terminal device, authenticate the terminal device based on the first device password and the second device password; the second device password is obtained by decrypting the authentication data.

[0102] In some embodiments, generating the first device password in the trusted execution environment in step S410 above includes: generating the first device password in the trusted execution environment based on a random number generation method.

[0103] In some embodiments, step S420 may include: sending a key negotiation request to a security server; and in response to a device authentication key from the security server, encrypting a first device password in a trusted execution environment based on the device authentication key to obtain authentication data.

[0104] In some embodiments, the key negotiation request includes the device identity identifier of the IoT device.

[0105] In some embodiments, the device authentication key is a key pair, which includes a first authentication key and a second authentication key; the identity authentication data is obtained by encrypting the first device password with the first authentication key; and the second device password is obtained by decrypting the identity authentication data with the second authentication key.

[0106] In some embodiments, the authentication of the terminal device based on the first device password and the second device password in step S440 includes: comparing the first device password and the second device password; if the first device password and the second device password are the same, then the terminal device is determined to have passed the authentication; if the first device password and the second device password are different, then the terminal device is determined to have failed the authentication.

[0107] In some embodiments, after determining that the terminal device has passed authentication, the method further includes: performing a control operation to respond to a control request.

[0108] For a detailed explanation of the steps and beneficial effects of the identity authentication method on the IoT device side, please refer to the above embodiments; further details will not be provided here.

[0109] To facilitate better implementation of the authentication method provided in this application, this application also provides a computer-readable storage medium storing a computer program or instructions thereon. When executed by a processor, the computer program or instructions implement the steps in the authentication method described above. For example, it implements the steps in the authentication method on the IoT device side as described above.

[0110] This application also provides an Internet of Things (IoT) device, including a memory and a processor. The memory stores a computer program or instructions. When the computer program or instructions are executed by the processor, the processor performs the following steps: in response to a control request for the IoT device, generating a first device password in a trusted execution environment; encrypting the first device password in the trusted execution environment to obtain authentication data; sending the authentication data to a terminal device; and in response to a second device password from the terminal device, authenticating the terminal device based on the first device password and the second device password. The second device password is obtained by decrypting the authentication data.

[0111] The processor described above can be a general-purpose processor or a special-purpose processor. For example, it can be a Central Processing Unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor, or any conventional processor.

[0112] The aforementioned memory can be independent of the processor or integrated into the processor. Computer programs or instructions in the memory can be executed by the processor.

[0113] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor. The computer-readable storage medium stores a computer program or instructions, which are loaded by a processor to perform the steps described in the above method embodiments of this application.

[0114] For details on the implementation of each of the above operations / steps, please refer to the previous examples, which will not be repeated here.

[0115] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0116] Since the computer program or instructions stored in the computer-readable storage medium can execute the steps in any of the above method embodiments provided in the embodiments of this application, the beneficial effects that the methods described in any of the above method embodiments can achieve can be realized, as detailed in the preceding embodiments, and will not be repeated here.

[0117] This application also provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are executed by a processor, they implement the steps in any of the above method embodiments. Therefore, the beneficial effects that the methods described in any of the above method embodiments can achieve can be realized. For details, please refer to the preceding embodiments, which will not be repeated here.

[0118] The above provides a detailed description of an identity authentication method, storage medium, IoT device, and identity authentication system provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. An identity authentication method, characterized in that, Applied to Internet of Things (IoT) devices; the authentication method includes: In response to a control request for the IoT device, a first device password is generated in a trusted execution environment; The password of the first device is encrypted in the trusted execution environment to obtain authentication data; Send the authentication data to the terminal device; In response to a second device password from the terminal device, the terminal device is authenticated based on the first device password and the second device password; wherein the second device password is obtained by decrypting the authentication data.

2. The identity authentication method according to claim 1, characterized in that, The step of generating the first device password in a trusted execution environment includes: In the trusted execution environment, the password for the first device is generated based on a random number generation method.

3. The identity authentication method according to claim 1, characterized in that, The step of encrypting the first device password in the trusted execution environment to obtain authentication data includes: Send a key negotiation request to the security server; In response to the device authentication key from the security server, the first device password is encrypted in the trusted execution environment according to the device authentication key to obtain the identity authentication data.

4. The identity authentication method according to claim 3, characterized in that, The key negotiation request includes the device identity identifier of the IoT device.

5. The identity authentication method according to claim 3, characterized in that, The device authentication key is a key pair, and the key pair includes a first authentication key and a second authentication key; The identity authentication data is obtained by encrypting the first device password with the first authentication key; The second device password is obtained by decrypting the identity authentication data based on the second authentication key.

6. The identity authentication method according to claim 1, characterized in that, The step of authenticating the terminal device based on the first device password and the second device password includes: Compare the password of the first device with the password of the second device; If the first device password and the second device password are the same, then the terminal device is determined to have passed the identity authentication. If the first device password and the second device password are different, then it is determined that the terminal device has failed the identity authentication.

7. The identity authentication method according to claim 6, characterized in that, After determining that the terminal device has passed the identity authentication, the process further includes: Perform a control operation in response to the control request.

8. A computer-readable storage medium, characterized in that, It stores a computer program or instructions that, when executed by a processor, implement the steps of the authentication method as described in any one of claims 1 to 7.

9. An Internet of Things (IoT) device, characterized in that, It includes a memory and a processor, wherein the memory stores computer programs or instructions, and when the computer programs or instructions are executed by the processor, the processor causes the processor to perform the following steps: In response to a control request for the IoT device, a first device password is generated in a trusted execution environment; The password of the first device is encrypted in the trusted execution environment to obtain authentication data; Send the authentication data to the terminal device; In response to a second device password from the terminal device, the terminal device is authenticated based on the first device password and the second device password; wherein the second device password is obtained by decrypting the authentication data.

10. An identity authentication system, characterized in that, The identity authentication system includes terminal devices, IoT devices, and a security server; wherein, The terminal device is used to: send control requests to the Internet of Things device; The IoT device is configured to: in response to the control request, generate a first device password in a trusted execution environment; encrypt the first device password in the trusted execution environment to obtain authentication data; and send the authentication data to the terminal device. The terminal device is also used to: send the identity authentication data to the security server; The security server is used to: decrypt the identity authentication data to obtain the second device password; and send the second device password to the terminal device. The terminal device is also used to: send the second device password to the Internet of Things device; The IoT device is also used to: authenticate the terminal device based on the first device password and the second device password.

11. The identity authentication system according to claim 10, characterized in that, The IoT device is also used to: send a key negotiation request to the security server; The security server is further configured to: generate a device authentication key in response to the key negotiation request; and send the device authentication key to the IoT device; The IoT device is also used to: encrypt the first device password according to the device authentication key in the trusted execution environment to obtain the identity authentication data.

12. The identity authentication system according to claim 11, characterized in that, The device authentication key is a key pair, and the key pair includes a first authentication key and a second authentication key; The IoT device is further configured to: encrypt the first device password according to the first authentication key to obtain the identity authentication data; The security server is also used to: decrypt the identity authentication data according to the second authentication key to obtain the second device password.

13. The identity authentication system according to claim 11, characterized in that, The key negotiation request includes the device identity identifier of the IoT device; The security server is further configured to: establish a mapping relationship between the device identity identifier and the device authentication key; update key mapping data according to the mapping relationship; wherein the key mapping data includes at least one set of mapping relationships between the device identity identifier and the device authentication key.

14. The identity authentication system according to claim 13, characterized in that, The terminal device is also used to: send the identity authentication data and the device identity identifier of the Internet of Things device to the security server; The security server is further configured to: obtain the device authentication key based on the key mapping data and the device identity identifier; and decrypt the identity authentication data based on the device authentication key to obtain the second device password.

Images