CN115277240A - Authentication method and device for Internet of things equipment - Google Patents

Abstract

The invention relates to the technical field of information security, in particular to an authentication method of Internet of things equipment, which is applied to an equipment end and comprises the following steps: under the condition of establishing connection with a server, after receiving an authentication request of a user, acquiring an equipment key parameter and an equipment number of an equipment end, and sending the equipment key parameter and the equipment number to the server so that the server checks the equipment number, and generates mask data of the server according to the equipment key parameter; acquiring server mask data and server key parameters sent by a server, and generating server verification parameters of the server according to the server mask data; determining that the server passes the authentication according to the server key parameter and the server verification parameter; and after the server passes the authentication, acquiring equipment authentication passing information sent by the server, and starting an application function corresponding to the authentication request. The method improves the authentication efficiency of the equipment, ensures the safety of the equipment, reduces the resource waste and realizes the function of 'one-time pad'.

Description

Authentication method and device for an Internet of Things device

technical field

The present invention relates to the technical field of information security, in particular to an authentication method and device for an Internet of Things device.

Background technique

In recent years, the demand and scope of IoT devices have increased. At the same time, more and more attention has been paid to the security of IoT devices. At present, a series of intrusive and non-intrusive attacks pose a threat to the security of IoT devices. The proliferation of devices connected to an IoT device and the continuous development of attack software, illegal software, or malware have seriously damaged It improves the security of IoT devices and ecosystems.

Currently, IoT devices often use asymmetric keys and symmetric keys for device authentication to ensure the security of IoT devices. However, the encryption operation and decryption operation of the software of the IoT device will consume a large amount of resources, and will also cause a decrease in network performance, causing the problem of low authentication efficiency of the IoT device.

Contents of the invention

The embodiment of the present application solves the technical problem of low authentication efficiency of IoT devices in the prior art by providing an authentication method and device for IoT devices, realizes the mutual authentication function between IoT devices and servers, and improves the Internet of Things. The authentication efficiency of the device ensures the security of the device. In the process of mutual authentication between the IoT device and the server, it has the characteristics of less resource consumption, fast response and "one-time secret", effectively preventing physical intrusion attacks and other technical effects .

In the first aspect, the embodiment of the present invention provides an authentication method for an Internet of Things device, which is applied to the device side, and the method includes:

Under the condition of establishing a connection with the server, after receiving the authentication request from the user, obtain the device key parameter and the device number of the device, and send the device key parameter and the device number to the service end, so that the server checks the device number, and generates server mask data according to the device key parameter;

Obtain the server mask data and server key parameters sent by the server, and generate server verification parameters of the server according to the server mask data;

determining that the server has passed the authentication according to the server key parameter and the server verification parameter;

After it is determined that the server has passed the authentication, the device-side authentication passing information sent by the server is obtained, and the application function corresponding to the authentication request is started.

Preferably, after determining that the server has passed the authentication, it also includes:

Obtain device mask data according to the server-side key parameter, and send the device mask data to the server, so that the server performs the device-side processing on the device according to the device mask data certification;

After sending the device mask data to the server, obtain device authentication passing information sent by the server, and start the corresponding application function.

Preferably, said obtaining device key parameters of the device includes:

Obtain device incentive parameters, and input the device incentive parameters into the physical unclonable function on the device side to obtain device response parameters, and input the device incentive parameters into the hash function on the device side to obtain the Hash result of device incentive parameters;

The device key parameter is obtained according to a hash result of the device response parameter and the device incentive parameter.

Preferably, after obtaining the device key parameter, it also includes:

Obtaining a device verification key according to the device key parameter;

The generating of the server verification parameters of the server according to the server mask data includes:

The server verification parameter is obtained according to the server mask data and the device verification key.

Preferably, the determining that the server passes the authentication according to the server key parameter and the server verification parameter includes:

Obtaining a first fuzzy Hamming distance according to the server key parameter and the server verification parameter;

If the first fuzzy Hamming distance is not less than the first set distance threshold, then determine that the server has passed the authentication, and output information that the device has passed the authentication of the server.

Preferably, before receiving the user's authentication request, it also includes:

sending a registration signal to the server;

After sending the registration signal, obtain the incentive value set sent by the server and the device code of the device, and store the incentive value set and the device code, wherein the device code and the device number consistent;

According to each stimulus value in the stimulus value set, a response value corresponding to each stimulus value and a plurality of stimulus-response pairs are obtained, wherein a stimulus-response pair includes an stimulus value and a response value corresponding to the stimulus value;

sending the plurality of stimulus-response pairs to the server, so that the server stores the plurality of stimulus-response pairs.

Based on the same inventive concept, in the second aspect, the present invention also provides an authentication device for an Internet of Things device, which is applied to the device end, and the device includes:

The obtaining and sending module is used to obtain the device key parameter and device number of the device after receiving the user's authentication request under the condition of establishing a connection with the server, and combine the device key parameter and the device number The number is sent to the server, so that the server checks the device number, and generates server mask data according to the device key parameter;

An acquisition generation module, configured to acquire the server mask data and server key parameters sent by the server, and generate server verification parameters of the server according to the server mask data;

An authentication module, configured to determine that the server has passed the authentication according to the server key parameter and the server verification parameter;

The control module is configured to obtain the device-side authentication passing information sent by the server after determining that the server has passed the authentication, and start the application function corresponding to the authentication request.

Based on the same inventive concept, in the third aspect, the embodiment of the present invention provides an authentication method for an IoT device, which is applied to a server, and the method includes:

After establishing a connection with the device, obtain the server key parameter of the server, the device key parameter and the device number sent by the device;

If the device number is consistent with the device code of the device in the server database, generate server mask data according to the device key parameter, and combine the server mask data with the service The terminal key parameter is sent to the device terminal;

After sending the server mask data and the server key parameter to the device, acquire the device mask data sent by the device;

According to the device mask data, it is determined that the device has passed the authentication, and the device authentication passing information of the device is sent to the device.

Preferably, the determining that the device has passed the authentication according to the device mask data includes:

generating device verification parameters on the device side according to the device mask data;

Obtaining a second fuzzy Hamming distance according to the device verification parameter and the device key parameter;

If the second fuzzy Hamming distance is not less than the second set distance threshold, it is determined that the device has passed the authentication, and the device authentication passing information of the device is sent to the device.

Based on the same inventive concept, in the fourth aspect, the present invention also provides an authentication device for an Internet of Things device, which is applied to a server, and the device includes:

The first obtaining module is used to obtain the server key parameter of the server, the device key parameter and the device number sent by the device after establishing a connection with the device;

A judging module, configured to generate server mask data according to the device key parameter if the device number is consistent with the device code of the device in the server database, and mask the server sending the data and the key parameter of the server to the device;

A second obtaining module, configured to obtain the device mask data sent by the device after sending the server mask data and the server key parameter to the device;

The determination module is configured to determine that the device has passed the authentication according to the device mask data, and send the device authentication passing information of the device to the device.

One or more technical solutions in the embodiments of the present invention have at least the following technical effects or advantages:

In the embodiment of the present invention, when the user uses a certain application function on the device side, the user's authentication request is triggered. After receiving the user's authentication request, the device side obtains the device key parameters and device number of the device side, and sends the device key parameters and device number to the server side, so that the server side can check the device number, and according to the device key parameter , to generate server-side mask data. Here, the server not only checks the device number, confirms that the device is a device registered in the server, but also generates server mask data, which effectively prevents machine learning attacks, replay attacks, or man-in-the-middle attacks and other related attacks, and improves the security of the device. Authentication efficiency ensures device security.

Next, the device acquires the server mask data and server key parameters sent by the server, and generates server verification parameters of the server according to the server mask data. Then, according to the key parameters of the server and the verification parameters of the server, it is determined that the server has passed the authentication, and the authentication of the device to the server is realized, thereby further improving the authentication efficiency of the device and ensuring the security of the device.

Then, after confirming that the server has passed the authentication, obtain the device-side authentication pass information sent by the server, which means that the device-side authenticates to the server-side, and the server-side authenticates to the device-side, that is, the two pass mutual authentication to ensure the safety of the device sex. After the mutual authentication of the two passes, the device side starts the application function corresponding to the authentication request, so that the user can use the application function of the device side safely.

Through the authentication method of the Internet of Things device in the embodiment of the present invention, the original direct mapping relationship between the response and the incentive of the server and the device is broken. During the entire authentication process of the two, the relevant parameters or mask data used each time depend on the data generated by the true random number generator, and the relevant mask data is also set, which greatly improves the authentication efficiency of the device and ensures the safety of the device. safety. Moreover, the server can also achieve "one-time padding", which effectively prevents machine learning attacks, replay attacks, and man-in-the-middle attacks. During the entire authentication process of the two, physical unclonable functions are also used to prevent physical intrusion attacks.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same components are represented by the same reference figures. In the attached picture:

FIG. 1 shows a schematic flow chart of the steps of an authentication method applied to an IoT device at the device end in an embodiment of the present invention;

FIG. 2 shows a schematic flowchart of an authentication method for an IoT device between a device end and a server end in an embodiment of the present invention;

FIG. 3 shows a schematic module diagram of an authentication device applied to an IoT device at the device end in an embodiment of the present invention;

FIG. 4 shows a schematic flow chart of steps of an authentication method applied to an IoT device at the server end in an embodiment of the present invention;

Fig. 5 shows a schematic diagram of modules of an authentication device applied to a server-side IoT device in an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

Embodiment one

The first embodiment of the present invention provides an authentication method for an Internet of Things device, which is applied to the device side, as shown in Figure 1, including:

S101, under the condition of establishing a connection with the server, after receiving the authentication request from the user, obtain the device key parameter and device number of the device, and send the device key parameter and device number to the server, so that the server Check the device number, and generate server mask data according to the device key parameters;

S102. Obtain the server mask data and server key parameters sent by the server, and generate server verification parameters of the server according to the server mask data;

S103. Determine that the server passes the authentication according to the server key parameter and the server verification parameter;

S104. After it is determined that the server has passed the authentication, obtain the device-side authentication passing information sent by the server, and start the application function corresponding to the authentication request.

The authentication method for the Internet of Things device in this embodiment is applied to the device end, and the device end is an Internet of Things device, such as a mobile phone, a tablet computer, an electronic lock, or other electronic products. The authentication method of the Internet of Things device is specifically applicable to scenarios such as identity verification scenarios of mobile payment, access control management scenarios, anti-counterfeiting identification authentication scenarios, radio frequency identification technology (Radio Frequency Identification, RFID), near field communication (Near Field Communication, NFC) technology or Device authentication scenarios in application scenarios of other communication technologies, etc.

Below, the specific implementation steps of the authentication method for the IoT device provided in this embodiment will be introduced in detail in conjunction with FIG. 1:

Before step S101 is executed, after the connection between the device and the server is established, the device needs to register with the server. The device side sends a registration signal to the server side, so that the device side enters the registration phase. In the registration phase, after the server receives the registration signal sent by the device, the server uses its own True Random Number Generator (TRNG) to randomly generate multiple incentive values (that is, incentive value sets) and device code, and send the incentive value set and device number to the device. After obtaining the device code of the device, the server stores the device code in the database of the server, so as to realize indexing of the device through the device code.

It should also be noted that the server generates n incentive modules through its own physical unclonable function circuit, and each incentive module includes N _C incentive values. Wherein, both n and N _C are integers greater than 1. In the registration phase, after the server receives the registration signal sent by the device, the server obtains random numbers u and k through its own True Random Number Generator (TRNG). u is the device code of the device, and k is the stimulus value of the kth stimulus module, that is, the stimulus value set.

After sending the registration signal, the device obtains the incentive value set sent by the server and the device code of the device, and stores the incentive value set and the device code. Wherein, after the device end receives the device code, it uses the device code as the device number of the device, that is, the device code is consistent with the device number.

And, after the device receives the incentive value set sent by the server, according to each incentive value C _i in the incentive value set C, the response value R _i corresponding to each incentive value C _i and multiple stimulus-response pairs are obtained CRP(C _i , R _i ). Wherein, a stimulus-response pair includes a stimulus value and a response value corresponding to the stimulus value, and i represents the ith stimulus value or response value. After obtaining multiple stimulus-response pairs, the device side sends the multiple stimulus-response pairs to the server. After the server receives the multiple stimulus-response pairs, the server stores the multiple stimulus-response pairs.

As shown in Figure 2, in the process of authentication between the device and the server, step S101 is first executed to obtain the device key parameters and The device number, and send the device key parameter and the device number to the server, so that the server can check the device number, and generate server mask data according to the device key parameter.

Specifically, when a connection is established between the device and the server, when the user uses an application function that requires authentication on the device, he clicks on the application on the device, and the device receives the user's authentication request. After receiving the authentication request from the user, the device obtains its own device key parameters and device number, and sends its own device key parameters and device number to the server. Wherein, the user's authentication request is a request for identity authentication when the user uses a certain application function on the device. For example, when the user uses the mobile payment function on the mobile phone, the identity authentication request. Or on the expressway, when the vehicle passes the toll booth, the vehicle electronic tag installed on the vehicle is used to identify the ETC (Electronic Toll Collection, electronic toll collection system) of the toll booth, and realize the request to verify the identity of the vehicle through the ETC.

The process of obtaining its own device key parameter a on the device side is to first obtain the device incentive parameters, and input the device incentive parameters into the physical unclonable function of the device side, obtain the device response parameters, and input the device incentive parameters into the hash of the device side In the function, get the hash result of device incentive parameters. Then according to the hash result of the device response parameter and the device incentive parameter, the device key parameter is obtained.

Specifically, the device obtains the device excitation index I _{d through the device-side true random number generator TRNG d .} Since the excitation value corresponding to the device excitation index I _d output by TRNG _d may not match the pre-stored C _i , it is necessary to feed I _d into the linear feedback shift register (Linear Feedback Shift Register, LFSR) at the device side, where LFSR All output values of the function are bounded between 0 and Nr. Nr is the number of CRPs obtained by the device during the registration phase. I _d passes through the linear feedback shift register at the device side, and outputs the actual index LFSR(I _d ) of the device. According to the actual index of the device, the device incentive parameter C _d is found in the database DB _d on the device side.

Next, input C _d into the physical unclonable function PUF(k, C _d ) of the device to obtain the device response parameter R _d . In addition, the device incentive parameter C _d is input into the hash function Hash at the device side to obtain a hash result Hash(C _d ) of the device incentive parameter. Then XOR operation is performed on the device response parameter R _d and Hash(C _d ) to obtain the device key parameter a.

将

通过设备端的物理不可克隆函数PUF(k，

)，得到设备验证密钥K_s。After the device key parameter a is obtained, the device key parameter a is fed into the linear feedback shift register LFSR at the device side, and the LFSR(a) at the device side outputs the device target index I _a . According to the device target index I _a , find the device-side verification incentive parameters in the device-side database DB _d

Will

Through the physical unclonable function PUF(k,

) to get the device verification key K _s .

After receiving the device key parameter and device number sent by the device, the server first judges whether the device number is consistent with the device code of the device stored in the server database. If the device number sent by the device is consistent with the device code stored in the server database, it means that the device has registered with the server, and the server has stored the incentive response of the device to CRP(C _i , R _i ), the server generates the server mask data according to the device key parameter, and sends the server mask data and the server server key parameter to the device.

If the device number sent by the device is not consistent with the device code stored in the server database, it means that the device has not registered with the server, and the device cannot be authenticated with the server, then the server sends the device to the device. Information about unregistered devices.

The process for the server to obtain the server key parameter b is that the server obtains the server incentive response index I _{s through the server's true random number generator TRNG s .} Feed I _s into the linear feedback shift register LFSR of the server, and the output of the linear feedback shift register LFSR of the server obtains the actual index LFSR(I _s ) of the server. According to the actual index of the server, the server incentive response pair parameter CRP(C _s , R _s ) is found in the database DB _s of the server.

Next, input the server incentive parameter C _s of the server incentive response pair CRP(C _s , R _s ) into the hash function Hash of the server, and obtain the hash result Hash(C _s ) of the server incentive parameter C _s . Exclusive OR operation is performed on the server response parameter R _s and Hash(C _s ) to obtain the server key parameter b.

After the server obtains the server-side key parameter b, it obtains the server-side authentication key according to the server-side key parameter b. The specific process is: feed the server-side key parameter b into the linear feedback shift register LFSR of the server, The LFSR(b) of the server outputs the target index I _b of the server. According to the target index I _b of the server, the verification key K _d of the server is found in the database DB _s of the server.

根据第一索引

在服务端的数据库DB_s中查找到第一验证密钥K_s。将第一验证密钥K_s和服务端激励响应索引I_s作异或运算，得到服务端掩码数据e。服务端将服务端掩码数据e和服务端密钥参数b发送至设备端。The specific process for the server to generate the server mask data e according to the device key parameter a is that the server passes the device key parameter a sent by the device through its own linear feedback shift register LFSR, and the server's LFSR(a) outputs get first index

according to the first index

The first verification key K _s is found in the database DB _s of the server. The XOR operation is performed on the first verification key K _s and the server stimulus response index I _s to obtain the server mask data e. The server sends the server mask data e and the server key parameter b to the device.

Next, step S102 is executed to acquire the server mask data and the server key parameter sent by the server, and generate the server authentication parameters of the server according to the server mask data.

Specifically, after the device receives the server mask data e and the server key parameter b sent by the server, it obtains the server verification parameter according to the server mask data e and the device verification key K _s

具体过程是，将服务端掩码数据e和设备验证密钥K_s作异或运算，得到第二索引

将第二索引

通过设备端的LFSR，得到第三索引LFSR

根据第三索引LFSR

在设备端的数据库DB_d中查找到第一激励参数C_s。将第一激励参数C_s输入到设备端的物理不可克隆函数PUF(k，C_s)中，得到第一响应参数R_s。将第一响应参数R_s和第一激励参数C_s的哈希结果Hash(C_s)作异或运算，得到服务端验证参数

Get server authentication parameters

The specific process is to perform an XOR operation on the server mask data e and the device verification key K _s to obtain the second index

index the second

Through the LFSR on the device side, get the third index LFSR

According to the third index LFSR

The first excitation parameter C _s is found in the database DB _d at the device side. Input the first excitation parameter C _s into the physical unclonable function PUF(k, C _s ) of the device to obtain the first response parameter R _s . Perform XOR operation on the hash result Hash(C _s ) of the first response parameter R _s and the first incentive parameter C _s to obtain the verification parameter of the server

后，执行步骤S103，根据服务端密钥参数和服务端验证参数，确定服务端通过认证。The device side obtains the verification parameters of the server side

Afterwards, step S103 is executed to determine that the server has passed the authentication according to the key parameter of the server and the authentication parameter of the server.

后，设备端将服务端密钥参数b和服务端验证参数

作模糊汉明距离算法(Fuzzy Hamming Distance，PHD)计算，得到第一模糊汉明距离PHD(b，

)。再对第一模糊汉明距离PHD(b，

)进行判断。若第一模糊汉明距离不小于第一设定距离阈值τ1，则确定服务端通过认证，并输出设备端对服务端认证通过的信息。其中，第一设定距离阈值根据实际需求而设置。若第一模糊汉明距离小于第一设定距离阈值，则确定服务端未通过认证，向服务端和设备端的屏幕输出设备端对服务端认证未通过的信息，并关闭认证请求对应的应用功能。Specifically, after the device side obtains the server-side verification parameters

After that, the device will pass the server-side key parameter b and the server-side verification parameter

Do fuzzy Hamming distance algorithm (Fuzzy Hamming Distance, PHD) calculation, get the first fuzzy Hamming distance PHD (b,

). Then for the first fuzzy Hamming distance PHD(b,

) to judge. If the first fuzzy Hamming distance is not less than the first set distance threshold τ1, it is determined that the server has passed the authentication, and output information that the device has passed the authentication of the server. Wherein, the first set distance threshold is set according to actual needs. If the first fuzzy Hamming distance is less than the first set distance threshold, it is determined that the server has not passed the authentication, and the information that the device fails to authenticate the server to the server is output to the screens of the server and the device, and the application function corresponding to the authentication request is closed .

In this embodiment, during the process of being used by the user, the device sends the device key parameter and the device number to the server, so that the server checks the device number and generates the server mask data and the server key parameter. The device authenticates the server according to the received server mask data and server key parameters sent by the server, and judges whether the server has passed the authentication, so as to improve the authentication efficiency of the device and ensure the security of the device. Moreover, through the setting of mask data on the server side, machine learning attacks, replay attacks or man-in-the-middle attacks can be effectively prevented.

After determining that the server has passed the authentication, the device executes step S104 to obtain the device authentication passing information sent by the server, and activates the application function corresponding to the authentication request.

Specifically, after confirming that the server has passed the authentication, the device obtains the device mask data f according to the server key parameter b, and sends the device mask data to the server, so that the server can, according to the device mask data, Authenticate on the device side.

根据第四索引

在设备端的数据库DB_d中查找到第二激励参数C_Kd。将C_Kd输入到设备端的物理不可克隆函数PUF(k，C_Kd)中，得到第二响应参数K_d。将K_d和设备激励索引I_d作异或运算，得到设备掩码数据f。The specific process of obtaining the device mask data f is to pass the server key parameter b through the LFSR of the device to obtain the fourth index

according to the fourth index

The second excitation parameter C _Kd is found in the database DB _d at the device side. Input C _Kd into the physical unclonable function PUF(k, C _Kd ) of the device to obtain the second response parameter K _d . Exclusive OR operation is performed on K _d and device excitation index I _d to obtain device mask data f.

将

通过服务端的LFSR，得到第六索引LFSR

根据第六索引LFSR

在服务端的数据库DB_s中查找到第三激励参数C_d和第三响应参数R_d。将第三响应参数R_d和第三激励参数C_d的哈希结果Hash(C_d)作异或运算，得到设备验证参数

After receiving the device mask data f sent by the device, the server generates the device verification parameters of the device according to the device mask data f. The specific process is: the server combines the device mask data f and the server verification key K _d XOR operation to get the fifth index

Will

Through the LFSR of the server, get the sixth index LFSR

According to the sixth index LFSR

The third excitation parameter C _d and the third response parameter R _d are found in the database DB _s of the server. Perform XOR operation on the hash result Hash(C _d ) of the third response parameter R _d and the third excitation parameter C _d to obtain the device verification parameter

后，将设备验证参数

和设备密钥参数a作模糊汉明距离算法PHD计算，得到第二模糊汉明距离PHD(a，

)。再对第二模糊汉明距离PHD(a，

)进行判断。若第二模糊汉明距离不小于第二设定距离阈值τ2，则确定设备端通过认证，并将设备端的设备端认证通过信息发送至设备端。其中，第二设定距离阈值根据实际需求而设置。若第二模糊汉明距离小于第二设定距离阈值，则服务端对设备端认证未通过，向设备端发送设备端未通过认证的信息。The server gets the device verification parameters

After that, the device will verify the parameter

Calculate the fuzzy Hamming distance algorithm PHD with the device key parameter a to get the second fuzzy Hamming distance PHD(a,

). Then for the second fuzzy Hamming distance PHD(a,

) to judge. If the second fuzzy Hamming distance is not less than the second set distance threshold τ2, it is determined that the device has passed the authentication, and the device-side authentication passing information of the device is sent to the device. Wherein, the second set distance threshold is set according to actual needs. If the second fuzzy Hamming distance is less than the second set distance threshold, the server fails to authenticate the device, and sends information to the device that the device has not passed the authentication.

After the server sends the device-side authentication information to the device, the server will delete the server-side incentive response pair parameter CRP(C _s ,R _s ), in the process of mutual authentication between the device and the server, the mutual authentication between the device and the server is realized once, and the parameter CRP(C _s , R _s ) is used once for the incentive response of the server, that is, the key is used once to improve the And the authentication efficiency of the server, guarantee the security of the device, reduce the waste of resources, and speed up the response speed.

After the device end sends the device mask data to the server end, it obtains the device end authentication passing information sent by the server end, and enables the corresponding application function, so that the user can use the corresponding application function.

再根据设备验证参数

和设备密钥参数a，确定出对设备端的认证结果，以提高设备的认证效率，保障设备的安全性。并且，通过设备掩码数据的设置，能有效防止机器学习攻击、重放攻击或中间人攻击等。In this embodiment, after the device side authenticates the server side, the server side also needs to authenticate the device side. The server obtains the device verification parameters according to the device mask data f sent by the device

Then verify the parameters according to the device

and the device key parameter a to determine the authentication result on the device, so as to improve the authentication efficiency of the device and ensure the security of the device. Moreover, through the setting of device mask data, machine learning attacks, replay attacks, or man-in-the-middle attacks can be effectively prevented.

During the entire authentication process between the device and the server, both the device and the server use the physically unclonable function PUF, which can effectively prevent physical intrusion attacks.

It should also be noted that the device and/or the server in this embodiment can use a circuit in which the process circuit corresponding to the true random number generator TRNG and the process circuit corresponding to the physical unclonable function PUF are connected in parallel to further reduce the cost of software resources. Waste, improve responsiveness.

