WO2024007122A1

WO2024007122A1 - Point-to-point secure communication method for internet of things

Info

Publication number: WO2024007122A1
Application number: PCT/CN2022/103689
Authority: WO
Inventors: 嵇旭辉
Original assignee: 嘉兴倍创网络科技有限公司
Priority date: 2022-07-04
Filing date: 2022-07-04
Publication date: 2024-01-11
Also published as: CN116982288A

Abstract

The present invention relates to a point-to-point secure communication method for the Internet of Things. The method is used for communication between a sending terminal and a receiving terminal in an Internet of Things system, and comprises the following steps: S1: encrypting data information to be sent, and generating an encryption key and a key exchange protocol; S2: generating a random key, and encrypting the encryption key and the key exchange protocol by using the random key; S3: signing the unencrypted encryption key by means of a signature private key of a sending terminal to obtain signature data; S4: sending a communication request to a receiving terminal, and establishing a secure information channel by means of a three-way handshake with the receiving terminal; S5: sending the encrypted data information and encryption key as well as the random key and the signature data to the receiving terminal by means of the secure information channel; and S6: the receiving terminal determining the integrity of the received data, and decrypting the data information. Compared with the prior art, the present invention has the advantages of improving information security and the like.

Description

A point-to-point secure communication method for the Internet of Things

Technical field

The invention relates to the field of Internet of Things and information communication security, and in particular to a point-to-point secure communication method for the Internet of Things.

Background technique

With the vigorous development of IoT technology, IoT terminals have entered all walks of life and thousands of households, and their number has also grown exponentially. At the same time, with the rapid development of edge computing, IoT terminal devices also have varying degrees of intelligence. Or intelligent, and the storage space is also increasing. Data information security and communication security on IoT terminals have also attracted much attention. Currently, the more common methods of wireless communication between IoT terminals are Bluetooth, NFC and Wi-Fi. These wireless communication technologies have brought great benefits to people’s daily lives. It provides great convenience, but how to ensure the security of data information of Internet of Things terminal equipment and the security of data information communication has become a big problem. The current method mainly ensures it by installing various anti-virus and anti-virus software on the terminal. The data information stored in the IoT terminal equipment is safe, but this can only ensure that the IoT terminal equipment is safe within a certain range. How can the data information stored on the IoT terminal be read safely and quickly, or how can the data information stored on the IoT terminal be read safely and quickly? The terminal performs localized control in order to achieve rapid localized data analysis and local monitoring and debugging. Especially in environments with narrow wireless network bandwidth, it becomes very important to adopt point-to-point secure data transmission.

Contents of the invention

The purpose of the present invention is to provide a point-to-point secure communication method for the Internet of Things in order to overcome the shortcomings of the above-mentioned existing technologies.

The object of the present invention can be achieved through the following technical solutions:

An Internet of Things point-to-point secure communication method, which is used for communication between a sending terminal and a receiving terminal in an Internet of Things system, and includes the following steps:

S1: The sending terminal encrypts the data information to be sent, and generates an encryption key and a key exchange protocol;

S2: Generate a random key and use the random key to encrypt the encryption key and key exchange protocol;

S3: The sending terminal signs the unencrypted encryption key using the signing private key of the sending terminal to obtain signature data;

S4: The sending terminal sends a communication request to the receiving terminal, and establishes a secure information channel through a three-way handshake with the receiving terminal;

S5: The sending terminal sends the encrypted data information, encryption key, random key and signature data to the receiving terminal through the secure information channel;

S6: The receiving terminal confirms the integrity of the received data. If the confirmation is correct, the data information is decrypted to obtain unencrypted data information.

Further, the encryption process specifically includes: obtaining the data content, security level and storage location of the data information to be sent in the sending terminal, packaging it into an initial data value, and encrypting the initial data value using an encryption key.

Further, the three-way handshake specifically includes:

The first handshake includes the following steps: first, the sending terminal sends a communication request carrying its own unique device identification code to start the first handshake; then, the receiving terminal sends back its own unique device identification code while receiving the request, When the sending terminal receives the unique device identification code of the receiving terminal, the first handshake is completed;

The second handshake includes the following steps: first, the sending terminal and the receiving terminal obtain the identity authentication information of the other party based on the received unique device identification code of the other party; then send the identity authentication information obtained by each other to each other and compare the received identity The authentication information is parsed and the second handshake is completed;

The third handshake includes the following steps: the sending terminal and the receiving terminal respectively verify the received identity authentication information sent by the other party. If the verification does not match, the information transmission is terminated; if the verification matches, the third handshake is completed. Three-way handshake to establish a secure information channel.

Furthermore, in the second handshake, the sending terminal and the receiving terminal obtain the identity authentication information of the other party based on the received unique device identification code of the other party, which specifically includes:

First, the sending terminal and the receiving terminal respectively send the received unique device identification code of the other party to the cloud authentication center; then the cloud authentication center performs legality authentication based on the received unique device identification code. If the legality authentication If it passes, the cloud authentication center will return the identity authentication information corresponding to the unique device identification code, otherwise the authentication will be terminated.

Furthermore, in the third handshake, the identity authentication information is verified as follows: first, parsing the own identity authentication information sent by the other party; then obtaining the own identity authentication information through the cloud authentication center and parsing it; finally Match and verify the identity authentication information sent by the other party with the content of the identity authentication information obtained through the cloud authentication center.

Further, the identity authentication information includes a communication level and a secure transmission key, and the matching verification is a verification of the communication level and the secure transmission key.

Furthermore, in the first handshake, when the receiving terminal receives the request, it first verifies that the received unique device identification code does not overlap with its own unique device identification code, and then sends back its own unique device identification code. .

Furthermore, in the third handshake, when the verification matches, the sending terminal and the receiving terminal again send each other the obtained communication level and secure transmission key, and finally complete the third handshake and establish security. information channel.

Compared with the prior art, the present invention has the following advantages:

1) The present invention solves the problem that the secure transmission, analysis and terminal control of real-time data cannot be realized when the Internet of Things terminal communication rate is low and the computing power is weak. It realizes point-to-point secure communication between Internet of Things terminals and can be widely used. In various IoT systems, the application prospects are extremely broad and of great significance;

2) The present invention uses the generated random key to encrypt the encryption key and the key exchange protocol, and uses the signature private key of the sending terminal to sign the unencrypted encryption key, and combines the encrypted data information with the encrypted The key, random key and signature data are sent to the receiving terminal, which improves the security of the information data and can adapt to long-distance and short-distance transmission, making the secure communication of data information have a wide range of application, strong autonomy and easy management, etc. advantage;

3) The present invention establishes a secure information channel through the three-way handshake of the sending terminal and the receiving terminal, realizes the matching and security authentication of point-to-point communication between the sending terminal and the receiving terminal, and solves the current point-to-point communication problem of lack of uniqueness for the request response active party and the reply request response terminal. The link verification check problem overcomes the risk of theft of responses from unknown servers in point-to-point communication.

Description of the drawings

Figure 1 is a schematic flow diagram of the present invention;

Figure 2 is a schematic flow chart of the three-way handshake between the sending terminal and the receiving terminal.

Detailed ways

The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts should fall within the scope of protection of the present invention.

As shown in Figures 1 and 2, the present invention provides a point-to-point secure communication method for the Internet of Things. The method is used for communication between the sending terminal and the receiving terminal in the Internet of Things system, and includes the following steps:

S1: The sending terminal encrypts the data information to be sent and generates the encryption key and key exchange protocol;

S3: The sending terminal signs the unencrypted encryption key with the sending terminal's signature private key to obtain the signature data;

Among them, the encryption process specifically includes: obtaining the data content, security level and storage location of the data information to be sent in the sending terminal, packaging it into an initial data value, and using the encryption key to encrypt the initial data value.

The encryption key and key exchange protocol are encrypted using the generated random key, and the unencrypted encryption key is signed using the signature private key of the sending terminal, and the encrypted data information, encryption key and random The key and signature data are sent to the receiving terminal, which improves the security of the information data and can adapt to long-distance and short-distance transmission, making the secure communication of data information have the advantages of wide application range, strong autonomy and easy management; solved Problems such as rapid transmission, analysis and terminal control of real-time data cannot be achieved when the communication rate of IoT terminals is low and the computing power is weak. Point-to-point secure communication between IoT terminals is realized.

As shown in Figure 2, the three-way handshake specifically includes:

The first handshake includes the following steps: first, the sending terminal sends a communication request carrying its own unique device identification code to start the first handshake; then, the receiving terminal receives the request and returns its own unique device identification code. When the sending terminal receives the When the terminal’s unique device identification code is received, the first handshake is completed;

The second handshake includes the following steps: first, the sending terminal and the receiving terminal obtain the identity authentication information of the other party based on the received unique device identification code of the other party; then send the identity authentication information obtained by each other to each other and perform the received identity authentication information. Parse and complete the second handshake;

The third handshake includes the following steps: the sending terminal and the receiving terminal respectively verify the received identity authentication information sent by the other party. If the verification does not match, the information transmission is terminated; if the verification matches, the third handshake is completed. , establish a secure information channel. The identity authentication information includes the communication level and the secure transmission key, and the matching verification is the verification of the communication level and the secure transmission key.

Among them, in the first handshake, when the receiving terminal receives the request, it first verifies that the unique device identification code received does not overlap with its own unique device identification code, and then sends back its own unique device identification code.

In the second handshake, the sending terminal and the receiving terminal obtain the identity authentication information of the other party based on the received unique device identification code of the other party, including:

First, the sending terminal and the receiving terminal respectively send the received unique device identification code to the cloud authentication center; then the cloud authentication center performs legality authentication based on the received unique device identification code. If the legality authentication passes, the cloud authentication center Return the identity authentication information corresponding to the unique device identification code, otherwise the authentication will be terminated.

In the third handshake, the verification of the identity authentication information is as follows: first, parsing the own identity authentication information sent by the other party; then obtaining the own identity authentication information through the cloud authentication center and parsing it; finally, parsing the own identity authentication information sent by the other party. The information is matched with the content of the identity authentication information obtained through the cloud authentication center. And when the verification matches, the sending terminal and the receiving terminal send each other the obtained communication level and secure transmission key again, and finally complete the third handshake and establish a secure information channel.

A secure information channel is established through the three-way handshake between the sending terminal and the receiving terminal to realize the matching and security authentication of the point-to-point communication between the sending terminal and the receiving terminal, and solve the link verification check that lacks the uniqueness of the current point-to-point communication for the request response active party and the reply request response terminal. It overcomes the risk of theft of responses from unfamiliar servers in point-to-point communications.

The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any worker familiar with the technical field can easily think of various equivalent methods within the technical scope disclosed in the present invention. Modifications or substitutions shall be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

A point-to-point secure communication method for the Internet of Things, characterized in that the method is used for communication between a sending terminal and a receiving terminal in an Internet of Things system, and includes the following steps:

S1: The sending terminal encrypts the data information to be sent, and generates an encryption key and a key exchange protocol;

S2: Generate a random key and use the random key to encrypt the encryption key and key exchange protocol;

S3: The sending terminal signs the unencrypted encryption key using the signing private key of the sending terminal to obtain signature data;

S4: The sending terminal sends a communication request to the receiving terminal, and establishes a secure information channel through a three-way handshake with the receiving terminal;

S5: The sending terminal sends the encrypted data information, encryption key, random key and signature data to the receiving terminal through the secure information channel;

S6: The receiving terminal confirms the integrity of the received data. If the confirmation is correct, the data information is decrypted to obtain unencrypted data information.
A point-to-point secure communication method for the Internet of Things according to claim 1, characterized in that the encryption process specifically includes: obtaining the data content, security level and storage location of the data information to be sent in the sending terminal, and packaging it into an initial data value and encrypt the initial data value using the encryption key.
A point-to-point secure communication method for the Internet of Things according to claim 1, characterized in that the three-way handshake specifically includes:

The first handshake includes the following steps: first, the sending terminal sends a communication request carrying its own unique device identification code to start the first handshake; then, the receiving terminal sends back its own unique device identification code while receiving the request, When the sending terminal receives the unique device identification code of the receiving terminal, the first handshake is completed;

The second handshake includes the following steps: first, the sending terminal and the receiving terminal obtain the identity authentication information of the other party based on the received unique device identification code of the other party; then send the identity authentication information obtained by each other to each other and compare the received identity The authentication information is parsed and the second handshake is completed;

The third handshake includes the following steps: the sending terminal and the receiving terminal respectively verify the received identity authentication information sent by the other party. If the verification does not match, the information transmission is terminated; if the verification matches, the third handshake is completed. Three-way handshake to establish a secure information channel.
A point-to-point secure communication method for the Internet of Things according to claim 3, characterized in that in the second handshake, the sending terminal and the receiving terminal obtain the other party's unique device identification code based on the received other party's unique device identification code. The identity authentication information specifically includes:

First, the sending terminal and the receiving terminal respectively send the received unique device identification code of the other party to the cloud authentication center; then the cloud authentication center performs legality authentication based on the received unique device identification code. If the legality authentication If it passes, the cloud authentication center will return the identity authentication information corresponding to the unique device identification code, otherwise the authentication will be terminated.
A point-to-point secure communication method in the Internet of Things according to claim 4, characterized in that in the third handshake, verifying the identity authentication information specifically includes: first parsing the self-identity authentication information sent by the other party. ; Then obtain its own identity authentication information through the cloud authentication center and analyze it; finally, match and verify the own identity authentication information sent by the other party and the content of its own identity authentication information obtained through the cloud authentication center.
A point-to-point secure communication method in the Internet of Things according to claim 5, wherein the identity authentication information includes a communication level and a secure transmission key, and the matching verification is a pair of the communication level and the secure transmission key. of verification.
A point-to-point secure communication method for the Internet of Things according to claim 3, characterized in that in the first handshake, when the receiving terminal receives the request, it first verifies the unique device identification code received and its own After the unique device identification code is no longer repeated, the unique device identification code will be returned.
A point-to-point secure communication method for the Internet of Things according to claim 6, characterized in that, in the third handshake, when the verification matches, the sending terminal and the receiving terminal send each other the communication obtained respectively. level and secure transmission key, and finally complete the third handshake to establish a secure information channel.