CN118540167A - IPK-based MQTT protocol identity authentication method and data transmission method - Google Patents

Abstract

The present invention discloses an identity authentication method and a data transmission method of the MQTT protocol based on IPK, wherein the identity authentication method includes initialization of a client, an MQTT Broker server and a key management center, the client establishing a connection with the server, the server sending a server public key, a client public key and a device ID to the key management center to apply for a key, and the client and the server performing key distribution based on the key management center to perform two-way identity authentication. The identity authentication method uses HMAC verification or a digital signature to ensure the integrity and authenticity of data transmission. The present invention proposes an identity authentication method and a data transmission method of the MQTT protocol based on IPK, which solves the authentication and encryption problems of the MQTT protocol while maintaining the lightweight characteristics of the MQTT protocol through identification public key technology, and proposes a complete terminal device security access solution to prevent attacks that may occur during device access and data transmission.

Description

An identity authentication method and data transmission method of MQTT protocol based on IPK

Technical Field

The present invention relates to the field of information security technology, and in particular to an identity authentication method and a data transmission method of an MQTT protocol based on IPK.

Background Art

A message transmission protocol based on the publish/subscribe model of the proxy. It is located in the application layer of the TCP/IP protocol stack and has attracted much attention for its lightweight, simple, open and easy-to-implement features. In the field of Internet of Things (IoT), especially in scenarios with strict restrictions on power consumption and network bandwidth, MQTT stands out for its excellent applicability and has become a popular member of the IoT communication protocol. The advantage of the publish-subscribe model adopted by MQTT is that it realizes the spatial and temporal decoupling between publishers and subscribers, which also allows MQTT to allow data published by a sensor to trigger a series of actions of multiple subscribers.

The traditional MQTT protocol has two major security issues: 1) The protocol does not encrypt data by default, which means that sensitive information may be easily intercepted and stolen by unauthorized attackers during network transmission. 2) The MQTT protocol lacks an efficient and secure identity authentication mechanism and relies solely on traditional account and password authentication, which makes the system vulnerable to man-in-the-middle attacks. Attackers may disguise themselves as legitimate users, steal and tamper with communication content, posing a serious threat to system security and data integrity. Therefore, when using the MQTT protocol, additional security measures must be taken to strengthen the confidentiality of data transmission and the reliability of identity authentication.

In order to improve the security of the MQTT protocol, many researchers are committed to designing security algorithms based on the MQTT protocol. However, there are some problems in this process. For example: 1) The Organization for the Promotion of Structured Information Standards proposed that SSL/TLS can be used to solve the security issues of the MQTT protocol. However, although this solution provides a security protection mechanism, the digital certificate management and verification involved in it bring a lot of computing and communication overhead. 2) Gu Zhengchuan et al. proposed a solution for MQTT data security transmission based on proxy re-encryption technology in the paper "End-to-end security solution for message queue telemetry transmission protocol based on proxy re-encryption". It realizes the secure distribution of session keys based on proxy re-encryption technology and solves the trust problem of MQTT Broker. However, the public and private keys of the terminal are generated by the trusted center, and offline key distribution will increase the cost, while online key distribution has security issues. 3) Mektoubi proposed a subject-based encryption scheme in the paper "New approach forsecuring communication over MQTT protocol A comparaison between RSA andElliptic Curve". Generate subject certificates for the client and the subject, realize the distribution of subject certificates and subject private keys, and realize the secure transmission of messages. However, using certificates to achieve secure information transmission has the problem of high overhead.

Therefore, it is particularly important to solve the authentication and encryption problems of the MQTT protocol while maintaining the lightweight characteristics of the MQTT protocol.

Summary of the invention

In order to overcome the shortcomings of the above technologies, the present invention provides an MQTT protocol identity authentication method and a data transmission method based on IPK. By identifying public key technology, a secure access solution for terminal devices is proposed, which reduces authentication overhead and prevents man-in-the-middle attacks that may occur when devices are accessed.

The technical solution adopted by the present invention to overcome the technical problems is as follows: the first aspect of the present invention proposes an identity authentication method based on the MQTT protocol of IPK, which is applied to an MQTT architecture system including at least a client, a server and a key management center, wherein the server is connected to the key management center via a dedicated network, and the identity authentication method includes:

The client, server, and key management center are initialized:

The key management center initialization at least includes generating public parameters based on the first cryptographic algorithm and constructing a private key matrix and a public public key matrix. The client and server initialization at least includes the server obtaining the identification parameters of the client, registering them with the server and associating them with the device ID.

The client establishes a connection with the server:

The client calculates a symmetric key based on the generated first random number and identification parameters, calculates a server public key based on the public parameters and the public key matrix, generates a client public-private key pair, and sends a first ciphertext encrypted by the symmetric key and the server public key to the server, the server decrypts the first ciphertext based on the server private key, authenticates the client based on the decryption result, thereby establishing a connection between the client and the server, and calculates a client public key based on the decryption result, and sends the server public key, the client public key and the device ID to the key management center;

The client and the server perform two-way identity authentication based on the key management center: the key management center calculates and generates a central key and a first client public key based on the server public key, the client public key, the device ID, the private key matrix and the key management center private key, and sends the central key and the first client public key to the server. The server encrypts the central key and the generated session key based on the client public key and sends the second ciphertext to the client based on the server private key signature; the client verifies the signature based on the server public key and decrypts the second ciphertext to obtain the central key and the session key, calculates the central private key based on the central key and the client private key, encrypts the identity information with the central private key and the server public key, and adds it to the connection data packet and sends it to the server; the server decrypts the encrypted connection data packet based on the first client public key and the server private key to obtain the identity information, and returns the connection data packet to the client after identity authentication, thereby completing the two-way security authentication of the client and the server.

Furthermore, the server and client initialization specifically includes: the server obtaining a client identification parameter;

The parameters for registering the client on the server side include identification parameters and device ID, wherein the device ID is associated with the device parameters of the client; and a dedicated network connection is established with the key management center.

Furthermore, the first ciphertext encrypted by the symmetric key and the server public key is sent to the server, which specifically includes: the client uses the symmetric key to encrypt the client public key to generate an intermediate encrypted ciphertext; encrypts the intermediate encrypted ciphertext, the device ID and the first random number based on the server public key to obtain the first ciphertext; the client sends the first ciphertext to the server.

Furthermore, the method of authenticating the client based on the decryption result to establish a connection between the client and the server specifically includes: obtaining the device ID based on decrypting the first ciphertext, and searching the server to see whether the device ID is registered locally; if the device ID is found in the server, calculating a symmetric key based on the first random number and the identification parameter, obtaining the client public key based on the calculated symmetric key as the decryption key, saving the client public key, and sending the server public key, the client public key and the device ID to the key management center; if the device ID cannot be found in the server, the server does not establish a connection with the device.

Furthermore, the key management center generates a central key and a first client public key based on the server public key, the client public key, the device ID, the private key matrix and the key management center private key, specifically including: the key management center calculates an accompanying public key based on the client public key and the server public key; calculates a mapping sequence based on the accompanying public key and the device ID; generates a central key based on the mapping sequence, the private key matrix and the key management center private key; and calculates a first client public key based on the accompanying public key, identification parameters and the public key matrix.

The first client public key IPK, ie, the identification public key, is calculated through the device ID or other parameters in the identification parameter.

Furthermore, the initialization of the key management center at least includes generating public parameters based on the first cryptographic algorithm, and constructing a private key matrix and a public public key matrix, specifically including: the key management center uses the elliptic curve of the SM2 algorithm to generate public parameters, and generates a private key matrix through the SM2 algorithm parameters; and obtains a public key matrix based on the private key matrix.

Furthermore, the client calculates a symmetric key based on the generated first random number and identification parameters, specifically including: the client generates a first random number, and uses the first random number and identification parameters as inputs of the KDF algorithm of SM3 to generate a symmetric key.

Furthermore, the client generates a public-private key pair based on the SM2 algorithm.

The second aspect of the present invention also proposes a data transmission method of the MQTT protocol based on IPK, which is applied to an Internet of Things system that includes at least a client, a server and a key management center. The above-mentioned identity authentication method based on the MQTT protocol of IPK is used to realize the bidirectional security authentication of the identity of the client and the server, wherein the client includes a subscriber and a publisher; the subscriber generates a subscriber key, and the publisher generates a publisher key; before the subscriber subscribes or before the publisher publishes, the subscriber key generated by the subscriber and the publisher key generated by the publisher are sent to the server respectively, and the topic information is sent; the server saves the received subscriber key and publisher key, and queries or creates a topic according to the received topic information, and sends the topic information to the server based on the topic ID. The key management center applies for a data transmission session key; the key management center generates a random key and transmits it back to the server as the data transmission session key; the server signs the data transmission session key based on the server private key and encrypts it with the first client public key and sends it to the client; the publisher verifies the signature based on the server public key and decrypts it based on the client private key to obtain the data transmission session key, and encrypts the published data packet based on the data transmission session key to generate a published ciphertext and calculates the HMAC value based on the publisher key and sends it to the server, the server verifies the HMAC based on the received publication message, calculates the HMAC value based on the subscriber key and forwards it to the subscriber; the subscriber verifies the HMAC after receiving the data packet, and decrypts it based on the data transmission session key to obtain the subscription data information.

The HMAC method is used to ensure the integrity and authenticity of data transmission.

The third aspect of the present invention further proposes a data transmission method of the MQTT protocol based on IPK, which is applied to an Internet of Things system including at least a client, a server and a key management center. The identity authentication method of the MQTT protocol based on IPK is used to realize the bidirectional security authentication of the client and the server, wherein the client includes a subscriber and a publisher; the subscriber sends topic information to the server before subscribing or the publisher sends topic information to the server before publishing; the server queries the topic or creates a topic based on the received topic information, and applies for a session key from the key management center based on the topic ID; the key management center generates a random key and transmits it back to the server as a data transmission session key; The server signs the data transmission session key based on the server private key and encrypts it with the first client public key before sending the session key data packet to the client; the client verifies the signature of the received data transmission session key data packet based on the server public key, and decrypts the session key data packet based on the client private key to obtain the data transmission session key; the publisher encrypts the data based on the session key and signs the published data with the central private key before sending it to the server, and the server verifies the signature of the received published data and forwards it to the subscriber; after receiving the data packet, the subscriber who subscribes to the corresponding topic ID verifies the signature based on the server public key and based on the session key, and decrypts it based on the session key to obtain the subscription data information.

Digital signatures are used to ensure the integrity and authenticity of data transmission.

The beneficial effects of the present invention are:

1. Proposed a terminal device identity authentication method to prevent possible man-in-the-middle attacks and counterfeit attacks;

2. Through the IPK-based MQTT certificate-free two-way authentication solution, the client and MQTT Broker are guaranteed to be trustworthy while reducing the authentication overhead;

3. Depending on the computing power of the terminal, HMAC or digital signature based methods are used to ensure the integrity and authenticity of the data;

4. During the key distribution and data transmission process, data is transmitted in ciphertext form. Only clients subscribing to the same topic can possess the key and decrypt to obtain plaintext information;

5. The use of topic-based key distribution reduces the amount of computing power on the device without destroying the spatial and temporal decoupling between publishers and subscribers;

6. During the identity security authentication phase, attackers cannot impersonate clients to connect to MQTT Broker. MQTT Broker only configures the client's identity information but not the attacker's information. Even if the attacker forges the client's information, the CONNECT data packet issued by the client contains the username and password information, so the attacker still cannot connect to MQTT Broker.

7. During the identity security authentication stage, attackers cannot impersonate MQTT Broker to connect to the client. When the client applies to connect to MQTT Broker, the client public key is used to encrypt the information. The attacker cannot obtain the client public key and thus cannot interact with the client in the future.

8. During the data transmission stage, HMAC and private key signature are provided to ensure the authenticity of the data, and attackers cannot impersonate the client to send information.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is an MQTT architecture system used in an embodiment of the present invention;

FIG2 is a flow chart of an identity authentication method based on the IPK MQTT protocol according to an embodiment of the present invention;

3 is a flow chart of a data transmission method of the MQTT protocol based on IPK implemented by verifying HMAC according to an embodiment of the present invention;

FIG4 is a flow chart of a data transmission method of the MQTT protocol based on IPK implemented by digital signature authentication in an embodiment of the present invention.

DETAILED DESCRIPTION

First, some abbreviations and key terms mentioned in the present invention are explained.

MQTT: A lightweight messaging protocol for IoT applications. MQTT allows devices to communicate with other devices, servers, or cloud services to exchange data in real time.

MQTT Broker: The core of the MQTT architecture, responsible for coordinating communications between MQTT clients (publishers and subscribers). As a server, it receives messages sent by publishers and forwards messages to subscribers based on the topics they subscribe to. It manages client connections, handles subscriptions and unsubscriptions, and ensures that messages are sent at the specified Quality of Service (QoS) level.

IPK: An asymmetric public key cryptography system, as a security self-certification system, realizes the association between identification and key, and solves the problems of public key distribution and public key authenticity proof under the public key system. IPK has the advantages of no need for third-party participation in authentication, low power consumption, low network bandwidth requirements, and compatibility with the CA system. It is more flexible and effective for IoT security access and security defense.

HMAC: Hash-based Message Authentication Code, the abbreviation of key-related hash operation message authentication code, a method of message authentication based on hash function and key.

In order to facilitate those skilled in the art to better understand the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The following is only exemplary and does not limit the protection scope of the present invention.

As shown in Figure 1, the schematic diagram of the MQTT architecture used in the embodiment of the present invention, the MQTT architecture includes a client, a server MQTT Broker and a key management center KMC, and the server is connected to the key management center through a private network VPN. The flowchart of the identity authentication method of the MQTT protocol based on IPK of the present invention is shown in Figure 2, which mainly includes the following steps: Each step is described in detail as follows.

S1, the client, server and key management center are initialized.

The server-side MQTT Broker obtains the identification parameter IDS of the device to be registered. The identification parameter IDS can be any one or more of CMIITID, ICCID, IMSI, device name, device MAC, etc., which is a unique parameter. When registering a client, the server registers the device ID in addition to the identification parameter. The device ID is associated with the device's identification parameter or other device parameters and is specified by the server. Each client has a unique ID number.

The initialization process of the key management center builds the private key matrix and the public key matrix.

In one implementation of the present invention, the key management center KMC selects the elliptic curve of the SM2 algorithm, calculates the order N of the elliptic curve and finds a relatively large factor n, then finds a suitable reference point G based on n, and selects parameters in the SM2 algorithm and makes them public.

The key management center uses the selected parameters to generate a private key matrix consisting of 32 private keys and derives a corresponding public key matrix consisting of 32 public keys (R=r•G). The private key matrix is saved by the key management center KMC, and the public key matrix is open to the public.

It should be noted that the parameters in the algorithm can be calculated based on the public key matrix that is open to the public, and then encryption can be performed based on the parameters.

S2, the client establishes a connection with the server.

S21, the client calculates a symmetric key based on the generated first random number and the identification parameter.

In one embodiment of the present invention, the client generates a random number S, and uses the identification parameter IDS and the generated random number S as input to generate a 16-byte symmetric key K1 using a KDF algorithm based on SM3, as shown in formula (1).

K1 = KDF(IDS, S) (1)

S22, the client obtains the public parameters and the public key matrix, and calculates the server private key r2 and the server public key R2.

S23, the client generates a public-private key pair (R1, r1) based on the SM2 algorithm, and makes the client public key R1 public, and saves the client private key r1. The client public key R1 is encrypted with the symmetric key K1 to generate the intermediate encrypted ciphertext P1. The client then encrypts the intermediate encrypted ciphertext P1, the device ID, and the random number S with the server public key R2 to generate the first ciphertext P2, as shown in formula (2).

P2 = Enc(R2, (Enc_K1(R1), ID, S)) (2)

S24, the client sends the first ciphertext P2 to the server MQTT Broker.

S25, MQTT Broker uses the server private key r2 to decrypt the first ciphertext P2, and searches the local identity list of the server according to the device ID obtained after decryption.

If the server finds the corresponding device ID in the local identity list, it calculates the symmetric key K1 of the corresponding device based on the random number S and the identification parameter IDS of the corresponding device ID, uses the symmetric key K1 as the decryption key to obtain the client public key R1, and saves the client public key R1. The server sends the server public key R2, the client public key R1 and the device ID information to the key management center.

If the device ID does not exist, the identity authentication fails and the server does not establish a connection with the client.

S3, the client and the server perform two-way authentication based on the key management center.

S31, the key management center calculates and generates a central key and a first client public key based on the server public key, the client public key, the device ID, the private key matrix and the key management center private key;

The key management center calculates the accompanying public key R through the client public key R1 and the server public key R2, R=R1+R2.

The mapping sequence is obtained by calculating the accompanying public key R and the device ID;

And based on the mapping sequence, the private key matrix and the private key of the key management center, a central key isk' is calculated and generated;

The key management center KMC calculates the first client public key IPK based on the accompanying public key R, the device ID and the public key matrix;

The key management center KMC sends the central key isk' and the first client public key IPK to the server.

S32, the server encrypts the central key isk' and the session key K2 using the client public key R1, signs the second ciphertext with the server private key and sends it to the client.

The session key is the session key K2 randomly generated by the server.

S33, the client verifies the signature based on the server public key and decrypts the second ciphertext to obtain the central key and session key, calculates the central private key based on the central key and the client private key, encrypts the identity information using the central private key and the server public key, and adds it to the connection data packet and sends it to the server.

The client uses the server public key to verify the signature and uses the client private key r1 to decrypt the central key isk' and the first client public key IPK. The central private key isk is calculated based on the central key isk' and the client private key r1.

The client encrypts the username and password using the central private key isk and the server public key R2 respectively, and adds the ciphertext corresponding to the username and password to the CONNECT connection data packet and sends it to the server MQTT Broker.

S34, the server decrypts the connection data packet based on the first client public key IPK and the server private key to obtain identity information, and returns the connection data packet to the client after identity authentication, thereby completing two-way security authentication between the client and the server.

After receiving the CONNECT data packet, the server uses the first client public key IPK and the server private key to decrypt and obtain the username and password. After identity authentication, the CONNECT data packet is returned to the client, thus completing the two-way security authentication between the client and the server.

In another embodiment of the present invention, a data transmission method based on the MQTT protocol of IPK is also proposed, and data transmission is performed on the basis of identity security authentication implemented on the client and the server. The client is divided into a subscriber and a publisher, and key distribution is performed based on the MQTT protocol based on the topic, thereby reducing the computing amount of the device.

In practical applications, HMAC verification or digital signature can be used to ensure the integrity and authenticity of data transmission according to the different computing power of the terminal.

In one embodiment of the present invention, HMAC is used to verify the integrity and authenticity of data transmission between the client and the server. The flow chart is shown in FIG3 , which specifically includes the following steps:

S41, the subscriber generates a subscriber key KEY_S for HMAC calculation, and the publisher generates a publisher key KEY_P for HMAC calculation.

S42, the subscriber and publisher send topic information to the server respectively, and send the subscriber key KEY_ and publisher key KEY_P to the server respectively.

S43, the server-side MQTT Broker saves the received subscriber key and publisher key, queries or creates a topic according to the received topic information, and applies for a data transmission session key from the key management center based on the topic ID.

The server-side MQTT Broker queries whether the local topic exists based on the received topic information. If the topic does not exist, the server-side MQTT Broker creates the topic.

S44, the server-side MQTT Broker applies for a data transmission session key Key from the key management center based on the topic ID.

S45, the key management center generates a random key as the data transmission session key Key and returns it to the server-side MQTT Broker.

S46, the server-side MQTT Broker signs the data transmission session key Key with the server-side private key and encrypts it with the first client public key IPK and then sends the data transmission session key Key data packet to the corresponding client.

S47, after receiving the data transmission session key Key data packet, the publisher verifies the signature with the server public key, and obtains the data transmission session key Key after decryption based on the client private key. The publisher encrypts the publishing data packet with the data transmission session key Key to generate the publishing ciphertext, and calculates the HMAC value based on the publisher key and sends it to the server.

S48, after receiving the information, the server-side MQTT Broker verifies the HMAC, recalculates the HMAC based on the subscription key KEY_S, and then forwards the information to the subscriber.

S49, after receiving the data packet, the subscriber verifies the HMAC and decrypts it based on the data transmission session key to obtain the subscription data information.

In another embodiment of the present invention, a data transmission method based on the MQTT protocol of IPK is also proposed, which uses digital signature verification to ensure the integrity and authenticity of data transmission. The flow chart is shown in Figure 4. It includes the following steps.

S51, the subscriber sends topic information to the server before subscribing or the publisher publishes;

S52, the server queries the topic or creates a topic according to the received topic information, and applies for a session key from the key management center based on the topic ID.

The server-side MQTT Broker queries whether the local topic exists based on the received topic information. If the topic does not exist, the server-side MQTT Broker creates the topic.

S53: The key management center generates a random key and transmits it back to the server as a data transmission session key.

S54, the server signs the data transmission session key based on the server private key, encrypts it with the first client public key IPK, and then sends the session key data packet to the client;

S54, the client verifies the signature of the received session key data packet based on the server public key, and decrypts the session key data packet based on the client private key to obtain the data transmission session key;

S55, the publisher encrypts the data based on the session key and signs the published data with the central private key and sends it to the server. The server verifies the signature of the received published data and forwards it to the subscriber.

S56, after receiving the data packet, the subscriber who subscribes to the corresponding topic ID verifies the signature based on the server public key and decrypts it based on the data transmission session key to obtain the subscription data information.

During the key distribution and data transmission process, data is transmitted in ciphertext form. Only clients subscribed to the same topic can possess the key and decrypt to obtain plaintext information.

By adopting an identity authentication method and a data transmission method of the MQTT protocol based on IPK proposed by the present invention, fake attacks and man-in-the-middle attacks are prevented in the identity authentication stage and the data transmission stage of the client and the server.

It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

Claims (10)

1. An identity authentication method based on the MQTT protocol of IPK, characterized in that it is applied to an MQTT architecture system including at least a client, a server and a key management center, wherein the server and the key management center are connected via a dedicated network, and the identity authentication method includes: The client, server, and key management center are initialized: The key management center initialization at least includes generating public parameters based on the first cryptographic algorithm and constructing a private key matrix and a public public key matrix. The client and server initialization at least includes the server obtaining the identification parameters of the client, registering them with the server and associating them with the device ID. The client establishes a connection with the server: The client calculates a symmetric key based on the generated first random number and the identification parameter, calculates a server public key based on the public parameter and the public key matrix, generates a client public-private key pair, and sends the first ciphertext encrypted by the symmetric key and the server public key to the server, The server decrypts the first ciphertext based on the server private key, authenticates the client based on the decryption result, thereby establishing a connection between the client and the server, calculates the client public key based on the decryption result, and sends the server public key, the client public key and the device ID to the key management center; The client and server perform two-way authentication based on the key management center: The key management center calculates and generates a central key and a first client public key based on the server public key, the client public key, the device ID, the private key matrix and the key management center private key, and sends the central key and the first client public key to the server. The server encrypts the central key and the generated session key based on the client public key and sends the second ciphertext to the client based on the server private key signature; The client verifies the signature based on the server public key and decrypts the second ciphertext to obtain the central key and session key, calculates the central private key based on the central key and the client private key, encrypts the identity information with the central private key and the server public key, and adds it to the connection data packet and sends it to the server; The server decrypts the encrypted connection data packet based on the first client public key and the server private key to obtain the identity information, and returns the connection data packet to the client after identity verification, thereby completing the two-way security authentication between the client and the server. 2. According to an identity authentication method based on the MQTT protocol of IPK according to claim 1, it is characterized in that the server and the client are initialized, specifically comprising: The server obtains the client identification parameter; The parameters for registering the client on the server include identification parameters and device ID, wherein the device ID is associated with the device parameters of the client; Establish a dedicated network connection to the key management center. 3. According to the identity authentication method of the MQTT protocol based on IPK in claim 2, it is characterized in that the first ciphertext encrypted by the symmetric key and the server public key is sent to the server, specifically comprising: The client uses a symmetric key to encrypt the client public key to generate an intermediate encrypted ciphertext; Encrypting the intermediate encrypted ciphertext, the device ID, and the first random number based on the server public key to obtain a first ciphertext; The client sends the first ciphertext to the server. 4. The identity authentication method of the MQTT protocol based on IPK according to claim 3, characterized in that: The authentication of the client based on the decryption result to establish a connection between the client and the server specifically includes: The device ID is obtained by decrypting the first ciphertext, and the server searches for the device ID to see if it is registered locally. If the device ID is found in the server, a symmetric key is calculated based on the first random number and the identification parameter, a client public key is obtained based on the calculated symmetric key as a decryption key, the client public key is saved, and the server public key, the client public key and the device ID are sent to the key management center; If the device ID cannot be found in the server, the server will not establish a connection with the device. 5. According to an identity authentication method of the MQTT protocol based on IPK according to claim 4, it is characterized in that the key management center calculates and generates a central key and a first client public key based on the server public key, the client public key, the device ID, the private key matrix and the key management center private key, specifically comprising: The key management center calculates the accompanying public key based on the client public key and the server public key; A mapping sequence is calculated based on the accompanying public key and the device ID; Generate a central key based on the mapping sequence, the private key matrix and the private key of the key management center; The first client public key is calculated based on the companion public key, the device ID and the public key matrix. 6. The identity authentication method of the MQTT protocol based on IPK according to claim 1, characterized in that the initialization of the key management center at least includes generating public parameters based on the first cryptographic algorithm, and constructing a private key matrix and a public public key matrix, specifically including: The key management center uses the elliptic curve of the SM2 algorithm to generate public parameters, and generates the private key matrix through the SM2 algorithm parameters; The public key matrix is obtained based on the private key matrix. 7. The identity authentication method of the MQTT protocol based on IPK according to claim 1 is characterized in that the client calculates the symmetric key based on the generated first random number and the identification parameter, specifically comprising: The client generates a first random number, and uses the first random number and an identification parameter as inputs to the KDF algorithm of SM3 to generate a symmetric key. 8. The identity authentication method of the MQTT protocol based on IPK according to claim 1 is characterized in that the client generates a public-private key pair based on the SM2 algorithm. 9. A data transmission method of the MQTT protocol based on IPK, characterized in that it is applied to an Internet of Things system including at least a client, a server and a key management center, and realizes a two-way security authentication of the identity of the client and the server through an identity authentication method of the MQTT protocol based on IPK according to any one of claims 1 to 8, wherein the client includes a subscriber and a publisher; The subscriber generates a subscriber key, and the publisher generates a publisher key; Before the subscriber subscribes or the publisher publishes, the subscriber key generated by the subscriber and the publisher key generated by the publisher are sent to the server, as well as the topic information; The server saves the received subscriber key and publisher key, queries or creates topics based on the received topic information, and applies to the key management center for a data transmission session key based on the topic ID; The key management center generates a random key and sends it back to the server as the data transmission session key; The server signs the data transmission session key based on the server private key and encrypts it with the first client public key before sending it to the client; The publisher verifies the signature based on the server public key and decrypts it based on the client private key to obtain the data transmission session key. In addition, the publisher encrypts the published data packet based on the data transmission session key to generate the published ciphertext and calculates the HMAC value based on the publisher key and sends it to the server. The server verifies the HMAC based on the received published message, calculates the HMAC value based on the subscriber's key, and forwards it to the subscriber; After receiving the data packet, the subscriber verifies the HMAC and decrypts it based on the data transmission session key to obtain the subscription data information. 10. A data transmission method of the MQTT protocol based on IPK, characterized in that it is applied to an Internet of Things system including at least a client, a server and a key management center, and realizes a two-way security authentication of the identity of the client and the server through an identity authentication method of the MQTT protocol based on IPK according to any one of claims 1 to 8, wherein the client includes a subscriber and a publisher; The subscriber sends topic information to the server before subscribing or the publisher sends topic information to the server before publishing; The server queries or creates a topic based on the received topic information, and applies for a session key from the key management center based on the topic ID; The key management center generates a random key and sends it back to the server as the data transmission session key; The server signs the data transmission session key based on the server private key and encrypts it with the first client public key before sending the session key data packet to the client; The client verifies the signature of the received data transmission session key data packet based on the server public key, and decrypts the session key data packet based on the client private key to obtain the data transmission session key; The publisher encrypts the data based on the session key and signs the published data with the central private key before sending it to the server. The server verifies the signature of the received published data and forwards it to the subscriber. After receiving the data packet, the subscriber who subscribes to the corresponding topic ID verifies the signature based on the server public key and the session key, and decrypts it based on the session key to obtain the subscription data information.