One or more technical solutions in the embodiments of the present invention have at least the following technical effects or advantages:

In this embodiment, when the user uses a certain application function on the device side, the user's authentication request is triggered. After receiving the user's authentication request, the device side obtains the device key parameters and device number of the device side, and sends the device key parameters and device number to the server side, so that the server side can check the device number, and according to the device key parameter , to generate server-side mask data. Here, the server not only checks the device number, confirms that the device is a device registered in the server, but also generates server mask data, which effectively prevents machine learning attacks, replay attacks, or man-in-the-middle attacks and other related attacks, and improves the security of the device. Authentication efficiency ensures device security.

Next, the device acquires the server mask data and server key parameters sent by the server, and generates server verification parameters of the server according to the server mask data. Then, according to the key parameters of the server and the verification parameters of the server, it is determined that the server has passed the authentication, and the authentication of the device to the server is realized, thereby further improving the authentication efficiency of the device and ensuring the security of the device.

Then, after confirming that the server has passed the authentication, obtain the device-side authentication pass information sent by the server, which means that the device-side authenticates to the server-side, and the server-side authenticates to the device-side, that is, the two pass mutual authentication to ensure the safety of the device sex. After the mutual authentication of the two passes, the device side starts the application function corresponding to the authentication request, so that the user can use the application function of the device side safely.

The authentication method for the IoT device in this embodiment breaks the original direct mapping relationship between the response and the incentive between the server and the device. During the entire authentication process of the two, the relevant parameters or mask data used each time depend on the data generated by the true random number generator, and the relevant mask data is also set, which greatly improves the authentication efficiency of the device and ensures the safety of the device. safety. Moreover, the server can also achieve "one-time padding", which effectively prevents machine learning attacks, replay attacks, and man-in-the-middle attacks. During the entire authentication process of the two, physical unclonable functions are also used to prevent physical intrusion attacks.

Embodiment two

Based on the same inventive concept, the second embodiment of the present invention also provides an authentication device for IoT devices, as shown in Figure 3, which is applied to the device side, and the device includes:

The obtaining and sending module 201 is configured to obtain the device key parameter and device number of the device after receiving the user's authentication request under the condition of establishing a connection with the server, and combine the device key parameter and the sending the device number to the server, so that the server checks the device number, and generates server mask data according to the device key parameter;

An acquisition and generation module 202, configured to acquire the server mask data and server key parameters sent by the server, and generate server verification parameters of the server according to the server mask data;

An authentication module 203, configured to determine that the server passes the authentication according to the server key parameter and the server verification parameter;

The control module 204 is configured to, after determining that the server has passed the authentication, obtain device-side authentication passing information sent by the server, and enable the application function corresponding to the authentication request.

As an optional embodiment, the control module 204 is configured to: after determining that the server has passed the authentication, obtain device mask data according to the server key parameter, and send the device mask data to the server, so that the server authenticates the device according to the mask data of the device;

After sending the device mask data to the server, obtain device authentication passing information sent by the server, and start the corresponding application function.

As an optional embodiment, the acquiring and sending module 201, configured to acquire the device key parameters of the device, includes:

Obtain device incentive parameters, and input the device incentive parameters into the physical unclonable function on the device side to obtain device response parameters, and input the device incentive parameters into the hash function on the device side to obtain the Hash result of device incentive parameters;

The device key parameter is obtained according to a hash result of the device response parameter and the device incentive parameter.

As an optional embodiment, the obtaining and sending module 201 is configured to, after obtaining the device key parameter, further include:

Obtaining a device verification key according to the device key parameter;

The acquisition generation module 202 is used to generate the server verification parameters of the server according to the mask data of the server, including:

The server verification parameter is obtained according to the server mask data and the device verification key.

As an optional embodiment, the determining that the server passes the authentication according to the server key parameter and the server authentication parameter includes:

Obtaining a first fuzzy Hamming distance according to the server key parameter and the server verification parameter;

If the first fuzzy Hamming distance is not less than the first set distance threshold, then determine that the server has passed the authentication, and output information that the device has passed the authentication of the server.

As an optional embodiment, the acquiring and sending module 201 is configured to: send a registration signal to the server before receiving the user's authentication request;

After sending the registration signal, obtain the incentive value set sent by the server and the device code of the device, and store the incentive value set and the device code, wherein the device code and the device number consistent;

According to each stimulus value in the stimulus value set, a response value corresponding to each stimulus value and a plurality of stimulus-response pairs are obtained, wherein a stimulus-response pair includes an stimulus value and a response value corresponding to the stimulus value;

sending the plurality of stimulus-response pairs to the server, so that the server stores the plurality of stimulus-response pairs.

Since the authentication device for IoT devices introduced in this embodiment is the device used to implement the authentication method for IoT devices in Embodiment 1 of this application, based on the authentication method for IoT devices introduced in Embodiment 1 of this application, Those skilled in the art can understand the specific implementation of the authentication device of the Internet of Things device in this embodiment and its various variants, so how to implement the method in the first embodiment of the application for the authentication device of the Internet of Things device Let me introduce in detail. As long as those skilled in the art implement the device used by the authentication method for the Internet of Things device in Embodiment 1 of the present application, they all fall within the scope of protection intended by the present application.

Embodiment three

Based on the same inventive concept, the third embodiment of the present invention provides an authentication method for an IoT device, as shown in FIG. 4 , applied to the server, and the method includes:

S301. After establishing a connection with the device, obtain the server key parameter of the server, the device key parameter and the device number sent by the device;

S302. If the device number is consistent with the device code of the device in the server database, generate server mask data according to the device key parameter, and combine the server mask data and the The key parameter of the server is sent to the device;

S303. After sending the server mask data and the server key parameter to the device, acquire the device mask data sent by the device;

S304. According to the device mask data, determine that the device has passed the authentication, and send the device authentication passing information of the device to the device.

As an optional embodiment, obtaining the server key parameter includes:

Obtaining server incentive parameters and server response parameters of the server, wherein the server incentive parameters correspond to the server response parameters;

inputting the server incentive parameter into the hash function of the server to obtain a hash result of the server incentive parameter;

The server key parameter is obtained according to the hash result of the server incentive parameter and the server response parameter.

As an optional embodiment, the determining that the device has passed the authentication according to the device mask data includes:

generating device verification parameters on the device side according to the device mask data;

Obtaining a second fuzzy Hamming distance according to the device verification parameter and the device key parameter;

If the second fuzzy Hamming distance is not less than the second set distance threshold, it is determined that the device has passed the authentication, and the device authentication passing information of the device is sent to the device.

As an optional embodiment, after the device-side authentication passing information of the device is sent to the device, the server-side incentive parameter and the server-side response parameter are deleted from the server-side database.

As an optional embodiment, after obtaining the server key parameter, it also includes:

Obtain the server verification key according to the server key parameter.

As an optional embodiment, the generating the device verification parameters on the device side according to the device mask data includes:

The device verification parameters are obtained according to the device mask data and the server verification key.

As an optional embodiment, before obtaining the server key parameter of the server, the device key parameter and the device number sent by the device, the method further includes:

Obtain a registration signal sent by the device;

After obtaining the registration signal, send the stimulus value set and the device code of the device to the device, so that the device can obtain multiple stimulus-response pairs according to the stimulus value set, and send the The device code is stored in the database of the server;

After the multiple stimulus parameters are sent to the device, the multiple stimulus-response pairs sent by the device are acquired, and the multiple stimulus-response pairs are stored.

Embodiment Four

Based on the same inventive concept, the fourth embodiment of the present invention also provides an authentication device for an Internet of Things device, as shown in Figure 5, which is applied to the server, and the device includes:

The first obtaining module 401 is configured to obtain the server key parameter of the server, the device key parameter and the device number sent by the device after establishing a connection with the device;

A judging module 402, configured to generate server mask data according to the device key parameter and mask the server if the device number is consistent with the device code of the device in the server database. code data and the server key parameter are sent to the device;

The second acquiring module 403 is configured to acquire the device mask data sent by the device after sending the server mask data and the server key parameter to the device;

The determining module 404 is configured to determine, according to the device mask data, that the device has passed the authentication, and send the device authentication passing information of the device to the device.

As an optional embodiment, the first obtaining module 401 is configured to obtain the server key parameter, including:

Obtaining server incentive parameters and server response parameters of the server, wherein the server incentive parameters correspond to the server response parameters;

inputting the server incentive parameter into the hash function of the server to obtain a hash result of the server incentive parameter;

The server key parameter is obtained according to the hash result of the server incentive parameter and the server response parameter.

As an optional embodiment, the determining that the device has passed the authentication according to the device mask data includes:

generating device verification parameters on the device side according to the device mask data;

Obtaining a second fuzzy Hamming distance according to the device verification parameter and the device key parameter;

If the second fuzzy Hamming distance is not less than the second set distance threshold, it is determined that the device has passed the authentication, and the device authentication passing information of the device is sent to the device.

As an optional embodiment, the determining module 404 is configured to: delete the server incentive parameter and The server responds with parameters.

As an optional embodiment, the first acquiring module 401 is configured to obtain the server verification key according to the server key parameter after obtaining the server key parameter.

As an optional embodiment, the judging module 402 is configured to generate device verification parameters on the device side according to the device mask data, including:

The device verification parameters are obtained according to the device mask data and the server verification key.

As an optional embodiment, the first obtaining module 401 is configured to: obtain the the registration signal sent;

After obtaining the registration signal, send the stimulus value set and the device code of the device to the device, so that the device can obtain multiple stimulus-response pairs according to the stimulus value set, and send the The device code is stored in the database of the server;

After the multiple stimulus parameters are sent to the device, the multiple stimulus-response pairs sent by the device are acquired, and the multiple stimulus-response pairs are stored.

Since the authentication device for IoT devices introduced in this embodiment is the device used to implement the authentication method for IoT devices in Embodiment 3 of this application, based on the authentication method for IoT devices introduced in Embodiment 3 of this application, Those skilled in the art can understand the specific implementation of the authentication device of the Internet of Things device in this embodiment and its various variants, so how to implement the method in the third embodiment of the application for the authentication device of the Internet of Things device Let me introduce in detail. As long as a person skilled in the art implements the device used by the authentication method for the IoT device in Embodiment 3 of the present application, it all falls within the scope of protection intended by the present application.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, systems, or computer program products. Accordingly, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

While preferred embodiments of the invention have been described, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is appreciated. Therefore, it is intended that the appended claims be construed to cover the preferred embodiment as well as all changes and modifications which fall within the scope of the invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (10)

1. An authentication method for an Internet of Things device, characterized in that it is applied to a device end, and the method includes: Under the condition of establishing a connection with the server, after receiving the authentication request from the user, obtain the device key parameter and the device number of the device, and send the device key parameter and the device number to the service end, so that the server checks the device number, and generates server mask data according to the device key parameter; Obtain the server mask data and server key parameters sent by the server, and generate server verification parameters of the server according to the server mask data; determining that the server has passed the authentication according to the server key parameter and the server verification parameter; After it is determined that the server has passed the authentication, the device-side authentication passing information sent by the server is obtained, and the application function corresponding to the authentication request is started. 2. The method according to claim 1, further comprising: after determining that the server has passed the authentication: Obtain device mask data according to the server-side key parameter, and send the device mask data to the server, so that the server performs the device-side processing on the device according to the device mask data certification; After sending the device mask data to the server, obtain device authentication passing information sent by the server, and start the corresponding application function. 3. The method according to claim 1, wherein said obtaining the device key parameters of the device comprises: Obtain device incentive parameters, and input the device incentive parameters into the physical unclonable function on the device side to obtain device response parameters, and input the device incentive parameters into the hash function on the device side to obtain the Hash result of device incentive parameters; The device key parameter is obtained according to a hash result of the device response parameter and the device incentive parameter. 4. The method according to claim 3, further comprising: after obtaining the device key parameters: Obtaining a device verification key according to the device key parameter; The generating of the server verification parameters of the server according to the server mask data includes: The server verification parameter is obtained according to the server mask data and the device verification key. 5. The method according to claim 1, wherein the determining that the server passes the authentication according to the server key parameter and the server verification parameter comprises: Obtaining a first fuzzy Hamming distance according to the server key parameter and the server verification parameter; If the first fuzzy Hamming distance is not less than the first set distance threshold, then determine that the server has passed the authentication, and output information that the device has passed the authentication of the server. 6. The method according to claim 1, further comprising: before receiving the authentication request from the user: sending a registration signal to the server; After sending the registration signal, obtain the incentive value set sent by the server and the device code of the device, and store the incentive value set and the device code, wherein the device code and the device number consistent; According to each stimulus value in the stimulus value set, a response value corresponding to each stimulus value and a plurality of stimulus-response pairs are obtained, wherein a stimulus-response pair includes an stimulus value and a response value corresponding to the stimulus value; sending the plurality of stimulus-response pairs to the server, so that the server stores the plurality of stimulus-response pairs. 7. An authentication device for an Internet of Things device, characterized in that it is applied to a device end, and the device includes: The obtaining and sending module is used to obtain the device key parameter and device number of the device after receiving the user's authentication request under the condition of establishing a connection with the server, and combine the device key parameter and the device number The number is sent to the server, so that the server checks the device number, and generates server mask data according to the device key parameter; An acquisition generation module, configured to acquire the server mask data and server key parameters sent by the server, and generate server verification parameters of the server according to the server mask data; An authentication module, configured to determine that the server has passed the authentication according to the server key parameter and the server verification parameter; The control module is configured to obtain the device-side authentication passing information sent by the server after determining that the server has passed the authentication, and start the application function corresponding to the authentication request. 8. An authentication method for an Internet of Things device, characterized in that it is applied to a server, and the method comprises: After establishing a connection with the device, obtain the server key parameter of the server, the device key parameter and the device number sent by the device; If the device number is consistent with the device code of the device in the server database, generate server mask data according to the device key parameter, and combine the server mask data with the service The terminal key parameter is sent to the device terminal; After sending the server mask data and the server key parameter to the device, acquire the device mask data sent by the device; According to the device mask data, it is determined that the device has passed the authentication, and the device authentication passing information of the device is sent to the device. 9. The method according to claim 8, wherein the determining that the device has passed the authentication according to the device mask data comprises: generating device verification parameters on the device side according to the device mask data; Obtaining a second fuzzy Hamming distance according to the device verification parameter and the device key parameter; If the second fuzzy Hamming distance is not less than the second set distance threshold, it is determined that the device has passed the authentication, and the device authentication passing information of the device is sent to the device. 10. An authentication device for an Internet of Things device, characterized in that it is applied to a server, and the device includes: The first obtaining module is used to obtain the server key parameter of the server, the device key parameter and the device number sent by the device after establishing a connection with the device; A judging module, configured to generate server mask data according to the device key parameter if the device number is consistent with the device code of the device in the server database, and mask the server sending the data and the key parameter of the server to the device; A second obtaining module, configured to obtain the device mask data sent by the device after sending the server mask data and the server key parameter to the device; The determination module is configured to determine that the device has passed the authentication according to the device mask data, and send the device authentication passing information of the device to the device.

Images