CN105471868A - Cross-domain fine-grained control system of Internet of things under social network environment - Google Patents

Abstract

The invention provides a cross-domain fine-grained control system of Internet of things under a social network environment. The system comprises a certification authorization module, a user registration module, a cross-domain safety certification module and a cross-domain fine-grained access control module. The certification authorization module provides reliability of user access for a network under an open condition. The user registration module provides data access safety for a user. The cross-domain safety certification module provides safety of cross-domain data access for the user. The cross-domain fine-grained access control module is used for refining safety grades in a domain and between domains. In the invention, through simulating increase of a selected service quantity, time consumption of safety service selection is evaluated, when a node quantity and the domains in the network are increased, the time consumption is increased simultaneously; on an aspect of the time consumption, feasibility and validity are possessed; based on a condition that information safety transmission and access of the Internet of things under the social network environment are considered, cross-domain fine-grained access control of Internet of things nodes is guaranteed.

Description

Cross-domain fine-grained control system of Internet of things in social network environment

Technical Field

The invention relates to the technical field of Internet of things, in particular to a cross-domain fine-grained control system of the Internet of things in a social network environment.

Background

The integration of the internet of things and social networks is one of the important trends in the development of network technologies in the future. On the basis that the Internet of things connects objects with objects, the objects are connected with people to form a huge and complex social network with all objects connected, so that nodes of the Internet of things can feel social characteristics, and a more flexible and efficient network system is formed.

Many existing systems assume the internet of things in a social network environment as a sensor network system in a single field, and provide a uniform access method and security service for all nodes in the system. However, in many application scenarios, the internet of things system in the social network environment is controlled by different departments, and network nodes belonging to different domains share sensor data through standard protocols. Meanwhile, various types of data generated by the nodes of the internet of things tend to belong to different security levels and can only be accessed by specific users. Therefore, access control of the internet of things system in a social network environment is very important. In summary, how to realize secure cross-domain fine-grained access is one of the problems that needs to be solved urgently by an internet of things system in a social network environment.

In fact, there have been many studies on cross-domain security, such as a cross-domain access control system based on attribute-based access control, in which a security domain including subject, object, authority, and environment attributes is added as a basis for decision making. This solves the cross-domain access control problem and improves the scalability and variability of the system to some extent. However, none of these existing systems take into account the openness, complexity and dynamics of the network in the social networking environment, and these characteristics increase the security risk, so that these systems do not fully meet the practical requirements.

Disclosure of Invention

Aiming at the defects in the prior art, the invention provides a cross-domain fine-grained control system of the Internet of things in the social network environment for meeting the actual safety requirement on the basis of considering the openness, complexity and dynamics of the network in the social network environment.

In order to achieve the purpose, the invention is realized by the following technical scheme.

A cross-domain fine-grained control system of an Internet of things in a social network environment comprises: the system comprises an authentication authorization module, a user login module, a cross-domain security authentication module and a cross-domain fine-grained access control module; wherein,

the authentication and authorization module provides the reliability of accessing the user on the premise that the network is opened;

the user login module provides security for a user to access data;

the cross-domain security authentication module provides security for users to access data in a cross-domain manner;

the cross-domain fine-grained access control module is used for refining the security level of users in the domain and between the domains.

Preferably, the authentication and authorization module adopts a trusted model of an X.509-based certificate distribution method, and the trusted model of the X.509-based certificate distribution method is of a layered tree structure in one domain and of a mesh structure in a plurality of domains.

Preferably, the trusted model of the certificate distribution method based on x.509 includes a root, denoted as CA, in each domain_xWherein the subscript x is a natural number, root CA_xAs a baseA station or a sink node.

Preferably, the trusted model of the x.509-based certificate distribution method further includes at least one sub-layer, denoted as CA, in each domain_xnWherein the subscript n is a natural number.

Preferably, the user login module adopts the following protocol:

in the step of S1, $U\→AS:{\{{\mathrm{ID}}_U,P,{\mathrm{RN}}_1\}}_{{\mathrm{PK}}_{AS}}:$

when the user U logs in, the user login module generates an arbitrary number RN₁Then the user login module passes the public key PK_ASEncrypting user password P, personal identification number ID_UAnd random number RN₁Obtaining a ciphertext a, and sending the ciphertext a to an access server AS for storing data by a user;

in the step of S2, $AS\→U:{\{{\mathrm{RN}}_2,{\mathrm{ID}}_U\}}_{{\mathrm{RN}}_1}:$

when the access server AS receives the request information sent by the user U, the access server AS passes through the private key SK of the access server AS_ASDecrypting the ciphertext a to obtain the personal identification number ID of the user U_UUser password P and random number RN₁And verifying the personal identity information of the user U; after verification is completed, the access server AS generates a random number RN₂Then using the random number RN obtained by decryption₁Encrypting a random number RN acting as a symmetric key₂And a personal identification number ID_UAnd sending the obtained ciphertext b to a user U;

step S3, after receiving the ciphertext b from the access server AS, the user U passes through the random number RN₁Decrypting to obtain random number RN₂I.e. the session key K used by the user U when accessing the AS_u，AS。

