CN110572800B - Equipment identity authentication method and device in machine-to-machine environment - Google Patents

Equipment identity authentication method and device in machine-to-machine environment Download PDF

Info

Publication number
CN110572800B
CN110572800B CN201910748663.4A CN201910748663A CN110572800B CN 110572800 B CN110572800 B CN 110572800B CN 201910748663 A CN201910748663 A CN 201910748663A CN 110572800 B CN110572800 B CN 110572800B
Authority
CN
China
Prior art keywords
authentication
intelligent
sensor equipment
router
intelligent sensor
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201910748663.4A
Other languages
Chinese (zh)
Other versions
CN110572800A (en
Inventor
程庆丰
孟良霖
刘文芬
丁文博
李钰汀
胡学先
张军琪
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Information Engineering University of PLA Strategic Support Force
Original Assignee
Information Engineering University of PLA Strategic Support Force
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Information Engineering University of PLA Strategic Support Force filed Critical Information Engineering University of PLA Strategic Support Force
Priority to CN201910748663.4A priority Critical patent/CN110572800B/en
Publication of CN110572800A publication Critical patent/CN110572800A/en
Application granted granted Critical
Publication of CN110572800B publication Critical patent/CN110572800B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H04W12/48—Security arrangements using identity modules using secure binding, e.g. securely binding identity modules to devices, services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention belongs to the technical field of information security, and particularly relates to a method and a device for authenticating equipment identity in a machine-to-machine environment, wherein the method comprises the following steps: the intelligent sensor equipment in the Internet of things determines self identity information, a pre-shared key is negotiated between the authentication server and the router, and meanwhile, the intelligent card performs read-write operation and opens up a storage space; the intelligent sensor equipment completes a registration request to the authentication server through the intelligent card and by utilizing the identity information of the intelligent sensor equipment; the intelligent sensor equipment accessed to the machine-to-machine communication environment reads the equipment through the intelligent card, and performs mutual authentication and key agreement with the router in the Internet of things through the pre-shared key so as to realize data interaction with other sensor equipment in the Internet of things. The method can resist test attack, pre-shared key leakage attack, session key leakage attack, man-in-the-middle attack and the like aiming at the smart card, effectively improves the safety in the data interaction process of the Internet of things, and has better application prospect.

