Method for authenticating internet of things devices

Abstract

The application relates to an authentication method of an Internet of Things device. The method is applied to a security authentication platform and comprises the following steps: receiving a second authentication request sent by an encryption gateway, wherein the Internet of Things device is associated with the encryption gateway, the encryption gateway and the Internet of Things device are registered in the security authentication platform, the second authentication request is sent by the encryption gateway to the security authentication platform in response to the first authentication request, the first authentication request is used for requesting the encryption gateway to perform first authentication on the Internet of Things device; performing second authentication on the Internet of Things device based on a first channel feature, a second channel feature and a first quantum entropy source token to determine an authentication result of the Internet of Things device; wherein the second authentication request comprises the first quantum entropy source token, the first channel feature and the second channel feature. The method can improve the robustness, accuracy and environment adaptability of the authentication of the Internet of Things device, and further improve the communication security of the Internet of Things device.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) technology, and in particular to an authentication method for IoT devices. Background Technology

[0002] With the development of IoT technology, IoT devices are widely used in various fields, which leads to huge challenges in the security and management of IoT devices. In order to ensure the communication security between IoT devices and platforms, it is often necessary to authenticate IoT devices.

[0003] In related technologies, physical layer authentication schemes that rely on linear prediction models such as Kalman filtering, fixed threshold decision schemes, and fixed kernel function similarity calculation schemes are commonly used to authenticate IoT devices.

[0004] However, the authentication schemes in the aforementioned related technologies have shortcomings such as relying on static prediction models, being unable to adapt to nonlinear channel drift, and being unable to utilize historically accumulated authentication information. These shortcomings result in low robustness, accuracy, and environmental adaptability of IoT device authentication, which seriously affects the communication security of IoT devices. Summary of the Invention

[0005] Therefore, it is necessary to provide an authentication method for IoT devices that addresses the aforementioned technical issues, thereby improving the robustness, accuracy, and environmental adaptability of IoT device authentication and ultimately enhancing the communication security of IoT devices.

[0006] Firstly, this application provides an authentication method for Internet of Things (IoT) devices, applied to a security authentication platform, the method comprising:

[0007] The system receives a second authentication request from the encryption gateway, wherein the IoT device and the encryption gateway are associated and both the encryption gateway and the IoT device are registered on the security authentication platform. The second authentication request is sent by the encryption gateway to the security authentication platform after the encryption gateway has successfully authenticated the IoT device in response to the first authentication request. The first authentication request is used to request the encryption gateway to perform a first authentication on the IoT device.

[0008] A second authentication of the IoT device is performed based on the first channel characteristics, the second channel characteristics, and the first quantum entropy source token to determine the authentication result of the IoT device;

[0009] The second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device, and a second channel feature collected by the encryption gateway. The first and second channel features are characteristics of the communication channel between the IoT device and the encryption gateway.

[0010] In one embodiment, a second authentication of an IoT device is performed based on a first channel feature, a second channel feature, and a first quantum entropy source token to determine the authentication result of the IoT device. This includes: determining the posterior confidence probability of the IoT device based on the first channel feature, the second channel feature, and the prior confidence probability of the IoT device; matching and verifying the first quantum entropy source token with the registration random number of the IoT device on the security authentication platform to obtain a quantum entropy source verification result; and determining the authentication result of the IoT device based on the posterior confidence probability and the quantum entropy source verification result.

[0011] In one embodiment, determining the posterior credibility probability of an IoT device based on a first channel feature, a second channel feature, and the prior credibility probability of the IoT device includes: performing feature fusion processing on the first channel feature and the second channel feature to obtain a current fused feature; determining a likelihood estimate of the IoT device based on the current fused feature and the historical fused feature of the IoT device; wherein the historical fused feature is a fused feature determined by the security authentication platform for successful authentication of the IoT device in its historical authentication process; and determining the posterior credibility probability of the IoT device based on the likelihood estimate and the prior credibility probability.

[0012] In one embodiment, the authentication result of the IoT device is determined based on the posterior confidence probability and the quantum entropy source verification result, including: determining a first weight of the posterior confidence probability and a second weight of the quantum entropy source verification result; weighting the posterior confidence probability and the quantum entropy source verification result based on the first weight and the second weight to obtain the authentication confidence of the IoT device; and determining the authentication result of the IoT device based on the authentication confidence.

[0013] In one embodiment, the second authentication request further includes a first quantum entropy source anchoring feature, a device identifier of the IoT device, and a gateway identifier of the encryption gateway; the method further includes: using the first public key of the IoT device, generating a session key based on the first quantum entropy source anchoring feature, device identifier, gateway identifier, authentication confidence level, current timestamp, and session random number; and negotiating the session key with the IoT device through the encryption gateway.

[0014] In one embodiment, a session key is negotiated with an IoT device via an encryption gateway, including: generating an initial key negotiation response message containing the session key and encapsulated ciphertext; wherein the encapsulated ciphertext is generated using a first public key; signing the initial key negotiation response message using a second private key of a security authentication platform to obtain a target key negotiation response message; and sending the target key negotiation response message, a current timestamp, a session random number, and an authentication confidence level to the IoT device via the encryption gateway; wherein the current timestamp, session random number, and authentication confidence level are used by the IoT device to verify the target key negotiation response message in conjunction with the second public key of the security authentication platform.

[0015] In one embodiment, the method further includes: receiving service data sent by an IoT device through an encrypted gateway; wherein the service data is sent after successful verification of the target key negotiation response message, and the service data is transmitted using session key encryption.

[0016] In one embodiment, the method further includes: sending a second public key to an IoT device via an encryption gateway; and receiving a first public key sent by the IoT device via the encryption gateway.

[0017] In one embodiment, a session key is generated using the first public key of the IoT device, based on the first quantum entropy source anchoring feature, device identifier, gateway identifier, authentication confidence level, current timestamp, and session random number. This includes: generating a shared secret value and encapsulating ciphertext using the first public key of the IoT device; generating a first binding credential based on the first quantum entropy source anchoring feature, current timestamp, and session random number; and generating the session key using a key derivation function based on the shared secret value, first binding credential, device identifier, gateway identifier, authentication confidence level, current timestamp, and session random number.

[0018] In one embodiment, the method further includes: acquiring the hardware response value of the IoT device and the registration random number generated by the IoT device; and sending multiple rounds of probe signals to the IoT device through an encryption gateway to collect the basic channel characteristics of the communication channel between the encryption gateway and the security authentication platform; generating a registration binding credential for the IoT device based on the registration random number, the basic channel characteristics, and the hardware response value, and storing the registration random number and the registration binding credential accordingly.

[0019] In one embodiment, the method further includes: receiving an authentication random number sent by an encryption gateway; wherein the authentication random number is sent after the encryption gateway receives a first authentication request; generating a second quantum entropy source token based on the authentication random number and the registration random number; and sending the second quantum entropy source token to the encryption gateway; wherein the second quantum entropy source token is used by the encryption gateway to perform a first authentication of the IoT device.

[0020] In one embodiment, receiving an authentication random number sent by an encryption gateway includes: receiving an authentication random number and a first timestamp sent by the encryption gateway; wherein the first timestamp is the timestamp at which the IoT device generates the first quantum entropy source anchoring feature; generating a second quantum entropy source token based on the authentication random number and the registration random number includes: generating a second quantum entropy source token based on the authentication random number and the registration random number when the time difference between the first timestamp and the second timestamp is less than a preset threshold; wherein the second timestamp is the timestamp at which the security authentication platform receives the authentication random number and the first timestamp.

[0021] Secondly, this application also provides an authentication method for IoT devices, applied to an encrypted gateway, the method comprising:

[0022] Receive the first authentication request sent by the associated IoT device; wherein the encryption gateway is associated with the IoT device and both the encryption gateway and the IoT device are registered on the security authentication platform;

[0023] Perform first authentication on the IoT device based on the first authentication request;

[0024] After successful authentication, a second authentication request for the IoT device is sent to the security authentication platform;

[0025] The second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device, and a second channel feature collected by the encryption gateway. The first channel feature and the second channel feature are the characteristics of the communication channel between the IoT device and the encryption gateway. The second authentication request is used to instruct the security authentication platform to perform a second authentication on the IoT device based on the first quantum entropy source token, the first channel feature, and the second channel feature.

[0026] In one embodiment, the first authentication request includes a first quantum entropy source anchoring feature, an authentication random number, a first channel feature, and a device identifier of the IoT device. The first authentication of the IoT device based on the first authentication request includes: sending an authentication random number to a security authentication platform; and collecting a second channel feature of the communication channel. The authentication random number is used by the security authentication platform to generate a second quantum entropy source token based on the authentication random number and the registration random number of the IoT device on the security authentication platform. The second quantum entropy source anchoring feature is determined based on the second channel feature, the device identifier, and the second quantum entropy source token sent by the security authentication platform. The first authentication of the IoT device is performed based on a first comparison result of the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature, and a second comparison result of the first channel feature and the second channel feature.

[0027] In one embodiment, a second authentication of an IoT device is performed based on a first comparison result of a first quantum entropy source anchoring feature and a second comparison result of a first channel feature and a second channel feature, including any one of the following: if the first comparison result indicates that the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature are the same, or if the second comparison result indicates that the similarity between the first channel feature and the second channel feature is greater than a similarity threshold, the first authentication result of the IoT device is determined to be successful; if the first comparison result indicates that the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature are the same, and the second comparison result indicates that the similarity between the first channel feature and the second channel feature is greater than a similarity threshold, the first authentication result of the IoT device is determined to be successful.

[0028] In one embodiment, the first authentication request further includes a first timestamp for the IoT device to generate a first quantum entropy source anchoring feature; sending an authentication random number to the security authentication platform, including: sending the authentication random number and the first timestamp to the security authentication platform; wherein, the first timestamp is used for the security authentication platform to generate a second quantum entropy source token when the time difference between the first timestamp and the second timestamp is less than a preset threshold; the second timestamp is the timestamp at which the security authentication platform receives the authentication random number and the first timestamp.

[0029] In one embodiment, the first authentication request further includes a first quantum entropy source anchoring feature, a device identifier, and a gateway identifier of the encrypted gateway; the second authentication request is further used to instruct the security authentication platform to use the first public key of the IoT device to generate a session key based on the first quantum entropy source anchoring feature, the device identifier, the gateway identifier, the authentication confidence level, the current timestamp, and the session random number, and to negotiate the session key with the IoT device through the encrypted gateway.

[0030] In one embodiment, the method further includes: receiving business data sent by an IoT device and sending the business data to a security authentication platform; wherein the business data is transmitted using session key encryption.

[0031] Thirdly, this application also provides an authentication method for IoT devices, applied to IoT devices, the method comprising:

[0032] Send the first authentication request to the associated encryption gateway;

[0033] Among them, the encryption gateway is associated with the IoT device and both the encryption gateway and the IoT device have been registered on the security authentication platform;

[0034] The first authentication request is used to request the encryption gateway to perform a first authentication of the IoT device, and after the IoT device is successfully authenticated, it sends a second authentication request to the security authentication platform; and,

[0035] The second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device, and a second channel feature collected by the encryption gateway. Both the first and second channel features are characteristics of the communication channel between the IoT device and the encryption gateway. The second authentication request is used to request the security authentication platform to perform a second authentication on the IoT device based on the first quantum entropy source token, the first channel feature, and the second channel feature.

[0036] In one embodiment, sending a first authentication request to the associated encryption gateway includes: generating an authentication random number; collecting a first channel characteristic of the communication channel; generating a first quantum entropy source token based on the authentication random number and the registration random number of the IoT device on the security authentication platform; generating a first quantum entropy source anchoring characteristic based on the first channel characteristic, the first quantum entropy source token, and the device identifier of the IoT device; generating a first authentication request including the first quantum entropy source anchoring characteristic, the authentication random number, the first channel characteristic, and the device identifier, and sending the first authentication request to the encryption gateway.

[0037] In one embodiment, the first authentication request further includes a first timestamp corresponding to the generation of the first quantum entropy source anchoring feature; the first authentication request is also used to request the encryption gateway to send the first timestamp to the security authentication platform, so that the security authentication platform can generate a second quantum entropy source token when the time difference between the first timestamp and the second timestamp is less than a preset threshold; wherein, the second timestamp is the timestamp at which the security authentication platform receives the first timestamp, and the second quantum entropy source token is used for the encryption gateway to perform the first authentication of the IoT device.

[0038] In one embodiment, the method further includes: after the security authentication platform authenticates the IoT device, negotiating a session key with the security authentication platform via an encryption gateway; wherein the session key is determined by the security authentication platform based on the IoT device's first public key, the first quantum entropy source anchoring feature, the IoT device's device identifier, the encryption gateway's gateway identifier, authentication confidence level, current timestamp, and session random number; and the current timestamp is the timestamp when the security authentication platform determines the session key.

[0039] In one embodiment, negotiating the session key with the security authentication platform via the encryption gateway includes: receiving a target key negotiation response message, a current timestamp, a session random number, and an authentication confidence level sent by the security authentication platform via the encryption gateway; and verifying the target key negotiation response message based on the second public key of the security authentication platform, the current timestamp, the session random number, and the authentication confidence level.

[0040] In one embodiment, the method further includes: in response to the successful verification of the target key negotiation response message, sending business data to the security authentication platform via an encryption gateway, wherein the business data is transmitted using session key encryption.

[0041] In one embodiment, the target key negotiation response message is verified based on the second public key of the security authentication platform, the current timestamp, the session random number, and the authentication confidence level. This includes: verifying the signature of the target key negotiation response message based on the second public key of the security authentication platform; in response to the successful signature verification of the target key negotiation response message, determining the shared secret value based on the first private key of the IoT device and the encapsulated ciphertext in the target key negotiation response message; generating a second binding credential based on the first quantum entropy source anchoring feature, the current timestamp, and the session random number; generating a candidate key using a key derivation function, the shared secret value, the second binding credential, the device identifier of the IoT device, the gateway identifier of the encryption gateway, the authentication confidence level, the current timestamp, and the session random number; and comparing the candidate key with the session key to obtain the verification result of the target key negotiation response message.

[0042] In one embodiment, the method further includes: extracting the hardware response value of the IoT device; generating a registration random number; receiving, via an encryption gateway, a multi-round probe signal sent by the security authentication platform in response to the registration request; wherein the multi-round probe signal is used to indicate the collection of basic channel characteristics of the communication channel between the encryption gateway and the security authentication platform; sending the hardware response value and the registration random number to the security authentication platform via the encryption gateway; wherein the hardware response value, the registration random number, and the basic channel characteristics are used by the security authentication platform to generate a registration binding credential for the IoT device, and correspondingly storing the registration random number and the registration binding credential.

[0043] In one embodiment, the method further includes: receiving a second public key of the security authentication platform sent by the security authentication platform via an encryption gateway; and sending a first public key of the IoT device to the security authentication platform via the encryption gateway.

[0044] Fourthly, this application also provides an authentication device for Internet of Things (IoT) devices, applied to a security authentication platform, comprising:

[0045] The second receiving module is used to receive a second authentication request sent by the encryption gateway. The IoT device and the encryption gateway are associated and the encryption gateway and the IoT device are registered on the security authentication platform. The second authentication request is sent by the encryption gateway to the security authentication platform after the encryption gateway has successfully authenticated the IoT device in response to the first authentication request. The first authentication request is used to request the encryption gateway to perform a first authentication on the IoT device.

[0046] The second authentication module is used to perform a second authentication on the IoT device based on the first channel characteristics, the second channel characteristics, and the first quantum entropy source token, so as to determine the authentication result of the IoT device.

[0047] The second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device, and a second channel feature collected by the encryption gateway. The first and second channel features are characteristics of the communication channel between the IoT device and the encryption gateway.

[0048] Fifthly, this application also provides an authentication device for an Internet of Things (IoT) device, applied to an encrypted gateway, comprising:

[0049] The first receiving module is used to receive the first authentication request sent by the associated IoT device, wherein the encryption gateway is associated with the IoT device and the encryption gateway and the IoT device have been registered on the security authentication platform;

[0050] The first authentication module is used to perform the first authentication of IoT devices based on the first authentication request;

[0051] The first sending module is used to send a second authentication request of the IoT device to the security authentication platform after successful authentication.

[0052] The second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device, and a second channel feature collected by the encryption gateway. The first channel feature and the second channel feature are the characteristics of the communication channel between the IoT device and the encryption gateway. The second authentication request is used to instruct the security authentication platform to perform a second authentication on the IoT device based on the first quantum entropy source token, the first channel feature, and the second channel feature.

[0053] Sixthly, this application also provides an authentication device for IoT devices, applied to IoT devices, including:

[0054] The second sending module is used to send a first authentication request to the associated encryption gateway, wherein the encryption gateway and the IoT device are associated and both the encryption gateway and the IoT device are registered on the security authentication platform; the first authentication request is used to request the encryption gateway to perform a first authentication of the IoT device, and after the IoT device passes the authentication, it sends a second authentication request to the security authentication platform; and the second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device, and a second channel feature collected by the encryption gateway, wherein the first channel feature and the second channel feature are both features of the communication channel between the IoT device and the encryption gateway, and the second authentication request is used to request the security authentication platform to perform a second authentication of the IoT device based on the first quantum entropy source token, the first channel feature, and the second channel feature.

[0055] In a seventh aspect, this application also provides a security authentication platform, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the methods provided in the first aspect.

[0056] Eighthly, this application also provides an encryption gateway, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the methods provided in the second aspect.

[0057] Ninthly, this application also provides an Internet of Things (IoT) device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the methods provided in the third aspect.

[0058] In a tenth aspect, this application also provides a computer-readable storage medium having computer-executable instructions stored thereon, which, when executed by a processor, implement the methods provided in the first, second, or third aspects.

[0059] In one aspect, this application also provides a computer program product, including a computer program or instructions, which, when executed by a processor, implement the methods provided in the first, second, or third aspects.

[0060] The aforementioned authentication method for IoT devices involves registering an associated encrypted gateway and IoT device on a security authentication platform. First, the encrypted gateway responds to a first authentication request and performs a first authentication on the IoT device. After successful first authentication, it sends a second authentication request to the security authentication platform. This second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device from the communication channel between the IoT device and the encrypted gateway, and a second channel feature collected by the encrypted gateway from the same communication channel. Upon receiving the second authentication request, the security authentication platform can perform a second authentication on the IoT device based on the first channel feature, the second channel feature, and the first quantum entropy source token to determine the authentication result of the IoT device. In this way, on the one hand, by binding the physical layer channel characteristics with quantum random numbers through the first quantum entropy source token, the first channel characteristics, and the second channel characteristics, it is possible to effectively prevent channel simulation attacks and replay attacks compared to simple physical layer authentication methods, since attackers cannot simultaneously replicate the physical channel and the quantum random source. On the other hand, by coordinating the first and second authentications among the IoT device, the encryption gateway, and the security authentication platform, the authentication process of the IoT device is layered. An attack on any layer does not affect the overall security of the IoT device, thus avoiding the decrease in communication security of the IoT device caused by the disruption of a single layer of the authentication process and reducing the success rate of attacks. Based on this, this solution can improve the robustness, accuracy, and environmental adaptability of IoT device authentication, thereby improving the communication security of IoT devices. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 Application environment diagrams for authentication methods of IoT devices provided in some embodiments of this application;

[0063] Figure 2 A flowchart illustrating the authentication method for IoT devices provided in some embodiments of this application;

[0064] Figure 3 This is a schematic diagram illustrating the process of performing a second authentication on an IoT device according to some embodiments of this application;

[0065] Figure 4 A flowchart illustrating the process of determining posterior confidence probability provided for some embodiments of this application;

[0066] Figure 5 A schematic diagram illustrating the process of determining authentication results provided for some embodiments of this application;

[0067] Figure 6 A schematic diagram illustrating the session key negotiation process provided for some embodiments of this application;

[0068] Figure 7 A schematic diagram illustrating the process of generating a session key provided in some embodiments of this application;

[0069] Figure 8 A schematic diagram illustrating the session key negotiation process provided for other embodiments of this application;

[0070] Figure 9 A schematic diagram illustrating the process of registering an IoT platform provided for some embodiments of this application;

[0071] Figure 10 A schematic diagram illustrating the process of generating a second quantum entropy source token provided in some embodiments of this application;

[0072] Figure 11 A flowchart illustrating the authentication method for IoT devices provided in other embodiments of this application;

[0073] Figure 12 This is a schematic diagram illustrating the process of performing a first authentication on an IoT device according to some embodiments of this application;

[0074] Figure 13 A flowchart illustrating an authentication method for an Internet of Things (IoT) device provided in some embodiments of this application;

[0075] Figure 14 A schematic diagram illustrating the process of sending a first authentication request provided for some embodiments of this application;

[0076] Figure 15 A schematic diagram illustrating the session key negotiation process provided for other embodiments of this application;

[0077] Figure 16 A flowchart illustrating the verification target key negotiation response message provided in some embodiments of this application;

[0078] Figure 17 Signaling diagrams for registering IoT devices provided in some embodiments of this application;

[0079] Figure 18 Signaling diagrams for first authentication of IoT devices provided in some embodiments of this application;

[0080] Figure 19 Signaling diagrams for second authentication of IoT devices provided for some embodiments of this application;

[0081] Figure 20 Signaling diagrams for session key negotiation between IoT devices and security authentication platforms provided in some embodiments of this application;

[0082] Figure 21 Structural block diagram of an authentication apparatus for an Internet of Things (IoT) device provided in some embodiments of this application;

[0083] Figure 22 Structural block diagram of an authentication device for an Internet of Things (IoT) device provided in other embodiments of this application;

[0084] Figure 23 Structural block diagram of an authentication device for an Internet of Things (IoT) device provided in some further embodiments of this application;

[0085] Figure 24 Internal structure diagram of the security authentication platform provided in some embodiments of this application;

[0086] Figure 25 This is an internal structure diagram of an Internet of Things (IoT) device provided in some embodiments of this application. Detailed Implementation

[0087] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0088] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments or any combination of multiple embodiments.

[0089] In related technologies, physical layer authentication schemes that rely on linear prediction models such as Kalman filtering, fixed threshold decision schemes, and fixed kernel function similarity calculation schemes are commonly used to authenticate IoT devices.

[0090] However, the authentication schemes in the aforementioned related technologies have shortcomings such as relying on static prediction models, being unable to adapt to nonlinear channel drift, and being unable to utilize historically accumulated authentication information. These shortcomings result in low robustness, accuracy, and environmental adaptability of IoT device authentication, which seriously affects the communication security of IoT devices.

[0091] Therefore, to address the aforementioned technical problems, an exemplary embodiment provides a method for authenticating IoT devices. The IoT device authentication method provided in this application embodiment can be applied to, for example... Figure 1 The application environment shown.

[0092] The IoT device 101 communicates with the encryption gateway 102 through a communication channel, while the encryption gateway 102 communicates with the security authentication platform 103 through a communication channel.

[0093] The IoT device 101 is associated with the encryption gateway 102. The IoT device 101 communicates with the security authentication platform 103 through the encryption gateway 102. That is, the encryption gateway 102 acts as an intermediate security node, connecting the IoT device 101 on one end and the security authentication platform 103 on the other, enabling protocol conversion and security hardening between the original messages on the IoT device 101 side and the encrypted secure channel on the security authentication platform 103 side. When the IoT device 101 needs to send information to the security authentication platform 103, it sends the information to the encryption gateway 102, which then forwards it to the security authentication platform 103. Conversely, when the security authentication platform 103 needs to send information to the IoT device 101, it sends the information to the encryption gateway 102, which then forwards it to the IoT device 101. In this application, the encryption gateway can be an edge encryption gateway.

[0094] Optionally, there is a unique correspondence between IoT devices and encrypted gateways, meaning that one IoT device is associated with only one encrypted gateway, and one encrypted gateway is associated with only one IoT device.

[0095] Optionally, IoT devices may include, but are not limited to, smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, and projection devices.

[0096] Optionally, the security authentication platform can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0097] Based on the above embodiments, in an exemplary embodiment, such as Figure 2 As shown, an authentication method for IoT devices is provided, which can be applied to... Figure 1 Taking the security authentication platform 103 in the example, the process may include the following steps:

[0098] S201, Receive the second authentication request sent by the encryption gateway.

[0099] In this embodiment, the IoT device and the encryption gateway are associated and both are registered on the security authentication platform. The second authentication request is sent by the encryption gateway to the security authentication platform after the encryption gateway has successfully authenticated the IoT device in response to the first authentication request. The first authentication request is used to request the encryption gateway to perform a first authentication on the IoT device. The second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device, and a second channel feature collected by the encryption gateway. The first channel feature and the second channel feature are the characteristics of the communication channel between the IoT device and the encryption gateway.

[0100] In this embodiment, the association between the IoT device and the encryption gateway is first established, and the IoT device and the encryption gateway are registered on the security authentication platform. Thus, when the IoT device needs to be authenticated, the IoT device first sends a first authentication request to the associated encryption gateway to request the encryption gateway to perform a first authentication of the IoT device. After the encryption gateway responds to the first authentication request and successfully authenticates the IoT device, the encryption gateway can send a second authentication request to the security authentication platform to request the security authentication platform to perform a second authentication of the IoT device.

[0101] In this embodiment, the IoT device can collect features of the communication channel between the IoT device and the encryption gateway to obtain a first channel feature, and the encryption gateway can also collect features of the communication channel between the IoT device and the encryption gateway to obtain a second channel feature. Therefore, the second authentication request may include the first channel feature and the second channel feature.

[0102] Furthermore, the so-called quantum entropy source token refers to the hardware security token of the quantum random number generator (QRNG) integrated into the IoT device. It is generated by random numbers randomly generated by the aforementioned quantum random number generator and is a true random entropy. In this embodiment, when the IoT device sends a first authentication request to the encryption gateway, a first quantum entropy source token can be generated and sent to the IoT device through the first authentication request. Subsequently, the IoT device sends the first quantum entropy source token to the security authentication platform through a second authentication request. Therefore, the second authentication request may also include the first quantum entropy source token.

[0103] S202, perform a second authentication on the IoT device based on the first channel characteristics, the second channel characteristics, and the first quantum entropy source token to determine the authentication result of the IoT device.

[0104] Upon receiving the aforementioned second authentication request, the security authentication platform can perform a second authentication on the IoT device based on the first channel feature, the second channel feature, and the first quantum entropy source token included in the second authentication request, in order to determine the authentication result of the IoT device. This authentication result is used to characterize whether the IoT device has passed authentication.

[0105] In this embodiment, if the authentication result indicates that the IoT device has passed authentication, the security authentication platform can confirm that the IoT device is a secure device. Therefore, it can perform signaling interaction with the IoT device through the encryption gateway, such as receiving business data sent by the IoT device through the encryption gateway and issuing control signaling to the IoT device through the encryption gateway.

[0106] Correspondingly, if the above authentication result indicates that the IoT device authentication fails, the security authentication platform can confirm that the IoT device is an insecure device, and there may be risks such as interaction errors and information leakage in the signaling interaction with the IoT device. Therefore, the security authentication platform can refuse to conduct signaling interaction with the IoT device, such as refusing to receive business data sent by the IoT device through the encrypted gateway.

[0107] Optionally, if the above authentication result indicates that the IoT device authentication fails, the security authentication platform can output alarm prompts for the IoT device. In this embodiment, the security authentication platform can output the above alarm prompts in various ways, such as sending alarm emails to a preset email address, displaying the device identifier of the IoT device and prompts that the IoT device has security risks on the display interface, etc.

[0108] Optionally, during the signaling interaction between the IoT device and the security authentication platform, the IoT device can periodically (e.g., every 5 minutes) initiate a new round of authentication to ensure channel continuity.

[0109] Optionally, if an IoT device detects an abnormal change, the IoT device may trigger re-authentication to terminate the current authentication process and initiate a new round of authentication.

[0110] The aforementioned authentication method for IoT devices involves registering an associated encrypted gateway and IoT device on a security authentication platform. First, the encrypted gateway responds to a first authentication request and performs a first authentication on the IoT device. After successful first authentication, it sends a second authentication request to the security authentication platform. This second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device from the communication channel between the IoT device and the encrypted gateway, and a second channel feature collected by the encrypted gateway from the same communication channel. Upon receiving the second authentication request, the security authentication platform can perform a second authentication on the IoT device based on the first channel feature, the second channel feature, and the first quantum entropy source token to determine the authentication result of the IoT device. In this way, on the one hand, by binding the physical layer channel characteristics with quantum random numbers through the first quantum entropy source token, the first channel characteristics, and the second channel characteristics, it is possible to effectively prevent channel simulation attacks and replay attacks compared to simple physical layer authentication methods, since attackers cannot simultaneously replicate the physical channel and the quantum random source. On the other hand, by coordinating the first and second authentications among the IoT device, the encryption gateway, and the security authentication platform, the authentication process of the IoT device is layered. An attack on any layer does not affect the overall security of the IoT device, thus avoiding the decrease in communication security of the IoT device caused by the disruption of a single layer of the authentication process and reducing the success rate of attacks. Based on this, this solution can improve the robustness, accuracy, and environmental adaptability of IoT device authentication, thereby improving the communication security of IoT devices.

[0111] Based on the above embodiments, in an exemplary embodiment, the second authentication of the IoT device in S202 is further refined; optionally, as... Figure 3 As shown, the following steps may be included:

[0112] S301, Based on the first channel features, the second channel features, and the prior confidence probability of the IoT device, determine the posterior confidence probability of the IoT device.

[0113] In this embodiment, after receiving the second authentication request, the security authentication platform can first determine the prior trust probability of the IoT device. For example, the security authentication platform can read historical authentication records of the IoT device from a preset data storage space (such as a database) to obtain the prior trust probability of the IoT device from these historical authentication records.

[0114] Optionally, the prior confidence probability of the aforementioned IoT device is the posterior confidence probability of the most recent successful authentication in the historical authentication process of the IoT device by the security authentication platform. In this embodiment, for the first authentication of the IoT device by the security authentication platform, the prior confidence probability corresponding to the first authentication can be set to a preset value, such as 0.5.

[0115] Furthermore, after determining the prior credibility probability of the aforementioned IoT device, the posterior credibility probability of the IoT device can be determined based on the prior credibility probability and the first channel feature and second channel feature in the second authentication request. For example, the security authentication platform can perform probabilistic authentication based on Bayesian inference based on the first channel feature, the second channel feature, and the prior credibility probability of the IoT device to obtain the posterior credibility probability of the IoT device.

[0116] In this embodiment, when the authentication result is successful, the posterior confidence probability of the IoT device determined in this authentication can be used as the prior confidence probability when the security authentication platform authenticates the IoT device in the next time (i.e., to implement Posterior Probability Update Authentication (PPUA)). By analogy, the historical authentication results of the security authentication platform for IoT devices can be accumulated into the current authentication decision, so that the authentication accuracy of the security authentication platform for IoT devices can be continuously improved with the increase of the number of authentications.

[0117] S302, the first quantum entropy source token is matched and verified with the random number registered by the IoT device on the security authentication platform to obtain the quantum entropy source verification result.

[0118] During the registration process of IoT devices on the security authentication platform, the quantum random number generator integrated into the IoT device can randomly generate random numbers and submit these random numbers to the security authentication platform through secure channels such as offline methods. These random numbers serve as the registration random numbers for the IoT device on the platform. Then, when the security authentication platform authenticates the IoT device to confirm its security status, it can match and verify the aforementioned first quantum entropy source token with the aforementioned registration random numbers to determine whether the first quantum entropy source token matches the registration random numbers, thus obtaining the quantum entropy source verification result.

[0119] Optionally, the quantum entropy source verification result is a numerical value used to characterize the degree of matching between the first quantum entropy source token and the registered random number, and its value range is [0,1]. In this embodiment, the closer the quantum entropy source verification result is to 1, the higher the degree of matching between the first quantum entropy source token and the registered random number. When the quantum entropy source verification result is 1, it means that the first quantum entropy source token and the registered random number are completely matched. Conversely, the closer the quantum entropy source verification result is to 0, the lower the degree of matching between the first quantum entropy source token and the registered random number. When the quantum entropy source verification result is 0, it means that the first quantum entropy source token and the registered random number are completely mismatched.

[0120] S303 determines the authentication result of IoT devices based on the posterior confidence probability and the quantum entropy source verification results.

[0121] After obtaining the aforementioned posterior confidence probability and quantum entropy source verification results, the security authentication platform can determine the authentication result of the IoT device based on the posterior confidence probability and quantum entropy source verification results.

[0122] For example, if the posterior confidence probability is greater than the probability threshold and the quantum entropy source verification result is greater than the result threshold, the authentication result of the IoT device is determined to be successful; if the posterior confidence probability is less than or equal to the probability threshold and / or the quantum entropy source verification result is less than or equal to the result threshold, the authentication result of the IoT device is determined to be unsuccessful.

[0123] In this embodiment, the prior confidence probability and posterior confidence probability of IoT devices are introduced. This allows the security authentication platform to accumulate the historical authentication results of IoT devices into the current authentication decision, enabling the authentication accuracy of IoT devices by the security authentication platform to continuously improve with the number of authentications. This, in turn, continuously improves the robustness, accuracy, and environmental adaptability of IoT device authentication, thereby continuously enhancing the communication security of IoT devices.

[0124] Based on the above embodiments, in an exemplary embodiment, the determination of the posterior confidence probability in S301 is further refined; optionally, such as Figure 4 As shown, the following steps may be included:

[0125] S401, perform feature fusion processing on the first channel features and the second channel features to obtain the current fused features.

[0126] In this embodiment, the security authentication platform first performs feature fusion processing on the first channel feature and the second channel feature to obtain the current fused feature. For example, the first channel feature and the second channel feature are superimposed to obtain the current fused feature.

[0127] Optionally, since the first and second channel features are obtained by the IoT device and the encryption gateway respectively collecting features from the same communication channel (the communication channel between the IoT device and the encryption gateway), the principle of channel exclusivity can be used to perform feature fusion processing on the first and second channel features to obtain the current fused features. For example, the current fused features can be determined using the following formula:

[0128]

[0129] In this embodiment, As a current feature of fusion, This is the first channel feature. This is the second channel feature.

[0130] S402, Based on the current convergence characteristics and the historical convergence characteristics of IoT devices, determine the likelihood estimate of IoT devices.

[0131] Among them, historical fusion characteristics are the fusion characteristics determined by the security authentication platform when the authentication of IoT devices is passed in the historical authentication process.

[0132] Likelihood estimation refers to constructing an estimate of unknown parameters using the likelihood function. Examples include maximum likelihood estimation (MLE) and maximum a posteriori estimation (MAP). The goal is to adjust the likelihood function to maximize the probability of the currently observed data.

[0133] In this embodiment, determining the likelihood estimate of an IoT device refers to the likelihood function (e.g., L(…)) of the current fusion characteristics under the assumption that "the IoT device is a secure device," based on the current fusion characteristics and the historical fusion characteristics of the IoT device. The model is constructed using the "legitimate device" approach. By adjusting the likelihood function, the probability that the current fused feature indicates that "the IoT device is a secure device" is most likely to be true is maximized. The value of the likelihood function is then used as the likelihood estimate of the IoT device.

[0134] Based on this, in this embodiment, the security authentication platform can read the historical authentication records of IoT devices to obtain the fusion features determined by the security authentication platform when the authentication of IoT devices was successful in the historical authentication process. These fusion features are then used as historical fusion features. Based on the aforementioned current fusion features and historical fusion features, the likelihood estimate of the IoT device is determined.

[0135] Optionally, based on the aforementioned current fusion characteristics and the fusion characteristics determined by the security authentication platform during the historical authentication process of IoT devices, the most recent preset number of successful authentications; wherein, the aforementioned preset number can be set by empirical values, authentication results of historical authentications, etc., for example, 10, etc., without specific limitations.

[0136] Optionally, the likelihood function described above can be modeled using the nonparametric kernel density estimation (KDE) method. For example, the likelihood estimate of an IoT device can be determined using the following formula:

[0137]

[0138] In this embodiment, For the likelihood estimate of IoT devices, For the security certification platform, this is the most recent certification process in the history of IoT devices. The second certification is in progress. The historical fusion characteristics determined when the certification is passed. As a current feature of fusion, For Euclidean distance for The corresponding adaptive bandwidth parameters.

[0139] In this embodiment, The method for determining this is as follows: For each historical fusion feature determined by the security authentication platform during the historical authentication process of IoT devices, when authentication is successful, calculate the historical fusion feature up to the [number]th [number]. Euclidean distance of the historical fusion characteristics of the nearest neighbors ,but ;in, The value can be set based on empirical values, historical authentication results, etc., for example, 5, etc., without specific limitations. The aforementioned adaptive bandwidth parameter causes the bandwidth kernel density to adaptively change with the historical fusion feature density: in regions with dense historical fusion features, Smaller values ​​improve local resolution accuracy; in regions where historical fusion features are sparse, A larger value ensures the smoothness of the likelihood estimation, thus overcoming the problem of decreased likelihood estimation accuracy when the fixed bandwidth kernel density is unevenly distributed in the feature space of historical fusion features.

[0140] S403, determine the posterior confidence probability of the IoT device based on the likelihood estimate and the prior confidence probability.

[0141] After obtaining the likelihood estimate and prior confidence probability, the security authentication platform can determine the posterior confidence probability of the IoT device based on the likelihood estimate and prior confidence probability.

[0142] Optionally, the posterior confidence probability of an IoT device can be determined using the following formula:

[0143]

[0144] In this embodiment, Let be the prior confidence probability. This is the likelihood estimate. Let be the posterior confidence probability.

[0145] In this embodiment, the historical authentication data of IoT devices by the security authentication platform can be accumulated into the current authentication decision, so that the authentication accuracy of IoT devices by the security authentication platform can be continuously improved with the increase of authentication times, thereby continuously improving the robustness, accuracy and environmental adaptability of IoT device authentication, and thus continuously improving the communication security of IoT devices.

[0146] Based on the above embodiments, in an exemplary embodiment, the determination of the authentication result in S303 is further refined; optionally, as... Figure 5 As shown, the following steps may be included:

[0147] S501 determines the first weight of the posterior confidence probability and the second weight of the quantum entropy source verification result.

[0148] Optionally, a first weight for the posterior confidence probability and a second weight for the quantum entropy source verification result are pre-set to adopt statically fixed first and second weights. For example, the first and second weights are determined based on the security level and environmental characteristics of the IoT device deployment scenario. For instance, in the case of a static industrial scenario, the first weight is determined to be [0.5, 0.7]; while in the case of a mobile device and / or a scenario where the IoT device is deployed in a way that causes drastic channel changes, the second weight is determined to be [0.5, 0.7].

[0149] Optionally, based on the Bayesian online learning mechanism, after each authentication of the IoT device by the security authentication platform, the first and second weights used in this authentication are updated according to the prediction error of the final authentication result based on the posterior confidence probability and the quantum entropy source verification result. The updated first and second weights are then used as the first and second weights for the next authentication of the IoT device by the security authentication platform. For example, the first and second weights are updated using the gradient descent method.

[0150] Optionally, before deploying IoT devices, test data is collected in the environment where the IoT devices are to be deployed. With the optimization goal of minimizing the sum of the false acceptance rate and false rejection rate of the security authentication platform for IoT devices, the first weight and second weight combinations in the preset weight space are traversed to determine the optimal combination, so that the first weight and second weight in the above optimal combination can be used when the security authentication platform authenticates the IoT devices.

[0151] It should be noted that the above embodiments are merely illustrative examples of the first weight and the second weight, and are not intended to limit the scope of this application. Any method for determining the first weight and the second weight that can satisfy the authentication requirements of the security authentication platform for IoT devices, as well as the specific values ​​of the first weight and the second weight, are within the scope of protection of this application.

[0152] S502, based on the first weight and the second weight, performs weighted processing on the posterior confidence probability and the quantum entropy source verification result to obtain the authentication confidence of the IoT device.

[0153] After obtaining the first and second weights mentioned above, the security authentication platform can weight the posterior confidence probability and the quantum entropy source verification result based on the first and second weights to obtain the authentication confidence level of the IoT device. For example, the authentication confidence level is determined using the following formula:

[0154]

[0155] In this embodiment, To verify confidence level, For the posterior confidence probability, As the first weight, Verification results for the quantum entropy source, It is the second weight.

[0156] S503 determines the authentication result of IoT devices based on authentication confidence level.

[0157] After obtaining the above-mentioned authentication confidence level, the IoT platform can determine the authentication result of the IoT device based on the authentication confidence level.

[0158] Optionally, if the authentication confidence level is greater than or equal to the confidence threshold, the authentication result of the IoT device is determined to be successful; if the authentication confidence level is less than the confidence threshold, the authentication result of the IoT device is determined to be unsuccessful. Optionally, the confidence threshold can be set according to the device security level of the IoT device, so that different IoT devices can use dynamically changing confidence thresholds.

[0159] In this embodiment, the authentication result of the IoT device is determined by weighting the posterior confidence probability and the quantum entropy source verification result. This can integrate the historical authentication status of the IoT device by the security authentication platform with the quantum entropy source verification, thereby improving the robustness and environmental adaptability of the IoT device authentication and enhancing the communication security of the IoT device.

[0160] Based on the above embodiments, in an exemplary embodiment, this application also provides an implementation method for session key negotiation between a security authentication platform and an IoT device; optionally, the second authentication request further includes a first quantum entropy source anchoring feature, the device identifier of the IoT device, and the gateway identifier of the encryption gateway; then as follows Figure 6 As shown, the following steps may be included:

[0161] S601 uses the first public key of the IoT device to generate a session key based on the first quantum entropy source anchoring feature, device identifier, gateway identifier, authentication confidence level, current timestamp, and session random number.

[0162] The so-called Quantum Entropy-Anchored Feature (QEAF) refers to a dynamic authentication credential generated by binding physical layer channel characteristics with a truly random entropy source generated by a quantum random number generator integrated with an IoT device lock, and then using a hash function. The QEAF combines the uniqueness of the physical layer channel with the unpredictability of the quantum random source, making it impossible for attackers to simultaneously replicate both the physical channel and the quantum random source.

[0163] A session key is a symmetric key that is temporarily used by both parties during the validity period of a communication session. It is only used for data encryption and integrity verification during this interaction and expires and is destroyed after the session ends.

[0164] In this embodiment, the second authentication request may further include the first quantum entropy source anchoring feature, the device identifier of the IoT device, and the gateway identifier of the encryption gateway, in order to request the security authentication platform to initiate a session key negotiation with the IoT platform when the authentication result of the IoT device indicates that the authentication is successful, so as to determine the session key used for subsequent signaling interaction between the IoT device and the security authentication platform.

[0165] Optionally, when an IoT device sends a first authentication request to an encryption gateway, it can generate a first quantum entropy source anchoring feature and send the first quantum entropy source anchoring feature to the IoT device through the first authentication request. Then, the IoT device sends the first quantum entropy source anchoring feature to the security authentication platform through a second authentication request. Therefore, the second authentication request may also include the first quantum entropy source anchoring feature.

[0166] Based on this, when the authentication result of the IoT device indicates successful authentication, the security authentication platform can determine the IoT device's first public key, as well as the first quantum entropy source anchoring feature, device identifier, gateway identifier, the aforementioned authentication confidence level, current timestamp, and session random number. Then, using the IoT device's first public key, and based on the first quantum entropy source anchoring feature, device identifier, gateway identifier, authentication confidence level, current timestamp, and session random number, a session key is generated. The session random number is a random number that can be randomly generated by the quantum random number generator integrated into the security authentication platform.

[0167] The S602 negotiates session keys with IoT devices via an encrypted gateway.

[0168] After generating the aforementioned session key, the security authentication platform sends the aforementioned session key to the encryption gateway bound to the IoT device based on the aforementioned device identifier, so that the encryption gateway sends the aforementioned session key to the IoT device, thereby enabling session key negotiation between the security authentication platform and the IoT platform.

[0169] Based on this, in this embodiment, a hierarchical cascade authentication architecture (HCAA) for IoT devices can be implemented. This means that the authentication process of IoT devices is decomposed into three independent levels: physical layer quantum entropy source verification, channel feature matching, and PQC (Post-Quantum Cryptography) key negotiation. The final authentication decision is formed by cascading and merging these levels. The breach of any single level will not affect the overall security of IoT device communication.

[0170] In this embodiment, an encryption gateway is used to negotiate session keys between the security authentication platform and the IoT device to determine the session key used for subsequent signaling interactions between the IoT device and the security authentication platform, thereby improving the communication security between the IoT device and the security authentication platform after IoT authentication is successful.

[0171] Based on the above embodiments, in an exemplary embodiment, the generation of the session key in step 601 is further refined; optionally, as... Figure 7 As shown, the following steps may be included:

[0172] S701 uses the first public key of the IoT device to generate a shared secret value and encapsulate ciphertext.

[0173] In this embodiment, the security authentication platform can use the first public key of the IoT device to call the key encapsulation function of the corresponding algorithm to generate a shared secret value and encapsulated ciphertext. For example, if the first public key is a Kyber_pub (KyberPublic) public key, the security authentication platform can use the Kyber_pub public key to call the key encapsulation function of the Kyber algorithm to generate a shared secret value and encapsulated ciphertext.

[0174] S702 generates the first binding credential based on the first quantum entropy source anchoring feature, the current timestamp, and the session random number.

[0175] In this embodiment, the security authentication platform can bind the aforementioned first quantum entropy source anchoring feature, current timestamp, and session random number to obtain a first binding credential. For example, the platform can perform hash encoding on the aforementioned first quantum entropy source anchoring feature, current timestamp, and session random number to obtain the first binding credential.

[0176] Optionally, the first binding credential can be determined using the following formula:

[0177]

[0178] In this embodiment, This is the first binding credential. Anchoring characteristics for the first quantum entropy source, This is the current timestamp. It refers to Hash-based Message Authentication Code - SM3 (SM3 Hash Message Authentication Code), which is a key-based message authentication algorithm that can simultaneously perform message integrity verification and identity authentication.

[0179] S703 uses a key derivation function to generate a session key based on a shared secret value, the first binding credential, the device identifier, the gateway identifier, the authentication confidence level, the current timestamp, and the session random number.

[0180] After obtaining the first binding credential, the security authentication platform can use a Key Derivation Function (KDF) to derive the session key by mixing the shared secret value, the first binding credential, the device identifier, the gateway identifier, the authentication confidence level, the current timestamp, and the session random number.

[0181] Optionally, the session key can be determined using the following formula:

[0182]

[0183] In this embodiment, For session key, To share secret values, This is the first binding credential. For device identification of Internet of Things (IoT) devices. The gateway identifier for the gateway device. This is the current timestamp. For authentication confidence level.

[0184] In some embodiments, the security authentication platform stores the authentication confidence time series of each IoT device and uses an exponentially weighted moving average to smooth the historical authentication confidence, suppressing single abnormal fluctuations. Specifically:

[0185] Among them, the smoothing coefficient The range of values ​​is 0 < ≤1, the specific value of which is determined based on the mobility level of the IoT device. This represents the current authentication confidence level (i.e., the authentication confidence level determined in this authentication process). Historical authentication confidence level (i.e., the historical authentication confidence level determined by the security authentication platform for IoT devices when authentication was successful in the past authentication process).

[0186] For static / low-mobility equipment (such as fixed-installation hydraulic RTUs (Remote Terminal Units), substation protection devices, etc.), The value can be [0.1, 0.3]. These devices have stable channel characteristics and should be given a higher weight (i.e., 1-) for historical authentication confidence. (Larger), to smooth out short-term interference and prevent frequent re-authentication due to accidental fluctuations.

[0187] For semi-mobile equipment (such as AGVs (Automated Guided Vehicles), inspection robots, etc.), The value can be [0.4, 0.6] to balance historical trust with the current real-time state.

[0188] For highly mobile devices (such as drones, handheld terminals, etc.) The value can be [0.7, 0.9]. These types of devices have rapidly changing channel characteristics, and the reference value of historical information decays quickly. Therefore, the current authentication confidence level should be given a higher weight.

[0189] In other embodiments, when the second authentication passes multiple times consecutively (e.g., M times, where M is an integer greater than 1) and the authentication confidence level determined by each successful second authentication exceeds a threshold, the security authentication platform updates the current fusion feature increment to the template library (which stores historical fusion features) and refreshes the quantum entropy source seed. Specifically:

[0190] ,in, To update weights (e.g., 0.05), ensure the template library slowly tracks environmental changes. Specifically, The range of values ​​is 0 < <1, the specific value of which is determined based on the rate of environmental change and safety strategy; To refresh the fusion features, Characterized by historical integration, This represents the current fusion feature.

[0191] For static environments (such as indoor enclosed computer rooms). The value can be [0.01, 0.05] to adopt a slow update strategy, mainly to prevent the template library from aging, and at the same time to avoid polluting the template pool due to occasional fluctuations.

[0192] For dynamic environments (such as outdoor environments, affected by weather, temperature and humidity). The value can be [0.05, 0.1] to appropriately speed up the update rate, so that the template library can follow the seasonal or diurnal channel characteristics.

[0193] Furthermore, to prevent malicious nodes from polluting the template library through slow injection, The value of this threshold can be set using a "high confidence threshold." That is, the template library update is only initiated when the authentication confidence level, determined after multiple consecutive successful second authentications, is greater than 0.9. Take the smaller value to ensure the robustness of template library updates.

[0194] Furthermore, when the authentication confidence level is detected to be continuously decreasing (e.g., decreasing N times consecutively, where N is an integer greater than 1), the security authentication platform triggers an operation and maintenance alarm, indicating possible environmental changes, device relocation, or potential attacks, to prompt the need for manual operation and maintenance intervention for verification.

[0195] In this embodiment, the session key is bound to the aforementioned authentication confidence level. The higher the authentication confidence level, the higher the entropy value of the obtained session key, and thus the higher the security of the obtained session key, thereby improving the communication security between IoT devices and the security authentication platform.

[0196] Based on the above embodiments, in an exemplary embodiment, the negotiation of the session key in S602 is further refined; optionally, as... Figure 8 As shown, the following steps may be included:

[0197] S801, generate an initial key negotiation response message containing the session key and encapsulated ciphertext.

[0198] The ciphertext is generated using the first public key.

[0199] In this embodiment, after obtaining the aforementioned session key, the security authentication platform first uses the first public key of the IoT device to generate encapsulated ciphertext, and then encapsulates the session key and the encapsulated ciphertext into a message to obtain an initial key negotiation response message containing the session key and the encapsulated ciphertext.

[0200] S802 uses the second private key of the security authentication platform to sign the initial key negotiation response message to obtain the target key negotiation response message.

[0201] After receiving the initial key negotiation response message, the security authentication platform can further use its own second private key to sign the initial key negotiation response message, thus obtaining the signed initial key negotiation response message, which serves as the target key negotiation response message.

[0202] The S803 sends a target key negotiation response message, current timestamp, session random number, and authentication confidence level to IoT devices through an encrypted gateway.

[0203] Among them, the current timestamp, session random number, and authentication confidence score are used by IoT devices to verify the target key negotiation response message in conjunction with the second public key of the security authentication platform.

[0204] In this embodiment, as described above, the IoT device can record the device identifier of the physical network device and the gateway identifier of the encrypted gateway. The session key is generated based on the shared secret value, the first binding credential, the device identifier, the gateway identifier, the authentication confidence level, the current timestamp, and the session random number. The first binding identifier is generated based on the first quantum entropy source anchoring feature, the current timestamp, and the session random number. Therefore, in order to ensure that the IoT device can verify the received target key negotiation response message, while sending the target key negotiation response message to the IoT device, it is also necessary to simultaneously send the current timestamp, session random number, and authentication confidence level, which are unknown to the IoT device, to the IoT device.

[0205] Based on this, the security authentication platform sends a target key negotiation response message, a current timestamp, a session random number, and an authentication confidence level to the encryption gateway associated with the IoT device. In turn, the encryption gateway sends the target key negotiation response message, a current timestamp, a session random number, and an authentication confidence level to the IoT device, so that the IoT device uses the second public key of the security authentication platform to verify the target key negotiation response message based on the aforementioned current timestamp, session random number, and authentication confidence level.

[0206] In one optional embodiment, the method may further include receiving service data sent by an IoT device through an encrypted gateway; wherein the service data is sent after successful verification of the target key negotiation response message, and the service data is transmitted using session key encryption.

[0207] In this embodiment, as described above, the session key is used for subsequent signaling interaction between the IoT device and the security authentication platform. When the IoT device successfully verifies the target key negotiation response message, it can parse the session key from the target key negotiation response message and confirm that it is using the session key to interact with the security authentication platform. Thus, after the target key negotiation response message is successfully verified, the IoT device can use the session key to encrypt the service data it wants to transmit to the security authentication platform and send the encrypted service data to the associated encryption gateway. The encryption gateway can then send the encrypted service data to the security authentication platform to realize the signaling interaction between the IoT device and the security authentication platform based on the session key for encrypted transmission.

[0208] In another alternative embodiment, the method may further include sending a second public key to an IoT device via an encryption gateway; and receiving a first public key sent by the IoT device via the encryption gateway.

[0209] In this embodiment, as described above, the security authentication platform generates an initial key negotiation response message using the first public key of the IoT device, while the IoT device verifies the target key negotiation response message using the second public key of the security authentication platform. The first public key of the IoT device is the public key in the key pair generated by the IoT device, and the second public key of the security authentication platform is the public key in the key pair generated by the security authentication platform. Therefore, in order for the IoT device and the security authentication platform to know the public key in each other's generated key pairs, the security authentication platform can send the second public key to the encryption gateway associated with the IoT device, and the encryption gateway will then send the second public key to the IoT device. Correspondingly, the IoT device sends its first public key to the bound encryption gateway, and the encryption gateway will then send its first public key to the security authentication platform. Optionally, the key pair generated by the security authentication platform and the IoT device can be a PQC key pair.

[0210] In this embodiment, an encryption gateway is used to negotiate session keys between the security authentication platform and the IoT device to determine the session key used for subsequent signaling interactions between the IoT device and the security authentication platform, thereby improving the communication security between the IoT device and the security authentication platform after IoT authentication is successful.

[0211] Based on the above embodiments, in one exemplary embodiment, this application also provides a method for registering IoT devices on a security authentication platform; optionally, such as Figure 9 As shown, the following steps may be included:

[0212] S901, obtain the hardware response value of the IoT device and the registration random number generated by the IoT device.

[0213] In this embodiment, during the registration process of an IoT device on a security authentication platform, the quantum random number generator integrated into the IoT device can randomly generate random numbers as registration random numbers. Furthermore, the IoT device can extract its hardware response value based on its Physical Unclonable Function (PUF). For each IoT device, the hardware response value is unique and serves as the fundamental credential of its identity. Therefore, the aforementioned hardware response value and registration random number can be submitted to the security authentication platform via secure channels, such as offline methods, to ensure their security.

[0214] Optionally, the above-mentioned registered random number can be a 256-bit random number.

[0215] The S902 sends multiple rounds of probe signals to IoT devices through an encryption gateway to collect basic channel characteristics of the communication channel between the encryption gateway and the security authentication platform.

[0216] The security authentication platform can send probing signals to the encryption gateway associated with the IoT device. The encryption gateway then sends these probing signals back to the IoT device. By absorbing these probing signals, the security authentication platform can collect the channel characteristics of the communication channel between the encryption gateway and itself. Furthermore, by sending multiple rounds of these probing signals, the security authentication platform can determine the basic channel characteristics of the communication channel between the encryption gateway and itself. Optionally, the IoT device can send a registration request to the security authentication platform via the encryption gateway. In response to the registration request, the security authentication platform will send multiple rounds of probing signals back to the IoT device via the encryption gateway.

[0217] In this embodiment, the number of rounds of the above-mentioned detection signal can be set according to empirical values, authentication requirements for IoT devices, etc., for example, 200, etc., and no specific limitation is made.

[0218] Optionally, the above-mentioned basic channel characteristics can be expressed by the following formula:

[0219] F base = [CSI, RSSI, CFO, Phase response , Latency spread ]

[0220] In this embodiment, Basic features, It refers to Channel State Information. It refers to the Received Signal Strength Indicator. (Carrier Frequency Offset)

[0221] in, It is the most core feature of physical layer authentication. Due to the multipath effect of the channel, it has spatial uniqueness and reciprocity (the uplink and downlink have the same channel state for a short period of time). It can serve as a "fingerprint" to distinguish the physical location of different devices; It is a relatively coarse-grained physical layer feature (susceptible to environmental changes), simple to implement, and has low computational overhead. Other characteristics (such as) Used in conjunction with other methods, it serves as one of the reference dimensions for fast matching, and is used to initially filter out connection requests that are obviously abnormal. It is a physical layer characteristic determined by the hardware features of a device, and is unique to each device. Different devices will exhibit different characteristics due to physical differences in crystal oscillator precision. Features, will As a dimension for binding the identity of IoT devices, it increases the complexity of physical layer fingerprints and the difficulty of forgery.

[0222] The above embodiments are merely illustrative examples of the basic channel characteristics and are not intended to limit the scope of protection of this application. Any content and representation of basic channel characteristics that can characterize the communication channel between the encryption gateway and the security authentication platform are within the scope of protection of this application.

[0223] S903 generates registration and binding credentials for IoT devices based on registration random numbers, basic channel characteristics, and hardware response values, and stores the registration random numbers and registration and binding credentials accordingly.

[0224] After obtaining the aforementioned registration random number, basic channel characteristics, and hardware response value, the security authentication platform can generate a registration binding credential for the IoT device based on these factors, and store the registration random number and the registration binding credential accordingly, thus completing the registration of the IoT device on the security authentication platform. Furthermore, since the IoT device and the encryption gateway are associated, the security authentication platform can further store the registration random number, the registration binding credential, and the encryption gateway associated with the IoT device (such as storing the gateway identifier of the encryption gateway) to complete the registration of the encryption gateway on the security authentication platform.

[0225] In this way, when the security authentication platform wants to interact with a certain IoT device through signaling, it can determine the encryption gateway to be used (i.e., determine the encryption gateway associated with the IoT device), and when it receives information sent by any encryption gateway, it can determine which IoT device sent the information.

[0226] Optionally, the security authentication platform employs a quantum security commitment scheme, binding the registration random number, the hash value of the basic channel feature, and the hardware response value into a triplet to generate a Quantum Identity Binding (QIB) credential, which serves as the registration binding credential. Here, QIB refers to the binding of the device's physical identity information (hardware response value), quantum entropy source seed (registration random number), and channel feature template (basic channel feature) into a triplet using the quantum security commitment scheme during the physical device registration phase, forming an unforgeable device identity anchor. An example registration binding credential is shown below:

[0227]

[0228] In this embodiment, This indicates the registration and binding credentials. To register random numbers, The hash value of the basic channel characteristics, This is the hardware response value. This refers to generating a commitment value using quantum-resistant algorithms (such as quantum-resistant hashing, lattices, encoding, etc.).

[0229] In this embodiment, by binding a triplet of registered random number, basic channel characteristics, and hardware response value, the triplet binding of "quantum entropy source, channel characteristics, and physical fingerprint" of IoT devices is realized, forming an unforgeable IoT device identity anchor. This increases the dimension of quantum random entropy source and introduces quantum security commitment protection, which can improve the robustness, accuracy, and environmental adaptability of IoT device authentication, thereby improving the communication security of IoT devices.

[0230] Based on the above embodiments, in an exemplary embodiment, this application further provides a method for an encrypted gateway to obtain a second quantum entropy source token used for first authentication of IoT devices; optionally, such as Figure 10 As shown, the following steps may be included:

[0231] S1001 receives the authentication random number sent by the encryption gateway.

[0232] In this embodiment, the authentication random number is sent after the encryption gateway receives the first authentication request.

[0233] In this embodiment, when the IoT device sends a first authentication request to the encryption gateway, it can send an authentication random number to the encryption gateway through the first authentication request. The encryption gateway can then send this authentication random number to the security authentication platform. This authentication random number is a random number randomly generated by the quantum random number generator integrated into the IoT device when the IoT device initiates this authentication and sends the first authentication request to the encryption gateway. It is used for this IoT device authentication and differs from the registration random number, which is a random number generated during the IoT device's registration process on the security authentication platform. Optionally, the encryption gateway can send the authentication random number to the security authentication platform via a secure channel, such as an offline method.

[0234] S1002 generates a second quantum entropy source token based on the authentication random number and the registration random number.

[0235] S1003, send the second quantum entropy source token to the encryption gateway.

[0236] In this embodiment, the second quantum entropy source token is used by the encryption gateway to perform the first authentication of the IoT device.

[0237] As mentioned earlier, since the security authentication platform stores the registration random number of IoT devices, upon receiving the aforementioned authentication random number, the security authentication platform can generate a second quantum entropy source token based on the authentication random number and the registration random number. Then, after obtaining the second quantum entropy source token, the security authentication platform can send the second quantum entropy source token to the encryption gateway, enabling the encryption gateway to perform the first authentication of the IoT device based on the second quantum entropy source token.

[0238] In one optional embodiment, S1001 may include receiving an authentication random number and a first timestamp sent by the encryption gateway; wherein the first timestamp is the timestamp at which the IoT device generates the first quantum entropy source anchoring feature.

[0239] Accordingly, in this optional embodiment, S1002 may include generating a second quantum entropy source token based on the authentication random number and the registration random number when the time difference between the first timestamp and the second timestamp is less than a preset threshold; wherein, the second timestamp is the timestamp at which the security authentication platform receives the authentication random number and the first timestamp.

[0240] In this embodiment, to ensure that the security authentication platform can promptly feed back the second quantum entropy source token to the encryption gateway to avoid authentication delays for IoT devices, and to ensure the security of signaling interaction between the IoT device and the security authentication platform in the event of authentication delays, the encryption gateway can also send the first timestamp of the first quantum entropy source anchoring feature generated by the IoT device to the security authentication platform when sending the authentication random number; wherein, the first timestamp is sent by the IoT device to the encryption gateway through the first authentication request; then the security authentication platform can determine the timestamp of receiving the authentication random number and the first timestamp as the second timestamp, and further determine whether the time difference between the first timestamp and the second timestamp is less than a preset threshold.

[0241] Therefore, when the aforementioned time difference is less than a preset threshold, it can be determined that the IoT device is currently requesting authentication. Based on the authentication random number and the registration random number, a second quantum entropy source token is generated. Conversely, when the aforementioned time difference is greater than or equal to the preset threshold, it can be determined that the authentication request initiated by the IoT device has been delayed for a considerable period due to communication latency, etc. Therefore, it is unnecessary to continue authenticating the IoT device, and a second quantum entropy source token is generated. The aforementioned preset threshold can be set based on empirical values, channel latency of the communication channel, etc., and is not specifically limited in this regard.

[0242] Optionally, the second quantum entropy source token can be determined using the following formula:

[0243]

[0244] In this embodiment, For the second quantum entropy source token, To register random numbers, For session random numbers, This is the first timestamp.

[0245] In this embodiment, since the attacker cannot obtain the registration random number, they cannot generate the correct second quantum entropy source token and therefore cannot pass the first authentication of the encryption gateway. This solves the defect of the simple physical layer authentication method in related technologies being vulnerable to channel simulation attacks and improves the communication security of IoT devices.

[0246] Based on the above embodiments, in an exemplary embodiment, such as Figure 11 As shown, an authentication method for IoT devices is provided, which can be applied to... Figure 1 Taking the encryption gateway 102 as an example, the following steps may be included:

[0247] S1101, Receives the first authentication request sent by the associated IoT device.

[0248] The encrypted gateway is associated with the IoT device, and both the encrypted gateway and the IoT device are registered on the security authentication platform.

[0249] In this embodiment, before the security authentication platform performs a second authentication on the IoT device in response to the second authentication request sent by the encryption gateway, the encryption gateway first performs a first authentication on the IoT device. The encryption gateway can receive a first authentication request sent by the associated IoT device, which is used to request the encryption gateway to perform a first authentication on the IoT device.

[0250] S1102, Perform first authentication on IoT devices based on the first authentication request.

[0251] S1103 After successful authentication, a second authentication request for the IoT device is sent to the security authentication platform.

[0252] In this embodiment, the second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device, and a second channel feature collected by the encryption gateway. The first channel feature and the second channel feature are the characteristics of the communication channel between the IoT device and the encryption gateway. The second authentication request is used to instruct the security authentication platform to perform a second authentication on the IoT device based on the first quantum entropy source token, the first channel feature, and the second channel feature.

[0253] After receiving the first authentication request, the encryption gateway can perform a first authentication on the IoT device based on the first authentication request. After the authentication is successful, it sends a second authentication request for the IoT device to the security authentication platform. The second authentication request instructs the security authentication platform to perform a second authentication on the IoT device based on the first quantum entropy source token, the first channel feature, and the second channel feature included in the second authentication request.

[0254] The aforementioned authentication method for IoT devices involves registering an associated encrypted gateway and IoT device on a security authentication platform. First, the encrypted gateway responds to a first authentication request and performs a first authentication on the IoT device. After successful first authentication, it sends a second authentication request to the security authentication platform. This second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device from the communication channel between the IoT device and the encrypted gateway, and a second channel feature collected by the encrypted gateway from the same communication channel. Upon receiving the second authentication request, the security authentication platform can perform a second authentication on the IoT device based on the first channel feature, the second channel feature, and the first quantum entropy source token to determine the authentication result of the IoT device. In this way, on the one hand, by binding the physical layer channel characteristics with quantum random numbers through the first quantum entropy source token, the first channel characteristics, and the second channel characteristics, it is possible to effectively prevent channel simulation attacks and replay attacks compared to simple physical layer authentication methods, since attackers cannot simultaneously replicate the physical channel and the quantum random source. On the other hand, by coordinating the first and second authentications among the IoT device, the encryption gateway, and the security authentication platform, the authentication process of the IoT device is layered. An attack on any layer does not affect the overall security of the IoT device, thus avoiding the decrease in communication security of the IoT device caused by the disruption of a single layer of the authentication process and reducing the success rate of attacks. Based on this, this solution can improve the robustness, accuracy, and environmental adaptability of IoT device authentication, thereby improving the communication security of IoT devices.

[0255] Based on the above embodiments, in an exemplary embodiment, the first authentication of the IoT device in S1102 is further refined; optionally, the first authentication request includes a first quantum entropy source anchoring feature, an authentication random number, a first channel feature, and the device identifier of the IoT device, then as follows: Figure 12 As shown, the following steps may be included:

[0256] S1201, send an authentication random number to the security authentication platform.

[0257] Among them, the authentication random number is used by the security authentication platform to generate a second quantum entropy source token based on the authentication random number and the registration random number of the IoT device on the security authentication platform.

[0258] In this embodiment, when the IoT device sends a first authentication request to the encryption gateway, it can send an authentication random number to the encryption gateway through the first authentication request. Then, the encryption gateway can send the authentication random number to the security authentication platform, so that the security authentication platform can generate a second quantum entropy source token based on the authentication random number and the registration random number of the IoT device on the security authentication platform. Then, the encryption gateway can receive the second quantum entropy source token sent by the security authentication platform.

[0259] In one optional embodiment, the first authentication request further includes a first timestamp of the first quantum entropy source anchoring feature generated by the IoT device; then the above S1201 may include sending an authentication random number and the first timestamp to the security authentication platform; wherein, the first timestamp is used for the security authentication platform to generate a second quantum entropy source token when the time difference between the first timestamp and the second timestamp is less than a preset threshold; the second timestamp is the timestamp at which the security authentication platform receives the authentication random number and the first timestamp.

[0260] S1202, Acquire the second channel characteristics of the communication channel.

[0261] Upon receiving the first authentication request to confirm the need for first authentication of the IoT device, the encryption gateway can collect features of the communication channel between the IoT device and the encryption gateway to obtain second channel features. Optionally, the second channel features may include channel state information, received signal strength indication, carrier frequency offset, and phase response.

[0262] S1203, based on the second channel characteristics, device identifier, and the second quantum entropy source token sent by the security authentication platform, determine the second quantum entropy source anchoring characteristics.

[0263] Subsequently, after receiving the second quantum entropy source token sent by the security authentication platform and the collected second channel features, the encryption gateway can determine the second quantum entropy source anchoring features based on the second channel features, device identifier, and the second quantum entropy source token sent by the security authentication platform.

[0264] Optionally, the anchoring characteristics of the second quantum entropy source can be determined using the following formula:

[0265]

[0266] in, Anchoring characteristics for the second quantum entropy source For the second quantum entropy source token, This is the second channel feature. For IoT devices, it serves as the device identifier.

[0267] S1204, based on the first comparison result of the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature, and the second comparison result of the first channel feature and the second channel feature, the IoT device is first certified.

[0268] In this embodiment, the first quantum entropy source anchoring feature is generated by the IoT device based on the first channel feature, the first quantum entropy source token, and the device identifier of the IoT device, while the first quantum entropy source token is generated by the IoT device based on the authentication random number and the registration random number.

[0269] Based on this, the first and second quantum entropy source anchoring features are determined by the IoT device and the encryption gateway using the same algorithm, respectively. The first and second channel features are obtained by the IoT device and the encryption gateway respectively collecting features from the same communication channel (the communication channel between the IoT device and the encryption gateway). Assuming the IoT device is a secure device, the aforementioned first and second quantum entropy source anchoring features should be identical, and the aforementioned first and second channel features should be similar or even identical. Therefore, the encryption gateway can compare the aforementioned first and second quantum entropy source anchoring features to obtain a first comparison result, and then compare the aforementioned first and second channel features to obtain a second comparison result. For example, it can determine the similarity between the first and second channel features (e.g., using a lightweight Euclidean distance to calculate the similarity), using this as the second comparison result. Then, based on the aforementioned first and second comparison results, it can perform a first authentication of the IoT device.

[0270] In one optional embodiment, S1204 may include determining that the first authentication result of the IoT device is successful when the first comparison result indicates that the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature are the same, or when the second comparison result indicates that the similarity between the first channel feature and the second channel feature is greater than a similarity threshold.

[0271] In another optional embodiment, S1204 may include determining that the first authentication result of the Internet of Things device is successful when the first comparison result indicates that the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature are the same, and the second comparison result indicates that the similarity between the first channel feature and the second channel feature is greater than a similarity threshold.

[0272] The aforementioned similarity threshold can be set based on empirical values, the sensitivity of IoT devices and encryption gateways to the characteristics of communication channels, etc., and no specific limitations are imposed on it.

[0273] In this embodiment, since the attacker cannot obtain the registration random number, they cannot generate the correct second quantum entropy source token, and therefore cannot pass the quantum entropy source anchoring feature authentication, and thus cannot pass the first authentication of the encryption gateway. This solves the defect of the simple physical layer authentication method in related technologies being vulnerable to channel simulation attacks, and improves the communication security of IoT devices.

[0274] Based on the above embodiments, in an exemplary embodiment, the first authentication request further includes a first quantum entropy source anchoring feature, a device identifier, and a gateway identifier of the encryption gateway;

[0275] The second authentication request is also used to instruct the security authentication platform to use the first public key of the IoT device to generate a session key based on the first quantum entropy source anchoring feature, device identifier, gateway identifier, authentication confidence level, current timestamp, and session random number, and to negotiate the session key with the IoT device through an encrypted gateway.

[0276] Specifically, the authentication confidence level is determined based on the quantum entropy source verification result and the posterior confidence probability of the IoT device; the quantum entropy source verification result is determined based on the first quantum entropy source token and the random number registered by the IoT device on the security authentication platform; and the posterior confidence probability is determined based on the first channel feature, the second channel feature, and the prior confidence probability of the IoT device.

[0277] In one optional embodiment, the method may further include receiving service data sent by an IoT device and sending the service data to a security authentication platform; wherein the service data is transmitted using session key encryption. Optionally, the service data is transmitted using session key encryption after successful verification of the target key negotiation response message.

[0278] In this embodiment, an encryption gateway is used to negotiate session keys between the security authentication platform and the IoT device to determine the session key used for subsequent signaling interactions between the IoT device and the security authentication platform, thereby improving the communication security between the IoT device and the security authentication platform after IoT authentication is successful.

[0279] Based on the above embodiments, in an exemplary embodiment, such as Figure 13 As shown, an authentication method for IoT devices is provided, which can be applied to... Figure 1 Taking IoT device 101 as an example, the following steps may be included:

[0280] S1301, send the first authentication request to the associated encryption gateway.

[0281] The encryption gateway is associated with the IoT device, and both the encryption gateway and the IoT device are registered on the security authentication platform. The first authentication request is used to request the encryption gateway to perform a first authentication on the IoT device, and after the IoT device passes the authentication, it sends a second authentication request to the security authentication platform. The second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device, and a second channel feature collected by the encryption gateway. The first channel feature and the second channel feature are both features of the communication channel between the IoT device and the encryption gateway. The second authentication request is used to request the security authentication platform to perform a second authentication on the IoT device based on the first quantum entropy source token, the first channel feature, and the second channel feature.

[0282] In this embodiment, when an IoT device initiates authentication, it first sends a first authentication request to the associated encryption gateway to request the encryption gateway to perform a first authentication of the IoT device. After the first authentication is successful, it sends a second authentication request to the security authentication platform to instruct the security authentication platform to perform a second authentication of the IoT device based on the first quantum entropy source token, the first channel feature, and the second channel feature included in the second authentication request.

[0283] The aforementioned authentication method for IoT devices involves registering an associated encrypted gateway and IoT device on a security authentication platform. First, the encrypted gateway responds to a first authentication request and performs a first authentication on the IoT device. After successful first authentication, it sends a second authentication request to the security authentication platform. This second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device from the communication channel between the IoT device and the encrypted gateway, and a second channel feature collected by the encrypted gateway from the same communication channel. Upon receiving the second authentication request, the security authentication platform can perform a second authentication on the IoT device based on the first channel feature, the second channel feature, and the first quantum entropy source token to determine the authentication result of the IoT device. In this way, on the one hand, by binding the physical layer channel characteristics with quantum random numbers through the first quantum entropy source token, the first channel characteristics, and the second channel characteristics, it is possible to effectively prevent channel simulation attacks and replay attacks compared to simple physical layer authentication methods, since attackers cannot simultaneously replicate the physical channel and the quantum random source. On the other hand, by coordinating the first and second authentications among the IoT device, the encryption gateway, and the security authentication platform, the authentication process of the IoT device is layered. An attack on any layer does not affect the overall security of the IoT device, thus avoiding the decrease in communication security of the IoT device caused by the disruption of a single layer of the authentication process and reducing the success rate of attacks. Based on this, this solution can improve the robustness, accuracy, and environmental adaptability of IoT device authentication, thereby improving the communication security of IoT devices.

[0284] Based on the above embodiments, in an exemplary embodiment, the sending of the first authentication request in S1301 is further refined; optionally, as... Figure 14 As shown, the following steps may be included:

[0285] S1401, Generate authentication random number.

[0286] S1402, Collect the first channel characteristics of the communication channel.

[0287] In this embodiment, when the IoT device initiates this authentication by sending a first authentication request to the encryption gateway, it first uses the integrated quantum random number generator to randomly generate a random number for this IoT device authentication, which serves as the authentication random number. Furthermore, the IoT device can collect features of the communication channel between the IoT device and the encryption gateway to obtain first channel features. Optionally, the first channel features may include channel state information, received signal strength indication, carrier frequency offset, and phase response.

[0288] S1403 generates the first quantum entropy source token based on the authentication random number and the registration random number of the IoT device on the security authentication platform.

[0289] In this embodiment, since the IoT device can store the registration random number generated during the registration process of the IoT device on the security authentication platform, the IoT device can generate a first quantum entropy source token based on the aforementioned authentication random number and the registration random number it stores.

[0290] Optionally, the first quantum entropy source token can be determined using the following formula:

[0291]

[0292] In this embodiment, For the first quantum entropy source token, To register random numbers, For session random numbers, This is the first timestamp.

[0293] S1404, Based on the first channel characteristics, the first quantum entropy source token, and the device identifier of the IoT device, generate the first quantum entropy source anchoring characteristics.

[0294] Therefore, after generating the aforementioned first quantum entropy source token, the IoT device can determine the first quantum entropy source anchoring characteristics based on the first channel characteristics, device identifier, and first quantum entropy source token.

[0295] Optionally, the anchoring characteristics of the second quantum entropy source can be determined using the following formula:

[0296]

[0297] in, Anchoring characteristics for the first quantum entropy source, For the first quantum entropy source token, This is the second channel feature. For IoT devices, it serves as the device identifier.

[0298] S1405, generate a first authentication request including the first quantum entropy source anchoring feature, authentication random number, first channel feature and device identifier, and send the first authentication request to the encryption gateway.

[0299] Having obtained the aforementioned first quantum entropy source anchoring characteristics, the IoT device can generate a first authentication request based on the first quantum entropy source anchoring characteristics, the authentication random number, the first channel characteristics, and the device identifier, and send the first authentication request to the encrypted mesh. Optionally, the IoT device can encapsulate the first quantum entropy source anchoring characteristics, the authentication random number, the first channel characteristics, and the device identifier into a message to obtain the first authentication request.

[0300] In one optional embodiment, the first authentication request further includes a first timestamp corresponding to the generation of the first quantum entropy source anchoring feature; the first authentication request is also used to request the encryption gateway to send the first timestamp to the security authentication platform, so that the security authentication platform can generate a second quantum entropy source token when the time difference between the first timestamp and the second timestamp is less than a preset threshold; the second timestamp is the timestamp at which the security authentication platform receives the first timestamp, and the second quantum entropy source token is used for the encryption gateway to perform the first authentication of the IoT device.

[0301] In this embodiment, since the attacker cannot obtain the registration random number, they cannot generate the correct second quantum entropy source token, and therefore cannot pass the quantum entropy source anchoring feature authentication, and thus cannot pass the first authentication of the encryption gateway. This solves the defect of the simple physical layer authentication method in related technologies being vulnerable to channel simulation attacks, and improves the communication security of IoT devices.

[0302] Based on the above embodiments, in an exemplary embodiment, this application also provides an implementation method for session key negotiation between a security authentication platform and an IoT device; optionally, it may include negotiating the session key with the security authentication platform via an encryption gateway after the security authentication platform authenticates the IoT device; wherein, the session key is determined by the security authentication platform based on the IoT device's first public key, first quantum entropy source anchoring feature, IoT device identifier, encryption gateway identifier, authentication confidence level, current timestamp, and session random number; and, the current timestamp is the timestamp when the security authentication platform determines the session key.

[0303] In this embodiment, it can be ensured that the security authentication platform can promptly feed back the second quantum entropy source token to the encryption gateway to avoid authentication delays for IoT devices, and to ensure the security of signaling interaction between IoT devices and the security authentication platform in the event of authentication delays for IoT devices.

[0304] Based on the above embodiments, in an exemplary embodiment, this application also provides an implementation method for determining the session key via an encryption gateway and a security authentication platform; optionally, such as Figure 15 As shown, the following steps may be included:

[0305] S1501 receives the target key negotiation response message, current timestamp, session random number and authentication confidence level sent by the security authentication platform via the encryption gateway.

[0306] S1502 verifies the target key negotiation response message based on the second public key of the security authentication platform, the current timestamp, the session random number, and the authentication confidence level.

[0307] In an optional embodiment, the method further includes sending business data to the security authentication platform via an encryption gateway in response to the successful verification of the target key negotiation response message, wherein the business data is transmitted using session key encryption.

[0308] In another alternative embodiment, the method may further include receiving a second public key of the security authentication platform sent by the security authentication platform via an encryption gateway; and sending a first public key of the IoT device to the security authentication platform via the encryption gateway.

[0309] In this embodiment, an encryption gateway is used to negotiate session keys between the security authentication platform and the IoT device to determine the session key used for subsequent signaling interactions between the IoT device and the security authentication platform, thereby improving the communication security between the IoT device and the security authentication platform after IoT authentication is successful.

[0310] Based on the above embodiments, in an exemplary embodiment, the verification of the target key negotiation response message in S1502 is further refined; optionally, as... Figure 16 As shown, the following steps may be included:

[0311] S1601 verifies the signature of the target key negotiation response message based on the second public key of the security authentication platform.

[0312] In this embodiment, after obtaining the target key negotiation response message, since the target key negotiation response message is obtained by the security authentication platform using its own second private key to sign the initial key negotiation response message, the IoT device can use the second public key of the security authentication platform to verify the signature of the target key negotiation response message, so as to ensure that the target key negotiation response message is transmitted by the security authentication platform through the encryption gateway and has not changed during the transmission process.

[0313] S1602, in response to the successful verification of the target key negotiation response message, the shared secret value is determined based on the first private key of the IoT device and the encapsulated ciphertext in the target key negotiation response message.

[0314] Furthermore, since the initial key negotiation response message contains the session key and encapsulated ciphertext, the target key negotiation response message that has passed verification also includes the session key and encapsulated ciphertext. The encapsulated ciphertext is generated by the security authentication platform using the IoT device's first public key. Therefore, the IoT device can first parse the encapsulated ciphertext in the target key negotiation response message based on its first private key to obtain the shared secret value. Specifically, if the IoT device is a secure device, the shared secret value obtained by the IoT device should be the same as the shared secret value generated by the security authentication platform using the IoT device's first public key.

[0315] S1603, based on the first quantum entropy source anchoring feature, the current timestamp, and the session random number, generate the second binding credential.

[0316] Furthermore, IoT devices can bind the first quantum entropy source anchoring feature, the current timestamp, and the session random number to obtain a first binding credential. The method by which the IoT device generates the second binding credential is the same as the method by which the aforementioned security authentication platform generates the first binding credential.

[0317] S1604 uses a key derivation function, a shared secret value, a second binding credential, the device identifier of the IoT device, the gateway identifier of the encrypted gateway, authentication confidence, the current timestamp, and a session random number to generate a candidate key.

[0318] After obtaining the second binding credential, the IoT device can then use a key derivation function to derive a candidate key by mixing the shared secret value, the second binding credential, the IoT device's device identifier, the encrypted gateway's gateway identifier, the authentication confidence level, the current timestamp, and the session random number. The method by which the IoT device generates the candidate key is the same as the method used by the security authentication platform to generate the session key, and the key derivation function used in each is identical.

[0319] Optionally, candidate keys can be determined using the following formula:

[0320]

[0321] In this embodiment, Candidate keys, To share secret values, This is the second binding credential. For device identification of IoT devices. The gateway identifier for the gateway device. This is the current timestamp. For authentication confidence level.

[0322] S1605, compare the candidate key and the session key to obtain the verification result of the target key negotiation response message.

[0323] Furthermore, if the session key negotiation between the security authentication platform and the IoT device is successful, the aforementioned candidate key should be the same as the session key. Thus, in the subsequent signaling interaction between the security authentication platform and the IoT device, the security authentication platform and the IoT device can use the same key to encrypt the signaling to be transmitted to each other.

[0324] Based on this, IoT devices can verify the target key negotiation response message by comparing the candidate key with the aforementioned response message and obtaining the session key from the target key negotiation response message. The verification result of the target key negotiation response message can then be determined based on the comparison results.

[0325] In this embodiment, when the candidate key is the same as the session key, the verification result of the target key negotiation response message is determined to be successful; correspondingly, when the candidate key is different from the session key, the verification result of the target key negotiation response message is determined to be unsuccessful.

[0326] In this embodiment, an encryption gateway is used to negotiate session keys between the security authentication platform and the IoT device to determine the session key used for subsequent signaling interactions between the IoT device and the security authentication platform, thereby improving the communication security between the IoT device and the security authentication platform after IoT authentication is successful.

[0327] Based on the above embodiments, in an exemplary embodiment, this application also provides a registration method for an IoT device and an encryption gateway on a security authentication platform; optionally, it may include: extracting the hardware response value of the IoT device; generating a registration random number; receiving, via the encryption gateway, multiple rounds of probe signals sent by the security authentication platform in response to the registration request; wherein, the multiple rounds of probe signals are used to indicate the collection of basic channel characteristics of the communication channel between the encryption gateway and the security authentication platform; sending the hardware response value and the registration random number to the security authentication platform via the encryption gateway; wherein, the hardware response value, the registration random number, and the basic channel characteristics are used by the security authentication platform to generate a registration binding credential for the IoT device, and correspondingly storing the registration random number and the registration binding credential.

[0328] In this embodiment, by binding a triplet of registered random number, basic channel characteristics, and hardware response value, the triplet binding of "quantum entropy source, channel characteristics, and physical fingerprint" of IoT devices is realized, forming an unforgeable IoT device identity anchor. This increases the dimension of quantum random entropy source and introduces quantum security commitment protection, which can improve the robustness, accuracy, and environmental adaptability of IoT device authentication, thereby improving the communication security of IoT devices.

[0329] The following describes the signaling interaction between IoT devices, encryption gateways, and security authentication platforms, such as... Figures 17-20 The following example illustrates the IoT device registration process, the first authentication process, the second authentication process, and the session key negotiation process in the IoT device authentication method provided in this application.

[0330] For example, such as Figure 17 As shown, the registration process for IoT devices may include the following steps:

[0331] S1701, IoT devices extract hardware response values ​​from IoT devices and generate registration random numbers.

[0332] S1702, the IoT device sends a hardware response value and a registration random number to the encryption gateway.

[0333] S1703, the encryption gateway sends a hardware response value and a registration random number to the security authentication platform.

[0334] S1704, the security authentication platform sends multiple rounds of probe signals to the encryption gateway to collect the basic channel characteristics of the communication channel between the encryption gateway and the security authentication platform.

[0335] S1705, the encrypted gateway sends multiple rounds of probe signals to IoT devices.

[0336] S1706, the security authentication platform generates registration and binding credentials for IoT devices based on registration random numbers, basic channel characteristics, and hardware response values, and stores the registration random numbers and registration and binding credentials accordingly.

[0337] The specific implementation methods of S1701-S1706 are the same as those in the above method embodiments, and will not be repeated here.

[0338] For example, such as Figure 18 As shown, the first authentication process of an encrypted gateway for IoT devices may include the following steps:

[0339] S1801, the IoT device generates an authentication random number, and based on the authentication random number and the registration random number, generates the first quantum entropy source token.

[0340] S1802, the IoT device collects the first channel characteristics of the communication channel, and generates the first quantum entropy source anchoring characteristics based on the first channel characteristics, the first quantum entropy source token and the device identifier of the IoT device.

[0341] S1803, the IoT device generates a first authentication request including a first quantum entropy source anchoring feature, an authentication random number, a first channel feature, and a device identifier.

[0342] S1804, the IoT device sends the first authentication request to the encryption gateway.

[0343] S1805, the encrypted gateway sends an authentication random number to the security authentication platform.

[0344] S1806, the security authentication platform generates a second quantum entropy source token based on authentication random numbers and registration random numbers.

[0345] S1807, the security authentication platform sends a second quantum entropy source token to the encryption gateway.

[0346] S1808, the encryption gateway collects the second channel characteristics of the communication channel, and determines the second quantum entropy source anchoring characteristics based on the second channel characteristics, the device identifier, and the second quantum entropy source token.

[0347] S1809, the encryption gateway performs first authentication on the IoT device based on the first comparison result of the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature, and the second comparison result of the first channel feature and the second channel feature.

[0348] The specific implementation methods of S1801-S1809 are the same as those in the above method embodiments, and will not be repeated here.

[0349] For example, such as Figure 19As shown, the second authentication process for IoT devices by the security authentication platform may include the following steps:

[0350] S1901: After the first authentication is successful, the encryption gateway sends a second authentication request for the IoT device to the security authentication platform.

[0351] The second authentication request includes a first quantum entropy source token, a first channel feature, and a second channel feature.

[0352] S1902, the security authentication platform performs feature fusion processing on the first channel features and the second channel features to obtain the current fused features, and determines the likelihood estimate of the IoT device based on the current fused features and the historical fused features of the IoT device.

[0353] S1903, the security authentication platform determines the posterior confidence probability of the IoT device based on the likelihood estimate and the prior confidence probability, and performs matching verification between the first quantum entropy source token and the registered random number to obtain the quantum entropy source verification result.

[0354] S1904, the security authentication platform determines the first weight of the posterior confidence probability and the second weight of the quantum entropy source verification result, and performs weighted processing on the posterior confidence probability and the quantum entropy source verification result based on the first weight and the second weight to obtain the authentication confidence of the IoT device.

[0355] S1905, the security authentication platform determines the authentication result of IoT devices based on authentication confidence level.

[0356] The specific implementation methods of S1901-S1905 are the same as those in the above method embodiments, and will not be repeated here.

[0357] For example, such as Figure 20 As shown, the session key negotiation process between IoT devices and a security authentication platform may include the following steps:

[0358] S2001, the IoT device sends its first public key to the encryption gateway.

[0359] S2002, the encrypted gateway sends the first public key of the IoT device to the security authentication platform.

[0360] S2003, the security authentication platform sends the second public key of the security authentication platform to the encrypted grid.

[0361] S2004, the encrypted gateway sends the second public key of the security authentication platform to the IoT device.

[0362] S2005: After the second authentication is passed, the security authentication platform uses the first public key of the IoT device to generate a shared secret value and encapsulated ciphertext, and generates the first binding credential based on the first quantum entropy source anchoring feature, the current timestamp, and the session random number.

[0363] The second authentication request also includes the first quantum entropy source anchoring feature, the device identifier of the IoT device, and the gateway identifier of the encryption gateway.

[0364] S2006, the security authentication platform uses a key derivation function to generate a session key based on a shared secret value, the first binding credential, the device identifier, the gateway identifier, the authentication confidence level, the current timestamp, and the session random number.

[0365] S2007, the security authentication platform generates an initial key negotiation response message containing the session key and encapsulated ciphertext, and uses the second private key of the security authentication platform to sign the initial key negotiation response message to obtain the target key negotiation response message.

[0366] S2008, the security authentication platform sends the current timestamp, session random number, authentication confidence level, and target key negotiation response message to the encryption gateway.

[0367] S2009, the encryption gateway sends the current timestamp, session random number, authentication confidence level and target key negotiation response message to the IoT device.

[0368] S2010, the IoT device verifies the signature of the target key negotiation response message based on the second public key of the security authentication platform, and in response to the successful verification of the target key negotiation response message, determines the shared secret value based on the first private key of the IoT device and the encapsulated ciphertext in the target key negotiation response message.

[0369] S2011, the IoT device generates a second binding credential based on the first quantum entropy source anchoring feature, the current timestamp, and the session random number, and generates a candidate key using the key derivation function, the shared secret value, the second binding credential, the IoT device's device identifier, the encryption gateway's gateway identifier, the authentication confidence level, the current timestamp, and the session random number.

[0370] S2012, the IoT device compares the candidate key and the session key to obtain the verification result of the target key negotiation response message.

[0371] S2013, the IoT device responds to the successful verification of the target key negotiation response message and sends business data to the encryption gateway.

[0372] The business data is transmitted using session key encryption.

[0373] S2014, the encrypted gateway sends business data to the security authentication platform.

[0374] The specific implementation methods of S2001-S2014 are the same as those in the above method embodiments, and will not be repeated here.

[0375] This application overcomes the shortcomings of existing physical layer authentication schemes, such as reliance on static prediction models, separation of quantum layer and cryptographic layer, and lack of probability accumulation in authentication decisions. By constructing a hierarchical cascaded authentication architecture based on quantum entropy source anchoring and posterior probability updates, it deeply integrates quantum random sources, physical layer channel characteristics, and PQC cryptographic protocols to achieve IoT device authentication with quantum security, environmental adaptability, and high robustness.

[0376] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0377] Based on the same inventive concept, this application also provides an authentication apparatus for an IoT device to implement the authentication method for the IoT device described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more IoT device authentication apparatus embodiments provided below can be found in the limitations of the IoT device authentication method described above, and will not be repeated here.

[0378] In one exemplary embodiment, such as Figure 21 As shown, an authentication device for IoT devices is provided, applied to a security authentication platform, comprising: a second receiving module 2110 and a second authentication module 2120, wherein:

[0379] The second receiving module 2110 is used to receive a second authentication request sent by the encryption gateway. The IoT device and the encryption gateway are associated and the encryption gateway and the IoT device are registered on the security authentication platform. The second authentication request is sent by the encryption gateway to the security authentication platform after the encryption gateway has successfully authenticated the IoT device in response to the first authentication request. The first authentication request is used to request the encryption gateway to perform a first authentication on the IoT device.

[0380] The second authentication module 2120 is used to perform a second authentication on the Internet of Things (IoT) device based on the first channel characteristics, the second channel characteristics, and the first quantum entropy source token, so as to determine the authentication result of the IoT device.

[0381] The second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device, and a second channel feature collected by the encryption gateway. The first and second channel features are characteristics of the communication channel between the IoT device and the encryption gateway.

[0382] In one exemplary embodiment, the second authentication module 2120 includes:

[0383] The probability determination unit is used to determine the posterior confidence probability of the Internet of Things (IoT) device based on the first channel features, the second channel features, and the prior confidence probability of the IoT device.

[0384] The matching and verification module is used to match and verify the first quantum entropy source token with the registration random number of the IoT device on the security authentication platform to obtain the quantum entropy source verification result.

[0385] The second authentication unit is used to determine the authentication result of the IoT device based on the posterior confidence probability and the quantum entropy source verification result.

[0386] In an exemplary embodiment, the probability determination unit is specifically used to: perform feature fusion processing on the first channel features and the second channel features to obtain the current fused features; determine the likelihood estimate of the IoT device based on the current fused features and the historical fused features of the IoT device; wherein, the historical fused features are the fused features determined by the security authentication platform when the IoT device passed authentication in the historical authentication process; and determine the posterior confidence probability of the IoT device based on the likelihood estimate and the prior confidence probability.

[0387] In an exemplary embodiment, the second authentication unit is specifically used to: determine a first weight for the posterior confidence probability and a second weight for the quantum entropy source verification result; perform weighted processing on the posterior confidence probability and the quantum entropy source verification result based on the first weight and the second weight to obtain the authentication confidence of the IoT device; and determine the authentication result of the IoT device based on the authentication confidence.

[0388] In one exemplary embodiment, the second authentication request further includes a first quantum entropy source anchoring feature, a device identifier of the IoT device, and a gateway identifier of the encryption gateway; the device also includes:

[0389] The first session key generation module is used to generate a session key using the first public key of the IoT device, based on the first quantum entropy source anchoring feature, device identifier, gateway identifier, authentication confidence level, current timestamp, and session random number;

[0390] The first negotiation module is used to negotiate session keys with IoT devices through an encrypted gateway.

[0391] In an exemplary embodiment, the first negotiation module is specifically configured to: generate an initial key negotiation response message containing a session key and encapsulated ciphertext; wherein the encapsulated ciphertext is generated using a first public key; sign the initial key negotiation response message using a second private key of the security authentication platform to obtain a target key negotiation response message; and send the target key negotiation response message, a current timestamp, a session random number, and an authentication confidence level to the IoT device through an encryption gateway; wherein the current timestamp, session random number, and authentication confidence level are used by the IoT device to verify the target key negotiation response message in conjunction with the second public key of the security authentication platform.

[0392] In one exemplary embodiment, the second receiving module is further configured to receive business data sent by the IoT device through the encrypted gateway;

[0393] The business data is sent after the target key negotiation response message is successfully verified, and the business data is transmitted using session key encryption.

[0394] In one exemplary embodiment, the device further includes:

[0395] The third sending module is used to send the second public key to IoT devices through the encryption gateway;

[0396] The second receiving module is also used to receive the first public key sent by the IoT device through the encryption gateway.

[0397] In an exemplary embodiment, the session key generation module is specifically used to: generate a shared secret value and encapsulated ciphertext using the first public key of the IoT device; generate a first binding credential based on the first quantum entropy source anchoring feature, the current timestamp, and the session random number; and generate a session key using a key derivation function based on the shared secret value, the first binding credential, the device identifier, the gateway identifier, the authentication confidence level, the current timestamp, and the session random number.

[0398] In one exemplary embodiment, the device further includes:

[0399] The acquisition module is used to acquire the hardware response value of the IoT device and the registration random number generated by the IoT device;

[0400] The detection module is used to send multiple rounds of detection signals to IoT devices through the encryption gateway in order to collect the basic channel characteristics of the communication channel between the encryption gateway and the security authentication platform.

[0401] The registration module is used to generate registration and binding credentials for IoT devices based on registration random numbers, basic channel characteristics, and hardware response values, and to store the registration random numbers and registration and binding credentials accordingly.

[0402] In one exemplary embodiment, the device further includes:

[0403] The second token generation module is used to generate a second quantum entropy source token based on the authentication random number and the registration random number;

[0404] The second receiving module is also used to receive the authentication random number sent by the encryption gateway; wherein the authentication random number is sent after the encryption gateway receives the first authentication request;

[0405] The third sending module is also used to send a second quantum entropy source token to the encryption gateway; wherein the second quantum entropy source token is used by the encryption gateway to perform the first authentication of the IoT device.

[0406] In an exemplary embodiment, the second receiving module is specifically configured to: receive an authentication random number and a first timestamp sent by the encryption gateway; wherein, the first timestamp is the timestamp at which the IoT device generates the first quantum entropy source anchoring feature;

[0407] The third sending module is specifically used to: generate a second quantum entropy source token based on the authentication random number and the registration random number when the time difference between the first timestamp and the second timestamp is less than a preset threshold; wherein, the second timestamp is the timestamp at which the security authentication platform receives the authentication random number and the first timestamp.

[0408] In one exemplary embodiment, such as Figure 22 As shown, an authentication device for an Internet of Things (IoT) device is provided, applied to an encrypted gateway, comprising: a first receiving module 2210, a first authentication module 2220, and a first sending module 2230, wherein:

[0409] The first receiving module 2210 is used to receive a first authentication request sent by an associated IoT device, wherein the encryption gateway is associated with the IoT device and the encryption gateway and the IoT device have been registered on the security authentication platform.

[0410] The first authentication module 2220 is used to perform first authentication on the IoT device based on the first authentication request;

[0411] The first sending module 2230 is used to send a second authentication request of the IoT device to the security authentication platform after the authentication is passed.

[0412] The second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device, and a second channel feature collected by the encryption gateway. The first channel feature and the second channel feature are the characteristics of the communication channel between the IoT device and the encryption gateway. The second authentication request is used to instruct the security authentication platform to perform a second authentication on the IoT device based on the first quantum entropy source token, the first channel feature, and the second channel feature.

[0413] In one exemplary embodiment, the first authentication module 2220 includes:

[0414] The sending unit is used to send an authentication random number to the security authentication platform; wherein, the authentication random number is used by the security authentication platform to generate a second quantum entropy source token based on the authentication random number and the registration random number of the IoT device on the security authentication platform;

[0415] The second acquisition unit is used to acquire the second channel characteristics of the communication channel;

[0416] The second feature determination unit is used to determine the second quantum entropy source anchoring feature based on the second channel feature, the device identifier and the second quantum entropy source token sent by the security authentication platform.

[0417] The first authentication unit is used to perform first authentication on IoT devices based on a first comparison result of the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature, and a second comparison result of the first channel feature and the second channel feature.

[0418] In an exemplary embodiment, the first authentication unit is specifically configured to perform any of the following: if the first comparison result indicates that the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature are the same, or if the second comparison result indicates that the similarity between the first channel feature and the second channel feature is greater than a similarity threshold, the first authentication result of the IoT device is determined to be successful; if the first comparison result indicates that the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature are the same, and the second comparison result indicates that the similarity between the first channel feature and the second channel feature is greater than a similarity threshold, the first authentication result of the IoT device is determined to be successful.

[0419] In an exemplary embodiment, the first authentication request further includes a first timestamp generated by the IoT device to anchor the first quantum entropy source; the sending unit is specifically used to: send an authentication random number and the first timestamp to the security authentication platform; wherein, the first timestamp is used for the security authentication platform to generate a second quantum entropy source token when the time difference between the first timestamp and the second timestamp is less than a preset threshold; the second timestamp is the timestamp at which the security authentication platform receives the authentication random number and the first timestamp.

[0420] In an exemplary embodiment, the first authentication request further includes a first quantum entropy source anchoring feature, a device identifier, and a gateway identifier of the encryption gateway; the second authentication request is further used to instruct the security authentication platform to use the first public key of the IoT device to generate a session key based on the first quantum entropy source anchoring feature, the device identifier, the gateway identifier, the authentication confidence level, the current timestamp, and the session random number, and to negotiate the session key with the IoT device through the encryption gateway.

[0421] In an exemplary embodiment, the first receiving module is further configured to receive business data sent by an IoT device and send the business data to a security authentication platform; wherein the business data is transmitted using session key encryption.

[0422] In one exemplary embodiment, such as Figure 23 As shown, an authentication device for an Internet of Things (IoT) device is provided, which is applied to IoT devices and includes: a second transmitting module 2310, wherein:

[0423] The second sending module 2310 is used to send a first authentication request to the associated encryption gateway; wherein the encryption gateway is associated with the IoT device and the encryption gateway and the IoT device are registered on the security authentication platform; the first authentication request is used to request the encryption gateway to perform a first authentication of the IoT device, and after the IoT device is successfully authenticated, to send a second authentication request to the security authentication platform; and the second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device and a second channel feature collected by the encryption gateway, wherein the first channel feature and the second channel feature are both features of the communication channel between the IoT device and the encryption gateway, and the second authentication request is used to request the security authentication platform to perform a second authentication of the IoT device based on the first quantum entropy source token, the first channel feature and the second channel feature.

[0424] In an exemplary embodiment, the second sending module 2310 is specifically configured to: generate an authentication random number; collect a first channel feature of the communication channel; generate a first quantum entropy source token based on the authentication random number and the registration random number of the IoT device on the security authentication platform; generate a first quantum entropy source anchoring feature based on the first channel feature, the first quantum entropy source token, and the device identifier of the IoT device; generate a first authentication request including the first quantum entropy source anchoring feature, the authentication random number, the first channel feature, and the device identifier, and send the first authentication request to the encryption gateway.

[0425] In an exemplary embodiment, the first authentication request further includes a first timestamp corresponding to the generation of the first quantum entropy source anchoring feature; the first authentication request is also used to request the encryption gateway to send the first timestamp to the security authentication platform, so that the security authentication platform can generate a second quantum entropy source token when the time difference between the first timestamp and the second timestamp is less than a preset threshold; the second timestamp is the timestamp at which the security authentication platform receives the first timestamp, and the second quantum entropy source token is used for the encryption gateway to perform the first authentication of the IoT device.

[0426] In one exemplary embodiment, the device further includes:

[0427] The second session key generation module negotiates the session key with the security authentication platform via the encryption gateway after the security authentication platform authenticates the IoT device. The session key is determined by the security authentication platform based on the IoT device's first public key, the first quantum entropy source anchoring feature, the IoT device's device identifier, the encryption gateway's gateway identifier, the authentication confidence level, the current timestamp, and the session random number. The current timestamp is the timestamp when the security authentication platform determines the session key.

[0428] In an exemplary embodiment, the second session key generation module is specifically used to: receive a target key negotiation response message, a current timestamp, a session random number, and an authentication confidence level sent by the security authentication platform via the encryption gateway; and verify the target key negotiation response message based on the second public key of the security authentication platform, the current timestamp, the session random number, and the authentication confidence level.

[0429] In one exemplary embodiment, the device further includes:

[0430] The fourth sending module is used to send business data to the security authentication platform via the encryption gateway in response to the successful verification of the target key negotiation response message. The business data is transmitted using session key encryption.

[0431] In an exemplary embodiment, the second session key generation module is specifically used for: verifying the signature of the target key negotiation response message based on the second public key of the security authentication platform; in response to the successful verification of the target key negotiation response message, determining the shared secret value based on the first private key of the IoT device and the encapsulated ciphertext in the target key negotiation response message; generating a second binding credential based on the first quantum entropy source anchoring feature, the current timestamp, and the session random number; generating a candidate key using the key derivation function, the shared secret value, the second binding credential, the device identifier of the IoT device, the gateway identifier of the encryption gateway, the authentication confidence level, the current timestamp, and the session random number; and comparing the candidate key with the session key to obtain the verification result of the target key negotiation response message.

[0432] In one exemplary embodiment, the device further includes:

[0433] The extraction module is used to extract hardware response values ​​from IoT devices;

[0434] The generation module is used to generate random numbers for registration.

[0435] The third receiving module is used to receive multi-round probe signals sent by the security authentication platform in response to the registration request via the encryption gateway; wherein the multi-round probe signals are used to indicate the collection of basic channel characteristics of the communication channel between the encryption gateway and the security authentication platform;

[0436] The fourth sending module is also used to send a hardware response value and a registration random number to the security authentication platform via an encryption gateway; wherein the hardware response value, the registration random number, and the basic channel characteristics are used by the security authentication platform to generate registration and binding credentials for IoT devices, and the registration random number and registration and binding credentials are stored accordingly.

[0437] In an exemplary embodiment, the third receiving module is further configured to receive the second public key of the security authentication platform sent by the security authentication platform via the encryption gateway;

[0438] The fourth sending module is also used to send the first public key of the IoT device to the security authentication platform via the encryption gateway.

[0439] The various modules in the authentication device of the aforementioned IoT device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0440] In one exemplary embodiment, a security authentication platform is provided. This security authentication platform may be a server, and its internal structure diagram may be as follows: Figure 24As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs in the non-volatile storage media to run. The database stores data such as registration random numbers for IoT devices. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements an authentication method for IoT devices.

[0441] In one exemplary embodiment, an Internet of Things (IoT) device is provided, wherein the computer device may be a terminal, and its internal structure diagram may be as follows: Figure 25 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements an authentication method for Internet of Things (IoT) devices. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0442] Those skilled in the art will understand that Figure 24 and Figure 25The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0443] In one exemplary embodiment, a security authentication platform is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the authentication method for various IoT devices on the security authentication platform side.

[0444] In one exemplary embodiment, an encryption gateway is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the authentication method for various IoT devices on the encryption gateway side.

[0445] In one exemplary embodiment, an Internet of Things (IoT) device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the authentication method for each IoT device on the IoT device side.

[0446] In one embodiment, a computer-readable storage medium is provided, on which a computer program or instructions are stored, which, when executed by a processor, implement the authentication methods for various IoT devices on the security authentication platform side, encryption gateway side, or IoT device side.

[0447] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the authentication methods for various IoT devices on the security authentication platform side, encryption gateway side, or IoT device side.

[0448] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0449] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0450] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0451] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An authentication method for Internet of Things (IoT) devices, characterized in that, Applied to a security authentication platform, the method includes: The system receives a second authentication request from an encryption gateway, wherein the IoT device is associated with the encryption gateway and the encryption gateway and the IoT device are registered on the security authentication platform. The second authentication request is sent by the encryption gateway to the security authentication platform after the IoT device has been successfully authenticated by the first authentication request. The first authentication request is used to request the encryption gateway to perform a first authentication on the IoT device. A second authentication is performed on the IoT device based on the first channel feature, the second channel feature, and the first quantum entropy source token to determine the authentication result of the IoT device. The second authentication request includes the first quantum entropy source token, the first channel feature collected by the IoT device, and the second channel feature collected by the encryption gateway. The first channel feature and the second channel feature are the characteristics of the communication channel between the IoT device and the encryption gateway.

2. The method according to claim 1, characterized in that, The second authentication of the IoT device based on the first channel characteristics, the second channel characteristics, and the first quantum entropy source token, to determine the authentication result of the IoT device, includes: Based on the first channel features, the second channel features, and the prior confidence probability of the IoT device, the posterior confidence probability of the IoT device is determined; and... The first quantum entropy source token is matched and verified with the registration random number of the IoT device on the security authentication platform to obtain the quantum entropy source verification result; The authentication result of the IoT device is determined based on the posterior confidence probability and the quantum entropy source verification result.

3. The method according to claim 2, characterized in that, The step of determining the posterior confidence probability of the IoT device based on the first channel features, the second channel features, and the prior confidence probability of the IoT device includes: The first channel features and the second channel features are fused together to obtain the current fused features. Based on the current fusion characteristics and the historical fusion characteristics of the IoT device, a likelihood estimate of the IoT device is determined; wherein, the historical fusion characteristics are the fusion characteristics determined by the security authentication platform when the IoT device passed authentication in its historical authentication process; The posterior confidence probability of the IoT device is determined based on the likelihood estimate and the prior confidence probability.

4. The method according to claim 2, characterized in that, The process of determining the authentication result of the IoT device based on the posterior confidence probability and the quantum entropy source verification result includes: Determine the first weight of the posterior confidence probability and the second weight of the quantum entropy source verification result; Based on the first weight and the second weight, the posterior confidence probability and the quantum entropy source verification result are weighted to obtain the authentication confidence of the IoT device. The authentication result of the IoT device is determined based on the authentication confidence level.

5. The method according to claim 4, characterized in that, The second authentication request also includes a first quantum entropy source anchoring feature, the device identifier of the IoT device, and the gateway identifier of the encryption gateway; the method further includes: Using the first public key of the IoT device, a session key is generated based on the first quantum entropy source anchoring feature, the device identifier, the gateway identifier, the authentication confidence level, the current timestamp, and the session random number; The session key is negotiated with the IoT device through the encryption gateway.

6. The method according to claim 5, characterized in that, The process of negotiating the session key with the IoT device through the encryption gateway includes: Generate an initial key negotiation response message containing the session key and the encapsulated ciphertext; wherein the encapsulated ciphertext is generated using the first public key; The initial key negotiation response message is signed using the second private key of the security authentication platform to obtain the target key negotiation response message; The encryption gateway sends the target key negotiation response message, the current timestamp, the session random number, and the authentication confidence level to the IoT device. The current timestamp, the session random number, and the authentication confidence level are used by the IoT device to verify the target key negotiation response message in conjunction with the second public key of the security authentication platform.

7. The method according to claim 6, characterized in that, The method further includes: Receive service data sent by the IoT device through the encryption gateway; The service data is sent after the target key negotiation response message is successfully verified, and the service data is transmitted using the session key for encryption.

8. The method according to claim 6, characterized in that, The method further includes: The second public key is sent to the IoT device through the encryption gateway; and, Receive the first public key sent by the IoT device through the encryption gateway.

9. The method according to claim 5, characterized in that, The step of generating a session key using the first public key of the IoT device, based on the first quantum entropy source anchoring feature, the device identifier, the gateway identifier, the authentication confidence level, the current timestamp, and the session random number, includes: Using the first public key of the IoT device, a shared secret value and encapsulated ciphertext are generated; Based on the first quantum entropy source anchoring feature, the current timestamp, and the session random number, a first binding credential is generated; A session key is generated using a key derivation function based on the shared secret value, the first binding credential, the device identifier, the gateway identifier, the authentication confidence level, the current timestamp, and the session random number.

10. The method according to any one of claims 1-9, characterized in that, The method further includes: Obtain the hardware response value of the IoT device and the registration random number generated by the IoT device; and, The encryption gateway sends multiple rounds of probe signals to the IoT device to collect the basic channel characteristics of the communication channel between the encryption gateway and the security authentication platform. Based on the registration random number, the basic channel characteristics, and the hardware response value, a registration binding credential for the IoT device is generated, and the registration random number and the registration binding credential are stored accordingly.

11. The method according to any one of claims 1-9, characterized in that, The method further includes: Receive the authentication random number sent by the encryption gateway; wherein the authentication random number is sent by the encryption gateway after receiving the first authentication request; Based on the authentication random number and the registration random number, a second quantum entropy source token is generated; The second quantum entropy source token is sent to the encryption gateway; wherein the second quantum entropy source token is used by the encryption gateway to perform a first authentication of the IoT device.

12. The method according to claim 11, characterized in that, The receipt of the authentication random number sent by the encryption gateway includes: The device receives an authentication random number and a first timestamp sent by the encryption gateway; wherein the first timestamp is the timestamp at which the IoT device generates the first quantum entropy source anchoring feature; The process of generating a second quantum entropy source token based on the authentication random number and the registration random number includes: When the time difference between the first timestamp and the second timestamp is less than a preset threshold, a second quantum entropy source token is generated based on the authentication random number and the registration random number; wherein, the second timestamp is the timestamp at which the security authentication platform receives the authentication random number and the first timestamp.

13. An authentication method for Internet of Things (IoT) devices, characterized in that, Applied to an encrypted gateway, the method includes: Receive a first authentication request sent by an associated IoT device; wherein the encryption gateway is associated with the IoT device and the encryption gateway and the IoT device are registered on the security authentication platform; The IoT device is first authenticated based on the first authentication request; After successful authentication, a second authentication request for the IoT device is sent to the security authentication platform; The second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device, and a second channel feature collected by the encryption gateway. The first channel feature and the second channel feature are characteristics of the communication channel between the IoT device and the encryption gateway. The second authentication request is used to instruct the security authentication platform to perform a second authentication on the IoT device based on the first quantum entropy source token, the first channel feature, and the second channel feature.

14. The method according to claim 13, characterized in that, The first authentication request includes a first quantum entropy source anchoring feature, an authentication random number, the first channel feature, and the device identifier of the IoT device; the first authentication of the IoT device based on the first authentication request includes: Send the authentication random number to the security authentication platform; and, The second channel characteristics of the communication channel are collected; wherein, the authentication random number is used by the security authentication platform to generate a second quantum entropy source token based on the authentication random number and the registration random number of the IoT device on the security authentication platform; Based on the second channel feature, the device identifier, and the second quantum entropy source token sent by the security authentication platform, the second quantum entropy source anchoring feature is determined; Based on the first comparison result of the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature, and the second comparison result of the first channel feature and the second channel feature, the IoT device is first authenticated.

15. The method according to claim 14, characterized in that, The second authentication of the IoT device based on the first comparison result of the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature, and the second comparison result of the first channel feature and the second channel feature, includes any one of the following: If the first comparison result indicates that the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature are the same, or if the second comparison result indicates that the similarity between the first channel feature and the second channel feature is greater than the similarity threshold, the first authentication result of the IoT device is determined to be authentication passed. If the first comparison result indicates that the first quantum entropy source anchoring feature and the second quantum entropy source anchoring feature are the same, and the second comparison result indicates that the similarity between the first channel feature and the second channel feature is greater than the similarity threshold, then the first authentication result of the IoT device is determined to be authentication passed.

16. The method according to claim 14 or 15, characterized in that, The first authentication request also includes a first timestamp generated by the IoT device for the first quantum entropy source anchoring feature; Sending the authentication random number to the security authentication platform includes: Send the authentication random number and the first timestamp to the security authentication platform; The first timestamp is used by the security authentication platform to generate the second quantum entropy source token when the time difference between the first timestamp and the second timestamp is less than a preset threshold. The second timestamp is the timestamp at which the security authentication platform receives the authentication random number and the first timestamp.

17. The method according to claim 14 or 15, characterized in that, The first authentication request also includes the first quantum entropy source anchoring feature, the device identifier, and the gateway identifier of the encryption gateway; The second authentication request is also used to instruct the security authentication platform to use the first public key of the IoT device to generate a session key based on the first quantum entropy source anchoring feature, the device identifier, the gateway identifier, the authentication confidence level, the current timestamp, and the session random number, and to negotiate the session key with the IoT device through the encryption gateway.

18. The method according to claim 17, characterized in that, The method further includes: Receive business data sent by the IoT device, and send the business data to the security authentication platform; The business data is transmitted using the session key for encryption.

19. An authentication method for Internet of Things (IoT) devices, characterized in that, Applied to Internet of Things (IoT) devices, the method includes: Send the first authentication request to the associated encryption gateway; The encryption gateway is associated with the IoT device, and both the encryption gateway and the IoT device are registered on the security authentication platform. The first authentication request is used to request the encryption gateway to perform a first authentication of the IoT device, and after the IoT device passes authentication, to send a second authentication request to the security authentication platform; and, The second authentication request includes a first quantum entropy source token, a first channel feature collected by the IoT device, and a second channel feature collected by the encryption gateway. The first channel feature and the second channel feature are both features of the communication channel between the IoT device and the encryption gateway. The second authentication request is used to request the security authentication platform to perform a second authentication on the IoT device based on the first quantum entropy source token, the first channel feature, and the second channel feature.

20. The method according to claim 19, characterized in that, Sending the first authentication request to the associated encryption gateway includes: Generate authentication random numbers; Collect the first channel characteristics of the communication channel; A first quantum entropy source token is generated based on the authentication random number and the registration random number of the IoT device on the security authentication platform; Based on the first channel feature, the first quantum entropy source token, and the device identifier of the IoT device, a first quantum entropy source anchoring feature is generated. A first authentication request is generated, including the first quantum entropy source anchoring feature, the authentication random number, the first channel feature, and the device identifier, and then sent to the encryption gateway.

21. The method according to claim 20, characterized in that, The first authentication request also includes a first timestamp corresponding to the generation of the first quantum entropy source anchoring feature; The first authentication request is further used to request the encryption gateway to send the first timestamp to the security authentication platform, so that the security authentication platform can generate a second quantum entropy source token when the time difference between the first timestamp and the second timestamp is less than a preset threshold. The second timestamp is the timestamp at which the security authentication platform receives the first timestamp, and the second quantum entropy source token is used by the encryption gateway to perform the first authentication on the IoT device.

22. The method according to claim 19, characterized in that, The method further includes: After the IoT device is authenticated by the security authentication platform, the session key is negotiated between the encryption gateway and the security authentication platform. The session key is determined by the security authentication platform based on the first public key of the IoT device, the first quantum entropy source anchoring feature, the device identifier of the IoT device, the gateway identifier of the encryption gateway, the authentication confidence level, the current timestamp, and the session random number; and, The current timestamp is the timestamp at which the security authentication platform determines the session key.

23. The method according to claim 22, characterized in that, The negotiation of the session key between the encryption gateway and the security authentication platform includes: Receive the target key negotiation response message, the current timestamp, the session random number, and the authentication confidence level sent by the security authentication platform via the encryption gateway; The target key negotiation response message is verified based on the second public key of the security authentication platform, the current timestamp, the session random number, and the authentication confidence level.

24. The method according to claim 23, characterized in that, The method further includes: In response to the successful verification of the target key negotiation response message, business data is sent to the security authentication platform via the encryption gateway, wherein the business data is transmitted using the session key for encryption.

25. The method according to claim 23, characterized in that, The verification of the target key negotiation response message based on the second public key of the security authentication platform, the current timestamp, the session random number, and the authentication confidence level includes: Based on the second public key of the security authentication platform, the signature of the target key negotiation response message is verified. In response to the successful verification of the target key negotiation response message, a shared secret value is determined based on the first private key of the IoT device and the encapsulated ciphertext in the target key negotiation response message; Based on the first quantum entropy source anchoring feature, the current timestamp, and the session random number, a second binding credential is generated; A candidate key is generated using the key derivation function, the shared secret value, the second binding credential, the device identifier of the IoT device, the gateway identifier of the encryption gateway, the authentication confidence level, the current timestamp, and the session random number. By comparing the candidate key and the session key, the verification result of the target key negotiation response message is obtained.

26. The method according to any one of claims 19-25, characterized in that, The method further includes: Extract the hardware response value of the IoT device; Generate a random number for registration; The encryption gateway receives multiple rounds of probe signals sent by the security authentication platform in response to the registration request; wherein the multiple rounds of probe signals are used to indicate the collection of basic channel characteristics of the communication channel between the encryption gateway and the security authentication platform. The hardware response value and the registration random number are sent to the security authentication platform via the encryption gateway; wherein the hardware response value, the registration random number, and the basic channel characteristics are used by the security authentication platform to generate the registration binding credential of the IoT device, and the registration random number and the registration binding credential are stored accordingly.

27. The method according to any one of claims 19-25, characterized in that, The method further includes: The system receives the second public key of the security authentication platform sent by the security authentication platform via the encryption gateway; and... The first public key of the IoT device is sent to the security authentication platform via the encryption gateway.

28. A security authentication platform, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 12.

29. An encryption gateway, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 13 to 18.

30. An Internet of Things (IoT) device, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 19 to 27.

31. A computer-readable storage medium storing computer-executable instructions thereon, characterized in that, When the computer-executable instructions are executed by a processor, the method of any one of claims 1 to 27 is implemented.

32. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the method of any one of claims 1 to 27.

Images