WO2023083007A1 - 物联网设备身份认证方法、装置、系统及存储介质 - Google Patents

物联网设备身份认证方法、装置、系统及存储介质 Download PDF

Info

Publication number
WO2023083007A1
WO2023083007A1 PCT/CN2022/127810 CN2022127810W WO2023083007A1 WO 2023083007 A1 WO2023083007 A1 WO 2023083007A1 CN 2022127810 W CN2022127810 W CN 2022127810W WO 2023083007 A1 WO2023083007 A1 WO 2023083007A1
Authority
WO
WIPO (PCT)
Prior art keywords
verification code
server device
verification
client device
identity authentication
Prior art date
Application number
PCT/CN2022/127810
Other languages
English (en)
French (fr)
Inventor
朱冠华
张清华
孙国玺
文成林
胡绍林
蔡业彬
荆晓远
黄权斯
甘梓润
Original Assignee
广东石油化工学院
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 广东石油化工学院 filed Critical 广东石油化工学院
Publication of WO2023083007A1 publication Critical patent/WO2023083007A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Definitions

  • the present invention relates to the technical field of the Internet of Things, in particular to a method, device, system and computer-readable storage medium for authenticating the identity of an Internet of Things device.
  • the Internet of Things refers to an intelligent service system that processes and responds to information in the physical and virtual world by connecting things, people, systems and information resources according to agreed protocols through IoT devices with perception and communication capabilities. .
  • IoT devices with perception and communication capabilities.
  • the deep integration of the Internet of Things and various industries has given birth to emerging application scenarios such as smart homes and smart cities.
  • the identity authentication of the device is the first step in the security of the entire Internet of Things
  • the identity authentication mechanism refers to a security mechanism for identifying and authenticating the identity of the device connected to the Internet of Things system before data interaction.
  • Smart card authentication is based on smart card identity authentication, which belongs to the mechanism of identity authentication through physical equipment, and its authentication data is static;
  • user name/password authentication is the simplest and most commonly used identity authentication method, which is based on " What you know” verification method, the password is static data;
  • dynamic password authentication is the basic authentication principle of dynamic password is that both sides use the same shared key to perform cryptographic algorithm calculation on time, and then compare whether the calculated value is consistent, so that Authentication;
  • digital certificate-based identity authentication is digital certificate identity authentication, a digital certificate authentication method based on the PKI (PublicKey Infrastructure, public key infrastructure) framework.
  • IoT devices Due to the limited computing power and storage resources of IoT devices, it is not possible to calculate overly complex algorithms in the IoT. If complex algorithms are used, the energy consumption and storage resources of IoT devices will be accelerated, or the decryption time will be too long; if a simple identity authentication encryption algorithm is not set or set, IoT devices will be easily cracked by attackers, thus Get user privacy data.
  • the openness of the mobile Internet has brought many security threats to the managed IoT devices, such as attackers using some devices to brute force crack the server, exhaustive attacks, etc.
  • IoT devices have limited computing power, which makes it impossible for IoT devices to load complex security measures. A large number of IoT devices are used in user-sensitive scenarios, and their data includes a large amount of user privacy. Once leaked, the consequences will be serious.
  • Embodiments of the present invention provide a method, device, system, and computer-readable storage medium for authenticating the identity of an Internet of Things device, so as to realize two-way authentication between interacting parties, reduce resource consumption of the Internet of Things device, and improve the security of the Internet of Things system.
  • an embodiment of the present invention provides an identity authentication method for an IoT device, which is executed by a client device, including:
  • the server device runs the second encryption algorithm in reverse, and decrypts the received third verification code to generate a fourth verification code, compare the fourth verification code with the first verification code, and when it is determined that the fourth verification code is consistent with the first verification code, the received encrypted data
  • the packet is decrypted to obtain device verification information, and when it is determined that the device verification information is consistent with the device-specific information of the client device, it is determined that the identity of the client device is correct.
  • the method also includes:
  • Receive the image verification code run the preset image generation algorithm in reverse to decrypt the image verification code, and obtain the first verification code; wherein, the image verification code is generated by the server device according to the image generation algorithm and The first verification code is generated and sent to the client device.
  • the reverse operation of the preset image generation algorithm to decrypt the image verification code to obtain the first verification code includes;
  • said generating a second verification code according to said first encryption algorithm includes:
  • the initial second verification code is processed according to the preset number of digits of the verification code to obtain the second verification code.
  • the method also includes:
  • the second verification code When it is determined for the first time that the second verification code is inconsistent with the first verification code, update the time period number to the time period number of the previous time, and return the information about the current time of the client device, the The step of calculating the time period number and the dynamic time interval to obtain an initial second verification code to obtain an updated second verification code;
  • encrypting the first verification code according to a preset second encryption algorithm to generate a third verification code includes:
  • the present invention provides an authentication device for an Internet of Things device, the device is set in a client device, including:
  • a request sending module configured to send identity authentication request information to the server device, so that the server device receives the identity authentication request information, generates a first verification code according to a preset first encryption algorithm, and sends the second a verification code is sent to the client device;
  • a first comparison module configured to receive the first verification code, generate a second verification code according to the first encryption algorithm, and compare the second verification code with the first verification code
  • a first judging module configured to determine that the identity of the server device is correct when it is judged that the second verification code is consistent with the first verification code
  • the first encryption module is configured to encrypt the first verification code according to a preset second encryption algorithm to generate a third verification code after determining that the identity of the server device is correct;
  • the first sending module is configured to send the third verification code and the pre-configured encrypted data packet to the server device, so that the server device reversely runs the second encryption algorithm, and performs the received
  • the third verification code is decrypted to generate a fourth verification code
  • the fourth verification code is compared with the first verification code, and when it is determined that the fourth verification code is consistent with the first verification code, the The received encrypted data packet is decrypted to obtain device verification information, and when it is determined that the device verification information is consistent with the device-specific information of the client device, it is determined that the identity of the client device is correct.
  • the present invention also provides a method for authenticating the identity of an Internet of Things device, which is executed by a server device, including:
  • the identity authentication request information is generated by the client device and sent to the server device;
  • the algorithm encrypts the first verification code to generate a third verification code, and sends the third verification code and a pre-configured encrypted data packet to the server device;
  • said generating a first verification code according to a preset first encryption algorithm includes:
  • the initial first verification code is processed according to the preset number of digits of the verification code to obtain the first verification code.
  • the method also includes:
  • said generating an image verification code according to a preset image generation algorithm and said first verification code includes:
  • the preset interference information is added to the initial image verification code to generate an image verification code.
  • the reverse operation of the second encryption algorithm to decrypt the third verification code to generate a fourth verification code includes:
  • the present invention also provides an IoT device identity authentication device, the device is set in the server device, including:
  • the second encryption module is configured to receive identity authentication request information, and generate a first verification code according to a preset first encryption algorithm; wherein, the identity authentication request information is generated by the client device and sent to the server device;
  • the second sending module is configured to send the first verification code to the client device, so that the client device generates a second verification code according to the first encryption algorithm, and combines the second verification code with the Comparing the received first verification code, when it is determined that the second verification code is consistent with the first verification code, it is determined that the identity of the server device is correct, and after determining that the identity of the server device is correct, Encrypting the first verification code according to a preset second encryption algorithm to generate a third verification code, and sending the third verification code and a pre-configured encrypted data packet to the server device;
  • a first receiving module configured to receive the encrypted data packet and the third verification code
  • the second comparison module is configured to reversely run the second encryption algorithm, decrypt the third verification code to generate a fourth verification code, and compare the fourth verification code with the first verification code;
  • a first decryption module configured to decrypt the encrypted data packet to obtain device verification information when it is determined that the fourth verification code is consistent with the first verification code
  • the second judging module is configured to determine that the identity of the client device is correct when it is judged that the device verification information is consistent with the device-specific information of the client device.
  • the present invention also provides an IoT device identity authentication system, including a client device and a server device, the client device communicates with the server device, and the client device is used to perform the following steps:
  • the server device is configured to execute the IoT device identity authentication method described in any one of the third aspect.
  • the present invention also provides a computer-readable storage medium, the computer-readable storage medium includes a stored computer program, wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute The IoT device identity authentication method described in any one of the first aspect or the IoT device identity authentication method described in any one of the third aspect.
  • the client device will perform identity authentication on the server device, and after confirming that the identity of the server device is correct, send the processed third verification code and encrypted data packet to the server device, and then the server device will The client device performs identity authentication, thereby realizing two-way authentication between the two sides of the interaction.
  • it does not need to be decrypted multiple times, does not involve multiple recursive iterations and public-private keys, etc., has the advantages of less resource occupation and fast authentication speed, and is suitable for devices with low computer technical capabilities and storage resources.
  • Fig. 1 is a schematic flow chart of a preferred embodiment of an identity authentication method for an Internet of Things device provided by the present invention
  • FIG. 2 is a schematic structural diagram of a preferred embodiment of an identity authentication method for an Internet of Things device provided by the present invention
  • Fig. 3 is a schematic flow diagram of another preferred embodiment of an IoT device identity authentication method provided by the present invention.
  • Fig. 4 is a schematic structural diagram of another preferred embodiment of an IoT device identity authentication method provided by the present invention.
  • the first embodiment of the present invention provides a method for authenticating the identity of an Internet of Things device, including the following steps S11-S15:
  • the client device in the IoT device needs to be registered.
  • the registration process three aspects are involved: the system administrator, the server device and the user.
  • the user applies for registration to the server device, and submits his mobile phone number and password information, and the system administrator verifies whether the user is his own user, and if so, registers through the user's application and sets certain operations for the user Permissions, such as adding permissions to delete devices, modify device information, and modify device account passwords, etc.
  • the user login is performed in the server device, and a client device registration application is initiated after the login is successful.
  • the server device returns a device-specific information submission interface according to the received client device registration application information, and the user enters the device-specific information of the client device on this interface, and sends the device-specific information to the server device.
  • the device-specific information includes the independent IP address, machine code, account number, password and other information of the client device.
  • the server device generates a dedicated data packet corresponding to the client device according to the received device-specific information, encrypts the dedicated data packet with a preset proprietary encryption algorithm to generate an encrypted data packet, and sends the encrypted data packet to the client device.
  • the client device preconfigures and stores the encrypted data package to the specified location.
  • the exclusive encryption algorithm is agreed and configured by both parties in advance, for example, a data encryption algorithm (Data Encryption Algorithm, DEA) can be used, which is not limited in the present invention.
  • the server device can also generate a device-specific program based on the device-specific information, and send the program to the client device.
  • the present invention generates a device-specific program based on the exclusive information of the client device when the client device applies for registration, which can resist forgery attacks, identity forgery attacks, man-in-the-middle attacks, etc. Improves the security of the IoT device identity authentication system.
  • the user can also install the device-specific program sent by the server device into the client device according to the encrypted data package.
  • the device After the device installs the program successfully, it starts to run the program, and stores the account information and password information.
  • the client device can also send the program installation success and account and password information to the server device.
  • the server device After receiving the information, the server device determines that the device registration is successful. After the program is successfully installed and the account password information is successfully stored, the client device executes step S11 to send identity authentication request information to the server device.
  • step S11 the client device sends identity authentication request information to the server device.
  • the server device receives the identity authentication request information, generates a first verification code according to a preset first encryption algorithm, and sends the first verification code to the client device.
  • the input data of the first encryption algorithm is dynamic and changes according to time.
  • a dedicated encryption method based on time synchronization verification is used to generate the first verification code based on the current time of the server device.
  • step S12 the client device receives the first verification code, generates a second verification code according to the first encryption algorithm, and compares the second verification code with the first verification code.
  • the input data of the first encryption algorithm is dynamic and changes according to time. For example, a dedicated encryption method based on time synchronization verification is used to generate a second verification code based on the current time of the client device.
  • steps S13 and S14 when the client device determines that the second verification code is consistent with the first verification code, it is determined that the identity of the server device is correct.
  • the first verification code is encrypted according to a preset second encryption algorithm to generate a third verification code.
  • a preset encryption number is added to the first verification code to generate a third verification code.
  • the preset encryption number may be a relatively large number.
  • step S15 the third verification code and the pre-configured encrypted data packet are sent to the server device.
  • the third verification code may be combined with an encrypted data packet to generate a character string, and sent to the server device for comparison and authentication.
  • all verification code information cached on the client device is deleted to prevent it from being stolen by others.
  • the server device reversely runs the second encryption algorithm, decrypts the received third verification code to generate a fourth verification code, and compares the fourth verification code with the first verification code .
  • the preset dedicated encryption algorithm is reversely run to decrypt the received encrypted data packet to obtain device verification information.
  • the device verification information is consistent with the device-specific information, which can be set in advance by both parties in the interaction, including the independent IP address, machine code, account number, password and other information of the client device.
  • the device verification information is consistent with the device-specific information, which can be set in advance by both parties in the interaction, including the independent IP address, machine code, account number, password and other information of the client device.
  • the server device receives the character string sent by the client device, deletes the encrypted number from the third verification code, and generates a fourth verification code.
  • the server device compares the decrypted fourth verification code with the first verification code, and when it is determined that the fourth verification code is consistent with the first verification code, it means that the comparison is correct.
  • the encrypted data packet behind the string is decrypted with a proprietary encryption algorithm, thereby reading the device verification information, which includes the device account number and password. It should be noted that, if it is determined that the fourth verification code is inconsistent with the first verification code, the server device will not decrypt the encrypted data packet, and will not obtain account and password information.
  • the device verification information when it is determined that the device verification information is consistent with the device-specific information, it is determined that the identity of the client device is correct, and authentication passing information is sent to the client device. When it is determined that the device verification information is inconsistent with the device-specific information, it means that the account and password verification fails, and a password error message is sent to the client device.
  • the server device generates a first verification code according to a preset first encryption algorithm, including the following steps S21-S23:
  • step S21 a time period number needs to be generated according to the preset dynamic time interval and the acquired current time of the server device. Specifically, the server device first obtains the current time, that is, the year, month, day, hour, minute, and second, and then performs calculations on the minutes and seconds in the current time.
  • the formula is as follows:
  • A means that the server device obtains the number of minutes in the current time
  • B represents the number of seconds in the current time obtained by the server device
  • T is the dynamic time interval
  • J represents the time period number "XX"
  • the time period number only takes Integer, no remainder.
  • the dynamic time interval T is a dynamic number.
  • the range of the dynamic time interval T is set by the administrator during the update process.
  • the server device randomly selects a number within this range every day as the dynamic time interval T of the day.
  • step S22 it is necessary to calculate the current time of the server device, the time period number and the dynamic time interval to obtain an initial first verification code.
  • the server device will obtain the value of the year, month, day, and hour in the current time for calculation, and the formula is as follows:
  • C represents the year, day, month and time obtained in the current time, that is, "YYYYMMDDHH”
  • F represents the quotient of the operation of the above formula (2)
  • G represents the remainder of the operation of the above formula (2).
  • the initial first verification code such as "519560212138" is obtained after combining F, G, and J.
  • step S23 the initial first verification code is processed according to the preset number of digits of the verification code to obtain the first verification code.
  • the initial first verification code obtained after step S22 is "519560212138".
  • the length of the final verification code will be inconsistent. Sometimes it will be several digits longer, and sometimes it will be several digits shorter.
  • the number of digits of the verification code can be configured according to the needs of the user, which is not limited in the present invention.
  • FGJ is combined to generate the first verification code based on the current time for 51921238.
  • the first encryption algorithm is a method for generating verification codes based on time synchronization
  • the generated verification information is dynamic information rather than static information.
  • this method can effectively prevent snooping, dictionary attack, exhaustion attempt, network data stream eavesdropping, replay attack and so on.
  • the dynamic time T of the present invention can be modified, and the server selects a value in the setting range every day as the agreed time rule of the day.
  • the delay strategy does not need to be pushed forward for several time periods for decryption, but only needs to be pushed forward for one time period for decryption, so it can resist guessing attacks, save power consumption of IoT devices, and improve the effectiveness of the identity authentication process ,safety.
  • step S12 the client device generates a second verification code according to the first encryption algorithm, including the following steps:
  • the initial second verification code is processed according to the preset number of digits of the verification code to obtain the second verification code.
  • the method also includes:
  • the server device generates an image verification code according to a preset image generation algorithm and the first verification code, and sends the image verification code to the client device, so that the client device reversely runs the image An algorithm is generated to decrypt the received image verification code to obtain the first verification code.
  • the server device generates an image verification code according to a preset image generation algorithm and the first verification code, including the following steps S31-S34:
  • step S31 the first verification code needs to be converted into an initial binary value.
  • First read the information in the first verification code, convert the first verification code into an initial binary value, represented by P bytes, and a byte has 8 bits.
  • step S32 a bitwise loop operation is performed on the initial binary value to obtain a binary value. For example, the first byte of the initial binary value is rotated to the left by two bits, the second byte is rotated to the right by four bits, and so on.
  • the first verification code is "51921238" for description. After 51921238 is converted into a binary number, it is 11000110000100000101010110, a total of 26 bits, and the previous completion is changed to 4 bytes, that is, 32 bits, which is 00000011000110000100000101010110.
  • Byte sorting starts from right to left, shift the first byte 01010110 to the left by five bits, the second byte 01000001 to the right by four bits, the third byte 00011000 to the right by two bits, and the fourth byte 00000011 to the right Shift one bit, after shifting, they are 11001010, 00010100, 00000110, 10000001 respectively, and the final binary value is 10000001000001100001010011001010.
  • step S33 the binary value is written into the image data preconfigured by the server device to generate an initial image verification code.
  • a certain number of background pictures are pre-stored or randomly generated in the server device in this embodiment. These pictures can be black and white pictures, grayscale pictures, color pictures, etc., and the graphics in the pictures can be Symbols, numbers, objects, etc.
  • the background picture stored in the server device or randomly generated is firstly read, and then the binary value is represented by the values of K points in the background picture.
  • the range of K points in the picture is obtained by random and non-repetitive extraction from the picture range every day by the server device.
  • the preset interference information is added to the initial image verification code to generate an image verification code.
  • the interference information may include L noises.
  • K value required by different image types is different.
  • the method also includes:
  • the client device receives the image verification code, reversely runs the preset image generation algorithm to decrypt the image verification code, and obtains the first verification code; wherein, the image verification code is generated by the server device according to the image A generation algorithm and the first verification code are generated and sent to the client device.
  • the reverse operation of the preset image generation algorithm to decrypt the image verification code to obtain the first verification code includes the following steps S41-S43;
  • steps S41-S43 are a process of running the image generation algorithm in reverse, and its operation rules are opposite to those of steps S31-S34.
  • the positions of the K points after the transformation of the picture are randomly selected, and the order of writing the binary values is also different, and an error in reading the order will also cause a decryption error. Therefore, to read the picture decryption rules in the module storing the rules of the client device, it is necessary to read some points in the image verification code and delete the preset interference information.
  • the read value is a decimal number
  • the binary value is operated according to the reverse left and right circular shift of step S32, and then correspondingly combined with K bytes to obtain the initial binary value. Finally, the initial binary value is converted into a decimal number to obtain the first verification code.
  • K1 is the first byte information
  • K2 is the second byte information
  • K3 is the third byte information
  • K4 is the fourth byte information.
  • the RGB color picture reads a decimal value of 0-255, which needs to be converted into a binary number, and the K bytes are reversely shifted left and right.
  • step S32 If the first byte in step S32 is shifted to the left by five bits, You only need to move the corresponding number of bits in reverse to get the original byte information, that is, right-shift the first byte by five bits, and so on for the remaining bytes.
  • the K bytes are sorted and combined in descending order, that is, K4, K3, K2, and K1 are sorted from large to small.
  • the sorted and combined numbers are the initial binary values, and then converted into decimal numbers to obtain the first verification code.
  • the randomly generated background picture is modified, the interaction parties agree on the rules, and the client device directly reads the authentication information from the picture.
  • the dynamic password authentication method it does not need to be decrypted multiple times, involves multiple recursive iterations, public and private keys, etc., and can achieve the advantages of less resource consumption and fast authentication speed, and is suitable for devices with low computer technical capabilities and storage resources.
  • the verification code image is generated by modifying the background image and writing the encoded information, people mistakenly think that the numbers, objects, and character information in the verification code image are identity authentication information, so that attackers cannot use guessing attacks.
  • the method also includes the following steps S51-S52:
  • the client device may be just at the dynamic time interval node, that is, at the end of this time period and the beginning of the next time period. The time obtained at this time will change.
  • the client device receives the picture verification code, the time jumps to the next time period number, and finally the decrypted second verification code is wrong.
  • the time period number calculated by the formula (1) is 02, and decrypt the picture verification code sent by the server device to obtain the first verification code.
  • the time period number is 01, which leads to an identity authentication error, which makes the client device mistakenly think that the server device is a fake identity. This kind of practice is not allowed. In this case, the above steps S51-S52 need to be performed.
  • step S51 when it is determined for the first time that the second verification code is inconsistent with the first verification code, update the time period number to the time period number of the previous time, and return the The step of calculating the current time, the time period number and the dynamic time interval to obtain an initial second verification code to obtain an updated second verification code.
  • the client device will move the current time period number forward by one time period number for the second time, for example, when the current time period number is 02 and the verification comparison fails, the time period number will be moved forward by one time period number , which is 01, and then verify and compare, which is the content of step S52. If the comparison is correct, continue to perform the correct identity authentication process; if the verification comparison fails, it is determined that the server device is a counterfeit server device, and the information of the server device will not be received in the future.
  • the devices in the Internet of Things can also be updated.
  • the content that the administrator can update is as follows:
  • the content of the server device update is as follows:
  • the content of the client device update is as follows:
  • the content of the user update is as follows:
  • the user can modify the password filled in during registration in the server device
  • the user can modify the password information of the client device in the server device, but cannot modify the account information of the client device.
  • the modified information will be sent from the server device to the client device.
  • Smart card authentication Identity authentication based on smart cards belongs to the mechanism of identity authentication through physical devices. Each user holds a smart card, and the smart card stores the user's secret information, and at the same time, the secret information is also stored in the verification server. When performing authentication, the user enters a PIN code (Personal Identification Number, personal identity authentication code), and the server authenticates the PIN code. After the PIN code is successfully authenticated, the secret information in the smart card can be read out, and then the secret information is used for authentication with the host.
  • the smart card-based authentication method is a two-factor authentication method (PIN+smart card). Even if the PIN code or the smart card is stolen separately, the identity of the legitimate user will not be impersonated (that is, access rights cannot be obtained).
  • Username/password authentication is the simplest and most commonly used identity authentication method, based on "what you know" verification method. Each user's password is set by the user himself, only the user himself knows. As long as the user can enter the password correctly, the computer considers the operator to be a legitimate user.
  • Dynamic password authentication The basic authentication principle of dynamic password is that the authentication parties use the same shared key to perform cryptographic algorithm calculation on the time, and then compare whether the calculated values are consistent, so as to perform authentication.
  • TOTP algorithm Time-based One-time Password algorithm, time-based one-time password algorithm.
  • TOTP is an example of a Hash-based Message Authentication Code (HMAC), which uses a cryptographic hash function to combine a secret key with the current timestamp to generate a one-time password. Timestamps are typically incremented at 30-second intervals due to network delays and out-of-sync clocks that can cause the password recipient to have to try a range of possible times to authenticate.
  • HMAC Hash-based Message Authentication Code
  • digital certificate authentication is a digital certificate authentication method based on PKI (PublicKey Infrastructure, public key infrastructure) framework.
  • Digital certificates are a set of data structures containing user identity information (keys) issued by a trusted third-party certification body.
  • the PKI system builds a complete set of processes by using encryption algorithms. The protection of input certificate files is required for identity authentication. password.
  • Smart card authentication Since the data read from the smart card is static each time, it is easy to intercept the user's identity verification information through technologies such as memory scanning or network monitoring, and a smart card needs to be added to the device. Smart cards are easy to guess and are vulnerable to attacks, such as snooping, dictionary attacks, exhaustive attempts, network data stream eavesdropping, and replay attacks.
  • Dynamic password authentication the password generation algorithm of the client and server uses pseudo-random sequence generator technology, once the algorithm is cracked, it will cause continuous leakage. If the time or times of the client and the server cannot be well synchronized, the problem that legitimate users cannot log in may occur. For example, within the same hash validity period, the result of dynamic password generation is the same, but due to network reasons, there may be a large gap between the time when the client generates the password and the time when the server accepts the password, resulting in two passwords Not within the same hash validity period, so the authentication fails. At this time, it is necessary to verify that the system has a delay strategy, which allows verification of dynamic passwords with the length of validity of the previous hashes.
  • the IoT devices will be decrypted multiple times, and the TOTP protocol involves multiple recursive iterations and public and private keys, resulting in excessive resource consumption, and the computing resources and energy supply in the IoT scenario are very limited , unable to provide sufficient resources and energy support.
  • the third type of identity authentication method generates a series of long and irregular passwords, and requires the user to input. Once the input is wrong, it needs to be re-operated. It may need to be decrypted multiple times, involving multiple recursive iterations and public and private keys, resulting in resource consumption. is too big.
  • the fourth type of method needs to introduce a third-party organization. The third-party organization issues a digital certificate to the device, and the certificate has a certain period of time, which is more troublesome to use in the IoT device.
  • the client device will perform identity authentication on the server device, and after confirming that the identity of the server device is correct, send the processed third verification code and encrypted data packet to the server device, and then the server device will The client device performs identity authentication, thereby realizing two-way authentication between the two sides of the interaction.
  • it does not need to be decrypted multiple times, does not involve multiple recursive iterations and public-private keys, etc., has the advantages of less resource occupation and fast authentication speed, and is suitable for devices with low computer technical capabilities and storage resources.
  • the second embodiment of the present invention provides an IoT device identity authentication device, the device is set in the client device, including:
  • a request sending module configured to send identity authentication request information to the server device, so that the server device receives the identity authentication request information, generates a first verification code according to a preset first encryption algorithm, and sends the second a verification code is sent to the client device;
  • a first comparison module configured to receive the first verification code, generate a second verification code according to the first encryption algorithm, and compare the second verification code with the first verification code
  • a first judging module configured to determine that the identity of the server device is correct when it is judged that the second verification code is consistent with the first verification code
  • the first encryption module is configured to encrypt the first verification code according to a preset second encryption algorithm to generate a third verification code after determining that the identity of the server device is correct;
  • the first sending module is configured to send the third verification code and the pre-configured encrypted data packet to the server device, so that the server device reversely runs the second encryption algorithm, and performs the received
  • the third verification code is decrypted to generate a fourth verification code
  • the fourth verification code is compared with the first verification code, and when it is determined that the fourth verification code is consistent with the first verification code, the The received encrypted data packet is decrypted to obtain device verification information, and when it is determined that the device verification information is consistent with the device-specific information of the client device, it is determined that the identity of the client device is correct.
  • the device also includes:
  • An image receiving module configured to receive an image verification code, run a preset image generation algorithm in reverse to decrypt the image verification code, and obtain the first verification code; wherein, the image verification code is determined by the server device according to The image generation algorithm and the first verification code are generated and sent to the client device.
  • the image receiving module is also used for:
  • the device also includes:
  • the update comparison module is used to update the time period number to the time period number of the previous time when it is determined that the second verification code is inconsistent with the first verification code for the first time, and return the pair to the client.
  • the first encryption module includes:
  • the first encryption unit is configured to add a preset encryption number to the first verification code to generate a third verification code.
  • the client device will perform identity authentication on the server device, and after confirming that the identity of the server device is correct, send the processed third verification code and encrypted data packet to the server device, and then the server device will The client device performs identity authentication, thereby realizing two-way authentication between the two sides of the interaction.
  • it does not need to be decrypted multiple times, does not involve multiple recursive iterations and public-private keys, etc., has the advantages of less resource occupation and fast authentication speed, and is suitable for devices with low computer technical capabilities and storage resources.
  • the third embodiment of the present invention provides a method for authenticating the identity of an Internet of Things device, including the following steps S61-S66:
  • S61 Receive identity authentication request information, and generate a first verification code according to a preset first encryption algorithm; wherein, the identity authentication request information is generated by the client device and sent to the server device;
  • the client device in the IoT device needs to be registered.
  • the user registration is successful, the user login is performed in the server device, and a client device registration application is initiated after the login is successful.
  • the server device returns a device-specific information submission interface according to the received client device registration application information, and the user enters the device-specific information of the client device on this interface, such as the independent IP address of the device, machine code, etc., and sends the device Exclusive information is sent to the server device.
  • the server device receives the device-specific information sent by the client device and generates a dedicated data packet, encrypts the dedicated data packet using a preset proprietary encryption algorithm, and generates an encrypted data packet.
  • the server device sends the encrypted data packet to the client device, and the client device receives the encrypted data packet, preconfigures and stores the encrypted data packet in a designated location.
  • the exclusive encryption algorithm is agreed and configured by both parties in advance, for example, a data encryption algorithm (Data Encryption Algorithm, DEA) can be used, which is not limited in the present invention.
  • the server device can also generate a device-specific program based on the device-specific information, and send the program to the client device.
  • step S61 the client device sends identity authentication request information to the server device.
  • the server device receives the identity authentication request information, and generates a first verification code according to a preset first encryption algorithm. The specific process has been described in steps S21-S23, and will not be repeated here.
  • step S62 the first verification code is sent to the client device, the client device generates a second verification code according to the first encryption algorithm, and combines the second verification code with the received first verification code A verification code is compared, and when it is determined that the second verification code is consistent with the first verification code, it is determined that the identity of the server device is correct, and after determining that the identity of the server device is correct, according to the preset second verification code An encryption algorithm encrypts the first verification code to generate a third verification code, and sends the third verification code and a pre-configured encrypted data packet to the server device.
  • step S63 the server device receives the encrypted data packet and the third verification code.
  • step S64 run the second encryption algorithm in reverse, decrypt the third verification code to generate a fourth verification code, and compare the fourth verification code with the first verification code.
  • the server device receives the character string sent by the client device, deletes the encrypted number from the third verification code, and generates a fourth verification code.
  • step S65 the server device compares the decrypted fourth verification code with the first verification code, and when it is determined that the fourth verification code is consistent with the first verification code, it means that the comparison is correct.
  • step S66 the server device decrypts the encrypted data packet behind the character string to read the device verification information, which includes the device account number and password. It should be noted that, if it is determined that the fourth verification code is inconsistent with the first verification code, the server device will not decrypt the encrypted data packet, and will not obtain account and password information.
  • the device verification information when it is determined that the device verification information is consistent with the device-specific information, it is determined that the identity of the client device is correct, and authentication passing information is sent to the client device. When it is determined that the device verification information is inconsistent with the device-specific information, it means that the account and password verification fails, and a password error message is sent to the client device.
  • the client device will perform identity authentication on the server device, and after confirming that the identity of the server device is correct, send the processed third verification code and encrypted data packet to the server device, and then the server device will The client device performs identity authentication, thereby realizing two-way authentication between the two sides of the interaction.
  • it does not need to be decrypted multiple times, does not involve multiple recursive iterations and public-private keys, etc., has the advantages of less resource occupation and fast authentication speed, and is suitable for devices with low computer technical capabilities and storage resources.
  • the fourth embodiment of the present invention provides an IoT device identity authentication device, the device is set in the server device, including:
  • the second encryption module is configured to receive identity authentication request information, and generate a first verification code according to a preset first encryption algorithm; wherein, the identity authentication request information is generated by the client device and sent to the server device;
  • the second sending module is configured to send the first verification code to the client device, so that the client device generates a second verification code according to the first encryption algorithm, and combines the second verification code with the Comparing the received first verification code, when it is determined that the second verification code is consistent with the first verification code, it is determined that the identity of the server device is correct, and after determining that the identity of the server device is correct, Encrypting the first verification code according to a preset second encryption algorithm to generate a third verification code, and sending the third verification code and a pre-configured encrypted data packet to the server device;
  • a first receiving module configured to receive the encrypted data packet and the third verification code
  • the second comparison module is configured to reversely run the second encryption algorithm, decrypt the third verification code to generate a fourth verification code, and compare the fourth verification code with the first verification code;
  • a first decryption module configured to decrypt the encrypted data packet to obtain device verification information when it is determined that the fourth verification code is consistent with the first verification code
  • the second judging module is configured to determine that the identity of the client device is correct when it is judged that the device verification information is consistent with the device-specific information of the client device.
  • the second encryption module includes:
  • a time acquisition unit configured to generate a time period number according to the preset dynamic time interval and the acquired current time of the server device
  • An initial first verification code generation unit configured to calculate the current time of the server device, the time period number and the dynamic time interval to obtain an initial first verification code
  • the first verification code generating unit is configured to process the initial first verification code according to a preset number of verification code digits to obtain the first verification code.
  • the device also includes:
  • An image verification code generation module configured to generate an image verification code according to a preset image generation algorithm and the first verification code, and send the image verification code to the client device, so that the client device can return Running the image generation algorithm to decrypt the received image verification code to obtain the first verification code.
  • the image verification code generation module includes:
  • a base conversion unit configured to convert the first verification code into an initial binary value
  • a cyclic operation unit configured to perform a bitwise cyclic operation on the initial binary value to obtain a binary value
  • An initial image verification code generating unit configured to write the binary value into the image data preconfigured by the server device to generate an initial image verification code
  • An image verification code generating unit configured to add preset interference information to the initial image verification code to generate an image verification code.
  • the second comparison module includes:
  • the fourth verification code generating unit is configured to delete the preset encrypted number from the third verification code to generate a fourth verification code.
  • the client device will perform identity authentication on the server device, and after confirming that the identity of the server device is correct, send the processed third verification code and encrypted data packet to the server device, and then the server device will The client device performs identity authentication, thereby realizing two-way authentication between the two sides of the interaction.
  • it does not need to be decrypted multiple times, does not involve multiple recursive iterations and public-private keys, etc., has the advantages of less resource occupation and fast authentication speed, and is suitable for devices with low computer technical capabilities and storage resources.
  • the fifth embodiment of the present invention provides an IoT device identity authentication system, including a client device and a server device, the client device communicates with the server device, and the client device is used to perform the following steps: An IoT device identity authentication method according to any one of the embodiments, the server device is configured to execute the IoT device identity authentication method according to any one of the third embodiment.
  • the server device in the identity authentication process, generally the server device generates a picture verification code and sends it to the client device for identity authentication processing.
  • the identities of the server device and the client device can be interchanged, that is, the client device generates a picture verification code and sends it to the server device for identity authentication processing.
  • a sixth embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein the computer-readable storage medium is controlled when the computer program is running.
  • the device where it is located executes the IoT device identity authentication method described in any one of the first embodiment or the IoT device identity authentication method described in any one of the third embodiment.
  • the present invention provides a method, device, system, and computer-readable storage medium for identity authentication of an Internet of Things device.
  • the client device will perform identity authentication on the server device, and after confirming that the identity of the server device is correct, send the processed
  • the third verification code and the encrypted data packet are sent to the server device, and the server device then authenticates the client device, thereby realizing two-way authentication between the two sides of the interaction.
  • it does not need to be decrypted multiple times, does not involve multiple recursive iterations and public-private keys, etc., has the advantages of less resource occupation and fast authentication speed, and is suitable for devices with low computer technical capabilities and storage resources.
  • the computer program may be divided into one or more modules/units, and the one or more modules/units are stored in the memory and executed by the processor to complete the present invention.
  • the one or more modules/units may be a series of computer program instruction segments capable of accomplishing specific functions, and the instruction segments are used to describe the execution process of the computer program in the client device or the server device.
  • the so-called processor can be a central processing unit (Central Processing Unit, CPU), and can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), off-the-shelf Programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • the general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc., the processor is the control center of the client device or the server device, using various interfaces and lines to connect the entire Each part of the client device or the server device.
  • the memory can be used to store the computer programs and/or modules, and the processor realizes the client by running or executing the computer programs and/or modules stored in the memory and calling the data stored in the memory.
  • the memory may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, at least one application program required by a function (such as a sound playback function, an image playback function, etc.) and the like; the storage data area may store Data created based on the use of the mobile phone (such as audio data, phonebook, etc.), etc.
  • the memory can include high-speed random access memory, and can also include non-volatile memory, such as hard disk, internal memory, plug-in hard disk, smart memory card (Smart Media Card, SMC), secure digital (Secure Digital, SD) card , flash card (Flash Card), at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device.
  • non-volatile memory such as hard disk, internal memory, plug-in hard disk, smart memory card (Smart Media Card, SMC), secure digital (Secure Digital, SD) card , flash card (Flash Card), at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device.
  • the integrated modules/units of the client device or the server device are realized in the form of software function units and sold or used as independent products, they may be stored in a computer-readable storage medium.
  • the present invention realizes all or part of the processes in the methods of the above embodiments, and can also be completed by instructing related hardware through a computer program.
  • the computer program can be stored in a computer-readable storage medium, and the computer When the program is executed by the processor, the steps in the above-mentioned various method embodiments can be realized.
  • the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file or some intermediate form.
  • the computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a removable hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM, Read-Only Memory) , Random Access Memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium, etc.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • electrical carrier signal telecommunication signal and software distribution medium, etc.
  • the device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physically separated.
  • a unit can be located in one place, or it can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • the connection relationship between the modules indicates that they have a communication connection, which can be specifically implemented as one or more communication buses or signal lines. It can be understood and implemented by those skilled in the art without creative effort.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明公开了一种物联网设备身份认证方法、装置、系统及存储介质，方法包括:发送身份认证请求，以使服务端设备生成第一验证码；接收第一验证码并生成第二验证码，当判定第二验证码与第一验证码一致时，确定服务端设备身份正确；对第一验证码进行加密，生成第三验证码；将第三验证码和预先配置的加密数据包发送至服务端设备，以使服务端设备对第三验证码解密生成第四验证码，当判定第四验证码与第一验证码一致时，对加密数据包进行解密得到设备验证信息，当判定设备验证信息与客户端设备的设备专属信息一致时，确定客户端设备身份正确。本方法能实现交互双方的双向认证，提高物联网系统的安全性。

Description

物联网设备身份认证方法、装置、系统及存储介质 技术领域
本发明涉及物联网技术领域，尤其涉及一种物联网设备身份认证方法、装置、系统及计算机可读存储介质。
背景技术
物联网是指通过具有感知和通信能力的物联网设备，按照约定的协议将物、人、系统和信息资源连接起来，以实现对物理和虚拟世界的信息进行处理并做出反应的智能服务系统。现如今物联网与各个行业深度融合，催生了智能家居、智能城市等等新兴应用场景。随着物联网的快速发展，大量的物联网设备托管在移动互联网的服务器上进行管理，物联网设备面临的安全和隐私挑战也越来越大。其中，对设备的身份认证是整个物联网安全的第一步，身份认证机制是指在进行数据交互前，对接入物联网系统的设备身份进行识别鉴定的一种安全机制。
目前，物联网系统中常用的身份认证方式主要有4种，分别为智能卡认证、用户名/密码方式认证、动态口令认证和基于数字证书的身份认证。智能卡认证是基于智能卡的身份认证属于通过物理设备进行身份认证的机制，其认证数据是静态的；用户名/密码方式认证是用户名/密码是最简单也是最常用的身份认证方法，是基于“what you know”的验证手段，其中的密码是静态的数据；动态口令认证是动态口令的基本认证原理是认证双方使用同一个共享密钥对时间进行密码算法计算，然后比较计算值是否一致，从而进行认证；基于数字证书的身份认证是数字证书身份认证，基于PKI(PublicKey Infrastructure，公钥基础设施)构架的数字证书认证方式。
由于物联网设备的计算能力和储存资源都有限，不能在物联网中运算过于复杂的算法。若使用复杂的算法会导致物联网设备耗能和储存资源加速消耗，或者解密时间过长；若不设置或设置简单的身份认证加密算法，会使物联网设备很容易被攻击者破解成功，从而得到用户隐私数据。而移动互联网的开放性给被托管的物联网设备带来诸多安全威胁，例如攻击者用一些设备对服务器进行暴力破解、穷举攻击等。此外，物联网设备运算能力有限，导致物联网设备无法加载复杂的安全措施。而大量的物联网设备用于用户敏感场景，其数据包括大量用户隐私，一旦泄露后果很严重。
综上，在身份认证过程中，常用的身份认证方式有些采用静态信息或增加智能卡，有些认证过程繁琐，导致资源消耗过大，均不能满足物联网系统的安全性的需求。
发明内容
本发明实施例提供了一种物联网设备身份认证方法、装置、系统及计算机可读存储介质，以实现交互双方的双向认证，减少物联网设备的资源消耗，提高物联网系统的安全性。
第一方面，为了解决上述技术问题，本发明实施例提供了一种物联网设备身份认证方法，由客户端设备执行，包括：
发送身份认证请求信息至服务端设备，以使所述服务端设备接收所述身份认证请求信息，根据预设的第一加密算法生成第一验证码，并将所述第一验证码发送至所述客户端设备；
接收所述第一验证码，并根据所述第一加密算法生成第二验证码，将所述第二验证码与所述第一验证码进行对比；
当判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确；
在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密，生成第三验证码；
将所述第三验证码和预先配置的加密数据包发送至所述服务端设备，以使所述服务端设备反向运行所述第二加密算法，对接收到的所述第三验证码解密以生成第四验证码，将所述第四验证码与所述第一验证码进行对比，当判定所述第四验证码与所述第一验证码一致时，对接收到的所述加密数据包进行解 密得到设备验证信息，当判定所述设备验证信息与所述客户端设备的设备专属信息一致时，确定所述客户端设备身份正确。
优选地，所述方法还包括：
接收图像验证码，反向运行预设的图像生成算法对所述图像验证码解密，得到所述第一验证码；其中，所述图像验证码由所述服务端设备根据所述图像生成算法和所述第一验证码生成，并发送至所述客户端设备。
优选地，所述反向运行预设的图像生成算法对所述图像验证码解密，得到所述第一验证码，包括；
对所述图像验证码进行信息读取，并删除预设的干扰信息，得到十进制数值；
将所述十进制数值转换为二进制数值，并对所述二进制数值进行反向按位循环运算，得到初始二进制数值；
将所述初始二进制数值进行十进制转换，得到所述第一验证码。
优选地，所述根据所述第一加密算法生成第二验证码，包括：
根据预设的动态时间间隔和获取到的客户端设备当前时间，生成时间段编号；
对所述客户端设备当前时间、所述时间段编号和所述动态时间间隔进行计算，得到初始第二验证码；
根据预设的验证码位数对所述初始第二验证码进行处理，得到所述第二验证码。
优选地，所述方法还包括：
当首次判定所述第二验证码与所述第一验证码不一致时，将所述时间段编号更新为前一个时间的时间段编号，并返回所述对所述客户端设备当前时间、所述时间段编号和所述动态时间间隔进行计算，得到初始第二验证码的步骤，以得到更新后的第二验证码；
将更新后的第二验证码与所述第一验证码进行对比。
优选地，所述根据预设的第二加密算法对所述第一验证码进行加密，生成第三验证码，包括：
将预设的加密数增加至所述第一验证码中，生成第三验证码。
第二方面，本发明提供了一种物联网设备身份认证装置，所述装置设于客户端设备中，包括：
请求发送模块，用于发送身份认证请求信息至服务端设备，以使所述服务端设备接收所述身份认证请求信息，根据预设的第一加密算法生成第一验证码，并将所述第一验证码发送至所述客户端设备；
第一对比模块，用于接收所述第一验证码，并根据所述第一加密算法生成第二验证码，将所述第二验证码与所述第一验证码进行对比；
第一判定模块，用于当判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确；
第一加密模块，用于在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密，生成第三验证码；
第一发送模块，用于将所述第三验证码和预先配置的加密数据包发送至所述服务端设备，以使所述服务端设备反向运行所述第二加密算法，对接收到的所述第三验证码解密以生成第四验证码，将所述第四验证码与所述第一验证码进行对比，当判定所述第四验证码与所述第一验证码一致时，对接收到的所述加密数据包进行解密得到设备验证信息，当判定所述设备验证信息与所述客户端设备的设备专属信息一致时，确定所述客户端设备身份正确。
第三方面，本发明还提供了一种物联网设备身份认证方法，由服务端设备执行，包括：
接收身份认证请求信息，根据预设的第一加密算法生成第一验证码；其中，所述身份认证请求信息由客户端设备生成并发送至服务端设备；
将所述第一验证码发送至所述客户端设备，以使所述客户端设备根据所述第一加密算法生成第二验 证码，将所述第二验证码与接收到的所述第一验证码进行对比，当判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确，在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密生成第三验证码，并将所述第三验证码和预先配置的加密数据包发送至所述服务端设备；
接收所述加密数据包和所述第三验证码；
反向运行所述第二加密算法，对所述第三验证码解密生成第四验证码，将所述第四验证码与所述第一验证码进行对比；
当判定所述第四验证码与所述第一验证码一致时，对所述加密数据包进行解密得到设备验证信息；
当判定所述设备验证信息与所述客户端设备的设备专属信息一致时，确定所述客户端设备身份正确。
优选地，所述根据预设的第一加密算法生成第一验证码，包括：
根据预设的动态时间间隔和获取到的服务端设备当前时间，生成时间段编号；
对所述服务端设备当前时间、所述时间段编号和所述动态时间间隔进行计算，得到初始第一验证码；
根据预设的验证码位数对所述初始第一验证码进行处理，得到所述第一验证码。
优选地，所述方法还包括：
根据预设的图像生成算法和所述第一验证码生成图像验证码，并将所述图像验证码发送至所述客户端设备，以使所述客户端设备反向运行所述图像生成算法，对接收到的所述图像验证码进行解密，得到所述第一验证码。
优选地，所述根据预设的图像生成算法和所述第一验证码生成图像验证码，包括：
将所述第一验证码转换为初始二进制数值；
对所述初始二进制数值进行按位循环运算，得到二进制数值；
将所述二进制数值写入服务端设备预先配置的图像数据中，生成初始图像验证码；
将预设的干扰信息增加至所述初始图像验证码中，生成图像验证码。
优选地，所述反向运行所述第二加密算法，对所述第三验证码解密生成第四验证码，包括：
将预设的加密数从所述第三验证码中删除，生成第四验证码。
第四方面，本发明还提供了一种物联网设备身份认证装置，所述装置设于服务端设备中，包括：
第二加密模块，用于接收身份认证请求信息，根据预设的第一加密算法生成第一验证码；其中，所述身份认证请求信息由客户端设备生成并发送至服务端设备；
第二发送模块，用于将所述第一验证码发送至所述客户端设备，以使所述客户端设备根据所述第一加密算法生成第二验证码，将所述第二验证码与接收到的所述第一验证码进行对比，当判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确，在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密生成第三验证码，并将所述第三验证码和预先配置的加密数据包发送至所述服务端设备；
第一接收模块，用于接收所述加密数据包和所述第三验证码；
第二对比模块，用于反向运行所述第二加密算法，对所述第三验证码解密生成第四验证码，将所述第四验证码与所述第一验证码进行对比；
第一解密模块，用于当判定所述第四验证码与所述第一验证码一致时，对所述加密数据包进行解密得到设备验证信息；
第二判定模块，用于当判定所述设备验证信息与所述客户端设备的设备专属信息一致时，确定所述客户端设备身份正确。
第五方面，本发明还提供了一种物联网设备身份认证系统，包括客户端设备和服务端设备，所述客 户端设备与所述服务端设备通信连接，所述客户端设备用于执行如第一方面中任意一项所述的物联网设备身份认证方法，所述服务端设备用于执行如第三方面中任意一项所述的物联网设备身份认证方法。
第六方面，本发明还提供了一种计算机可读存储介质，所述计算机可读存储介质包括存储的计算机程序，其中，在所述计算机程序运行时控制所述计算机可读存储介质所在设备执行如第一方面中任意一项所述的物联网设备身份认证方法或如第三方面中任意一项所述的物联网设备身份认证方法。
相比于现有技术，本发明实施例具有如下有益效果：
在本发明实施例中，客户端设备会对服务端设备进行身份认证，确定服务端设备身份正确后，再发送处理过的第三验证码和加密数据包至服务端设备，服务端设备再对客户端设备进行身份认证，从而实现交互双方的双向认证。同时，在本发明实施例中，不用循环解密多次、也不涉及多次递归迭代以及公私钥等，具有占用资源少、认证速度快的优点，适用于计算机技术能力和储存资源低的设备。
附图说明
图1是本发明提供的一种物联网设备身份认证方法的一个优选实施例的流程示意图；
图2是本发明提供的一种物联网设备身份认证方法的一个优选实施例的结构示意图；
图3是本发明提供的一种物联网设备身份认证方法的另一个优选实施例的流程示意图；
图4是本发明提供的一种物联网设备身份认证方法的另一个优选实施例的结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
参照图1，本发明第一实施例提供了一种物联网设备身份认证方法，包括以下步骤S11-S15：
S11，发送身份认证请求信息至服务端设备，以使所述服务端设备接收所述身份认证请求信息，根据预设的第一加密算法生成第一验证码，并将所述第一验证码发送至所述客户端设备；
S12，接收所述第一验证码，并根据所述第一加密算法生成第二验证码，将所述第二验证码与所述第一验证码进行对比；
S13，当判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确；
S14，在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密，生成第三验证码；
S15，将所述第三验证码和预先配置的加密数据包发送至所述服务端设备，以使所述服务端设备反向运行所述第二加密算法，对接收到的所述第三验证码解密以生成第四验证码，将所述第四验证码与所述第一验证码进行对比，当判定所述第四验证码与所述第一验证码一致时，对接收到的所述加密数据包进行解密得到设备验证信息，当判定所述设备验证信息与所述客户端设备的设备专属信息一致时，确定所述客户端设备身份正确。
需要说明的是，在开始验证之前，需要对物联网设备中的客户端设备进行注册。在注册流程中，涉及到系统管理员、服务端设备和用户三个方面。首先，用户向服务端设备申请注册，并且提交自己的手机号码和密码信息，系统管理员则验证该用户是不是自己的用户，如果是则通过用户的申请注册，并且给该用户设置一定的操作权限，例如增加删除设备、修改设备信息、修改设备账户密码的权限等。
进一步地，在用户注册成功后，在服务端设备中进行用户登录，登录成功后发起客户端设备注册申请。服务端设备根据接收到的客户端设备注册申请信息，返回一个设备专属信息提交界面，用户在此界面输入客户端设备的设备专属信息，并将设备专属信息发送至服务端设备。其中，设备专属信息包括客户端设备的独立I P地址、机器码、账号、密码等信息。
服务端设备根据接收到的设备专属信息生成对应客户端设备的专属数据包，采用预设的专属加密算法对专属数据包进行加密以生成加密数据包，并将加密数据包发送至客户端设备，客户端设备将加密数 据包预先配置并存储至指定位置。其中，专属加密算法由双方提前约定并配置，例如，可以采用数据加密算法(Data Encryption Algorithm，DEA)，本发明对此不做限定。
进一步地，服务端设备还可以基于设备专属信息生成设备专用的程序，并将程序发送至客户端设备。与现有技术中的数字证书身份认证对比，本发明在客户端设备申请注册的时候，基于客户端设备的专属信息生成设备专用的程序，可以抵抗伪造攻击、伪造身份攻击、中间人攻击等等，提高了物联网设备身份认证系统的安全性。
在本实施例中，用户还可以根据加密数据包，将服务端设备发送过来的设备专用程序安装到客户端设备中，设备安装程序成功后开始运行程序，并且储存加密数据包中的账号信息和密码信息。在程序安装成功和账号和密码信息储存成功后，客户端设备还可以发送程序安装成功和账号密码信息储存成功信息至服务端设备，服务端设备接收到信息后，确定设备注册成功。客户端设备在程序安装成功和账号密码信息储存成功之后，再执行步骤S11，发送身份认证请求信息至所述服务端设备。
在步骤S11中，客户端设备发送身份认证请求信息至服务端设备。服务端设备接收所述身份认证请求信息，根据预设的第一加密算法生成第一验证码，并将所述第一验证码发送至所述客户端设备。
需要说明的是，第一加密算法的输入数据是动态的，根据时间进行变化。例如，使用基于时间同步验证的专用加密方法，来生成基于服务端设备当前时间的第一验证码。
在步骤S12中，客户端设备接收所述第一验证码，并根据所述第一加密算法生成第二验证码，将所述第二验证码与所述第一验证码进行对比。其中，第一加密算法的输入数据是动态的，根据时间进行变化。例如，使用基于时间同步验证的专用加密方法，来生成基于客户端设备当前时间的第二验证码。
在步骤S13和S14中，当客户端设备判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确。在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密，生成第三验证码。在一种实施方式中，将预设的加密数增加至所述第一验证码中，生成第三验证码。具体地，预设的加密数可以是一个较大的数。
在步骤S15中，将所述第三验证码和预先配置的加密数据包发送至所述服务端设备。示例性地，可以将第三验证码组合上加密数据包生成字符串，发送至服务端设备进行对比认证。最后，将缓存在客户端设备上所有的验证码信息删除，防止被他人盗用。
进一步地，服务端设备反向运行所述第二加密算法，对接收到的所述第三验证码解密以生成第四验证码，将所述第四验证码与所述第一验证码进行对比。当判定所述第四验证码与所述第一验证码一致时，反向运行预设的专属加密算法对接收到的所述加密数据包进行解密，得到设备验证信息。其中，设备验证信息与设备专属信息保持一致，可以由交互双方提前设定，包括客户端设备的独立I P地址、机器码、账号、密码等信息。当判定所述设备验证信息与所述设备专属信息一致时，确定所述客户端设备身份正确。
在一种实施方式中，服务端设备接收到客户端设备发送过来的字符串，将所述加密数从所述第三验证码中删除，生成第四验证码。服务端设备将解密出来的第四验证码与第一验证码进行对比，当判定所述第四验证码与所述第一验证码一致时，说明对比正确。再对字符串后面的加密数据包采用专属加密算法进行解密，从而读取设备验证信息，设备验证信息包括设备的账号和密码。需要说明的是，在判定第四验证码与第一验证码不一致的情况下，服务端设备不会去解密加密数据包，不会获得账号和密码信息。
进一步地，当判定所述设备验证信息与所述设备专属信息一致时，则确定客户端设备身份正确，发送认证通过信息至客户端设备。当判定所述设备验证信息与所述设备专属信息不一致时，说明账号和密码验证失败，则发送密码错误信息至客户端设备。
为了便于对本发明的理解，下面将对本发明的一些优选实施例做更进一步的描述。
在一种实现方式中，所述服务端设备根据预设的第一加密算法生成第一验证码，包括以下步骤S21-S23：
S21，根据预设的动态时间间隔和获取到的服务端设备当前时间，生成时间段编号；
S22，对所述服务端设备当前时间、所述时间段编号和所述动态时间间隔进行计算，得到初始第一 验证码；
S23，根据预设的验证码位数对所述初始第一验证码进行处理，得到所述第一验证码。
在步骤S21中，需要根据预设的动态时间间隔和获取到的服务端设备当前时间，生成时间段编号。具体地，服务端设备首先获取当前时间，即年月日时分秒，然后对当前时间中的分钟数和秒数进行运算，公式如下：
Figure PCTCN2022127810-appb-000001
其中，A表示服务端设备获取当前时间中的分钟数，B表示服务端设备获取当前时间中的秒数，T是动态时间间隔，J表示的是时间段编号“XX”，时间段编号只取整数，余数不要。动态时间间隔T是一个动态数字，由管理员在更新过程中设定动态时间间隔T的范围，服务端设备每天在此范围中进行随机选择一个数字，作为当天的动态时间间隔T。在本实施例中，经过上述公式(1)的运算后得时间段编号为：J＝XX，J为一个二位数的数值。在其他实施例中，若是J的数值不到二位，进行前面补位处理。例如，经过上述公式(1)得到J＝1，则进行补位处理，以0进行补位，得到最终的J为01。
在步骤S22中，需要对所述服务端设备当前时间、所述时间段编号和所述动态时间间隔进行计算，得到初始第一验证码。具体地，服务端设备将获取到当前时间中的年月日时数值进行运算，公式如下：
Figure PCTCN2022127810-appb-000002
其中，C表示获取到当前时间中的年日月时，即“YYYYMMDDHH”，D表示时间段编号与动态时间间隔的组合，即JT,例如J＝01、T＝90,则D＝0190,F表示上述公式(2)运算的商，G表示上述公式(2)运算的余数。进一步地，对F、G、J进行组合后得到初始第一验证码，例如“519560212138”。
在步骤S23中，根据预设的验证码位数对所述初始第一验证码进行处理，得到所述第一验证码。需要说明的是，在一种实施例中，经过步骤S22得到的初始第一验证码为“519560212138”。但在具体实施当中，若将初始第一验证码直接组合起来，会使得最终的验证码长度不一致，有的时候会长几位，有的时候会短几位。为了统一字符串的长度，在得到F、G和J三个数值后，要根据预设的验证码位数对F和G进行取若干位数，再进行FGJ组合。其中，验证码位数可以根据用户的需求进行配置，本发明对此不做限制。
示例性地，假设当前时间为2021年09月05日21时58分20秒，T＝90。经过公式(1)的运算后得到J＝38，此时C＝2021090521，D＝3890。在本实施例中，经过公式(2)运算得到F＝519560、G＝2121。以验证码位数为8位进行示例，此时取F和G的前三位数，取位后的F＝519、G＝212，最后进行FGJ的组合，生成基于当前时间的第一验证码为51921238。在其他实施例中，若是G的数值不到三位的，进行前面补位处理。例如，经过上述公式(2)得到G＝1，则进行补位处理，以0进行补位，得到最终的G为001。
在本实施例中，第一加密算法为一种基于时间同步验证编码的生成方法，生成的验证信息是动态信息，而不是静态信息。与智能卡及用户名/密码方式的身份认证方法相对比，此方法可以有效防止窥探、字典攻击、穷举尝试、网络数据流窃听、重放攻击等。同时，设定一个可以修改的动态时间间隔T，每天或者隔一段时间后T的数值就变化。与现有技术动态口令中的TOTP协议对比，本发明的动态时间T可以修改，每天服务器在设定范围中选取一个数值作为当天的约定时间规则。而且，延时的策略不需要向前推好几个时间段进行解密，只需要向前推一个时间段进行解密，因此可以抵抗猜测攻击，节省物联网设备的功耗，提高身份认证过程的有效性、安全性。
相应地，在步骤S12中，所述客户端设备根据所述第一加密算法生成第二验证码，包括以下步骤：
根据预设的动态时间间隔和获取到的客户端设备当前时间，生成时间段编号；
对所述客户端设备当前时间、所述时间段编号和所述动态时间间隔进行计算，得到初始第二验证码；
根据预设的验证码位数对所述初始第二验证码进行处理，得到所述第二验证码。
需要说明的是，上述步骤与步骤S21-S23的不同之处仅在于，上述步骤中获取到的是客户端设备当前时间，而步骤S21获取到的是服务端设备当前时间，其他过程在此不再赘述。
在一种优选实施方式中，所述方法还包括：
服务端设备根据预设的图像生成算法和所述第一验证码生成图像验证码，并将所述图像验证码发送至所述客户端设备，以使所述客户端设备反向运行所述图像生成算法，对接收到的所述图像验证码进行解密，得到所述第一验证码。
具体地，所述服务端设备根据预设的图像生成算法和所述第一验证码生成图像验证码，包括以下步骤S31-S34：
S31，将所述第一验证码转换为初始二进制数值；
S32，对所述初始二进制数值进行按位循环运算，得到二进制数值；
S33，将所述二进制数值写入服务端设备预先配置的图像数据中，生成初始图像验证码；
S34，将预设的干扰信息增加至所述初始图像验证码中，生成图像验证码。
在步骤S31中，需要将所述第一验证码转换为初始二进制数值。首先读取第一验证码中的信息，将第一验证码转换为初始二进制数值，用P个字节表示，一个字节有8位。
在步骤S32中，对所述初始二进制数值进行按位循环运算，得到二进制数值。例如，对初始二进制数值的第一个字节进行循环左移两位，第二个字节进行循环右移四位等。
示例性地，以第一验证码为“51921238”进行说明。51921238转化为二进制数后为11000110000100000101010110，一共有26位，将前面补全变为4个字节，即32位，为00000011000110000100000101010110。字节排序从右向左开始，对第一个字节01010110进行左移五位，第二个字节01000001右移为四位，第三个字节00011000右移两位，第四个00000011右移一位，移位后分别为11001010、00010100、00000110、10000001，得到最终二进制数值为10000001000001100001010011001010。
在步骤S33中，将所述二进制数值写入服务端设备预先配置的图像数据中，生成初始图像验证码。需要说明的是，本实施例中预先在服务端设备中储存或随机生成若干数量的背景图片，这些图片的可以是黑白类图片、灰度化图片、彩色类图片等，图片里面的图形可以是符号、数字编号、物体等。
进一步地，首先读取在服务端设备中储存或者随机生成的背景图片，然后用背景图片中的K个点的数值来表示所述二进制数值。其中，图片中的K个点的范围由服务端设备每天在图片范围中随机不重复抽取得到。最后，将步骤S22中得到的P个字节的二进制数值对应的写入到背景图片中去，生成初始图像验证码。
在步骤S34中，将预设的干扰信息增加至所述初始图像验证码中，生成图像验证码。其中，干扰信息可以包括L个噪声。
需要说明的是，不同的图片类型所需要的K值是不一样的，比如黑白图片中一个点只有0和1两个取值，因此需要K＝P*8个点，RGB彩色图片中一个点的取值是0到255，转化为二进制数的话是8位二进制数，因此只需要K＝4个点即可。
在一种优选实施方式中，所述方法还包括：
客户端设备接收图像验证码，反向运行预设的图像生成算法对所述图像验证码解密，得到所述第一验证码；其中，所述图像验证码由所述服务端设备根据所述图像生成算法和所述第一验证码生成，并发送至所述客户端设备。
具体地，所述反向运行预设的图像生成算法对所述图像验证码解密，得到所述第一验证码，包括以下步骤S41-S43；
S41，对所述图像验证码进行信息读取，并删除预设的干扰信息，得到十进制数值；
S42，将所述十进制数值转换为二进制数值，并对所述二进制数值进行反向按位循环运算，得到初始二进制数值；
S43，将所述初始二进制数值进行十进制转换，得到所述第一验证码。
需要说明的是，上述步骤S41-S43是反向运行图像生成算法的过程，其运算规则与步骤S31-S34相反。
在本实施例中，对图片进行改造后的K个点的位置是随机抽取的，对二进制数值写入的顺序也是不一样的，顺序读取错误也会使解密出错。因此在客户端设备储存规则的模块中读取图片解密规则，需要对图像验证码中的某些点进行读取，并删除预设的干扰信息。当读取到数值为十进制数时，需要转化为二进制数，然后将二进制数值根据与步骤S32反向的左右循环移位操作，再对应的将K个字节进行组合，得到初始二进制数值。最后将初始二进制数值转化为十进制数，得到所述第一验证码。
示例性地，以RGB彩色图片为例，一个点可以代表一个8位二进制数，即一个字节，假设设定的点为4个，即K＝4。第一个点的位置为第15行第10列用K1＝(15，10)表示，以此类推后面点位置为K2＝(20，10)、K3＝(45，1)、K4＝(2，35)。K1为第一字节信息，K2为第二字节信息，K3为第三字节信息，K4为第四字节信息。RGB彩色图片读取到的是0-255的十进制数值，需要转化为二进制数，将K个字节进行反向左右循环移位操作，若步骤S32的第一个字节是左移五位，只需要反向移动对应的位数即可得到原字节信息，即对第一个字节进行右移五位即可，剩下的字节以此类推。最后将K个字节进行降序排列组合，即K4、K3、K2、K1从大到小排序。排序组合好的数是初始二进制数值，再转化为十进制数即可得到第一验证码。
在本实施例中，针对随机生成的背景图片进行改造，交互双方约定好规则，客户端设备直接在图片上读取出认证信息。与动态口令身份认证方法相比，不用循环解密多次、涉及多次递归迭代以及公私钥等，可以达到占用资源少、认证速度快的优点，适用于计算机技术能力和储存资源低的设备。同时，由于是采用对背景图片进行改造写入编码信息的方法生成验证码图片，让人误以为验证码图片中的数字、物体、字符信息是身份认证信息，让攻击者无法利用猜测攻击。
此外，采用对第一验证码转换成二进制数后，再进行左右循环移位的操作方法。与TOTP协议需要进行多次递归迭代以及公私钥相对比，这种移位操作更加方便快捷，不需要进行多次递归迭代以及公私钥相，加密和解密速度都比TOTP协议的快，并且左右循环移位的规则是可以设定。可以达到认证速度快、不用消耗过多的资源的优点。
在一种优选实施方式中，所述方法还包括以下步骤S51-S52：
S51，当首次判定所述第二验证码与所述第一验证码不一致时，将所述时间段编号更新为前一个时间的时间段编号，并返回所述对所述客户端设备当前时间、所述时间段编号和所述动态时间间隔进行计算，得到初始第二验证码的步骤，以得到更新后的第二验证码；
S52，将更新后的第二验证码与所述第一验证码进行对比。
需要说明的是，客户端设备在认证过程中出现失败，可能是刚好在动态时间间隔节点上，即处于这个时间段末尾，到下一个时间段的开始。此时获取到的时间是会变化，客户端设备接收到图片验证码的时候，时间跳到下一个时间段编号，最后使得解密出来的第二验证码是错误的。
示例性地，假设循环时间段编号为0、1、2、3....39，动态时间间隔T＝90秒，此时服务端设备获取到当前时间中的分钟数为2、秒数为58，通过公式(1)的计算得到J＝01。由于时间是会变化的，服务端设备需要将获取到的第一验证码进行处理后得到图片验证码后，再发送到客户端设备中。若服务端设备发送图片验证码的时间中分钟数为3，秒数为0。此时客户端设备需要基于自身设备的时间生成第二验证码，通过公式(1)计算得到的时间段编号为02，而对服务端设备发送过来的图片验证码进行解密得到第一验证码中的时间段编号为01，从而导致身份认证错误，使客户端设备误以为服务端设备是假冒身份，这种做法是不允许出现的，此时需要执行上述步骤S51-S52。
在步骤S51中，当首次判定所述第二验证码与所述第一验证码不一致时，将所述时间段编号更新为前一个时间的时间段编号，并返回所述对所述客户端设备当前时间、所述时间段编号和所述动态时间间隔进行计算，得到初始第二验证码的步骤，以得到更新后的第二验证码。具体地，当出现第一次认证失败后，第二次客户端设备将当前时间段编号循环前移一个时间段编号，例如当前时间段编号为02验证对比失败时，则前移一个时间段编号，即为01，再进行验证对比，也即步骤S52的内容。若对比正确后，继续执行正确的身份认证流程；若是出现验证对比失败后，则判定此服务端设备为假冒服务端设备，后 续不接收此服务端设备的信息。
在具体实施当中，还可以对物联网中的设备进行更新。其中，管理员可以更新的内容如下：
(1)更新服务端设备中约定时间间隔T的范围大小；
(2)更新服务端设备中约定加密数的范围大小；
(3)更新服务端设备中用户的权限，比如取消增加客户端设备权限，增加删除客户端设备权限、修改客户端设备的密码信息等；
(4)更改客户端设备注册时候生成的随机密码；
(5)增加或者删除用户和客户端设备。
服务端设备更新的内容如下：
(1)每天在设定约定时间间隔T的范围中随机抽取一个数值作为当天约定时间间隔，并且发送将此规则至客户端设备；
(2)每天在设定约定加密数的范围中随机抽取一个数作为当天的约定加密数，并且发送此规则至客户端设备；
(3)更新用户更改后的客户端设备密码信息，发送到客户端设备中进行更新；
(4)每天在设定改造验证码图片的行数、列数范围随机不重复抽取P*8个点作为当天验证码图片改造点，并且将此规则发送到客户端设备；
客户端设备更新的内容如下：
(1)一起接受服务端设备每天更新后的规则；
(2)接收由用户在服务端设备中更改客户端设备密码信息，并且将此信息储存起来；
用户更新的内容如下：
(1)用户可以在服务端设备中修改在注册时候填写的密码；
(2)用户可以在服务端设备中修改客户端设备的密码信息，不可修改客户端设备的账户信息。修改后的信息，会由服务端设备发送到客户端设备。
在现有技术中，物联网系统中常用的身份认证方式主要有4种，分别为智能卡认证、用户名/密码方式认证、动态口令认证和基于数字证书的身份认证，具体如下：
(1)智能卡认证：基于智能卡的身份认证属于通过物理设备进行身份认证的机制。每个用户持有一张智能卡，智能卡存储用户秘密信息，同时在验证服务器中也存放该秘密信息。在进行认证时，用户输入PIN码(Personal Identification Number，个人身份认证码)，服务器认证PIN码，成功后即可读出智能卡中的秘密信息，进而利用该秘密信息与主机之间进行认证。基于智能卡的认证方式是一种双因素认证方式(PIN+智能卡)，即使PIN码或智能卡单独被窃取，合法用户的身份仍不会被冒充(即不能获得访问权)。
(2)用户名/密码方式认证：用户名/密码是最简单也是最常用的身份认证方法，是基于“what you know”的验证手段。每个用户的密码均是由用户自己设定的，只有用户自己知道。只要用户能够正确输入密码，计算机就认为操作者是合法用户。
(3)动态口令认证：动态口令的基本认证原理是认证双方使用同一个共享密钥对时间进行密码算法计算，然后比较计算值是否一致，从而进行认证。比如TOTP算法(Time-based One-time Password algorithm，基于时间的一次性密码算法)。TOTP是基于散列的消息认证码(Hash-based Message Authentication Code，HMAC)的示例，它使用加密哈希函数将密钥与当前时间戳组合在一起以生成一次性密码。由于网络延迟和不同步时钟可能导致密码接收者必须尝试一系列可能的时间来进行身份验证，因此时间戳通常以30秒的间隔增加。
(4)基于数字证书的身份认证：数字证书身份认证是基于PKI(PublicKey Infrastructure，公 钥基础设施)构架的数字证书认证方式。数字证书是由可信任的第三方认证机构颁发的一组包含用户身份信息(密钥)的数据结构，PKI体系通过采用加密算法构建了一套完善的流程，身份认证时需要输入证书文件的保护口令。
针对上述现有技术(1)-(4)，存在以下问题：
(1)智能卡认证：由于每次从智能卡中读取的数据均是静态的，通过内存扫描或网络监听等技术很容易截取用户的身份验证信息，并且在设备中需要增加一个智能卡。智能卡容易猜测，且易被攻击，例如采用窥探、字典攻击、穷举尝试、网络数据流窃听、重放攻击等。
(2)用户名/密码方式认证：由于密码是静态的数据，在验证过程中需要在计算机内存和网络中传输，而每次验证使用的验证信息都是相同的，容易猜测，且易被攻击，采用窥探、字典攻击、穷举尝试、网络数据流窃听、重放攻击等。因此，从安全性上讲，用户名/密码方式以及智能卡都是极不安全的身份认证方式。
(3)动态口令认证：客户端和服务器端的口令生成算法本身采用的是伪随机序列发生器技术，一旦算法被破解将会造成连续泄密。如果客户端与服务器端的时间或次数不能保持良好的同步，就可能发生合法用户无法登录的问题。例如，在同一个哈希有效期的时间长度内，动态密码生成的结果是一样的，但是由于网络的原因，客户端生成密码的时间和服务器接受密码的时间可能差距会很大，导致两个密码不在同一个哈希有效期的时间长度内，所以导致认证失败。这个时候就需要验证系统有一个延时的策略，可以允许验证前几个哈希有效期的时间长度的动态密码。若是允许前几个时间段的话，会使得物联网设备循环解密多次，并且TOTP协议涉及多次递归迭代以及公私钥，导致资源消耗过大，而物联网场景下计算资源和能量供应都非常有限，无法提供足够的资源和能量支持。
(4)基于数字证书的认证：需要增加一个共同信任的第三方机构即CA中心(Certificate Authority，证书授权中心)签发数字证书，并且这个数字证书是一定的期限，需要在物联网的身份认证系统增加第三方机构，使身份认证过程过于繁琐。
由上述分析可知，在第一类和第二类的身份认证过程中，传输的都是静态的信息。此外，第一类的身份认证在认证过程需要增加一张智能卡，静态的信息在设备身份认证过程中容易被截取信息。第三类的身份认证方法生成的是一串较长无规律的密码，且需要用户输入，一旦输错就要重新操作，可能需要解密多次，涉及多次递归迭代以及公私钥，导致资源消耗过大。第四类方法需要引入第三方机构，第三方机构对设备进行签发数字证书，并且是证书是有一定期限，在物联网设备使用起来较为麻烦。
在本发明实施例中，客户端设备会对服务端设备进行身份认证，确定服务端设备身份正确后，再发送处理过的第三验证码和加密数据包至服务端设备，服务端设备再对客户端设备进行身份认证，从而实现交互双方的双向认证。同时，在本发明实施例中，不用循环解密多次、也不涉及多次递归迭代以及公私钥等，具有占用资源少、认证速度快的优点，适用于计算机技术能力和储存资源低的设备。
参照图2，本发明第二实施例提供了一种物联网设备身份认证装置，所述装置设于客户端设备中，包括：
请求发送模块，用于发送身份认证请求信息至服务端设备，以使所述服务端设备接收所述身份认证请求信息，根据预设的第一加密算法生成第一验证码，并将所述第一验证码发送至所述客户端设备；
第一对比模块，用于接收所述第一验证码，并根据所述第一加密算法生成第二验证码，将所述第二验证码与所述第一验证码进行对比；
第一判定模块，用于当判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确；
第一加密模块，用于在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密，生成第三验证码；
第一发送模块，用于将所述第三验证码和预先配置的加密数据包发送至所述服务端设备，以使所述服务端设备反向运行所述第二加密算法，对接收到的所述第三验证码解密以生成第四验证码，将所述第四验证码与所述第一验证码进行对比，当判定所述第四验证码与所述第一验证码一致时，对接收到的所 述加密数据包进行解密得到设备验证信息，当判定所述设备验证信息与所述客户端设备的设备专属信息一致时，确定所述客户端设备身份正确。
优选地，所述装置还包括：
图像接收模块，用于接收图像验证码，反向运行预设的图像生成算法对所述图像验证码解密，得到所述第一验证码；其中，所述图像验证码由所述服务端设备根据所述图像生成算法和所述第一验证码生成，并发送至所述客户端设备。
优选地，所述图像接收模块还用于：
对所述图像验证码进行信息读取，并删除预设的干扰信息，得到十进制数值；
将所述十进制数值转换为二进制数值，并对所述二进制数值进行反向按位循环运算，得到初始二进制数值；
将所述初始二进制数值进行十进制转换，得到所述第一验证码。
优选地，所述装置还包括：
更新对比模块，用于当首次判定所述第二验证码与所述第一验证码不一致时，将所述时间段编号更新为前一个时间的时间段编号，并返回所述对所述客户端设备当前时间、所述时间段编号和所述动态时间间隔进行计算，得到初始第二验证码的步骤，以得到更新后的第二验证码；
将更新后的第二验证码与所述第一验证码进行对比。
优选地，所述第一加密模块包括：
第一加密单元，用于将预设的加密数增加至所述第一验证码中，生成第三验证码。
在本发明实施例中，客户端设备会对服务端设备进行身份认证，确定服务端设备身份正确后，再发送处理过的第三验证码和加密数据包至服务端设备，服务端设备再对客户端设备进行身份认证，从而实现交互双方的双向认证。同时，在本发明实施例中，不用循环解密多次、也不涉及多次递归迭代以及公私钥等，具有占用资源少、认证速度快的优点，适用于计算机技术能力和储存资源低的设备。
参照图3，本发明第三实施例提供了一种物联网设备身份认证方法，包括以下步骤S61-S66：
S61，接收身份认证请求信息，根据预设的第一加密算法生成第一验证码；其中，所述身份认证请求信息由客户端设备生成并发送至服务端设备；
S62，将所述第一验证码发送至所述客户端设备，以使所述客户端设备根据所述第一加密算法生成第二验证码，将所述第二验证码与接收到的所述第一验证码进行对比，当判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确，在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密生成第三验证码，并将所述第三验证码和预先配置的加密数据包发送至所述服务端设备；
S63，接收所述加密数据包和所述第三验证码；
S64，反向运行所述第二加密算法，对所述第三验证码解密生成第四验证码，将所述第四验证码与所述第一验证码进行对比；
S65，当判定所述第四验证码与所述第一验证码一致时，对所述加密数据包进行解密得到设备验证信息；
S66，当判定所述设备验证信息与所述客户端设备的设备专属信息一致时，确定所述客户端设备身份正确。
需要说明的是，在开始验证之前，需要对物联网设备中的客户端设备进行注册。在用户注册成功后，在服务端设备中进行用户登录，登录成功后发起客户端设备注册申请。服务端设备根据接收到的客户端设备注册申请信息，返回一个设备专属信息提交界面，用户在此界面输入客户端设备的设备专属信息，例如设备的独立I P地址、机器码等，并将设备专属信息发送至服务端设备。
进一步地，服务端设备接收客户端设备发送的设备专属信息并生成专属数据包，采用预设的专属加密算法对所述专属数据包进行加密，生成加密数据包。服务端设备将所述加密数据包发送至所述客户端设备，所述客户端设备接收所述加密数据包，并将加密数据包预先配置并存储至指定位置。其中，专属加密算法由双方提前约定并配置，例如，可以采用数据加密算法(Data Encrypt ion Algor ithm，DEA)，本发明对此不做限定。进一步地，服务端设备还可以基于设备专属信息生成设备专用的程序，并将程序发送至客户端设备。
在步骤S61中，客户端设备发送身份认证请求信息至所述服务端设备。服务端设备接收所述身份认证请求信息，根据预设的第一加密算法生成第一验证码，具体过程在步骤S21-S23已做说明，在此不再赘述。
在步骤S62中，将所述第一验证码发送至所述客户端设备，客户端设备根据所述第一加密算法生成第二验证码，将所述第二验证码与接收到的所述第一验证码进行对比，当判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确，在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密生成第三验证码，并将所述第三验证码和预先配置的加密数据包发送至所述服务端设备。
在步骤S63中，服务端设备接收所述加密数据包和所述第三验证码。
在步骤S64中，反向运行所述第二加密算法，对所述第三验证码解密生成第四验证码，将所述第四验证码与所述第一验证码进行对比。在一种实施方式中，服务端设备接收到客户端设备发送过来的字符串，将所述加密数从所述第三验证码中删除，生成第四验证码。
在步骤S65中，服务端设备将解密出来的第四验证码与第一验证码进行对比，当判定所述第四验证码与所述第一验证码一致时，说明对比正确。
在步骤S66中，服务端设备再对字符串后面的加密数据包进行解密，从而读取设备验证信息，设备验证信息包括设备的账号和密码。需要说明的是，在判定第四验证码与第一验证码不一致的情况下，服务端设备不会去解密加密数据包，不会获得账号和密码信息。
进一步地，当判定所述设备验证信息与所述设备专属信息一致时，则确定客户端设备身份正确，发送认证通过信息至客户端设备。当判定所述设备验证信息与所述设备专属信息不一致时，说明账号和密码验证失败，则发送密码错误信息至客户端设备。
在本发明实施例中，客户端设备会对服务端设备进行身份认证，确定服务端设备身份正确后，再发送处理过的第三验证码和加密数据包至服务端设备，服务端设备再对客户端设备进行身份认证，从而实现交互双方的双向认证。同时，在本发明实施例中，不用循环解密多次、也不涉及多次递归迭代以及公私钥等，具有占用资源少、认证速度快的优点，适用于计算机技术能力和储存资源低的设备。
参照图4，本发明第四实施例提供了一种物联网设备身份认证装置，所述装置设于服务端设备中，包括：
第二加密模块，用于接收身份认证请求信息，根据预设的第一加密算法生成第一验证码；其中，所述身份认证请求信息由客户端设备生成并发送至服务端设备；
第二发送模块，用于将所述第一验证码发送至所述客户端设备，以使所述客户端设备根据所述第一加密算法生成第二验证码，将所述第二验证码与接收到的所述第一验证码进行对比，当判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确，在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密生成第三验证码，并将所述第三验证码和预先配置的加密数据包发送至所述服务端设备；
第一接收模块，用于接收所述加密数据包和所述第三验证码；
第二对比模块，用于反向运行所述第二加密算法，对所述第三验证码解密生成第四验证码，将所述第四验证码与所述第一验证码进行对比；
第一解密模块，用于当判定所述第四验证码与所述第一验证码一致时，对所述加密数据包进行解密得到设备验证信息；
第二判定模块，用于当判定所述设备验证信息与所述客户端设备的设备专属信息一致时，确定所述客户端设备身份正确。
优选地，所述第二加密模块包括：
时间获取单元，用于根据预设的动态时间间隔和获取到的服务端设备当前时间，生成时间段编号；
初始第一验证码生成单元，用于对所述服务端设备当前时间、所述时间段编号和所述动态时间间隔进行计算，得到初始第一验证码；
第一验证码生成单元，用于根据预设的验证码位数对所述初始第一验证码进行处理，得到所述第一验证码。
优选地，所述装置还包括：
图像验证码生成模块，用于根据预设的图像生成算法和所述第一验证码生成图像验证码，并将所述图像验证码发送至所述客户端设备，以使所述客户端设备反向运行所述图像生成算法，对接收到的所述图像验证码进行解密，得到所述第一验证码。
优选地，所述图像验证码生成模块包括：
进制转换单元，用于将所述第一验证码转换为初始二进制数值；
循环运算单元，用于对所述初始二进制数值进行按位循环运算，得到二进制数值；
初始图像验证码生成单元，用于将所述二进制数值写入服务端设备预先配置的图像数据中，生成初始图像验证码；
图像验证码生成单元，用于将预设的干扰信息增加至所述初始图像验证码中，生成图像验证码。
优选地，所述第二对比模块包括：
第四验证码生成单元，用于将预设的加密数从所述第三验证码中删除，生成第四验证码。
在本发明实施例中，客户端设备会对服务端设备进行身份认证，确定服务端设备身份正确后，再发送处理过的第三验证码和加密数据包至服务端设备，服务端设备再对客户端设备进行身份认证，从而实现交互双方的双向认证。同时，在本发明实施例中，不用循环解密多次、也不涉及多次递归迭代以及公私钥等，具有占用资源少、认证速度快的优点，适用于计算机技术能力和储存资源低的设备。
本发明第五实施例提供了一种物联网设备身份认证系统，包括客户端设备和服务端设备，所述客户端设备与所述服务端设备通信连接，所述客户端设备用于执行如第一实施例任意一项所述的物联网设备身份认证方法，所述服务端设备用于执行如第三实施例任意一项所述的物联网设备身份认证方法。
需要说明的是，在身份认证过程中，一般是由服务端设备生成图片验证码发送到客户端设备中进行身份认证处理的。在另一种实施例中，服务端设备与客户端设备的身份可以互换，即由客户端设备生成图片验证码发送到服务端设备中进行身份认证处理的。
本发明第六实施例提供了一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括存储的计算机程序，其中，在所述计算机程序运行时控制所述计算机可读存储介质所在设备执行第一实施例任意一项所述的物联网设备身份认证方法或第三实施例任意一项所述的物联网设备身份认证方法。
综上，本发明提供了一种物联网设备身份认证方法、装置、系统及计算机可读存储介质，客户端设备会对服务端设备进行身份认证，确定服务端设备身份正确后，再发送处理过的第三验证码和加密数据包至服务端设备，服务端设备再对客户端设备进行身份认证，从而实现交互双方的双向认证。同时，在本发明实施例中，不用循环解密多次、也不涉及多次递归迭代以及公私钥等，具有占用资源少、认证速度快的优点，适用于计算机技术能力和储存资源低的设备。
示例性的，所述计算机程序可以被分割成一个或多个模块/单元，所述一个或者多个模块/单元被存储在所述存储器中，并由所述处理器执行，以完成本发明。所述一个或多个模块/单元可以是能够完成特定功能的一系列计算机程序指令段，该指令段用于描述所述计算机程序在所述客户端设备或所述服务端设备中的执行过程。
所称处理器可以是中央处理单元(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等，所述处理器是所述客户端设备或所述服务端设备的控制中心，利用各种接口和线路连接整个所述客户端设备或所述服务端设备的各个部分。
所述存储器可用于存储所述计算机程序和/或模块，所述处理器通过运行或执行存储在所述存储器内的计算机程序和/或模块，以及调用存储在存储器内的数据，实现所述客户端设备或所述服务端设备的各种功能。所述存储器可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如声音播放功能、图像播放功能等)等；存储数据区可存储根据手机的使用所创建的数据(比如音频数据、电话本等)等。此外，存储器可以包括高速随机存取存储器，还可以包括非易失性存储器，例如硬盘、内存、插接式硬盘，智能存储卡(Smart Media Card,SMC)，安全数字(Secure Digital,SD)卡，闪存卡(Flash Card)、至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
其中，所述客户端设备或所述服务端设备集成的模块/单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明实现上述实施例方法中的全部或部分流程，也可以通过计算机程序来指令相关的硬件来完成，所述的计算机程序可存储于一计算机可读存储介质中，该计算机程序在被处理器执行时，可实现上述各个方法实施例的步骤。其中，所述计算机程序包括计算机程序代码，所述计算机程序代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。所述计算机可读介质可以包括：能够携带所述计算机程序代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、电载波信号、电信信号以及软件分发介质等。需要说明的是，所述计算机可读介质包含的内容可以根据司法管辖区内立法和专利实践的要求进行适当的增减，例如在某些司法管辖区，根据立法和专利实践，计算机可读介质不包括电载波信号和电信信号。
需说明的是，以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。另外，本发明提供的装置实施例附图中，模块之间的连接关系表示它们之间具有通信连接，具体可以实现为一条或多条通信总线或信号线。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
以上所述的具体实施例，对本发明的目的、技术方案和有益效果进行了进一步的详细说明，应当理解，以上所述仅为本发明的具体实施例而已，并不用于限定本发明的保护范围。特别指出，对于本领域技术人员来说，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (13)

  1. 一种物联网设备身份认证方法，其特征在于，由客户端设备执行，包括：
    发送身份认证请求信息至服务端设备，以使所述服务端设备接收所述身份认证请求信息，根据预设的第一加密算法生成第一验证码，并将所述第一验证码发送至所述客户端设备或根据预设的图像生成算法和所述第一验证码生成图像验证码并将所述图像验证码发送至所述客户端设备；
    接收所述第一验证码或接收所述图像验证码并反向运行所述图像生成算法对所述图像验证码解密得到所述第一验证码，根据所述第一加密算法生成第二验证码，将所述第二验证码与所述第一验证码进行对比；
    当判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确；
    在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密，生成第三验证码；
    将所述第三验证码和预先配置的加密数据包发送至所述服务端设备，以使所述服务端设备反向运行所述第二加密算法，对接收到的所述第三验证码解密以生成第四验证码，将所述第四验证码与所述第一验证码进行对比，当判定所述第四验证码与所述第一验证码一致时，对接收到的所述加密数据包进行解密得到设备验证信息，当判定所述设备验证信息与所述客户端设备的设备专属信息一致时，确定所述客户端设备身份正确。
  2. 根据权利要求1所述的物联网设备身份认证方法，其特征在于，所述反向运行预设的图像生成算法对所述图像验证码解密，得到所述第一验证码，包括：
    对所述图像验证码进行信息读取，并删除预设的干扰信息，得到十进制数值；
    将所述十进制数值转换为二进制数值，并对所述二进制数值进行反向按位循环运算，得到初始二进制数值；
    将所述初始二进制数值进行十进制转换，得到所述第一验证码。
  3. 根据权利要求1所述的物联网设备身份认证方法，其特征在于，所述根据所述第一加密算法生成第二验证码，包括：
    根据预设的动态时间间隔和获取到的客户端设备当前时间，生成时间段编号；
    对所述客户端设备当前时间、所述时间段编号和所述动态时间间隔进行计算，得到初始第二验证码；
    根据预设的验证码位数对所述初始第二验证码进行处理，得到所述第二验证码。
  4. 根据权利要求3所述的物联网设备身份认证方法，其特征在于，所述方法还包括：
    当首次判定所述第二验证码与所述第一验证码不一致时，将所述时间段编号更新为前一个时间的时间段编号，并返回所述对所述客户端设备当前时间、所述时间段编号和所述动态时间间隔进行计算，得到初始第二验证码的步骤，以得到更新后的第二验证码；
    将更新后的第二验证码与所述第一验证码进行对比。
  5. 根据权利要求1所述的物联网设备身份认证方法，其特征在于，所述根据预设的第二加密算法对所述第一验证码进行加密，生成第三验证码，包括：
    将预设的加密数增加至所述第一验证码中，生成第三验证码。
  6. 一种物联网设备身份认证装置，其特征在于，所述装置设于客户端设备中，用于执行 如权利要求1至5中任意一项所述的物联网设备身份认证方法，包括：
    请求发送模块，用于发送身份认证请求信息至服务端设备，以使所述服务端设备接收所述身份认证请求信息，根据预设的第一加密算法生成第一验证码，并将所述第一验证码发送至所述客户端设备；
    第一对比模块，用于接收所述第一验证码，并根据所述第一加密算法生成第二验证码，将所述第二验证码与所述第一验证码进行对比；
    第一判定模块，用于当判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确；
    第一加密模块，用于在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密，生成第三验证码；
    第一发送模块，用于将所述第三验证码和预先配置的加密数据包发送至所述服务端设备，以使所述服务端设备反向运行所述第二加密算法，对接收到的所述第三验证码解密以生成第四验证码，将所述第四验证码与所述第一验证码进行对比，当判定所述第四验证码与所述第一验证码一致时，对接收到的所述加密数据包进行解密得到设备验证信息，当判定所述设备验证信息与所述客户端设备的设备专属信息一致时，确定所述客户端设备身份正确。
  7. 一种物联网设备身份认证方法，其特征在于，由服务端设备执行，包括：
    接收身份认证请求信息，根据预设的第一加密算法生成第一验证码；其中，所述身份认证请求信息由客户端设备生成并发送至服务端设备；
    将所述第一验证码发送至所述客户端设备或根据预设的图像生成算法和所述第一验证码生成图像验证码并将所述图像验证码发送至所述客户端设备，以使所述客户端设备根据所述第一加密算法生成第二验证码，将所述第二验证码与接收到的所述第一验证码进行对比或反向运行所述图像生成算法，对接收到的所述图像验证码进行解密得到所述第一验证码，并将所述第二验证码与解密得到的所述第一验证码进行对比，当判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确，在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密生成第三验证码，并将所述第三验证码和预先配置的加密数据包发送至所述服务端设备；
    接收所述加密数据包和所述第三验证码；
    反向运行所述第二加密算法，对所述第三验证码解密生成第四验证码，将所述第四验证码与所述第一验证码进行对比；
    当判定所述第四验证码与所述第一验证码一致时，对所述加密数据包进行解密得到设备验证信息；
    当判定所述设备验证信息与所述客户端设备的设备专属信息一致时，确定所述客户端设备身份正确。
  8. 根据权利要求7所述的物联网设备身份认证方法，其特征在于，所述根据预设的第一加密算法生成第一验证码，包括：
    根据预设的动态时间间隔和获取到的服务端设备当前时间，生成时间段编号；
    对所述服务端设备当前时间、所述时间段编号和所述动态时间间隔进行计算，得到初始第一验证码；
    根据预设的验证码位数对所述初始第一验证码进行处理，得到所述第一验证码。
  9. 根据权利要求7所述的物联网设备身份认证方法，其特征在于，所述根据预设的图像 生成算法和所述第一验证码生成图像验证码，包括：
    将所述第一验证码转换为初始二进制数值；
    对所述初始二进制数值进行按位循环运算，得到二进制数值；
    将所述二进制数值写入服务端设备预先配置的图像数据中，生成初始图像验证码；
    将预设的干扰信息增加至所述初始图像验证码中，生成图像验证码。
  10. 根据权利要求7所述的物联网设备身份认证方法，其特征在于，所述反向运行所述第二加密算法，对所述第三验证码解密生成第四验证码，包括：
    将预设的加密数从所述第三验证码中删除，生成第四验证码。
  11. 一种物联网设备身份认证装置，其特征在于，所述装置设于服务端设备中，用于执行如权利要求7至10中任意一项所述的物联网设备身份认证方法，包括：
    第二加密模块，用于接收身份认证请求信息，根据预设的第一加密算法生成第一验证码；其中，所述身份认证请求信息由客户端设备生成并发送至服务端设备；
    第二发送模块，用于将所述第一验证码发送至所述客户端设备，以使所述客户端设备根据所述第一加密算法生成第二验证码，将所述第二验证码与接收到的所述第一验证码进行对比，当判定所述第二验证码与所述第一验证码一致时，确定所述服务端设备身份正确，在确定所述服务端设备身份正确后，根据预设的第二加密算法对所述第一验证码进行加密生成第三验证码，并将所述第三验证码和预先配置的加密数据包发送至所述服务端设备；
    第一接收模块，用于接收所述加密数据包和所述第三验证码；
    第二对比模块，用于反向运行所述第二加密算法，对所述第三验证码解密生成第四验证码，将所述第四验证码与所述第一验证码进行对比；
    第一解密模块，用于当判定所述第四验证码与所述第一验证码一致时，对所述加密数据包进行解密得到设备验证信息；
    第二判定模块，用于当判定所述设备验证信息与所述客户端设备的设备专属信息一致时，确定所述客户端设备身份正确。
  12. 一种物联网设备身份认证系统，其特征在于，包括客户端设备和服务端设备，所述客户端设备与所述服务端设备通信连接，所述客户端设备用于执行如权利要求1至5中任意一项所述的物联网设备身份认证方法，所述服务端设备用于执行如权利要求7至10中任意一项所述的物联网设备身份认证方法。
  13. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括存储的计算机程序，其中，在所述计算机程序运行时控制所述计算机可读存储介质所在设备执行如权利要求1至5中任意一项所述的物联网设备身份认证方法或如权利要求7至10中任意一项所述的物联网设备身份认证方法。
PCT/CN2022/127810 2021-11-11 2022-10-27 物联网设备身份认证方法、装置、系统及存储介质 WO2023083007A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111331483.X 2021-11-11
CN202111331483.XA CN114157451B (zh) 2021-11-11 2021-11-11 物联网设备身份认证方法、装置、系统及存储介质

Publications (1)

Publication Number Publication Date
WO2023083007A1 true WO2023083007A1 (zh) 2023-05-19

Family

ID=80459527

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/127810 WO2023083007A1 (zh) 2021-11-11 2022-10-27 物联网设备身份认证方法、装置、系统及存储介质

Country Status (2)

Country Link
CN (1) CN114157451B (zh)
WO (1) WO2023083007A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117834216A (zh) * 2023-12-18 2024-04-05 慧之安信息技术股份有限公司 一种基于解决通信白名单智能化处理方法和系统

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114157451B (zh) * 2021-11-11 2022-06-07 广东石油化工学院 物联网设备身份认证方法、装置、系统及存储介质
CN114697117B (zh) * 2022-04-07 2023-11-24 中国工商银行股份有限公司 基于定位信息的验证方法、装置、密码器及系统
CN114499899B (zh) * 2022-04-15 2022-09-09 阿里云计算有限公司 身份校验系统
CN116432241A (zh) * 2023-06-09 2023-07-14 深圳奥联信息安全技术有限公司 一种文本加密系统及方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170126654A1 (en) * 2015-10-28 2017-05-04 Alibaba Group Holding Limited Method and system for dynamic password authentication based on quantum states
CN107113315A (zh) * 2016-04-15 2017-08-29 深圳前海达闼云端智能科技有限公司 一种身份认证方法、终端及服务器
WO2017185913A1 (zh) * 2016-04-29 2017-11-02 上海斐讯数据通信技术有限公司 一种无线局域网认证机制的改进方法
CN108718323A (zh) * 2018-06-29 2018-10-30 北京东方英卡数字信息技术有限公司 一种身份认证方法和系统
CN114157451A (zh) * 2021-11-11 2022-03-08 广东石油化工学院 物联网设备身份认证方法、装置、系统及存储介质

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105337740B (zh) * 2014-07-31 2019-01-04 阿里巴巴集团控股有限公司 一种身份验证方法、客户端、中继设备及服务器
KR102364652B1 (ko) * 2019-08-01 2022-02-21 한국전자통신연구원 화이트박스 암호화를 이용한 puf 기반 사물인터넷 디바이스 인증 장치 및 방법
US11647014B2 (en) * 2020-02-18 2023-05-09 International Business Machines Corporation Identity authentication based on data from Internet of Things devices
CN112565265B (zh) * 2020-12-04 2022-11-01 国网辽宁省电力有限公司沈阳供电公司 物联网终端设备间的认证方法、认证系统及通讯方法
CN113541967B (zh) * 2021-09-13 2021-12-24 北京深思数盾科技股份有限公司 信息处理方法、电子设备及物联网终端系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170126654A1 (en) * 2015-10-28 2017-05-04 Alibaba Group Holding Limited Method and system for dynamic password authentication based on quantum states
CN107113315A (zh) * 2016-04-15 2017-08-29 深圳前海达闼云端智能科技有限公司 一种身份认证方法、终端及服务器
WO2017185913A1 (zh) * 2016-04-29 2017-11-02 上海斐讯数据通信技术有限公司 一种无线局域网认证机制的改进方法
CN108718323A (zh) * 2018-06-29 2018-10-30 北京东方英卡数字信息技术有限公司 一种身份认证方法和系统
CN114157451A (zh) * 2021-11-11 2022-03-08 广东石油化工学院 物联网设备身份认证方法、装置、系统及存储介质

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117834216A (zh) * 2023-12-18 2024-04-05 慧之安信息技术股份有限公司 一种基于解决通信白名单智能化处理方法和系统

Also Published As

Publication number Publication date
CN114157451B (zh) 2022-06-07
CN114157451A (zh) 2022-03-08

Similar Documents

Publication Publication Date Title
US11757662B2 (en) Confidential authentication and provisioning
US11563567B2 (en) Secure shared key establishment for peer to peer communications
WO2023083007A1 (zh) 物联网设备身份认证方法、装置、系统及存储介质
CN108092776B (zh) 一种基于身份认证服务器和身份认证令牌的系统
US10142107B2 (en) Token binding using trust module protected keys
US10320765B2 (en) Method and system for securing communication
CN108737106B (zh) 区块链系统上用户验证方法、装置、终端设备及存储介质
US20030204724A1 (en) Methods for remotely changing a communications password
CN109714176B (zh) 口令认证方法、装置及存储介质
CN109361508B (zh) 数据传输方法、电子设备及计算机可读存储介质
CN110958209B (zh) 基于共享密钥的双向认证方法及系统、终端
WO2019110018A1 (zh) 通信网络系统的消息验证方法、通信方法和通信网络系统
KR100668446B1 (ko) 안전한 인증정보 이동방법
CN114553590A (zh) 数据传输方法及相关设备
US11240661B2 (en) Secure simultaneous authentication of equals anti-clogging mechanism
EP2905717A1 (en) Device and method for device and user authentication
CN115473655B (zh) 接入网络的终端认证方法、装置及存储介质
CN114553566B (zh) 数据加密方法、装置、设备及存储介质
KR102539418B1 (ko) Puf 기반 상호 인증 장치 및 방법
Corella et al. Strong and convenient multi-factor authentication on mobile devices
Culnane et al. Formalising Application-Driven Authentication & Access-Control based on Users’ Companion Devices
WO2023027730A1 (en) Authentication
CN115544583A (zh) 一种服务器密码机的数据处理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22891803

Country of ref document: EP

Kind code of ref document: A1