CN111654481A - Identity authentication method, identity authentication device and storage medium - Google Patents
Identity authentication method, identity authentication device and storage medium Download PDFInfo
- Publication number
- CN111654481A CN111654481A CN202010447265.1A CN202010447265A CN111654481A CN 111654481 A CN111654481 A CN 111654481A CN 202010447265 A CN202010447265 A CN 202010447265A CN 111654481 A CN111654481 A CN 111654481A
- Authority
- CN
- China
- Prior art keywords
- random number
- user terminal
- sensor node
- key
- public key
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
- H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
Abstract
The invention discloses an identity authentication method, an identity authentication device and a storage medium, wherein the method comprises the following steps: sending an access request to a gateway so that the gateway can acquire and feed back a first public key of a sensor node; after receiving the first public key, acquiring a first random number, encrypting the first random number according to the first public key and transmitting the first random number to the sensor node; receiving encryption information and a second random number sent by the sensor node, acquiring a third random number and a session key according to the encryption information, determining that the first random number is equal to the third random number, judging that identity authentication is successful, and storing the session key; and encrypting the second random number according to the session key and transmitting the encrypted second random number to the sensor node. The invention improves the communication safety by establishing the bidirectional authentication; in addition, the requirements on the sensor nodes and the hardware cost are reduced, and the method can be widely applied to the technical field of the Internet of things.
Description
Technical Field
The invention relates to the technical field of Internet of things, in particular to an identity authentication method, an identity authentication device and a storage medium.
Background
For network applications of the internet of things, which involve massive equipment and data, how to ensure safe and reliable information exchange and communication, that is, how to perform identity authentication on a communication subject of the internet of things and how to perform confidential and safe transmission on data, is a current core technical problem.
Existing security protocol designs for the internet of things often revolve around the goal of guaranteeing lightweight communications and computing overhead. In some protocols, an ECC algorithm is used, which can reduce the operation overhead compared with the conventional RSA algorithm system. And a time synchronization mechanism is not needed to be used to avoid attack behaviors such as replay attack and the like a partial protocol, so that the calculation and communication expenses caused by time synchronization are avoided. Therefore, the key negotiation and establishment with low consumption and high safety are realized on the device with limited computing power and storage resources, such as an embedded device.
The existing authentication protocol is applied to the environment of the Internet of things and mainly has the following problems: 1. a time synchronization mechanism is used in the protocol design to resist replay attack and the like, namely, the time synchronization is used for judging the aging of each step of the protocol. Maintaining time synchronization between devices that are generally weak in the context of the internet of things is difficult to achieve and consumes a large amount of resources. 2. The internet of things equipment is directly used for authentication, all user information which can possibly access the internet of things equipment is required to be stored in the internet of things equipment, and the method is suitable for the condition that the number of users in small-scale internet of things application is small. However, for a general large-scale application of the internet of things, in which a large number of dynamic users are involved, it is difficult for the solution to maintain and update user information on a large number of internet of things devices deployed at different locations, and a large amount of stored user information consumes storage resources of the devices.
Disclosure of Invention
In order to solve one of the above technical problems, an object of the present invention is to provide an identity authentication method, an identity authentication device and a storage medium based on an identity authentication protocol of a trusted third party.
The technical scheme adopted by the invention is as follows:
an identity authentication method comprising the steps of:
the user terminal transmits the access request to the gateway;
the gateway acquires a first public key of a sensor node which needs to be accessed by the user terminal according to an access request, and transmits the first public key to the user terminal;
the user terminal acquires a first random number, encrypts the first random number according to the first public key and transmits the encrypted first random number to the sensor node;
the sensor node decrypts the received information to obtain the first random number, encrypts the first random number and transmits the encrypted first random number to the gateway;
the gateway decrypts the received information to obtain the first random number and a session key, and generates and transmits encrypted information to the sensor node according to the first random number and the session key;
after receiving the encrypted information, the sensor node acquires a session key according to the encrypted information, acquires a second random number, and transmits the encrypted information and the second random number to the user terminal;
the user terminal acquires a third random number and the session key according to the encryption information, determines that the first random number is equal to the third random number, judges that identity authentication is successful, stores the session key, encrypts the second random number according to the session key and transmits the second random number to the sensor node;
and the sensor node decrypts the received information to obtain a fourth random number, determines that the second random number is equal to the fourth random number, judges that the identity authentication is successful and stores the session key.
Further, the accessing request includes an identifier of the user terminal and an identifier of the sensor node, the gateway obtains a first public key of the sensor node that the user terminal needs to access according to the accessing request, and transmits the first public key to the user terminal, including:
the gateway confirms whether the user terminal has the authority of accessing the sensor node or not according to the identifier of the user terminal, and if so, the first public key is obtained according to the identifier of the sensor node;
based on a pre-stored gateway private key, a first public key is signed by adopting an elliptic curve cipher signature system, and the signed first public key is transmitted to the user terminal.
Further, the elliptic curve cryptographic signature system specifically includes:
randomly acquiring an integer k within a preset numerical range;
calculating a coordinate point V according to the integer k, and converting the X-axis coordinate of the coordinate point V into an integer;
calculating a first parameter r according to the coordinate point V after the X-axis coordinate conversion, wherein the first parameter r is not zero;
acquiring a second parameter s according to the identifier of the sensor node and the first public key, wherein the second parameter s is not zero;
splicing the first parameter r and the second parameter s to obtain a signature result;
the coordinate point V represents a point on an elliptic curve, determined by the user terminal by using the integer k, known only by the user terminal, the first parameter r represents an integer determined by using an x-axis coordinate of the coordinate point V, known only by the user terminal, and the second parameter s represents an operation result of a hash value of the content to be transmitted, namely a signature of the content to be transmitted, by using the first parameter r and a private key of the user terminal.
Further, the step of acquiring, by the user terminal, a first random number, encrypting the first random number according to the first public key, and transmitting the encrypted first random number to the sensor node includes:
the user terminal verifies the signature by using a pre-stored gateway public key, and acquires a first random number after the signature is verified correctly;
and based on the first public key, the first random number is encrypted by adopting an elliptic curve algorithm and then transmitted to the sensor node.
Further, after the first random number is encrypted by an elliptic curve algorithm, the first random number is transmitted to the sensor node, and the method comprises the following steps:
randomly acquiring an integer k within a preset numerical range;
calculating a third parameter R from the integer k1And a fourth parameter Z, said fourth parameter Z being non-zero;
according to the third parameter R1Acquiring a symmetric encryption key according to the fourth parameter Z, encrypting a first random number according to the symmetric encryption key, and transmitting the encrypted first random number to the sensor node;
the third parameter R _1 represents a result of hiding the integer k selected by the user terminal by elliptic curve multiplication, and the fourth parameter Z represents a secret result obtained by using the first public key and the integer k, and the secret result can be recovered by a message receiver by using a private key corresponding to the first public key.
Further, the identity authentication method further comprises a setting step, specifically:
setting elliptic curve parameters, wherein the elliptic curve parameters comprise a finite field, an elliptic curve on the finite field and a base point on the elliptic curve;
determining a key pair of the user terminal, a key pair of the gateway and a key pair of the sensor node according to the elliptic curve parameters, wherein the key pairs comprise a public key and a private key;
the user terminal stores a key pair of the user terminal, the gateway stores a key pair of the user terminal and public keys of all the sensor nodes, and the sensor nodes store a key pair of the user terminal and a gateway public key.
The other technical scheme adopted by the invention is as follows:
an identity authentication method comprising the steps of:
sending an access request to a gateway so that the gateway can acquire and feed back a first public key of a sensor node;
after receiving the first public key, acquiring a first random number, encrypting the first random number according to the first public key and transmitting the first random number to the sensor node;
receiving encryption information and a second random number sent by the sensor node, acquiring a third random number and a session key according to the encryption information, determining that the first random number is equal to the third random number, judging that identity authentication is successful, and storing the session key;
and encrypting the second random number according to the session key and transmitting the encrypted second random number to the sensor node.
The other technical scheme adopted by the invention is as follows:
an identity authentication method comprising the steps of:
receiving access information sent by a user terminal, acquiring a first random number according to the access information, encrypting the first random number and transmitting the encrypted first random number to a gateway;
receiving encrypted information sent by the gateway, acquiring a session key according to the encrypted information, acquiring a second random number, and transmitting the encrypted information and the second random number to the user terminal;
receiving authentication information sent by the user terminal, acquiring a fourth random number according to the authentication information, determining that the second random number is equal to the fourth random number, judging that identity authentication is successful, and storing the session key.
The other technical scheme adopted by the invention is as follows:
an identity authentication apparatus comprising:
at least one processor;
at least one memory for storing at least one program;
when executed by the at least one processor, cause the at least one processor to implement the method described above.
The other technical scheme adopted by the invention is as follows:
a storage medium having stored therein processor-executable instructions for performing the method as described above when executed by a processor.
The invention has the beneficial effects that: the invention improves the communication safety by establishing the bidirectional authentication; in addition, time synchronization does not need to be maintained between sensor nodes with severely limited resources, and information of the user terminal does not need to be stored on the sensor nodes, so that the requirements on the sensor nodes and the hardware cost are reduced.
Drawings
Fig. 1 is a flowchart illustrating steps of an identity authentication method according to an embodiment.
Detailed Description
Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to the same or similar elements or elements having the same or similar function throughout. The embodiments described below with reference to the accompanying drawings are illustrative only for the purpose of explaining the present invention, and are not to be construed as limiting the present invention.
In the description of the present invention, it should be understood that the orientation or positional relationship referred to in the description of the orientation, such as the upper, lower, front, rear, left, right, etc., is based on the orientation or positional relationship shown in the drawings, and is only for convenience of description and simplification of description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and thus, should not be construed as limiting the present invention.
In the description of the present invention, the meaning of a plurality of means is one or more, the meaning of a plurality of means is two or more, and larger, smaller, larger, etc. are understood as excluding the number, and larger, smaller, inner, etc. are understood as including the number. If the first and second are described for the purpose of distinguishing technical features, they are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated or implicitly indicating the precedence of the technical features indicated.
In the description of the present invention, unless otherwise explicitly limited, terms such as arrangement, installation, connection and the like should be understood in a broad sense, and those skilled in the art can reasonably determine the specific meanings of the above terms in the present invention in combination with the specific contents of the technical solutions.
The authentication protocol provided by this embodiment introduces a network model including three roles of a user (i.e., a user terminal, which logs in and accesses a sensor node through an intelligent terminal), a sensor and other internet of things devices (i.e., a sensor node), and an internet of things gateway. Wherein the user is an entity (including but not limited to a mobile phone, a computer, a tablet, etc.) accessing data in the application of the internet of things; the devices such as the sensors are common internet of things devices (such as intelligent water meters, intelligent electric meters and the like, temperature sensors and the like) with limited resources, and the internet of things gateway is responsible for managing all the internet of things devices in one domain, generally, the devices have strong performance and electric power. In practical application, in consideration of the transmission capability of the internet of things device, such gateway devices are commonly used in system networking.
The authentication protocol is in two stages, and the setting stage of the protocol can be entered in the deployment stage of the application of the Internet of things. After deployment is completed, in specific use, if a user needs to access data in the internet of things equipment, an authentication phase is started. The specific schemes of the two stages are described below.
First, set up stage
In the setup phase, operators are required to set up reasonable elliptic curve parameters and distribute them to sensors, gateways and users. The parameters comprise a finite field, an elliptic curve on the finite field, a base point on the elliptic curve and the like.
Thereafter, each user, as well as the gateway and the device, determines its own key pair. Namely, the parameters of the elliptic curve are utilized to generate respective public key and private key; that is, a secret key d ∈ R [1, n-1] is randomly selected, and a secret key pair { Q, d } is generated by calculating a public key Q ═ d × P from the secret key. Wherein, P is the base point, and n is the order of the elliptic curve of P.
After the key pair is generated, each sensor node needs to store its own key pair and the public key of the gateway. The gateway needs to store its own key pair and the public keys of all sensor nodes. The user needs to register with the gateway through the security means of the entity after generating its own key pair. After registration, the gateway owns the public key of the user, and the user owns the public key of the gateway.
Second, authentication phase
After the user connects to the sensor to be accessed, the protocol of the authentication phase is initiated. In this phase, the gateway acts as a trusted third party participating in the mutual authentication and key agreement process between the user and the sensor. After the successful completion of the stage, the user and the sensor can respectively authenticate the identity of the other party with the help of the gateway and carry out later secret communication by utilizing the session key generated in the protocol.
The detailed protocol flow is shown in fig. 1:
step 1: the first step of the protocol is for the user to send to the gateway: an identifier of itself and an identifier of the device to be accessed, i.e. a request for a device access to the gateway.
User → gateway: IDi||SIDj
Step 2: after the gateway searches the access right control of the gateway, the gateway confirms that the user corresponding to the user identifier really has the right to access the equipment. The gateway sends the equipment SIDjCorresponding public key QjAnd sending the public key to the user, and ensuring the validity of the public key by signing the public key of the device by using the private key of the gateway. The signature process can adopt an elliptic curve cryptographic signature system:
the gateway randomly selects an integer k such that: k belongs to R1, n-1, n is the order of initial parameter P of the elliptic curve.
After calculating V ═ kP, the X-axis coordinate of the V point is converted to an integer:
where V is a point on the user-only known elliptic curve uniquely determined by the user using his randomly selected integer k, and P is the base point.
Computing
If the calculation result r is 0, the original operation must be returned, and the operation must be repeated after another k is selected until r is not 0. Wherein r is the result of the modulo of the x-axis coordinate of the V point to n.
For SIDj||QjHash processing is carried out to obtain e ═ H (SID)j||Qj)。
Calculating s ═ e + r × dGWN)×k-1mod n. And ensures that S is not equal to 0, otherwise returns to the original operation to reselect k.
And splicing the calculation results r and s to obtain a signature result of the gateway, and sending the signature result to the user.
Gateway → user: IDj||Qj||signatureGWN(SIDj||Qj)
And step 3: after receiving the information, the user firstly verifies the validity of the signature by using the public key of the gateway. The verification process is the reverse operation of step 2. If the signature is verified to be correct, the user encrypts N with the obtained device public key in an elliptic curve algorithmi||IDiWherein N isiIs a first random number, IDiThe specific encryption steps for the user identifier are as follows:
the user randomly selects a k such that: k is an element of R1, n-1.
Calculation of R1K × P and Z h × k × QjAnd ensures that the result Z is not equal to ∞, otherwise k is reselected. Wherein R is1Represents the result of hiding the user-selected random number k using elliptic curve multiplication and Z represents a secret result using the first public key and the user-selected random number k. The result can be recovered by the message receiver by using the private key corresponding to the first public key. h represents an initial integer, Q, shared by all participants preset in the setup phasejIs the device public key (i.e., the first public key).
By using (x)Z,R1) Generating a symmetric encrypted key symkey, xZIs the X-axis coordinate of the above operation result Z. N may then be encrypted using a symmetric encryption algorithm, such as AES or the likei||IDi. I.e. C1＝ENCsymkey(Ni||IDi)。
Will { R1||C1And combining the information into encrypted information and sending the encrypted information to the sensor.
User → sensor
And 4, step 4: after receiving the information, the device decrypts by using the private key of the device and the inverse operation of the step 3. Decrypt to produce NiThereafter, N is encrypted using the encryption process of step 3 and the public key of the gatewayiAnd sent to the gateway.
Sensor → gateway
And 5: the gateway decrypts the received data, and performs the following operations after decryption without errors:
finding out public key Q corresponding to useriGenerating signature by using the signature mode of the step 2GWN(IDi||Qi) Randomly selecting an integer KsAs the next session key between the user and the device.
Generating a signatureGWN(IDi||SIDj||Ni||Ks)；
Generating encrypted information using a public key of a sensor
The results are sent to the sensor.
Gateway → sensor: IDi||Qi||signatureGWN(IDi||Qi)
Step 6: after receiving the information of step 5, the device first verifies whether the content is valid. If it is valid, a random number N is selectedjAnd the last part of the information is compared with NjAnd the encrypted public key of the user is used together for encryption and then is sent to the user.
Device → user
And 7: the user receives the message and decrypts to obtain N'iAnd verifying whether N is selected from N itself beforeiAre equal. If equal, K in the message is acknowledgedsIs a session key and uses its symmetric encryption NjAnd then sent to the device.
User → device
Judging N 'after user receives'jWhether or not to react with NjAre equal. If equal, K in the message is acknowledgedsIs a session key.
After the protocol is finished, the mutual authentication between the user and the equipment is realized, and the session key K in the subsequent communication is obtaineds。
By the identity authentication method, bidirectional authentication and safe communication can be established for the equipment access process in the Internet of things with high safety. Meanwhile, the embodiment does not need to maintain time synchronization among devices with severely limited resources, and does not need to store user information on the devices, thereby avoiding the overhead of the devices, and also not needing to frequently configure and modify the devices after system deployment.
The embodiment also provides an identity authentication method, which comprises the following steps:
sending an access request to the gateway so that the gateway can acquire and feed back the first public key of the sensor node;
after receiving the first public key, acquiring a first random number, encrypting the first random number according to the first public key and transmitting the first random number to the sensor node;
receiving encrypted information and a second random number sent by a sensor node, acquiring a third random number and a session key according to the encrypted information, determining that the first random number is equal to the third random number, judging that identity authentication is successful, and storing the session key;
and encrypting the second random number according to the session key and transmitting the second random number to the sensor node.
The method of the embodiment is mainly executed by a user terminal, the user terminal firstly sends an access request to a gateway when needing to access the sensor node, and the gateway stores public keys of all the accessed sensor nodes, and sends the public keys (namely, the first public key) of the corresponding sensor nodes to the user terminal after searching and obtaining the public keys. And after the user terminal receives the first public key, sending information to the corresponding sensor node according to the first public key so that the sensor node sends the session key to the user terminal. And when the user terminal receives the information sent by the sensor node and verifies that the first random number is equal to the third random number, the user terminal passes the identity authentication, stores the session key and uses the session key in subsequent communication with the sensor node. The encrypted information includes a public key of the user terminal.
The embodiment also provides an identity authentication method, which comprises the following steps:
receiving access information sent by a user terminal, acquiring a first random number according to the access information, and performing processing on the first random number
Transmitting the encrypted data to a gateway;
receiving the encrypted information sent by the gateway, acquiring a session key according to the encrypted information, acquiring a second random number, and encrypting
Transmitting the information and the second random number to the user terminal;
and receiving authentication information sent by the user terminal, acquiring a fourth random number according to the authentication information, determining that the second random number is equal to the fourth random number, judging that the identity authentication is successful, and storing the session key.
The method of the embodiment is mainly executed by a sensor node, wherein after receiving access information sent by a user terminal, the sensor node decrypts the access information to obtain a first random number, sends the first random number to a gateway to obtain a session key from the gateway, and sends the session key and a second random number generated by the sensor node to the user terminal. And when the user terminal sends back authentication information, checking whether the second random number is equal to the fourth random number, if so, indicating that the identity authentication is passed, storing the session key by the sensor node, and using the session key in subsequent communication with the user terminal. The encrypted information includes a public key of the user terminal. In this embodiment, the sensor node does not need to record the relevant information of the user terminal, so that the requirement of the sensor node is reduced, and when the sensor node needs to be laid out in a large number, the cost of the sensor node is greatly reduced.
This embodiment also provides an identity authentication device, includes:
at least one processor;
at least one memory for storing at least one program;
when the at least one program is executed by the at least one processor, the at least one processor is caused to perform the above-described method.
The identity authentication device of the embodiment can execute the identity authentication method provided by the embodiment of the method of the invention, can execute any combination of the implementation steps of the embodiment of the method, and has corresponding functions and beneficial effects of the method.
The present embodiments also provide a storage medium having stored therein processor-executable instructions for performing the method as described above when executed by a processor.
The storage medium of this embodiment may execute the identity authentication method provided in the method embodiment of the present invention, may execute any combination of the implementation steps of the method embodiment, and has corresponding functions and beneficial effects of the method.
It will be understood that all or some of the steps, systems of methods disclosed above may be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on computer readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). The term computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data, as is well known to those of ordinary skill in the art. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, Digital Versatile Disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can accessed by a computer. In addition, communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media as known to those skilled in the art.
The embodiments of the present invention have been described in detail with reference to the accompanying drawings, but the present invention is not limited to the above embodiments, and various changes can be made within the knowledge of those skilled in the art without departing from the gist of the present invention.
Claims (10)
1. An identity authentication method, comprising the steps of:
the user terminal transmits the access request to the gateway;
the gateway acquires a first public key of a sensor node which needs to be accessed by the user terminal according to an access request, and transmits the first public key to the user terminal;
the user terminal acquires a first random number, encrypts the first random number according to the first public key and transmits the encrypted first random number to the sensor node;
the sensor node decrypts the received information to obtain the first random number, encrypts the first random number and transmits the encrypted first random number to the gateway;
the gateway decrypts the received information to obtain the first random number and a session key, and generates and transmits encrypted information to the sensor node according to the first random number and the session key;
after receiving the encrypted information, the sensor node acquires a session key according to the encrypted information, acquires a second random number, and transmits the encrypted information and the second random number to the user terminal;
the user terminal acquires a third random number and the session key according to the encryption information, determines that the first random number is equal to the third random number, judges that identity authentication is successful, stores the session key, encrypts the second random number according to the session key and transmits the second random number to the sensor node;
and the sensor node decrypts the received information to obtain a fourth random number, determines that the second random number is equal to the fourth random number, judges that the identity authentication is successful and stores the session key.
2. The identity authentication method according to claim 1, wherein the access request includes an identifier of the user terminal and an identifier of the sensor node, the gateway obtains a first public key of the sensor node that the user terminal needs to access according to the access request, and transmits the first public key to the user terminal, including:
the gateway confirms whether the user terminal has the authority of accessing the sensor node or not according to the identifier of the user terminal, and if so, the first public key is obtained according to the identifier of the sensor node;
based on a pre-stored gateway private key, a first public key is signed by adopting an elliptic curve cipher signature system, and the signed first public key is transmitted to the user terminal.
3. The identity authentication method according to claim 2, wherein the elliptic curve cryptographic signature system specifically comprises:
randomly acquiring an integer k within a preset numerical range;
calculating a coordinate point V according to the integer k, and converting the X-axis coordinate of the coordinate point V into an integer;
calculating a first parameter r according to the coordinate point V after the X-axis coordinate conversion, wherein the first parameter r is not zero;
acquiring a second parameter s according to the identifier of the sensor node and the first public key, wherein the second parameter s is not zero;
splicing the first parameter r and the second parameter s to obtain a signature result;
the coordinate point V represents a point on an elliptic curve, determined by the user terminal by using the integer k, known only by the user terminal, the first parameter r represents an integer determined by using an x-axis coordinate of the coordinate point V, known only by the user terminal, and the second parameter s represents an operation result of a hash value of the content to be transmitted, namely a signature of the content to be transmitted, by using the first parameter r and a private key of the user terminal.
4. An identity authentication method according to claim 2, wherein the user terminal obtains the first random number,
encrypting the first random number according to the first public key and transmitting the encrypted first random number to the sensor node, wherein the encrypting comprises the following steps:
the user terminal verifies the signature by using a pre-stored gateway public key, and acquires a first random number after the signature is verified correctly;
and based on the first public key, the first random number is encrypted by adopting an elliptic curve algorithm and then transmitted to the sensor node.
5. The identity authentication method of claim 4, wherein the encrypting the first random number by an elliptic curve algorithm based on the first public key and then transmitting the encrypted first random number to the sensor node comprises:
randomly acquiring an integer k within a preset numerical range;
calculating a third parameter R from the integer k1And a fourth parameter Z, said fourth parameter Z being non-zero;
according to the third parameter R1Acquiring a symmetric encryption key according to the fourth parameter Z, encrypting a first random number according to the symmetric encryption key, and transmitting the encrypted first random number to the sensor node;
wherein the third parameter R1The result representing that the integer k selected by the user terminal is hidden by elliptic curve multiplication, and the fourth parameter Z representing a secret result obtained by using the first public key and the integer k, which can be recovered by the message receiver by using the private key corresponding to the first public key.
6. The identity authentication method according to claim 1, further comprising a setting step, specifically:
setting elliptic curve parameters, wherein the elliptic curve parameters comprise a finite field, an elliptic curve on the finite field and a base point on the elliptic curve;
determining a key pair of the user terminal, a key pair of the gateway and a key pair of the sensor node according to the elliptic curve parameters, wherein the key pairs comprise a public key and a private key;
the user terminal stores a key pair of the user terminal, the gateway stores a key pair of the user terminal and public keys of all the sensor nodes, and the sensor nodes store a key pair of the user terminal and a gateway public key.
7. An identity authentication method, comprising the steps of:
sending an access request to a gateway so that the gateway can acquire and feed back a first public key of a sensor node;
after receiving the first public key, acquiring a first random number, encrypting the first random number according to the first public key and transmitting the first random number to the sensor node;
receiving encryption information and a second random number sent by the sensor node, acquiring a third random number and a session key according to the encryption information, determining that the first random number is equal to the third random number, judging that identity authentication is successful, and storing the session key;
and encrypting the second random number according to the session key and transmitting the encrypted second random number to the sensor node.
8. An identity authentication method, comprising the steps of:
receiving access information sent by a user terminal, acquiring a first random number according to the access information, encrypting the first random number and transmitting the encrypted first random number to a gateway;
receiving encrypted information sent by the gateway, acquiring a session key according to the encrypted information, acquiring a second random number, and transmitting the encrypted information and the second random number to the user terminal;
receiving authentication information sent by the user terminal, acquiring a fourth random number according to the authentication information, determining that the second random number is equal to the fourth random number, judging that identity authentication is successful, and storing the session key.
9. An identity authentication apparatus, comprising:
at least one processor;
at least one memory for storing at least one program;
when executed by the at least one processor, cause the at least one processor to implement an identity authentication method as claimed in any one of claims 1 to 8.
10. A storage medium having stored therein processor-executable instructions, which when executed by a processor, are configured to perform the method of any one of claims 1-8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010447265.1A CN111654481B (en) | 2020-05-25 | 2020-05-25 | Identity authentication method, identity authentication device and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010447265.1A CN111654481B (en) | 2020-05-25 | 2020-05-25 | Identity authentication method, identity authentication device and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111654481A true CN111654481A (en) | 2020-09-11 |
| CN111654481B CN111654481B (en) | 2021-06-08 |
Family
ID=72346831
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010447265.1A Active CN111654481B (en) | 2020-05-25 | 2020-05-25 | Identity authentication method, identity authentication device and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111654481B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112600676A (en) * | 2020-12-09 | 2021-04-02 | 北京航天紫光科技有限公司 | Edge gateway access method and device for industrial internet |
| CN112887308A (en) * | 2021-01-26 | 2021-06-01 | 许少建 | Non-inductive network identity authentication method and system |
| CN113596004A (en) * | 2021-07-22 | 2021-11-02 | 支付宝(杭州)信息技术有限公司 | Identity authentication method and device in multi-party security computing |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1770681A (en) * | 2005-10-14 | 2006-05-10 | 西安电子科技大学 | Conversation key safety distributing method under wireless environment |
| CN102325131A (en) * | 2011-07-20 | 2012-01-18 | 北京邮电大学 | Bidirectional identity authentication method for wireless sensor network node |
| CN103699920A (en) * | 2014-01-14 | 2014-04-02 | 西安电子科技大学昆山创新研究院 | Radio frequency identification two-way authentication method based on ellipse curve |
| CN106657124A (en) * | 2017-01-03 | 2017-05-10 | 宜春学院 | Pseudonym-based anonymous authentication and key negotiation optimization method and optimized authentication analysis method for Internet of Things |
| CN109873815A (en) * | 2019-01-28 | 2019-06-11 | 西安电子科技大学 | Isomeric compound networking certification method based on edge calculations, Internet of Things security platform |
-
2020
- 2020-05-25 CN CN202010447265.1A patent/CN111654481B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1770681A (en) * | 2005-10-14 | 2006-05-10 | 西安电子科技大学 | Conversation key safety distributing method under wireless environment |
| CN102325131A (en) * | 2011-07-20 | 2012-01-18 | 北京邮电大学 | Bidirectional identity authentication method for wireless sensor network node |
| CN103699920A (en) * | 2014-01-14 | 2014-04-02 | 西安电子科技大学昆山创新研究院 | Radio frequency identification two-way authentication method based on ellipse curve |
| CN106657124A (en) * | 2017-01-03 | 2017-05-10 | 宜春学院 | Pseudonym-based anonymous authentication and key negotiation optimization method and optimized authentication analysis method for Internet of Things |
| CN109873815A (en) * | 2019-01-28 | 2019-06-11 | 西安电子科技大学 | Isomeric compound networking certification method based on edge calculations, Internet of Things security platform |
Non-Patent Citations (2)
| Title |
|---|
| HSIU-LIEN YEH等: "A Secured Authentication Protocol for Wireless Sensor Networks Using Elliptic Curves Cryptography", 《SENSORS》 * |
| 朱艳: "面向物联网的身份认证和访问控制的研究", 《中国优秀硕士学位论文全文数据库 信息科技辑》 * |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112600676A (en) * | 2020-12-09 | 2021-04-02 | 北京航天紫光科技有限公司 | Edge gateway access method and device for industrial internet |
| CN112600676B (en) * | 2020-12-09 | 2023-04-07 | 北京航天紫光科技有限公司 | Edge gateway access method and device for industrial Internet |
| CN112887308A (en) * | 2021-01-26 | 2021-06-01 | 许少建 | Non-inductive network identity authentication method and system |
| CN113596004A (en) * | 2021-07-22 | 2021-11-02 | 支付宝(杭州)信息技术有限公司 | Identity authentication method and device in multi-party security computing |
| CN113596004B (en) * | 2021-07-22 | 2023-06-20 | 支付宝(杭州)信息技术有限公司 | Identity authentication method and device in multiparty security calculation |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111654481B (en) | 2021-06-08 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9621545B2 (en) | System and method for connecting client devices to a network | |
| US8285989B2 (en) | Establishing a secured communication session | |
| CN111654481B (en) | Identity authentication method, identity authentication device and storage medium | |
| CN111050322B (en) | GBA-based client registration and key sharing method, device and system | |
| US10680835B2 (en) | Secure authentication of remote equipment | |
| KR101297648B1 (en) | Authentication method between server and device | |
| US20210167963A1 (en) | Decentralised Authentication | |
| CN110635901A (en) | Local Bluetooth dynamic authentication method and system for Internet of things equipment | |
| WO2022135391A1 (en) | Identity authentication method and apparatus, and storage medium, program and program product | |
| CN116015807A (en) | Lightweight terminal security access authentication method based on edge calculation | |
| CN116170144B (en) | Smart power grid anonymous authentication method, electronic equipment and storage medium | |
| US11240661B2 (en) | Secure simultaneous authentication of equals anti-clogging mechanism | |
| US20240064006A1 (en) | Identity authentication method and apparatus, storage medium, program, and program product | |
| CN116204914A (en) | Trusted privacy computing method, device, equipment and storage medium | |
| KR101256114B1 (en) | Message authentication code test method and system of many mac testserver | |
| US20240064011A1 (en) | Identity authentication method and apparatus, device, chip, storage medium, and program | |
| CN115473655A (en) | Terminal authentication method, device and storage medium for access network | |
| CN114417309A (en) | Bidirectional identity authentication method, device, equipment and storage medium | |
| WO2022135387A1 (en) | Identity authentication method and apparatus | |
| EP4270866A1 (en) | Identity authentication method and apparatus, device, chip, storage medium, and program | |
| WO2022135386A1 (en) | Method and device for identity authentication | |
| WO2022135385A1 (en) | Identity authentication method and apparatus | |
| WO2022135404A1 (en) | Identity authentication method and device, storage medium, program, and program product | |
| CN117729056A (en) | Equipment identity authentication method and system | |
| WO2023011702A1 (en) | Establishment of forward secrecy during digest authentication |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |