CN112543098B - Intelligent building mobile equipment authentication system and method based on challenge response mechanism - Google Patents
Intelligent building mobile equipment authentication system and method based on challenge response mechanism Download PDFInfo
- Publication number
- CN112543098B CN112543098B CN202011262440.6A CN202011262440A CN112543098B CN 112543098 B CN112543098 B CN 112543098B CN 202011262440 A CN202011262440 A CN 202011262440A CN 112543098 B CN112543098 B CN 112543098B
- Authority
- CN
- China
- Prior art keywords
- user
- challenge
- control center
- code
- user side
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Telephonic Communication Services (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
The invention discloses an intelligent building mobile equipment authentication system and method based on a challenge response mechanism, which comprises a control center, a relay node, a router and mobile equipment, wherein the mobile equipment is used for sending a registration application, applying for command execution, initiating a challenge, making a response, sending and receiving a generation code to the router. The router is used for selecting and setting a route, broadcasting a generation code of the connection equipment, processing a network request, forwarding a control request and positioning the mobile equipment. The control center is used for analyzing the rationality of the control request, judging suspicious equipment, cutting off the broadcast of the suspicious equipment to generate codes, analyzing equipment possibly attacked, judging whether key equipment in the building is attacked or not, and triggering the alarm device. According to the invention, by adopting a technical means of carrying out safety protection on the mobile equipment in the intelligent building in a challenge response mode, the hidden danger of physical fusion attack of malicious information in the prior art is overcome on the premise of fully ensuring the privacy of the user.
Description
Technical Field
The invention belongs to the technical field of safety protection of an information physical fusion system, and particularly relates to a mobile equipment authentication system and method in an intelligent building.
Background
With the development of the information physics convergence technology, threats of a physical device no longer come from a physical layer, the intellectualization of the device enables a network hacker to attack the physical device by means of network attack, and for an operator of a system, the improvement of the intellectualization degree of the device is expected, and the network hacker is also prohibited to launch an attack on the device from the network layer. For the information physical fusion system, due to the wireless internet connection of the external equipment, the physical equipment damage caused by network attack becomes easier, and particularly, the intelligent building system frequently interacts with the outside. Based on the propagation speed and the propagation range of the network, the damage caused by the attack of the network layer to the physical equipment is stronger than the attack destructive power of a pure physical layer, and the loss caused by the attack is more serious, so that the network security protection capability of the information physical fusion system is the premise that the information physical fusion system can be popularized and used in a large range.
For an operation and manager of the information physical fusion system, more protection and control on access and read-write operation of inherent equipment of the system are expected to be achieved, and attack events such as viruses, illegal access, denial of service, illegal occupation of network resources, illegal control and the like are avoided; for security-related security units, the security-related security units hope to filter and prevent illegal, harmful or country-confidential information from leaking, avoid harm to the society and cause huge losses to the country.
At present, the development of intelligent buildings is in a rapid development stage, multiple disciplines and high and new technologies are largely integrated and used, and the intelligent buildings are rapidly developed. It has begun to move towards networking, informatization and intelligence. The intelligent building utilizes a plurality of advanced technologies such as artificial intelligence, information security, network communication, RFID, comprehensive wiring and the like, home products advance from digitalization to intellectualization, and a family intelligent internet of things is initially constructed, so that the life of people is safer, more comfortable and more intelligent. However, the security risk faced by intelligent buildings is not negligible, once the control system of one building is broken, hackers can easily enter the control systems of other buildings. The communication protocols used by the automation control systems of many buildings are integrated with each other for product compatibility and ease of operation. Furthermore, if the building control system is on the same network as the company's enterprise network, the hazard will be even greater. Therefore, the network security problem should be kept away like the fire and theft prevention problem of each household.
For some intelligent buildings that are open to the outside, the uncertainty of the outside visitors poses a greater challenge to their security protection. As personal information related in mobile devices becomes richer and more comprehensive, privacy protection for users is also very critical in monitoring of external mobile devices. In the prior art, registration authentication of a plurality of access network devices needs a mode of verifying a code through a mobile phone number or a short message, and because a telephone number is usually authenticated by a real name and is bound with an identity card, the privacy of a user is difficult to ensure.
Disclosure of Invention
The invention aims to provide a security protection system based on a challenge response mechanism, which can prevent malicious information physical fusion attack and improve the security of the information physical fusion system on the premise of fully ensuring the privacy of a user by attacking physical equipment through a network.
The technical scheme adopted by the invention is as follows:
the intelligent building mobile equipment authentication method based on the challenge response mechanism comprises the following steps:
step S1: a user terminal entering a building applies for registering an account number and sends the account number to a control center, and the control center generates a random generation code and returns the random generation code to the user terminal;
step S2: the user side accesses the network or applies for the instruction and transmits with the random generating code, the random generating code is used as the identity information of the user and is accessed by other users; all randomly generated codes of the user terminals entering the building are broadcasted to the peripheral user terminals in real time through the routers connected with the randomly generated codes;
step S3: a user side sends a control request for initiating inherent equipment in a building to a control center;
step S4: the control center receives the control request, inquires the trust list and judges whether the user side is in the trust list:
a1, if the user end is in the trust list, executing the control request sent by the user end;
a2, if the user side is not in the trust list, initiating a challenge response to the user side:
a21, if the user end responds by challenge, executing the control request of the client end;
a22, if the user end fails to pass the challenge response, the user end is marked as a suspicious user, the control center analyzes the historical behavior of the user end and tracks the next behavior according to the router through which the randomly generated code is uploaded, whether the user is a malicious user is judged, if the user is determined to be the malicious user, the network connection of the user is cut off, and the randomly generated code is broadcasted to all devices and users which have access to the network simultaneously with the malicious user through the control center.
Further, in step S4, when a user side is marked as a malicious user, the control center sends a self-check two-dimensional code to the user side that appears in the building at the same time interval as the user side, and uploads a locally stored randomly generated code to the control center by scanning the self-check two-dimensional code, and the control center feeds back whether the user side has a possibility of being attacked maliciously.
Further, the trust list described in step S4 is updated by the following steps:
step S41, the control center configures the trust visitor list of each inherent device;
step S42, when the fixed equipment in the building receives the access request of the user terminal, judging whether the user terminal is in the trust access list:
if the user side is in the trust access list, judging whether the instruction is normal:
when the instruction is abnormal, the feedback control center judges whether to remove the trust list according to the historical behavior;
otherwise, executing the instruction normally;
if the user side is not in the trust access list, a challenge response mechanism is adopted to send out a challenge, and the user side generates a response code according to a predetermined mechanism after receiving the challenge and returns the response code to the control center; the control center judges whether the response codes are matched, if so, the instruction of the visitor is executed, otherwise, the instruction is fed back to the control center and is marked as a suspected malicious user;
after the same user responds by challenge N times in succession, the control center can add it to the trusted visitor list.
Further, the challenge-response mechanism adopted in step S42 includes the following steps:
step S421: the user terminal initiates a challenge request to the equipment initiating the control request in a mode of sending a challenge code;
step S422: the router receives the challenge code, encrypts the challenge code and sends the encrypted challenge code to the control center;
step S423: the control center receives the challenge request and carries out security verification on the untrusted equipment:
if the security verification fails, the control center does not forward the challenge request;
if the security verification is passed, the control center forwards the challenge request to the untrusted user side, the untrusted user side receives the challenge code, decodes the challenge code and generates a response code, and the response code is returned to the initiating device;
the challenge initiating device compares the response code with the expected response result generated by the challenge initiating device, and executes the control request when the comparison result is the same; and when the comparison results are different, refusing to execute the control requirement, feeding back the comparison result to the control center and warning the doubtful property of the comparison result.
Further, in step S423, the control center performs security verification by pre-analyzing the historical access record of the untrusted device;
if the security verification of a certain user side fails, directly marking the user side as high risk and tracking the access behavior of the user side until the risk is relieved;
and if the security verification is passed, forwarding the challenge code to the user side.
Further, in step S423, the control center fits the movement track according to the router number accessed by the user end, and determines whether the user end is a malicious user according to the number of irrelevant devices on the movement track, the number of times of failure of challenge response, and the like.
The intelligent building mobile equipment authentication system based on the challenge response mechanism comprises a control center and a router which are electrically connected, wherein the router is used for receiving networking applications and control requests sent by a user side; assigning a random generation code to a user side, processing a user networking application, and transmitting a challenge response request of the user side and a control center; the control center is used for receiving the networking application and the control request transmitted by the router, controlling the interaction of all equipment in the building, judging whether the behavior of the user side is malicious behavior, informing all equipment which is possibly attacked to perform self-check, cutting off the network connection of the risk equipment, analyzing the historical behavior of the risk equipment, and tracking and controlling the risk equipment until the risk is relieved.
Further, the control center and the router are connected through the relay node.
Compared with the prior art, the invention has at least the following beneficial technical effects:
the invention provides a detection and identification mechanism of suspicious users, once a user is marked as a suspicious user, a control center analyzes the type and source of a mobile device and the purpose of accessing inherent equipment, analyzes the historical behavior of the mobile device according to a router through which a randomly generated code is uploaded, tracks the next behavior in a building and judges whether the mobile device is a malicious attacker.
The invention carries out the safety protection of the information physical fusion system by adopting a challenge response mechanism, combines the mobile equipment authentication of the randomly generated code, does not need to acquire any privacy information of a user end as an identification, only adopts the information without any user end characteristics, namely the randomly generated code, as the identity information of the user end, overcomes the hidden danger of malicious information physical fusion attack and the safety risk that the network attack damages the physical equipment in the existing information physical fusion system, especially an intelligent building system, on the premise of protecting the privacy of the user to the maximum extent, realizes the comprehensive safety protection of the information physical fusion system, has the beneficial effect of timely discovering the attack behavior of a malicious attacker, and enhances the protection capability of the information physical fusion system against the malicious information physical fusion attack.
Further, when a certain user side is marked as a malicious user, the control center sends a self-checking two-dimensional code to the user side which appears in the building at the same time period, the self-checking two-dimensional code is scanned, the locally stored randomly generated code is uploaded to the control center, and the control center feeds back whether the user side has the possibility of being attacked maliciously or not, so that the safety of other visiting users is ensured.
Furthermore, the trust list in step S4 is updated in time according to the access condition of the user side, so as to improve the response speed on the premise of ensuring the security of the devices in the building.
Furthermore, the control center conducts security verification through pre-analyzing historical access records of the untrusted device, and the attack risk of malicious users is reduced.
The system realizes the authentication of the intelligent building mobile equipment by utilizing the existing system and the router in the building, protects the safety of the equipment in the building on the premise of ensuring the privacy of users, can be directly realized by integrating related functional modules in the existing control system of the building, and saves the cost.
Drawings
FIG. 1 is a schematic diagram of a challenge response based security system of the present invention;
FIG. 2 is a flowchart of the operation of a trust list control strategy of an apparatus of the present invention;
FIG. 3 is a flowchart illustrating a method for authenticating a mobile device based on a randomly generated code control strategy according to the present invention;
fig. 4 is a flowchart of the operation of embodiment 5 of the present invention.
Detailed Description
In order to make the objects and technical solutions of the present invention clearer and easier to understand. The present invention will be described in further detail with reference to the following drawings and examples, wherein the specific examples are provided for illustrative purposes only and are not intended to limit the present invention.
In the description of the present invention, it is to be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", and the like, indicate orientations or positional relationships based on those shown in the drawings, and are used only for convenience in describing the present invention and for simplicity in description, and do not indicate or imply that the referenced devices or elements must have a particular orientation, be constructed and operated in a particular orientation, and thus, are not to be construed as limiting the present invention. Furthermore, the terms "first", "second" and "first" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the present invention, "a plurality" means two or more unless otherwise specified. In the description of the present invention, it should be noted that, unless otherwise explicitly specified or limited, the terms "mounted," "connected," and "connected" are to be construed broadly, e.g., as meaning either a fixed connection, a removable connection, or an integral connection; can be mechanically or electrically connected; they may be connected directly or indirectly through intervening media, or they may be interconnected between two elements. The specific meanings of the above terms in the present invention can be understood in specific cases to those skilled in the art.
Example 1
As shown in fig. 1, an intelligent building mobile device authentication system based on a challenge-response mechanism includes a control center, a relay node, a router, and a user side connected in sequence, where the user side includes a device inherent in a building and a foreign mobile device.
The user side is used for sending a networking application to the router, receiving a generating code of the user side connected to the same router at the same time, storing the generating code in the local, sending a control request to the control center and initiating and responding a challenge response;
the router is used for processing the user networking application and transmitting the challenge response request of the user side and the control center; the floor relay node is used for connecting the router and the control center, recording the number of historical access devices of the router and controlling the on-off of the router;
the control center is used for controlling interaction of all devices (including a user terminal, a router and a relay node) in the building, generating a user terminal random generation code, judging whether the behavior of the devices is malicious behavior, informing all devices which are possibly attacked to carry out self-checking, cutting off network connection of the risk devices, analyzing historical behaviors of the risk devices, and carrying out tracking control until risk is relieved.
The control center consists of a small number of personnel and a large number of computers with strong computing power, and can intervene in management decision or process emergency at any time as the brain of the intelligent building.
The relay node plays a role in connecting the control center and the routers, can manage a plurality of routers in groups, and can cut off the risk router in an emergency without affecting the network connection of key equipment.
The user side can be mobile equipment, computer equipment, embedded equipment and other internet access equipment, and the mobile equipment can be Android or IOS-based mobile equipment.
Besides, a code generation module, a challenge response module, a trusted visitor list and an ID generator are integrated in the control center. The generating code module is used for managing and updating a generating code generating algorithm; the challenge response module is used for managing updating and setting a challenge response mechanism; the trust visitor list is used for managing and detecting the trust list of the inherent equipment; and the ID generator is used for generating the ID of the user terminal.
Example 2
An intelligent building mobile equipment authentication method based on a challenge response mechanism specifically comprises the following steps:
step S1: a user enters a building, applies for registering an account number and sends the account number to a router, the router uploads user account number information to a control center, and the control center generates a random generation code and returns the random generation code to a user side;
step S2: the user side accesses the network or applies for the instruction each time and transmits the instruction together with the random generated code, and the random generated code is used as the identity information of the user and is accessed by other users; all the randomly generated codes of the mobile user terminals entering the building are broadcasted to the peripheral user terminals in real time through the routers connected with the randomly generated codes, and are stored locally by other users;
step S3: the user side sends a control request for the inherent equipment in the building to the control center through the router;
step S4: the control center receives the control request, inquires the trust list and judges whether the user side is in the trust list:
if the user side is in the trust list, the control request sent by the user side is directly executed without initiating a challenge response;
if the user side is not in the trust list, a challenge response is initiated to the user side:
step SA 1: if the user end passes the challenge response, executing the control request of the client end;
step SA 2: if the user end can not respond by the challenge, the user end is marked as a suspicious user. After the user side is marked as a suspicious user side, the control center analyzes the historical behavior of the user side according to the router through which the randomly generated code is uploaded, tracks the next behavior of the user side and judges whether the user side is a malicious user or not.
After the user is determined to be a malicious user, the network connection of the user is cut off, and the randomly generated code is broadcasted to all equipment and users which have access to the network simultaneously with the malicious user through the control center;
step S5: and a user terminal leaving the building receives a self-checking two-dimensional code, the two-dimensional code is scanned and uploaded to a randomly generated code stored locally in the control center, and the system feeds back whether the user has the possibility of being attacked maliciously or not.
Through the steps, the privacy of the visitor can be protected to the maximum extent, each mobile device only corresponds to one generated code in the control center, and other devices and the control center only can see the randomly generated code of the device and cannot acquire the identity information and the internal data of a specific user side.
The random generation code of the invention is a mode of a main key plus a random code, and the specific generation steps are as follows: firstly, a random ID is generated from an ID generator embedded in a computer of a control center, a character string with fixed digits (such as 8 digits) is refilled (0 is filled on the left side of an insufficient digit, the digit is directly used when the digit exceeds the digit), and finally, 1 letter or other non-numeric symbols are randomly inserted behind each digit, so that a unique randomly generated code can be obtained, and an algorithm of the randomly generated code can be replaced at any time as required.
Example 3
This embodiment is a further supplement to the step S4 in the above example, and as shown in fig. 2, a method for controlling a trust list of a device includes the following steps:
step S41, before the intelligent building receives external access, the control center configures a trust access list of each inherent device in advance;
step S42, when the fixed equipment in the building receives the access request of the user terminal, judging whether the user terminal is in the trust access list:
if the user side is in the trust access list, only the reliability of the instruction needs to be analyzed, when the instruction is abnormal, the feedback control center rechecks the historical behavior of the user side and judges whether the user side removes the trust access list, otherwise, the user side executes the instruction normally;
if the user side is not in the trust access list, a challenge response mechanism is adopted to send out a challenge through a challenge response module:
after receiving the challenge, the untrusted visitor generates a response code according to a predetermined mechanism and returns the response code to the control center; the control center forwards the response code to the challenge initiating device, the challenge initiating device judges whether the responses are matched, if so, the command of the visitor is executed, otherwise, the command is fed back to the control center and is marked as a suspected malicious user;
step S43: when the same user passes through the challenge response mechanism of a certain inherent device for more than 5 times continuously, the control center can add the challenge response mechanism into the trusted visitor list.
The challenge-response mechanism adopted in step S42 specifically includes the following steps:
step S421: a user end applies for a control center to initiate a challenge request to equipment initiating the control request in a mode of sending a challenge code through a connected router;
step S422: the router receives the challenge code, encrypts the challenge code and sends the encrypted challenge code to the control center through the relay node;
step S423: the control center receives the challenge request and carries out security verification on the untrusted equipment:
if the security verification fails, the control center does not forward the challenge request;
if the security verification is passed, the control center forwards the challenge request to the untrusted equipment, the untrusted equipment receives the challenge code, decodes the challenge code and generates a response code, and the response code is returned to the control center through the router and the relay node;
the control center receives the response code of the untrusted equipment and then forwards the response code to the challenge initiating equipment;
the challenge initiating device compares the response code with the expected response result generated by the challenge initiating device, and executes the control request when the comparison result is the same; and when the comparison results are different, refusing to execute the control requirement, feeding back the comparison result to the control center and warning the doubtful property of the comparison result.
Step S423 specifically includes the following steps:
step S4231: the control center carries out security verification by pre-analyzing the historical access records of the untrusted equipment in advance, and the attack risk of malicious users is reduced.
Step S4232: if the security verification fails, directly marking the user as high risk and tracking the access behavior of the user until the risk is relieved;
step S4233: and forwarding the challenge code to the user terminal through the security verification.
Specifically, in step S4232, in order to protect the privacy of the user, the control center cannot directly access the user data, but fits the active trajectory of the user according to the number of the router accessed by the user after entering the intelligent building, and determines whether the user is a malicious user according to the number of irrelevant devices on the active trajectory, the number of times of failure of challenge response, and the like;
once the user is judged to be a malicious user, the control center sends the generated code to other users used at the same time, and the user compares the generated code stored locally to check whether the user is attacked maliciously.
Through the steps, the control center can judge the source of the equipment more accurately and quickly when access comes every time, computing resources are saved, and response speed is increased. The trust list at the initial moment is basically the inherent equipment of the system, and the trust list control strategy provides convenience for the increase of subsequent system equipment. Meanwhile, the devices are in one-to-one correspondence with the trust lists, so that some safe visitors with the requirement of accessing a certain device for multiple times are more convenient, but the access authority of the visitors to other devices is still limited, and the safety of the whole system is guaranteed. Once a certain trusted device has abnormal behaviors, the abnormal behaviors are immediately eliminated from the trust list, so that the risk that the trusted device is indirectly utilized by an attacker by an attack system can be reduced.
The encryption algorithm of the challenge response mechanism in the invention adopts a high-entropy key to realize authentication. To better illustrate the working principle of the high-entropy key authentication mechanism, it is assumed that a shared key k has been established between a and B based on the conventional "challenge-response" mechanism. A initiates authentication to B, therefore A sends a random number r to B, B encrypts r by using a shared key k to obtain an encryption result c, then sends the encryption result c to A as a response, A encrypts r by using the shared key k, and then compares whether the encryption result is consistent with c, if so, the authentication to B is passed; otherwise, the authentication fails. In this embodiment, a is a fixed user end in the building that initiates the challenge, and B is a user end that needs to respond.
Example 4
The embodiment is a further supplement to step S5 in example 2, as shown in fig. 3, a client sends a request for controlling a device, a router receives the request and uploads the request to a control center, a challenge response module executes the request of the client if the request passes through the request, otherwise, the challenge response module reports the request to the control center and marks the request as a suspicious user, the control center analyzes and monitors a history request and a trace of the client, and determines whether the client is a malicious attack user, if the client is a malicious user, the network connection of the client is cut off, a randomly generated code of the client is broadcast, and a high-risk device is warned; otherwise, the monitoring is released.
Example 5
This example is a further addition to the challenge-response mechanism in step S42 in example 2, as shown in fig. 4, after receiving the control request, the fixed device in the building sends a challenge code to the router; the router checks the challenge code line, judges whether the challenge code is legal or not, and then executes the following two conditions:
case 1: and when the verification fails, the control center receives a verification failure return code, and the challenge verification fails.
Case 2: and after the verification is passed, the challenge code is encrypted and uploaded to the control center through the relay node.
Then, the control center analyzes whether the challenge code is legal or not, including the following two cases:
case 1: if not, no treatment is carried out;
case 2: if the random number is legal, the control center generates a challenge random number which is sent to the control request user side as a question;
after receiving the question, the control request user end generates a response code by using a random generation code + H which is agreed in advance and returns the response code to the control center. After receiving the response code, the control center compares the response code with the result calculated by the control center, and the comparison result is divided into the following two conditions:
case 1: if the authentication is successful, the instruction is executed;
case 2: and if the answer is not successful, the instruction is not executed, and the answer user is marked as a suspicious user.
While the preferred embodiments of the present invention have been illustrated and described, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.
The above-mentioned contents are only for illustrating the technical idea of the present invention, and the protection scope of the present invention is not limited thereby, and any modification made on the basis of the technical idea of the present invention falls within the protection scope of the claims of the present invention.
Claims (8)
1. The intelligent building mobile equipment authentication method based on the challenge response mechanism is characterized by comprising the following steps:
step S1: a user terminal entering a building applies for registering an account number and sends the account number to a control center, and the control center generates a random generation code and returns the random generation code to the user terminal;
step S2: the user side accesses the network or applies for the instruction and transmits with the random generating code, the random generating code is used as the identity information of the user and is accessed by other users; all randomly generated codes of the user terminals entering the building are broadcasted to the peripheral user terminals in real time through the routers connected with the randomly generated codes;
step S3: a user side sends a control request for initiating inherent equipment in a building to a control center;
step S4: the control center receives the control request, inquires the trust list and judges whether the user side is in the trust list:
a1, if the user end is in the trust list, executing the control request sent by the user end;
a2, if the user side is not in the trust list, initiating a challenge response to the user side:
a21, if the user side responds by the challenge, executing a control request of the client side;
a22, if the user end fails to pass the challenge response, the user end is marked as a suspicious user, the control center analyzes the historical behavior of the user end and tracks the next behavior according to the router through which the randomly generated code is uploaded, whether the user is a malicious user is judged, if the user is determined to be the malicious user, the network connection of the user is cut off, and the randomly generated code is broadcasted to all devices and users which have access to the network simultaneously with the malicious user through the control center.
2. The intelligent building mobile device authentication method based on the challenge-response mechanism as claimed in claim 1, wherein in step S4, when a user end is marked as a malicious user, the control center sends a self-check two-dimensional code to the user end that appears in the building at the same time period as the user end, and uploads the locally stored randomly generated code to the control center by scanning the self-check two-dimensional code, and the control center feeds back whether the user end has a possibility of being attacked maliciously.
3. The intelligent building mobile device authentication method based on the challenge-response mechanism as claimed in claim 1, wherein the trust list in step S4 is updated by the following steps:
step S41, the control center configures the trust visitor list of each inherent device;
step S42, when the fixed equipment in the building receives the access request of the user terminal, judging whether the user terminal is in the trust access list:
if the user side is in the trust access list, judging whether the instruction is normal:
when the instruction is abnormal, the feedback control center judges whether to remove the trust list according to the historical behavior;
otherwise, executing the instruction normally;
if the user side is not in the trust access list, a challenge response mechanism is adopted to send out a challenge, and the user side generates a response code according to a predetermined mechanism after receiving the challenge and returns the response code to the control center; the control center judges whether the response codes are matched, if so, the instruction of the visitor is executed, otherwise, the instruction is fed back to the control center and is marked as a suspected malicious user;
after the same user responds by challenge N times in succession, the control center can add it to the trusted visitor list.
4. The intelligent building mobile device authentication method based on the challenge-response mechanism as claimed in claim 3, wherein the challenge-response mechanism adopted in the step S42 comprises the following steps:
step S421: the user terminal initiates a challenge request to the equipment initiating the control request in a mode of sending a challenge code;
step S422: the router receives the challenge code, encrypts the challenge code and sends the encrypted challenge code to the control center;
step S423: the control center receives the challenge request and carries out security verification on the untrusted equipment:
if the security verification fails, the control center does not forward the challenge request;
if the security verification is passed, the control center forwards the challenge request to the untrusted user side, the untrusted user side receives the challenge code, decodes the challenge code and generates a response code, and the response code is returned to the initiating device;
the challenge initiating device compares the response code with the expected response result generated by the challenge initiating device, and executes the control request when the comparison result is the same; and when the comparison results are different, refusing to execute the control requirement, feeding back the comparison result to the control center and warning the doubtful property of the comparison result.
5. The intelligent building mobile device authentication method based on the challenge-response mechanism as claimed in claim 4, wherein in step S423, the control center performs security verification by pre-analyzing the historical access records of the untrusted device;
if the security verification of a certain user side fails, directly marking the user side as high risk and tracking the access behavior of the user side until the risk is relieved;
and if the security verification is passed, forwarding the challenge code to the user side.
6. The intelligent building mobile device authentication method based on the challenge-response mechanism as claimed in claim 5, wherein in step S423, the control center fits its motion trajectory according to the router number accessed by the user end, and determines whether the user end is a malicious user according to the number of irrelevant devices on the motion trajectory, the number of times of failure of challenge-response, and the like.
7. The intelligent building mobile equipment authentication system based on the challenge response mechanism is characterized by comprising a control center and a router which are electrically connected,
the router is used for receiving the networking application and the control request sent by the user side; assigning a random generation code to a user side, processing a user networking application, and transmitting a challenge response request of the user side and a control center;
the control center is used for receiving the networking application and the control request transmitted by the router, controlling the interaction of all equipment in the building, judging whether the behavior of the user side is a malicious behavior, informing all equipment which is possibly attacked to perform self-check, cutting off the network connection of the risk equipment, analyzing the historical behavior of the risk equipment and performing tracking control until the risk is relieved;
the system implements the following mobile device authentication method:
step S1: a user enters a building, applies for registering an account number and sends the account number to a router, the router uploads user account number information to a control center, and the control center generates a random generation code and returns the random generation code to a user side;
step S2: the user side accesses the network or applies for the instruction each time and transmits the instruction together with the random generated code, and the random generated code is used as the identity information of the user and is accessed by other users; all the randomly generated codes of the mobile user terminals entering the building are broadcasted to the peripheral user terminals in real time through the routers connected with the randomly generated codes, and are stored locally by other users;
step S3: the user side sends a control request for the inherent equipment in the building to the control center through the router;
step S4: the control center receives the control request, inquires the trust list and judges whether the user side is in the trust list:
if the user side is in the trust list, the control request sent by the user side is directly executed without initiating a challenge response;
if the user side is not in the trust list, a challenge response is initiated to the user side:
step SA 1: if the user end passes the challenge response, executing the control request of the client end;
step SA 2: if the user side can not pass the challenge response, the user side is marked as a suspicious user; after the user side is marked as a suspicious user side, the control center analyzes the historical behavior of the user side and tracks the next behavior according to the router through which the randomly generated code is uploaded, and judges whether the user side is a malicious user;
and after the user is determined to be a malicious user, cutting off the network connection of the user, and broadcasting the randomly generated code to all the devices and users which have access to the network simultaneously with the malicious user through the control center.
8. The intelligent building mobile device authentication system based on the challenge-response mechanism as claimed in claim 7, wherein the control center and the router are connected through a relay node.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011262440.6A CN112543098B (en) | 2020-11-12 | 2020-11-12 | Intelligent building mobile equipment authentication system and method based on challenge response mechanism |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011262440.6A CN112543098B (en) | 2020-11-12 | 2020-11-12 | Intelligent building mobile equipment authentication system and method based on challenge response mechanism |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112543098A CN112543098A (en) | 2021-03-23 |
| CN112543098B true CN112543098B (en) | 2021-10-01 |
Family
ID=75014866
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011262440.6A Active CN112543098B (en) | 2020-11-12 | 2020-11-12 | Intelligent building mobile equipment authentication system and method based on challenge response mechanism |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112543098B (en) |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105099705A (en) * | 2015-08-19 | 2015-11-25 | 同方计算机有限公司 | Safety communication method and system based on USB protocol |
| CN106416122A (en) * | 2015-05-08 | 2017-02-15 | 松下电器（美国）知识产权公司 | Authentication method and authentication system |
| WO2017151820A1 (en) * | 2016-03-01 | 2017-09-08 | Google Inc. | Network security based on proximity with ip whitelisting |
| CN107786978A (en) * | 2017-10-23 | 2018-03-09 | 浙江神州量子网络科技有限公司 | NFC Verification Systems based on quantum cryptography |
| CN108235806A (en) * | 2017-12-28 | 2018-06-29 | 深圳达闼科技控股有限公司 | Method, device and system for safely accessing block chain, storage medium and electronic equipment |
| CN110086825A (en) * | 2019-05-08 | 2019-08-02 | 国网江苏省电力有限公司 | A kind of unmanned plane electric inspection process data safe transmission system and method |
| CN110300102A (en) * | 2019-06-17 | 2019-10-01 | 中电科大数据研究院有限公司 | A kind of Internet of Things safety access system and method based on block chain |
| CN111130797A (en) * | 2019-12-23 | 2020-05-08 | 深圳市永达电子信息股份有限公司 | Security protection system, method and storage medium based on challenge response |
| CN111327583A (en) * | 2019-08-22 | 2020-06-23 | 刘高峰 | Identity authentication method, intelligent equipment and authentication server |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CA2922181A1 (en) * | 2013-08-23 | 2015-02-26 | Margaret BOUSE | System and method for identity management |
| US20170076274A1 (en) * | 2015-09-16 | 2017-03-16 | First Data Corporation | Authentication systems and methods |
| JP7077272B2 (en) * | 2019-06-20 | 2022-05-30 | 株式会社東芝 | Certificate issuance equipment, verification equipment, communication equipment, certificate issuance systems, certificate issuance methods, and programs |
-
2020
- 2020-11-12 CN CN202011262440.6A patent/CN112543098B/en active Active
Patent Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106416122A (en) * | 2015-05-08 | 2017-02-15 | 松下电器（美国）知识产权公司 | Authentication method and authentication system |
| CN105099705A (en) * | 2015-08-19 | 2015-11-25 | 同方计算机有限公司 | Safety communication method and system based on USB protocol |
| WO2017151820A1 (en) * | 2016-03-01 | 2017-09-08 | Google Inc. | Network security based on proximity with ip whitelisting |
| CN108476228A (en) * | 2016-03-01 | 2018-08-31 | 谷歌有限责任公司 | Based on the network security with the IP white list degrees of approach |
| CN107786978A (en) * | 2017-10-23 | 2018-03-09 | 浙江神州量子网络科技有限公司 | NFC Verification Systems based on quantum cryptography |
| CN108235806A (en) * | 2017-12-28 | 2018-06-29 | 深圳达闼科技控股有限公司 | Method, device and system for safely accessing block chain, storage medium and electronic equipment |
| CN110086825A (en) * | 2019-05-08 | 2019-08-02 | 国网江苏省电力有限公司 | A kind of unmanned plane electric inspection process data safe transmission system and method |
| CN110300102A (en) * | 2019-06-17 | 2019-10-01 | 中电科大数据研究院有限公司 | A kind of Internet of Things safety access system and method based on block chain |
| CN111327583A (en) * | 2019-08-22 | 2020-06-23 | 刘高峰 | Identity authentication method, intelligent equipment and authentication server |
| CN111130797A (en) * | 2019-12-23 | 2020-05-08 | 深圳市永达电子信息股份有限公司 | Security protection system, method and storage medium based on challenge response |
Non-Patent Citations (2)
| Title |
|---|
| "Internet of things: Survey on security and privacy";Diego Mendez;《IOT SECURITY》;20171231;全文 * |
| "高智能楼宇安全系统的设计与实现";高健;《中国优秀硕士学位论文全文数据库》;20160715;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112543098A (en) | 2021-03-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Panchal et al. | Security issues in IIoT: A comprehensive survey of attacks on IIoT and its countermeasures | |
| Diaz Lopez et al. | Shielding IoT against cyber‐attacks: an event‐based approach using SIEM | |
| Andrea et al. | Internet of Things: Security vulnerabilities and challenges | |
| US7093291B2 (en) | Method and system for detecting and preventing an intrusion in multiple platform computing environments | |
| Islam et al. | An analysis of cybersecurity attacks against internet of things and security solutions | |
| KR101369727B1 (en) | Apparatus and method for controlling traffic based on captcha | |
| JP4911018B2 (en) | Filtering apparatus, filtering method, and program causing computer to execute the method | |
| US20080172713A1 (en) | Network Security Enforcement System | |
| Rani et al. | Cyber security techniques, architectures, and design | |
| KR101276261B1 (en) | Security System For Remote Connection | |
| CN102882676A (en) | Method and system for equipment to safely access Internet of things | |
| CN116708210A (en) | Operation and maintenance processing method and terminal equipment | |
| Poonia | Internet of Things (IoT) security challenges | |
| CN105812338B (en) | Data access control method and network management equipment | |
| KR101001197B1 (en) | System and method for log-in control | |
| CN113794563A (en) | Communication network security control method and system | |
| CN117768151A (en) | Network communication method and system based on zero trust | |
| CN112543098B (en) | Intelligent building mobile equipment authentication system and method based on challenge response mechanism | |
| Mahlous | Threat model and risk management for a smart home iot system | |
| CN114157438A (en) | Network equipment management method and device and computer readable storage medium | |
| CN107968777B (en) | Network security monitoring system | |
| CN115720171A (en) | Safe intelligent gateway system and data transmission method | |
| Narula et al. | Novel Defending and Prevention Technique for Man‐in‐the‐Middle Attacks in Cyber‐Physical Networks | |
| Gu et al. | IoT security and new trends of solutions | |
| CN111556024B (en) | Reverse access control system and method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |