CN115242440A - Block chain-based Internet of things equipment trusted calling method, device and equipment - Google Patents

Abstract

The embodiment of the specification provides a block chain-based method, a block chain-based device and a device for trustable calling of Internet of things equipment. The method comprises the following steps: receiving a device calling request sent by a user terminal; the equipment calling request comprises a request encrypted by a terminal private key corresponding to the user terminal; sending a terminal public key acquisition request to the block link point equipment; the terminal public key acquisition request is used for acquiring a terminal public key uploaded to the blockchain node device by the user terminal; receiving a terminal public key fed back by the block chain node equipment; and if the terminal public key is used for decrypting the equipment calling request, authorization information is fed back to the user terminal so that the client on the user terminal calls the Internet of things equipment. The method verifies the identity of the user terminal, and ensures the calling safety.

Description

A method, device and device for trusted invocation of IoT devices based on blockchain

This application is a divisional application for an invention patent application with an application number of 202010684456.X, an application date of July 16, 2020, and an invention title of "a method, device and device for secure invocation of IoT devices based on blockchain" .

technical field

The embodiments of this specification relate to the technical field of network security, and in particular, to a method, device, and device for trusted invocation of IoT devices based on blockchain.

Background technique

With the development of Internet of Things technology, more and more devices can be connected to the Internet, and devices can be controlled remotely while obtaining device data conveniently. For example, for a smart camera connected to the network, the user can directly use the client in the corresponding terminal device to obtain video data captured by the camera, and issue remote instructions to adjust the shooting angle and magnification of the smart camera.

IoT devices can use the sensing module in the device to obtain data, which makes IoT devices have high security requirements. Criminals can obtain control rights of IoT devices indirectly through the client by tampering with the client code or implanting malicious plug-ins in the client. Since IoT devices generally use their own stored firmware to execute corresponding instructions, it is also easy to be deceived by criminals by directly setting a fixed verification program in the firmware. Therefore, at present, when a user controls an IoT device through a corresponding client, it is difficult for the IoT device to verify the security of the client.

SUMMARY OF THE INVENTION

The purpose of the embodiments of this specification is to provide a method, apparatus and device for trusted invocation of IoT devices based on blockchain, so as to solve the problem of how to ensure the security of the process of invoking IoT devices.

In order to solve the above technical problems, the embodiments of this specification also propose a blockchain-based trusted invocation method for IoT devices, including: receiving a device invocation request sent by a user terminal; the device invocation request includes using the user terminal to correspond to request encrypted by the private key of the terminal; send a terminal public key acquisition request to the blockchain node device; the terminal public key acquisition request is used to acquire the terminal public key uploaded by the user terminal to the blockchain node device ; Receive the terminal public key fed back by the blockchain node device; if the terminal public key is used to decrypt the device call request, the authorization information is fed back to the user terminal, so that the client can call the Internet of Things equipment.

In some embodiments, after receiving the terminal public key fed back by the blockchain node device, the method further includes: if the device invocation request cannot be decrypted by using the terminal public key, identifying the terminal identifier corresponding to the user terminal It is sent to the blockchain node device as the high-risk device identifier, so that the user terminal associated with the blockchain node device can obtain the high-risk device identifier.

In some embodiments, before sending the terminal public key acquisition request to the blockchain node device, the method further includes: sending a terminal query request to the blockchain node device; the terminal query request is used to acquire the security of the user terminal The evaluation result; correspondingly, the sending the terminal public key acquisition request to the blockchain node device includes: if the security evaluation result fed back by the blockchain node device is a security device, sending the terminal public key to the blockchain node device Get request.

The embodiment of this specification also proposes a blockchain-based IoT device trusted invocation device, including: a request receiving module, configured to receive a device invocation request sent by a user terminal; the device invocation request includes using the user terminal to correspond to The request encrypted by the private key of the terminal; the request sending module is used to send the terminal public key acquisition request to the blockchain node device; the terminal public key acquisition request is used to acquire the user terminal and upload it to the blockchain node The terminal public key in the device; the public key receiving module is used to receive the terminal public key fed back by the blockchain node device; the information feedback module is used to use the terminal public key to decrypt the device call request At the time, the authorization information is fed back to the user terminal, so that the client can call the Internet of Things device.

The embodiments of this specification also provide an IoT device, including a memory and a processor; the memory is used to store computer program instructions; the processor is used to execute the computer program instructions to implement the following steps: receiving a user terminal The device invocation request sent; the device invocation request includes a request encrypted with the terminal private key corresponding to the user terminal; a terminal public key acquisition request is sent to the blockchain node device; the terminal public key acquisition request is used to acquire Upload the user terminal to the terminal public key in the blockchain node device; receive the terminal public key fed back by the blockchain node device; if the terminal public key is used to decrypt the device call request, The authorization information is fed back to the user terminal, so that the client can call the Internet of Things device.

The embodiments of this specification also propose a blockchain-based trusted invocation method for IoT devices, including: encrypting a device invocation request with a terminal private key; the device invocation request includes a request generated by a client; Send an encrypted device call request, so that the IoT device sends a terminal public key acquisition request to the blockchain node device after receiving the device call request, and receives the terminal public key fed back by the blockchain node device. The terminal public key includes the terminal public key uploaded by the user terminal to the blockchain node device; the authorization information fed back by the IoT device is received, so that the client can call the IoT device; the authorization The information includes information generated by the IoT device after decrypting the encrypted device call request by using the terminal public key.

In some embodiments, before sending the encrypted device invocation request to the IoT device, the method further includes: sending an IoT device query request to the blockchain node device; the IoT device query request is used to obtain all The security evaluation result of the Internet of Things device; correspondingly, the sending an encrypted device call request to the Internet of Things device includes: if the security evaluation result fed back by the blockchain node device is a security device, sending an encrypted device call request to the Internet of Things device. Encrypted device call request.

In some embodiments, the authorization information includes information encrypted by the IoT device using the device private key; after receiving the authorization information fed back by the IoT device, the authorization further includes: sending the device public key to the blockchain node device Acquisition request; the device public key acquisition request is used to acquire the device public key uploaded by the IoT device to the blockchain node device; receive the device public key fed back by the blockchain node device; The device public key is used to decrypt the authorization information, and the client is used to call the IoT device.

The embodiments of this specification also propose a blockchain-based trusted invocation device for IoT devices, including: an encryption module for encrypting a device invocation request using a terminal private key; the device invocation request includes a request generated by a client The request sending module is used to send an encrypted device invocation request to the Internet of Things device, so that the Internet of Things device sends a terminal public key acquisition request to the blockchain node device after receiving the device invocation request, and receives The terminal public key fed back by the blockchain node device; the terminal public key includes the terminal public key uploaded by the user terminal to the blockchain node device; the information receiving module is used to receive authorization information fed back by the IoT device , so that the client can invoke the IoT device; the authorization information includes information generated by the IoT device after decrypting the encrypted device invocation request by using the terminal public key.

The embodiments of this specification also provide a user terminal, including a memory and a processor; the memory is used to store computer program instructions; the processor is used to execute the computer program instructions to realize the following steps: using the terminal private key Encrypt the device invocation request; the device invocation request includes a request generated by the client; send the encrypted device invocation request to the Internet of Things device, so that the Internet of Things device receives the device invocation request to the block The chain node device sends a terminal public key acquisition request, and receives the terminal public key fed back by the blockchain node device; the terminal public key includes the terminal public key uploaded by the user terminal to the blockchain node device; the receiver The authorization information fed back by the networked device, so that the client can call the Internet of Things device; the authorization information includes the authorization information generated by the Internet of Things device after decrypting the encrypted device call request by using the terminal public key information.

It can be seen from the technical solutions provided by the above embodiments of this specification that the embodiments of this specification use the terminal public key stored in the blockchain network to decrypt the encrypted device call request, and grant the user terminal to call the IoT device when the decryption is successful. Based on the digital signature technology, the identity verification of the user terminal is realized, which avoids the right to call the device when the user terminal is hijacked, and ensures the security of the calling process.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present specification or the prior art, the following briefly introduces the accompanying drawings required in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments described in this specification. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

FIG. 1 is a frame diagram of an IoT device calling system according to an embodiment of this specification;

FIG. 2 is a flowchart of a blockchain-based IoT device security invocation method according to an embodiment of this specification;

3 is a flowchart of a blockchain-based IoT device security calling method according to an embodiment of this specification;

4 is a flowchart of a blockchain-based IoT device security calling method according to an embodiment of this specification;

5 is a flowchart of a blockchain-based trusted calling method for IoT devices according to an embodiment of this specification;

6 is a flowchart of a blockchain-based trusted calling method for IoT devices according to an embodiment of this specification;

7 is a flowchart of a blockchain-based trusted calling method for IoT devices according to an embodiment of this specification;

FIG. 8 is a block diagram of a block chain-based IoT device security invocation device according to an embodiment of this specification;

FIG. 9 is a block diagram of a block chain-based IoT device security invocation device according to an embodiment of this specification;

10 is a block diagram of a blockchain-based trusted invocation device for IoT devices according to an embodiment of this specification;

11 is a block diagram of a blockchain-based trusted invocation device for IoT devices according to an embodiment of this specification;

FIG. 12 is a structural diagram of an Internet of Things device according to an embodiment of this specification;

FIG. 13 is a structural diagram of a user terminal according to an embodiment of the present specification.

Detailed ways

The technical solutions in the embodiments of the present specification will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present specification. Obviously, the described embodiments are only a part of the embodiments of the present specification, rather than all the embodiments. Based on the embodiments in this specification, all other embodiments obtained by persons of ordinary skill in the art without creative efforts shall fall within the protection scope of this specification.

In order to better understand the inventive concept of the present application, an IoT device calling system in the embodiments of this specification is first introduced. As shown in FIG. 1 , the IoT device calling system 100 includes an IoT device 110 , a user terminal 120 and a blockchain node device 130 .

The Internet of Things is a kind of network that connects various networks through sensing devices according to the agreed protocol, exchanges and communicates information, and realizes intelligent identification, positioning, tracking, monitoring and management. From the perspective of logical structure, the Internet of Things can be roughly composed of three layers: the perception layer, the network layer and the application layer. The perception layer at the bottom is mainly realized through the sensor network. It collects and controls the object information with the help of RFID and sensors. The sensor network aggregates information from a set of sensors and transmits it to the core network. The network layer is mainly composed of the existing basic network, which is responsible for the interconnection of things. There are many basic networks available for the Internet of Things. According to the needs of the application, it can be a public communication network, an industry-specific network, or even a newly built communication network dedicated to the Internet of Things. The high-level application layer is mainly responsible for information processing, decision support and business application services.

The IoT device 110 is a device connected to the IoT. Through the Internet of Things, a user can remotely acquire the sensing data in the Internet of Things device or the data of the Internet of Things device itself through a terminal device. Under the condition that the IoT device has certain maneuverability, the IoT device can also be controlled to a certain extent by sending an instruction to the IoT device. For example, when the IoT device is a smart camera, the smart camera can collect video data based on its own camera components, and store the video data in its own storage module or transmit it to a cloud server, so that users can The APP or web page acquires the video data. The IoT device is not limited to the above examples, for example, it may also be a smart home robot, etc., which will not be described in detail.

The user terminal 120 is the device used by the user. The user terminal may be, for example, a smart phone, a PC, a smart wearable device, a server, and the like. The user terminal 120 can implement communication with the IoT device, so as to implement sending and receiving of related instructions. The user terminal is provided with a client, and the client may be a small program, an APP, a software program, a web client, or the like that calls the IoT device 110 . In the embodiments of this specification, in order to ensure the security of the IoT device, the security of the client needs to be verified.

Blockchain is a distributed ledger that organizes multiple data blocks in a chain structure in chronological order, and uses cryptographic algorithms to ensure security, traceability, and non-tampering. The blockchain node device 130 can be used to construct a blockchain network. The blockchains may include public blockchains, federated blockchains (also known as consortium blockchains), private blockchains, and the like. The distributed ledger is jointly maintained by multiple blockchain node devices 130 in the blockchain network. The blockchain network is formed by a plurality of blockchain node devices through a consensus mechanism. The blockchain network may include, for example, a P2P network (peer-to-peer network) and the like. The consensus mechanism may be based on Proof of Work (POW), Proof of Stake (POS), Delegated Proof of Stake (DPOS), or Practical Byzantine Fault Tolerance (PBFT) Algorithms are implemented. Specifically, multiple service parties can set up multiple blockchain node devices. The plurality of blockchain node devices may establish a blockchain network based on blockchain technology. For example, multiple companies that provide third-party payment services can set up multiple blockchain node devices. The plurality of blockchain node devices may establish the blockchain network based on the blockchain technology.

In the embodiment of this specification, the IoT device 110 and the user terminal 120 may store information used for verification, such as device identification, or a key for encrypting and decrypting information, in the blockchain node device. Since the information stored in the blockchain has the property that it cannot be tampered with, the correctness of the verification information stored in the blockchain node device is ensured, so that the verification information can be used to realize the verification of the device identity.

Based on the above-mentioned IoT device invocation system, the embodiments of this specification propose a blockchain-based IoT device security invocation method, where the execution subject of the IoT device invocation method is the Internet of Things device invocation system. As shown in FIG. 2 , the blockchain-based method for invoking IoT devices safely includes the following steps.

S210: The user terminal sends the device invocation request to the IoT device.

A device invocation request is a request to obtain permission to invoke an IoT device. The device invocation request may be a request generated by a first client on the user terminal. The first client may be a client on the user terminal corresponding to an Internet of Things device. Since the user terminal may be hijacked by criminals, thereby tampering with the program of the first client, and thus endangering the IoT device, the first client needs to be authenticated.

In some embodiments, the device invocation request includes a first client identifier of the first client. The first client identifier is used to identify identity information or environmental characteristics of the first client.

In a specific example, the first client identifier includes a digest obtained by encrypting the program and/or plug-in of the first client. Specifically, the executable program, files and legal plug-ins in the app may be encrypted by using SHA256 in the Hash algorithm to obtain the digest.

In another specific example, the first client identifier may be the IP address of the user terminal. The first client identifier is not limited to the above examples, and other examples of the first client identifier proposed by those skilled in the art based on the technical solutions of the present application are all within the protection scope of the present application.

In the process of practical application, physical network devices may also be at risk of being hijacked by criminals based on their own vulnerabilities. Therefore, in some embodiments, in order to ensure the security of IoT devices, before sending a device call request, you can First determine whether the IoT device is safe.

In this embodiment, there is a security evaluation result for the IoT device. The security evaluation result is the result obtained after evaluating the security of the IoT device. The specific evaluation process can be implemented by those skilled in the art according to the requirements of practical applications, and details are not repeated here. The safety evaluation result may include, for example, safety equipment and high-risk equipment. A secure device indicates that the IoT device does not have a vulnerability that has a greater impact on data security or device control authority, and can send a device call request to the IoT device; a high-risk device indicates that the IoT device has an impact on security. Higher vulnerability, there may be higher risk of interaction with the IoT device. There may also be other ways for the classification of the safety evaluation result, and those skilled in the art can make corresponding adjustments according to the actual situation, which will not be repeated here.

Therefore, in this embodiment, before sending the device call request to the IoT device, the user terminal may also send the IoT device query request to the blockchain node device to obtain the security evaluation of the IoT device When the safety evaluation result is a safety device, the device invocation request is sent to the Internet of Things device; when the safety evaluation result is a high-risk device, the device invocation request is no longer sent to the Internet of Things device. To meet the needs of invoking IoT devices, you can send device invocation requests to other relatively secure IoT devices.

S220: The IoT device sends a second client identifier acquisition request to the blockchain node device.

After receiving the device invocation request, the IoT device may send a second client identification acquisition request to the blockchain node device. The second client identifier acquisition request is used to acquire the second client identifier. The second client identifier is stored in the blockchain node device.

The second client identification is an identification corresponding to the second client. The second client is a client that has the authority to call the IoT device. For example, the second client may be a client developed and tested by a developer. At this time, the client is not likely to be tampered with by criminals, and can also implement corresponding functions, and has correspondingly high security. Can be used as a second client.

The type of the second client identification corresponds to the type of the first client identification. For example, when the first client identifier is an IP address, the acquired second client identifier is the IP address with the highest frequency among the historical login IP addresses of the user terminal, that is, the IP address is the user's normal The IP address used may log in in a more dangerous environment if it does not conform to the IP address; when the first client is identified as a summary of the program of the first client, the obtained second client is identified as A summary of the program for the second client. The specific corresponding type can be adjusted based on the actual application, which is not repeated here.

