CN108616504A - A kind of sensor node identity authorization system and method based on Internet of Things - Google Patents

Abstract

The invention discloses a sensor node identity authentication system based on the Internet of Things, which includes an authentication server, a device management center, a security gateway, and at least one sensor node; the sensor node is connected to the security gateway for sending authentication information to the A security gateway; the security gateway is connected to the authentication server, and is used to send the authentication information together with the gateway number to the authentication server; the authentication server is connected to the device management center, and is used to authenticate the authentication information After the authentication is completed, an identity token is generated, the identity token is returned to the sensor node, and the authenticated sensor node is stored in the device management center. In addition, the present invention also discloses a sensor node identity authentication method based on the Internet of Things to ensure two-way authentication between the sensor node and the Internet of Things common support platform, improve the authentication efficiency of the sensor nodes, and reduce the networking time of the Internet of Things.

Description

A sensor node identity authentication system and method based on the internet of things

technical field

The invention belongs to the field of the Internet of Things and information security, and specifically relates to a sensor node identity authentication system and method based on the Internet of Things. Under the common support platform of the Internet of Things, for the authentication of the legality of a newly connected sensor node identity, the sensor node is guaranteed Node data and state security.

Background technique

In the Internet of Things environment, things are interconnected and information is exchanged, and sensor nodes also have the ability to receive, transmit, and process data and commands. However, due to the high security requirements of the data transmitted in the Internet of Things, the identity of sensor nodes, one of the most important components of the Internet of Things, needs to be effectively authenticated when accessing the common supporting platform of the Internet of Things. Without secure identity authentication, attackers are very likely to use forged nodes to enter the IoT platform, posing a great threat to the security of the platform and its data.

Faced with the rapid development of the Internet of Things platform system, sensor nodes will perform access requirements and identity authentication in a blowout manner, requiring a faster and safer node authentication method.

However, the existing sensor node authentication methods cannot provide a large number of nodes for plug-and-play without additional allocation of identity authentication methods, which fail to provide identity authentication based on the characteristics of the nodes themselves. , requires manual operation and intervention, takes a lot of networking time, and greatly reduces the working efficiency of networking.

Contents of the invention

In order to solve the above-mentioned problems existing in the prior art, the present invention provides a sensor node identity authentication system and method based on the Internet of Things to ensure two-way authentication between the sensor node and the common supporting platform of the Internet of Things, and improve the authentication efficiency of the sensor node and reduce the IoT networking time.

The technical problem to be solved in the present invention is realized through the following technical solutions:

An embodiment of the present invention provides a sensor node identity authentication system based on the Internet of Things, including an authentication server, a device management center, a security gateway, and at least one sensor node;

The sensor node is connected to the security gateway for sending authentication information to the security gateway;

The security gateway is connected to the authentication server, and is used to send the authentication information together with the gateway number to the authentication server;

The authentication server is connected to the device management center for authenticating the authentication information, generates an identity token after the authentication is completed, returns the identity token to the sensor node, and stores the authenticated sensor node in the Device Management Center.

The embodiment of the present invention also provides a sensor node identity authentication method based on the Internet of Things, including:

S1. Initialize the sensor node information list to be authenticated;

S2. Receive the authentication information sent by the sensor node to be authenticated;

S3. Perform a first decryption operation on the authentication information. If the first decryption operation fails, it is determined that the authentication has failed, and the authentication is exited; if the first decryption operation is successful, the sensor node identity information, initial time stamp, and node unique identification code are obtained. , execute step S4;

S4. Judging whether there is an identity token in the identity information of the sensor node to be authenticated, if so, then judging that the authentication is completed, if not, then performing step S5;

S5. Judging whether the initial time stamp is valid, if not, judging that the authentication has failed, and exiting the authentication; if so, executing step S6;

S6. Query the public key generated by the attribute of the sensor node according to the unique identification code of the node, and perform a second decryption operation on the identity information of the sensor node. If the second decryption operation fails, it is determined that the authentication fails and exits the authentication; if the second If the decryption operation is successful, the decrypted identity information is obtained, and step S7 is executed;

S7. Generate a new identity token and a new authentication time stamp according to the decrypted identity information, store the decrypted identity information, and send the new identity token and new authentication time stamp to the sensor to be authenticated node.

In a specific embodiment, the authentication information includes: the identity information of the sensor node and the initial time stamp of the sensor node encrypted sequentially by the public key of the common support platform of the Internet of Things and the private key generated by the attribute of the sensor node.

In a specific embodiment, the step S4 also includes:

It is judged whether the identity token of the sensor node to be authenticated has expired, and if yes, step S5 is executed.

In a specific embodiment, the step S7 also includes:

Set a token expiration time for the new identity token sent to the sensor node to be authenticated, and if it is judged that the token of the sensor node is invalid, send re-authentication information to the invalid sensor node.

In a specific embodiment, after the step S7, it also includes:

When it is judged that the authentication of the predetermined number of sensor nodes is completed, each sensor node after authentication is used to obtain an authentication circle, and the sensor node to be authenticated is authenticated according to the authentication circle.

In a specific embodiment, authenticating the sensor node to be authenticated according to the authentication circle includes:

When a new sensor node to be authenticated requests authentication, calculate the distance between the new sensor node to be authenticated and the authentication circle, and when it is judged that the new sensor node to be authenticated belongs to the authentication circle, It is judged that the authentication is completed.

In a specific embodiment, authenticating the sensor node to be authenticated according to the authentication circle includes:

When a new sensor node to be authenticated requests authentication, calculate the distance between the new sensor node to be authenticated and the authentication circle, and when it is judged that the new sensor node to be authenticated does not belong to the authentication circle, And when it is found that no node is connected, it is determined that the authentication fails.

Compared with prior art, the beneficial effect of the present invention:

1. In the method of the present invention, the sensor node encrypts the identity information with a key generated by its own attributes, and the public key of the key pair is stored in the common support platform of the Internet of Things, and the private key is not stored. Since the properties of all sensor node devices are different, third parties outside the IoT platform cannot generate equally valid identity information, which ensures the unique validity and legitimacy of identity information.

2. In the method of the present invention, the sensor node identity information can only be obtained by the Internet of Things platform of the present invention, that is, the sensor node uses the public key of the Internet of Things platform to encrypt the platform feature code to ensure that the sensor node will not be authenticated by an unauthorized third-party platform outside the platform, The information will not be obtained by a third party, achieving the effect of two-way authentication between the sensor node and the IoT platform.

3. In the method of the present invention, after the sensor node is successfully authenticated, the node identity information corresponds to the security gateway connected to the node, which facilitates the Internet of Things platform to set corresponding access rights according to different security gateways and different device types, and ensures that the sensor node is authenticated every time. Access is authorized, so that the data collected by sensor nodes will not be obtained by unauthorized third parties in the Internet of Things platform, and under the condition of a certain number of security nodes with known identities, fast security authentication can be realized for unknown nodes , its certification is simple, safe and reliable, with high application prospects and market value.

Description of drawings

Fig. 1 is a block diagram of a sensor node identity authentication system based on the Internet of Things provided by an embodiment of the present invention;

Fig. 2 is a schematic diagram of the internal structure of a sensor node of the present invention;

Fig. 3 is a kind of flow chart of the sensor node identity authentication method based on Internet of Things provided by the embodiment of the present invention;

FIG. 4 is a schematic diagram of a method for quickly authenticating a subsequent node according to an embodiment of the present invention.

Detailed ways

The present invention will be described in further detail below in conjunction with specific examples, but the embodiments of the present invention are not limited thereto.

Embodiment one

Please refer to FIG. 1. FIG. 1 is a module block diagram of a sensor node identity authentication system based on the Internet of Things provided by an embodiment of the present invention, including an authentication server, a device management center, a security gateway, and at least one sensor node;

The sensor node is connected to the security gateway for sending authentication information to the security gateway;

The security gateway is connected to the authentication server, and is used to send the authentication information together with the gateway number to the authentication server;

As a security gateway connected to the platform in different scenarios in the common support platform of the Internet of Things, the security gateway is deployed in different scenarios as required. The security gateway has the authority to send and receive data to the sensor node. The sensor node is in The authentication process and the subsequent data interaction process all communicate with the security gateway exclusively, and do not accept commands from other security gateways, that is to say, each sensor node corresponds to a unique security gateway, which is identified by the gateway number.

In this embodiment, the security gateway is responsible for the interaction between the Internet of Things common support platform and the sensor node data. When the security gateway receives the authentication message A sent by the subordinate node, it assigns the node sequence Us to the node as a security gateway to identify the identity of the subordinate node After the update data is responsible for sending to the IoT platform; when the security gateway receives the information returned by the IoT platform, it retrieves the node sequence Us and sends the information to the corresponding node.

The authentication server is connected to the device management center for authenticating the authentication information, generates an identity token after the authentication is completed, returns the identity token to the sensor node, and stores the authenticated sensor node in the Device Management Center.

The device management center manages the detailed information of all security gateways in the management platform and the identity information of all sensor nodes under the security gateway, and adds the verified sensor node identity information under the security gateway to which it belongs according to the requirements of the authentication server. The authentication server receives the authentication message A sent by the security gateway, and authenticates the authenticity and validity of A according to the corresponding policy. After the authentication is successful, it generates the identity token Uauth and the authentication timestamp Tauth, and is responsible for managing the expiration time of the identity token.

Specifically, in one embodiment, both the device management center and the authentication server are on a common support platform of the Internet of Things; the sensor node accesses the security gateway, and obtains the authentication of the authentication server through the security gateway; Described sensor node comprises CPU, sensor, safety SoC (System on Chip system level chip) chip, memory, I/O interface etc., please refer to Fig. 2, Fig. 2 is a schematic diagram of internal structure of a sensor node; Described safety SoC chip stores It includes the feature code of the common support platform of the Internet of Things, the identity information encrypted by the private key generated by the node's own attributes, the unique identification code of the sensor node, and the initial time stamp. The data stored in the above-mentioned secure SoC chip should be stored in the sensor node in an encrypted manner, and the key is the public key disclosed by the Internet of Things common support platform. The identity information carried by the sensor node itself includes the sensor node type, the sensor node security level, and the sensor node control command type. The memory in the sensor node stores the identity token that the authentication server sends to the sensor node after successful authentication in the future and other information that the sensor needs to store.

In a specific implementation scenario, the sensor node authentication process specifically includes the following steps:

Step 1. When the system is running, the sensor node and the security gateway are started. The sensor node confirms that the identity information stored in ciphertext is available, and the security gateway confirms that the security gateway number is available; the device management center confirms that the node information list is legal and available, and confirms that the security gateway management Table legally available. The node information list includes the unique identification code of the sensor node and the public key generated according to its own attributes, and the security gateway management table includes all security gateway information under the Internet of Things common support platform and all sensor node identity information under each security gateway.

Step 2: The sensor node sends the authentication information A, merges with the security gateway number Sid when passing through the security gateway, and obtains the node sequence Us assigned by the security gateway to the node, updates the authentication information A, and sends it to the authentication server. Among them, the authentication information A is obtained by secondary encryption from the sensor node identity information C and the common support platform feature code Tid of the Internet of Things, the unique identification code Uid of the sensor node and the initial time stamp T1. The generated private key Pra and the public key Pub of the Internet of Things common support platform, the encryption method is E[Pub,E(Pra,C)||Tid||Uid||T1], after passing through the security gateway and merging with the security gateway number The authentication message A is updated to E[Pub,E(Pra,C)||Tid||Uid||T1]||Sid||Us, and the authentication message A is sent to the authentication server.

Step 3: After receiving the authentication message A, the authentication server decrypts the authentication message A using the private key Prb of the common supporting platform of the Internet of Things, and obtains the decrypted message B after successful decryption. Then verify the legitimacy of the initial timestamp T1, platform feature code Tid, and sensor unique identification code Uid. After successful verification, the sensor node identity information C is obtained, and the identity token Uauth and authentication timestamp Tauth are generated according to the identity information C, and returned to the sensor node. . At the same time, the identity information is sent to the device management center according to the security gateway number Sid.

Step 4: The sensor node receives the identity token Uauth and the authentication time stamp, and stores it in the SoC of the security chip in the node as a credential for subsequent data interaction. The security chip stores the identity information C of the node, and stores data that cannot be used by a third party, such as the identity token Uauth and the authentication time stamp Tauth, into the node memory. Therefore, the requirement on the capacity of the secure SOC chip is reduced.

In the method of the present invention, the sensor node uses the key generated by its own attribute to encrypt the identity information, the public key of the key pair is stored in the Internet of Things common support platform, and the private key is not stored. Since the properties of all sensor node devices are different, third parties outside the IoT platform cannot generate equally valid identity information, which ensures the unique validity and legitimacy of identity information.

In addition, the sensor node identity information can only be obtained by the Internet of Things platform of the present invention, that is, the sensor node uses the public key of the Internet of Things platform to encrypt the platform feature code, so as to ensure that the sensor node will not be authenticated by an unauthorized third-party platform outside the platform, and the information will not be stolen. Obtained by a third party to achieve the effect of two-way authentication between the sensor node and the IoT platform.

Embodiment two

Please refer to FIG. 3 for the process of authenticating the identity of the sensor node by the authentication server. FIG. 3 is a flow chart of a method for authenticating the identity of a sensor node based on the Internet of Things provided by an embodiment of the present invention, including:

S1. Initialize the sensor node information list to be authenticated;

Among them, the system is initialized first, each sensor node to be authenticated and the security gateway used to transmit data are started, the authentication server initializes the sensor node information list, the device management center initializes and the list of security gateways and corresponding nodes, and the sensor node is initialized to ensure The sensor node confirms that the identity information stored in ciphertext is available, and the security gateway confirms that the security gateway number is available; the device management center confirms that the node information list is legally available, and that the security gateway management table is legally available.

S2. Receive the authentication information sent by the sensor node to be authenticated;

Wherein, the sensor node sends the authentication information to the authentication server via the security gateway in the IoT platform networking system, and the authentication server receives the authentication information. The authentication information is composed of the sensor node identity information and the sensor node initial time stamp after being encrypted sequentially by the public key of the common support platform of the Internet of Things and the private key generated by the sensor node attributes; the sensor node identity information includes the node's own information and the Internet of Things common support platform feature code. When passing through the security gateway, the authentication information is spliced with the security gateway number.

After receiving the authentication message A, the authentication server uses the private key Prb of the Internet of Things common support platform to decrypt A, and the method is D[Prb,E(Pra,C)||Tid||Uid||T1]||Sid|| Us, get the IoT platform feature code Tid, the unique identification code Uid of the sensor node, and the initial timestamp T1.

S3. Perform a first decryption operation on the authentication information. If the first decryption operation fails, it is determined that the authentication has failed, and the authentication is exited; if the first decryption operation is successful, the sensor node identity information, initial time stamp, and node unique identification code are obtained. , execute step S4;

Among them, the authentication server receives the authentication information, uses the public key of the Internet of Things common support platform to decrypt the authentication information for the first time, and obtains the characteristic code of the Internet of Things platform, the initial time stamp of the device, and the unique identification code of the sensor node. If the decryption fails or the decrypted feature code fails to match, the authentication fails.

The authentication server verifies whether the Internet of Things platform feature code Tid obtained in the previous step matches the feature code TID saved by the authentication server, if Tid=TID, then executes the next step, if not, it proves that the sensor node is not applicable to the Internet of Things platform, Authentication failed.

S4. Judging whether there is an identity token in the identity information of the sensor node to be authenticated, if so, then judging that the authentication is completed, if not, then performing step S5;

Wherein, when it is judged that there is an identity token but the identity token has expired, step S5 is performed.

That is, it is judged whether the encrypted information contains the identity token Uauth and whether Uauth is available.

S5. Judging whether the initial time stamp is valid, if not, judging that the authentication has failed, and exiting the authentication; if so, executing step S6;

That is to judge whether the initial timestamp T1 obtained by decryption is valid. If the initial timestamp T1 is abnormal, it proves that the security of the node needs to be verified, and the authentication fails.

S6. Query the public key generated by the attribute of the sensor node according to the unique identification code of the node, and perform a second decryption operation on the identity information of the sensor node. If the second decryption operation fails, it is determined that the authentication fails and exits the authentication; if the second If the decryption operation is successful, the decrypted identity information is obtained, and step S7 is executed;

Use the decrypted node unique identification code Uid to query the node public key Pua. If the node unique identification code is invalid or the node public key Pua cannot be queried, it proves that the availability of the node needs to be verified, and the authentication fails. If the node public key Pua is queried, then Use the node public key Pua to decrypt the message B for the second time, and the decryption method is D(Pua,C).

S7. Generate a new identity token and a new authentication time stamp according to the decrypted identity information, store the decrypted identity information, and send the new identity token and new authentication time stamp to the sensor to be authenticated node.

Specifically, the node identity token Uauth and the authentication timestamp Tauth are generated according to the node identity information C, the identity token Uauth and the authentication timestamp Tauth are returned to the sensor node, and the node identity information C is written into the device management according to the security gateway number Sid center.

In a specific embodiment, the step S7 also includes:

Set a token expiration time for the new identity token sent to the sensor node to be authenticated, and if it is judged that the token of the sensor node is invalid, send re-authentication information to the invalid sensor node.

In order to ensure higher security requirements, the authentication server can set different token expiration times for the security levels of the authenticated sensor nodes stored in the system. Afterwards, the sensor whose identity token expires sends information to the server, and the server requires the sensor to re-authenticate, and updates the token stored by the node after success.

In one embodiment, the Internet of Things platform can set different security authentication schemes according to the security level of the sensor node obtained during the initial authentication. For example, a shorter valid time of the identity token can be set for a sensor node with a higher security level, and the valid time of sensor node a is set to Ta. After the initial verification is successful, when the sensor node passes the authentication server during the data interaction process, the authentication server Verify the validity of the timestamp Tauth. If the current time Tc-Tauth>Ta, it indicates that the identity token is invalid, and the sensor node a needs to perform identity authentication again. This measure can ensure that different security measures are set for different types of sensor nodes according to their types. While ensuring the security of node identities, the number of verifications is reduced due to the flexibility of verification strategies, thereby improving the overall authentication of sensor nodes in the IoT platform. time.

In a specific embodiment, after the step S7, it also includes:

When it is judged that the authentication of the predetermined number of sensor nodes is completed, each sensor node after authentication is used to obtain an authentication circle, and the sensor node to be authenticated is authenticated according to the authentication circle.

According to the authentication circle field, the sensor node to be authenticated is authenticated, including:

When a new sensor node to be authenticated requests authentication, calculate the distance between the new sensor node to be authenticated and the authentication circle, and when it is judged that the new sensor node to be authenticated belongs to the authentication circle, It is judged that the authentication is completed.

According to the authentication circle field, the sensor node to be authenticated is authenticated, including:

When a new sensor node to be authenticated requests authentication, calculate the distance between the new sensor node to be authenticated and the authentication circle, and when it is judged that the new sensor node to be authenticated does not belong to the authentication circle, And when it is found that no node is connected, it is determined that the authentication fails.

Among them, after completing the authentication of a batch of sensor nodes, the current K-means algorithm is used to calculate the center points of several types of nodes and draw a circle. When a new node requests authentication, calculate the distance between the new node and the central point. If it belongs to the currently known type of node, it will pass the authentication. If it does not belong to the range of the current type of node, then query whether there is a new type of node access object Internet platform, otherwise it will not pass the certification.

In order to illustrate this implementation manner more clearly, please refer to FIG. 4 , which is a schematic diagram of a method for quickly authenticating a subsequent node in an embodiment of the present invention.

After completing the authentication of a batch of sensor nodes, use the flow K-means algorithm to calculate the center points of several types of nodes and draw a circle, as shown in r1 and r2 in the figure. When a new node requests authentication, calculate the distance between the new node and the center point. If it belongs to the currently known type of node, it will pass the authentication. If node p2 is within the range of r1, it will pass the authentication; if it does not belong to the range of the current type of node , then query whether there is a new type of node connected to the IoT platform, otherwise the authentication will not be passed. If the node p1 does not belong to the currently known type of node, the authentication will not be performed immediately.

Through the above method, in the authentication process of new nodes, in the case of verifying known nodes of the same type, identity authentication is performed through quick authentication, and in the case of verifying unknown attribute type nodes, cautious authentication is used until the node is confirmed Trusted or untrusted, the embodiment of the present invention can guarantee the trusted identity of the node under the condition of fast sensor authentication and rapid assembly of the Internet of Things platform.

In the method of the present invention, after the sensor node is authenticated successfully, the node identity information corresponds to the security gateway connected to the node, which facilitates the Internet of Things platform to set corresponding access rights according to different security gateways and different device types, and ensures that each access of the sensor node is guaranteed. It is authorized, so that the data collected by the sensor nodes will not be obtained by unauthorized third parties in the IoT platform, and under the condition of a certain number of security nodes with known identities, it can quickly and securely authenticate unknown nodes. The certification is simple, safe and reliable, with high application prospects and market value.

The above content is a further detailed description of the present invention in conjunction with specific preferred embodiments, and it cannot be assumed that the specific implementation of the present invention is limited to these descriptions. For those of ordinary skill in the technical field of the present invention, without departing from the concept of the present invention, some simple deduction or replacement can be made, which should be regarded as belonging to the protection scope of the present invention.

Claims (8)

1. a kind of sensor node identity authorization system based on Internet of Things, which is characterized in that including certificate server, equipment pipe Reason center, security gateway, at least one sensor node；

The sensor node connects the security gateway, for sending authentication information to the security gateway；

The security gateway connects the certificate server, for the authentication information to be sent to the certification together with gateway number Server；

The certificate server connects the equipment management center, for being authenticated to the authentication information, after the completion of certification Identity token is generated, the identity token is returned into the sensor node, and the sensor node after the certification is stored in The equipment management center.

2. a kind of sensor node identity identifying method based on Internet of Things, which is characterized in that including：

S1, initialization sensor node information list to be certified；

S2, the authentication information that the sensor node to be certified is sent is received；

S3, the first decryption operation is carried out to the authentication information, if the first decryption operation failure, judges authentification failure, exit Certification；If the first decryption operation success, obtains sensor node identity information, initial time stamp, nodes unique identifier, holds Row step S4；

S4, judge that the sensor node identity information to be certified whether there is identity token, if so, judgement certification is completed, If it is not, thening follow the steps S5；

S5, judge whether the initial time stamp is effective, if it is not, then judging authentification failure, exit certification；If so, executing step Rapid S6；

S6, the public key that sensor node attribute generation is inquired according to the nodes unique identifier, to the sensor node Identity information carries out the second decryption operation, if the second decryption operation failure, judges authentification failure, exit certification；If the second solution Close operation success, then obtain decryption identity information, execute step S7；

S7, new identity token and new authenticated time stamp are generated according to the decryption identity information, store the decryption identity Information, and the new identity token and new authenticated time stamp are sent to the sensor node to be certified.

3. the sensor node identity identifying method according to claim 2 based on Internet of Things, which is characterized in that described to recognize Demonstrate,proving information includes：By Internet of Things general character support platform public key and the private key of sensor node attribute generation successively encrypted biography Sensor node identity information and sensor node initial time stamp.

4. the sensor node identity identifying method according to claim 2 based on Internet of Things, which is characterized in that the step Suddenly S4 further includes：

Judge whether the identity token of the sensor node to be certified is expired, if so, thening follow the steps S5.

5. the sensor node identity identifying method according to claim 2 based on Internet of Things, which is characterized in that the step Suddenly S7 further includes：

The token out-of-service time is arranged in the new identity token to being sent to the sensor node to be certified, if described in judging The token of sensor node fails, then send re-authentication information to the failure sensor node.

6. the sensor node identity identifying method according to claim 2 based on Internet of Things, which is characterized in that the step Further include after rapid S7：

When judging that predetermined quantity sensor node certification is completed, recognized using each sensor node after the completion of certification Card circle domain is justified domain according to the certification and is authenticated to sensor node to be certified.

7. the sensor node identity identifying method according to claim 6 based on Internet of Things, which is characterized in that according to institute Certification circle domain is stated to be authenticated sensor node to be certified, including：

When there is new sensor node to be certified to ask certification, the new sensor node to be certified and the certification are calculated The distance between circle domain, when judging that the new sensor node to be certified belongs to the certification circle domain, judgement certification is completed.

8. the sensor node identity identifying method according to claim 6 based on Internet of Things, which is characterized in that according to institute Certification circle domain is stated to be authenticated sensor node to be certified, including：

When there is new sensor node to be certified to ask certification, the new sensor node to be certified and the certification are calculated Circle the distance between domain when judging that the new sensor node to be certified is not belonging to certification circle domain, and inquires not When having node access, then authentification failure is judged.