TW202301831A - Authentication and encryption method for intelligent Internet of Things can provide simple, fast, and convenient authentication functions for the smart device that is installed with the application program, and can encrypt the authentication of the gateway to form a double protection - Google Patents

Abstract

The present invention discloses an authentication and encryption method for the intelligent Internet of Things, which includes the following steps: encrypting an authentication file; having a gateway store and decrypt the encrypted authentication file to generate an encryption functional encrypted public key; having the encrypted public key encrypt a gateway data sent from the gateway to the cloud server; having the cloud server use an encrypted private key stored therein to decrypt the gateway data transmitted from the gateway; and if the cloud server successfully decrypting the gateway data, the cloud server getting the authorization in the gateway.

Description

Smart Internet of Things authentication and encryption method

The present invention relates to an authentication and encryption method, in particular to an authentication and encryption method for an intelligent internet of things.

IoT devices have been widely used in users' lives at present, which provide users with different experiences and conveniences according to the functions of the IoT devices.

As mentioned above, in the use of IoT devices, users pair smart devices with gateways and control IoT devices through gateways. However, the procedures for pairing and authentication between smart devices and gateways are often too complicated, and when the number of paired smart devices increases, that is, when the number of users increases, errors in connection and pairing are more likely to occur. That is to say, the control right of the gateway cannot be smoothly set by the smart device.

Please refer to FIG. 6 , which is a schematic diagram of the architecture of the IoT system. In the IoT system, it includes perception layer, network layer, cloud computing layer, data analysis layer and application layer. The perception layer includes various components with sensing or identification capabilities. The network layer is connected to the Internet through wired or wireless methods, and the sensed signals and data are transmitted to the cloud computing layer and data analysis layer through the Internet for further analysis. Data processing and analysis. Since the IoT system includes various components with sensing, computing and communication capabilities, there will be a risk of data leakage if the data and signal transmission between the various layers of the IoT system is not secured.

Continuing from the above, taking the transmission between the perception layer, the network layer and the cloud computing layer as an example, the sensing element of the perception layer transmits the sensed signal to the gateway, and the gateway transmits the signal through the network layer to the The cloud computing layer and data analysis layer perform data calculations, while the network layer transmits data through wireless network technology. However, due to the open nature of the wireless transmission interface, that is, any wireless device may cause problems such as key leakage, data tampering, and identity fraud through theft.

Accordingly, how to provide an authentication and encryption method for the smart Internet of Things has become an urgent research topic.

In view of the above problems, the present invention discloses an authentication and encryption method for the smart Internet of Things, comprising the following steps: encrypting an authentication file; storing and decrypting the encrypted authentication file by the gateway to generate an encryption function of an encryption function Key; Encrypt a gateway data sent by the gateway to the cloud server by the encrypted public key; The cloud server decrypts the gateway data sent by the gateway by storing an encrypted private key ; and if the cloud server successfully decrypts the data of the gateway, the cloud server obtains an authorization of the gateway.

Based on the above, the smart Internet of Things authentication and encryption method of the present invention can provide simple, fast, and convenient authentication functions for installed smart devices through applications, and can target different smart devices without mutual interference. Users of small devices set different contextual operations according to the different functions of each IoT device. Furthermore, through the encryption mechanism, the authentication of the gateway can be encrypted, and it can form a double protection with the authentication and encryption mechanism of the smart device, so as to protect the information security of the Internet of Things system at all levels of use.

Please refer to FIG. 1 , which is a flow chart of the steps of the encryption method for the smart Internet of Things of the present invention. The encryption method for the smart internet of things includes the following steps: In step S11, the authentication file is encrypted. In step S12, the encrypted authentication file is stored and decrypted by the gateway to generate an encryption public key of an encryption function. In step S13, the gateway data transmitted from the gateway to the cloud server is encrypted by the encryption public key. In step S14, the gateway data transmitted by the gateway is decrypted by the cloud server through the stored encrypted private key. In step S15, if the cloud server successfully decrypts the data of the gateway, the cloud server obtains the authorization of the gateway.

In the embodiment of the present invention, the authentication file is encrypted by the Advanced Encryption Standard (AES; Advanced Encryption Standard) method, and is encrypted and stored in the gateway when the gateway is manufactured.

The gateway decrypts the encrypted authentication file through the firmware to generate the encryption public key of the encryption function, and the encryption private key corresponds to the encryption public key and is pre-stored in the cloud server. In the embodiment of the present invention, the encryption function is an asymmetric encryption algorithm (RSA).

In the embodiment of the present invention, one authentication file corresponds to the serial number of one gateway independently, that is, the A authentication file corresponds to the A gateway, and the B authentication file corresponds to the B gateway. If the A authentication file is stored in the B gateway, the B gateway cannot use the A authentication file to connect to the cloud server.

Please refer to FIG. 2 , which is a schematic diagram of encryption and decryption of the encryption method for the smart Internet of Things of the present invention. In the embodiment of FIG. 2 , the data transmitted from the gateway to the cloud server is encrypted with an asymmetric key encryption function. In the asymmetric encryption method, different keys are used for encryption and decryption, including the public key and the private key. The files encrypted with the public key can only be decrypted with the private key. In the encryption process of the embodiment shown in Fig. 2, the authentication file of the gateway is encrypted by the Advanced Encryption Standard and then stored in the gateway, and is decrypted by the firmware of the gateway to become the public key of the encryption function, and is used to key to send the encrypted gateway data to the cloud server, and the cloud server uses the private key to decrypt it with the decryption function. If it is successfully decrypted, it means that the authentication file sent by the gateway to the cloud server is a legal authentication file. A connection can be established between the gateway and the cloud server, that is, the cloud server can obtain the authorization of the gateway, so that the smart device can obtain the control right of the gateway through the cloud server, and further pass through the gateway controller to control IoT devices.

Please refer to FIG. 3 , which is a method flowchart of another embodiment of the smart Internet of Things authentication and encryption system of the present invention. The difference from the above embodiment is that in this embodiment, in addition to encrypting the data transmitted between the gateway and the cloud server, it further targets the data transmitted between the smart device and the cloud server Encrypt to achieve the effect of double encryption. Furthermore, in this embodiment, in addition to the encryption mechanism of double encryption, it also includes the authentication mechanism of the smart device, forming the effect of authentication and double encryption, and further strengthening the data transmission of the Internet of Things system in the network layer safety.

In this embodiment, the smart IoT authentication and encryption method includes the following steps: In step S21, the authentication file of the gateway is encrypted by the first encryption method; in step S22, the authentication file is stored and decrypted by the gateway file; in step S23, generate the first encryption public key of the second encryption method according to the decrypted authentication file; in step S24, encrypt the gateway with the first encryption public key and send it to the gateway of the cloud server Data; in step S25, encrypt with the third encryption method for the smart device data transmitted from the smart device to the cloud server; in step S26, generate the second encryption public key and The second encryption private key of the second encryption public key; in step S27, encrypt the smart device data sent to the cloud server with the second encryption public key, and store the second encryption private key to the cloud server; in step S28 , the cloud server decrypts the gateway data with the first encryption private key, and decrypts the smart device data with the second encryption private key and the third encryption method; when the cloud server successfully decrypts the gateway data and the smart device Device data, and the smart device passes the authentication of the cloud server, then the smart device obtains the control right of the gateway through the cloud server; the control right includes the context control and function control of the gateway to the IoT device.

As mentioned above, since the smart device data transmitted from the smart device to the cloud server has been encrypted by the third encryption method and the second encryption public key, in step S28, the cloud server must use the second encryption private key and the third encryption method to decrypt the action, and after successfully decrypting the smart device data through the second encryption private key, and successfully decrypting the smart device data through the third encryption method, a decryption success message is generated and encrypted And send a decryption success message to the smart device. The decrypted message returned by the cloud server is encrypted by the third encryption method and the fourth encryption method in sequence, and the decryption success message is encrypted. When the smart device receives the encrypted decryption success message, the smart device decrypts the decryption success message by the fourth encryption method and the third encryption method in sequence, and after the smart device successfully decrypts the decryption success message, The decrypted message executes the corresponding action, and the so-called execution of the corresponding action will be described in the following specification. When the smart device cannot decrypt the decryption success message by the fourth encryption method or the third encryption method, a decryption failure message is generated and an error message is displayed on the smart device.

In step S28, when the cloud server cannot decrypt the smart device data with the second encrypted private key, or cannot decrypt the smart device data with the third encryption method, it generates a decryption failure message, encrypts and sends the A decryption failure message is sent to the smart device. The cloud server encrypts the decryption failure message by the third encryption method and the fourth encryption method in sequence. When the smart device receives the encrypted decryption failure message, the smart device decrypts the decryption failure message by the fourth encryption method and the third encryption method in sequence, and after the smart device successfully decrypts the decryption failure message, The decrypted message executes the corresponding action, and the so-called execution of the corresponding action will be described in the following specification. When the smart device cannot decrypt the decryption failure message by the fourth encryption method or the third encryption method, an error message is displayed on the smart device.

In the embodiment of the present invention, the first encryption method and the third encryption method are advanced encryption standard methods, and the second encryption method and the fourth encryption method are asymmetric encryption algorithms.

Please refer to FIG. 4 , which is a schematic block diagram of the smart IoT authentication and encryption system of the present invention. The smart IoT authentication and encryption system 1 includes a smart device 11 and a gateway 12 . The gateway 12 has identification information and authorization information. The identification information, authorization information, network configuration settings and license number can be used as a gateway to transmit the gateway data to the cloud server C. The cloud server C is connected to the network, and the IoT device D is connected through a wireless communication protocol. The smart device 11 is installed with an application program 111 (APP), and the application program 111 has version information, and the smart device 11 is connected to the cloud server C through the Internet, the smart device 11 has a unique identification code, and the smart device 11 Run the application program 111, and after obtaining the identification information of the gateway 12, send it to the cloud server C through the Internet to compare the identification information, unique identification code, version information, wherein the unique identification code, version information and smart The identification data of the gateway 12 obtained by the device 11 can be used as the smart device data transmitted by the smart device 11 to the cloud server C. When the smart device 11 passes the authentication of the cloud server C, the smart device 11 can obtain the authorization information of the gateway 12, and the smart device 11 obtains through the cloud server C and the gateway 12 by running the application program 111 The control right of the IoT device D, wherein the control right includes the context control and function control of the IoT device D.

In an embodiment of the present invention, the Internet includes Message Queuing Telemetry Transport (MQTT).

In an embodiment of the present invention, the wireless communication protocol includes a home automation wireless communication protocol (Z wave), Zigbee, WiFi, Bluetooth, and the like. In an embodiment of the present invention, the gateway 12 is connected to the IoT device D through a home automation wireless communication protocol (Z wave), but it is not limited thereto, and the wireless communication protocol for connection can be selected according to user needs.

In one embodiment of the present invention, the identification information is a two-dimensional barcode of the gateway 12 .

In one embodiment of the present invention, the authorization information is the license number (license) of the gateway 12 . In addition, in the embodiment of the present invention, the smart IoT authentication and encryption system 1 can provide users with different versions of the gateway 12 to support the number of connected IoT devices D and the number of setting context controls according to different license numbers.

In one embodiment of the present invention, the gateway 12 includes a network configuration setting value, so that users can configure network connection settings. The default value is Dynamic Host Configuration Protocol (Dynamic Host Configuration Protocol; DHCP. In addition, in another embodiment of the present invention, the setting value of network configuration also supports fixed IP address, so that users can set in the road environment.

The application 111 running on the smart device 11 obtains the serial number of the gateway 12 after scanning the two-dimensional barcode of the gateway 12 through the smart device 11 .

The application program 11 running on the smart device 11 has a login page, and when the smart device 11 activates the login page, the version information of the application program 111 is sent to the cloud server C, and the version information is compared by the cloud server C, and After the comparison is completed, the verification message is sent back to the smart device 11 . When the version information of the application program 111 does not match the version information stored in the cloud server C, the cloud server C will forcefully update the application program 111, otherwise the smart device 11 cannot use the application program 111 to connect to the cloud server C.

The login page includes account registration information, and the account registration information is sent to the cloud server C for application through the Internet with the mobile phone number of the smart device 11 . Furthermore, since more than one gateway 12 may be used, when the user wants to register and apply for an account, he uses the smart device 11 to scan the two-dimensional barcode of the gateway 12 to obtain the serial number of the gateway 12, and After the user applies for an account, it is sent to the cloud server C through the Internet together with the user information to verify whether the user has the right to use the gateway 12 . After the cloud server C confirms that the smart device 11 is a legitimate device and has the right to use the gateway 12, the cloud server C confirms the account registration information and the mobile phone number of the smart device 11 to further store the account registration information Correspondence with the gateway 12 license number (Mapping).

Based on the above, in order to ensure the singleness of the smart device 11 in the control of the gateway 12, that is, at the same time, the same account can only log in on one smart device 11, so as to ensure that the Internet of Things The performance and safety of device D in control. Further, when the user uses the smart device 11 to install the application program 111, the application program 111 will request the smart device 11 to provide a unique device identification code (UDID; Unique Device Identifier), and send it to the The database (Database) storage of the cloud server C. When the user logs in the application program 111 through the smart device 11 , the smart device 11 will send the unique device identification code to the cloud server C for comparison through the application program 111 , and return the comparison result to the smart device 11 . When the comparison result is abnormal, the cloud server C sends an update request to the smart device 11, indicating that the user may have replaced the smart device 11, or the smart device 11 has an illegal login situation. Accordingly, the smart device 11 is verified by the verification program to ensure the single device of the smart device 11 in use.

Based on the above, the smart IoT authentication and encryption system 1 of the present invention includes a push function for notifying each smart device 11 of the status of applying to join the IoT system. For example, when the user uses the smart device 11 to activate the login page, a token (Token) information will be generated, and the token information is sent to the cloud server C corresponding to the user registration information, and when the user completes the registration or refuses to register, etc., The cloud server C sends a notification signal to the smart device 11 of the user for the tag information, so as to complete the corresponding verification procedure.

In one embodiment of the present invention, identity setting can be further performed on the smart device 11 joining the Internet of Things system, and different permissions and functions can be given according to different identities. Further, the cloud server C judges whether the smart device 11 is the master device (Administrator) according to the pairing data of the gateway 12 and the smart device 11, and gives the wisdom when the smart device 11 is the master device. The type device 11 has the functions of adding, removing, naming and editing the IoT device D. Further, when the smart device 11 is the master device, the smart device 11 sends a device addition or removal request to the gateway 12, and after the gateway 12 receives the addition or removal request , the gateway 12 starts the pairing mode with the IoT device D, and completes adding or removing the IoT device D in the pairing mode. For the function of naming and editing the IoT device D, the smart device 11 of the main control device sends a naming or editing request to the cloud server C to complete the action of naming and editing the IoT device D.

Please refer to FIG. 5 , which is a schematic diagram of identity recognition of the smart Internet of Things authentication and encryption system of the present invention. Based on the above, the same smart device 11 can have different identities in different gateways 12 . For example, the A1 smart device 11 is the master device identity in the B1 gateway 12, the user identity in the B2 gateway 12, the A2 smart device 11 is the user identity in the B1 gateway 12, The identity of the master device in the B2 gateway 12 . In addition, if there is no other smart device 11 to join the pairing when the smart device 11 joins the gateway 12, that is, the smart device 11 is the first to join the pairing, then the smart device 11 is automatically set as The main control device of the gateway 12. Furthermore, the identity of the master control device and the identity of the user can also be switched. For example, after the smart device 11 as the user obtains the access code of the gateway 12, it can switch the identity with the smart device 11 as the master device.

Based on the above, the smart IoT authentication and encryption system 1 can set different usage scenarios according to the functions of the IoT device D. For example, when the IoT device D is a desk lamp that can adjust the brightness of the light source, the smart device 11 can adjust and control its lighting intensity according to the user's work and rest time, set it as a use situation, and use the use situation and the corresponding set The smart device is stored in the cloud server C.

Furthermore, the smart IoT authentication and encryption system 1 can further combine speech analysis and recognition interfaces to use contextual control of various IoT devices D. For example, there are currently three scenarios stored in the cloud server C. When the user wants to enable the context control of the first type of IoT device D, the first type of context control can be enabled through the voice analysis and recognition interface, and the rest of the IoT devices D Contextual manipulation of can also be enabled in this way.

As mentioned above, after the smart device successfully decrypts the decryption failure message or the decryption success message, it performs corresponding actions on the so-called decrypted message. For example, in the above content, the smart device 11 transmits the version of the application 111 when starting the login page When the information is sent to the cloud server C, the smart device 11 will encrypt the version information of the application program 111, and decrypt it through the cloud server C, and compare the version information after the decryption is successful, and compare After completion, the verification message is encrypted and sent back to the smart device 11 for decryption by the smart device 11 . The operations related to encryption and decryption are as described above and will not be repeated here. In addition, here only the version information and verification information of the application program 111 are used as an example for encryption and decryption. In fact, in the above-mentioned embodiments, any data transmission between the smart device 11 and the cloud server C, and the gateway Any data transmission between the server 12 and the cloud server C can be encrypted and decrypted through the above-mentioned encryption and decryption process, which will not be repeated here.

To sum up, the smart Internet of Things authentication and encryption method of the present invention can provide simple, fast and convenient authentication functions for installed smart devices through the application program, and can target different smart devices without interfering with each other. Users of small devices set different contextual operations according to the different functions of each IoT device. Furthermore, through the encryption mechanism, the authentication of the gateway can be encrypted, and it can form a double protection with the authentication and encryption mechanism of the smart device, so as to protect the information security of the Internet of Things system at all levels of use.

S11~S15: Steps S21~S28: Steps 1: Smart IoT authentication and encryption system 11:Smart device 111: Apps 12: Gateway C: Cloud server D: IoT device A1: Smart device A2: Smart Device B1: Gateway B2: Gateway

Fig. 1 is a flow chart of the steps of the encryption method for the smart internet of things of the present invention; Fig. 2 is a schematic diagram of encryption and decryption of the smart Internet of Things encryption method of the present invention; Fig. 3 is a method flowchart of another embodiment of the intelligent Internet of Things authentication and encryption system of the present invention; Fig. 4 is a schematic block diagram of the intelligent Internet of Things authentication and encryption system of the present invention; Fig. 5 is a schematic diagram of the identification of the smart Internet of Things authentication and encryption system of the present invention; and FIG. 6 is a schematic diagram of the architecture of the Internet of Things system.

S11~S15: Steps

Claims (22)

A kind of intelligent Internet of Things encryption method comprises the following steps: encryption-authentication file; storing and decrypting the encrypted authentication file by the gateway to generate an encryption public key of an encryption function; Encrypting a gateway data transmitted by the gateway to the cloud server by the encryption public key; the cloud server decrypts the gateway data transmitted by the gateway by storing an encrypted private key; and If the cloud server successfully decrypts the data of the gateway, the cloud server obtains an authorization of the gateway. The smart IoT encryption method as described in Claim 1, wherein the authentication file is encrypted by an Advanced Encryption Standard method. The smart IoT encryption method as described in Claim 2, wherein the gateway decrypts the encrypted authentication file through a firmware to generate the encryption public key of the encryption function. The smart Internet of Things encryption method as described in Claim 1, wherein the encryption function is an asymmetric encryption algorithm. The smart IoT encryption method as described in Claim 1, wherein the authentication file corresponds to a serial number of the gateway. A kind of intelligent Internet of things authentication and encryption method comprises the following steps: Encrypting an authentication file of a gateway by a first encryption method; storing and decrypting the authentication file by the gateway; Generate a first encryption public key of a second encryption method according to the decrypted authentication file; Encrypting a gateway data transmitted by the gateway to the cloud server by the first encrypted public key; A third encryption method is used to encrypt the data of the smart device transmitted from the smart device to the cloud server; generating a second encryption public key with a fourth encryption method and generating a second encryption private key corresponding to the second encryption public key; Encrypt the smart device data transmitted to the cloud server with the second encryption public key, and store the second encryption private key in the cloud server; and The cloud server decrypts the gateway data by storing a first encrypted private key, and decrypts the smart device data by using the second encrypted private key; Wherein, when the cloud server successfully decrypts the data of the gateway and the data of the smart device, and the smart device passes the authentication of the cloud server, the smart device obtains one of the gateways through the cloud server. Control; Wherein the control right includes context control and function control of an Internet of Things device by the gateway. The smart IoT authentication and encryption method as described in claim 6, wherein the smart device data includes a unique identification code of the smart device, a version information of an application program, and the gateway obtained by the smart device One of the identifying information. In the smart IoT authentication and encryption method as described in Claim 6, wherein the gateway data includes a network configuration setting value and a permission number. In the smart IoT authentication and encryption method described in claim 6, the first encryption method and the third encryption method are an advanced encryption standard method. In the smart IoT authentication and encryption method described in Claim 6, the second encryption method and the fourth encryption method are an asymmetric encryption algorithm. The smart IoT authentication and encryption method as described in claim 10, wherein the gateway decrypts the encrypted authentication file through a firmware to generate the first encrypted public key of the asymmetric encryption algorithm. The smart IoT authentication and encryption method as described in claim 6, wherein the authentication file is independently corresponding to the gateway. The smart IoT authentication and encryption method as described in claim 7, wherein the application program has a login page, and the version information is sent to the cloud server when the smart device activates the login page, and through the The cloud server compares the version information. The smart Internet of Things authentication and encryption method as described in claim 13, wherein the login page includes an account registration information, and the account registration information is sent to the cloud server through an Internet with a mobile phone number of the smart device device application. The smart IoT authentication and encryption method as described in claim 6, wherein when the cloud server successfully decrypts the smart device data through the second encryption private key, and successfully decrypts the smart device data through the third encryption method After receiving the data of the smart device, a decryption success message is generated, and the decryption success message is encrypted and sent to the smart device. The smart IoT authentication and encryption method as described in claim 15, wherein the cloud server encrypts the decryption success message by the third encryption method and the fourth encryption method in sequence. The smart IoT authentication and encryption method as described in claim 16, wherein the smart device decrypts the decryption success message by the fourth encryption method and the third encryption method in sequence, and the smart device successfully decrypts the message After the successful decryption message, the smart device executes corresponding actions according to the successful decryption message. The smart IoT authentication and encryption method as described in claim 16, wherein when the smart device cannot decrypt the decryption success message by the fourth encryption method or the third encryption method, a decryption failure message is generated, and An error message is displayed on the smart device. The smart IoT authentication and encryption method as described in claim 6, wherein when the cloud server cannot decrypt the smart device data by the second encrypted private key, or cannot decrypt the smart device data by the third encryption method After the smart device data is generated, a decryption failure message is generated, and the decryption failure message is encrypted and sent to the smart device. The smart IoT authentication and encryption method as described in claim 19, wherein the cloud server encrypts the decryption failure message sequentially by the third encryption method and the fourth encryption method. The smart IoT authentication and encryption method as described in claim 20, wherein the smart device decrypts the decryption failure message by the fourth encryption method and the third encryption method in sequence, and the smart device successfully decrypts the message After the decryption failure message, the smart device executes corresponding actions according to the decryption failure message. The smart IoT authentication and encryption method as described in claim 20, wherein when the smart device cannot decrypt the decryption failure message by the fourth encryption method or the third encryption method, it is displayed on the smart device an error message.

Images