TWI733265B - Secure connection system and method of the same - Google Patents

Abstract

Provided is a secure connection system and a method of the same. The system includes a terminal device and an IoT platform having a keystore and authentication unit. The terminal device has a device code and a device key to send an authentication request message to the authentication unit. The authentication unit receives the authentication request message to send a check code to the terminal device. The terminal device also sends an authentication message including a check code, device code, and hash value of the device key to the authentication unit. The authentication unit receives the authentication message to find a device key corresponding to the device code in the authentication message from the key store, and performs a hash operation on the corresponding device key to obtain the first hash value. Further, the first hash value is compared with the hash value of the device key in the authentication message, and a reply message is sent to the terminal device based on the comparison result.

Description

Safe connection system and method

The present invention relates to a secure connection technology, and more specifically, to a secure connection system and method applied in an Internet of Things system.

Generally speaking, through a network connection between the IoT platform and the terminal device in the IoT system, the user can control the terminal device through the IoT platform or receive information uploaded by the terminal device to the IoT platform. However, people who are interested may invade the system by fraudulently using the identity of the Internet of Things platform or terminal equipment, thereby causing damage or stealing data. Therefore, the communication between the IoT platform and the terminal device must pass security certification.

The existing security authentication method is responsible for authenticating the terminal device through an authentication center. Although this method can prevent the problem of disguising the terminal device, it may still be fraudulently used as the identity of the Internet of Things platform. Therefore, how to provide a secure connection system and method that can provide two-way authentication has become an urgent issue in the industry.

In order to solve the various problems of the aforementioned conventional technology, one purpose of the present invention is to provide a secure connection system and method that can provide two-way authentication.

In order to achieve the foregoing objective, the secure connection system of the present invention includes a terminal device and an Internet of Things platform, where the Internet of Things platform includes a key store and an authentication unit.

The terminal device has a device code and a device key, and is used to send an authentication request message and an authentication message. The key bank stores device codes and device keys. The authentication unit is used to receive the authentication request message sent by the terminal device to send a check code to the terminal device, and is also used to receive the authentication message sent by the terminal device to send a reply message to the terminal device, wherein the authentication The message includes the check code, the device code, and a hash value of the device key, and the authentication unit is also used to find the device key corresponding to the device code in the authentication message from the key library, so as to determine the corresponding The device key is hashed to obtain the first hash value, and the device key hash value in the authentication message is compared with the first hash value to send a reply message to the terminal device according to the comparison result.

In one embodiment, if the comparison result is the same, the authentication unit is further used to hash the check code to obtain a conversation key and attach the conversation key to the reply message.

In one embodiment, the terminal device is further used to perform a hash operation on the check code to obtain a second hash value, and then compare the second hash value with the conversation key in the reply message.

In one embodiment, the Internet of Things platform further includes a data storage unit for receiving data messages sent by the terminal equipment, and the data messages are encrypted with a conversation key.

In one embodiment, the Internet of Things platform further includes a control unit for sending a command message to control the terminal device, and the command message is encrypted by the conversation key.

In one embodiment, if the comparison results are not the same, the reply message only has a header or includes a value that can identify errors.

In one embodiment, the terminal device is registered with the IoT platform in advance to obtain the device code and the device key.

The present invention also provides a secure connection method, which includes: sending an authentication request message through a terminal device; receiving the authentication request message through an authentication unit of an Internet of Things platform to send a check code; receiving the check code through the terminal device to Send an authentication message, the authentication message includes the check code, device code, and device key hash value; receive the authentication message through the authentication unit to find the device code in the authentication message from the key library of the Internet of Things platform Corresponding device key, and then perform a hash operation on the corresponding device key to obtain a first hash value; and compare the device key hash value in the authentication message with the first hash value through the authentication unit To send a reply message to the terminal device based on the comparison result.

In one embodiment, if the comparison result is the same, the check code is hashed through the authentication unit to obtain a conversation key, and the conversation key is attached to the reply message; if the comparison result is Not the same, the reply message only has a header or includes a value that can identify errors.

In an embodiment, the secure connection method of the present invention further includes: receiving the reply message through the terminal device, performing a hash operation on the check code to obtain a second hash value, and then the second hash value and the reply The conversation key in the message is compared.

Compared with the prior art, the secure connection system and method of the present invention send a request for authentication message to request authentication by the terminal device, and then send a check code through the authentication unit of the Internet of Things platform, and the terminal device sends the check code, device The reply message of the hash value of the code and the device key, and the authentication unit searches for the device key corresponding to the device code in the authentication message from the key library of the Internet of Things platform, and after hashing, it matches the device key in the authentication message The hash value is compared, and the identity of the terminal device can be confirmed in this way to establish a secure connection between the IoT platform and the terminal device. In addition, the check code can also be mixed and shipped through the authentication unit Calculate to obtain a conversation key, and attach the conversation key to the reply message to send to the terminal device. The terminal device can hash the previously received check code and compare it with the conversation key in the reply message. In this way, the identity of the IoT platform can be confirmed, and mutual authentication can be achieved, which fully solves the problems of the existing technology.

11‧‧‧Terminal equipment

12‧‧‧Internet of Things Platform

121‧‧‧Key Bank

122‧‧‧Authentication Unit

123‧‧‧Data storage unit

124‧‧‧Control Unit

S1~S5, S51~S53, S6‧‧‧Step

FIG. 1 is a schematic diagram of the structure of a secure connection system according to an embodiment of the present invention.

Figure 2 is a schematic diagram of the application of the secure connection system according to the embodiment of the present invention.

FIG. 3 is a schematic flowchart of a secure connection method according to an embodiment of the present invention.

FIG. 4 is a schematic diagram of the process of replying to a message in the secure connection method according to the embodiment of the present invention.

The following specific examples illustrate the implementation of the present invention. Those familiar with the art can easily understand the other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied by other different specific embodiments, and various details in this specification can also be based on different viewpoints and applications, and various modifications and changes can be made without departing from the spirit of the present invention.

Please refer to Figures 1 and 2, which are schematic diagrams of the secure connection system of the embodiment of the present invention. The secure connection system of the present invention includes a terminal device 11 and an Internet of Things platform 12, where the Internet of Things platform 12 includes a key store 121 and an authentication unit 122.

In an embodiment, the terminal device 11 may be a gateway to include various devices or sensors in the Internet of Things (for example, an air quality sensor or a physiological sensor, etc.), Or connected to the various devices or sensors, and the IoT platform 12 can be, for example, a server Server. The terminal device 11 has a device code and a corresponding device key. The device code and the device key can be a combination of numbers, characters, or symbols. For example, the device code can be 0136, and the corresponding device key can be BFGW6YS8. The terminal device 11 is used to send an authentication request message and an authentication message.

In one embodiment, the key store 121 stores device codes and device keys. The key store 121 can be, for example, a memory or a hard disk, but it is not limited thereto.

In one embodiment, the authentication unit 122 is used to receive an authentication request message sent by the terminal device 11 and generate a check code to send to the terminal device 11. The check code is a random number generated by the authentication unit 122, which can be a combination of numbers, characters or symbols. For example, the check code can be A2 B3 C4 D7 E5 F9.

In one embodiment, the terminal device 11 is also used to receive a check code and used to send an authentication message to the authentication unit 22. The authentication message includes the check code, the device code, and the device key hash value. The terminal device 11 can use the check The code hashes the device key to obtain the device key hash value. For example, when the check code is A2 B3 C4 D7 E5 F9, the device code is 0136, and the device key is BFGW6YS8, the hash value of the device key after the device key is hashed is 47EE78547A522319, then the authentication message can be, for example, A2B3C4D7E5F9013647EE78547A522319( Excluding the representation of the header). The following Table 1 illustrates the authentication message in an embodiment. The authentication message has four fields. The first field is the header, which is used to identify the connection URL; the second field is the check code, which is the check code generated and sent by the authentication unit; the third field is the device code, which serves as The terminal device 11 is used for identity identification of the Internet of Things platform 12; the fourth field is the device key hash value, which is obtained by the terminal device 11 using the check code to hash the device key of the terminal device 11.

In one embodiment, the authentication unit 122 is further used to receive the authentication message sent by the terminal device 11, and search for the corresponding device key from the key bank 121 according to the device code in the authentication message, so as to find the corresponding device key. Perform a hash operation on the device key of to obtain the first hash value, and compare the first hash value with the device key hash value in the authentication message, and send a reply message to the terminal device 11 according to the comparison result. If the comparison results are the same, it means that the terminal device 11 has passed the authentication, and the authentication unit 122 sends a reply message including the conversation key. If the comparison result is different, it means that the terminal device 11 has not passed the authentication, and the authentication unit 122 sends a reply message that does not include the conversation key or a reply message that includes a recognizable error value.

In one embodiment, if the comparison result is the same, the authentication unit 122 is further used to hash the generated check code to obtain a conversation key, and then add the conversation key to the reply message and send it to the terminal device 11. . For example, when the check code is A2 B3 C4 D7 E5 F9, the conversation key obtained after hashing is D13F0BDA22B82908, and the reply message can be, for example, D13F0BDA22B82908 (not including the header). Table 2 below shows the reply message in an embodiment. The reply message has two fields. The first field is the header, which is used for identification of the connection URL; the second field is the conversation key, which is obtained by hash calculation using the check code as the authentication unit. If the terminal device 11 fails the authentication of the authentication unit 122, the second field is empty or other values that can identify errors.

In one embodiment, the terminal device 11 performs a hash operation on the previously received check code to obtain the second hash value, and compares it with the conversation key in the reply message. If the comparison results are the same, it means that the reply message is the reply authentication of the real IoT platform 12, and the mutual authentication has been achieved so far.

In one embodiment, the IoT platform 12 further includes a data storage unit 123 for receiving data messages sent by the terminal device 11, and the data messages are encrypted with a conversation key. If the two-way authentication is successful, the terminal device 11 can encrypt the data of the IoT platform 12 and transmit it to the data storage unit 123 for storage. The transmitted data can be, for example, the pM2.5 data of the air quality sensor, or the blood pressure of the human physiological sensor. Record data; the data storage unit 123 is NoSQL, so the data format that can be stored is based on the actual transmitted data. The stored data can be used by other IoT application services, such as air quality monitoring services that can access pM2.5 data, health care The service can access blood pressure records and so on. In an embodiment, the data encryption transmission technology may be AES, but is not limited to this.

In one embodiment, the IoT platform 12 further includes a control unit 124 for sending a command message to control the terminal device 11, and the command message is encrypted by a conversation key. If the two-way authentication is successful, the IoT platform 12 can also perform command control on the terminal device 11. The control unit 124 encrypts the command and transmits the command to the terminal device 11 for command control, for example: using RESTful or MQTT protocol to transmit the command to the terminal device 11 to indicate Turn on the air purifier.

In one embodiment, the data message or the command message can be encrypted with the conversation key. For example, the conversation key such as D13F0BDA22B82908 is encrypted with AES128.

In one embodiment, if the ratio of the hash value of the device key in the authentication message received by the authentication unit 122 to the first hash value of the corresponding device key found by the authentication unit 122 from the key library 121 after the hash operation When the results are different, it means that the terminal device 11 has not passed the authentication, and the reply message sent by the authentication unit 122 includes an error-recognizable value, such as 0000000000000000 (excluding the representation of the header).

In one embodiment, the terminal device 11 may register with the IoT platform 12 in advance to obtain the device code and the device key. In another embodiment, the device code and/or device key can be stored in a chip in the terminal device 11.

Please refer to FIG. 3, which is a schematic flowchart of a secure connection method according to an embodiment of the present invention. As shown in the figure, the secure connection method of the present invention includes the following steps:

S1. The terminal device sends an authentication request message.

S2. The authentication unit of the IoT platform receives the authentication request message and sends a check code.

S3. The terminal device receives the check code and sends an authentication message. The authentication message includes the check code, the device code, and the hash value of the device key.

S4. The authentication unit receives the authentication message, and searches for the device key corresponding to the device code in the authentication message from a key bank based on the device code in the authentication message, so as to perform a hash operation on the corresponding device key to obtain the first A hash value.

S5. The authentication unit compares the hash value of the device key in the authentication message with the first hash value, and sends a reply message to the terminal device according to the comparison result.

In steps S1 to S5, the authentication of the terminal device is completed. Since the secure connection method of the present invention is applied to the aforementioned secure connection system, please refer to the foregoing description for the specific implementation, and will not be repeated here.

Please refer to FIG. 4, which is a schematic diagram of the flow of replying messages in the secure connection method of the embodiment of the present invention. In S51, it is judged whether the comparison results in S5 are the same, if yes, go to S52, if not, go to S53.

S53. The reply message sent by the authentication unit only has a header or includes an identifiable error value.

S52. The authentication unit hashes the check code to obtain a conversation key, and attaches the conversation key to the reply message.

S6. The terminal device receives the reply message with the dialogue key, performs a hash operation on the check code to obtain a second hash value, and then compares the second hash value with the dialogue key in the reply message.

In steps S5~S6, the authentication of the Internet of Things platform is completed. In other words, steps S1~S6 have reached a two-way authentication. A secure connection can be established between the terminal device and the Internet of Things platform, and encryption can be used later Transmission of equipment data or other interactive instructions.

In summary, the secure connection system and method of the present invention sends a check code through the authentication unit of the Internet of Things platform after the terminal device sends a request for authentication message to request authentication. The terminal device sends a check code, equipment code, and equipment money. The authentication message of the key hash value, and the authentication unit searches for the device key corresponding to the device code in the authentication information from the key library of the Internet of Things platform to perform a hash calculation, and compares it with the device key hash value in the authentication message Yes, in this way, the identity of the terminal device can be confirmed to establish a secure connection between the IoT platform and the terminal device. In addition, the check code can be hashed through the authentication unit to obtain a conversation key, and a reply message including the conversation key can be sent. After receiving the check code, the terminal device will hash the check code previously received and combine it with the reply message In this way, the identity of the IoT platform can be confirmed and mutual authentication can be achieved, which fully solves the problems of the existing technology. Furthermore, it can also be applied to environments where the terminal transmits less data and the hardware performance is lower.

The above-mentioned embodiments are merely illustrative to illustrate the principles and effects of the present invention, and are not intended to limit the present invention. Anyone who is familiar with this technique can modify and change the above-mentioned embodiments without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the rights of the present invention should be listed in the scope of patent application described later.

11‧‧‧Terminal equipment

12‧‧‧Internet of Things Platform

121‧‧‧Key Bank

122‧‧‧Authentication Unit

123‧‧‧Data storage unit

124‧‧‧Control Unit

Claims (12)

A secure connection system includes: a terminal device, which has a device code and a device key, and is used to send an authentication request message and receive a check code to send an authentication message, wherein the authentication message includes the check code and the device code And a device key hash value; and the Internet of Things platform, including: a key store that stores the device code and the device key; and an authentication unit for receiving the authentication request message sent by the terminal device to send the check Code to the terminal device, and used to receive the authentication message sent by the terminal device to send a reply message to the terminal device, wherein the authentication unit is also used to search for the device in the authentication message from the key bank The device key corresponding to the code is used to perform a hash operation on the corresponding device key to obtain the first hash value, and then the device key hash value in the authentication message is compared with the first hash value to compare Send the reply message to the terminal device for the result. For example, the secure connection system described in item 1 of the scope of patent application, wherein, if the comparison result is the same, the authentication unit is also used to hash the check code to obtain a conversation key, and to transfer the conversation The key is attached to the reply message. For example, the secure connection system described in item 2 of the scope of patent application, wherein the terminal device is also used to perform a hash operation on the check code to obtain a second hash value, and then the second hash value is combined with the reply message The conversation key is compared. Such as the secure connection system described in item 2 of the scope of patent application, wherein the IoT platform also includes: The data storage unit is used for receiving the data message sent by the terminal device, and the data message is encrypted by the conversation key. For example, in the secure connection system described in item 2 of the scope of patent application, the Internet of Things platform further includes: a control unit for sending a command message to control the terminal device, and the command message is encrypted by the conversation key. For example, the secure connection system described in item 2 of the scope of patent application, wherein, if the comparison result is different, the reply message only has a header or includes a value that can identify errors. For example, in the secure connection system described in item 1 of the scope of patent application, the terminal device is registered with the Internet of Things platform in advance to obtain the device code and the device key. A secure connection method includes: sending an authentication request message via a terminal device; receiving the authentication request message via an authentication unit of an Internet of Things platform to send a check code; receiving the check code via the terminal device to send an authentication message , Wherein the authentication message includes the check code, device code, and device key hash value; the authentication message is received through the authentication unit to find the device code corresponding to the device code in the authentication message from the key library of the Internet of Things platform And then perform a hash operation on the corresponding device key to obtain a first hash value; and compare the device key hash value in the authentication message with the first hash value through the authentication unit, Based on the comparison result, a reply message is sent to the terminal device. For example, the secure connection method described in item 8 of the scope of patent application, wherein the terminal device is registered with the Internet of Things platform in advance to obtain the device code and the device key. For example, the secure connection method described in item 8 of the scope of patent application, wherein, if the comparison result is the same, the check code is hashed by the authentication unit to obtain a conversation key, and the conversation key Attached to the reply message. For example, the secure connection method described in item 10 of the scope of patent application further includes: receiving the reply message through the terminal device, performing a hash operation on the check code to obtain a second hash value, and then adding the second hash value to Compare the conversation key in the reply message. For example, the secure connection method described in item 8 of the scope of patent application, wherein, if the comparison results are different, the reply message only has a header or includes a value that can identify errors.

Images