A blockchain identity authentication method for internet of things devices

Abstract

The application discloses a kind of blockchain identity authentication methods for Internet of Things equipment, belong to Internet of Things security and blockchain technical field;The method of the present application constructs the layered authentication system including Internet of Things equipment layer, sub-chain layer, adaptation layer, core layer and main chain layer, and the first time when device accesses, through MAC address, production serial number, device fingerprint and the identity verification token of sub-chain distribution concatenation string, based on BLAKE2b-256 algorithm generates unique device credential;Device runs through the dual mechanism of real-time identity check and secondary check of core layer by adapter, to realize dynamic identity authentication;The application solves the problem that the prior art can only initialize authentication, cannot real-time sense device state, and the performance pressure of main chain is big, has the advantages of strong compatibility, high scalability, safe and reliable, is suitable for electric vehicle charging pile, smart grid, industrial Internet of Things and other large-scale device access scenarios.

Description

Technical Field

[0001] This invention belongs to the field of IoT security and blockchain technology, specifically relating to a blockchain identity authentication method for IoT devices. Background Technology

[0002] With the rapid development of Internet of Things (IoT) technology, a massive number of smart devices are connecting to the network, making secure communication and authentication between devices a core issue in ensuring the stable operation of IoT systems. Traditional centralized authentication schemes suffer from drawbacks such as single point of failure risk, vulnerability to DDoS attacks, and low data reliability, failing to meet the security authentication needs of large-scale IoT devices.

[0003] Blockchain technology, with its decentralized, immutable, transparent and traceable characteristics, provides a new solution for IoT identity authentication. Among the existing technologies, literature [1] (Li Fuqiang, Zhang Lu. Application of blockchain technology in electric vehicle charging pile sharing detection [J]. Special Vehicle, 2024, (09): 75-77) proposes to apply blockchain to charging pile sharing detection, and realize data trust and process automation through real-time status on-chain, asymmetric encryption and smart contracts; Chinese patent CN109391661A discloses a blockchain networking method for IoT terminals, which connects to the blockchain network through the built-in blockchain module of the terminal, reducing the pressure on the central side.

[0004] However, the aforementioned existing technologies all have the following drawbacks: 1. It only supports device initial registration and authentication, and cannot perform real-time dynamic verification of the device's identity during operation. It cannot detect when the device is hijacked or tampered with in a timely manner. 2. The lack of a layered architecture design, with all devices directly connected to the main chain, can lead to a performance bottleneck on the main chain and high transaction confirmation latency when a large number of devices connect concurrently. 3. The device identification method is simple, relying solely on hardware address or serial number, which makes it easy to be forged and impersonated, resulting in insufficient security; 4. Blockchain itself cannot directly sense changes in device status and needs to rely on external systems for device management, which increases system complexity and security risks.

[0005] Therefore, a blockchain identity authentication method for IoT devices is needed to solve the four major problems in existing IoT blockchain identity authentication schemes: "single initial authentication, lack of real-time perception, main chain performance bottleneck, and easy identity forgery". Summary of the Invention

[0006] The purpose of this invention is to provide a blockchain identity authentication method for Internet of Things (IoT) devices to solve the problems mentioned in the background section.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a blockchain identity authentication method for Internet of Things (IoT) devices, comprising the following steps: Step S1: Construct a layered blockchain identity authentication system, which consists of, from top to bottom, the main chain layer, the core layer, the adaptation layer, the sub-chain layer, and the IoT device layer. Step S2: When an IoT device first accesses the network, it sends a registration request containing a unique hardware identifier to its sub-chain node. After verifying the user's permissions, the sub-chain node assigns a unique authentication token to the device. Step S3: The corresponding adapter of the adaptation layer receives the hardware unique identifier and authentication token sent by the device, concatenates them to generate a device identifier string, calculates a unique device credential based on a preset hash algorithm, and stores it locally; Step S4: The identity module of the core layer verifies the validity of the device credentials. After successful verification, it writes the hash value of the device identity information and the hash value of the device credentials into the main chain layer to complete the initial registration and authentication of the device. Step S5: When a device generates a status change, data report, or interaction request, the adapter first performs real-time identity verification on the device. After successful verification, it forwards the data and device credentials to the core layer. Step S6: The core layer performs a secondary verification of the device identity. After the verification is successful, the transaction module packages and sorts the data and writes it into the main chain layer to complete the data on-chain storage.

[0008] It should be noted in the solution that the hierarchical blockchain identity authentication system in step S1 specifically consists of the following components: The IoT device layer includes multiple IoT devices with pre-installed device SDKs, embedded operating systems, and security chips. The security chip stores the device's unique hardware identifier from the factory. The sub-chain layer consists of multiple lightweight consortium chain nodes. Each sub-chain node corresponds to one or more authorized users and is used to manage all IoT devices under that user's name. It independently maintains the ledger of its own chain and adopts the PBFT consensus mechanism. The adaptation layer contains multiple distributed adapters, each of which connects to at least one sub-chain node. It supports multiple IoT communication protocols such as MQTT, CoAP, Modbus, and HTTP, enabling protocol conversion, data preprocessing, and real-time identity verification. The core layer is deployed on a cloud server cluster and includes a transaction module, an identity module, and a communication module. The transaction module is responsible for data packet sorting and transaction generation, the identity module is responsible for the management and secondary verification of entity identities across the entire system, and the communication module is responsible for reliable data transmission across layers. The main chain layer, which is a public chain or a permissioned consortium chain, adopts the PoS consensus mechanism and is used to store the identity credential hash values ​​of all devices, the Merkle root of the sub-chain, and key transaction data, serving as the final evidence storage layer.

[0009] It is further worth noting that the specific process of calculating the unique device credential based on the preset hash algorithm in step S3 is as follows: the BLAKE2b-256 hash algorithm is used to perform a one-way hash calculation on the concatenated device identifier string, and the calculation formula for the device credential is: in, This refers to the physical network interface card (NIC) address of the IoT device. This is a globally unique production serial number for the equipment. For the device's hardware fingerprint, A 128-bit random authentication token is assigned to the child chain node. This represents a string concatenation operation in sequence; the calculated result It is a 256-bit hexadecimal hash value, serving as the unique identifier for the device throughout the entire blockchain system.

[0010] Furthermore, it should be noted that the device hardware fingerprint The fingerprint is generated by collecting the device's CPU serial number, BIOS version hash value, storage chip UID, and network card firmware version hash value, concatenating the above information in a fixed format, and then performing SHA-256 hash calculation to obtain a 128-bit hardware fingerprint value.

[0011] In a preferred embodiment, the specific process of the adapter performing real-time identity verification on the device in step S5 is as follows: The adapter receives the service data and current hardware identification information sent by the device, and regenerates the device identification string according to the same concatenation rules as the initial registration. The BLAKE2b-256 algorithm is used to calculate the current device credentials, and then the credentials are compared bit by bit with the valid device credentials stored locally. If the comparison results match, the identity verification passes, and the business data and device credentials are forwarded to the core layer; if the comparison results do not match, the request is rejected, and a device identity anomaly alarm message is sent to the corresponding sub-chain node.

[0012] In a preferred embodiment, the secondary identity verification process of the core layer in step S6 is as follows: The identity module obtains the historical registration credential hash value of the device from the main chain layer and compares it with the device credential hash value forwarded by the adapter; Verify the validity of the digital signature of the authentication token by the sub-chain node to confirm that the token has not been tampered with; If both verifications pass, the second verification is considered successful; otherwise, the data upload process is terminated, and an alarm is sent to the sub-chain node and the device administrator.

[0013] As a preferred implementation, the sub-chain layer and the main chain layer use a periodic anchoring mechanism for data synchronization: every preset time interval (default 10 minutes), the sub-chain node summarizes the device identity change records and transaction data within its chain to generate a Merkle tree and calculates the Merkle root; the sub-chain node signs the Merkle root using its own private key and sends it to the main chain layer; after the main chain layer verifies the validity of the signature, it writes the Merkle root into the block for storage.

[0014] As a preferred implementation, all cross-node data transmission within the system employs a security mechanism combining asymmetric encryption and digital signatures: the device uses its own private key to sign the transmitted data, and the adapter uses the device's public key to verify the signature; data transmission between the adapter and the core layer, and between the core layer and the main chain layer, is encrypted using the TLS 1.3 protocol to ensure the confidentiality, integrity, and non-repudiation of the data.

[0015] Compared with existing technologies, the blockchain identity authentication method for IoT devices provided by this invention has at least the following beneficial effects: (1) The adaptation layer of this invention supports a variety of mainstream IoT communication protocols and is compatible with IoT devices from different manufacturers and of different types, without the need for large-scale modification of existing devices; and the sub-chains can be horizontally scaled as lightweight nodes, with each sub-chain independently handling authentication requests for the devices under its jurisdiction, while the main chain only stores hash values ​​and evidence data, and the system can support concurrent access of millions of devices; at the same time, the deployment and maintenance costs of the sub-chains are low, and a large number of lightweight transactions are completed on the sub-chains, reducing the gas fees and computing resource consumption of the main chain.

[0016] (2) This invention can effectively prevent device identity forgery and hijacking through a dual identity verification mechanism; the BLAKE2b-256 algorithm is faster and more secure than the traditional SHA-256 algorithm; asymmetric encryption and digital signature ensure data transmission security; at the same time, it supports identity management throughout the device's life cycle. When the device undergoes hardware changes or transfer, the device credentials can be updated through the sub-chain and synchronized to the main chain to realize the dynamic transfer of identity. Attached Figure Description

[0018] Figure 1 This is a flowchart of a blockchain identity authentication method for Internet of Things (IoT) devices according to the present invention;

[0019] Figure 2 The structural block diagram for constructing the hierarchical blockchain identity authentication system of this invention is shown below. Detailed Implementation

[0020] The present invention will be further described below with reference to embodiments.

[0021] Please see Figure 1This invention provides a blockchain identity authentication method for Internet of Things (IoT) devices, comprising the following steps: Step S1: Construct a layered blockchain identity authentication system, which consists of a main chain layer, a core layer, an adaptation layer, a sub-chain layer, and an IoT device layer from top to bottom.

[0022] Step S2: When an IoT device first accesses the network, it sends a registration request containing a unique hardware identifier to its sub-chain node. After verifying the user's permissions, the sub-chain node assigns a unique authentication token to the device.

[0023] Step S3: The corresponding adapter of the adaptation layer receives the hardware unique identifier and authentication token sent by the device, concatenates them to generate a device identifier string, calculates a unique device credential based on a preset hash algorithm, and stores it locally.

[0024] Specifically, the process for calculating a unique device credential based on a preset hash algorithm is as follows: The BLAKE2b-256 hash algorithm is used to perform a one-way hash calculation on the concatenated device identifier string. The formula for calculating the device credential is: in, This refers to the physical network interface card (NIC) address of the IoT device. This is a globally unique production serial number for the equipment. For the device's hardware fingerprint, A 128-bit random authentication token is assigned to the child chain node. This represents a string concatenation operation in sequence; the calculated result It is a 256-bit hexadecimal hash value, serving as the unique identifier for the device throughout the entire blockchain system.

[0025] Furthermore, it should be noted that the device hardware fingerprint The fingerprint is generated by collecting the device's CPU serial number, BIOS version hash value, storage chip UID, and network card firmware version hash value, concatenating the above information in a fixed format, and then performing SHA-256 hash calculation to obtain a 128-bit hardware fingerprint value.

[0026] Step S4: The identity module of the core layer verifies the validity of the device credentials. After successful verification, it writes the hash value of the device identity information and the hash value of the device credentials into the main chain layer to complete the initial registration and authentication of the device. Step S5: When a device generates a status change, data report, or interaction request, the adapter first performs real-time identity verification on the device. After successful verification, it forwards the data and device credentials to the core layer.

[0027] Specifically, the process by which the adapter performs real-time identity verification on the device is as follows: The adapter receives the service data and current hardware identification information sent by the device, and regenerates the device identification string according to the same concatenation rules as the initial registration. The BLAKE2b-256 algorithm is used to calculate the current device credentials, and then the credentials are compared bit by bit with the valid device credentials stored locally. If the comparison results match, the identity verification passes, and the business data and device credentials are forwarded to the core layer; if the comparison results do not match, the request is rejected, and a device identity anomaly alarm message is sent to the corresponding sub-chain node.

[0028] Step S6: The core layer performs a secondary verification of the device identity. After the verification is successful, the transaction module packages and sorts the data and writes it into the main chain layer to complete the data on-chain storage.

[0029] Specifically, the secondary identity verification process is as follows: The identity module obtains the historical registration credential hash value of the device from the main chain layer and compares it with the device credential hash value forwarded by the adapter; Verify the validity of the digital signature of the authentication token by the sub-chain node to confirm that the token has not been tampered with; If both verifications pass, the second verification is considered successful; otherwise, the data upload process is terminated, and an alarm is sent to the sub-chain node and the device administrator.

[0030] Furthermore, the sub-chain layer and the main chain layer adopt a periodic anchoring mechanism for data synchronization: every preset time interval (default 10 minutes), the sub-chain node summarizes the device identity change records and transaction data in its own chain to generate a Merkle tree and calculates the Merkle root; the sub-chain node signs the Merkle root with its own private key and sends it to the main chain layer. After the main chain layer verifies the validity of the signature, it writes the Merkle root into the block for storage.

[0031] Further as Figure 2 As shown, it is worth noting that the hierarchical blockchain identity authentication system in step S1 is specifically composed of the following components: The IoT device layer includes multiple IoT devices with pre-installed device SDKs, embedded operating systems, and security chips. The security chip stores the device's unique hardware identifier from the factory. The sub-chain layer consists of multiple lightweight consortium chain nodes. Each sub-chain node corresponds to one or more authorized users and is used to manage all IoT devices under that user's name. It independently maintains the ledger of its own chain and adopts the PBFT consensus mechanism. The adaptation layer contains multiple distributed adapters, each of which connects to at least one sub-chain node. It supports multiple IoT communication protocols such as MQTT, CoAP, Modbus, and HTTP, enabling protocol conversion, data preprocessing, and real-time identity verification. The core layer is deployed on a cloud server cluster and includes a transaction module, an identity module, and a communication module. The transaction module is responsible for data packet sorting and transaction generation, the identity module is responsible for the management and secondary verification of entity identities across the entire system, and the communication module is responsible for reliable data transmission across layers. The main chain layer, which is a public chain or a permissioned consortium chain, adopts the PoS consensus mechanism and is used to store the identity credential hash values ​​of all devices, the Merkle root of the sub-chain, and key transaction data, serving as the final evidence storage layer.

[0032] Specifically, all cross-node data transmission within the system employs a security mechanism combining asymmetric encryption and digital signatures: devices use their own private keys to sign the data being sent, and adapters use the devices' public keys to verify the signature; data transmission between the adapter and the core layer, and between the core layer and the main chain layer, is encrypted using the TLS 1.3 protocol to ensure the confidentiality, integrity, and non-repudiation of the data.

[0033] In summary, this invention addresses four common industry problems in existing IoT blockchain identity authentication technologies: simplistic initial authentication, lack of real-time device status awareness, significant main chain performance bottlenecks, and susceptibility to device identity forgery and misuse. It innovatively proposes a dynamic identity authentication method based on a five-layer architecture: "Main Chain Layer - Core Layer - Adaptation Layer - Sub-Chain Layer - IoT Device Layer." Through multi-dimensional device credential generation, a combination of real-time edge verification and core layer secondary verification, and a collaborative mechanism of periodic anchoring between the sub-chain and the main chain, it achieves trusted identity management throughout the entire lifecycle of IoT devices. This effectively fills a gap in existing technologies and possesses significant technological advancement and engineering practical value.

[0034] The core technological breakthroughs of this invention are reflected in four dimensions: First, it pioneers a layered blockchain architecture of "sub-chains handling daily business + main chain undertaking global evidence storage," which offloads the vast majority of device authentication requests, data reporting, and lightweight transactions to sub-chains for independent processing. The main chain only stores the device identity credential hash value, the sub-chain Merkle root, and key transaction data. This achieves both linear scalability of the system, supporting a large number of IoT devices online simultaneously, and significantly reduces the storage and computing resource consumption of the main chain, completely solving the performance bottleneck of traditional single-chain architectures in large-scale IoT scenarios. Second, it constructs a multi-dimensional, unforgeable device identity system, abandoning the single hardware identifier identity generation method. It integrates four elements: the device's physical network card address, a globally unique production serial number, a hardware fingerprint, and a sub-chain random token. A unique device credential is generated using the BLAKE2b-256 algorithm, where the hardware fingerprint integrates multiple unforgeable elements. The altered hardware characteristics significantly increase the difficulty of identity forgery; thirdly, a full-process dynamic identity verification mechanism has been established, which differs from the existing technology that only performs one-time authentication during device registration, achieving "verification with every device interaction." The adapter completes low-latency real-time identity verification at the edge, and the core layer performs secondary authoritative verification in conjunction with the main chain's evidence storage. It can detect abnormal states such as device hardware tampering, firmware flashing, and illegal hijacking in real time and respond quickly, realizing an upgrade from "static registration and authentication" to "dynamic full lifecycle protection"; fourthly, it achieves low-threshold adaptation of heterogeneous devices and systems. The adaptation layer has built-in parsing engines for multiple mainstream IoT communication protocols. Devices only need to pre-install a lightweight SDK to connect. Existing devices can be quickly upgraded through external security chips. At the same time, it provides standardized API interfaces, which can be seamlessly integrated with existing IoT platforms and cloud service systems, greatly reducing the cost of technology implementation.

[0035] In terms of security and compliance, this invention employs multiple security mechanisms, including on-chain and off-chain identity separation, asymmetric encryption and digital signatures, and TLS 1.3 transmission encryption. Only anonymized identity hash values ​​are stored on-chain, while the user's real identity and device-sensitive data are stored in an off-chain encrypted database. This ensures both the immutability and traceability of the data and provides refined protection for user privacy. The main chain adopts a multi-node consensus mechanism, which can introduce regulatory agencies as consensus nodes. All transaction data is transparent and verifiable to regulators, fully complying with relevant laws and regulations.

[0036] This invention has broad industry application prospects and can be directly applied to various large-scale IoT device access scenarios, such as electric vehicle charging piles, smart grids, industrial IoT, smart homes, and smart security. For example, in the field of shared electric vehicle charging piles, it can achieve trusted authentication of charging pile identities and tamper-proof storage of charging data, solving the common problems of information asymmetry, data fraud, and lack of trust in the industry. In the field of industrial IoT, it can effectively prevent industrial control equipment from being illegally hijacked and data stolen, ensuring the safe and stable operation of industrial production. In the field of smart grids, it can achieve trusted collection and on-chain storage of smart meter electricity consumption data, providing a reliable basis for electricity trading settlement. At the same time, the unified device identity standard established by this invention lays the technical foundation for cross-platform and cross-industry device identity mutual recognition, supporting the development of various innovative IoT business models such as equipment leasing, data trading, and intelligent operation and maintenance.

[0037] In summary, the present invention has a novel technical concept and a complete and feasible solution, combining technical innovation with industrial applicability. It breaks through the core bottleneck of existing IoT blockchain identity authentication technology and is of great significance for promoting the progress of IoT security technology and the large-scale and standardized development of the IoT industry.

[0038] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0039] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0040] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0041] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A blockchain identity authentication method for Internet of Things (IoT) devices, characterized in that: Includes the following steps: Step S1: Construct a layered blockchain identity authentication system, which consists of, from top to bottom, the main chain layer, the core layer, the adaptation layer, the sub-chain layer, and the IoT device layer. Step S2: When an IoT device first accesses the network, it sends a registration request containing a unique hardware identifier to its sub-chain node. After verifying the user's permissions, the sub-chain node assigns a unique authentication token to the device. Step S3: The corresponding adapter of the adaptation layer receives the hardware unique identifier and authentication token sent by the device, concatenates them to generate a device identifier string, calculates a unique device credential based on a preset hash algorithm, and stores it locally; Step S4: The identity module of the core layer verifies the validity of the device credentials. After successful verification, it writes the hash value of the device identity information and the hash value of the device credentials into the main chain layer to complete the initial registration and authentication of the device. Step S5: When a device generates a status change, data report, or interaction request, the adapter first performs real-time identity verification on the device. After successful verification, it forwards the data and device credentials to the core layer. Step S6: The core layer performs a secondary verification of the device identity. After the verification is successful, the transaction module packages and sorts the data and writes it into the main chain layer to complete the data on-chain storage.

2. The blockchain identity authentication method for IoT devices according to claim 1, characterized in that: The hierarchical blockchain identity authentication system in step S1 consists of the following components: The IoT device layer includes multiple IoT devices with pre-installed device SDKs, embedded operating systems, and security chips. The security chip stores the device's unique hardware identifier from the factory. The sub-chain layer consists of multiple lightweight consortium chain nodes. Each sub-chain node corresponds to one or more authorized users and is used to manage all IoT devices under that user's name. It independently maintains the ledger of its own chain and adopts the PBFT consensus mechanism. The adaptation layer contains multiple distributed adapters, each of which connects to at least one sub-chain node. It supports multiple IoT communication protocols such as MQTT, CoAP, Modbus, and HTTP, enabling protocol conversion, data preprocessing, and real-time identity verification. The core layer is deployed on a cloud server cluster and includes a transaction module, an identity module, and a communication module. The transaction module is responsible for data packet sorting and transaction generation, the identity module is responsible for the management and secondary verification of entity identities across the entire system, and the communication module is responsible for reliable data transmission across layers. The main chain layer, which is a public chain or a permissioned consortium chain, adopts the PoS consensus mechanism and is used to store the identity credential hash values ​​of all devices, the Merkle root of the sub-chain, and key transaction data, serving as the final evidence storage layer.

3. The blockchain identity authentication method for IoT devices according to claim 1, characterized in that: The specific process of calculating the unique device credential based on the preset hash algorithm in step S3 is as follows: The BLAKE2b-256 hash algorithm is used to perform a one-way hash calculation on the concatenated device identifier string. The calculation formula for the device credential is: in, This refers to the physical network interface card (NIC) address of the IoT device. This is a globally unique production serial number for the equipment. For the device's hardware fingerprint, A 128-bit random authentication token is assigned to the child chain node. This represents a string concatenation operation in sequence; the calculated result It is a 256-bit hexadecimal hash value, serving as the unique identifier for the device throughout the entire blockchain system.

4. The blockchain identity authentication method for IoT devices according to claim 3, characterized in that: The device hardware fingerprint The fingerprint is generated by collecting the device's CPU serial number, BIOS version hash value, storage chip UID, and network card firmware version hash value, concatenating the above information in a fixed format, and then performing SHA-256 hash calculation to obtain a 128-bit hardware fingerprint value.

5. The blockchain identity authentication method for IoT devices according to claim 1, characterized in that: The specific process of the adapter performing real-time identity verification of the device in step S5 is as follows: The adapter receives the service data and current hardware identification information sent by the device, and regenerates the device identification string according to the same concatenation rules as the initial registration. The BLAKE2b-256 algorithm is used to calculate the current device credentials, and then the credentials are compared bit by bit with the valid device credentials stored locally. If the comparison results match, the identity verification passes, and the business data and device credentials are forwarded to the core layer; if the comparison results do not match, the request is rejected, and a device identity anomaly alarm message is sent to the corresponding sub-chain node.

6. The blockchain identity authentication method for IoT devices according to claim 1, characterized in that: The secondary identity verification process of the core layer in step S6 is as follows: The identity module obtains the historical registration credential hash value of the device from the main chain layer and compares it with the device credential hash value forwarded by the adapter; Verify the validity of the digital signature of the authentication token by the sub-chain node to confirm that the token has not been tampered with; If both verifications pass, the second verification is considered successful; otherwise, the data upload process is terminated, and an alarm is sent to the sub-chain node and the device administrator.

7. A blockchain identity authentication method for IoT devices according to claim 1, characterized in that: The sub-chain layer and the main chain layer use a periodic anchoring mechanism to synchronize data: every preset time interval, the sub-chain node summarizes the device identity change records and transaction data in its chain to generate a Merkle tree and calculates the Merkle root; the sub-chain node signs the Merkle root with its own private key and sends it to the main chain layer. After the main chain layer verifies the validity of the signature, it writes the Merkle root into the block for storage.

8. A blockchain identity authentication method for IoT devices according to claim 1, characterized in that: All cross-node data transmission within the system employs a security mechanism combining asymmetric encryption and digital signatures: the device uses its own private key to sign the data being sent, and the adapter uses the device's public key to verify the signature; Data transmission between the adapter and the core layer, and between the core layer and the main chain layer, is encrypted using the TLS 1.3 protocol to ensure the confidentiality, integrity, and non-repudiation of the data.

Images