WO2020220627A1 - 物联网场景下跨域逻辑强隔离与安全访问控制方法及装置 - Google Patents

物联网场景下跨域逻辑强隔离与安全访问控制方法及装置 Download PDF

Info

Publication number
WO2020220627A1
WO2020220627A1 PCT/CN2019/114985 CN2019114985W WO2020220627A1 WO 2020220627 A1 WO2020220627 A1 WO 2020220627A1 CN 2019114985 W CN2019114985 W CN 2019114985W WO 2020220627 A1 WO2020220627 A1 WO 2020220627A1
Authority
WO
WIPO (PCT)
Prior art keywords
domain
identity authentication
authentication result
internet
iot
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/114985
Other languages
English (en)
French (fr)
Inventor
徐恪
吕亮
吴波
谭崎
赵乙
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tsinghua University
Original Assignee
Tsinghua University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tsinghua University filed Critical Tsinghua University
Priority to US16/958,029 priority Critical patent/US11546330B2/en
Publication of WO2020220627A1 publication Critical patent/WO2020220627A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0884—Network architectures or network communication protocols for network security for authentication of entities by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H04L9/0833—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H04L9/3273—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response for mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees
    • G—PHYSICS
    • G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
    • G16Y—INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
    • G16Y30/00—IoT infrastructure
    • G16Y30/10—Security thereof
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H04L2209/805—Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the feedback of this application belongs to the technical field of cyberspace security, and particularly relates to a method and device for cross-domain logical strong isolation and secure access control in the Internet of Things scenario.
  • Access control technology is an important research content in the field of cyberspace security. This technology aims to prevent unauthorized access to any resources and ensure that computer systems are used within a legal scope.
  • the Internet of Things mainly solves the interconnection between objects and objects, objects and people, and people.
  • IoT nodes In the Internet of Things (Internet of Things) scenario, IoT nodes usually have limited computing power, which makes it difficult to complete complex computing operations and access control, so the risk of being hijacked is high; the number of IoT nodes is large.
  • access control solutions in the Internet of Things generally work from two levels. The first is to start from the level of protocols and frameworks. Representative work includes XACML (Extensible Access Control Markup Language), OAUTH (Access control solutions based on Open Authorization protocol), UMA (User-Managed Access), etc.; The second is to start from the model (Models) level. Representative work includes RBAC (Role-Based Access Control), ABAC (Attribute-Based Access Control), CAPBAC (Capability-based access control), UCON (usage control), ORBAC (Organizational-Based Access Control) etc.
  • RBAC Role-Based Access Control
  • ABAC Attribute-Based Access Control
  • CAPBAC Capability-based access control
  • UCON usage control
  • ORBAC Organizational-Based Access Control
  • IoT gateways have more computing resources than IoT nodes, they still cannot support the complex identity authentication process. It is unrealistic to always assume that the authentication node is secure or trustworthy, so the above There is still room for improvement in the security of the access control scheme using a single authentication node.
  • the feedback of this application aims to solve one of the technical problems in related technologies at least to a certain extent.
  • one purpose of this application is to propose a cross-domain logical strong isolation and secure access control method in the Internet of Things scenario, which overcomes the drawbacks of the single authentication node scheme and has the characteristics of high security, transparency, and traceability. .
  • Another purpose of the feedback of this application is to propose a cross-domain logical strong isolation and secure access control device in the IoT scenario.
  • one embodiment of the present application proposes a cross-domain logical strong isolation and secure access control method in the IoT scenario, including:
  • the target IoT gateway in the domain obtains the identity authentication request of the host outside the domain, encapsulates the identity authentication request into a request to publish data packet, and sends the request to publish data packet to other IoT gateways in the domain in a broadcast manner;
  • S2 All IoT gateways in the domain authenticate the request to publish data packet to generate an identity authentication result
  • any Internet of Things gateway in the domain After any Internet of Things gateway in the domain generates the identity authentication result, it starts a distributed consensus mechanism, and calculates a legal number string consistent with the distributed consensus mechanism, and compares the identity authentication result with the legal number string Send to other IoT gateways in the domain;
  • S5 The target Internet of Things gateway in the domain scans whether the identity authentication result exists in the blockchain that is locally updated and stored synchronously through the node synchronization mechanism, and if so, sends the identity authentication result to the outside of the domain If the host does not exist, continue scanning.
  • This application feeds back the cross-domain logical strong isolation and secure access control method in the IoT scenario of the embodiment.
  • a certain IoT gateway receives an identity authentication request, it publishes the authentication request to other IoT gateways in the domain.
  • the network gateway separately authenticates the host sending this request, and uses a distributed consensus mechanism to reach a consensus on the result of the identity authentication.
  • the Internet of Things gateways in the domain use a distributed consensus mechanism to control access to achieve strong cross-domain logic isolation, which effectively improves the security of the Internet of Things system, and the identity authentication results are stored in block form, which is convenient for retrieval and reference, and has publicity. Transparent and traceable characteristics.
  • cross-domain logical strong isolation and secure access control method in the IoT scenario of the foregoing embodiment according to the present application feedback may also have the following additional technical features:
  • IoT gateways in the domain authenticate the request to publish data packet to generate an identity authentication result, including:
  • gateways in the domain receive the request release data packet, they extract the identity information in the request release data packet, and authenticate the identity information according to the locally stored legal identity certificate to generate an identity authentication result.
  • the S3 further includes: after any Internet of Things gateway in the domain generates the identity authentication result, if before calculating a legal number string consistent with the distributed consensus mechanism, another Internet of Things in the domain The gateway calculates the identity authentication result and the legal number string, and the IoT gateway in another domain starts the distributed consensus mechanism, and sends the identity authentication result and the legal number string to other IoT in the domain Gateway.
  • the S4 further includes:
  • S41 All the Internet of Things gateways in the domain verify whether the received identity authentication result is the same as the authentication result generated by the own Internet of Things gateway. If they are different, the identity authentication result is not recognized, the identity authentication result is discarded, and S42 is executed. If they are the same, execute S43;
  • S42 Calculate the legal number string that is consistent with the distributed consensus mechanism. After the calculation is completed, start the distributed consensus mechanism, and send the authentication result of the IoT gateway and the legal number string to all things in the domain.
  • Network gateway execute S41;
  • the node synchronization mechanism is that when all the Internet of Things gateways in the domain verify the identity authentication result and the legal number string, the blockchains of all the Internet of Things gateways in the domain perform information exchange, and the area Block chain for synchronous storage.
  • this application reports that another embodiment proposes a cross-domain logical strong isolation and secure access control device in the IoT scenario, including:
  • the acquisition module is used for the target Internet of Things gateway in the domain to acquire the identity authentication request of the host outside the domain, encapsulate the identity authentication request into a request to publish data packet, and send the request to publish data packet to other Internet of Things gateways in the domain in a broadcast manner ;
  • a generating module used for all IoT gateways in the domain to authenticate the request to release data packet to generate an identity authentication result
  • the sending module is used to start a distributed consensus mechanism after any Internet of Things gateway in the domain generates the identity authentication result, and calculate a legal number string that is consistent with the distributed consensus mechanism, and compare the identity authentication result with the The legal number string is sent to other IoT gateways in the domain;
  • the verification module is used for other IoT gateways in the domain to verify the identity authentication result and the legal digital string through the distributed consensus mechanism and node synchronization mechanism to reach a consensus, and write the identity authentication result into the block for execution Store and generate blockchain;
  • the scanning module is used for the target Internet of Things gateway in the domain to scan whether the identity authentication result exists in the blockchain, which is locally updated and stored synchronously through the node synchronization mechanism, and if so, sends the identity authentication result to If the host outside the domain does not exist, continue scanning.
  • This application feeds back the cross-domain logical strong isolation and secure access control device in the IoT scenario of the embodiment.
  • a certain IoT gateway receives an identity authentication request, it publishes the authentication request to other IoT gateways in the domain.
  • the network gateway separately authenticates the host sending this request, and uses a distributed consensus mechanism to reach a consensus on the result of the identity authentication.
  • the Internet of Things gateways in the domain use a distributed consensus mechanism to control access to achieve strong cross-domain logic isolation, which effectively improves the security of the Internet of Things system, and the identity authentication results are stored in block form, which is convenient for retrieval and reference, and has publicity. Transparent and traceable characteristics.
  • the device for strong cross-domain logical isolation and secure access control in the IoT scenario may also have the following additional technical features:
  • the generating module is specifically used for:
  • gateways in the domain receive the request release data packet, they extract the identity information in the request release data packet, and authenticate the identity information according to the locally stored legal identity certificate to generate an identity authentication result.
  • sending module is also used for:
  • any Internet of Things gateway in the domain After any Internet of Things gateway in the domain generates the identity authentication result, if before calculating a legal number string consistent with the distributed consensus mechanism, another Internet of Things gateway in the domain calculates the identity authentication result and the result For the legal number string, the IoT gateway in another domain initiates the distributed consensus mechanism, and sends the identity authentication result and the legal number string to other IoT gateways in the domain.
  • the identity authentication unit includes an identity authentication unit, a calculation unit and a digital string verification unit;
  • the identity authentication unit is used for all the Internet of Things gateways in the domain to verify whether the received identity authentication result is the same as the authentication result generated by the own Internet of Things gateway. If they are different, the identity authentication result is not recognized and the identity is discarded As a result of the authentication, the calculation unit is executed, and if the same, the digital string verification unit is executed;
  • the calculation unit is used to calculate the legal number string that is consistent with the distributed consensus mechanism. After the calculation is completed, the distributed consensus mechanism is activated, and the authentication result of the IoT gateway and the legal number string are sent To all IoT gateways in the domain, and execute the identity authentication unit;
  • the digital string verification unit is used to verify whether the legal digital string meets the conditions specified by the distributed consensus mechanism, if not, execute the computing unit, if it does, pass the distributed consensus mechanism and
  • the node synchronization mechanism reaches a consensus on the identity authentication result and the legal digital string, writes the identity authentication result into a block for storage, and generates the blockchain.
  • the node synchronization mechanism is that when all the Internet of Things gateways in the domain verify the identity authentication result and the legal number string, the blockchains of all the Internet of Things gateways in the domain perform information exchange, and the area Block chain for synchronous storage.
  • Fig. 1 is a flow chart of a method for cross-domain logical strong isolation and secure access control in an IoT scenario according to an embodiment of the present application
  • FIG. 2 is a schematic diagram of the structure of a request to publish data packet sent by an IoT gateway according to an embodiment of the present application
  • FIG. 3 is a schematic diagram of a broadcast identity authentication result data packet according to an embodiment of the present application.
  • FIG. 4 is a flow chart of a method for cross-domain logical strong isolation and secure access control in an IoT scenario according to another embodiment of the present application;
  • FIG. 5 is a schematic diagram of a blockchain structure for recording identity authentication results according to an embodiment of the present application.
  • FIG. 6 is a system structure diagram of a cross-domain logical strong isolation and secure access control method in an IoT scenario according to an embodiment of the present application
  • FIG. 7 is a flow chart of a method for cross-domain logical strong isolation and secure access control in an IoT scenario according to another embodiment of the present application feedback;
  • Fig. 8 is a schematic structural diagram of a cross-domain logical strong isolation and secure access control device in an IoT scenario according to an embodiment of the present application.
  • Fig. 1 is a flow chart of a method for cross-domain logical strong isolation and secure access control in an IoT scenario according to an embodiment of the present application.
  • the cross-domain logical strong isolation and secure access control method in this IoT scenario includes the following steps:
  • Step S1 The target Internet of Things gateway in the domain obtains the identity authentication request of the host outside the domain, encapsulates the identity authentication request into a request to publish data packet, and sends the request to publish data packet to other Internet of Things gateways in the domain in a broadcast manner.
  • the Internet of Things gateways in the domain form a network by themselves. After a certain Internet of Things gateway in the domain receives an identity authentication request from a host outside the domain, it encapsulates the information carried in the identity authentication request into a request release data packet and broadcasts Send the request release data packet to other IoT gateways in the domain to share the information of the identity authentication request.
  • the Internet of Things in the domain consists of 5 gateways A, B, C, D, and E.
  • Gateway A receives an identity authentication request R, encapsulates the information carried in R and sends it to B, C, D, and E.
  • the five gateways jointly process the identity authentication request R.
  • the Timestamp field is 128 bits, indicating the time when the message is sent; the message type MsgType field is 64 bits, indicating the message type; the ID field is 128 bits , Fill in the unique code of the IoT gateway sending this message; 4096 bits in the authentication information AuthInfo field, fill in the identity authentication information.
  • Step S2 all IoT gateways in the domain authenticate the request to publish the data packet to generate an identity authentication result.
  • IoT gateways in the domain receive the request to publish data packet carrying identity authentication request information sent by the target IoT gateway in the domain, they authenticate the request to publish data packet in a preset manner to generate an identity authentication result.
  • all IoT gateways in the domain can extract the identity information in the request publication data packet after receiving the request publication data packet, and according to the locally stored The legal identity certificate authenticates the identity information to generate an identity authentication result.
  • all the IoT gateways in the domain authenticate the request to publish the data packet and generate an identity authentication result.
  • Multiple identity authentication results may be the same or different.
  • the calculation speed of each IoT gateway is different, and multiple IoT gateways successively calculate multiple identity authentication results.
  • A, B, C, D, and E, 5 IoT gateways all authenticate the request to publish the data packet, and generate corresponding 5 identity authentication results.
  • the 5 identity authentication results can be the same. It can be different.
  • Step S3 After any IoT gateway in the domain generates the identity authentication result, it starts the distributed consensus mechanism, calculates the legal digital string that matches the distributed consensus mechanism, and sends the identity authentication result and legal digital string to other IoT in the domain Gateway.
  • any IoT gateway in the domain where the identity authentication result is calculated first starts a distributed consensus mechanism to broadcast the calculated identity authentication result within the domain to other than itself
  • it also calculates the legal digital string that is consistent with the distributed consensus mechanism and broadcasts the identity authentication result and the legal digital string to other IoT gateways in the domain.
  • any Internet of Things gateway in the domain generates the identity authentication result, if it calculates the legal number string that matches the distributed consensus mechanism, another Internet of Things gateway in the domain first calculates the identity authentication result and the legal number string.
  • the IoT gateway in another domain initiates the distributed consensus mechanism, and sends the identity authentication result and the legal number string to other IoT gateways in the domain.
  • A, B, C, D, and E 5 IoT gateways all generate identity authentication results.
  • C first generates the identity authentication result, and then calculates the legal number string.
  • the other 4 IoT gateways have not completed the calculation of the legal number string, then C starts the distributed mechanism and sends the identity authentication result and the legal number string generated by C to A in the domain by broadcasting.
  • B, D and E 4 IoT gateways.
  • the five IoT gateways all generate identity authentication results.
  • C first generates the identity authentication result.
  • E After E generates the identity authentication result, Before C calculates a legal number string that complies with the distributed consensus mechanism, E starts the distributed consensus mechanism, and sends the identity authentication result and legal number string generated by E to A, B, C, and D in the domain by broadcasting. 4 IoT gateways.
  • FIG. 3 it shows the structure of the broadcast data packet sent by the IoT gateway that has completed the authentication and obtained the legal number string.
  • the broadcast data packet includes the identity authentication result and the legal number string.
  • the Timestamp field is 128 bits, which means The time when this message is sent; the message type MsgType field is 64 bits, indicating the message type; the ID field is 128 bits, and the unique code of the IoT gateway that sends this message is filled in; the numeric string NumString field is 1024 bits, and the match obtained by the IoT gateway is filled in The legal number string specified by the distributed consensus mechanism; the length of the authentication result AuthResult field is variable, the shortest is not less than 128 bits, and the longest is not more than 3776 bits. Fill in the identity authentication result obtained by this IoT gateway.
  • Step S4 other IoT gateways in the domain verify the identity authentication result and the legal digital string through a distributed consensus mechanism and a node synchronization mechanism to reach a consensus, write the identity authentication result into a block for storage, and generate a blockchain.
  • the specific distributed consensus mechanism used is not limited.
  • the blockchain also has its own node synchronization mechanism.
  • the node synchronization mechanism between nodes can unify the respective stored blockchains.
  • the synchronization mechanism of different blockchain systems may be different.
  • the specific node synchronization mechanism used is not limited. For example, you can use the Initial Block Download (IBD) synchronization mechanism in the Bitcoin blockchain. Other node synchronization mechanisms can be used.
  • IBD Initial Block Download
  • step S4 specifically includes:
  • S41 All the Internet of Things gateways in the domain verify whether the received identity authentication result is the same as the authentication result generated by the Internet of Things gateway. If they are different, the identity authentication result is not recognized, the identity authentication result is discarded, and S42 is executed. If the same, S43 is executed. ;
  • S42 Calculate the legal number string conforming to the distributed consensus mechanism. After the calculation is completed, start the distributed consensus mechanism, send the authentication result and legal number string of the IoT gateway to all IoT gateways in the domain, and execute S41;
  • PoW Proof of Work
  • the gateway needs to compare the obtained identity authentication result with the legal number
  • the strings are broadcast together in the domain.
  • other IoT gateways After receiving the broadcast, other IoT gateways first check whether the identity authentication result in the broadcast packet is the same as the identity authentication result obtained by the gateway. If they are different, then discard the packet directly; if they are the same, verify the legal number string Whether it meets the conditions stipulated by PoW.
  • the IoT gateway Only when the identity authentication result in the broadcast data packet is the same as the identity authentication result obtained by this gateway and the legal digital string carried in the broadcast data packet meets certain conditions, the IoT gateway will recognize the identity authentication result and the IoT gateway corresponding to the legal digital string. The new block will eventually be linked to the blockchain in the domain.
  • A, B, D, and E receive the identity authentication result and legal number string sent by C, they perform verification. For example, A verifies the identity authentication result sent by C and the identity generated by the gateway. Whether the authentication results are the same, if they are the same, then verify the legal number string again, if the legal number string also meets the requirements, then it is recognized that C writes the identity authentication result into the block, stores it in the blockchain, and ends the calculation of the legal number string; If the identity authentication result sent by A verifies that C is different from the identity authentication result generated by the gateway, the identity authentication result is discarded, the legal number string is continued to be calculated, and the distributed consensus mechanism is started after the calculation is completed.
  • the process is as in the above-mentioned embodiment. To repeat; if the identity authentication result sent by A verifies that C is the same as the identity authentication result generated by this gateway, but the legal number string does not meet the requirements, the legal number string is calculated, and the distributed consensus mechanism is started after the calculation is completed.
  • the process is as in the above embodiment , Do not repeat it. B, D, and E are verified in the same way, so I won’t repeat them.
  • the blockchains of all the IoT gateways in the domain exchange information and synchronize the storage of the blockchains, so that you can Reach a consensus on the identity authentication results, generate blocks, and write them into the blockchain.
  • FIG. 5 shows a schematic diagram of the blockchain structure that records the result of identity authentication.
  • the previous block ID, current block ID, timestamp and random number are all of the block structure in the current mainstream blockchain system Inherent content, where the previous block ID represents the ID of the previous block linked to this block, the current block ID represents the ID of this block, and the ID of each block is unique on the entire network; the timestamp indicates At the moment when this block is generated, the random number is a string of numbers that meets the PoW regulations obtained by the IoT gateway that generated this block.
  • the DataRecord part records data records related to identity authentication. These data records can be network status, host information, and identity authentication log records.
  • the data records in the blockchain are open and transparent to the IoT gateway in the domain, and once written into the blockchain, they cannot be tampered with.
  • Step S5 the target Internet of Things gateway in the domain scans whether there is an identity authentication result on the locally updated and stored block chain synchronously through the node synchronization mechanism, if so, the identity authentication result is sent to the host outside the domain, if not, the scanning continues.
  • the IoT gateway that receives the identity authentication request continuously scans the locally updated and stored blockchain through the node synchronization mechanism. When it is confirmed that the block in the blockchain contains the request for identity authentication After the authentication result, the identity authentication result in the block is fed back to the host outside the domain that sent the identity authentication request.
  • the Internet of Things gateways in the domain are interconnected to form a network, sharing the identity certificates of all legitimate hosts in the domain, to overcome the problem of insufficient security in the current Internet of Things scenario, a single Internet of Things gateway access control mechanism, with high security and openness Features of transparency and traceability.
  • the user (host outside the domain) initiates an identity authentication request to the IoT gateway.
  • the IoT gateway in the domain reaches a consensus on the identity authentication result through a distributed consensus mechanism, and stores the authentication result in the form of a blockchain.
  • a consensus is reached using a proof-of-work (Power of Work) mechanism, that is, the IoT gateway uses hash algorithm calculations to perform a large number of attempts to generate a series of numbers that are difficult to calculate but easy to verify.
  • the so-called difficult to calculate means that the IoT gateway usually needs to go through a lot of calculations to calculate a qualified number string; the so-called easy verification means that other IoT gateways can easily verify whether the number string meets specific conditions.
  • the IoT gateway needs to pay a certain amount of computing resources to get the qualified string to form a new block and link it to the blockchain.
  • the IoT gateway 1 receives the identity authentication request R sent by a certain host H.
  • the Internet of Things gateway 1 encapsulates the identity information carried in the identity authentication request R into a request to publish data packet, and sends the request to publish data packet to other Internet of Things gateways in the domain.
  • the Internet of Things gateway in the domain receives the request to publish the data packet, it extracts the identity information carried in the data packet, and authenticates the identity information according to the legal identity certificate stored locally.
  • the IoT gateway gets the authentication result, it starts to start the distributed consensus mechanism. It is assumed that the IoT gateway adopts Proof of Work (PoW) as a distributed consensus mechanism. It is assumed that the IoT gateway 3 first calculates and obtains a legal number string that meets the PoW regulations.
  • PoW Proof of Work
  • the gateway After the IoT gateway 3 calculates the legal number string required for PoW, the gateway encapsulates the obtained identity authentication result and the number string in a broadcast data packet, and sends it to other IoT gateways in the domain. After the other IoT gateways receive the broadcast, they first check whether the identity authentication result in the broadcast data packet is the same as the identity authentication result obtained by the gateway.
  • the data packet is directly discarded, and the digital string is continuously calculated for distributed Consensus mechanism; if they are the same, verify whether the digital string meets the conditions specified by the PoW; if not, continue to calculate the digital string and perform a distributed consensus mechanism; only the identity authentication result in the broadcast data packet and the identity authentication obtained by the gateway.
  • the IoT gateway will recognize that a new block is generated by the IoT gateway 3 and stop calculating the number string that meets the conditions. The block is finally linked to the blockchain in the domain. in.
  • the IoT gateway 1 that receives the identity authentication request continues to scan the blockchain in the domain, and after confirming that the block in the blockchain contains the authentication result of the identity authentication request R, the identity in the block The authentication result is fed back to the sender of R.
  • the cross-domain logical strong isolation and secure access control method in the IoT scenario is oriented to the IoT scenario, and the authentication mode of a single node in the traditional access control scheme is extended to be passed by all IoT gateways in the domain.
  • the distributed consensus mechanism completes the authentication. In theory, only when more than 50% of the computing resources in the domain are hijacked, will the IoT devices in the domain be threatened. Realize the strong logical isolation across domains, effectively improving system security.
  • the authentication request is issued to other IoT gateways in the domain.
  • the Internet of Things gateway separately authenticates the host sending this request, and uses a distributed consensus mechanism to reach a consensus on the result of the identity authentication.
  • the Internet of Things gateways in the domain use a distributed consensus mechanism to control access to achieve strong cross-domain logic isolation, which effectively improves the security of the Internet of Things system, and the identity authentication results are stored in block form, which is convenient for retrieval and reference, and has publicity. Transparent and traceable characteristics.
  • Fig. 8 is a schematic structural diagram of a cross-domain logical strong isolation and secure access control device in an IoT scenario according to an embodiment of the present application.
  • the cross-domain logical strong isolation and secure access control device in the Internet of Things scenario includes: an acquisition module 100, a generation module 200, a sending module 300, a verification module 400, and a scanning module 500.
  • the obtaining module 100 is configured to obtain an identity authentication request of a host outside the domain by a target IoT gateway in the domain, encapsulate the identity authentication request into a request release data packet, and send the request release data packet to other IoT gateways in the domain in a broadcast manner.
  • the generating module 200 is used for all the Internet of Things gateways in the domain to authenticate the request to publish the data packet to generate an identity authentication result.
  • the sending module 300 is used for any IoT gateway in the domain to generate the identity authentication result, start the distributed consensus mechanism, calculate the legal digital string that is consistent with the distributed consensus mechanism, and send the identity authentication result and legal digital string to others in the domain IoT gateway.
  • the verification module 400 is used for other IoT gateways in the domain to verify the identity authentication result and the legal digital string through a distributed consensus mechanism and a node synchronization mechanism to reach a consensus, write the identity authentication result into a block for storage, and generate a blockchain.
  • the scanning module 500 is used for the target IoT gateway in the domain to scan the locally updated and stored block chain through the node synchronization mechanism to see if there is an identity authentication result, if so, the identity authentication result is sent to the host outside the domain, if not, continue scanning.
  • the device overcomes the disadvantages of the single authentication node scheme, and has the characteristics of high security, transparency and traceability.
  • the generating module is specifically used for,
  • gateways in the domain receive the request release data packet, they extract the identity information in the request release data packet, and authenticate the identity information according to the legal identity certificate stored locally to generate an identity authentication result.
  • the sending module is also used for,
  • any IoT gateway in the domain After any IoT gateway in the domain generates the identity authentication result, if another IoT gateway in the domain calculates the identity authentication result and the legal number string before calculating the legal number string that matches the distributed consensus mechanism, then another domain The IoT gateway initiates a distributed consensus mechanism, and sends the identity authentication result and legal digital string to other IoT gateways in the domain.
  • the identity authentication unit includes an identity authentication unit, a calculation unit and a digital string verification unit;
  • the identity authentication unit is used for all IoT gateways in the domain to verify whether the received identity authentication result is the same as the authentication result generated by this IoT gateway. If they are different, the identity authentication result is not recognized, the identity authentication result is discarded, and the calculation unit is executed. Same, then execute the digital string verification unit;
  • the computing unit is used to calculate the legal number string that is consistent with the distributed consensus mechanism. After the calculation is completed, the distributed consensus mechanism is activated, and the authentication result and legal number string of the IoT gateway are sent to all IoT gateways in the domain to execute the identity Authentication unit
  • the digital string verification unit is used to verify whether the legal digital string meets the conditions specified by the distributed consensus mechanism. If it does not meet the conditions, the calculation unit is executed. If it does, the identity authentication result and the legal digital string are verified through the distributed consensus mechanism and node synchronization mechanism. Reach a consensus, write the identity authentication result into the block for storage, and generate a blockchain
  • the node synchronization mechanism is that when all the IoT gateways in the domain verify the identity authentication result and the legal digital string, the blockchains of all the IoT gateways in the domain exchange information and store the blockchains synchronously.
  • the authentication request is issued to other IoT gateways in the domain.
  • the Internet of Things gateway separately authenticates the host sending this request, and uses a distributed consensus mechanism to reach a consensus on the result of the identity authentication.
  • the Internet of Things gateways in the domain use a distributed consensus mechanism to control access to achieve strong cross-domain logic isolation, which effectively improves the security of the Internet of Things system, and the identity authentication results are stored in block form, which is convenient for retrieval and reference, and has publicity. Transparent and traceable characteristics.
  • first and second are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Therefore, the features defined with “first” and “second” may explicitly or implicitly include at least one of the features. In the description of feedback in this application, “multiple” means at least two, such as two, three, etc., unless otherwise specifically defined.
  • the terms “installation”, “connected”, “connected”, “fixed” and other terms should be understood in a broad sense.
  • it can be a fixed connection or a detachable connection. Connected or integrated; it can be mechanically connected or electrically connected; it can be directly connected or indirectly connected through an intermediary, and it can be the internal communication between two components or the interaction between two components, unless otherwise Clearly defined.
  • the specific meaning of the above-mentioned terms in the feedback of this application can be understood according to the specific situation.
  • the “on” or “under” of the first feature on the second feature may be in direct contact with the first and second features, or the first and second features may be through an intermediary. Indirect contact.
  • the “above”, “above” and “above” of the first feature on the second feature may mean that the first feature is directly above or obliquely above the second feature, or simply means that the level of the first feature is higher than the second feature.
  • the “below”, “below” and “below” of the second feature of the first feature may mean that the first feature is directly below or obliquely below the second feature, or it simply means that the level of the first feature is smaller than the second feature.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Power Engineering (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请反馈公开了一种物联网场景下跨域逻辑强隔离与安全访问控制方法及装置，其中，该方法包括：当某台物联网网关接收到身份认证请求后，该网关将此请求广播到域内的其它物联网网关上；域内的物联网网关接收到身份认证请求后，开始独立验证是否该身份认证请求是否合法；某台物联网网关得出身份认证结果后，启动分布式共识机制；域内的物联网网关通过分布式共识机制对认证结果达成共识，而后身份认证结果被写入区块存储起来，这些区块形成区块链。由此，域内的物联网网关以分布式共识机制进行访问控制，实现跨域逻辑强隔离，有效提升了物联网系统的安全性，并且身份认证结果存储在区块链中的区块上，具有公开透明和可追溯的特性。

Description

物联网场景下跨域逻辑强隔离与安全访问控制方法及装置
相关申请的交叉引用
本申请要求清华大学于2019年04月29日提交的、发明名称为“物联网场景下跨域逻辑强隔离与安全访问控制方法及装置”的、中国专利申请号“201910354377.X”的优先权。
技术领域
本申请反馈属于网络空间安全技术领域，特别涉及一种物联网场景下跨域逻辑强隔离与安全访问控制方法及装置。
背景技术
访问控制技术是网络空间安全领域的重要研究内容，该技术旨在防止对任何资源进行的未授权访问，确保计算机系统在合法的范围内使用。根据国际电信联盟的定义，物联网主要解决物品与物品、物品与人、人与人之间的互联。在物联网(Internet of Things)场景中，物联网节点通常算力有限，难以完成复杂的计算操作和访问控制，所以被劫持的风险很高；物联网节点数量大，如果物联网节点被劫持，黑客可以借助物联网节点在数量上的优势实施DDoS(Distributed Denial of Service，分布式拒绝服务)攻击，极大危害网络安全；物联网节点与人类生活息息相关，因此物联网节点通常记录了人们的隐私数据，若被劫持，可能会造成严重的隐私泄漏。瑞士苏黎世大学的Mattern团队曾经总结了从互联网到物联网的转变过程中可能会面临的一系列安全问题，其中尤为强调了访问控制问题。因此，研究物联网场景下的访问控制机制具有重要意义。
近年来，随着物联网的广泛应用，物联网场景中有大量关于访问控制方面的研究。目前，物联网中的访问控制解决方案大致从两个层面开展工作。第一，是从协议和框架(Protocols and Frameworks)层面入手，代表性工作包括XACML(Extensible Access Control Markup Language)、OAUTH(Access control solutions based on Open Authorization protocol)、UMA(User-Managed Access)等；第二，是从模型(Models)层面入手，代表性工作包括RBAC(Role-Based Access Control)、ABAC(Attribute-Based Access Control)、CAPBAC(Capability-based access control)、UCON(usage control)、ORBAC(Organizational-Based Access Control)等。尽管这些方案从各个层面上增强了物联网系统的安全性，但是从宏观来看，在上述解决方案中，访问控制通常由单一认证节点(比如物联网网关)完成，并且 通常假设这个认证节点是可信的、安全的。这导致一个问题：如果该认证节点被劫持，该域内的所有物联网设备和用户数据就处于风险之中；尽管在某些解决方案中，域内可以部署多个认证节点，但是这些认证节点之间通常互为备份，这仅为提升系统可靠性考虑，只要多个认证节点中有一个认证节点被劫持，即可极大威胁身份认证安全，并无法有效提升系统安全性。此外，尽管相对于物联网节点来说，物联网网关具备较多的计算资源，但是仍然无法支持复杂的身份认证过程，总是假设认证节点是安全的或者可信的是不现实的，所以上述采用单认证节点的访问控制方案安全性仍有提升空间。
发明内容
本申请反馈旨在至少在一定程度上解决相关技术中的技术问题之一。
为此，本申请反馈的一个目的在于提出一种物联网场景下跨域逻辑强隔离与安全访问控制方法，该方法克服单认证节点方案存在的弊端，具有高安全性、透明和可追溯等特点。
本申请反馈的另一个目的在于提出一种物联网场景下跨域逻辑强隔离与安全访问控制装置。
为达到上述目的，本申请反馈一方面实施例提出了一种物联网场景下跨域逻辑强隔离与安全访问控制方法，包括：
S1，域内目标物联网网关获取域外主机的身份认证请求，将所述身份认证请求封装为请求发布数据包，并以广播的方式发送所述请求发布数据包至域内其它的物联网网关；
S2，域内所有的物联网网关对所述请求发布数据包进行认证以生成身份认证结果；
S3，域内任一物联网网关生成所述身份认证结果后，启动分布式共识机制，并计算与所述分布式共识机制相符合的合法数字串，将所述身份认证结果和所述合法数字串发送至域内其它的物联网网关；
S4，域内其它的物联网网关通过所述分布式共识机制和节点同步机制对所述身份认证结果和所述合法数字串进行验证达成共识，将所述身份认证结果写入区块进行存储，生成区块链；
S5，所述域内目标物联网网关扫描本地通过所述节点同步机制同步更新并存储的所述区块链是否存在所述身份认证结果，若存在，则将所述身份认证结果发送给所述域外主机，若不存在，则继续扫描。
本申请反馈实施例的物联网场景下跨域逻辑强隔离与安全访问控制方法，当某台物联网网关接收到身份认证请求后，将此认证请求发布给域内的其它物联网网关，域内的物联网网关分别对此发送此请求的主机进行身份认证，并以分布式共识机制对身份认证的结果达成共识。由此，域内的物联网网关以分布式共识机制进行访问控制，实现跨域逻辑强隔 离，有效提升了物联网系统的安全性，并且身份认证结果以区块形式存储，便于检索查阅，具有公开透明和可追溯的特性。
另外，根据本申请反馈上述实施例的物联网场景下跨域逻辑强隔离与安全访问控制方法还可以具有以下附加的技术特征：
进一步地，所述域内所有的物联网网关对所述请求发布数据包进行认证生成身份认证结果，包括：
域内所有的物联网网关接收到所述请求发布数据包后，提取所述请求发布数据包中的身份信息，并根据本地存储的合法身份证书对所述身份信息进行认证生成身份认证结果。
进一步地，所述S3，还包括：所述域内任一物联网网关生成所述身份认证结果后，若在计算出与所述分布式共识机制相符合的合法数字串之前，域内另一物联网网关计算出所述身份认证结果和所述合法数字串，则由另一域内物联网网关启动所述分布式共识机制，将所述身份认证结果和所述合法数字串发送至域内其它的物联网网关。
进一步地，所述S4，进一步包括：
S41，域内所有的物联网网关验证接收到的所述身份认证结果与本物联网网关生成的认证结果是否相同，若不同，则不认可所述身份认证结果，丢弃所述身份认证结果，执行S42，若相同，则执行S43；
S42，计算与所述分布式共识机制相符合的所述合法数字串，计算完成后，启动所述分布式共识机制，将本物联网网关的认证结果和所述合法数字串发送至域内所有的物联网网关，执行S41；
S43，验证所述合法数字串是否符合所述分布式共识机制规定的条件，若不符合，则执行S42，若符合，通过所述分布式共识机制和所述节点同步机制对所述身份认证结果和所述合法数字串达成共识，将所述身份认证结果写入区块进行存储，生成所述区块链。
进一步地，所述节点同步机制为域内所有的物联网网关在对所述身份认证结果和所述合法数字串进行验证时，域内所有的物联网网关的区块链进行信息交互，将所述区块链进行同步存储。
为达到上述目的，本申请反馈另一方面实施例提出了一种物联网场景下跨域逻辑强隔离与安全访问控制装置，包括：
获取模块，用于域内目标物联网网关获取域外主机的身份认证请求，将所述身份认证请求封装为请求发布数据包，并以广播的方式发送所述请求发布数据包至域内其它的物联网网关；
生成模块，用于域内所有的物联网网关对所述请求发布数据包进行认证以生成身份认证结果；
发送模块，用于域内任一物联网网关生成所述身份认证结果后，启动分布式共识机制，并计算与所述分布式共识机制相符合的合法数字串，将所述身份认证结果和所述合法数字串发送至域内其它的物联网网关；
验证模块，用于域内其它的物联网网关通过所述分布式共识机制和节点同步机制对所述身份认证结果和所述合法数字串进行验证达成共识，将所述身份认证结果写入区块进行存储，生成区块链；
扫描模块，用于所述域内目标物联网网关扫描本地通过所述节点同步机制同步更新并存储的所述区块链是否存在所述身份认证结果，若存在，则将所述身份认证结果发送给所述域外主机，若不存在，则继续扫描。
本申请反馈实施例的物联网场景下跨域逻辑强隔离与安全访问控制装置，当某台物联网网关接收到身份认证请求后，将此认证请求发布给域内的其它物联网网关，域内的物联网网关分别对此发送此请求的主机进行身份认证，并以分布式共识机制对身份认证的结果达成共识。由此，域内的物联网网关以分布式共识机制进行访问控制，实现跨域逻辑强隔离，有效提升了物联网系统的安全性，并且身份认证结果以区块形式存储，便于检索查阅，具有公开透明和可追溯的特性。
另外，根据本申请反馈上述实施例的物联网场景下跨域逻辑强隔离与安全访问控制装置还可以具有以下附加的技术特征：
进一步地，所述生成模块，具体用于，
域内所有的物联网网关接收到所述请求发布数据包后，提取所述请求发布数据包中的身份信息，并根据本地存储的合法身份证书对所述身份信息进行认证生成身份认证结果。
进一步地，所述发送模块，还用于，
所述域内任一物联网网关生成所述身份认证结果后，若在计算出与所述分布式共识机制相符合的合法数字串之前，域内另一物联网网关计算出所述身份认证结果和所述合法数字串，则由另一域内物联网网关启动所述分布式共识机制，将所述身份认证结果和所述合法数字串发送至域内其它的物联网网关。
进一步地，包括身份认证单元、计算单元和数字串验证单元；
所述身份认证单元，用于域内所有的物联网网关验证接收到的所述身份认证结果与本物联网网关生成的认证结果是否相同，若不同，则不认可所述身份认证结果，丢弃所述身份认证结果，执行所述计算单元，若相同，则执行所述数字串验证单元；
所述计算单元，用于计算与所述分布式共识机制相符合的所述合法数字串，计算完成后，启动所述分布式共识机制，将本物联网网关的认证结果和所述合法数字串发送至域内所有的物联网网关，执行所述身份认证单元；
所述数字串验证单元，用于验证所述合法数字串是否符合所述分布式共识机制规定的条件，若不符合，则执行所述计算单元，若符合，通过所述分布式共识机制和所述节点同步机制对所述身份认证结果和所述合法数字串达成共识，将所述身份认证结果写入区块进行存储，生成所述区块链。
进一步地，所述节点同步机制为域内所有的物联网网关在对所述身份认证结果和所述合法数字串进行验证时，域内所有的物联网网关的区块链进行信息交互，将所述区块链进行同步存储。
本申请反馈附加的方面和优点将在下面的描述中部分给出，部分将从下面的描述中变得明显，或通过本申请反馈的实践了解到。
附图说明
本申请反馈上述的和/或附加的方面和优点从下面结合附图对实施例的描述中将变得明显和容易理解，其中：
图1为根据本申请反馈一个实施例的物联网场景下跨域逻辑强隔离与安全访问控制方法流程图；
图2为根据本申请反馈一个实施例的物联网网关发送的请求发布数据包结构示意图；
图3为根据本申请反馈一个实施例的广播身份认证结果数据包的示意图；
图4为根据本申请反馈另一个实施例的物联网场景下跨域逻辑强隔离与安全访问控制方法流程图；
图5为根据本申请反馈一个实施例的记录身份认证结果的区块链结构示意图；
图6为根据本申请反馈一个实施例的物联网场景下跨域逻辑强隔离与安全访问控制方法的系统结构图；
图7为根据本申请反馈又一个实施例的物联网场景下跨域逻辑强隔离与安全访问控制方法流程图；
图8为根据本申请反馈一个实施例的物联网场景下跨域逻辑强隔离与安全访问控制装置结构示意图。
具体实施方式
下面详细描述本申请反馈的实施例，实施例的示例在附图中示出，其中自始至终相同或类似的标号表示相同或类似的元件或具有相同或类似功能的元件。下面通过参考附图描述的实施例是示例性的，旨在用于解释本申请反馈，而不能理解为对本申请反馈的限制。
下面参照附图描述根据本申请反馈实施例提出的物联网场景下跨域逻辑强隔离与 安全访问控制方法及装置。
首先将参照附图描述根据本申请反馈实施例提出的物联网场景下跨域逻辑强隔离与安全访问控制方法。
图1为根据本申请反馈一个实施例的物联网场景下跨域逻辑强隔离与安全访问控制方法流程图。
如图1所示，该物联网场景下跨域逻辑强隔离与安全访问控制方法包括以下步骤：
步骤S1，域内目标物联网网关获取域外主机的身份认证请求，将身份认证请求封装为请求发布数据包，并以广播的方式发送请求发布数据包至域内其它的物联网网关。
具体地，域内的物联网网关自组成网，域内的某台物联网网关收到域外的主机的身份认证请求后，将身份认证请求中携带的信息封装到请求发布数据包中，并以广播的方式将请求发布数据包发送给域内的其它的物联网网关，共享该身份认证请求的信息。
比如，域内物联网有A、B、C、D和E共5个网关组成，网关A收到一个身份认证请求R，将R中携带的信息进行封装后发送给B、C、D和E，5个网关共同对该身份认证请求R进行处理。
如图2所示，展示了物联网网关发送的请求发布数据包结构，其中，时间戳Timestamp字段128位，表示本消息发送的时刻；消息类型MsgType字段64位，表明消息类型；ID字段128位，填写发送本消息的物联网网关的独有编码；认证信息AuthInfo字段4096位，填写身份认证信息。
步骤S2，域内所有的物联网网关对请求发布数据包进行认证以生成身份认证结果。
具体地，域内其它的物联网网关收到域内目标物联网网关发送的携带身份认证请求信息的请求发布数据包后，通过预先设定的方式对请求发布数据包进行认证，生成身份认证结果。
对请求数据包进行认证有多种方式，作为一种可能实现的方式，域内所有的物联网网关可以在接收到请求发布数据包后，提取请求发布数据包中的身份信息，并根据本地存储的合法身份证书对身份信息进行认证生成身份认证结果。
需要说明的是，域内所有的物联网网关都对请求发布数据包进行认证，生成身份认证结果，多个身份认证结果可以相同，也可以不相同。并且每个物联网网关的计算速度不同，多个物联网网关先后计算出多个身份认证结果。
比如，根据上述的实施例，A、B、C、D和E，5个物联网网关都对请求发布数据包进行认证，生成对应的5个身份认证结果，5个身份认证结果可以相同，也可以不相同。
步骤S3，域内任一物联网网关生成身份认证结果后，启动分布式共识机制，并计算与 分布式共识机制相符合的合法数字串，将身份认证结果和合法数字串发送至域内其它的物联网网关。
具体地，由于物联网网关的计算速度有差异，因此，首先计算出身份认证结果的域内任一物联网网关，启动分布式共识机制将计算出的身份认证结果在域内广播至域内除自身外的其它物联网网关，在广播身份认证结果之前，还要计算与分布式共识机制相符合的合法数字串，将身份认证结果和合法数字串一同在域内广播至其它的物联网网关。
需要说明的是，域内任一物联网网关生成身份认证结果后，若在计算出与分布式共识机制相符合的合法数字串之前，域内另一物联网网关先计算出身份认证结果和合法数字串，则由另一域内物联网网关启动所述分布式共识机制，将身份认证结果和所述合法数字串发送至域内其它的物联网网关。
可以理解的是，域内所有的物联网网关都在计算身份认证结果与分布式共识机制相符的合法数字串，首先计算出二者的物联网网关才可以将身份认证结果和合法数字串发送至其它物联网网关。
举例而言，根据上述的实施例，比如，A、B、C、D和E，5个物联网网关都生成身份认证结果，其中，C首先生成身份认证结果，再计算合法数字串，在C完成合法数字串的计算时，其它4个物联网网关都没有完成合法数字串的计算，则C启动分布式机制，将C生成的身份认证结果和合法数字串在域内以广播的方式发送给A、B、D和E，4个物联网网关。
又如，A、B、C、D和E，5个物联网网关都生成身份认证结果，其中，C首先生成身份认证结果，在C计算合法数字串的过程中，E生成身份认证结果后，在C之前计算出符合分布式共识机制的合法数字串，则E启动分布式共识机制，将E生成的身份认证结果和合法数字串在域内以广播的方式发送给A、B、C和D，4个物联网网关。
如图3所示，展示了认证完成且得出合法数字串的物联网网关发送的广播数据包结构，广播数据包中包括身份认证结果和合法数字串，其中，时间戳Timestamp字段128位，表示本消息发送的时刻；消息类型MsgType字段64位，表明消息类型；ID字段128位，填写发送本消息的物联网网关的独有编码；数字字串NumString字段1024位，填写本物联网网关得到的符合分布式共识机制规定的合法数字串；认证结果AuthResult字段长度可变，最短不低于128位，最长不超过3776位，填写本物联网网关得到的身份认证结果。
步骤S4，域内其它的物联网网关通过分布式共识机制和节点同步机制对身份认证结果和合法数字串进行验证达成共识，将身份认证结果写入区块进行存储，生成区块链。
可以理解的是，在每个物联网网关内都存在身份认证结果和合法数字串后，通过分布式共识机制和节点同步机制对二者进行验证，验证通过后才认可身份认证结果。
其中，分布式共识机制有很多种，具体使用哪种分布式共识机制不做限定，区块链也有自身的节点同步机制，节点之间通过节点同步机制可以将各自存储的区块链统一起来，不同的区块链系统的同步机制可能有所不同，具体使用哪种节点同步机制不做限定，比如可以使用比特币区块链中的初始化区块下载(Initial Block Download，IBD)同步机制，也可使用其它节点同步机制。
作为一种可能实现的方式，分布式共识机制采用工作量证明的方式(Proof of Work，PoW)，如图4所示，步骤S4具体包括：
S41，域内所有的物联网网关验证接收到的身份认证结果与本物联网网关生成的认证结果是否相同，若不同，则不认可身份认证结果，丢弃身份认证结果，执行S42，若相同，则执行S43；
S42，计算与分布式共识机制相符合的合法数字串，计算完成后，启动分布式共识机制，将本物联网网关的认证结果和合法数字串发送至域内所有的物联网网关，执行S41；
S43，验证合法数字串是否符合分布式共识机制规定的条件，若不符合，则执行S42，若符合，通过分布式共识机制和节点同步机制对身份认证结果和合法数字串达成共识，将身份认证结果写入区块进行存储，生成区块链。
具体地，和通常的PoW(工作量证明)分布式共识机制相比，当某个物联网网关计算出PoW所需的合法数字串后，该网关需要将其得到的身份认证结果和该合法数字串一同在域内广播。其它物联网网关接收到该广播后，首先核对该广播数据包中的身份认证结果是否与本网关得到的身份认证结果相同，若不同，则直接丢弃该数据包；若相同，则验证合法数字串是否符合PoW规定的条件。只有广播数据包中的身份认证结果与本网关得到的身份认证结果相同并且广播数据包携带的合法数字串符合特定条件时，本物联网网关才认可身份认证结果和合法数字串对应的物联网网关生成新的区块，最终将其链接到域内的区块链中。
举例而言，根据上述的实施例，A、B、D、E收到C发送的身份认证结果和合法数字串后，进行验证，比如，A验证C发送的身份认证结果与本网关生成的身份认证结果是否相同，若相同，则再验证合法数字串，若合法数字串也符合要求，则认可C将该身份认证结果写入区块，存入区块链，并结束合法数字串的计算；若A验证C发送的身份认证结果与本网关生成的身份认证结果不相同，则丢弃该身份认证结果，继续计算合法数字串，计算完成后启动分布式共识机制，过程如上述的实施例，不做赘述；若A验证C发送的身份认证结果与本网关生成的身份认证结果相同，但合法数字串不符合要求，则计算合法数字串，计算完成后启动分布式共识机制，过程如上述实施例，不做赘述。B、D和E同理进行验证，不做赘述。
需要说明的是，域内所有的物联网网关在对身份认证结果和合法数字串进行验证时，域内所有的物联网网关的区块链进行信息交互，将区块链进行同步存储，由此，可以对身份认证结果达成共识，生成区块，写入区块链。
如图5所示，展示了记录身份认证结果的区块链结构示意图，其中，前一区块ID、当前区块ID、时间戳和随机数都是当前主流区块链系统中区块结构的固有内容，其中前一区块ID表示本区块所链接的前一区块的ID，当前区块ID表示本区块的ID，每个区块的ID都是全网唯一的；时间戳表示本区块生成的时刻，随机数是生成本区块的物联网网关得出的符合PoW规定的数字串。DataRecord部分记录了与身份认证相关的数据记录，这些数据记录可以是网络状态、主机信息和身份认证的日志记录等。区块链中的数据记录对于域内的物联网网关而言是公开透明的，且一旦写入区块链就无法被篡改。
步骤S5，域内目标物联网网关扫描本地通过节点同步机制同步更新并存储的区块链是否存在身份认证结果，若存在，则将身份认证结果发送给域外主机，若不存在，则继续扫描。
具体地，在进行验证的过程中，接收到身份认证请求的物联网网关持续扫描本地通过节点同步机制同步更新并存储的区块链，当确认区块链中的区块上包含对身份认证请求的认证结果后，将区块中的身份认证结果反馈给发送身份认证该请求的域外主机。
可以理解的是，不同的分布式共识机制和节点同步机制在生成区块链时有所差异，作为一种可能实现的方式，比如，若采用比特币区块链的分布式共识机制以及比特币区块链的节点同步机制，在扫描时，如果含有该身份认证结果的区块已经在链上并且其该区块后已经链接了6个其它区块，则说明该身份认证结果已经被域内的大多数网关认可，则将身份认证结果返回给发送身份认证请求的域外网关；否则，持续扫描区块链。
进一步地，域内的物联网网关互联成网，共享本域内所有合法主机的身份证书，克服当前物联网场景中，单物联网网关访问控制机制在安全性不足方面的问题，具有高安全性、公开透明和可追溯的特点。
如图6所示，用户(域外主机)向物联网网关发起身份认证请求，域内的物联网网关通过分布式共识机制对身份认证结果达成共识，并将认证结果以区块链的形式存储起来。
在上述实施例中，采用工作量证明(Power of Work)机制达成共识，即物联网网关利用散列算法计算进行大量尝试，生成一串难于计算但易于验证的数字。所谓难于计算，是指物联网网关通常需要经过大量计算才能计算出一个符合条件的数字串；所谓易于验证，是指其它物联网网关可以很容易的验证这个数字串是否符合特定的条件。在这个过程中，因为需要不断尝试不同的随机数，物联网网关需要付出一定的计算资源才能得到符合条件的字符串进而形成新区块，并链接至区块链中。物联网网关的工作量越大(计算时间越长、 计算次数越多)，就越有可能计算生成新的区块，保证了入侵者只有劫持超过50％的计算资源才有可能篡改身份认证结果。另外，所有成功链接至区块链中的区块都是不可篡改的，也都是所有物联网网关公开可见且获得所有物联网网关认可的。
以一个具体实施例对物联网场景下跨域逻辑强隔离与安全访问控制方法详细说明，如图7所示，物联网网关1接收到某主机H发送的身份认证请求R。物联网网关1将身份认证请求R中携带的身份信息封装到请求发布数据包中，并将该请求发布数据包发送给域内的其它物联网网关。
域内的物联网网关接收到请求发布数据包后，提取数据包内携带的身份信息，并根据本地存储的合法身份证书对该身份信息进行认证。
当物联网网关得到认证结果后，即开始启动分布式共识机制。假设物联网网关采用工作量证明(Proof of Work，PoW)作为分布式共识机制。假设物联网网关3最先计算得到符合PoW规定的合法数字串。
当物联网网关3计算出PoW所需的合法数字串后，该网关将其得到的身份认证结果和该数字串封装在广播数据包中，发送给域内的其它物联网网关。其余物联网网关接收到该广播后，首先核对广播数据包中的身份认证结果是否与本网关得到的身份认证结果相同，若不同，则直接丢弃该数据包，同时继续计算数字串，进行分布式共识机制；若相同，则验证数字串是否符合PoW规定的条件；若不符合条件，则继续计算数字串，进行分布式共识机制；只有广播数据包中的身份认证结果与本网关得到的身份认证结果相同并且广播数据包携带的数字串符合特定条件时，本物联网网关才认可由物联网网关3生成新的区块，停止计算符合条件的数字串，该区块最终链接到域内的区块链中。
在此过程中，接收到身份认证请求的物联网网关1持续扫描域内的区块链，当确认区块链中的区块上包含对身份认证请求R的认证结果后，将区块中的身份认证结果反馈给R的发送者。
根据上述的实施例，物联网场景下跨域逻辑强隔离与安全访问控制方法面向物联网场景，将传统访问控制方案中的单个节点进行认证的模式，扩展为由域中的所有物联网网关通过分布式共识机制完成认证。理论上，只有当域中超过50％的计算资源都被劫持时，才会导致域内的物联网设备受到安全威胁。实现了跨域强逻辑隔离，有效提升了系统安全性。
根据本申请反馈实施例提出的物联网场景下跨域逻辑强隔离与安全访问控制方法，当某台物联网网关接收到身份认证请求后，将此认证请求发布给域内的其它物联网网关，域内的物联网网关分别对此发送此请求的主机进行身份认证，并以分布式共识机制对身份认证的结果达成共识。由此，域内的物联网网关以分布式共识机制进行访问控制，实现跨域逻辑强隔离，有效提升了物联网系统的安全性，并且身份认证结果以区块形式存储，便于 检索查阅，具有公开透明和可追溯的特性。
其次参照附图描述根据本申请反馈实施例提出的物联网场景下跨域逻辑强隔离与安全访问控制装置。
图8为根据本申请反馈一个实施例的物联网场景下跨域逻辑强隔离与安全访问控制装置结构示意图。
如图8所示，该物联网场景下跨域逻辑强隔离与安全访问控制装置包括：获取模块100、生成模块200、发送模块300、验证模块400和扫描模块500。
其中，获取模块100，用于域内目标物联网网关获取域外主机的身份认证请求，将身份认证请求封装为请求发布数据包，并以广播的方式发送请求发布数据包至域内其它的物联网网关。
生成模块200，用于域内所有的物联网网关对请求发布数据包进行认证以生成身份认证结果。
发送模块300，用于域内任一物联网网关生成身份认证结果后，启动分布式共识机制，并计算与分布式共识机制相符合的合法数字串，将身份认证结果和合法数字串发送至域内其它的物联网网关。
验证模块400，用于域内其它的物联网网关通过分布式共识机制和节点同步机制对身份认证结果和合法数字串进行验证达成共识，将身份认证结果写入区块进行存储，生成区块链。
扫描模块500，用于域内目标物联网网关扫描本地通过节点同步机制同步更新并存储的区块链是否存在身份认证结果，若存在，则将身份认证结果发送给域外主机，若不存在，则继续扫描。
该装置克服了单认证节点方案存在的弊端，具有高安全性、透明和可追溯等特点。
进一步地，生成模块，具体用于，
域内所有的物联网网关接收到请求发布数据包后，提取请求发布数据包中的身份信息，并根据本地存储的合法身份证书对身份信息进行认证生成身份认证结果。
进一步地，发送模块，还用于，
域内任一物联网网关生成身份认证结果后，若在计算出与分布式共识机制相符合的合法数字串之前，域内另一物联网网关计算出身份认证结果和合法数字串，则由另一域内物联网网关启动分布式共识机制，将身份认证结果和合法数字串发送至域内其它的物联网网关。
进一步地，包括身份认证单元、计算单元和数字串验证单元；
身份认证单元，用于域内所有的物联网网关验证接收到的身份认证结果与本物联网网 关生成的认证结果是否相同，若不同，则不认可身份认证结果，丢弃身份认证结果，执行计算单元，若相同，则执行数字串验证单元；
计算单元，用于计算与分布式共识机制相符合的合法数字串，计算完成后，启动分布式共识机制，将本物联网网关的认证结果和合法数字串发送至域内所有的物联网网关，执行身份认证单元；
数字串验证单元，用于验证合法数字串是否符合分布式共识机制规定的条件，若不符合，则执行计算单元，若符合，通过分布式共识机制和节点同步机制对身份认证结果和合法数字串达成共识，将身份认证结果写入区块进行存储，生成区块链
进一步地，节点同步机制为域内所有的物联网网关在对身份认证结果和合法数字串进行验证时，域内所有的物联网网关的区块链进行信息交互，将区块链进行同步存储。
需要说明的是，前述对物联网场景下跨域逻辑强隔离与安全访问控制方法实施例的解释说明也适用于该实施例的装置，此处不再赘述。
根据本申请反馈实施例提出的物联网场景下跨域逻辑强隔离与安全访问控制装置，当某台物联网网关接收到身份认证请求后，将此认证请求发布给域内的其它物联网网关，域内的物联网网关分别对此发送此请求的主机进行身份认证，并以分布式共识机制对身份认证的结果达成共识。由此，域内的物联网网关以分布式共识机制进行访问控制，实现跨域逻辑强隔离，有效提升了物联网系统的安全性，并且身份认证结果以区块形式存储，便于检索查阅，具有公开透明和可追溯的特性。
在本申请反馈的描述中，需要理解的是，术语“中心”、“纵向”、“横向”、“长度”、“宽度”、“厚度”、“上”、“下”、“前”、“后”、“左”、“右”、“竖直”、“水平”、“顶”、“底”“内”、“外”、“顺时针”、“逆时针”、“轴向”、“径向”、“周向”等指示的方位或位置关系为基于附图所示的方位或位置关系，仅是为了便于描述本申请反馈和简化描述，而不是指示或暗示所指的装置或元件必须具有特定的方位、以特定的方位构造和操作，因此不能理解为对本申请反馈的限制。
此外，术语“第一”、“第二”仅用于描述目的，而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”的特征可以明示或者隐含地包括至少一个该特征。在本申请反馈的描述中，“多个”的含义是至少两个，例如两个，三个等，除非另有明确具体的限定。
在本申请反馈中，除非另有明确的规定和限定，术语“安装”、“相连”、“连接”、“固定”等术语应做广义理解，例如，可以是固定连接，也可以是可拆卸连接，或成一体；可以是机械连接，也可以是电连接；可以是直接相连，也可以通过中间媒介间接相连，可以是两个元件内部的连通或两个元件的相互作用关系，除非另有明确的限定。对于本领域的普通 技术人员而言，可以根据具体情况理解上述术语在本申请反馈中的具体含义。
在本申请反馈中，除非另有明确的规定和限定，第一特征在第二特征“上”或“下”可以是第一和第二特征直接接触，或第一和第二特征通过中间媒介间接接触。而且，第一特征在第二特征“之上”、“上方”和“上面”可是第一特征在第二特征正上方或斜上方，或仅仅表示第一特征水平高度高于第二特征。第一特征在第二特征“之下”、“下方”和“下面”可以是第一特征在第二特征正下方或斜下方，或仅仅表示第一特征水平高度小于第二特征。
在本说明书的描述中，参考术语“一个实施例”、“一些实施例”、“示例”、“具体示例”、或“一些示例”等的描述意指结合该实施例或示例描述的具体特征、结构、材料或者特点包含于本申请反馈的至少一个实施例或示例中。在本说明书中，对上述术语的示意性表述不必须针对的是相同的实施例或示例。而且，描述的具体特征、结构、材料或者特点可以在任一个或多个实施例或示例中以合适的方式结合。此外，在不相互矛盾的情况下，本领域的技术人员可以将本说明书中描述的不同实施例或示例以及不同实施例或示例的特征进行结合和组合。
尽管上面已经示出和描述了本申请反馈的实施例，可以理解的是，上述实施例是示例性的，不能理解为对本申请反馈的限制，本领域的普通技术人员在本申请反馈的范围内可以对上述实施例进行变化、修改、替换和变型。

Claims (10)

  1. 一种物联网场景下跨域逻辑强隔离与安全访问控制方法，其特征在于，包括以下步骤：
    S1，域内目标物联网网关获取域外主机的身份认证请求，将所述身份认证请求封装为请求发布数据包，并以广播的方式发送所述请求发布数据包至域内其它的物联网网关；
    S2，域内所有的物联网网关对所述请求发布数据包进行认证以生成身份认证结果；
    S3，域内任一物联网网关生成所述身份认证结果后，启动分布式共识机制，并计算与所述分布式共识机制相符合的合法数字串，将所述身份认证结果和所述合法数字串发送至域内其它的物联网网关；
    S4，域内其它的物联网网关通过所述分布式共识机制和节点同步机制对所述身份认证结果和所述合法数字串进行验证达成共识，将所述身份认证结果写入区块进行存储，生成区块链；
    S5，所述域内目标物联网网关扫描本地通过所述节点同步机制同步更新并存储的所述区块链是否存在所述身份认证结果，若存在，则将所述身份认证结果发送给所述域外主机，若不存在，则继续扫描。
  2. 根据权利要求1所述的方法，其特征在于，所述域内所有的物联网网关对所述请求发布数据包进行认证生成身份认证结果，包括：
    域内所有的物联网网关接收到所述请求发布数据包后，提取所述请求发布数据包中的身份信息，并根据本地存储的合法身份证书对所述身份信息进行认证生成身份认证结果。
  3. 根据权利要求1所述的方法，其特征在于，所述S3，还包括：所述域内任一物联网网关生成所述身份认证结果后，若在计算出与所述分布式共识机制相符合的合法数字串之前，域内另一物联网网关计算出所述身份认证结果和所述合法数字串，则由另一域内物联网网关启动所述分布式共识机制，将所述身份认证结果和所述合法数字串发送至域内其它的物联网网关。
  4. 根据权利要求1所述的方法，其特征在于，所述S4，进一步包括：
    S41，域内所有的物联网网关验证接收到的所述身份认证结果与本物联网网关生成的认证结果是否相同，若不同，则不认可所述身份认证结果，丢弃所述身份认证结果，执行S42，若相同，则执行S43；
    S42，计算与所述分布式共识机制相符合的所述合法数字串，计算完成后，启动所述分布式共识机制，将本物联网网关的认证结果和所述合法数字串发送至域内所有的物联网网关，执行S41；
    S43，验证所述合法数字串是否符合所述分布式共识机制规定的条件，若不符合，则执行S42，若符合，通过所述分布式共识机制和所述节点同步机制对所述身份认证结果和所述合法数字串达成共识，将所述身份认证结果写入区块进行存储，生成所述区块链。
  5. 根据权利要求4所述的方法，其特征在于，所述节点同步机制为域内所有的物联网网关在对所述身份认证结果和所述合法数字串进行验证时，域内所有的物联网网关的区块链进行信息交互，将所述区块链进行同步存储。
  6. 一种物联网场景下跨域逻辑强隔离与安全访问控制装置，其特征在于，包括：
    获取模块，用于域内目标物联网网关获取域外主机的身份认证请求，将所述身份认证请求封装为请求发布数据包，并以广播的方式发送所述请求发布数据包至域内其它的物联网网关；
    生成模块，用于域内所有的物联网网关对所述请求发布数据包进行认证以生成身份认证结果；
    发送模块，用于域内任一物联网网关生成所述身份认证结果后，启动分布式共识机制，并计算与所述分布式共识机制相符合的合法数字串，将所述身份认证结果和所述合法数字串发送至域内其它的物联网网关；
    验证模块，用于域内其它的物联网网关通过所述分布式共识机制和节点同步机制对所述身份认证结果和所述合法数字串进行验证达成共识，将所述身份认证结果写入区块进行存储，生成区块链；
    扫描模块，用于所述域内目标物联网网关扫描本地通过所述节点同步机制同步更新并存储的所述区块链是否存在所述身份认证结果，若存在，则将所述身份认证结果发送给所述域外主机，若不存在，则继续扫描。
  7. 根据权利要求6所述的装置，其特征在于，所述生成模块，具体用于，
    域内所有的物联网网关接收到所述请求发布数据包后，提取所述请求发布数据包中的身份信息，并根据本地存储的合法身份证书对所述身份信息进行认证生成身份认证结果。
  8. 根据权利要求6所述的装置，其特征在于，所述发送模块，还用于，
    所述域内任一物联网网关生成所述身份认证结果后，若在计算出与所述分布式共识机制相符合的合法数字串之前，域内另一物联网网关计算出所述身份认证结果和所述合法数字串，则由另一域内物联网网关启动所述分布式共识机制，将所述身份认证结果和所述合法数字串发送至域内其它的物联网网关。
  9. 根据权利要求6所述的装置，其特征在于，所述验证模块，包括身份认证单元、计算单元和数字串验证单元；
    所述身份认证单元，用于域内所有的物联网网关验证接收到的所述身份认证结果与本 物联网网关生成的认证结果是否相同，若不同，则不认可所述身份认证结果，丢弃所述身份认证结果，执行所述计算单元，若相同，则执行所述数字串验证单元；
    所述计算单元，用于计算与所述分布式共识机制相符合的所述合法数字串，计算完成后，启动所述分布式共识机制，将本物联网网关的认证结果和所述合法数字串发送至域内所有的物联网网关，执行所述身份认证单元；
    所述数字串验证单元，用于验证所述合法数字串是否符合所述分布式共识机制规定的条件，若不符合，则执行所述计算单元，若符合，通过所述分布式共识机制和所述节点同步机制对所述身份认证结果和所述合法数字串达成共识，将所述身份认证结果写入区块进行存储，生成所述区块链。
  10. 根据权利要求9所述的装置，其特征在于，所述节点同步机制为域内所有的物联网网关在对所述身份认证结果和所述合法数字串进行验证时，域内所有的物联网网关的区块链进行信息交互，将所述区块链进行同步存储。
PCT/CN2019/114985 2019-04-29 2019-11-01 物联网场景下跨域逻辑强隔离与安全访问控制方法及装置 Ceased WO2020220627A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/958,029 US11546330B2 (en) 2019-04-29 2019-11-01 Method and device for cross-domain strong logical isolation and secure access control in the internet of things

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910354377.X 2019-04-29
CN201910354377.XA CN109981689B (zh) 2019-04-29 2019-04-29 物联网场景下跨域逻辑强隔离与安全访问控制方法及装置

Publications (1)

Publication Number Publication Date
WO2020220627A1 true WO2020220627A1 (zh) 2020-11-05

Family

ID=67087055

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/114985 Ceased WO2020220627A1 (zh) 2019-04-29 2019-11-01 物联网场景下跨域逻辑强隔离与安全访问控制方法及装置

Country Status (3)

Country Link
US (1) US11546330B2 (zh)
CN (1) CN109981689B (zh)
WO (1) WO2020220627A1 (zh)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112487443A (zh) * 2020-11-11 2021-03-12 昆明理工大学 一种基于区块链的能源数据细粒度访问控制方法
CN113935016A (zh) * 2021-11-03 2022-01-14 北京邮电大学 命名数据网中基于区块链的可信访问与跨域认证方法
CN114024749A (zh) * 2021-11-05 2022-02-08 西北工业大学 一种基于中心节点域间协同的工业设备逻辑跨域接入认证方法
CN114745137A (zh) * 2022-05-10 2022-07-12 山东鲁软数字科技有限公司 一种实现安全通信方法及区块链物联代理装置
CN116527300A (zh) * 2023-01-30 2023-08-01 东南大学 一种区块链辅助的物联网安全跨域授权与认证方法
CN116684103A (zh) * 2023-06-09 2023-09-01 山东省计算中心（国家超级计算济南中心） 一种基于区块链的跨域身份认证方法
CN117914558A (zh) * 2023-12-28 2024-04-19 天翼物联科技有限公司 物联网设备可信控制方法、系统、电子设备及存储介质

Families Citing this family (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109981689B (zh) * 2019-04-29 2020-05-12 清华大学 物联网场景下跨域逻辑强隔离与安全访问控制方法及装置
CN110855637A (zh) * 2019-10-28 2020-02-28 西北工业大学 一种基于属性的区块链物联网分布式访问控制方法
CN111049799B (zh) * 2019-11-13 2022-01-21 华为终端有限公司 控制方法、装置和系统
CN111010376B (zh) * 2019-11-28 2022-01-21 国网河南省电力公司信息通信公司 基于主从链的物联网认证系统及方法
CN111163084B (zh) * 2019-12-27 2021-11-09 清创网御(合肥)科技有限公司 一种基于动态选举和共识机制的安全存储方法
US11641364B2 (en) 2020-03-03 2023-05-02 International Business Machines Corporation Cross-domain state synchronization
CN111404896B (zh) * 2020-03-06 2022-03-04 杭州云象网络技术有限公司 一种基于sgx的非中心身份认证方法
CN111600845A (zh) * 2020-04-21 2020-08-28 上海上实龙创智慧能源科技股份有限公司 一种物联网数据访问控制方法及系统
CN111585985B (zh) * 2020-04-24 2022-07-12 广东职业技术学院 一种基于区块链的商业身份识别认证方法及系统
CN111585984B (zh) * 2020-04-24 2021-10-26 清华大学 面向分组全生存周期的去中心化安全保障方法及装置
CN111683101B (zh) * 2020-06-16 2021-01-22 铭数科技(青岛)有限公司 一种基于区块链的自主跨域访问控制方法
CN111917724B (zh) * 2020-06-29 2021-05-04 普瑞达建设有限公司 一种物联网应用安全控制方法及系统
CN112261155B (zh) * 2020-12-21 2021-03-16 哈尔滨工业大学(深圳)(哈尔滨工业大学深圳科技创新研究院) 一种基于联盟区块链具有动态共识的物联网访问控制方法
CN112733532B (zh) * 2021-01-15 2023-03-31 河北大学 IoT CapBAC规则语义中时间间隔粗糙性分析方法
CN113315634B (zh) * 2021-05-21 2022-04-08 广州大学 一种物联网的轻量访问控制方法、装置以及系统
CN114050932A (zh) * 2021-11-10 2022-02-15 安徽健坤通信股份有限公司 分布式系统的网络安全验证方法和系统
CN114338076B (zh) * 2021-11-11 2023-04-07 清华大学 适用于智能家居环境的分布式跨设备访问控制方法及装置
CN114500088B (zh) * 2022-02-23 2024-02-23 北京中科锐链科技有限公司 基于区块链和边缘计算的物联网设备接入认证方法、系统
CN115452046A (zh) * 2022-09-01 2022-12-09 康志文 一种基于物联网的环保监测系统及方法
CN115396537B (zh) * 2022-10-31 2023-01-13 深圳万物安全科技有限公司 物联网访问控制方法、装置、设备与介质
CN116055055B (zh) * 2022-11-29 2025-01-10 北京笔新互联网科技有限公司 跨域认证方法及系统
CN116015669B (zh) * 2022-12-02 2025-06-10 杭州电子科技大学 一种基于区块链的物联网跨域协同认证方法
CN116260592B (zh) * 2023-02-13 2025-05-20 重庆邮电大学 一种基于联盟区块链的天地一体化车联网的跨域认证方法
CN116155514B (zh) * 2023-03-01 2024-06-21 电子科技大学 一种基于区块链的跨域物联网设备隐私保护认证方法
CN116708397B (zh) * 2023-07-11 2026-05-01 昆明理工大学 一种基于联盟链与mqtt的物联网跨域认证系统及方法
CN118826997B (zh) * 2024-05-29 2025-12-09 中移物联网有限公司 基于区块链的双向认证方法、装置、设备、介质及产品
CN120639336B (zh) * 2025-05-16 2026-01-02 中科诺信集团有限公司 一种基于在线学习的物联网设备身份认证方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180225661A1 (en) * 2017-02-07 2018-08-09 Microsoft Technology Licensing, Llc Consortium blockchain network with verified blockchain and consensus protocols
US20180302222A1 (en) * 2017-04-18 2018-10-18 Samsung Electronics Co., Ltd. Method and apparatus for access control in distributed blockchain-based internet of things (iot) network
CN108964924A (zh) * 2018-07-24 2018-12-07 腾讯科技（深圳）有限公司 数字证书校验方法、装置、计算机设备和存储介质
CN109495516A (zh) * 2019-01-07 2019-03-19 国网江苏省电力有限公司无锡供电分公司 基于区块链的电力物联网终端接入方法
CN109981689A (zh) * 2019-04-29 2019-07-05 清华大学 物联网场景下跨域逻辑强隔离与安全访问控制方法及装置

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105701372B (zh) * 2015-12-18 2019-04-09 布比（北京）网络技术有限公司 一种区块链身份构建及验证方法
FR3049089B1 (fr) * 2016-03-21 2018-02-16 Sebastien Jean Serge Dupont Procede permettant de gerer les validations des messages relatifs a une chaine de messages de facon unitaire a travers un reseau de validation decentralise
US10164983B2 (en) * 2017-01-20 2018-12-25 Verizon Patent And Licensing Inc. Distributed authentication for internet-of-things resources
CN107424066B (zh) * 2017-07-19 2020-11-10 武汉凤链科技有限公司 一种基于价值量建立共识机制的方法及其系统
CN107360238A (zh) * 2017-07-25 2017-11-17 光载无限（北京）科技有限公司 基于区块链cpow共识算法的智能合约网关
US10924466B2 (en) * 2017-07-28 2021-02-16 SmartAxiom, Inc. System and method for IOT security
US10972463B2 (en) * 2018-06-06 2021-04-06 Cisco Technology, Inc. Blockchain-based NB-IoT devices
GB2577751A (en) * 2018-10-05 2020-04-08 Dragon Infosec Ltd A consensus method and framework for a blockchain system
CN109218981B (zh) * 2018-11-20 2019-06-21 太原理工大学 基于位置信号特征共识的Wi-Fi接入认证方法
CN109617929B (zh) * 2019-02-12 2021-07-13 浪潮通用软件有限公司 在区块链网络模式下的节点与用户交互认证方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180225661A1 (en) * 2017-02-07 2018-08-09 Microsoft Technology Licensing, Llc Consortium blockchain network with verified blockchain and consensus protocols
US20180302222A1 (en) * 2017-04-18 2018-10-18 Samsung Electronics Co., Ltd. Method and apparatus for access control in distributed blockchain-based internet of things (iot) network
CN108964924A (zh) * 2018-07-24 2018-12-07 腾讯科技（深圳）有限公司 数字证书校验方法、装置、计算机设备和存储介质
CN109495516A (zh) * 2019-01-07 2019-03-19 国网江苏省电力有限公司无锡供电分公司 基于区块链的电力物联网终端接入方法
CN109981689A (zh) * 2019-04-29 2019-07-05 清华大学 物联网场景下跨域逻辑强隔离与安全访问控制方法及装置

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112487443A (zh) * 2020-11-11 2021-03-12 昆明理工大学 一种基于区块链的能源数据细粒度访问控制方法
CN113935016A (zh) * 2021-11-03 2022-01-14 北京邮电大学 命名数据网中基于区块链的可信访问与跨域认证方法
CN114024749A (zh) * 2021-11-05 2022-02-08 西北工业大学 一种基于中心节点域间协同的工业设备逻辑跨域接入认证方法
CN114024749B (zh) * 2021-11-05 2022-11-29 西北工业大学 一种基于中心节点域间协同的工业设备逻辑跨域接入认证方法
CN114745137A (zh) * 2022-05-10 2022-07-12 山东鲁软数字科技有限公司 一种实现安全通信方法及区块链物联代理装置
CN116527300A (zh) * 2023-01-30 2023-08-01 东南大学 一种区块链辅助的物联网安全跨域授权与认证方法
CN116684103A (zh) * 2023-06-09 2023-09-01 山东省计算中心（国家超级计算济南中心） 一种基于区块链的跨域身份认证方法
CN117914558A (zh) * 2023-12-28 2024-04-19 天翼物联科技有限公司 物联网设备可信控制方法、系统、电子设备及存储介质

Also Published As

Publication number Publication date
US20210218740A1 (en) 2021-07-15
US11546330B2 (en) 2023-01-03
CN109981689A (zh) 2019-07-05
CN109981689B (zh) 2020-05-12

Similar Documents

Publication Publication Date Title
CN109981689B (zh) 物联网场景下跨域逻辑强隔离与安全访问控制方法及装置
CN108810073B (zh) 一种基于区块链的物联网多域访问控制系统及方法
TWI749061B (zh) 區塊鏈身份系統
CN102594823B (zh) 一种远程安全访问智能家居的可信系统
CN101697540B (zh) 一种p2p服务请求用户身份认证方法
CN102201915B (zh) 一种基于单点登录的终端认证方法和装置
CN108064440A (zh) 基于区块链的fido认证方法、装置及系统
CN112436940B (zh) 一种基于零知识证明的物联网设备可信启动管理方法
CN103747036A (zh) 一种桌面虚拟化环境下的可信安全增强方法
CN103517273A (zh) 认证方法、管理平台和物联网设备
CN108173827B (zh) 基于区块链思维的分布式sdn控制平面安全认证方法
CN115038084B (zh) 一种面向蜂窝基站的去中心化可信接入方法
CN113507370B (zh) 基于区块链的林业物联网设备授权认证访问控制方法
WO2025162387A1 (zh) 服务器、终端和安全系统
WO2026020572A1 (zh) 基于量子密码的spa单包认证方法及系统
CN115242546A (zh) 一种基于零信任架构的工业控制系统访问控制方法
WO2023093319A1 (zh) 基于区块链的账户重置方法和设备
CN113630255B (zh) 基于sram puf的轻量级双向认证方法及系统
CN110445809A (zh) 网络攻击检测方法、装置、系统、电子设备及存储介质
CN108632254B (zh) 一种基于私有链的智能家居环境的访问控制方法
Chen et al. A Blockchain-Based Cross-Domain Data Transmission Scheme for Industrial Internet of Things With Edge-Cloud Computing
CN118250054A (zh) 一种IoT设备的防重放攻击方法
CN103095451A (zh) 一种在传感器网络中进行认证的方法和传感器网络
CN116781337A (zh) 一种区域股权交易存证跨链共识方法及系统
CN117375871A (zh) 一种基于区块链和tee的物联网终端无证书认证方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19926969

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19926969

Country of ref document: EP

Kind code of ref document: A1