S230: The blockchain node device feeds back the second client identifier to the IoT device.

When the blockchain node device receives the second client identification acquisition request, it can obtain the second client identification by querying the data stored in the blockchain network, and feed back the second client identification to the IoT devices.

S240: The IoT device determines whether the first client identifier matches the second client identifier.

After receiving the second client identifier, the IoT device determines whether the first client identifier matches the second client identifier. The matching process may be, for example, judging whether the first client identification and the second client identification are the same, or whether the first client identification and the second client identification are in a preset comparison part. same. The specific comparison process may be determined based on the types of the first client identifier and the second client identifier, and details are not described herein again.

S250: If there is a match, the IoT device sends authorization information to the user terminal.

If it matches, it means that the first client has not been tampered with, or the application environment of the first client is relatively secure, and the first client is less likely to send malicious instructions when calling the IoT device, and can grant the Describe the authority of the first client to call the IoT device. Therefore, authorization information can be sent to the user terminal, and the authorization information allows the first client to call the IoT device.

In some other implementations, the first client identifier may not match the second client identifier, indicating that the first client may be tampered with by criminals, or the user terminal is in an insecure application environment , if the first client is granted the permission to call the IoT device, there may be a high risk. Therefore, warning information can be fed back to the user terminal, and the warning information is used to remind the user that the first client terminal lacks security.

If the first client identifier does not match the second client identifier, the IoT device may also send the first client identifier as a high-risk client identifier to the blockchain node device, so as to associate The user terminal in the blockchain network receives the high-risk client identifier, and can then check and test itself.

The above method realizes the verification of the first client by comparing the first client identifier with the second client identifier stored in the blockchain network, and avoids the first client being tampered with or the user terminal being tampered with. The impact on the first client in a dangerous application environment ensures the security of device calls.

According to the blockchain-based IoT device security invocation method corresponding to FIG. 2 , an embodiment of this specification further proposes a blockchain-based IoT device security invocation method. The execution subject of the blockchain-based IoT device security invocation method is the IoT device. As shown in FIG. 3 , the blockchain-based IoT device security invocation method includes the following specific steps.

S310: Receive a device invocation request sent by a user terminal; the device invocation request includes a request generated by a first client on the user terminal; the device invocation request includes a first client identifier of the first client .

For the introduction of this step, reference may be made to the description in step S210, which is not repeated here.

S320: Send a second client identifier acquisition request to the blockchain node device; the blockchain node device stores the second client identifier.

For the introduction of this step, reference may be made to the description in step S220, which will not be repeated here.

S330: Receive a second client identifier fed back by the blockchain node device; the second client identifier includes a client identifier corresponding to the second client; the second client has the authority to call the IoT device.

For the introduction of this step, reference may be made to the description in step S230, which will not be repeated here.

S340: If the first client identifier matches the second client identifier, feedback authorization information to the user terminal, so that the first client can call the IoT device.

For the introduction of this step, reference may be made to the description in steps S240 and S250, which will not be repeated here.

According to the blockchain-based IoT device security invocation method corresponding to FIG. 2 , an embodiment of this specification further proposes a blockchain-based IoT device security invocation method. The execution subject of the blockchain-based IoT device security invocation method is the user terminal. As shown in FIG. 4 , the blockchain-based IoT device security invocation method includes the following specific steps.

S410: Obtain a device invocation request generated by a first client; the device invocation request includes a first client identifier of the first client.

For the introduction of this step, reference may be made to the description in step S210, which is not repeated here.

S420: Send the device invocation request to the Internet of Things device, so that the Internet of Things device sends a second client identifier acquisition request to the blockchain node device, and receives the second client identifier returned by the blockchain node device. A client identifier; the second client identifier includes a client identifier corresponding to the second client; the second client has the authority to call the IoT device.

For the introduction of this step, reference may be made to the descriptions in steps S210 , S220 , S230 and S240 , which will not be repeated here.

S430: Receive authorization information fed back by the Internet of Things device, so that the first client can call the Internet of Things device; the authorization information includes the identity of the Internet of Things device in the first client and the identity of the second client match the generated information.

For the introduction of this step, reference may be made to the description in step S250, which will not be repeated here.

Based on the above IoT device invocation system, the embodiments of this specification also propose a blockchain-based IoT device trusted invocation method, where the execution subject of the IoT device trusted invocation method is the IoT device invocation system. As shown in FIG. 5 , the blockchain-based method for trusted invocation of IoT devices includes the following steps.

S510: The user terminal generates a device invocation request.

A device invocation request is a request to obtain permission to invoke an IoT device. The device invocation request may be a request generated by a client on the user terminal.

In some embodiments, the device invocation request may be a request obtained by encrypting the terminal private key saved by the user terminal. The terminal private key corresponds to the terminal public key. The terminal private key is stored on the user terminal, and the terminal public key is stored in the blockchain network. When the terminal private key has not been tampered with, the information encrypted by the terminal private key can be decrypted using the terminal public key, so that whether the device has been tampered can be determined according to whether the terminal public key can be used for decryption.

In the process of practical application, physical network devices may also be at risk of being hijacked by criminals based on their own vulnerabilities. Therefore, in some embodiments, in order to ensure the security of IoT devices, before sending a device call request, you can First determine whether the IoT device is safe.

In this embodiment, there is a security evaluation result for the IoT device. The security evaluation result is the result obtained after evaluating the security of the IoT device. The specific evaluation process can be implemented by those skilled in the art according to the requirements of practical applications, and details are not repeated here. The safety evaluation result may include, for example, safety equipment and high-risk equipment. A secure device indicates that the IoT device does not have a vulnerability that has a greater impact on data security or device control authority, and can send a device call request to the IoT device; a high-risk device indicates that the IoT device has an impact on security. Higher vulnerability, there may be higher risk of interaction with the IoT device. There may also be other ways for the classification of the safety evaluation result, and those skilled in the art can make corresponding adjustments according to the actual situation, which will not be repeated here.

Therefore, in this embodiment, before sending the device call request to the IoT device, the user terminal may also send the IoT device query request to the blockchain node device to obtain the security evaluation of the IoT device When the safety evaluation result is a safety device, the device invocation request is sent to the Internet of Things device; when the safety evaluation result is a high-risk device, the device invocation request is no longer sent to the Internet of Things device. To meet the needs of invoking IoT devices, you can send device invocation requests to other relatively secure IoT devices.

S520: The user terminal sends the device invocation request to the IoT device.

After generating the device invocation request, the user terminal may send the device invocation request to the Internet of Things device.

S530: The IoT device sends a terminal public key acquisition request to the blockchain node device.

After receiving the device call request, the IoT device can send a terminal public key acquisition request to the blockchain node device. The terminal public key acquisition request is used to acquire the terminal public key. The terminal public key is stored in the blockchain node device. The information encrypted by the corresponding terminal private key can be decrypted by using the terminal public key, so as to realize the judgment of the user identity.

In some embodiments, before obtaining the terminal public key, the IoT device may send a terminal query request to the blockchain node device to obtain the security evaluation result of the user terminal. If the security evaluation result fed back by the blockchain node device is a security device, send a terminal public key acquisition request to the blockchain node device. If the security evaluation result fed back by the blockchain node device is not a security device, it indicates that the user terminal may be at risk, and the device call request can be directly rejected.

S540: The blockchain node device feeds back the terminal public key to the IoT device.

After receiving the terminal public key acquisition request, the blockchain node device can obtain the terminal public key by querying the data stored in the blockchain network, and feed back the terminal public key to the IoT device.

S550: The IoT device determines whether the terminal public key can be used to decrypt the device call request.

After obtaining the terminal public key, the Internet of Things device can try to decrypt the device call request by using the terminal public key. Since the terminal public key is stored in the blockchain network and cannot be tampered with, the terminal public key can be used to decrypt the device call request to verify the Describe the identity of the user terminal.

S560: If it can be realized, the IoT device feeds back authorization information to the user terminal.

If it can be realized, it means that the terminal private key used by the client is the correct private key, the client is the client corresponding to the IoT device and has not been replaced by criminals, and the client is calling the IoT device. When the possibility of sending malicious instructions is low, the client can be granted the authority to call the IoT device. Therefore, authorization information can be sent to the user terminal, and the authorization information allows the client to call the IoT device.

In other embodiments, if the device invocation request cannot be decrypted using the terminal public key, it indicates that the client may be tampered with by criminals, or the user terminal is in an insecure application environment. Permissions for IoT devices can be risky. Therefore, warning information can be fed back to the user terminal, and the warning information is used to remind the user that the client terminal lacks security.

If the device invocation request cannot be decrypted by using the terminal public key, the IoT device may also send the terminal identifier corresponding to the user terminal as a high-risk device identifier to the blockchain node device, so that the device associated with the zone The user terminal of the blockchain network receives the high-risk device identifier, thereby avoiding communication with the user terminal and improving security.

In some embodiments, the authorization information may be information encrypted by the Internet of Things device on the private key, and after receiving the authorization information, the user terminal may send a request for obtaining the device public key to the blockchain node device, to obtain the device public key uploaded by the IoT device to the blockchain node device, and after receiving the device public key fed back by the blockchain node device, use the device public key to decrypt the authorization information , if the device public key realizes the decryption of the authorization information, it indicates that the IoT device is a secure device, and the client can be used to call the IoT device. If the authorization information cannot be decrypted, it indicates that the IoT device may be tampered with or replaced, and there may be a high risk in continuing to call the IoT device, and other IoT devices can be obtained for calling.

Through the above method, after receiving the device invocation request, the encrypted device invocation request is decrypted using the terminal public key stored in the blockchain network, and when the decryption is successful, the user terminal is granted the authority to invoke the Internet of Things device. The digital signature technology realizes the verification of the identity of the user terminal, avoids the right to call the device when the user terminal is hijacked, and ensures the security of the calling process.

Based on the blockchain-based IoT device trusted invocation method corresponding to FIG. 5 , an embodiment of the present specification further proposes a blockchain-based IoT device trusted invocation method. The execution subject of the blockchain-based IoT device trusted invocation method is the IoT device. As shown in FIG. 6 , the blockchain-based IoT device trusted invocation method includes the following specific steps.

S610: Receive a device invocation request sent by a user terminal; the device invocation request includes a request encrypted by using a terminal private key corresponding to the user terminal.

For the introduction of this step, reference may be made to the description in steps S510 and S520, and details are not repeated here.

S620: Send a terminal public key acquisition request to the blockchain node device; the terminal public key acquisition request is used to acquire the terminal public key uploaded by the user terminal to the blockchain node device.

For the introduction of this step, reference may be made to the description in step S530, which is not repeated here.

S630: Receive the terminal public key fed back by the blockchain node device.

For the introduction of this step, reference may be made to the description in step S540, which will not be repeated here.

S640: If the terminal public key is used to decrypt the device invocation request, feedback authorization information to the user terminal, so that the client can invoke the Internet of Things device.

For the introduction of this step, reference may be made to the description in steps S550 and S560, and details are not repeated here.

Based on the blockchain-based IoT device trusted invocation method corresponding to FIG. 5 , an embodiment of the present specification further proposes a blockchain-based IoT device trusted invocation method. The execution subject of the blockchain-based IoT device trusted invocation method is the user terminal. As shown in FIG. 7 , the blockchain-based IoT device trusted invocation method includes the following specific steps.

S710: Use the terminal private key to encrypt the device invocation request; the device invocation request includes a request generated by the client.

For the introduction of this step, reference may be made to the description in step S510, which will not be repeated here.

S720: Send an encrypted device invocation request to the Internet of Things device, so that the Internet of Things device sends a terminal public key acquisition request to the blockchain node device after receiving the device invocation request, and receives the blockchain The terminal public key fed back by the node device; the terminal public key includes the terminal public key uploaded by the user terminal to the blockchain node device.

For the introduction of this step, reference may be made to the description in step S520, which is not repeated here.

S730: Receive authorization information fed back by the Internet of Things device, so that the client can call the Internet of Things device; the authorization information includes the authorization information that the Internet of Things device uses to implement the encrypted device call request by using the terminal public key Information generated after decryption.

For the introduction of this step, reference may be made to the description in steps S530 , S540 , S550 , and S560 , which will not be repeated here.

Based on the blockchain-based IoT device security invocation method corresponding to FIG. 3 , a blockchain-based IoT device security invocation apparatus according to an embodiment of this specification is introduced. The blockchain-based IoT device security invocation device is set on the IoT device. As shown in FIG. 8 , the blockchain-based IoT device security invocation device includes the following modules.

A request receiving module 810 is configured to receive a device invocation request sent by a user terminal; the device invocation request includes a request generated by a first client on the user terminal; the device invocation request includes the first client's the first client identifier;

A request sending module 820, configured to send a second client identifier acquisition request to the blockchain node device; the blockchain node device stores the second client identifier;

The identifier receiving module 830 is configured to receive the second client identifier fed back by the blockchain node device; the second client identifier includes the client identifier corresponding to the second client; the second client has a calling object Permissions for networked devices;

An information feedback module 840, configured to feed back authorization information to the user terminal when the first client identifier matches the second client identifier, so that the first client can call the IoT device .

Based on the blockchain-based IoT device security invocation method corresponding to FIG. 4 , a blockchain-based IoT device security invocation apparatus according to an embodiment of this specification is introduced. The blockchain-based IoT device security invocation device is set on the user terminal. As shown in FIG. 9 , the blockchain-based IoT device security invocation device includes the following modules.

a request obtaining module 910, configured to obtain a device invocation request generated by a first client; the device invocation request includes a first client identifier of the first client;

The request sending module 920 is configured to send the device invocation request to the IoT device, so that the IoT device sends the second client identification acquisition request to the blockchain node device, and receives the blockchain node device The feedback of the second client identifier; the second client identifier includes the client identifier corresponding to the second client; the second client has the authority to call the IoT device;

An information receiving module 930 is configured to receive authorization information fed back by the Internet of Things device, so that the first client can call the Internet of Things device; the authorization information includes the identity of the Internet of Things device in the first client and the The second client identifies the generated information that matches.

Based on the blockchain-based IoT device trusted invocation method corresponding to FIG. 6 , a blockchain-based IoT device trusted invocation apparatus according to an embodiment of this specification is introduced. The blockchain-based IoT device trusted invocation device is set on the IoT device. As shown in FIG. 10 , the blockchain-based IoT device trusted invocation device includes the following modules.

A request receiving module 1010, configured to receive a device invocation request sent by a user terminal; the device invocation request includes a request encrypted with a terminal private key corresponding to the user terminal;

The request sending module 1020 is configured to send a terminal public key acquisition request to the blockchain node device; the terminal public key acquisition request is used to acquire the terminal public key uploaded by the user terminal to the blockchain node device;

A public key receiving module 1030, configured to receive the terminal public key fed back by the blockchain node device;

The information feedback module 1040 is configured to feed back authorization information to the user terminal when the terminal public key is used to decrypt the device invocation request, so that the client can invoke the Internet of Things device.

Based on the blockchain-based IoT device trusted invocation method corresponding to FIG. 7 , a blockchain-based IoT device trusted invocation apparatus according to an embodiment of this specification is introduced. The blockchain-based IoT device trusted invocation device is set on the user terminal. As shown in FIG. 11 , the blockchain-based IoT device trusted invocation device includes the following modules.

an encryption module 1110, configured to encrypt the device invocation request by using the terminal private key; the device invocation request includes a request generated by the client;

The request sending module 1120 is configured to send an encrypted device call request to the IoT device, so that the IoT device sends a terminal public key acquisition request to the blockchain node device after receiving the device call request, and receives The terminal public key fed back by the blockchain node device; the terminal public key includes the terminal public key uploaded by the user terminal to the blockchain node device;

The information receiving module 1130 is configured to receive authorization information fed back by the Internet of Things device, so that the client can call the Internet of Things device; the authorization information includes that the Internet of Things device uses the terminal public key to encrypt the encryption. The decrypted information generated by the device call request.

Based on the blockchain-based IoT device security invocation method corresponding to FIG. 3 , an embodiment of the present specification further proposes an IoT device. As shown in FIG. 12 , the IoT device may include a memory and a processor.

In this embodiment, the memory may be implemented in any suitable manner. For example, the memory may be a read-only memory, a mechanical hard disk, a solid-state hard disk, or a USB flash drive. The memory may be used to store computer instructions.

In this embodiment, the processor may be implemented in any suitable manner. For example, a processor may take the form of, for example, a microprocessor or a processor and a computer readable medium storing computer readable program code (eg software or firmware) executable by the (micro)processor, logic gates, switches, application specific integrated circuits ( Application Specific Integrated Circuit, ASIC), programmable logic controller and embedded microcontroller form, etc. The processor may execute the computer instructions to implement the following steps: receiving a device invocation request sent by a user terminal; the device invocation request includes a request generated by a first client on the user terminal; in the device invocation request including the first client identifier of the first client; sending a second client identifier acquisition request to the blockchain node device; storing the second client identifier in the blockchain node device; receiving the blockchain The second client identifier fed back by the node device; the second client identifier includes the client identifier corresponding to the second client; the second client has the authority to call the IoT device; if the first client identifier Matching with the identifier of the second client, the authorization information is fed back to the user terminal, so that the first client can call the IoT device.

Based on the blockchain-based IoT device security invocation method corresponding to FIG. 4 , an embodiment of this specification further proposes a user terminal, as shown in FIG. 13 , the user terminal may include a memory and a processor.

In this embodiment, the memory may be implemented in any suitable manner. For example, the memory may be a read-only memory, a mechanical hard disk, a solid-state hard disk, or a USB flash drive. The memory may be used to store computer instructions.

In this embodiment, the processor may be implemented in any suitable manner. For example, a processor may take the form of, for example, a microprocessor or a processor and a computer readable medium storing computer readable program code (eg software or firmware) executable by the (micro)processor, logic gates, switches, application specific integrated circuits ( Application Specific Integrated Circuit, ASIC), programmable logic controller and embedded microcontroller form, etc. The processor may execute the computer instructions to implement the following steps: obtaining a device invocation request generated by a first client; the device invocation request includes a first client identifier of the first client; Send to the Internet of Things device, so that the Internet of Things device sends a second client identifier acquisition request to the blockchain node device, and receives the second client identifier fed back by the blockchain node device; the second client identifier The client identifier includes the client identifier corresponding to the second client; the second client has the authority to call the IoT device; and the authorization information fed back by the IoT device is received, so that the first client can call the IoT device device; the authorization information includes information generated by the IoT device when the first client identification matches the second client identification.

Based on the blockchain-based IoT device security invocation method corresponding to FIG. 6 , the embodiments of this specification further propose an IoT device. As shown in FIG. 12 , the IoT device may include a memory and a processor.

In this embodiment, the memory may be implemented in any suitable manner. For example, the memory may be a read-only memory, a mechanical hard disk, a solid-state hard disk, or a USB flash drive. The memory may be used to store computer instructions.

In this embodiment, the processor may be implemented in any suitable manner. For example, a processor may take the form of, for example, a microprocessor or a processor and a computer readable medium storing computer readable program code (eg software or firmware) executable by the (micro)processor, logic gates, switches, application specific integrated circuits ( Application Specific Integrated Circuit, ASIC), programmable logic controller and embedded microcontroller form, etc. The processor may execute the computer instructions to implement the following steps: receiving a device invocation request sent by a user terminal; the device invocation request includes a request encrypted by using the terminal private key corresponding to the user terminal; Sending a terminal public key acquisition request; the terminal public key acquisition request is used to acquire the terminal public key uploaded by the user terminal to the blockchain node device; and receiving the terminal public key fed back by the blockchain node device; If the terminal public key is used to decrypt the device invocation request, authorization information is fed back to the user terminal, so that the client can invoke the Internet of Things device.

Based on the blockchain-based IoT device security invocation method corresponding to FIG. 7 , an embodiment of this specification further proposes a user terminal, as shown in FIG. 13 , the user terminal may include a memory and a processor.

In this embodiment, the memory may be implemented in any suitable manner. For example, the memory may be a read-only memory, a mechanical hard disk, a solid-state hard disk, or a USB flash drive. The memory may be used to store computer instructions.

In this embodiment, the processor may be implemented in any suitable manner. For example, a processor may take the form of, for example, a microprocessor or a processor and a computer readable medium storing computer readable program code (eg software or firmware) executable by the (micro)processor, logic gates, switches, application specific integrated circuits ( Application Specific Integrated Circuit, ASIC), programmable logic controller and embedded microcontroller form, etc. The processor may execute the computer instructions to implement the following steps: encrypting the device invocation request by using the terminal private key; the device invocation request includes a request generated by the client; sending the encrypted device invocation request to the Internet of Things device to Make the IoT device send a terminal public key acquisition request to the blockchain node device after receiving the device call request, and receive the terminal public key fed back by the blockchain node device; the terminal public key includes the user The terminal uploads the terminal public key in the blockchain node device; receives authorization information fed back by the IoT device, so that the client can call the IoT device; the authorization information includes the IoT device using the The terminal public key implements the decrypted information generated for the encrypted device invocation request.

The systems, devices, modules or units described in the above embodiments may be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or A combination of any of these devices.

From the description of the above embodiments, those skilled in the art can clearly understand that this specification can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solutions of this specification or the parts that make contributions to the prior art can be embodied in the form of software products, and the computer software products can be stored in storage media, such as ROM/RAM, magnetic disks, etc. , CD, etc., including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments in this specification.

Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, as for the system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and for related parts, please refer to the partial descriptions of the method embodiments.

This specification can be used in numerous general purpose or special purpose computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, including A distributed computing environment for any of the above systems or devices, and the like.

This specification may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including storage devices.

Although this specification has been described by way of examples, those of ordinary skill in the art will recognize that there are many modifications and changes to this specification without departing from the spirit of the specification, and it is intended that the appended claims include such modifications and changes without departing from the spirit of the specification.

Claims (10)

1. A method for trusted invocation of Internet of Things devices based on blockchain, characterized in that, comprising: receiving a device invocation request sent by a user terminal; the device invocation request includes a request encrypted by using the terminal private key corresponding to the user terminal; Send a terminal public key acquisition request to the blockchain node device; the terminal public key acquisition request is used to acquire the terminal public key uploaded by the user terminal to the blockchain node device; Receive the terminal public key fed back by the blockchain node device; If the terminal public key is used to decrypt the device invocation request, authorization information is fed back to the user terminal, so that the client on the user terminal can invoke the Internet of Things device. 2. The method according to claim 1, wherein after receiving the terminal public key fed back by the blockchain node device, the method further comprises: If the device call request cannot be decrypted using the terminal public key, the terminal identifier corresponding to the user terminal is sent to the blockchain node device as a high-risk device identifier, so that the user terminal associated with the blockchain node device Obtain the identification of high-risk equipment. 3. The method according to claim 1, characterized in that, before sending the terminal public key acquisition request to the blockchain node device, the method further comprises: Send a terminal query request to the blockchain node device; the terminal query request is used to obtain the security evaluation result of the user terminal; Correspondingly, the sending the terminal public key acquisition request to the blockchain node device includes: If the security evaluation result fed back by the blockchain node device is a security device, send a terminal public key acquisition request to the blockchain node device. 4. A blockchain-based IoT device trusted invocation device, characterized in that it comprises: a request receiving module, configured to receive a device invocation request sent by a user terminal; the device invocation request includes a request encrypted with a terminal private key corresponding to the user terminal; a request sending module, configured to send a terminal public key acquisition request to the blockchain node device; the terminal public key acquisition request is used to acquire the terminal public key uploaded by the user terminal to the blockchain node device; a public key receiving module, configured to receive the terminal public key fed back by the blockchain node device; An information feedback module, configured to feed back authorization information to the user terminal when the terminal public key is used to decrypt the device invocation request, so that the client on the user terminal can invoke the Internet of Things device. 5. An IoT device, comprising a memory and a processor; the memory for storing computer program instructions; The processor is configured to execute the computer program instructions to implement the following steps: receiving a device invocation request sent by a user terminal; the device invocation request includes a request encrypted by using the terminal private key corresponding to the user terminal; The blockchain node device sends a terminal public key acquisition request; the terminal public key acquisition request is used to acquire the terminal public key uploaded by the user terminal to the blockchain node device; Terminal public key; if the terminal public key is used to decrypt the device call request, the authorization information is fed back to the user terminal, so that the client on the user terminal can call the IoT device. 6. A blockchain-based trusted calling method for IoT devices, comprising: The device invocation request is encrypted using the terminal private key; the device invocation request includes a request generated by the client; Send an encrypted device call request to the IoT device, so that the IoT device sends a terminal public key acquisition request to the blockchain node device after receiving the device call request, and receives the blockchain node device. The terminal public key fed back; the terminal public key includes the terminal public key uploaded by the user terminal to the blockchain node device; Receive authorization information fed back by the Internet of Things device, so that the client can call the Internet of Things device; the authorization information includes the Internet of Things device after using the terminal public key to decrypt the encrypted device call request generated information. 7. The method according to claim 6, wherein before sending the encrypted device invocation request to the Internet of Things device, the method further comprises: Send an IoT device query request to the blockchain node device; the IoT device query request is used to obtain a security evaluation result of the IoT device; Correspondingly, the sending an encrypted device call request to the IoT device includes: If the security evaluation result fed back by the blockchain node device is a security device, an encrypted device call request is sent to the IoT device. 8. The method of claim 6, wherein the authorization information comprises information encrypted by the Internet of Things device using a device private key; after receiving the authorization information fed back by the Internet of Things device, the authorization information further comprises: Send a device public key acquisition request to the blockchain node device; the device public key acquisition request is used to acquire the device public key uploaded by the IoT device to the blockchain node device; Receive the device public key fed back by the blockchain node device; If the device public key is used to decrypt the authorization information, the client is used to call the IoT device. 9. A blockchain-based trusted invocation device for IoT devices, characterized in that it comprises: an encryption module, used for encrypting a device invocation request by using the terminal private key; the device invocation request includes a request generated by the client; A request sending module is used to send an encrypted device invocation request to the Internet of Things device, so that the Internet of Things device sends a terminal public key acquisition request to the blockchain node device after receiving the device invocation request, and receives all The terminal public key fed back by the blockchain node device; the terminal public key includes the terminal public key uploaded by the user terminal to the blockchain node device; An information receiving module is used to receive authorization information fed back by the Internet of Things device, so that the client can call the Internet of Things device; the authorization information includes the Internet of Things device using the terminal public key to realize the encryption of the encrypted information. The decrypted information generated by the device call request. 10. A user terminal, comprising a memory and a processor; the memory for storing computer program instructions; The processor is configured to execute the computer program instructions to implement the following steps: encrypting the device invocation request by using the terminal private key; the device invocation request includes a request generated by the client; sending the encrypted device to the Internet of Things device a call request, so that the IoT device sends a terminal public key acquisition request to the blockchain node device after receiving the device call request, and receives the terminal public key fed back by the blockchain node device; the terminal The public key includes the terminal public key uploaded by the user terminal to the blockchain node device; the authorization information fed back by the IoT device is received, so that the client can call the IoT device; the authorization information includes the IoT device Information generated after decrypting the encrypted device invocation request using the terminal public key.

Images