Summary of the invention
The present invention provides the method for managing security of a kind of Internet of things system and Internet of things system, to solve the fusion problem of Internet of Things and telecommunications network.
In order to address the above problem, the invention discloses a kind of Internet of things system, comprising: local Internet of Things, Access Network, core net and Internet of Things server, wherein,
Local Internet of Things comprises Internet of Things router and the node device that links to each other with the Internet of Things router, and node device is communicated by letter with Access Network through the Internet of Things router;
Access Network is used to transmit communication data or order between local Internet of Things and the core net;
Core net is used between Access Network and Internet of Things server, communicating data or order exchange, also is used between different Access Networks, transmitting communication data or order;
The Internet of Things server is used for the Internet of Things router and the node device of local Internet of Things are carried out safety certification.
Preferably, said Internet of things system also comprises: user terminal, be used to insert core net, and through core net and Access Network Internet of Things router in the local Internet of Things and node device are carried out monitoring management.
Preferably; Said local Internet of Things comprises at least one subnet; Each subnet comprises an Internet of Things router and the node device that links to each other with the Internet of Things router of this subnet; Each node device in the subnet has a local ident unique in subnet, and the Internet of Things router in each subnet has a Global ID unique in Internet of things system; Node device in the subnet is mobile device or is permanent plant.
Preferably, said local Internet of Things also comprises the node device with overall unique ID, and each has corresponding Internet of Things router of node device of overall unique ID.
Preferably, said Internet of Things server carries out safety certification to Internet of Things router in the local Internet of Things and the node device with overall unique ID.
Preferably, the Internet of Things router in each subnet carries out safety certification to the node device in this subnet in the said local Internet of Things.
Preferably, the Internet of Things router in the said local Internet of Things carries out safety certification to user terminal, and said user terminal is the user terminal that this Internet of Things router is carried out monitoring management.
The present invention also provides a kind of method for managing security of Internet of things system; Said Internet of things system comprises local Internet of Things, Access Network, core net, Internet of Things server and user terminal, and said local Internet of Things comprises Internet of Things router and the node device that links to each other with the Internet of Things router;
Said method for managing security comprises the authentication of Internet of Things server to the Internet of Things router, and said authentication comprises:
The Internet of Things server receives the authentication request that the Internet of Things router sends through Access Network and core net successively;
Generation comprises the Ciphering Key of random number, intended response and authentication token, and random number in the Ciphering Key and authentication token are returned to said Internet of Things router;
Receive the authentication response that the Internet of Things router is sent, said authentication response is calculated according to the random number and the authentication token that receive by the Internet of Things router;
Intended response in authentication response that receives and the said Ciphering Key is compared, if identical, then to the authentication success of this Internet of Things router; If difference, then authentification failure.
Preferably; Said Internet of Things server also comprises the authentication of Internet of Things router: the Internet of Things router is earlier according to the authentication token computing information confirmation codes that receives; And the corresponding informance in said validation of information sign indicating number and the authentication token compared; If identical, calculate authentication response according to random number that receives and authentication token again; If difference, then authentification failure.
Preferably, said Internet of Things server also comprises the authentication of Internet of Things router: the service network numbering at the Global ID of inclusion networking router and Internet of Things router place in the authentication request that the Internet of Things server receives; Whether the Global ID that verifies said Internet of Things router is corresponding with the service network numbering at Internet of Things router place, if corresponding, then the checking of Internet of Things router place service network passed through, and then generated Ciphering Key; If not corresponding, authentification failure then.
Preferably, said local Internet of Things comprises the node device with Global ID, and each has corresponding Internet of Things router of node device of Global ID; Said method for managing security also comprises the authentication of Internet of Things server to node device with Global ID, and said authentication comprises: the Internet of Things server receives the authentication request that node device with Global ID sends through Internet of Things router, Access Network and core net successively; Generation comprises the Ciphering Key of random number, intended response and authentication token, and random number in the Ciphering Key and authentication token are returned to said node device with Global ID; Reception has the authentication response that the node device of Global ID is sent, and said authentication response is calculated according to the random number and the authentication token that receive by the node device with Global ID; Intended response in authentication response that receives and the said Ciphering Key is compared,, then this is had the authentication success of the node device of Global ID if identical; If difference, then authentification failure.
Preferably; Said Internet of Things server also comprises the authentication of node device with Global ID: the node device with Global ID is earlier according to the authentication token computing information confirmation codes that receives; And the corresponding informance in said validation of information sign indicating number and the authentication token compared; If identical, calculate authentication response according to random number that receives and authentication token again; If difference, then authentification failure.
Preferably, said Internet of Things server also comprises the authentication of node device with Global ID: the Global ID that comprises node device in the authentication request that the Internet of Things server receives numbers with the service network at node device place; Whether the Global ID that verifies said node device is corresponding with the service network numbering at node device place, if corresponding, then the checking of node device place service network passed through, and then generated Ciphering Key; If not corresponding, authentification failure then.
Preferably, also comprise the authentication of Internet of Things router to user terminal, said authentication comprises: the Internet of Things router carries out authentication according to preset user terminal list to user terminal, if this user terminal ID in said user terminal list, authentication success then; Otherwise, authentification failure; Wherein, said user terminal is the user terminal that this Internet of Things router is carried out monitoring management.
Preferably; Also comprise of the authentication of Internet of Things router to user terminal; Said authentication comprises: said local Internet of Things comprises at least one subnet; Each subnet comprises an Internet of Things router and the node device that links to each other with the Internet of Things router of this subnet, and each node device in the subnet has a local ident unique in subnet; Said method for managing security also comprises the authentication of the interior Internet of Things router of each subnet to the node device in this subnet; Said authentication comprises: the Internet of Things router in each subnet is according to preset node device list; Node device in this subnet is carried out authentication; If node device ID in said node device list, authentication success then; Otherwise, authentification failure.
Compared with prior art, the present invention has the following advantages:
At first; But the present invention proposes a kind of Internet of things system of combining telecommunication net; Said Internet of things system mainly comprises local Internet of Things, Access Network, core net and Internet of Things server; Wherein said Access Network promptly comprises telecommunications network; Said local Internet of Things comprises Internet of Things router and the node device that links to each other with the Internet of Things router, and local Internet of Things can insert telecommunications network (being Access Network) through the Internet of Things router, and the Internet of Things server can carry out unified management and safety certification to Internet of Things router and node device through core net and Access Network.Hence one can see that; Internet of Things framework provided by the invention makes it to become the Internet of Things router through the function of enhanced routers; And the increment networked server, can not need to realize under the extensive situation of changing and the organically blending of Internet of Things at the current telecommunications network that comprises mobile radio communication.
Secondly, the present invention proposes the method based on separation between machine and card, and the Internet of Things router is carried out the security management of high-reliability, has guaranteed the data of Internet of Things and the fail safe of order, makes local Internet of Things to carry out operation management through communication network.
Once more, propose classification safety management way, thereby the node device in the Internet of Things is realized the ordering management the node device of Internet of Things.
Embodiment
For make above-mentioned purpose of the present invention, feature and advantage can be more obviously understandable, below in conjunction with accompanying drawing and embodiment the present invention done further detailed explanation.
The present invention proposes a kind of network architecture, can Internet of Things and communication network (comprising mobile radio communication) be organically blended, and can carry out safety management to the key equipment in the Internet of Things.Wherein, Said telecommunications network (telecommunication network) is the communication system that constitutes a plurality of telecommunication systems interconnection that a plurality of users intercom mutually; It is the human important foundation facility of realizing telecommunication; Utilize cable, wireless, optical fiber or other electromagnetic system, transmit, transmit and receive sign, literal, image, sound or other signal.Telecommunications network can be divided into by the kind of telecommunication service: telephone network, telegraph network, subscriber telegraph network, data communication network, facsimile communication network, image communication network, cable television network etc.; Can be divided into by the coverage scope: local telecommunication net, rural area telecommunications network, telecommunication system, mobile radio communication, international telecommunication net etc.
With reference to Fig. 1, be the structure chart of the said a kind of Internet of things system of the embodiment of the invention.
Said Internet of things system mainly comprises local Internet of Things 11, Access Network 12, core net 13 and Internet of Things server 14, wherein:
Local Internet of Things 11 comprises Internet of Things router one 5 and the node device 16 that links to each other with Internet of Things router one 5, and node device 16 is communicated by letter with Access Network 12 through Internet of Things router one 5;
Access Network 12 is used to provide local Internet of Things 11 to be linked into the service bearer of core net 13, mainly comprises the communication data or the order of transmitting between local Internet of Things 11 and the core net 13;
Core net 13 is used between Access Network 12 and Internet of Things server 14, communicating data or order exchange, also is used between different Access Networks 12, transmitting communication data or order;
Internet of Things server 14 is used for the Internet of Things router one 5 of local Internet of Things 11 is carried out safety certification with node device 16.
Preferably, said Internet of things system can also comprise:
User terminal 17 is used to insert core net 13, carries out monitoring management through Internet of Things router one in 13 pairs of local Internet of Things 11 of core net 5 and node device 16.As shown in Figure 1, user terminal 17 is various informative, can be desktop computer, also can be portable terminals such as mobile phone; And user terminal 17 can directly insert core net (for example portable terminal) through Access Network, also can insert core net (the for example computer of Long-distance Control) through the Internet net.
Structure in the face of above-mentioned Internet of things system is elaborated down.
1, local Internet of Things
In said local Internet of Things, the Internet of Things router has following characteristics and function:
(1) have globally unique identifier (ID), can be used as the overall identification of the local Internet of Things at Internet of Things router place, thereby but orderly management, the wherein said overall situation is meant whole Internet of things system;
(2) exchanges data and the route between each node device in the local Internet of Things at realization Internet of Things router place;
(3) realize interior node device and exchanges data between the external network and the route of local Internet of Things that the Internet of Things router belongs to;
(4) conversion of realization agreement, the inner communication protocol of local Internet of Things possibly be diversified, realize the interconnected of local Internet of Things and outside Access Network, just need carry out the conversion of agreement;
(5) completion is to the safety certification and the management of the local Internet of Things interior nodes equipment at Internet of Things router place.
The node device of said local Internet of Things is equipment or the article of RFID being installed or having implanted communication module, and major function comprises: the perception information data of collecting are sent or received through communication chip; Perhaps the perception information data of collecting are managed by recognition of devices such as Internet of Things routers through RFID.
In said local Internet of Things, the node device of being managed can be divided into following three types:
The first kind has the equipment of high priority, and this category node equipment comprises lot item or visual plant etc., and general cost is very high and have mobility, like private car, bus, container etc.This category node equipment has the unique ID of the overall situation; The corresponding Internet of Things router of each node device; The Internet of Things router can directly be installed or be integrated on the node device and move with node device; Therefore the Global ID of this category node equipment is the Global ID of Internet of Things router integrated on it, and this category node equipment also can be thought the function with Internet of Things router.And because the Internet of Things router has communication module, so the node device of this type with Global ID can directly be connected on the access and the control of core net.
Second type, general mobile device like article such as key, wallet, cameras, can install corresponding communication module or RFID additional on it.This type number of articles is huge, if having Global ID, cost is high, and resource consumption is big.So; These belongings can constitute a sub-net; Like the subnet among Fig. 11, this subnet is through Internet of Things router and external network communication, this Internet of Things router respectively with subnet in each node device link to each other; Each node device in the subnet has a local ident unique in subnet, and the Internet of Things router in the subnet has a Global ID unique in Internet of things system.Internet of Things router in the subnet can be integrated on the portable terminal such as mobile phone, is convenient for carrying.The characteristics of this type article are to have mobility, and only in subnet, have unique ID, owing to there is not the ID of the overall situation, so core net can not directly be visited, need to carry out dereference through the Internet of Things router in the subnet.
In practical application, how to differentiate article and whether belong to valuables, belong to first kind node device or belong to the second category node equipment, can let the user be provided with voluntarily.
The 3rd type, the permanent plant of low priority like household electrical appliances such as refrigerator, TV, washing machine, water heaters, installs communication module or RFID additional on it.These equipment are linked into the Internet of Things router, are that unit forms a sub-net with the family, shown in the subnet among Fig. 12.Each node device in the subnet all passes through an Internet of Things router and external network communication; This Internet of Things router can be a home gateway; The Internet of Things router has a Global ID unique in Internet of things system, and each node device in the subnet has a local ident unique in subnet.Equally, this type permanent plant, needs to carry out dereference through the Internet of Things router in the subnet so core net can not directly be visited owing to there is not the ID of the overall situation.
Can know based on above device class; Local Internet of Things can comprise some subnets; Each subnet comprises an Internet of Things router and the various node devices that link to each other with the Internet of Things router of this subnet, and each node device in the subnet has a local ident unique in subnet, and the Internet of Things router in each subnet has a Global ID unique in Internet of things system; Node device in the subnet can be above-mentioned second type mobile device, perhaps is above-mentioned the 3rd type permanent plant.In addition; Local Internet of Things also can comprise the node device of the above-mentioned first kind; The corresponding Internet of Things router of each node device; Said correspondence is meant: a common integrated Internet of Things router on this category node equipment with communication module, perhaps itself have the functional module of Internet of Things router, and node device has the unique identical ID of the overall situation with the Internet of Things router.
In the above-mentioned three category node equipment, user terminal is all Internet of Things router and the first kind node devices of monitoring management directly, indirect control and supervision management second type and the 3rd category node equipment.The monitoring management here mainly refers to visit, Control Node.The user also can the mechanical, electrical brain of handle etc. user terminal be arranged to the node device in the local Internet of Things, and it is controlled.And the difference of user terminal and Internet of Things node device is: user terminal can be in local Internet of Things; User terminal can insert core net by any way; And the node device in the Internet of Things perhaps passes through Internet of Things router access network, and perhaps itself just has the function of Internet of Things router.
2, Access Network
Access Network partly is telecommunications network, and is as shown in Figure 1, and Access Network can be the wireless mobile communication network that the base station is set, and also can be wired broadband access network.Access Network can be supported the access of different terminals node, comprises Internet of Things router, user terminal etc.The function of Access Network is the communication data or the order of transmitting between local Internet of Things and the core net.
3, core net
The function of core net is the reliable transmission of carrying out data; Can between Access Network and Internet of Things server, communicate data or order exchange; Like protocol conversion; And the request of Internet of Things data in server routed to different access networks, perhaps the request of data with Access Network routes to the Internet of Things server; Also can between different Access Networks, transmit communication data or order simultaneously, as between mobile radio communication and broadband network, transmitting, and the safety that is associated with Access Network of assurance.
4, Internet of Things server
The Internet of Things server can provide the registration service and the Security Authentication Service of Internet of Things router or first kind node device.Wherein, registration service is used to register the information of Internet of Things router and first kind node device, comprises node ID and corresponding security parameter etc. in the network; Security Authentication Service is used to guarantee the safety of Internet of Things related data information, can carry out safety certification to Internet of Things router and first kind node device.
In sum, above-mentioned Internet of things system is direct integrated communicaton module on the Internet of Things router, and with the integrated read-write capability of communication module.As shown in Figure 1; Consideration is the local Internet of Things network of base unit with a certain application-specific scene; Major function is to realize the management (such as the monitoring of article such as household electrical appliances, automobile, the perhaps management of industrial equipment and operation, the intellectuality of illuminator and security protection etc.) of family's sensor node.Wherein there is the Internet of Things router in each scene; The common child network of forming of Internet of Things router and other field apparatus; The adding of all field apparatuss must be accomplished through the Internet of Things router, and after the adding, the inner information interaction of subnet can be accomplished through the Internet of Things router; Or under the situation of Internet of Things router mandate, by directly communication completion between the node; And subnet information interaction inner and that subnet is outside need be passed through Internet of Things router, Access Network and core net cooperation completion.Wherein being connected of Internet of Things router and core transmission network can be through wired or wireless, the subnet 1 of corresponding respectively Fig. 1 and the operating mode of subnet 2.
Specify the communication process of above-mentioned Internet of things system below through Fig. 2 and Fig. 3.
With reference to Fig. 2, be the interaction diagrams of user terminal and node device in the said Internet of things system of the embodiment of the invention.
Said user terminal can insert core net through variety of way, and the user is addressable through user terminal, each node device in the local Internet of Things of control, and said node device comprises above-mentioned three category node equipment.
Be example with the user to the real-time monitor procedure of node device below, an interaction flow of user terminal and node device is following:
Step 201, user terminal is to core net transmitting control commands/data;
Step 202, core net are transmitted the Access Network of said control command/data to the node device place;
Step 203, the Access Network at node device place continue to transmit said control command/data and give the Internet of Things router (Router) that links to each other with node device;
Step 204, the Internet of Things router (Router) that links to each other with node device carries out protocol conversion, be the node standard data format in the Internet of Things with said control command/data transaction, and the control command/data after will changing is issued node device;
Step 205, node device return to real-time monitor data the Internet of Things router (Router) that links to each other with this node device according to said control command/data;
Step 206, said Internet of Things router (Router) carries out protocol conversion, converts said real-time monitor data into meet the Access Network standard data format, and the real-time monitor data after will changing is issued Access Network;
Step 207, Access Network is transmitted said real-time monitor data to core net;
Step 208, core net returns to user terminal with said real-time monitor data.
With reference to Fig. 3, be the interaction diagrams between the node device in the said Internet of things system of the embodiment of the invention.
Said node device comprises above-mentioned three category node equipment, all can visit each other between the node device of different sub-network and between first kind node device and subnet second type or the 3rd category node equipment.
Be example with the data interaction between node device 1 and the node device 2 below, node device 1 inserts different Access Networks through Internet of Things router (Router) respectively with node device 2, and one time interaction flow is following:
Step 301, node device 1 sends data to the Router1 that links to each other with this node device 1;
Step 302, Router1 carries out protocol conversion, and the data forwarding after will changing is to the Access Network 1 of Router1 access;
Step 303, Access Network 1 is given core net with said data forwarding;
Step 304, core net is transmitted said data to the Access Network 2 that Router2 inserts;
Step 305, Access Network 2 are given said data forwarding the Router2 that links to each other with node device 2;
Step 306, Router2 carries out protocol conversion, and the data forwarding after will changing is given node device 2.
Based on above-mentioned interaction flow, above-mentioned Internet of things system also can be realized the safety management to whole system in the telecommunications network that organically blended.Said safety management comprises:
The first, the safety certification that the Internet of Things server carries out Internet of Things router in the local Internet of Things;
The second, the safety certification that the Internet of Things server carries out the first kind node device that has overall unique ID in the local Internet of Things;
The 3rd, the safety certification that the Internet of Things router in the local Internet of Things carries out the user terminal that it is carried out monitoring management;
The 4th, the safety certification that the Internet of Things router in the local Internet of Things in each subnet carries out the node device in this subnet.
Specify respectively below.
1, Internet of Things server safety certification that Internet of Things router in the local Internet of Things is carried out
With reference to Fig. 4, be in the said Internet of things system of the embodiment of the invention to the security authentication process figure of Internet of Things router.
(Router) is following to the safety management of Access Network by the Internet of Things router:
Step 401, Router issues core net through Access Network with authentication request;
At first Router initiates authentication request, need be linked into core net and register, after registration inserts core net, and also need be through the authentication of Internet of Things server.
Step 402, core net are transmitted said authentication request and are given the Internet of Things server;
After Router inserted core net, core net was added the Global ID of Router and the service network numbering at Router place in authentication request, and is transmitted to the Internet of Things server, and request is carried out authentication to the identity of Router and the service network at its place.Wherein, said service network numbering is meant the network numbering of core net.
Preferred steps 403, the Internet of Things server is verified the service network at Router place;
After the Internet of Things server receives the authentication request that core net sends; For further tightening security property; According to the numbering of the service network in the authentication request service network at Router place is verified earlier; If authentication failed then refuse said authentication request, if checking through execution in step 404.
Concrete; Whether the Global ID of the said Router of Internet of Things server authentication is corresponding with the service network numbering at Router place; Be whether the service network at Router place numbers necessary being; Whether the Global ID of Router necessary being, and whether this Router has been registered to this service network numbering down.If corresponding, then the checking of Router place service network is passed through; If not corresponding, authentification failure then, whole identifying procedure finishes.
Step 404, the Internet of Things server generates the Ciphering Key that comprises random number, intended response and authentication token, and random number in the Ciphering Key and authentication token are returned to Router;
The Internet of Things server can adopt multiple algorithm to generate Ciphering Key, the for example f1 among the 3GPP, f2, f3, f4, f5 algorithm etc.The Internet of Things server sends to core net with random number and authentication token, and core net is stored, and is transmitted to Router.
Preferred steps 405, Router is first according to the authentication token computing information confirmation codes that receives, and the corresponding informance in said validation of information sign indicating number and the authentication token is compared, if identical, execution in step 406 again; If difference, then authentification failure;
Distorted in transmission course in order to prevent authentication token; Router can carry out safety verification to the authentication token that receives earlier; Verification method is according to authentication token computing information confirmation codes; If authentication token is not distorted, the validation of information sign indicating number that then calculates should be identical with the information (being corresponding informance) of assigned position in the authentication token; If different, explain that then authentication token is distorted, then send the refusal authentication message, and abandon this process to core net, whole identifying procedure finishes.
Step 406, Router calculates authentication response according to random number that receives and authentication token, and authentication response is issued the Internet of Things server;
Router can adopt multiple algorithm to generate authentication response, the for example f1 among the 3GPP, f2, f3, f4, f5 algorithm etc.Router sends to core net with user authentication response, and core net is transmitted to the Internet of Things server.
Step 407, the Internet of Things server compares the intended response in authentication response that receives and the said Ciphering Key, if identical, then to the authentication success of Router; If difference, then authentification failure.
In above-mentioned verification process to Router, Router and Internet of Things server also can carry out key agreement, and negotiations process is: the Internet of Things server generates first key simultaneously when generating Ciphering Key; And Router can be according to the random number in the Ciphering Key, authentication token and some information calculations second keys that self have, and on the basis that above-mentioned verification process passes through, then first key is identical with second key, and first key and second key become pair of secret keys.In the data transmission procedure between follow-up Router and Internet of Things server, Router adopts second secret key encryption to issuing the Internet of Things data in server, and the Internet of Things server adopts first key to decipher accordingly, thereby accomplishes secure communication.
2, Internet of Things server safety certification that the first kind node device that has overall unique ID in the local Internet of Things is carried out
The Internet of Things server to the verification process of first kind node device with similar to the verification process of Internet of Things router (Router), specifically as shown in Figure 5.
With reference to Fig. 5, be in the said Internet of things system of the embodiment of the invention to the security authentication process figure of first kind node device.
Because first kind node device is integrated Internet of Things router or self have the function of Internet of Things router, so the Internet of Things server can directly carry out safety management to first kind node device, and flow process is following:
Step 501, first kind node device is issued core net through Access Network with authentication request;
At first first kind node device is initiated authentication request, need be linked into core net and register, after registration inserts core net, and also need be through the authentication of Internet of Things server.
Step 502, core net are transmitted said authentication request and are given the Internet of Things server;
After first kind node device inserts core net; Core net is added the Global ID of first kind node device and the service network numbering at first kind node device place in authentication request; And being transmitted to the Internet of Things server, request is carried out authentication to the identity of first kind node device and the service network at its place.Wherein, said service network numbering is meant the network numbering of core net.
Preferred steps 503, the Internet of Things server is verified the service network at first kind node device place;
After the Internet of Things server receives the authentication request that core net sends; For further tightening security property; According to the numbering of the service network in the authentication request service network at first kind node device place is verified earlier; If authentication failed then refuse said authentication request, if checking through execution in step 504.
Concrete; Whether the Global ID of the said first kind node device of Internet of Things server authentication is corresponding with the service network numbering at first kind node device place; Be whether the service network at first kind node device place numbers necessary being; Whether the Global ID of the first kind node device necessary being, and whether this first kind node device has been registered to this service network numbering down.If corresponding, then the checking of first kind node device place service network is passed through; If not corresponding, authentification failure then, whole identifying procedure finishes.
Step 504, the Internet of Things server generates the Ciphering Key that comprises random number, intended response and authentication token, and random number in the Ciphering Key and authentication token are returned to first kind node device;
The Internet of Things server can adopt multiple algorithm to generate Ciphering Key, the for example f1 among the 3GPP, f2, f3, f4, f5 algorithm etc.The Internet of Things server sends to core net with random number and authentication token, and core net is stored, and is transmitted to first kind node device.
Preferred steps 505, first kind node device is first according to the authentication token computing information confirmation codes that receives, and the corresponding informance in said validation of information sign indicating number and the authentication token is compared, if identical, execution in step 506 again; If difference, then authentification failure;
Distorted in transmission course in order to prevent authentication token; First kind node device can carry out safety verification to the authentication token that receives earlier; Verification method is according to authentication token computing information confirmation codes; If authentication token is not distorted, the validation of information sign indicating number that then calculates should be identical with the information (being corresponding informance) of assigned position in the authentication token; If different, explain that then authentication token is distorted, then send the refusal authentication message, and abandon this process to core net, whole identifying procedure finishes.
Step 506, first kind node device calculates authentication response according to random number that receives and authentication token, and authentication response is issued the Internet of Things server;
First kind node device can adopt multiple algorithm to generate authentication response, the for example f1 among the 3GPP, f2, f3, f4, f5 algorithm etc.First kind node device sends to core net with user authentication response, and core net is transmitted to the Internet of Things server.
Step 507, the Internet of Things server compares the intended response in authentication response that receives and the said Ciphering Key, if identical, then to the authentication success of first kind node device; If difference, then authentification failure.
In above-mentioned verification process to first kind node device, first kind node device and Internet of Things server also can carry out key agreement, and negotiations process is: the Internet of Things server generates first key simultaneously when generating Ciphering Key; And first kind node device can be according to the random number in the Ciphering Key, authentication token and some information calculations second keys that self have; On the basis that above-mentioned verification process passes through; First key is identical with second key, and first key and second key become pair of secret keys.In follow-up first kind node device and the data transmission procedure between the Internet of Things server; First kind node device adopts second secret key encryption to issuing the Internet of Things data in server; The Internet of Things server adopts first key to decipher accordingly, thereby accomplishes secure communication.
3, the safety certification that the user terminal that it is carried out monitoring management is carried out of the Internet of Things router in the local Internet of Things
User terminal can insert core net through variety of way, and then through core net and Access Network the Internet of Things router in the local Internet of Things is carried out monitoring management.But the Internet of Things router need carry out authentication to keeper under it, prevents that other unwarranted users from obtaining its corresponding information.
Concrete authentication process is: the Internet of Things router is according to preset user terminal list; User terminal is carried out authentication; Said user terminal is the user terminal that this Internet of Things router is carried out monitoring management, if this user terminal ID in said user terminal list, authentication success then; Otherwise, authentification failure.Wherein, The ID of main user terminal and the ID of other user terminals can be set in the said user terminal list, and the user can carry out above-mentioned setting to said user terminal list through main user terminal, supposes that the user uses other user terminals to operate; If the ID of other user terminals is IDs that main user terminal configures in list; Then allow its access line operate (during operation possibly need corresponding password) of going forward side by side, if other ID outside the list, then refusal inserts.
4, the safety certification that the Internet of Things router in each subnet carries out the node device in this subnet in the local Internet of Things
After the Internet of Things router passed through the authentication of user terminal, the user can use this user terminal that the Internet of Things router is conducted interviews, controls, as in the subnet at this Internet of Things router place, adding or deleting which node device etc.If the adding node device, then the Internet of Things router need carry out the safety certification management to the node device that adds.
The inner authentication of subnet can adopt the safety certifying method in the existing Internet of Things with management; For example: the Internet of Things router in the subnet is according to preset node device list; To the authentication of the node device in this subnet, if node device ID in said node device list, authentication success then; Otherwise, authentification failure.
In sum, the method for managing security of Internet of things system provided by the invention and Internet of things system has the following advantages:
The first, said Internet of Things framework makes it to become the Internet of Things router through the function of enhanced routers, and the increment networked server, can not need to realize under the extensive situation of changing and the organically blending of Internet of Things at the current telecommunications network that comprises mobile radio communication;
The second, the present invention proposes the method based on separation between machine and card, and the Internet of Things router is carried out the security management of high-reliability, has guaranteed the data of Internet of Things and the fail safe of order, makes local Internet of Things to carry out operation management through communication network;
The 3rd, propose classification safety management way, thereby the node device in the Internet of Things is realized the ordering management the node device of Internet of Things.
Each embodiment in this specification all adopts the mode of going forward one by one to describe, and what each embodiment stressed all is and the difference of other embodiment that identical similar part is mutually referring to getting final product between each embodiment.
More than to the method for managing security of a kind of Internet of things system provided by the present invention and Internet of things system; Carried out detailed introduction; Used concrete example among this paper principle of the present invention and execution mode are set forth, the explanation of above embodiment just is used for helping to understand method of the present invention and core concept thereof; Simultaneously, for one of ordinary skill in the art, according to thought of the present invention, the part that on embodiment and range of application, all can change, in sum, this description should not be construed as limitation of the present invention.