TWI747659B - Iot system and privacy authorization method - Google Patents

Abstract

A IoT system and a privacy authorization method are provided. In the method, multiple private key values are generated based on ECC. ECC includes the ECQV algorithm. A sever public key of the server is generated based on ECC through the private key value of the server. The node public key is generated based on ECC through the server public key and the private key value of the node. The sever and the node belong to the IoT of blockchain. The identification code of the server is encoded through the node public key, to generate the node certificate. The node certificate would be published on the IoT of the blockchain. Accordingly, safe privacy authorization can be implemented in the open and non-trust based IoT world.

Description

Internet of things system and privacy authorization method

The present invention relates to a data authorization mechanism, and particularly relates to an Internet of Things system and privacy authorization method used in a blockchain.

According to forecasts by international research and consulting institutions, the number of endpoints in the global enterprise Internet of Things (IoT) market will grow to 5.8 billion in 2020, an increase of 21% from 2019. How to strengthen the storage and secure exchange and transmission of huge sensitive and confidential data between the Internet of Things, how to reduce the risk of data theft of the Internet of Things, and how to construct a secure Internet of Things privacy authorization and blockchain on a zero-trust network A system of correct data verification is one of the current urgent goals of relevant industry and researchers.

In view of this, the present invention provides an Internet of Things system and a privacy authorization method that combines cryptography and blockchain to strengthen data authentication and authorization.

The privacy authorization method of the embodiment of the present invention is applicable to a blockchain Internet of Things, and includes (but not limited to) the following steps: Based on Elliptic-curve cryptography (Elliptic-curve) cryptography (ECC) randomly generates multiple private key values (private key values). Elliptic curve cryptography includes ECQV (Elliptic Curve Qu-Vanstone) algorithm. Based on elliptic curve cryptography, the server public key is generated through the server's private key value. Based on elliptic curve cryptography, the node public key of the node is generated through the server public key and the node's private key value. Servers and nodes belong to the Internet of Things of the blockchain. Encode the server's identity code through the node's public key to generate the node's node certificate. Publish node credentials in the Internet of Things on the blockchain.

The Internet of Things system of the embodiment of the present invention is applicable to the Internet of Things of the blockchain, and includes (but is not limited to) a node, a certificate management center, and a server. The node is used to collect sensing data. The certificate management center is used to issue original certificates. The server is used to randomly generate multiple private key values based on elliptic curve cryptography, generate the server public key of the server based on elliptic curve cryptography through the private key value of the server, and use the server public key and node based on elliptic curve cryptography The private key value of the node generates the node public key of the node, the identity code of the server is encoded by the node public key to generate the node certificate of the node, and the node certificate is published in the blockchain of the Internet of Things. Elliptic curve cryptography includes the ECQV algorithm.

Based on the above, according to the IoT system and privacy authorization method of the embodiments of the present invention, elliptic curve cryptography is used to generate the server public key and the node public key respectively, and the node public key is used to further generate the node certificate of the corresponding node with the original certificate, and The node certificate is published in the blockchain for identity verification. In this way, it is possible to avoid using the Session Key as the encryption negotiation key, thereby avoiding frequent use of key exchange and increasing the chance of data being cracked, thereby preventing the theft of private data, and ensuring the security of node-to-node data transfer .

In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail in conjunction with the accompanying drawings.

1: system

10: Internet of Things

20, 30: Group proxy server

25, 35: Group privacy database

40A1~40An, 40B1~40Bm: node

41: Sensor

60: Certificate Management Center

70: Blockchain

S101~S105, S200~S208, S301~S311: steps

FIG. 1 is a system architecture diagram of the Internet of Things according to an embodiment of the present invention.

Fig. 2 is a flowchart of an identity authentication phase according to an embodiment of the present invention.

FIG. 3 is a flowchart of a key generation stage according to an embodiment of the invention.

Fig. 4 is a flowchart of a data authorization stage according to an embodiment of the present invention.

FIG. 1 is a system architecture diagram of the Internet of Things according to an embodiment of the present invention. Please refer to Figure 1. This system 1 includes (but is not limited to) group proxy servers 20, 30, group privacy databases 25, 35, nodes 40A1~40An, 40B1~40Bm (m and n are positive integers), sensor Detector 41 and credential management center 60.

The group proxy servers 20 and 30 may be various types of computer systems (for example, desktop or notebook computers, servers, smart phones or tablet computers). The Internet of Things group proxy server 20, 30 can be connected to the Internet of Things 10. In one embodiment, the Internet of Things group proxy servers 20, 30 belong to two groups. For example, the Internet of Things group proxy server 20 belongs to group A, and the Internet of Things group proxy server 30 belongs to group B.

The group privacy database 25, 35 is respectively connected to the Internet of Things group proxy server 20, 30. Group privacy databases 25, 35 can be storage servers or various types of storage (For example, solid state drive (SSD), traditional hard drive (HDD) or cache memory).

Nodes 40A1~40An, 40B1~40Bm can be routers, relay stations or switches. Nodes 40A1~40An, 40B1~40Bm can be connected to the Internet of Things 10. In one embodiment, each node 40A1-40An, 40B1-40Bm collects the sensing data of the corresponding sensor 41 (for example, related to weather, power, electricity, sound, other physical, mechanical, or software states). In some embodiments, the nodes 40A1-40An belong to group A, and the nodes 40B1-40Bm belong to group B.

The Certificate Authority (CA) 60 is used to manage, authenticate and issue certificates, and its operation can be realized by a computer system. The function of a digital certificate is to prove that the user listed in the certificate legally owns the public key listed in the certificate.

Hereinafter, various devices in the system 1 will be used to illustrate the method according to the embodiment of the present invention. Each process of the method can be adjusted accordingly according to the implementation situation, and is not limited to this.

Fig. 2 is a flowchart of an identity authentication phase according to an embodiment of the present invention. Please refer to Figure 2. The identity authentication stage of the nodes 40A1~40An, 40B1~40Bm in the Internet of Things 10 is the process stage of the method of generating identity certificates for the nodes 40A1~40An, 40B1~40Bm to establish an identity registration mechanism for a trusted certificate system. After obtaining the certificate of the certificate management center, the proxy server 20, 30 uses ECQV (Elliptic Curve Qu-Vanstone) or other Elliptic-curve cryptography (ECC) related algorithms to generate multiple sets of proxy certificates with public and private keys. The mechanism is redistributed to the nodes 40A1~40An and 40B1~40Bm in the Internet of Things 10.

Specifically, the group proxy servers 20 and 30 respectively report to the certificate management center 60 Apply for an original certificate request (step S101). The certificate management center 60 may issue the original certificate to the corresponding group proxy server 20, 30 (step S102). The nodes 40A1-40An, 40B1-40Bm may submit a registration application to the group proxy server 20, 30 to request to join the group (step S103). The group proxy server 20, 30 can issue the registration serial number and read the access password of the privacy database 25, 35 to the nodes 40A1-40An, 40B1-40Bm according to the registration application (step S104).

Then, the group proxy servers 20, 30 can respectively use the original certificate issued by the certificate management center 60 to use ECQV or other ECC-related algorithms to generate multiple sets of node certificates for each node 40A1~40An, 40B1~40Bm (step S105 ). Specifically, FIG. 3 is a flowchart of the key generation phase according to an embodiment of the present invention. Referring to FIG. 3, the group proxy server 20 is taken as an example below, but the group proxy server 30 can implement the same or similar procedures. For the certificate application (step S200), the group proxy server 20 randomly generates a plurality of private key values based on the ECC (step S201). ECC is an algorithm for establishing public key encryption, that is, asymmetric encryption. Public key encryption is the foundation of modern network security or the chain of trust. A major feature of public key encryption is that the two parties of the communication terminal each have a pair of public and private keys, which have a specific mathematical relationship between the public and private keys. In addition, the communication terminals each store their own private keys and disclose their own public keys. Even if a third party maliciously obtains any one's public key, it cannot be decrypted smoothly. And ECC introduces the discrete logarithm problem on the elliptic curve into a specific mathematical relationship between public and private keys. In addition, in addition to ECQV, algorithms such as ECDH (Elliptic Curve Diffie-Hellman) and EdDSA (Edwards-curve Digital Signature Algorithm) are all ECC.

The group proxy server 20 can generate a server public key through its own private key value based on ECC (step S202). For example, the group proxy server 20 multiplies its own private key value and one of multiple parameter base points on the elliptic curve to generate a server public key belonging to the server. The group proxy server 20 may send the server public key and its own identification code (for example, name, organization, country, purpose, period, etc.) to the certificate management center 60 (step S203).

The certificate management center 60 can verify the server public key generated by the group proxy server 20 according to the ECC (step S204), and issue the original certificate to the group proxy server 20 according to the verification result (step S205). The group proxy server 20 can select the private key value of a node 40A1, 40A2,... or 40An in the group A (step S206), and based on the ECC through the server public key and the selected node (the node 40A1 As an example, but not limited to this), the node public key of the node 40A1 is generated from the private key value (step S207). For example, the group proxy server 20 multiplies the private key value of the node 40A1 and one of the multiple parameter base points on the elliptic curve to generate the node public key belonging to the node 40A1.

The group proxy server 20 can generate the node certificate of the node 40A1 (for example, the certificate value generated by the encoding) by encoding the identity code of the server and other required data for the certificate through the node public key (step S208). That is, a digital signature is applied to the public key of the node through the private key value to generate the node certificate. The node credentials of all groups in the Internet of Things 10 and all nodes 40A1~40An will be published in the Internet of Things 10 of the blockchain for all nodes 40A1~40An, 40B1~40Bm to query to confirm their identities.

Fig. 4 is a flowchart of a data authorization stage according to an embodiment of the present invention. Please refer to Figure 4, nodes 40A1~40An, 40B1~40Bm collect their own sensor 41 detection The sensed data can be made into a privacy authorization form. The content of the privacy authorization form includes the authorization items, the data content of the authorization items, the sensing time of the authorization data, and the permissions of the authorization items, etc. The group proxy server 20, 30 uses the asymmetric public key of the group proxy server 20, 30 of the node 40A1~40An, 40B1~40Bm to which the authorization is applied to encrypt the data of the authorized privacy form, and writes the privacy authorization form into the application Authorized nodes 40A1~40An, 40B1~40Bm in the privacy database 25, 35 of the group proxy server 20, 30, applying for authorization nodes 40A1~40An, 40B1~40Bm can decrypt their own registration number and access password , In order to achieve the purpose of obtaining authorized private information efficiently in a short time.

For example, the sensor 41 of the node 40A1 of the group A detects to obtain the sensing data. The node 40A1 encrypts the sensed data with the signature made by its own node certificate and the registered access password and sends it to the privacy database 25 of the group A for centralized storage and storage (step S301).

Assume that the node 40B1 of the group B applies to the group A for the authorization of the sensor data of the node 40A1 (that is, sends an access request) (step S302). The group proxy server 20 of group A can read the sensor data of the sensor 41 of the node 40A1 from the privacy database 25 of the group A, and decrypt the encrypted data with the access password obtained from the registration of the node 40A1 Sensing data (step S303). The group proxy server 20 of the group A uses the group certificate (for example, the original certificate) corresponding to the group A and the node certificate of the node 40A1 to make public key encryption for the sensor data obtained by the sensor 41 of the node 40A1 Algorithm (for example, Elliptic Curve Digital Signature Algorithm (ECDSA), RSA encryption algorithm, or Digital Signature Algorithm (Digital Signature Algorithm) Signature Algorithm, DSA)), and encrypt the signature and the sensing data of the sensor 41 of the node 40A1 with the asymmetric (Asymmetric) encryption of the group proxy server 30 of the group B (for example, RSA, ElGamal) , Or Rabin) public key encryption, and the privacy authorization data generated by the encryption is sent to group B (step S304).

The group proxy server 30 of the group B decrypts the private authorization data of the node 40A1 of the group A with the asymmetric encryption private key (for example, the RSA private key, and corresponds to the RSA used in step S304), and obtains it from the privacy block The chain 70 reads the group certificate of the group A and the node certificate of the node 40A1 to verify the signature of the group A and the node 40A1, and then confirm its identity and privacy authorization data (step S305).

Finally, the group proxy server 30 of the group B can encrypt the privacy authorization data of the node 40A1 of the group A with the access password registered by the node 40B1 and send it to the node 40B1 (step S306).

For one-to-many authorization, suppose that the node 40B1 of the group B applies to the group A for the authorization of the sensing data package of all the sensors 41 of the node 40A1, the node 40A2, and the node 40A3 (step S307).

The group proxy server 20 of the group A reads the sensing data of all the sensors 41 of the node 40A1, the node 40A2, and the node 40A3 from the privacy database 25 of the group A, and uses the 40A1, the node 40A2 and the node The access password obtained from the registration of 40A3 decrypts the encrypted sensing data (step S308). The group proxy server 20 of group A uses the group certificate corresponding to group A and the node certificate of node 40A1, node 40A2, and node A340 to sense the sensor 41 of node 40A1, node 40A2, and node 40A3, respectively Make the signatures of the public key encryption algorithm for the data, and sign them separately The sensing data of the sensor 41 of the node 40A1, the node 40A2, and the node 40A3 is encrypted with the asymmetric encryption public key (for example, RSA supply) of the group proxy server 30 of the group B, and the encrypted data is generated The privacy authorization data is sent to group B (step S309).

The group proxy server 30 of the group B decrypts the private authorization data of the nodes 40A1, 40A2, and 40A3 of the group A with the asymmetric encryption private key (for example, the RSA private key) of the group B, and obtains the information from the privacy Read the group certificate of group A and the respective node certificates of node 40A1, node 40A2 and node 40A3 in the blockchain 70 to verify the signatures of group A and node 40A1, node 40A2 and node 40A3, and then confirm Identity and privacy authorization data (step S310).

Finally, the group proxy server 30 of the group B can encrypt the privacy authorization data of the nodes 40A1, 40A2, and 40A3 of the group A with the access password registered by the node 40B1 and send it to the node 40B1 (step S311).

To sum up, in the Internet of Things system and privacy authorization method of the embodiments of the present invention, the proxy server manages the node group of the Internet of Things, and establishes the identity verification mechanism of the implicit certificate ECC-related algorithm in the block of the Internet of Things. Chain system. The authorization method for IoT nodes is a multi-identity verification method using certificates of ECC-related algorithms, and is connected to an anchored blockchain system, so that nodes do not need to continuously generate session keys to exchange private data Transmission, from achieving the characteristics of authorization and verification for fast mutual access of private data.

The embodiments of the present invention further include the following features and effects:

In the embodiment of the present invention, the group proxy server applies to the certificate management center for the issuance of original certificates, and then generates multiple sets of node certificates for ECC-related algorithms and distributes them to The proxy credential mechanism used by the node. In addition, the node credentials of all nodes will be published in the blockchain system of the Internet of Things. Using multiple sets of node certificates and original certificates generated by ECC related algorithms for multiple identity verification can verify the security of the original node authorization and has the advantage of quickly authorizing private data.

The group proxy server of the embodiment of the present invention uses the certificate issued by the certificate management center to perform package authorization on the privacy authorization data generated by the node. The node performs multiple identity verification through the corresponding node certificate and the original certificate. The embodiment of the present invention provides a package structure for multi-node authorization of private data to perform identity verification between nodes and collective authorization of private data, so as to achieve the purpose of multi-nodes directly authorizing multi-node private data.

The embodiment of the present invention utilizes the security features of the asymmetric cryptographic system. As long as both nodes establish identity verification, the asymmetric encryption public key of the group proxy server can be grouped to provide multiple transmissions of privacy authorization data, thereby reducing the general use of session funds. The key is used to authorize data, which avoids frequent use of key exchange and increases the chance of data being cracked. In this way, privacy data can be prevented from being stolen, and the security of the node's authorized transmission of node data can be ensured.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the technical field can make some changes and modifications without departing from the spirit and scope of the present invention. The scope of protection of the present invention shall be subject to those defined by the attached patent scope.

20: Group proxy server

S200~S208: steps

Claims (8)

A privacy authorization method, applicable to a blockchain (Internet of Things, IoT), including: randomly generating multiple private key values (private keys) based on an elliptic curve cryptography (Elliptic-curve cryptography, ECC) key value), wherein the elliptic curve cryptography includes the ECQV (Elliptic Curve Qu-Vanstone) algorithm; based on the elliptic curve cryptography, a server public key (public key); Based on the elliptic curve cryptography, a node public key of the node is generated through the server public key and a private key value of a node, wherein the server and the node belong to the Internet of Things of the blockchain; The node’s public key encodes the server’s identity code to generate a node certificate for the node; publishes the node certificate in the Internet of Things of the blockchain; and corresponds to the sensor data collected through the node The node certificate and the access password are encrypted and stored in the privacy database, where the sensing data is obtained by a sensor; it responds to an access request to correspond to the node certificate and a group of certificate pairs The sensing data is used to create a signature of the public key encryption algorithm; the signature and the sensing data are encrypted by an asymmetric (Asymmetric) encryption public key to generate a private authorization data; the corresponding data is generated by the asymmetric encryption public key An asymmetrically encrypted private key to decrypt the privacy The authorization data is verified by the group certificate and the node certificate; and the private authorization data is encrypted with the access password of another node that issued the access request according to the verification result. The privacy authorization method according to claim 1, wherein the step of generating the server public key of the server includes: the private key value of the server and one of a plurality of parameter base points on an elliptic curve Multiply to generate the server public key of the server. The privacy authorization method according to claim 1, wherein after the step of generating the server public key of the server, it further includes: transmitting the server public key and the identity code to a certificate management center; managing through the certificate The center verifies the server public key based on the elliptic curve cryptography; and issues an original certificate to the server based on the verification result. The privacy authorization method according to claim 1, wherein before the step of generating the server public key of the server, it further comprises: receiving a registration application from the node through the server; and the node according to the registration application Issue the registration serial number and read the access password for a private database. An Internet of Things system suitable for a blockchain Internet of Things, including: a node for collecting a sensed data; a certificate management center for issuing an original certificate; a server for based on an elliptic curve Cryptography randomly generates multiple private key values, A server public key of the server is generated based on the elliptic curve cryptography through a private key value of the server, and the server public key is generated based on the elliptic curve cryptography through the server public key and a private key value of the node A node public key of a node, through which the node public key encodes the identity code of the server to generate a node certificate of the node, and publish the node certificate in the Internet of Things of the blockchain, where the elliptic curve Cryptography includes ECQV algorithm; a second node; and a second server, wherein the node encrypts the collected sensing data with the corresponding node certificate and the access password, and stores it in the privacy database , Wherein the sensing data is obtained by a sensor and responding to an access request from the second node. The server generates a public key for the sensing data with the corresponding node certificate and a group of certificates Encryption algorithm signature, the server encrypts the signature and the sensing data with an asymmetric encryption public key to generate a private authorization data, the second server uses an asymmetric encryption corresponding to the asymmetric encryption public key The private key decrypts the private authorization data and verifies the signature through the group certificate and the node certificate. The second server sends the access request to the private authorization data according to the verification result of the second node. The password is encrypted and sent to the second node. The Internet of Things system according to claim 5, wherein the server generates the server public key by multiplying one of the private key value of the server and one of a plurality of parameter base points on an elliptic curve. The Internet of Things system according to claim 5, wherein the server transmits the server public key and the identification code to the certificate management center, and the certificate management center verifies the server public key according to the elliptic curve cryptography, and The certificate management center issues an original certificate to the server based on the verification result. The Internet of Things system according to claim 5, wherein the server receives a registration application from the node, and the server issues a registration serial number to the node and reads an access password for a private database according to the registration application.

Images