Preferably, the cross-domain security authentication module adopts the following protocol:

in the step a1, the step b, $U\→{\mathrm{AS}}_h:{\mathrm{ID}}_U,{\{{\mathrm{ID}}_S,N_U,T_U,R_U,h(T_U,R_U)\}}_{K_{U,AS}}:$

user U sends access request to access server AS in user U domain_hTo request access to a server S in another domain; wherein, K_u，ASThe session key is finally obtained in a protocol adopted by a user login module; n is a radical of_UIs a random number generated by the user U to ensure the freshness of the request; time information T_UAnd a random number R_UAre two additional elements used to resist replay attacks; h () represents time information T_UA random number R_UThe hash value of (1); ID_SA sign indicating the server S; the relationship between the user U and the server S is as follows: the object which the user U wishes to have access to is the server S;

in the step a2, the step b, ${\mathrm{AS}}_h\→{\mathrm{AS}}_v:{\mathrm{ID}}_{{\mathrm{AS}}_h},S_{hv}:$

access server AS_hDecrypt the information obtained from user U and pass the ID_SVerifying to which domain the server S the user U wants to access belongs; then access the server AS_hGenerating a random number N_hvAnd calculateLast access server AS_hIdentify itself with ID_AShAnd S_hvAccess server AS sent to the domain to which server S belongs_v(ii) a Wherein S is_hvRepresenting by a random number N_hvAnd calculating to obtain a result; p is produced by user URoot and root CA_AshThe password of the exchange;

in the step a3, the step b, ${\mathrm{AS}}_v\→{\mathrm{AS}}_h:S_{vh},\left\{Cert.{\mathrm{AS}}_v,{\left\{h\left(S_{vh},S_{hv}\right)\right\}}_{{\mathrm{SK}}_v}\right\}{K}_{vh}:$

at the access server AS to which the server S belongs_vGenerating a random number N_vhAnd calculateWhile at the same time according toDiffie-Hellman key exchange protocol, calculating

Wherein, K_vhActing AS an Access Server AS_vAnd access server AS_hA temporary session key to ask; access server AS_vBy means of a temporary session key K_vhEncrypted access server AS_hPublic key certificate chain and digital signature h (S)_vh，S_hv) And cipher texts c and S obtained thereby_vhSent to the access server AS_v(ii) a Wherein S is_vhRepresenting by a random number N_vhAnd calculating to obtain a result; k_hvRepresenting acting AS an Access Server AS_vAnd access server AS_hA temporary session key to ask;

in the step a4, the step b, ${\mathrm{AS}}_h\→{\mathrm{AS}}_v:{\left\{\begin{array}{c}Cert.{\mathrm{AS}}_h,{\left\{h(S_{hv},S_{vh})\right\}}_{{\mathrm{SK}}_h},{\mathrm{ID}}_U,{\mathrm{ID}}_S,\\ sk,T_U,R_U,h(T_U,R_U),{\{{\mathrm{ID}}_U,sk\}}_{N_U}\end{array}\right\}}_{K_{hv}}:$

access server AS_hAfter receiving the ciphertext c, obtaining S_vhAnd calculating K by the method in the step a3_hvAnd K_vhThereby decrypting to obtain the access server AS_vAnd a digital signature for verifying identity; verifies the access server AS_vAfter the identity of (2), access to the server AS_hSent to the access server AS_vBy K_hvEncrypted information; the passage K_hvThe encrypted information includes: access server AS_hAuthentication chain of (1), digital signature, identity information of the user U and the server S, random number sk between the user U and the server S as a session key, and certificate

In the step a5, the step b, ${\mathrm{AS}}_v\→S:{\left\{{\mathrm{ID}}_U,{\mathrm{ID}}_S,sk,T_U,R_U,{\left\{{\mathrm{ID}}_U,sk\right\}}_{N_U},N_v\right\}}_{K_{S,AS}}:$

access server AS_vAuthentication of an Access Server AS by the method in step a4_hThen sent to the server S via K_S，ASEncrypting the obtained information, wherein K_S，ASIs the server AS in step a4_hSent to the server AS_vServer S and access server AS_vA symmetric key exchanged therebetween; the passage K_S，ASThe information obtained by encryption comprises: identity information of the user U and the server S, a random number sk serving as a session key between the user U and the server S, and time information T_UAnd a random number R_UCertificate and certificateV is generated as a random number Nv, wherein the root server v of the domain where the server to be accessed by the user U is located;

in the step a6, the step b, $S\→U:{\{{\mathrm{ID}}_U,sk\}}_{N_U},{\{{\mathrm{ID}}_S,T_S,R_S,h(T_S,R_S),N_S\}}_{sk}:$

after receiving the information, the server S passes the symmetric key K_S，ASDecrypting the received information and thereafter sending the certificateGiving the user U, and simultaneously encrypting the personal information by the server S through the random number sk and sending the personal information to the user U;

step a7, U → S: n is a radical of_S+1：

User U passes through random number N_UDecryptionThen, the address of the server S is obtained through decryption of the random number sk; the user U then sends N as a response message to the server S_S+1 and certify the identity of the server S; finally, the user U passes through the session key K_U，SAccessing data on the server S, i.e. the random number sk; wherein N is_SRepresenting a random number generated by the server S.

Preferably, the cross-domain fine-grained access control module comprises a user allocation unit, a right allocation unit, an authorization unit, an obligation unit and a condition unit; wherein:

the user allocation unit and the right allocation unit are respectively used for correctly allocating user roles and user operation authorities;

the authorization unit, the obligation unit and the condition unit are used for correctly removing the user roles and the user operation rights which are allocated by the user before.

Preferably, the user role comprises an original right and a valid right of the user, wherein:

the original rights are all rights assigned to the user role;

the valid rights are rights of the user role under the restrictions of the authorization unit, the obligation unit and the condition unit.

Preferably, user roles having the same original rights can have different valid rights in different domains.

Preferably, a layered role model is adopted during cross-domain user role mapping; the hierarchical role model is based on inheritance, i.e., a parent role has all the rights of a child role.

Compared with the prior art, the invention has the following beneficial effects:

1. the invention evaluates the time overhead of the safety service selection by simulating the increase of the number of the selected services, and the time overhead is increased while the number of the nodes and the domains in the network are increased;

2. the method has feasibility and effectiveness in time overhead, and ensures cross-domain fine-grained access control of the nodes of the Internet of things on the basis of considering safe information transmission and access of the Internet of things in the social network environment.

Drawings

Other features, objects and advantages of the invention will become more apparent upon reading of the detailed description of non-limiting embodiments with reference to the following drawings:

FIG. 1 is a trust model of a certificate authority module;

FIG. 2 is a role-based access control model;

FIG. 3 is a cross-domain role mapping model;

fig. 4 is a diagram illustrating access response time.

Detailed Description

The following examples illustrate the invention in detail: the embodiment is implemented on the premise of the technical scheme of the invention, and a detailed implementation mode and a specific operation process are given. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the inventive concept, which falls within the scope of the present invention.

Examples

The embodiment provides a cross-domain fine-grained control system of an internet of things in a social network environment, which comprises: the system comprises an authentication authorization module, a user login module, a cross-domain security authentication module and a cross-domain fine-grained access control module; wherein,

the authentication and authorization module provides the reliability of accessing the user on the premise that the network is opened;

the user login module provides security for a user to access data;

the cross-domain security authentication module provides security for users to access data in a cross-domain manner;

the cross-domain fine-grained access control module is used for refining the security level of users in the domain and between the domains.

Further, the authentication and authorization module adopts a trusted model of the certificate distribution method based on X.509, and the trusted model of the certificate distribution method based on X.509 is of a layered tree structure in one domain and of a mesh structure in a plurality of domains.

Further, the trusted model of the certificate distribution method based on the X.509 comprises a root in each domain, and the root is marked as CA_xWherein the subscript x is a natural number, root CA_xAs a base station or sink node.

Further, the trusted model of the certificate distribution method based on the X.509 also comprises at least one sub-layer in each domain, which is denoted as CA_xnWherein the subscript n is a natural number.

Further, the user login module adopts the following protocol:

in the step of S1, $U\→AS:{\{{\mathrm{ID}}_U,P,{\mathrm{RN}}_1\}}_{{\mathrm{PK}}_{AS}}:$

when the user U logs in, the user login module generates an arbitrary number RN₁Then the user login module passes the public key PK_ASEncrypting user password P, personal identification number ID_UAnd random number RN₁Obtaining a ciphertext a, and sending the ciphertext a to an access server AS for storing data by a user U;

in the step of S2, $AS\→U:{\{{\mathrm{RN}}_2,{\mathrm{ID}}_U\}}_{{\mathrm{RN}}_1}:$

when the access server AS receives the request information sent by the user U, the access server AS passes through the private key SK of the access server AS_ASDecrypting the ciphertext a to obtain the personal identification number ID of the user U_UUser password P and random number RN₁And verifying the personal identity information of the user U; after verification is completed, the access server AS generates a random number RN₂Then using the random number RN obtained by decryption₁Encrypting a random number RN acting as a symmetric key₂And a personal identification number ID_UAnd sending the obtained ciphertext b to a user U;

step S3, after receiving the ciphertext b from the access server AS, the user U passes through the random number RN₁Decrypting to obtain random number RN₂I.e. the session key K used by the user U when accessing the AS_u，AS。

Further, the cross-domain security authentication module adopts the following protocol:

in the step a1, the step b, $U\→{\mathrm{AS}}_h:{\mathrm{ID}}_U,{\{{\mathrm{ID}}_S,N_U,T_U,R_U,h(T_U,R_U)\}}_{K_{U,AS}}:$

user U sends access request to access server AS in user U domain_hTo request access to a server S in another domain; wherein, K_u，ASThe session key is finally obtained in a protocol adopted by a user login module; n is a radical of_UIs a random number generated by the user U to ensure the freshness of the request; time information T_UAnd a random number R_UAre two additional elements used to resist replay attacks; h () represents time information T_UA random number R_UThe hash value of (1); ID_SA sign symbol representing a subscriber S;

in the step a2, the step b, ${\mathrm{AS}}_h\→{\mathrm{AS}}_v:{\mathrm{ID}}_{{\mathrm{AS}}_h},S_{hv}:$

access server AS_hDecrypt the information obtained from user U and pass the ID_SVerifying to which domain the server S the user U wants to access belongs; then access the server AS_hGenerating a random number N_hvAnd calculateLast access server AS_hIdentify itself with ID_AShAnd S_hvAccess server AS sent to the domain to which server S belongs_v(ii) a Wherein S is_hvRepresenting by a random number N_hvAnd calculating to obtain a result; p is root CA_xA password assigned to the user;

in the step a3, the step b, ${\mathrm{AS}}_v\→{\mathrm{AS}}_h:S_{vh},\left\{Cert.{\mathrm{AS}}_v,{\left\{h\left(S_{vh},S_{hv}\right)\right\}}_{{\mathrm{SK}}_v}\right\}{K}_{vh}:$

at the access server AS to which the server S belongs_vGenerating a random number N_vhAnd calculateMeanwhile, according to a Diffie-Hellman key exchange protocol, the method calculates

Wherein, K_vhActing AS an Access Server AS_vAnd access server AS_hA temporary session key to ask; access server AS_vBy means of a temporary session key K_vhEncrypted access server AS_hPublic key certificate chain and digital signature h (S)_vh，S_hv) And cipher texts c and S obtained thereby_vhSent to the access server AS_v(ii) a Wherein S is_vhRepresenting by a random number N_vhAnd calculating to obtain a result; k_hvRepresenting acting AS an Access Server AS_vAnd access server AS_hA temporary session key to ask;

in the step a4, the step b, ${\mathrm{AS}}_h\→{\mathrm{AS}}_v:{\left\{\begin{array}{c}Cert.{\mathrm{AS}}_h,{\left\{h(S_{hv},S_{vh})\right\}}_{{\mathrm{SK}}_h},{\mathrm{ID}}_U,{\mathrm{ID}}_S,\\ sk,T_U,R_U,h(T_U,R_U),{\{{\mathrm{ID}}_U,sk\}}_{N_U}\end{array}\right\}}_{K_{hv}}:$

access server AS_hAfter receiving the ciphertext c, obtaining S_vhAnd calculating K by the method in the step a3_hvAnd K_vhThereby decrypting to obtain the access server AS_vAnd a digital signature for verifying identity; verifies the access server AS_vAfter the identity of (2), access to the server AS_hSent to the access server AS_vBy K_hvEncrypted information; the passage K_hvThe encrypted information includes: access server AS_hAuthentication chain of (1), digital signature, identity information of the user U and the server S, random number sk between the user U and the server S as a session key, and certificate

In the step a5, the step b, ${\mathrm{AS}}_v\→S:{\left\{{\mathrm{ID}}_U,{\mathrm{ID}}_S,sk,T_U,R_U,{\left\{{\mathrm{ID}}_U,sk\right\}}_{N_U},N_{\mathrm{\ν}}\right\}}_{K_{S,AS}}:$

access server AS_vAuthentication of an Access Server AS by the method in step a4_hThen sent to the server S via K_S，ASEncrypting the obtained information, wherein K_S，ASIs the server AS in step a4_hSent to the server AS_vServer S and access server AS_vA symmetric key exchanged therebetween; the passage K_S，ASThe information obtained by encryption comprises: identity information of the user U and the server S, a random number sk serving as a session key between the user U and the server S, and time information T_UAnd a random number R_UCertificate and certificateA random number Nv generated by v, wherein v represents a root server v of a domain where a server to be accessed by a user U is located;

in the step a6, the step b, $S\→U:{\{{\mathrm{ID}}_U,sk\}}_{N_U},{\{{\mathrm{ID}}_S,T_S,R_S,h(T_S,R_S),N_S\}}_{sk}:$

after receiving the information, the server S passes the symmetric key K_S，ASDecrypting the received information and thereafter sending the certificateGiving the user U, and simultaneously encrypting the personal information by the server S through the random number sk and sending the personal information to the user U;

step a7, U → S: n is a radical of_S+1：

User U passes through random number N_UDecryptionThen, the address of the server S is obtained through decryption of the random number sk; the user U then sends N as a response message to the server S_S+1 and certify the identity of the server S; finally, the user U passes through the session key K_U，SAccessing data on the server S, i.e. the random number sk; wherein N is_SShow clothesA random number generated by the server S.

Further, the cross-domain fine-grained access control module comprises a user allocation unit, an entitlement allocation unit, an authorization unit, an obligation unit and a condition unit; wherein:

the user allocation unit and the right allocation unit are respectively used for correctly allocating user roles and user operation authorities;

the authorization unit, the obligation unit and the condition unit are used for correctly removing the user roles and the user operation rights which are allocated by the user before.

Further, the user role comprises an original right and an effective right of the user, wherein:

the original rights are all rights assigned to the user role;

the valid rights are rights of the user role under the restrictions of the authorization unit, the obligation unit and the condition unit.

Further, user roles having the same original rights can have different valid rights in different domains.

Furthermore, a layered role model is adopted when the cross-domain user role is mapped; the hierarchical role model is based on inheritance, i.e., a parent role has all the rights of a child role.

The present embodiment is further described below with reference to the accompanying drawings.

The embodiment comprises an authentication and authorization module, a user login module, a cross-domain security authentication module and a cross-domain fine-grained access control module. The symbols used hereinafter are as described in table 1.

TABLE 1

A. Trusted authentication authorization module

In order to realize the trusted authentication authorization, the module uses a trusted model based on the certificate distribution method of X.509. As shown in fig. 1.

The trusted model is a layered tree structure in one domain and a mesh structure in multiple domains. In FIG. 1, each CA_xAre root CAs that are trust anchors for a domain.

For a wireless sensor network with distributed storage of data, similar to domain 1 in fig. 1, we use a two-layer tree structure. Highest layer of CA₁I.e., the root CA, is designed as a base station that issues data certificates to a second level CA, e.g., a CA in domain 1₁₁The key is distributed. The CA of the second layer is designed as a place to store the sensed data, while it can issue data certificates and keys to the data server and the user. In the present model, a data server is a node used to store data.

For wireless sensor networks that store data centrally, we use only a single layer structure, similar to domain 2 in fig. 1. Root CA, i.e. CA₂Designed as a base station or sink node, which issues data certificates and keys to data servers and users, while the servers are used to store data.

B. User login module

In this embodiment, when the user logs in to the wireless sensor network through the password when he needs to access data, the user will start logging in to the module, and the protocol used by this module is as follows.

Step S1: $U\→AS:{\{{\mathrm{ID}}_U,P,{\mathrm{RN}}_1\}}_{{\mathrm{PK}}_{AS}}$

when user U logs in, he will generate an arbitrary number RN₁Then he passes the public key PK_ASEncrypting user password P, personal identification number ID_UAnd random number RN₁And obtaining the ciphertext a, and then sending the ciphertext a to an access server AS for storing data by the user U.

Step S2: $AS\→U:{\{{\mathrm{RN}}_2,{\mathrm{ID}}_U\}}_{{\mathrm{RN}}_1}$

when the access server AS receives the request information sent by the user U, the access server AS passes through the private key SK of the access server AS_ASDecrypting the ciphertext a to obtain the personal identification number ID of the user U_UUser password P and random number RN₁And verifies the personal identification information of the user U. After verification is completed, the access server AS generates a random number RN₂Then using the random number RN obtained by decryption₁Encrypting a random number RN acting as a symmetric key₂And a personal identification number ID_UAnd sends the obtained ciphertext b to the user U.

Step S3: after receiving the ciphertext b from the access server AS, the user U passes through the random number RN₁Decrypting to obtain random number RN₂I.e. the session key K used by the user U when accessing the access server AS_u，AS。

C. Cross-domain security authentication module

Step a 1: $U\→{\mathrm{AS}}_h:{\mathrm{ID}}_U,{\{{\mathrm{ID}}_S,N_U,T_U,R_U,h(T_U,R_U)\}}_{K_{U,AS}}$

user U sends access request to access server AS in user U domain_hTo request access to the server S in the other domain. K_u，ASIs the session key RN finally obtained in the protocol adopted by the user login module₂。N_UIs a random number generated by the user U to ensure the freshness of the request, time information T_UAnd a random number R_UAre two additional elements used to resist replay attacks.

Step a 2: ${\mathrm{AS}}_h\→{\mathrm{AS}}_v:{\mathrm{ID}}_{{\mathrm{AS}}_h},S_{hv}$

access server AS_hDecrypt the information obtained from user U and pass the ID_SIt is verified to which domain the server S the user U wants to access belongs. Then access the server AS_hGenerating a random number N_hvAnd calculateLast access server AS_hIdentify itself with ID_AShAnd S_hvAccess server AS sent to the domain to which server S belongs_v。

Step a 3: ${\mathrm{AS}}_v\→{\mathrm{AS}}_h:S_{vh},\left\{Cert.{\mathrm{AS}}_v,{\left\{h\left(S_{vh},S_{hv}\right)\right\}}_{{\mathrm{SK}}_v}\right\}{K}_{vh}$

access server AS_vGenerating a random number N_vhAnd calculateMeanwhile, according to a Diffie-Hellman key exchange protocol, the method calculates $K_{vh}=K_{hv}={S_{vh}}^{N_{hv}}\mathrm{mod}P={S_{hv}}^{N_{vh}}\mathrm{mod}P.$

K_vhActing AS an Access Server AS_vAnd access server AS_hThe temporary session key in question. Access server AS_vBy K_vhEncrypting the public key certificate chain and the digital signature h (S)_vh，S_hv) And the ciphertext c sum obtained therebyS_vhSent to the access server AS_v。

Step a 4: ${\mathrm{AS}}_h\→{\mathrm{AS}}_v:{\left\{\begin{array}{c}Cert.{\mathrm{AS}}_h,{\left\{h(S_{hv},S_{vh})\right\}}_{{\mathrm{SK}}_h},{\mathrm{ID}}_U,{\mathrm{ID}}_S,\\ sk,T_U,R_U,h(T_U,R_U),{\{{\mathrm{ID}}_U,sk\}}_{N_U}\end{array}\right\}}_{K_{hv}}$

access server AS_hAfter receiving the ciphertext c, obtaining S_vhAnd calculating K by the method in step 3_hvAnd K_vhThereby decrypting to obtain the access server AS_vAnd a digital signature for verifying identity. Verifies the access server AS_vAfter the identity of (2), access to the server AS_hSent to the access server AS_vBy K_hvEncrypted information. This information includes accessServer AS_hAuthentication chain, digital signature, identity information of the user U and the server S, random number sk as a session key between the user U and the server S, and certificate

When an AS needs to verify a chain of intra-domain certificates from another access server, he looks for CAs that can be trusted and cross-certified with the root CA to which the chain of intra-domain certificates belongs. Then, a chain of trust may be established and the AS may verify the chain of certificates with the public key of the root CA within the domain.

Step a 5: ${\mathrm{AS}}_v\→S:{\left\{{\mathrm{ID}}_U,{\mathrm{ID}}_S,sk,T_U,R_U,{\left\{{\mathrm{ID}}_U,sk\right\}}_{N_U},N_v\right\}}_{K_{S,AS}}$

access server AS_vAuthentication of an Access Server AS by the method in step a4_hThen sent to the server S via K_S，ASEncrypting the resulting information (key d), where K_S，ASIs S and AS in the last stage_vThe symmetric key exchanged between. This information (key d) includes identity information of the user U and the server S, a random number sk serving as a session key between the user U and the server S, and time information T_UAnd a random number R_UCertificate and certificateA random number Nv generated by v.

Step a 6: $S\→U:{\{{\mathrm{ID}}_U,sk\}}_{N_U},{\{{\mathrm{ID}}_S,T_S,R_S,h(T_S,R_S),N_S\}}_{sk}$

after the server S receives the secret key d, it passes K_S，ASDecrypting the received information and thereafter sending the certificateAnd the server S encrypts personal information by using the random number sk and sends the personal information to the user U.

Step a 7: u → S: n is a radical of_S+1

User U passes through N_UDecryptionAnd then the address of the server S is obtained through decryption of the random number sk. The user U then sends N as a response message to the server S_S+1 and confirm its identity. Finally, the user U passes through the session key K_U，SThe data on the server S, i.e. the random number sk, is accessed.

D. Cross-domain fine-grained access control module

The module realizes access control on the basis of RBAC. In this module, there are five control units, respectively: a user allocation unit, a rights allocation unit, an authorization unit, an obligation unit and a condition unit. The user allocation unit and the right allocation unit are for the correct allocation of functions (user role and operation right of the user role), while the other three units are for the correct removal.

The assignment process of the user assignment unit is a process in which the system assigns to the user role. The original rights are the rights that are owned by the role assigned to the user. A valid right is a right that is restricted under an authorization unit, an obligation unit and a condition unit. A principal having the same original rights may have different valid rights in different application scenarios. A role based usage control model is shown in fig. 2.

The model adopts a layered role model when the cross-domain role is mapped. This hierarchical character model is based on inheritance, i.e., a parent character has all the rights of a child character. The cross-domain role mapping is shown in fig. 3.

In FIG. 3, the "Secondary Administrator" in domain B is mapped to the "advanced user" role in domain A. This means that if some users in domain B are assigned the role of "secondary administrator", he has all the rights that the "premium users" in domain a have when he accesses domain a across domains. In addition, role mapping can be transferred, as shown in fig. 3, when "sub-administrator" maps to "advanced user", the parent node of "sub-administrator" in domain B can map to "advanced user" according to the hierarchical structure of roles.

The present embodiment evaluates the time overhead of security service selection by simulating an increase in the number of selected services. As shown in fig. 4, as the number of nodes and domains in the network increases, the time overhead increases.

The experimental results prove the feasibility of the embodiment in time overhead and the feasibility and effectiveness of the invention. In summary, according to the embodiment, on the basis of considering safe information transmission and access of the internet of things in the social network environment, cross-domain fine-grained access control of the nodes of the internet of things is ensured.

In this embodiment:

CA: authentication authorization (CertificateAuthority);

x.509: digital certificate standards established by the international telecommunications union;

Diffie-Hellman: a method of ensuring that a shared secret traverses an insecure network;

RBAC: role-based access control (Role-based access control).

The foregoing description of specific embodiments of the present invention has been presented. It is to be understood that the present invention is not limited to the specific embodiments described above, and that various changes and modifications may be made by one skilled in the art within the scope of the appended claims without departing from the spirit of the invention.

Claims (10)

1. A cross-domain fine-grained control system of an Internet of things in a social network environment is characterized by comprising: the system comprises an authentication authorization module, a user login module, a cross-domain security authentication module and a cross-domain fine-grained access control module; wherein,

the authentication and authorization module provides the reliability of accessing the user on the premise that the network is opened;

the user login module provides security for a user to access data;

the cross-domain security authentication module provides security for users to access data in a cross-domain manner;

the cross-domain fine-grained access control module is used for refining the security level of the user in the domain and between the domains.

2. The cross-domain fine-grained control system of the internet of things in the social network environment according to claim 1, characterized in that the authentication and authorization module adopts a trusted model of the certificate distribution method based on x.509, and the trusted model of the certificate distribution method based on x.509 has a layered tree structure in one domain and a mesh structure in a plurality of domains.

3. The cross-domain fine-grained control system of the internet of things in the social network environment of claim 2, wherein the trust model of the certificate distribution method based on the x.509 comprises a root in each domain, and the root is denoted as CA_xWherein the subscript x is a natural number, root CA_xAs a base station or sink node.

4. The cross-domain fine-grained control system of the internet of things in the social network environment according to claim 3, wherein the trusted model of the certificate distribution method based on X.509 further comprises at least one sub-layer in each domain, and the sub-layer is denoted as CA_xnWherein the subscript n is a natural number.

5. The cross-domain fine-grained control system of the internet of things in the social network environment of claim 1, wherein the user login module adopts the following protocol:

in the step of S1, $U\→AS:{\{{\mathrm{ID}}_U,P,{\mathrm{RN}}_1\}}_{{\mathrm{PK}}_{AS}}:$

when the user U logs in, the user login module generates an arbitrary number RN₁Then the user login module passes the public key PK_ASEncrypting user password P, personal identification number ID_UAnd random number RN₁Obtaining a ciphertext a, and sending the ciphertext a to an access server AS for storing data by a user U;

in the step of S2, $AS\→U:{\{{\mathrm{RN}}_2,{\mathrm{ID}}_U\}}_{{\mathrm{RN}}_1}:$

when the access server AS receives the request information sent by the user U, the access server AS passes through the private key SK of the access server AS_ASDecrypting the ciphertext a to obtain the personal identification number ID of the user U_UUser password P and random number RN₁And verifying the personal identity information of the user U; after verification is completed, the access server AS generates a random number RN₂Then using the random number RN obtained by decryption₁Encrypting a random number RN acting as a symmetric key₂And a personal identification number ID_UAnd sending the obtained ciphertext b to a user U;

step S3, after receiving the ciphertext b from the access server AS, the user U passes through the random number RN₁Decrypting to obtain random number RN₂I.e. the session key K used by the user U when accessing the access server AS_U，AS。

6. The cross-domain fine-grained control system of the internet of things in the social network environment of claim 1, wherein the cross-domain security authentication module adopts the following protocol:

in the step al, the step of the method, $U\→{\mathrm{AS}}_h:{\mathrm{ID}}_U,{\{{\mathrm{ID}}_S,N_U,T_U,R_U,h(T_U,R_U)\}}_{K_{U,AS}}:$

user U sends access request to access server AS in user U domain_hTo request access to a server S in another domain; wherein, K_u，ASThe session key is finally obtained in a protocol adopted by a user login module; n is a radical of_UIs a random number generated by the user U to ensure the freshness of the request; time information T_UAnd a random number R_UAre two additional elements used to resist replay attacks; h () represents time information Y_UA random number R_UThe hash value of (1); ID_SA sign indicating the server S; the server S is an object which the user U wants to access;

in the step a2, the step b, ${\mathrm{AS}}_h\→{\mathrm{AS}}_v:{\mathrm{ID}}_{{\mathrm{AS}}_h},S_{hv}:$

access server AS_hDecrypt the information obtained from user U and pass the ID_SVerifying to which domain the server S the user U wants to access belongs; then access the server AS_hGenerating a random number N_hvAnd calculateLast access server AS_hIdentify itself with ID_AShAnd S_hvAccess server AS sent to the domain to which server S belongs_v(ii) a Wherein S is_hvRepresenting by a random number N_hvAnd calculating to obtain a result; p is generated for user U and associated with root CA_AshThe password of the exchange;

in the step a3, the step b, ${\mathrm{AS}}_v\→{\mathrm{AS}}_h:S_{vh},\{Cert.{\mathrm{AS}}_v,{\left\{h(S_{vh},S_{hv})\right\}}_{{\mathrm{SK}}_v}\}{K}_{vh}:$

at the access server AS to which the server S belongs_vGenerating a random number N_vhAnd calculateMeanwhile, according to a Diffie-Hellman key exchange protocol, the method calculates

Wherein, K_vhActing AS an Access Server AS_vAnd access server AS_hAn inter-temporary session key; access server AS_vBy means of a temporary session key K_vhEncrypted access server AS_hPublic key certificate chain and digital signature h (S)_vh，S_hv) And cipher texts c and S obtained thereby_vhSent to the access server AS_v(ii) a Wherein S is_vhRepresenting by a random number N_vhAnd calculating to obtain a result; k_hvRepresenting acting AS an Access Server AS_vAnd access server AS_hAn inter-temporary session key;

in the step a4, the step b, ${\mathrm{AS}}_h\→{\mathrm{AS}}_v:{\left\{\begin{array}{c}Cert.{\mathrm{AS}}_h,{\left\{h(S_{hv},S_{vh})\right\}}_{{\mathrm{SK}}_h},{\mathrm{ID}}_U,{\mathrm{ID}}_S,\\ sk,T_U,R_U,h(T_U,R_U),{\{{\mathrm{ID}}_U,sk\}}_{N_U}\end{array}\right\}}_{K_{hv}}:$

access server AS_hAfter receiving the ciphertext c, obtaining S_vhAnd calculating K by the method in the step a3_hvAnd K_vhThereby decrypting to obtain the access server AS_vAnd a digital signature for verifying identity; verifies the access server AS_vAfter the identity of (2), access to the server AS_hSent to the access server AS_vBy K_hvEncrypted information; the passage K_hvThe encrypted information includes: access server AS_hAuthentication chain of (1), digital signature, identity information of the user U and the server S, random number sk between the user U and the server S as a session key, and certificate

In the step a5, the step b, ${\mathrm{AS}}_v\→S:{\{{\mathrm{ID}}_U,{\mathrm{ID}}_S,sk,T_U,R_U,{\{{\mathrm{ID}}_U,sk\}}_{N_U},N_v\}}_{K_{S,AS}}:$

access server AS_vAuthentication of an Access Server AS by the method in step a4_hThen sent to the server S via K_S，ASEncrypting the resulting secret d, where K_S，ASIs the server AS in step a4_hSent to the server AS_vServer S and access server AS_vA symmetric key exchanged therebetween; the secret key d comprises: identity information of the user U and the server S, a random number sk serving as a session key between the user U and the server S, and time information T_UAnd a random number R_UCertificate and certificateA random number Nv generated by v, wherein v represents a root server v of a domain where a server to be accessed by a user U is located;

in the step a6, the step b, $S\→U:{\{{\mathrm{ID}}_U,sk\}}_{N_U},{\{{\mathrm{ID}}_S,T_S,R_S,h(T_S,R_S),N_S\}}_{sk}:$

after receiving the key d, the server S passes through the symmetric key K_S，ASDecrypting the received information and thereafter sending the certificateGiving the user U, and simultaneously encrypting the personal information by the server S through the random number sk and sending the personal information to the user U;

step a7, U → S: n is a radical of_S+1：

User U passes through random number N_UDecryptionThen, the address of the server S is obtained through decryption of the random number sk; the user U then sends N as a response message to the server S_S+1 and certify the identity of the server S; finally, the user U passes through the session key K_U，SAccessing data on the server S, i.e. random numberssk; wherein N is_SRepresenting a random number generated by the server S.

7. The cross-domain fine-grained control system of the internet of things in the social network environment of claim 1, wherein the cross-domain fine-grained access control module comprises a user allocation unit, an entitlement allocation unit, an authorization unit, an obligation unit and a condition unit; wherein:

the user allocation unit and the right allocation unit are respectively used for correctly allocating user roles and user operation authorities;

the authorization unit, the obligation unit and the condition unit are used for correctly removing the user roles and the user operation rights which are allocated by the user before.

8. The cross-domain fine-grained control system of the internet of things in a social network environment according to claim 1, wherein the user role comprises an original right and an effective right of a user, wherein:

the original rights are all rights assigned to the user role;

the valid rights are rights of the user role under the restrictions of the authorization unit, the obligation unit and the condition unit.

9. The cross-domain fine-grained control system for the internet of things in the social network environment of claim 8, wherein user roles having the same original rights can have different effective rights in different domains.

10. The cross-domain fine-grained control system of the internet of things in the social network environment of claim 9, wherein a layered role model is adopted during cross-domain user role mapping; the hierarchical role model is based on inheritance, i.e., a parent role has all the rights of a child role.