Description

Equipment identity authentication method and device in machine-to-machine environment
Technical Field
The invention belongs to the technical field of information security, and particularly relates to a method and a device for authenticating equipment identity in a machine-to-machine environment.
Background
Machine-to-machine (M2M) communication is a key technology for implementing the Industrial Internet of Things (IIoT). In the M2M technology, all devices and machines can communicate with each other through a wireless network. M2M technology can generally provide data exchange between resource-constrained devices without human intervention. One important role of M2M is to enable real-time data communication between smart sensor equipped devices and a central management application in order to collect important data for its users that is transmitted from remote devices. Since the M2M technology is located within embedded cells through 3GPP technologies (such as GSM/GPRS, UMTS/HSPA (+) and LTE networks), it has become more mobile and intelligent than before. However, similar to Wireless Sensor Networks (WSNs), 3GPP cellular networks are vulnerable to some well-known information security threats. Therefore, similar to WSN, there is a need to ensure confidentiality, integrity of transmitted data and robustness against attacks from external entities. These security requirements can be met by designing a safe and effective communication scheme. In the M2M technology employed in the industrial internet of things (IIoT), the system model consists of three main entities: smart sensors, routers and Authentication Servers (AS). A pre-shared key is set between the router and the authentication server, the registration process of the intelligent sensor is carried out between the intelligent sensor and the authentication server, and the mutual authentication process is carried out between the intelligent sensor and the router.
In order to ensure secure communication between M2M devices, an authentication scheme and a key agreement scheme (AKA) have been proposed in recent years of research. These schemes should not only be able to securely perform mutual authentication and session key establishment, but also should be able to satisfy high efficiency. However, most of the existing lightweight authentication mechanisms and key agreement mechanisms can also be applied to the field of internet of things, and provide a security mechanism for asymmetric encryption, but the calculation cost is high, so that many security problems are caused. The traditional identity authentication and key agreement protocol is not suitable for the environment of the internet of things, and the traditional encryption mode and protocol are specifically restricted in the environment of a sensing layer, because the intelligent terminal equipment of the internet of things is generally weaker in storage and calculation capacity and cannot bear a large amount of data processing and data calculation, further requirements are provided for the authentication protocol during identity authentication and the authenticated key agreement protocol.
Disclosure of Invention
Therefore, the equipment identity authentication method and device in the machine-to-machine environment can resist security problems such as test attack, pre-shared key leakage attack, session key leakage attack and man-in-the-middle attack aiming at the smart card, and effectively improve the security in the data interaction process of the Internet of things.
According to the design scheme provided by the invention, the equipment identity authentication method oriented to the machine-to-machine environment comprises the following steps:
in the initialization stage, the intelligent sensor equipment in the Internet of things determines the identity information of the intelligent sensor equipment, a pre-shared key is negotiated between the authentication server and the router, and meanwhile, the intelligent card performs read-write operation and opens up a storage space;
in the registration stage, the intelligent sensor equipment completes a registration request to the authentication server through the intelligent card and by utilizing self identity information;
and in the authentication negotiation stage, the intelligent sensor equipment accessed into the machine-to-machine communication environment reads the equipment through an intelligent card, and performs mutual authentication and key negotiation with the router in the Internet of things through a pre-shared key so as to realize data interaction with other sensor equipment in the Internet of things.
In the registration phase, the smart sensor device obtains and stores temporary identity information and temporary session key information by using the smart card, where the temporary session key information includes password data of the smart sensor device; and initiating a registration request to the authentication server through a secure channel, and constructing a temporary session key between the intelligent sensor device and the authentication server, so that mutual authentication between the intelligent sensor device and the router is completed.
The registration stage specifically includes the following contents:
the intelligent sensor equipment sends self identity information to an authentication server;
after receiving the identity information of the intelligent sensor equipment, the authentication server generates a temporary identity set and a session key set for the intelligent sensor equipment, writes the temporary identity set and the session key set into the intelligent card, and simultaneously sends message data containing the temporary identity set, the session key set and a pre-shared key of the two parties to the intelligent sensor equipment;
and after receiving the message data, the intelligent sensor equipment selects a self password, updates the temporary identity set and the session key set according to the password, and stores the updated data into the intelligent card.
In the authentication negotiation stage, the smart sensor device reads data through the smart card, generates a sending message, and sends the sending message to the router; the router carries out message verification after receiving the message and feeds back the verification result to the authentication server, the authentication server generates a session key and an authentication message between the intelligent sensor equipment and the router, and the intelligent sensor equipment and the router carry out identity authentication of the intelligent sensor equipment and the router according to the session key and the authentication message.
According to the session key and the authentication message, the intelligent sensor equipment verifies and updates the session key set after receiving the router feedback message, generates a new message and sends the new message to the router, and the router verifies the message after receiving the new message so as to complete the identity authentication of the intelligent sensor equipment.
Furthermore, the present invention also provides an apparatus for authenticating device identity in a machine-to-machine environment, comprising: an initialization module, a registration module, and an authentication negotiation module, wherein,
the initialization module is used for determining self identity information of the intelligent sensor equipment of the Internet of things in an initialization stage, negotiating a pre-shared key between the authentication server and the router, and simultaneously carrying out read-write operation and opening up a storage space by the intelligent card;
the registration stage is used for completing a registration request to the authentication server by the intelligent sensor equipment through the intelligent card and by utilizing the identity information of the intelligent sensor equipment;
and the authentication negotiation module is used for reading equipment by the intelligent sensor equipment accessed into the machine-to-machine communication environment through the intelligent card in the authentication negotiation stage, and performing mutual authentication and key negotiation with the router in the Internet of things through the pre-shared key so as to realize data interaction with other sensor equipment in the Internet of things.
The invention has the beneficial effects that:
based on the smart card and password two-factor authentication mode, the pre-shared secret key between the router and the authentication server is encrypted and protected through the smart card and the password, a session secret key between the smart sensor and the router is generated by negotiation in the mutual authentication process between the smart sensor and the router, and the security in the data interaction process can be still ensured even if the temporary session secret key is leaked; aiming at attack modes of security vulnerabilities such as test attack, pre-shared key leakage attack, session key leakage attack, man-in-the-middle attack and the like of the intelligent card, the method can effectively ensure the anti-attack performance, improves the information security and has better application prospect.
Description of the drawings:
FIG. 1 is a flow chart of an embodiment of a method for identity authentication;
FIG. 2 is a flowchart of registration in an embodiment;
FIG. 3 is a diagram of an embodiment of an identity authentication device;
FIG. 4 is a flow chart of an intelligent sensor device registration phase in an embodiment;
fig. 5 is a schematic diagram of an authentication and key agreement process between the smart sensor device and the router in the embodiment.
The specific implementation mode is as follows:
in order to make the objects, technical solutions and advantages of the present invention clearer and more obvious, the present invention is further described in detail below with reference to the accompanying drawings and technical solutions.
For the situations that the conventional identity authentication and key agreement protocol is not suitable for the environment of the internet of things, and the conventional encryption manner and protocol are subject to specific constraints in the environment of the sensing layer, the embodiment of the present invention, as shown in fig. 1, provides an equipment identity authentication method in a machine-to-machine environment, including the following contents:
s101) in an initialization stage, the intelligent sensor equipment in the Internet of things determines identity information of the intelligent sensor equipment, a pre-shared key is negotiated between an authentication server and a router, and meanwhile, the intelligent card performs read-write operation and opens up a storage space;
s102) in a registration stage, the intelligent sensor equipment completes a registration request to an authentication server through an intelligent card and by using self identity information;
s103) in the authentication negotiation stage, the intelligent sensor equipment accessed into the machine-to-machine communication environment reads the equipment through the intelligent card, and performs mutual authentication and key negotiation with the router in the Internet of things through the pre-shared key so as to realize data interaction with other sensor equipment in the Internet of things.
Based on a smart card and password two-factor authentication mode, a pre-shared key between the router and the authentication server is encrypted and protected through the smart card and the password, a session key between the smart sensor and the router is generated by negotiation in the mutual authentication process between the smart sensor and the router, and the security in the data interaction process can be still ensured even if a temporary session key is leaked.
Furthermore, in the embodiment of the present invention, the smart sensor SE initiates a registration request to the authentication server AS through the secure channel, and the smart sensor device obtains and stores temporary identity information and temporary session key information by using the smart card, where the temporary session key information includes password data of the smart sensor device; and initiating a registration request to the authentication server through a secure channel, and constructing a temporary session key between the intelligent sensor device and the authentication server, so that mutual authentication between the intelligent sensor device and the router is completed.
Further, in the embodiment of the present invention, the registration phase, as shown in fig. 2, specifically includes the following contents:
s201) the intelligent sensor equipment sends self identity information to an authentication server;
s202) after receiving the identity information of the intelligent sensor equipment, the authentication server generates a temporary identity set and a session key set for the intelligent sensor equipment, writes the temporary identity set and the session key set into the intelligent card, and simultaneously sends message data containing the temporary identity set, the session key set and a pre-shared key of the two parties to the intelligent sensor equipment;
s203) after the intelligent sensor equipment receives the message data, the intelligent sensor equipment selects a self password, updates the temporary identity set and the session key set according to the password, and stores the updated data into the intelligent card.
The intelligent sensor SE sends the identity information ID of the intelligent sensor SEiAnd sending the data to an authentication server AS. After the authentication server AS receives the message of the intelligent sensor SE, f is calculated1i＝h(IDi||x)，f2i＝h(f1i) The authentication server AS generates a temporary identity set PID ═ PID for the intelligent sensor SE1,pid2… } where pid ═ h (ID)i||rj||f1i). The authentication server then generates a set of session keys for the smart sensor
Figure BDA0002166435410000055
Wherein
Figure BDA0002166435410000056
Computing
Figure BDA0002166435410000051
And mixing PID, KSAH (-) is written into the smart card SMC. After the computation is finished, the authentication server AS sends a message { f2i,PID,KSA,TSRH (·) } to the smart sensor SE. After receiving the message, the intelligent sensor selects the password PSW of the intelligent sensoriAnd calculate
Figure BDA0002166435410000052
Will be updated
Figure BDA0002166435410000053
And storing the data into the smart card.
Furthermore, in the embodiment of the present invention, the smart sensor SE and the router R perform an authentication and key agreement process, in which both sides perform mutual authentication and key agreement, and the smart sensor device reads data through the smart card, generates a sending message, and sends the sending message to the router; the router carries out message verification after receiving the message and feeds back the verification result to the authentication server, the authentication server generates a session key and an authentication message between the intelligent sensor equipment and the router, and the intelligent sensor equipment and the router carry out identity authentication of the intelligent sensor equipment and the router according to the session key and the authentication message.
Further, in the embodiment of the present invention, according to the session key and the authentication message, the intelligent sensor device verifies and updates the session key set after receiving the router feedback message, generates a new message, and sends the new message to the router, and the router verifies the message after receiving the new message to complete the identity authentication of the intelligent sensor device.
The smart sensor SE inserts the smart card into the reader device and submits its IDiAnd PSWiThe smart card being calculated by the reading device
Figure BDA0002166435410000054
And transmitting the calculation result to an intelligent sensor SE, and obtaining PID and K by the intelligent sensor SESARandom number r is arbitrarily selected1And calculate
Figure BDA0002166435410000061
M2＝h(r1||M1||pidi). After the computation is completed, a message { M } is sent1,M2,PID,TSRGive router R. Router R receives message { M1,M2,PID,TSRAfter the previous step, calculate
Figure BDA0002166435410000062
f2i＝h(f1i)，
Figure BDA0002166435410000063
Calculating h (r)1||M1||pidi) And verify h (r)1||M1||pidi) Whether or not to equal M2If not, the router immediately terminates the authentication process and sends the intelligent sensor SE to the serveriPid ofiServer AS deletes PID from PID seti. Otherwise, if equal, the router R selects the random number R2And calculate
Figure BDA0002166435410000064
Then the AID is usediSending to the authentication server AS, the authentication server updating
Figure BDA0002166435410000065
Then calculate
Figure BDA0002166435410000066
M′2＝h(M′1||AIDi||r2) Generating a smart sensor SEiAnd a session key SK between the router Rij＝h(r1||r2). Generate message { M'1,M′2,AIDj}. Smart sensor SE receiving message { M 'sent by router'1,M″2,AIDjAfter the previous step, calculate
Figure BDA0002166435410000067
And verifies h (M'1||AIDi||r2) And M'2Whether equal, if equal, calculate
Figure BDA0002166435410000068
Updating
Figure BDA0002166435410000069
Then the message is sent
Figure BDA00021664354100000610
To the router R. The router R receives the message M ″1Then, verify
Figure BDA00021664354100000611
Whether or not it is equal to h (r)2) If not, then the smart sensor SEiAuthentication fails; if equal, the authentication is successful.
In the password updating phase, the intelligent sensor SE can freely change its own password without the help of the router. It needs to identify its own identity information IDiOriginal password PSWiAnd a new password PSWi *Submitting the information to an intelligent card SMC, and after receiving the information submitted by the intelligent sensor, the intelligent card sends the original information in the intelligent card
Figure BDA00021664354100000612
Figure BDA00021664354100000613
Delete, and calculate
Figure BDA00021664354100000614
Figure BDA00021664354100000615
New PID to be generated**And
Figure BDA00021664354100000616
and storing the data into the smart card.
Further, based on the above method, an embodiment of the present invention further provides an apparatus for authenticating identity of a device in a machine-to-machine environment, as shown in fig. 3, including: an initialization module 101, a registration module 102, and an authentication negotiation module 103, wherein,
the initialization module 101 is configured to, in an initialization stage, determine identity information of the internet of things intelligent sensor device, negotiate a pre-shared key between the authentication server and the router, and simultaneously perform read-write operation and open up a storage space by the smart card;
a registration stage 102, in which the smart sensor device completes a registration request to the authentication server through the smart card and by using the identity information of the smart sensor device;
and the authentication negotiation module 103 is used for reading the intelligent sensor device accessed to the machine-to-machine communication environment through the intelligent card in the authentication negotiation stage, and performing mutual authentication and key negotiation with the router in the internet of things through the pre-shared key so as to realize data interaction with other sensor devices in the internet of things.
The invention provides an efficient and safe machine-to-machine environment-oriented lightweight authentication and key agreement mechanism, which realizes the security protection of a pre-shared key and a session key based on a smart card and password two-factor authentication model, thereby ensuring the security and reliability of the lightweight authentication protocol. The lightweight authentication and key agreement oriented to the machine-to-machine environment is mainly divided into four processes: an initialization process, a registration process, an authentication and key agreement process, and a password update process. Following with the intelligent sensor SEiAnd a router RjThe authentication between the processes is taken as an example, and the specific implementation steps of each process are respectively described as follows:
1) initialization procedure
First of all, the intelligent sensor SEiDetermining an identity ID of a user in a connected internet of thingsiSecond, the smart sensor SEiAnd router RjNegotiate a pre-shared key PSK between the twojAnd read-write operation is carried out on the smart card SMC, and a storage space is opened up.
2) Registration process
Referring to fig. 4, a smart sensor SEiSending a registration request to the authentication server AS, the purpose of the registration being to enable the smart sensor SEiAnd a router RjCan authenticate each other. First of all intelligenceSensor SEiSending own identity information IDiTo the authentication server AS, which is receiving the smart sensor SEiAfter the identity information of (c), f is calculated1i＝h(IDi||x)，f2i＝h(f1i) The authentication server AS is an intelligent sensor SEiGenerating a temporary identity set PID ═ PID1,pid2… } where pid ═ h (ID)i||rj||f1i). The authentication server then generates a set of session keys for the smart sensor
Figure BDA0002166435410000071
Wherein
Figure BDA0002166435410000072
Computing
Figure BDA0002166435410000073
And mixing PID, KSAH (-) is written into the smart card SMC. After the computation is finished, the authentication server AS sets the Message1 to f2i,PID,KSA,TSRH (-) sends to the smart sensor SEi. After receiving the message, the intelligent sensor selects the password PSW of the intelligent sensoriAnd calculate
Figure BDA0002166435410000081
Will be updated
Figure BDA0002166435410000082
And storing the data into the smart card.
3) Authentication and key agreement procedure
Referring to fig. 5, a smart sensor SEiAfter registration, will be connected into the context of machine-to-machine communication, in which communication context the smart sensor SE isiThrough and router RjAnd the connection is communicated with other intelligent sensors in the Internet of things. Therefore, during the authentication process, a smart sensor SE is requirediAnd router RjMutual authentication is performed and a secure session key is formed. First, the smart sensor SEiInserting and reading smart cardIn the fetching device, submitting its IDiAnd PSWiThe smart card being calculated by the reading device
Figure BDA0002166435410000083
And transmits the calculation result to the intelligent sensor SEiIntelligent sensor SEiGet PID and KSARandom number r is arbitrarily selected1And calculate
Figure BDA0002166435410000084
M2＝h(r1||M1||pidi). After the calculation is completed, a Message2 ═ { M ═ is sent1,M2,PID,TSRGive router Rj。
Router RjReceived Message2 ═ M1,M2,PID,TSRAfter the previous step, calculate
Figure BDA0002166435410000085
f2i＝h(f1i)，
Figure BDA0002166435410000086
Calculating h (r)1||M1||pidi) And verify h (r)1||M1||pidi) Whether or not to equal M2If not, the router immediately terminates the authentication process and sends the intelligent sensor SE to the serveriPid ofiServer AS deletes PID from PID seti. Otherwise, if equal, the router RjSelecting a random number r2And calculate
Figure BDA0002166435410000087
Then the AID is usediSending to the authentication server AS, the authentication server updating
Figure BDA0002166435410000088
Then calculate
Figure BDA0002166435410000089
M′2＝h(M′1||AIDi||r2) Generating a smart sensor SEiAnd a router RjSK of session key betweenij＝h(r1||r2). Generating Message3 ═ M'1,M′2,AIDj}。
Intelligent sensor SEiWhen the Message3 ═ M 'sent by the router is received'1,M′2,AIDjAfter the previous step, calculate
Figure BDA00021664354100000810
And verifies h (M'1||AIDi||r2) And M'2Whether equal, if equal, calculate SKij＝h(r1||r2)，
Figure BDA0002166435410000091
Updating
Figure BDA0002166435410000092
Then the message is sent
Figure BDA0002166435410000093
To router Rj。
Router RjReceipt of message M ″)1Then, verify
Figure BDA0002166435410000094
Whether or not it is equal to h (r)2) If not, then the smart sensor SEiAuthentication fails; if equal, the authentication is successful.
4) Password update procedure
In the intelligent sensor SEiAnd a router RjAfter one mutual authentication and key agreement, the intelligent sensor SEiThe password of the user can be freely changed without the help of the router. It needs to identify its own identity information IDiOriginal password PSWiAnd a new password PSWi *Submitting to a smart card SMC, the smart card receiving a smart sensor SEiAfter the submitted information, the original information in the smart card is sent
Figure BDA0002166435410000095
Delete, and calculate
Figure BDA0002166435410000096
New PID to be generated**And
Figure BDA0002166435410000097
and storing the data into the smart card.
Under the application environment of the industrial Internet of things, the lightweight identity authentication and key agreement protocol realized in the embodiment of the invention facing to the machine-to-machine communication environment can resist not only the pre-shared key leakage attack, the key leakage disguised attack, the anonymity leakage attack, the known key attack and the man-in-the-middle attack, but also the hardware attack of the smart card, can ensure the security of the session key and the anonymity of both communication parties, and has better application prospect.
Unless specifically stated otherwise, the relative steps, numerical expressions, and values of the components and steps set forth in these embodiments do not limit the scope of the present invention.
Based on the foregoing method, an embodiment of the present invention further provides a server, including: one or more processors; a storage device for storing one or more programs which, when executed by the one or more processors, cause the one or more processors to implement the method described above.
Based on the above method, the embodiment of the present invention further provides a computer readable medium, on which a computer program is stored, wherein the program, when executed by a processor, implements the above method.
The device provided by the embodiment of the present invention has the same implementation principle and technical effect as the method embodiments, and for the sake of brief description, reference may be made to the corresponding contents in the method embodiments without reference to the device embodiments.
It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the system and the apparatus described above may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
In all examples shown and described herein, any particular value should be construed as merely exemplary, and not as a limitation, and thus other examples of example embodiments may have different values.
It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures.
The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units is only one logical division, and there may be other divisions when actually implemented, and for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection of devices or units through some communication interfaces, and may be in an electrical, mechanical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit.
The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a non-volatile computer-readable storage medium executable by a processor. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.
Finally, it should be noted that: the above-mentioned embodiments are only specific embodiments of the present invention, which are used for illustrating the technical solutions of the present invention and not for limiting the same, and the protection scope of the present invention is not limited thereto, although the present invention is described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: any person skilled in the art can modify or easily conceive the technical solutions described in the foregoing embodiments or equivalent substitutes for some technical features within the technical scope of the present disclosure; such modifications, changes or substitutions do not depart from the spirit and scope of the embodiments of the present invention, and they should be construed as being included therein. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims (4)

1. An equipment identity authentication method oriented to a machine-to-machine environment, comprising:
in the initialization stage, the intelligent sensor equipment in the Internet of things determines the identity information of the intelligent sensor equipment, a pre-shared key is negotiated between the authentication server and the router, and meanwhile, the intelligent card performs read-write operation and opens up a storage space;
in the registration stage, the intelligent sensor equipment completes a registration request to the authentication server through the intelligent card and by utilizing self identity information;
in the authentication negotiation stage, intelligent sensor equipment accessed into a machine-to-machine communication environment performs equipment reading through an intelligent card, and performs mutual authentication and key negotiation with a router in the Internet of things through a pre-shared key so as to realize data interaction with other sensor equipment in the Internet of things;
the registration stage specifically includes the following contents:
the intelligent sensor equipment sends self identity information to an authentication server;
after receiving the identity information of the intelligent sensor equipment, the authentication server generates a temporary identity set and a session key set for the intelligent sensor equipment, writes the temporary identity set and the session key set into the intelligent card, and simultaneously sends message data containing the temporary identity set, the session key set and a pre-shared key of the two parties to the intelligent sensor equipment;
after receiving the message data, the intelligent sensor device selects a self password, updates the temporary identity set and the session key set according to the password, and stores the updated data into the intelligent card;
in the authentication negotiation stage, the intelligent sensor equipment reads data through an intelligent card, generates a sending message and sends the sending message to the router; the router carries out message verification after receiving the message and feeds back the verification result to the authentication server, the authentication server generates a session key and an authentication message between the intelligent sensor equipment and the router, and the intelligent sensor equipment and the router carry out identity authentication of the intelligent sensor equipment and the router according to the session key and the authentication message.
2. The equipment identity authentication method in the machine-to-machine environment oriented to the claim 1, characterized in that in the registration phase, the smart sensor equipment uses the smart card to obtain and store the temporary identity information and the temporary session key information, wherein the temporary session key information contains password data of the smart sensor equipment; and initiating a registration request to the authentication server through a secure channel, and constructing a temporary session key between the intelligent sensor device and the authentication server, so that mutual authentication between the intelligent sensor device and the router is completed.
3. The equipment identity authentication method in the machine-to-machine environment as claimed in claim 1, wherein according to the session key and the authentication message, the smart sensor equipment verifies and updates the session key set after receiving the router feedback message, generates a new message and sends the new message to the router, and the router verifies the message after receiving the new message to complete the identity authentication of the smart sensor equipment.
4. An apparatus for authenticating device identity in a machine-to-machine environment, comprising: an initialization module, a registration module, and an authentication negotiation module, wherein,
the initialization module is used for determining self identity information of the intelligent sensor equipment of the Internet of things in an initialization stage, negotiating a pre-shared key between the authentication server and the router, and simultaneously carrying out read-write operation and opening up a storage space by the intelligent card;
the registration stage is used for completing a registration request to the authentication server by the intelligent sensor equipment through the intelligent card and by utilizing the identity information of the intelligent sensor equipment;
the authentication negotiation module is used for reading equipment by intelligent sensor equipment accessed into a machine-to-machine communication environment through an intelligent card in an authentication negotiation stage, and performing mutual authentication and key negotiation with a router in the Internet of things through a pre-shared key so as to realize data interaction with other sensor equipment in the Internet of things;
the registration stage specifically includes the following contents:
the intelligent sensor equipment sends self identity information to an authentication server;
after receiving the identity information of the intelligent sensor equipment, the authentication server generates a temporary identity set and a session key set for the intelligent sensor equipment, writes the temporary identity set and the session key set into the intelligent card, and simultaneously sends message data containing the temporary identity set, the session key set and a pre-shared key of the two parties to the intelligent sensor equipment;
after receiving the message data, the intelligent sensor device selects a self password, updates the temporary identity set and the session key set according to the password, and stores the updated data into the intelligent card;
in the authentication negotiation stage, the intelligent sensor equipment reads data through an intelligent card, generates a sending message and sends the sending message to the router; the router carries out message verification after receiving the message and feeds back the verification result to the authentication server, the authentication server generates a session key and an authentication message between the intelligent sensor equipment and the router, and the intelligent sensor equipment and the router carry out identity authentication of the intelligent sensor equipment and the router according to the session key and the authentication message.
CN201910748663.4A 2019-08-14 2019-08-14 Equipment identity authentication method and device in machine-to-machine environment Active CN110572800B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201910748663.4A CN110572800B (en) 2019-08-14 2019-08-14 Equipment identity authentication method and device in machine-to-machine environment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201910748663.4A CN110572800B (en) 2019-08-14 2019-08-14 Equipment identity authentication method and device in machine-to-machine environment

Publications (2)

Publication Number Publication Date
CN110572800A CN110572800A (en) 2019-12-13
CN110572800B true CN110572800B (en) 2022-04-05

Family

ID=68775246

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201910748663.4A Active CN110572800B (en) 2019-08-14 2019-08-14 Equipment identity authentication method and device in machine-to-machine environment

Country Status (1)

Country Link
CN (1) CN110572800B (en)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112202511B (en) * 2020-09-29 2023-09-22 中国人民解放军战略支援部队信息工程大学 Physical layer key generation method and system based on channel characteristics
JP2024500489A (en) * 2020-12-24 2024-01-09 ホアウェイ・テクノロジーズ・カンパニー・リミテッド Secure access methods and devices
CN112887978B (en) * 2021-02-24 2022-03-25 曲阜师范大学 Anonymous identity authentication and key agreement protocol in WSN
CN113872763A (en) * 2021-09-07 2021-12-31 杭州师范大学 Privacy protection authentication method based on wireless body area network
CN114501440B (en) * 2022-01-04 2024-02-09 中国人民武装警察部队工程大学 Authentication key protocol for block chain application at edge of wireless sensor network

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101702645A (en) * 2009-11-30 2010-05-05 中国人民解放军信息工程大学 Three-side password authentication key exchange method
CN103346887A (en) * 2013-07-02 2013-10-09 山东科技大学 Low-complexity identity authentication method based on intelligent card and under multiserver environment
CN103347018A (en) * 2013-07-02 2013-10-09 山东科技大学 Long-distance identity authentication method based on intelligent card and under multiple-service environment
CN104584609A (en) * 2012-09-03 2015-04-29 阿尔卡特朗讯公司 Smart card initial personnalization with local generation of keys
CN105072110A (en) * 2015-08-06 2015-11-18 山东科技大学 Two-factor remote identity authentication method based on smart card
CN105491076A (en) * 2016-01-28 2016-04-13 西安电子科技大学 Heterogeneous network end-to-end authentication secret key exchange method based on space-sky information network
CN105871553A (en) * 2016-06-28 2016-08-17 电子科技大学 Identity-free three-factor remote user authentication method
CN109327313A (en) * 2018-11-07 2019-02-12 西安电子科技大学 A kind of Bidirectional identity authentication method with secret protection characteristic, server
CN113572765A (en) * 2021-07-23 2021-10-29 桂林电子科技大学 Lightweight identity authentication key negotiation method for resource-limited terminal

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10104545B2 (en) * 2016-11-02 2018-10-16 National Chin-Yi University Of Technology Computer-implemented anonymity authentication method for wireless sensor networks

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101702645A (en) * 2009-11-30 2010-05-05 中国人民解放军信息工程大学 Three-side password authentication key exchange method
CN104584609A (en) * 2012-09-03 2015-04-29 阿尔卡特朗讯公司 Smart card initial personnalization with local generation of keys
CN103346887A (en) * 2013-07-02 2013-10-09 山东科技大学 Low-complexity identity authentication method based on intelligent card and under multiserver environment
CN103347018A (en) * 2013-07-02 2013-10-09 山东科技大学 Long-distance identity authentication method based on intelligent card and under multiple-service environment
CN105072110A (en) * 2015-08-06 2015-11-18 山东科技大学 Two-factor remote identity authentication method based on smart card
CN105491076A (en) * 2016-01-28 2016-04-13 西安电子科技大学 Heterogeneous network end-to-end authentication secret key exchange method based on space-sky information network
CN105871553A (en) * 2016-06-28 2016-08-17 电子科技大学 Identity-free three-factor remote user authentication method
CN109327313A (en) * 2018-11-07 2019-02-12 西安电子科技大学 A kind of Bidirectional identity authentication method with secret protection characteristic, server
CN113572765A (en) * 2021-07-23 2021-10-29 桂林电子科技大学 Lightweight identity authentication key negotiation method for resource-limited terminal

Non-Patent Citations (9)

* Cited by examiner, † Cited by third party
Title
"Impersonation Attack on Two Identity-Based Authenticated Key Exchange Protocols";Shiwu Zhang;《IEEE》;20100221;全文 *
"SECURITY WEAKNESS OF TWO IDENTITY-BASED";CHENG QINGFENG;《IEEE》;20100221;全文 *
"基于动态ID 的多服务器认证密钥协商方案";刘文芬;《信息工程大学学报》;20141231;全文 *
"基于无线传感器网络的身份认证方案的研究";温凤桐;《CNKI》;20190630;全文 *
"对三个无双线性对的密钥协商";程庆丰;《CNKI》;20190131;全文 *
"对两个特定安全模型下密钥交换协议的分析";李钰汀;《CNKI》;20190630;全文 *
"适用于无线传感器网络的动态ID 认证方案";刘文芬;《密码学报》;20140814;全文 *
"通用可组合的网关口令认证密钥交换协议";胡学先;《CNKI》;20170531;全文 *
"面向物联网的轻量级安全协议及关键技术研究";骆汉光;《CNKI》;20190630;全文 *

Also Published As

Publication number Publication date
CN110572800A (en) 2019-12-13

Similar Documents

Publication Publication Date Title
CN110572800B (en) Equipment identity authentication method and device in machine-to-machine environment
CN111639361B (en) Block chain key management method, multi-person common signature method and electronic device
Alzahrani et al. A provably secure and lightweight patient-healthcare authentication protocol in wireless body area networks
Chaudhry et al. Securing demand response management: A certificate-based access control in smart grid edge computing infrastructure
Wu et al. An efficient privacy-preserving mutual authentication scheme for secure V2V communication in vehicular ad hoc network
Gope et al. A realistic lightweight anonymous authentication protocol for securing real-time application data access in wireless sensor networks
Panda et al. A secure mutual authentication protocol for IoT environment
Li et al. A secure chaotic maps and smart cards based password authentication and key agreement scheme with user anonymity for telecare medicine information systems
Jiang et al. User centric three‐factor authentication protocol for cloud‐assisted wearable devices
Moon et al. An improvement of robust biometrics-based authentication and key agreement scheme for multi-server environments using smart cards
Chaudhry et al. Rotating behind privacy: An improved lightweight authentication scheme for cloud-based IoT environment
US20200195446A1 (en) System and method for ensuring forward & backward secrecy using physically unclonable functions
CN110381055B (en) RFID system privacy protection authentication protocol method in medical supply chain
Shen et al. Toward data privacy preservation with ciphertext update and key rotation for IoT
Odelu et al. A secure anonymity preserving authentication scheme for roaming service in global mobility networks
Chom Thungon et al. A lightweight authentication and key exchange mechanism for IPv6 over low‐power wireless personal area networks‐based Internet of things
Yang et al. Cryptanalysis and improvement of a biometrics-based authentication and key agreement scheme for multi-server environments
Chen et al. Enhanced authentication protocol for the Internet of Things environment
Yang et al. Publicly verifiable outsourced data migration scheme supporting efficient integrity checking
Abdussami et al. LASSI: a lightweight authenticated key agreement protocol for fog-enabled IoT deployment
Lee et al. Secure three-factor anonymous user authentication scheme for cloud computing environment
Lin et al. Authenticated quantum dialogue based on Bell states
Chen et al. Improved secure and lightweight authentication scheme for next-generation IOT infrastructure
Gupta et al. An improved authentication scheme for BLE devices with no I/O capabilities
Shashidhara et al. A secure and privacy-preserving mutual authentication system for global roaming in mobile networks

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant