CN111162914A - Internet of things IPv4 identity authentication method and system based on PUF - Google Patents
Internet of things IPv4 identity authentication method and system based on PUF Download PDFInfo
- Publication number
- CN111162914A CN111162914A CN202010086119.0A CN202010086119A CN111162914A CN 111162914 A CN111162914 A CN 111162914A CN 202010086119 A CN202010086119 A CN 202010086119A CN 111162914 A CN111162914 A CN 111162914A
- Authority
- CN
- China
- Prior art keywords
- ipv4
- ipv4 address
- terminal
- puf
- secure
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 24
- 230000004044 response Effects 0.000 claims description 31
- 239000000284 extract Substances 0.000 claims description 2
- 230000002277 temperature effect Effects 0.000 claims 1
- 230000005284 excitation Effects 0.000 description 4
- 238000004519 manufacturing process Methods 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 230000006399 behavior Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 239000002131 composite material Substances 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- 230000007613 environmental effect Effects 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 238000007634 remodeling Methods 0.000 description 1
- 238000012827 research and development Methods 0.000 description 1
- 230000000630 rising effect Effects 0.000 description 1
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
- H04L9/3278—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response using physically unclonable functions [PUF]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D30/00—Reducing energy consumption in communication networks
- Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Power Engineering (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses an internet of things IPv4 identity authentication method and system based on PUF (physical unclonable function), and aims to solve the technical problems that in the prior art, the internet of things IPv4 terminal identity authentication security is poor, and the damage to the IPv4 internet security caused by an illegal terminal is not facilitated. The method comprises the following steps: responding to an access request of the terminal, and comparing the IPv4 address of the terminal with a pre-stored IPv4 address; judging whether the access request of the terminal passes or not based on the comparison result; the IPv4 address generation method comprises the following steps: extracting a secure IPv4 address generated by adopting a weak PUF; an IPv4 address is generated based on the secure IPv4 address.
Description
Technical Field
The invention relates to an internet of things IPv4 identity authentication method and system based on PUF, and belongs to the technical field of computer networks.
Background
With the development of society and science and technology, the internet of things industry is in the spotlight and enters a rapid development stage. According to statistics, the production scale in 2017 breaks through 11000 hundred million yuan, and the composite growth rate reaches 25%. The continuous maturity of the technology, the standard and the network of the internet of things rapidly promotes the application of the internet of things in the fields of electric power, traffic, environmental protection, logistics, industry, medical treatment, water conservancy, security protection, electric power and the like, provides powerful support for realizing fine management of a plurality of industries, greatly improves the management capability level, and changes the industry operation mode. The industry of the internet of things is applied more and more, more and more users are attracted, and especially the demands of new retail, logistics, medical treatment and smart cities are on a vertical rising trend.
The wide application of the internet of things brings about the sharp increase of the number of terminals of the sensing management and control equipment, the sensing management and control equipment is large enough to a network system and a platform, the sensing management and control equipment is small enough to a mass of sensor equipment, and each terminal in the internet of things can become an attack point. Therefore, the security risk of the internet of things is far greater than that of the traditional internet, and the security risk is mainly reflected in terminal security high-risk loopholes and insufficient terminal security protection measures. Meanwhile, when enterprises in the industrial chain of the internet of things seek to quickly seize the market high point, safety protection measures are rarely deployed in advance, and the proportion of safety protection technical links is low, so that potential safety hazards exist in the industrial chain of the internet of things, and potential serious threats are brought to the application of the internet of things.
Internet Protocol version 4 (IPv 4) is the core of the Internet and is also the most widely used Internet Protocol version, and its subsequent version is Internet Protocol version 6 (IPv 6), although the security is high, IPv6 is still in the initial stage of deployment. Therefore, the large-scale safe deployment of the IPv4 has extremely important reality and long-term benefits for remodeling the competitiveness of reconstructed countries, enhancing the national information safety capability, improving the network safety, particularly the safety of the Internet of things developing at a high speed.
Based on the security risk of the internet of things and the wide application of IPv4, it is difficult to ensure the identity security of the network by only relying on the user name/password of the application layer or embedding the SIM/UIM card in the terminal. The application environment of the Internet of things needs to identify the authenticity of the equipment terminal, so that the condition that illegal equipment is accessed into the network and the safety of the IPv4 Internet is damaged by malicious behaviors is prevented.
Disclosure of Invention
Aiming at the defects of the prior art, the invention aims to provide an internet of things IPv4 identity authentication method and system based on PUF (physical unclonable function), so as to solve the technical problems that in the prior art, the internet of things IPv4 terminal identity authentication security is poor, and the damage to the IPv4 internet security caused by an illegal terminal is not facilitated.
In order to solve the technical problems, the technical scheme adopted by the invention is as follows:
an internet of things IPv4 identity authentication method based on PUF comprises the following steps:
responding to an access request of the terminal, and comparing the IPv4 address of the terminal with a pre-stored IPv4 address;
judging whether the access request of the terminal passes or not based on the comparison result;
the IPv4 address generation method comprises the following steps:
extracting a secure IPv4 address generated by adopting a weak PUF;
an IPv4 address is generated based on the secure IPv4 address.
Further, the method for generating the secure IPv4 address includes:
generating a stimulus in response to a request for generation of a secure IPv4 address;
generating a response reply with the weak PUF in response to the stimulus;
generating the secure IPv4 address based on no less than one response reply.
Further, the secure IPv4 address is a 16-bit secure IPv4 address;
the IPv4 address generation method comprises the following steps:
generating a 32-bit base IPv4 address;
the last 16 bits of the base IPv4 address are replaced with a secure IPv4 address.
Further, determining whether to access the request through the terminal based on the comparison result includes:
if the IPv4 address of the terminal is consistent with the prestored IPv4 address, the access request of the terminal is passed;
and if the IPv4 address of the terminal is inconsistent with the pre-stored IPv4 address, rejecting the access request of the terminal.
In order to achieve the above object, the present invention further provides an internet of things IPv4 identity authentication system based on a PUF, including:
a network side: the terminal is used for responding to the access request of the terminal, comparing the IPv4 address of the terminal with the prestored IPv4 address, and judging whether the access request of the terminal passes through or not based on the comparison result;
the device database deployed on the network side: for storing the pre-stored IPv4 address;
a PUF circuit module: for generating a secure IPv4 address using a weak PUF;
an IPv4 protocol stack module deployed at a terminal: the method is used for extracting the safe IPv4 address generated by adopting the weak PUF, generating an IPv4 address based on the safe IPv4 address and sending an access request to the network side.
Further, the PUF circuit module is disposed at the terminal.
Further, the IPv4 protocol stack module is also used for sending a generation request of a secure IPv4 address to the PUF circuit;
the PUF circuit block includes:
an excitation generation submodule: for generating stimuli in response to a request for generation of a secure IPv4 address;
a response generation submodule: for generating response replies with weak PUFs in response to stimuli, and generating secure IPv4 addresses based on no less than one response reply.
Further, the response generation submodule is integrated with an auxiliary circuit for eliminating the temperature influence.
Compared with the prior art, the invention has the following beneficial effects: the PUF hardware circuit is used for generating a unique and uncopyable safe IPv4 address serving as an interface identifier of an IPv4 address of the terminal IPv4 chip of the Internet of things, the IPv4 address of the IPv4 chip is prestored in an equipment database of a network end, and the IPv4 address is compared with the terminal IPv4 address to judge whether the IPv4 address is consistent with the terminal IPv4 address so as to finish the authentication process. The method and the system can be widely applied to all the terminal equipment of the Internet of things using the IPv4 protocol, and provide good safety guarantee for the transmission of data packets among the terminal equipment of the Internet of things.
Drawings
FIG. 1 is a schematic diagram of the system of the present invention.
Detailed Description
The invention is further described below with reference to the accompanying drawings. The following examples are only for illustrating the technical solutions of the present invention more clearly, and the protection scope of the present invention is not limited thereby.
It should be noted that in the description of the present invention, the terms "front", "rear", "left", "right", "upper", "lower", "inner", "outer", and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the drawings, and are only for convenience of describing the present invention but do not require that the present invention must be constructed and operated in a specific orientation, and thus, should not be construed as limiting the present invention. As used in the description of the present invention, the terms "front," "back," "left," "right," "up," "down" and "in" refer to directions in the drawings, and the terms "inner" and "outer" refer to directions toward and away from, respectively, the geometric center of a particular component.
Starting from the research and development of the IPv4 chip with independent safety and controllability, in the chip manufacturing process, an IPv4 address which is Unclonable and has unique Physical characteristics is generated for each IPv4 chip by utilizing a Physical Unclonable Function (PUF) to identify the chip, the IPv4 address is prestored in a network end, and the authentication process is completed by comparing whether the IPv4 address is consistent with the terminal IPv4 address, so that the safety of each terminal device of the Internet of things can be fundamentally improved, and the overall safety of the network is further ensured.
Based on the technical idea, a specific embodiment of the present invention provides an internet of things IPv4 identity authentication system based on a PUF, as shown in fig. 1, which is a schematic diagram of the system of the present invention, where the system includes an IPv4 chip deployed at a terminal and a network side deployed with an equipment database, and the IPv4 chip is integrated with an IPv4 protocol stack module and a PUF circuit module.
A PUF circuit module: the weak PUF is used as a Cipher Generated Address (CGA) key manager for generating a secure IPv4 address as an interface identifier of an IPv4 address of an IPv4 chip. More specifically, the PUF circuit module integrates a stimulus generation submodule for generating a stimulus and a response generation submodule for generating a response reply in response to the stimulus, several of which may constitute the secure IPv4 address. The response generation submodule is integrated with an auxiliary circuit (such as a Fuzzy inductor) for eliminating the influence of the external temperature, so as to improve the stability of the response reply and avoid the occurrence of errors.
IPv4 protocol stack module: various protocols are provided for the transmission of data packets between entities, including various computer network layer protocols such as application layer, transport layer, network layer, data link layer, physical layer, etc. In the embodiment, the method is used for communication between the IPv4 chip and the network side, and configures a 32-bit IPv4 address based on the interface identifier.
An equipment database: the IPv4 address for storing the 32-bit data includes attributes such as an interface identifier, a layer two line ID, and a user ID.
A network side: after receiving an access request sent by an IPv4 protocol stack module, comparing a 32-bit IPv4 address of an Internet of things terminal IPv4 chip with a 32-bit IPv4 address prestored in an equipment database, and if the two addresses are consistent, passing the access request of a corresponding terminal; and if the two are not consistent, rejecting the access request of the terminal.
The specific embodiment of the invention also provides an internet of things IPv4 identity authentication method based on PUF, which is realized based on the system of the invention and comprises the following steps:
(1) in the manufacturing or registration stage of the IPv4 chip, an IPv4 protocol stack module in the IPv4 chip is used for generating a 32-bit basic IPv4 address and sending a generation request of a secure IPv4 address to the PUF circuit module;
(2) after receiving a generation request of a secure IPv4 address, an excitation generation submodule of the PUF circuit module generates a random binary excitation (Challenge) and sends the random binary excitation (Challenge) to a response generation submodule; the Response generation submodule correspondingly generates a unique, random binary Response reply (Response). In the embodiment, 16 changees are input, 16 responses are correspondingly generated, and the 16 bit sequence is used as an interface identifier of an IPv4 address of an internet of things terminal IPv4 chip, namely, a secure IPv4 address;
(3) the IPv4 protocol stack module extracts the safe IPv4 address, replaces the last 16 bits of the 32-bit basic IPv4 address to form a new 32-bit IPv4 address serving as an IPv4 address of the IPv4 chip, and the IPv4 address comprises attributes such as an interface identifier, a two-layer line ID, a user ID and the like;
(4) and storing the IPv4 address of the IPv4 chip into a device database on the network side.
(5) In the identity authentication stage, an IPv4 protocol stack module in an Internet of things terminal IPv4 chip sends an IPv4 data packet to a network terminal, after the network terminal receives an access request, an IPv4 address in the IPv4 data packet is extracted and compared with an IPv4 chip prestored in an equipment database, if the IPv4 address and the IPv4 chip are consistent, authentication is passed, network node authentication, charging and the like are carried out through the access request of the terminal, and whether the data packet is finally accepted is judged; if the two are not consistent, the authentication is not passed, and the access request of the terminal is refused.
The above description is only a preferred embodiment of the present invention, and it should be noted that, for those skilled in the art, several modifications and variations can be made without departing from the technical principle of the present invention, and these modifications and variations should also be regarded as the protection scope of the present invention.
Claims (8)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010086119.0A CN111162914B (en) | 2020-02-11 | 2020-02-11 | IPv4 identity authentication method and system of Internet of things based on PUF |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010086119.0A CN111162914B (en) | 2020-02-11 | 2020-02-11 | IPv4 identity authentication method and system of Internet of things based on PUF |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111162914A true CN111162914A (en) | 2020-05-15 |
| CN111162914B CN111162914B (en) | 2023-06-16 |
Family
ID=70565562
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010086119.0A Active CN111162914B (en) | 2020-02-11 | 2020-02-11 | IPv4 identity authentication method and system of Internet of things based on PUF |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111162914B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113726720A (en) * | 2020-05-26 | 2021-11-30 | 中国电信股份有限公司 | Internet of things equipment communication method, equipment, server and communication system |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102340509A (en) * | 2011-10-24 | 2012-02-01 | 杭州华三通信技术有限公司 | Access control method and equipment for dual-stack user |
| CN104836669A (en) * | 2015-05-08 | 2015-08-12 | 东南大学 | Security authentication method based on SRAM PUF (Static Random Access Memory Physical Uncloable Function), terminal and authentication system |
| CN106777300A (en) * | 2016-12-30 | 2017-05-31 | 深圳市华傲数据技术有限公司 | Base address base construction method and system |
| US20180076957A1 (en) * | 2016-09-13 | 2018-03-15 | Hiroshi Watanabe | Network without Abuse of a Private Key |
| CN109032868A (en) * | 2018-07-26 | 2018-12-18 | 北京计算机技术及应用研究所 | A kind of physics unclonable function IP kernel automatic Verification device |
-
2020
- 2020-02-11 CN CN202010086119.0A patent/CN111162914B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102340509A (en) * | 2011-10-24 | 2012-02-01 | 杭州华三通信技术有限公司 | Access control method and equipment for dual-stack user |
| CN104836669A (en) * | 2015-05-08 | 2015-08-12 | 东南大学 | Security authentication method based on SRAM PUF (Static Random Access Memory Physical Uncloable Function), terminal and authentication system |
| US20180076957A1 (en) * | 2016-09-13 | 2018-03-15 | Hiroshi Watanabe | Network without Abuse of a Private Key |
| CN106777300A (en) * | 2016-12-30 | 2017-05-31 | 深圳市华傲数据技术有限公司 | Base address base construction method and system |
| CN109032868A (en) * | 2018-07-26 | 2018-12-18 | 北京计算机技术及应用研究所 | A kind of physics unclonable function IP kernel automatic Verification device |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113726720A (en) * | 2020-05-26 | 2021-11-30 | 中国电信股份有限公司 | Internet of things equipment communication method, equipment, server and communication system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111162914B (en) | 2023-06-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105354604B (en) | A kind of method for anti-counterfeit effectively based on physics unclonable function | |
| CN100539501C (en) | Unified identity identification and authentication method based on domain name | |
| CN103647777B (en) | Safety certificate method and bidirectional forwarding detection BFD equipment | |
| CN106549925A (en) | Prevent method, the apparatus and system of cross-site request forgery | |
| CN112019503B (en) | A method, communication entity, communication system and storage medium for obtaining device identification | |
| CN109726578B (en) | Dynamic two-dimensional code anti-counterfeiting solution | |
| CN103905194B (en) | Identity traceability authentication method and system | |
| CN112469034B (en) | Internet of things gateway device capable of safely authenticating physical sensing equipment and access method thereof | |
| CN110535877A (en) | Internet-of-things terminal identity identifying method and Verification System based on double authentication | |
| CN112235104B (en) | A data encryption transmission method, system, terminal and storage medium | |
| CN103209170A (en) | File type identification method and identification system | |
| CN114124476B (en) | A sensitive information leakage vulnerability detection method, system and device for web applications | |
| CN115150143A (en) | Industrial control equipment network access authentication method, device, equipment and storage medium | |
| CN106454814A (en) | GTP tunnel communication system and method | |
| Cao et al. | Lightweight RFID bidirectional authentication protocol based on improved hash function | |
| CN111162914A (en) | Internet of things IPv4 identity authentication method and system based on PUF | |
| CN108494764A (en) | A kind of identity identifying method and device | |
| WO2016008212A1 (en) | Terminal as well as method for detecting security of terminal data interaction, and storage medium | |
| CN104410642A (en) | Equipment access sensing method based on ARP protocol | |
| CN118174968B (en) | An explicit and implicit feature recognition device and method for an Internet of Things terminal device | |
| CN107770183A (en) | A kind of data transmission method and device | |
| CN114666074A (en) | Product identification authentication method and device | |
| CN115604162A (en) | A detection method for network security equipment | |
| CN114666129A (en) | Network security authentication method, system, computer equipment, storage medium | |
| CN111629004A (en) | Rapid authentication method for nodes of Internet of things |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |