WO2024060696A1 - 一种基于tee的智能家居远程控制方法及相关装置 - Google Patents

一种基于tee的智能家居远程控制方法及相关装置 Download PDF

Info

Publication number
WO2024060696A1
WO2024060696A1 PCT/CN2023/099350 CN2023099350W WO2024060696A1 WO 2024060696 A1 WO2024060696 A1 WO 2024060696A1 CN 2023099350 W CN2023099350 W CN 2023099350W WO 2024060696 A1 WO2024060696 A1 WO 2024060696A1
Authority
WO
WIPO (PCT)
Prior art keywords
verification
identity
tee
user
information
Prior art date
Application number
PCT/CN2023/099350
Other languages
English (en)
French (fr)
Inventor
胡厚鹏
罗奕
高正浩
钱斌
欧家祥
周密
Original Assignee
贵州电网有限责任公司
南方电网科学研究院有限责任公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 贵州电网有限责任公司, 南方电网科学研究院有限责任公司 filed Critical 贵州电网有限责任公司
Publication of WO2024060696A1 publication Critical patent/WO2024060696A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2803—Home automation networks
    • H04L12/2816—Controlling appliance services of a home automation network by calling their functionalities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H04L67/125—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks involving control of end-device applications over a network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
    • Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
    • Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Definitions

  • This application relates to the field of smart home technology, and in particular to a TEE-based smart home remote control method and related devices.
  • Remote control smart home solutions have some common requirements, such as executability, resistance to man-in-the-middle attacks, resistance to replay attacks, and efficiency.
  • the requirements for existing smart home remote control technologies are also constantly improving, and the current technology Although it can meet some needs, it will sacrifice some needs at the same time, causing the smart home remote control process to be unable to take into account both attack resistance and efficiency.
  • This application provides a TEE-based smart home remote control method and related devices to solve the technical problem that existing smart home remote control technology cannot meet the requirements of attack resistance and efficiency at the same time.
  • the first aspect of this application provides a TEE-based smart home remote control method, including:
  • a randomly generated timestamp and identity verification information are sent to the remote sensor through the user terminal, where the identity verification information includes a time verification hash value and a matching pseudo-identity ID;
  • the remote sensor performs replay attack verification and identity legality verification respectively according to the timestamp and the identity verification information. If both verifications pass, a first shared key is generated and verification is sent to the user terminal. success message;
  • the user terminal generates a second shared key after receiving the verification success information, and performs instruction interaction with the remote sensor based on the first shared key and the second shared key, thereby realizing the verification.
  • Remote control of smart home devices
  • the TEE in the TrustZone architecture when the TEE in the TrustZone architecture is turned on, user legitimacy verification is performed through the user terminal based on the preset login information and the TEE stored login information, which also includes:
  • TEE in the TrustZone architecture When TEE in the TrustZone architecture is turned on, user information is registered on the remote sensor through the user terminal, and the user information includes user ID and user password;
  • the remote sensor generates a registered pseudo-identity ID, an identity hash verification value and a matching pseudo-identity ID based on the master key and the user information based on a hash algorithm;
  • the registered pseudo identity ID, the identity hash verification value and the matching pseudo identity ID are stored in the TEE system through the remote sensor to form TEE storage login information, and are simultaneously sent to the user terminal to complete user registration.
  • TEE in the TrustZone architecture when the TEE in the TrustZone architecture is turned on, user legitimacy verification is performed through the user terminal based on the preset login information and the TEE stored login information, including:
  • preset login information is sent to the remote sensor through the user terminal.
  • the preset login information includes the current user ID and the current user password;
  • Verify the current identity hash with the identity hash in the TEE stored login information The user's legality verification is performed in the form of comparison. If they are consistent, the verification passes.
  • the remote sensor performs replay attack verification and identity legitimacy verification respectively according to the timestamp and the identity verification information. If both verifications pass, a first shared key is generated and sent to all
  • verification success information including:
  • a first shared key with the user terminal is generated based on the remote sensor, and verification success information is sent to the user terminal.
  • the second aspect of this application provides a TEE-based smart home remote control device, including:
  • the login verification module is used to verify user legitimacy through the user terminal based on the preset login information and the TEE stored login information when the TEE in the TrustZone architecture is turned on;
  • An information sending module configured to send a randomly generated timestamp and identity verification information to the remote sensor through the user terminal if the user legitimacy check is passed.
  • the identity verification information includes a time verification hash value and Match pseudo identity ID;
  • a user verification module configured to perform replay attack verification and identity legitimacy verification through the remote sensor based on the timestamp and the identity verification information. If both verifications pass, generate a first shared key and send it to The user terminal sends verification success information;
  • a session control module configured to generate a second shared key through the user terminal after receiving the verification success information, and communicate with the remote sensor based on the first shared key and the second shared key. Interact with commands to achieve remote control of smart home devices.
  • it also includes:
  • Registration module used to register user information on the remote sensor through the user terminal when the TEE in the TrustZone architecture is turned on.
  • the user information includes the user ID and user password. code;
  • a computing module configured to generate a registered pseudo-identity ID, an identity hash verification value and a matching pseudo-identity ID based on the master key and the user information through the remote sensor based on a hash algorithm;
  • a storage module configured to store the registered pseudo identity ID, the identity hash verification value and the matching pseudo identity ID in the TEE system through the remote sensor to form TEE storage login information, and send it to the user terminal at the same time Complete user registration.
  • the login verification module is specifically used for:
  • preset login information is sent to the remote sensor through the user terminal.
  • the preset login information includes the current user ID and the current user password;
  • a user legitimacy check is performed by comparing the current identity hash value with the identity hash verification value in the TEE stored login information. If they are consistent, the verification passes.
  • the user verification module is specifically used for:
  • a first shared key with the user terminal is generated based on the remote sensor, and verification success information is sent to the user terminal.
  • the third aspect of this application provides a TEE-based smart home remote control device, which includes a processor and a memory;
  • the memory is used to store program code and transmit the program code to the processor
  • the processor is configured to execute the TEE-based smart home remote control method described in the first aspect according to instructions in the program code.
  • the fourth aspect of this application provides a computer-readable storage medium, the computer-readable storage medium is used to store program code, and the program code is used to execute the TEE-based smart home remote control method described in the first aspect.
  • a TEE-based smart home remote control method including: when the TEE in the TrustZone architecture is turned on, user legitimacy verification is performed through the user terminal based on the preset login information and the TEE stored login information; If the user legitimacy check is passed, the randomly generated timestamp and identity verification information are sent to the remote sensor through the user terminal.
  • the identity verification information includes the time verification hash value and matching pseudo identity ID; through the remote sensor based on the timestamp and identity verification information for replay attack verification and identity legality verification respectively. If both verifications pass, the first shared key is generated and verification success information is sent to the user terminal; after receiving the verification success information, the user terminal generates a third shared key. two shared keys, and performs instruction interaction with the remote sensor based on the first shared key and the second shared key to achieve remote control of the smart home device.
  • the TEE-based smart home remote control method implements user identity verification through user login information to ensure that the controller is a legitimate user before communication, which can meet the verifiability requirements; and based on user-generated Replay attack verification and identity legality verification using timestamps and identity verification information can resist replay attacks and avoid wasting system resources, and can also resist user simulation attacks and avoid illegal behaviors; moreover, the entire technical solution is carried out in the TEE environment, and information is transmitted It cannot be attacked or intercepted during the storage process, further ensuring the security of the data; in addition, no other additional encryption algorithms and operating methods are involved in this process, and the process is simple and easy to implement, with a certain degree of efficiency. Therefore, this application can solve the technical problem that existing smart home remote control technology cannot meet the requirements of attack resistance and efficiency at the same time.
  • FIG. 1 is a schematic flow chart of a TEE-based smart home remote control method provided by an embodiment of the present application
  • FIG. 2 is a schematic structural diagram of a TEE-based smart home remote control device provided by an embodiment of the present application
  • FIG. 3 is a schematic diagram of smart home remote control under TEE provided by the embodiment of this application.
  • FIG. 4 is a schematic diagram of the TrustZone architecture of different Cortex provided by the embodiment of this application.
  • This application provides an embodiment of a TEE-based smart home remote control method, including:
  • Step 101 When the TEE in the TrustZone architecture is turned on, user legitimacy is verified through the user terminal based on the preset login information and the TEE stored login information.
  • step 101 includes:
  • the preset login information includes the current user ID and the current user password;
  • User legitimacy verification is performed by comparing the current identity hash value with the identity hash verification value in the TEE stored login information. If they are consistent, the verification passes.
  • the TEE-based smart home remote control system can be described as shown in Figure 3.
  • Cortex processors are implanted on remote sensors and user terminals, such as smartphones, and then the TrustZone architecture is deployed.
  • the TrustZone architecture isolates a secure world through hardware. , and provides a TEE system.
  • By saving the confidential data of the user terminal in the TEE built based on TrustZone even if the hacker fully controls the operating system in the REE (Rich Execution Environment), these confidential data cannot be obtained.
  • different Cortex-A processors have certain differences in the deployed TrustZone architecture.
  • Figure 4 shows a schematic diagram of the TrustZone architecture based on Cortex-A and Cortex-M.
  • the user terminal Before session construction or communication, start the TEE in the TrustZone architecture and start When a session is generated, the user terminal can request login according to the preset login, that is, request the remote sensor to verify the validity of the user's identity; the verification process of the remote sensor is not only based on the preset login information, but also requires login with TEE storage Information is used as the basis for hash calculation and numerical comparison. Since the information stored in the TEE system cannot be obtained by external attack targets, the security and reliability of the verification process can be guaranteed to a large extent.
  • step 101 also includes:
  • User information When TEE in the TrustZone architecture is turned on, user information is registered on the remote sensor through the user terminal.
  • User information includes user ID and user password;
  • the remote sensor generates registration pseudo-identity ID, identity hash verification value and matching pseudo-identity ID based on the master key and user information based on the hash algorithm;
  • the registered pseudo-identity ID, identity hash verification value and matching pseudo-identity ID are stored in the TEE system through the remote sensor to form the TEE storage login information, and are simultaneously sent to the user terminal to complete user registration.
  • the remote sensor In addition to receiving the registered user information sent by the user terminal, the remote sensor also needs to perform operations such as calculation, information storage and sending.
  • the registered pseudo-identity ID that is, UIDi
  • the matching pseudo-identity ID is a piece of information generated based on the user ID that matches the registered pseudo-identity ID.
  • the generated registration pseudo-identity ID, identity hash verification value and matching pseudo-identity ID not only need to be stored in the TEE system to form the TEE to store login information, but also need to be sent to the user terminal to complete the process. Complete the user registration process.
  • Step 102 If the user legitimacy check is passed, the randomly generated timestamp and identity verification information are sent to the remote sensor through the user terminal.
  • the identity verification information includes the time verification hash value and the matching pseudo identity ID.
  • the subsequent session key establishment phase can be performed.
  • the randomly generated timestamp of the user terminal can be hashed to generate a time verification hash value to participate in the subsequent key negotiation verification, and the user terminal receives data from the remote
  • the matching pseudo-identity ID sent by the end sensor can also be sent to the remote sensor together with the timestamp and time verification hash value.
  • the reason why the matching pseudo-identity ID is also sent to the remote sensor together with the matching pseudo-identity ID is to confirm that the user terminal has received the message from the remote sensor.
  • the information sent by the sensor can be used to confirm that the received information is correct, that is, it has not been tampered with or replaced.
  • the time verification hash value A1 and the matching pseudo identity ID, that is, RIDi, are sent to the remote sensor.
  • Step 103 Use the remote sensor to perform replay attack verification and identity validity verification respectively based on the timestamp and identity verification information. If both verifications pass, generate a first shared key and send verification success information to the user terminal.
  • step 103 includes:
  • a first shared key with the user terminal is generated based on the remote sensor, and verification success information is sent to the user terminal.
  • the verification process of the remote sensor mainly includes two parts. One part is the time-based replay attack verification, and the other part is the identity legitimacy verification based on the identity verification information. Only when both verification processes are passed can the verification be successful and the verification process can be generated. The shared secret key of the two interactive parties and send the verification Successful verification news.
  • the replay attack verification process is determined based on the timestamp T1 and the time threshold range, that is, the difference is calculated based on the preset reference value Tc and the timestamp T1. If the value of Tc-T1 is within the time threshold range, it means If there is no replay attack, the verification passes, otherwise the sensor stops operating. It can be understood that the time threshold range and the preset reference value are configured according to the actual situation and are not limited here.
  • the identity legitimacy verification process is performed after the replay attack verification is passed.
  • the corresponding registered pseudo-identity ID is searched in the TEE system based on the matching pseudo-identity ID in the identity verification information, and then the registered pseudo-identity ID and timestamp are found.
  • the shared key refers to the shared key for interaction between the user terminal and the remote sensor.
  • the remote sensor directly generates the first shared key after verification, and at the same time sends verification success information to the user terminal. At this point, the remote sensor completes the session establishment task.
  • Step 104 The user terminal generates a second shared key after receiving the verification success information, and performs instruction interaction with the remote sensor based on the first shared key and the second shared key to realize remote control of the smart home device.
  • the user terminal After receiving the verification success information, the user terminal can also directly generate the second shared key. At this point, the user terminal completes the session establishment task. Thereafter, the user terminal and the remote sensor can communicate through the first shared key and the second shared key, that is, control command interaction, thereby realizing remote control of the smart home device.
  • the first shared key and the second shared key are both interactive keys between the user terminal and the remote sensor. They are matching keys of the same nature and can realize free encryption and decryption operations. Since the important information of the key negotiation between the user terminal and the remote sensor is stored in the TEE system and is conducted in the TEE environment, the shared key can resist various attacks and third parties cannot obtain the private information. It is also impossible to intercept or tamper with information by attacking a certain party, ensuring the security and reliability of the key interaction process.
  • this application provides a specific comparison case.
  • the comparison object is an existing smart home remote control solution.
  • the specific comparison results are shown in Tables 1 and 2.
  • the TEE-based smart home remote control method verifies the legitimacy of the user identity through the user login information, ensuring that the controller is verified to be a legitimate user before communication, and can meet the verifiability requirements; and replay attack verification and identity legitimacy verification based on the timestamp and identity authentication information generated by the user can resist replay attacks to avoid waste of system resources, and can also resist user simulation attacks to avoid illegal behavior; moreover, the entire technical solution is carried out in the TEE environment, and the information cannot be attacked or intercepted during the transmission and storage process, further ensuring the security of the data; in addition, no other additional encryption algorithms and operating methods are involved in this process, the process is simple and easy to implement, and has a certain degree of efficiency. Therefore, the embodiment of the present application can solve the technical problem that the existing smart home remote control technology cannot meet the requirements of anti-attack and high efficiency at the same time.
  • TEE-based smart home remote control device including:
  • the login verification module 201 is used to perform user legitimacy verification through the user terminal based on the preset login information and the TEE stored login information when the TEE in the TrustZone architecture is turned on. test;
  • the information sending module 202 is used to send the randomly generated timestamp and identity verification information to the remote sensor through the user terminal if the user legitimacy check is passed.
  • the identity verification information includes the time verification hash value and the matching pseudo identity ID;
  • the user verification module 203 is used to conduct replay attack verification and identity validity verification respectively through the remote sensor based on the timestamp and identity verification information. If both verifications pass, generate a first shared key and send a verification success message to the user terminal. information;
  • the session control module 204 is configured to generate a second shared key through the user terminal after receiving the verification success information, and perform command interaction with the remote sensor based on the first shared key and the second shared key to implement control of the smart home device. remote control.
  • the registration module 205 is used to register user information on the remote sensor through the user terminal when the TEE in the TrustZone architecture is turned on.
  • the user information includes the user ID and user password;
  • the computing module 206 is configured to generate a registered pseudo-identity ID, an identity hash verification value and a matching pseudo-identity ID based on the master key and user information through a remote sensor based on a hash algorithm;
  • the storage module 207 is used to store the registered pseudo identity ID, identity hash verification value and matching pseudo identity ID in the TEE system through the remote sensor to form the TEE storage login information, and at the same time send it to the user terminal to complete user registration.
  • login verification module 201 is specifically used for:
  • the preset login information includes the current user ID and the current user password;
  • User legitimacy verification is performed by comparing the current identity hash value with the identity hash verification value in the TEE stored login information. If they are consistent, the verification passes.
  • the user verification module 203 is specifically used for:
  • a first shared key with the user terminal is generated based on the remote sensor, and verification success information is sent to the user terminal.
  • This application also provides a TEE-based smart home remote control device, which includes a processor and a memory;
  • Memory is used to store program code and transmit the program code to the processor
  • the processor is configured to execute the TEE-based smart home remote control method in the above method embodiment according to instructions in the program code.
  • This application also provides a computer-readable storage medium.
  • the computer-readable storage medium is used to store program codes.
  • the program codes are used to execute the TEE-based smart home remote control method in the above method embodiment.
  • the disclosed devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the above integrated units can be implemented in the form of hardware or software functional units.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions for executing all or part of the steps of the methods described in various embodiments of the application through a computer device (which can be a personal computer, a server, or a network device, etc.).
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (English full name: Read-Only Memory, English abbreviation: ROM), random access memory (English full name: Random Access Memory, English abbreviation: RAM), magnetic Various media such as discs or optical discs that can store program code.

Abstract

一种基于TEE的智能家居远程控制方法及相关装置，涉及智能家居技术领域，方法包括：在开启TEE的情况下，通过用户终端根据预置登录信息与TEE存储登录信息进行用户合法性校验；若通过用户合法性校验，则通过用户终端将随机生成的时间戳和身份验证信息发送给远端传感器；通过远端传感器根据时间戳和身份验证信息分别进行重放攻击验证和身份合法性验证，若是验证均通过，则生成第一共享密钥，并向用户终端发送验证成功信息；通过用户终端在接收到验证成功信息后生成第二共享密钥，并基于第一共享密钥和第二共享密钥与远端传感器进行指令交互控制。本申请解决了现有智能家居远程控制技术无法同时满足抗攻击性和高效性需求的技术问题。

Description

一种基于TEE的智能家居远程控制方法及相关装置
本申请要求于2022年9月20日提交中国专利局、申请号为202211144330.9、发明名称为“一种基于TEE的智能家居远程控制方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及智能家居技术领域，尤其涉及一种基于TEE的智能家居远程控制方法及相关装置。
背景技术
随着社会经济体系的不断更新，信息技术的不断提升以及物联网的迅速发展，人们对家居环境也提出了更高的要求。越来越多的家庭不仅要求家居环境的智能化，而且对家居环境的安全性提出了更高的要求。人们对智能家居的远程控制是通过各类传感设备来接纳各类传感信号，并触发控制命令来实现的。近年来，远程控制智能家居因其便利性受到人们广泛关注和推崇。虽然有许多远程控制智能家居的方案，但是随着科技的发展，远程控制智能家居对方案提出了更严格的安全性和效率要求。
远程控制智能家居方案有一些常见的要求，如可执行性、抗中间人攻击性、抗重放攻击性以及效率性等，现有的智能家居远程控制技术的要求也在不断提高，而当前的技术虽然能够满足一些需求，但是同时就会牺牲某些需求，导致智能家居远程控制过程无法同时兼顾抗攻击性和高效性。
发明内容
本申请提供了一种基于TEE的智能家居远程控制方法及相关装置，用于解决现有智能家居远程控制技术无法同时满足抗攻击性和高效性需求的技术问题。
有鉴于此，本申请第一方面提供了一种基于TEE的智能家居远程控制方法，包括：
在开启TrustZone架构中的TEE的情况下，通过用户终端根据预置登录信息与TEE存储登录信息进行用户合法性校验；
若通过所述用户合法性校验，则通过所述用户终端将随机生成的时间戳和身份验证信息发送给远端传感器，所述身份验证信息包括时间验证哈希值和匹配伪身份ID；
通过所述远端传感器根据所述时间戳和所述身份验证信息分别进行重放攻击验证和身份合法性验证，若是验证均通过，则生成第一共享密钥，并向所述用户终端发送验证成功信息；
通过所述用户终端在接收到所述验证成功信息后生成第二共享密钥，并基于所述第一共享密钥和所述第二共享密钥与所述远端传感器进行指令交互，实现对智能家居设备的远程控制。
优选地，所述在开启TrustZone架构中的TEE的情况下，通过用户终端根据预置登录信息与TEE存储登录信息进行用户合法性校验，之前还包括：
在开启TrustZone架构中的TEE的情况下，通过用户终端在远端传感器上注册用户信息，所述用户信息包括用户ID和用户密码；
通过所述远端传感器基于哈希算法根据主密钥和所述用户信息生成注册伪身份ID、身份哈希验证值和匹配伪身份ID；
通过所述远端传感器将所述注册伪身份ID、所述身份哈希验证值和所述匹配伪身份ID存储在TEE系统形成TEE存储登录信息，同时发送至所述用户终端完成用户注册。
优选地，所述在开启TrustZone架构中的TEE的情况下，通过用户终端根据预置登录信息与TEE存储登录信息进行用户合法性校验，包括：
在开启TrustZone架构中的TEE的情况下，通过用户终端向远端传感器发送预置登录信息，所述预置登录信息包括当前用户ID和当前用户密码；
通过所述远端传感器根据所述预置登录信息和TEE存储登录信息中的所述注册伪身份ID计算当前身份哈希值；
将所述当前身份哈希值与TEE存储登录信息中的所述身份哈希验证 值进行对比形式的用户合法性校验，若一致则检验通过。
优选地，所述通过所述远端传感器根据所述时间戳和所述身份验证信息分别进行重放攻击验证和身份合法性验证，若是验证均通过，则生成第一共享密钥，并向所述用户终端发送验证成功信息，包括：
通过所述远端传感器根据所述时间戳和时间阈值范围进行重放攻击验证；
在通过所述重放攻击验证后，根据所述匹配伪身份ID查找对应的注册伪身份ID；
依据查找到的所述注册伪身份ID和所述时间戳计算当前时间哈希值，并将所述当前时间哈希值与所述时间验证哈希值进行对比验证，若一致，则身份合法性验证通过；
在通过所述身份合法性验证后，基于所述远端传感器生成与所述用户终端之间的第一共享密钥，并向所述用户终端发送验证成功信息。
本申请第二方面提供了一种基于TEE的智能家居远程控制装置，包括：
登录校验模块，用于在开启TrustZone架构中的TEE的情况下，通过用户终端根据预置登录信息与TEE存储登录信息进行用户合法性校验；
信息发送模块，用于若通过所述用户合法性校验，则通过所述用户终端将随机生成的时间戳和身份验证信息发送给远端传感器，所述身份验证信息包括时间验证哈希值和匹配伪身份ID；
用户验证模块，用于通过所述远端传感器根据所述时间戳和所述身份验证信息分别进行重放攻击验证和身份合法性验证，若是验证均通过，则生成第一共享密钥，并向所述用户终端发送验证成功信息；
会话控制模块，用于通过所述用户终端在接收到所述验证成功信息后生成第二共享密钥，并基于所述第一共享密钥和所述第二共享密钥与所述远端传感器进行指令交互，实现对智能家居设备的远程控制。
优选地，还包括：
注册模块，用于在开启TrustZone架构中的TEE的情况下，通过用户终端在远端传感器上注册用户信息，所述用户信息包括用户ID和用户密 码；
计算模块，用于通过所述远端传感器基于哈希算法根据主密钥和所述用户信息生成注册伪身份ID、身份哈希验证值和匹配伪身份ID；
存储模块，用于通过所述远端传感器将所述注册伪身份ID、所述身份哈希验证值和所述匹配伪身份ID存储在TEE系统形成TEE存储登录信息，同时发送至所述用户终端完成用户注册。
优选地，所述登录校验模块，具体用于：
在开启TrustZone架构中的TEE的情况下，通过用户终端向远端传感器发送预置登录信息，所述预置登录信息包括当前用户ID和当前用户密码；
通过所述远端传感器根据所述预置登录信息和TEE存储登录信息中的所述注册伪身份ID计算当前身份哈希值；
将所述当前身份哈希值与TEE存储登录信息中的所述身份哈希验证值进行对比形式的用户合法性校验，若一致则检验通过。
优选地，所述用户验证模块，具体用于：
通过所述远端传感器根据所述时间戳和时间阈值范围进行重放攻击验证；
在通过所述重放攻击验证后，根据所述匹配伪身份ID查找对应的注册伪身份ID；
依据查找到的所述注册伪身份ID和所述时间戳计算当前时间哈希值，并将所述当前时间哈希值与所述时间验证哈希值进行对比验证，若一致，则身份合法性验证通过；
在通过所述身份合法性验证后，基于所述远端传感器生成与所述用户终端之间的第一共享密钥，并向所述用户终端发送验证成功信息。
本申请第三方面提供了一种基于TEE的智能家居远程控制设备，所述设备包括处理器以及存储器；
所述存储器用于存储程序代码，并将所述程序代码传输给所述处理器；
所述处理器用于根据所述程序代码中的指令执行第一方面所述的基于TEE的智能家居远程控制方法。
本申请第四方面提供了一种计算机可读存储介质，所述计算机可读存储介质用于存储程序代码，所述程序代码用于执行第一方面所述的基于TEE的智能家居远程控制方法。
从以上技术方案可以看出，本申请实施例具有以下优点：
本申请中，提供了一种基于TEE的智能家居远程控制方法，包括：在开启TrustZone架构中的TEE的情况下，通过用户终端根据预置登录信息与TEE存储登录信息进行用户合法性校验；若通过用户合法性校验，则通过用户终端将随机生成的时间戳和身份验证信息发送给远端传感器，身份验证信息包括时间验证哈希值和匹配伪身份ID；通过远端传感器根据时间戳和身份验证信息分别进行重放攻击验证和身份合法性验证，若是验证均通过，则生成第一共享密钥，并向用户终端发送验证成功信息；通过用户终端在接收到验证成功信息后生成第二共享密钥，并基于第一共享密钥和第二共享密钥与远端传感器进行指令交互，实现对智能家居设备的远程控制。
本申请提供的基于TEE的智能家居远程控制方法，通过用户登录信息实现用户身份合法性的校验，确保在通信之前验证出操控方是合法用户，能够满足可验证性需求；而基于用户生成的时间戳和身份验证信息进行重放攻击验证和身份合法验证则可以抵抗重放攻击避免系统资源浪费，也可以抵抗用户模拟攻击避免非法行为；而且，整个技术方案在TEE环境中进行，信息在传输存储过程中无法被攻击或者截取，进一步确保了数据的安全性；此外，在此过程中没有涉及到其他额外加密算法和操作手段，过程简单易实现，具有一定的高效性。因此，本申请能够解决现有智能家居远程控制技术无法同时满足抗攻击性和高效性需求的技术问题。
附图说明
图1为本申请实施例提供的一种基于TEE的智能家居远程控制方法的流程示意图；
图2为本申请实施例提供的一种基于TEE的智能家居远程控制装置的结构示意图；
图3为本申请实施例提供的TEE下的智能家居远程控制示意图；
图4为本申请实施例提供的不同Cortex的TrustZone架构示意图。
具体实施方式
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
为了便于理解，请参阅图1，本申请提供的一种基于TEE的智能家居远程控制方法的实施例，包括：
步骤101、在开启TrustZone架构中的TEE的情况下，通过用户终端根据预置登录信息与TEE存储登录信息进行用户合法性校验。
进一步地，步骤101，包括：
在开启TrustZone架构中的TEE的情况下，通过用户终端向远端传感器发送预置登录信息，预置登录信息包括当前用户ID和当前用户密码；
通过远端传感器根据预置登录信息和TEE存储登录信息中的注册伪身份ID计算当前身份哈希值；
将当前身份哈希值与TEE存储登录信息中的身份哈希验证值进行对比形式的用户合法性校验，若一致则检验通过。
基于TEE的智能家居远程控制的系统可以描述为如图3所示，在远端传感器和用户终端，例如智能手机上植入Cortex处理器，然后部署TrustZone架构，TrustZone架构通过硬件隔离出的安全世界，并提供TEE系统，通过将用户终端的机密数据保存在基于TrustZone构建的TEE中，即使黑客完全控制了REE(Rich Execution Environment)中的操作系统，也无法获取这些机密数据。其中Cortex-A处理器不同，部署的TrustZone架构也存在一定差异，具体请参阅图4，给出基于Cortex-A和Cortex-M的TrustZone架构示意图。
在进行会话构建或者通信之前，开启TrustZone架构中的TEE，开始 产生会话，用户终端可以根据预置登录进行请求登录，也就是请求远端传感器进行用户身份合法性的校验；而远端传感器的校验过程不仅基于预置登录信息，还需要以TEE存储登录信息为基准进行哈希计算和数值对比，由于TEE系统中存储的信息无法被外来攻击目标获取到，所以能够较大程度的保障验证过程的安全性和可靠性。
需要说明的是，TEE存储登录信息中的注册伪身份ID和身份哈希验证值均是用户在注册阶段存入TEE系统中的，可以直接取出进行计算和对比验证，对比验证一致则用户合法性校验通过，否则校验失败，判断用户终端为非法身份，终止运行。若采用IDi表示当前用户ID，用PWi表示当前用户密码，UIDi表示注册伪身份ID，那么当前身份哈希值可以计算为V'＝h(IDi||PWi||UIDi)，那么身份哈希验证值可以表示为V，若V'与V一致，则校验通过。
进一步地，步骤101，之前还包括：
在开启TrustZone架构中的TEE的情况下，通过用户终端在远端传感器上注册用户信息，用户信息包括用户ID和用户密码；
通过远端传感器基于哈希算法根据主密钥和用户信息生成注册伪身份ID、身份哈希验证值和匹配伪身份ID；
通过远端传感器将注册伪身份ID、身份哈希验证值和匹配伪身份ID存储在TEE系统形成TEE存储登录信息，同时发送至用户终端完成用户注册。
用户终端与远端传感器交互认证之前还需要进行用户身份注册，远端传感器除了接收用户终端发送的注册用户信息之外，还需要进行计算和信息存储发送等操作。其中注册伪身份ID，即UIDi是根据远端传感器中的主密钥和用户ID进行哈希计算得到的，而匹配伪身份ID，是根据用户ID生成的一个与注册伪身份ID匹配的信息，表达为RIDi；身份哈希验证值V则是根据用户ID、用户密码和注册伪身份ID进行哈希计算得到的，具体表述为V＝h(IDi||PWi||UIDi)。
生成的注册伪身份ID、身份哈希验证值和匹配伪身份ID除了需要存储在TEE系统中，形成TEE存储登录信息，还需要发送至用户终端，完 成用户注册过程。
步骤102、若通过用户合法性校验，则通过用户终端将随机生成的时间戳和身份验证信息发送给远端传感器，身份验证信息包括时间验证哈希值和匹配伪身份ID。
用户合法性校验通过则可以执行后续的建立会话密钥阶段，用户终端随机生成的时间戳可以通过哈希计算生成一个时间验证哈希值参与后续的密钥协商验证，而用户终端接收来自远端传感器发送的匹配伪身份ID也可以与时间戳和时间验证哈希值一并发送给远端传感器，之所以还携带匹配伪身份ID一起发送给远端传感器是为了证实用户终端收到了远端传感器发送的信息，且可以用于证实接收到的信息无误，即未被篡改、替换。若是时间戳表示为T1，那么基于时间戳生成的时间验证哈希值可以表达为A1＝h(UIDi||T1)，即根据时间戳和注册伪身份ID计算得到，进而可以将时间戳T1、时间验证哈希值A1和匹配伪身份ID，即RIDi一并发送至远端传感器。
步骤103、通过远端传感器根据时间戳和身份验证信息分别进行重放攻击验证和身份合法性验证，若是验证均通过，则生成第一共享密钥，并向用户终端发送验证成功信息。
进一步地，步骤103，包括：
通过远端传感器根据时间戳和时间阈值范围进行重放攻击验证；
在通过重放攻击验证后，根据匹配伪身份ID查找对应的注册伪身份ID；
依据查找到的注册伪身份ID和时间戳计算当前时间哈希值，并将当前时间哈希值与时间验证哈希值进行对比验证，若一致，则身份合法性验证通过；
在通过身份合法性验证后，基于远端传感器生成与用户终端之间的第一共享密钥，并向用户终端发送验证成功信息。
远端传感器的验证过程主要包括两个部分，一个部分是基于时间的重放攻击验证，一个部分是基于身份验证信息的身份合法性验证；两个验证过程均通过才算验证成功，才可以生成两个交互端的共享密钥，并发送验 证成功的消息。
具体的，重放攻击验证过程是基于时间戳T1和时间阈值范围进行判定的，即根据预设基准值Tc和时间戳T1计算差值，若是Tc-T1的值在时间阈值范围内，则说明没有遭受重放攻，验证通过，否则传感器停止动作。可以理解的是，时间阈值范围和预设基准值都是根据实际情况配置的，在此不作限定。
身份合法性验证过程是在重放攻击验证通过后执行的，根据身份验证信息中的匹配伪身份ID在TEE系统中查找对应的注册伪身份ID，然后根据查找到的注册伪身份ID和时间戳T1计算当前时间哈希值A1’＝h(UIDi||T1)，将A1’与时间验证哈希值A1进行对比验证，若一致则说明该用户终端为合法的，即通过身份合法性验证；否则终止运行。
需要说明的是，共享密钥是指用户终端与远端传感器之间交互的共享密钥，首先是远端传感器在经过验证后直接生成第一共享密钥，同时向用户终端发送验证成功信息，至此远端传感器完成会话建立任务。
步骤104、通过用户终端在接收到验证成功信息后生成第二共享密钥，并基于第一共享密钥和第二共享密钥与远端传感器进行指令交互，实现对智能家居设备的远程控制。
用户终端接收到验证成功信息后也可以直接生成第二共享密钥，至此用户终端完成会话建立任务。此后用户终端和远端传感器之间便可以通过第一共享密钥和第二共享密钥进行通信，即控制指令交互，从而实现对智能家居设备的远程控制。第一共享密钥和第二共享密钥均是用户终端和远端传感器之间的交互密钥，是相同性质的匹配的密钥，可以实现自由的加密和解密操作。由于用户终端与远端传感器之间的密钥协商重要信息均是存储在TEE系统，是在TEE环境下进行的，所以共享密钥可以抵抗各种攻击，第三方无法获取到其中的私密信息，也无法通过攻击某一方实现信息截取或者篡改，保障了密钥交互过程的安全可靠性。
为了验证本申请提供的技术方案的高效性，本申请提供了具体的对比案例，对比对象是现有技术一种智能家居远程控制方案，具体的对比结果如表1和表2所示。
表1两种方案时间效率对比
表2两种方案通信效率对比
根据表1和表2所示可知，本申请技术方案具有较明显的时间效率优势，而且在通信效率对比中，会话密钥建立阶段也具有较为明显的优势，综合而言比现有的技术方案更加突出，既能保证安全性，又能保证高效性。
本申请实施例提供的基于TEE的智能家居远程控制方法，通过用户登录信息实现用户身份合法性的校验，确保在通信之前验证出操控方是合法用户，能够满足可验证性需求；而基于用户生成的时间戳和身份验证信息进行重放攻击验证和身份合法验证则可以抵抗重放攻击避免系统资源浪费，也可以抵抗用户模拟攻击避免非法行为；而且，整个技术方案在TEE环境中进行，信息在传输存储过程中无法被攻击或者截取，进一步确保了数据的安全性；此外，在此过程中没有涉及到其他额外加密算法和操作手段，过程简单易实现，具有一定的高效性。因此，本申请实施例能够解决现有智能家居远程控制技术无法同时满足抗攻击性和高效性需求的技术问题。
为了便于理解，请参阅图2，本申请提供了一种基于TEE的智能家居远程控制装置的实施例，包括：
登录校验模块201，用于在开启TrustZone架构中的TEE的情况下，通过用户终端根据预置登录信息与TEE存储登录信息进行用户合法性校 验；
信息发送模块202，用于若通过用户合法性校验，则通过用户终端将随机生成的时间戳和身份验证信息发送给远端传感器，身份验证信息包括时间验证哈希值和匹配伪身份ID；
用户验证模块203，用于通过远端传感器根据时间戳和身份验证信息分别进行重放攻击验证和身份合法性验证，若是验证均通过，则生成第一共享密钥，并向用户终端发送验证成功信息；
会话控制模块204，用于通过用户终端在接收到验证成功信息后生成第二共享密钥，并基于第一共享密钥和第二共享密钥与远端传感器进行指令交互，实现对智能家居设备的远程控制。
进一步地，还包括：
注册模块205，用于在开启TrustZone架构中的TEE的情况下，通过用户终端在远端传感器上注册用户信息，用户信息包括用户ID和用户密码；
计算模块206，用于通过远端传感器基于哈希算法根据主密钥和用户信息生成注册伪身份ID、身份哈希验证值和匹配伪身份ID；
存储模块207，用于通过远端传感器将注册伪身份ID、身份哈希验证值和匹配伪身份ID存储在TEE系统形成TEE存储登录信息，同时发送至用户终端完成用户注册。
进一步地，登录校验模块201，具体用于：
在开启TrustZone架构中的TEE的情况下，通过用户终端向远端传感器发送预置登录信息，预置登录信息包括当前用户ID和当前用户密码；
通过远端传感器根据预置登录信息和TEE存储登录信息中的注册伪身份ID计算当前身份哈希值；
将当前身份哈希值与TEE存储登录信息中的身份哈希验证值进行对比形式的用户合法性校验，若一致则检验通过。
进一步地，用户验证模块203，具体用于：
通过远端传感器根据时间戳和时间阈值范围进行重放攻击验证；
在通过重放攻击验证后，根据匹配伪身份ID查找对应的注册伪身份 ID；
依据查找到的注册伪身份ID和时间戳计算当前时间哈希值，并将当前时间哈希值与时间验证哈希值进行对比验证，若一致，则身份合法性验证通过；
在通过身份合法性验证后，基于远端传感器生成与用户终端之间的第一共享密钥，并向用户终端发送验证成功信息。
本申请还提供了一种基于TEE的智能家居远程控制设备，设备包括处理器以及存储器；
存储器用于存储程序代码，并将程序代码传输给处理器；
处理器用于根据程序代码中的指令执行上述方法实施例中的基于TEE的智能家居远程控制方法。
本申请还提供了一种计算机可读存储介质，计算机可读存储介质用于存储程序代码，程序代码用于执行上述方法实施例中的基于TEE的智能家居远程控制方法。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以通过一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(英文全称：Read-Only Memory，英文缩写：ROM)、随机存取存储器(英文全称：Random Access Memory，英文缩写：RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (10)

  1. 一种基于TEE的智能家居远程控制方法，其特征在于，包括：
    在开启TrustZone架构中的TEE的情况下，通过用户终端根据预置登录信息与TEE存储登录信息进行用户合法性校验；
    若通过所述用户合法性校验，则通过所述用户终端将随机生成的时间戳和身份验证信息发送给远端传感器，所述身份验证信息包括时间验证哈希值和匹配伪身份ID；
    通过所述远端传感器根据所述时间戳和所述身份验证信息分别进行重放攻击验证和身份合法性验证，若是验证均通过，则生成第一共享密钥，并向所述用户终端发送验证成功信息；
    通过所述用户终端在接收到所述验证成功信息后生成第二共享密钥，并基于所述第一共享密钥和所述第二共享密钥与所述远端传感器进行指令交互，实现对智能家居设备的远程控制。
  2. 根据权利要求1所述的基于TEE的智能家居远程控制方法，其特征在于，所述在开启TrustZone架构中的TEE的情况下，通过用户终端根据预置登录信息与TEE存储登录信息进行用户合法性校验，之前还包括：
    在开启TrustZone架构中的TEE的情况下，通过用户终端在远端传感器上注册用户信息，所述用户信息包括用户ID和用户密码；
    通过所述远端传感器基于哈希算法根据主密钥和所述用户信息生成注册伪身份ID、身份哈希验证值和匹配伪身份ID；
    通过所述远端传感器将所述注册伪身份ID、所述身份哈希验证值和所述匹配伪身份ID存储在TEE系统形成TEE存储登录信息，同时发送至所述用户终端完成用户注册。
  3. 根据权利要求2所述的基于TEE的智能家居远程控制方法，其特征在于，所述在开启TrustZone架构中的TEE的情况下，通过用户终端根据预置登录信息与TEE存储登录信息进行用户合法性校验，包括：
    在开启TrustZone架构中的TEE的情况下，通过用户终端向远端传感器发送预置登录信息，所述预置登录信息包括当前用户ID和当前用户密码；
    通过所述远端传感器根据所述预置登录信息和TEE存储登录信息中的所述注册伪身份ID计算当前身份哈希值；
    将所述当前身份哈希值与TEE存储登录信息中的所述身份哈希验证值进行对比形式的用户合法性校验，若一致则检验通过。
  4. 根据权利要求1所述的基于TEE的智能家居远程控制方法，其特征在于，所述通过所述远端传感器根据所述时间戳和所述身份验证信息分别进行重放攻击验证和身份合法性验证，若是验证均通过，则生成第一共享密钥，并向所述用户终端发送验证成功信息，包括：
    通过所述远端传感器根据所述时间戳和时间阈值范围进行重放攻击验证；
    在通过所述重放攻击验证后，根据所述匹配伪身份ID查找对应的注册伪身份ID；
    依据查找到的所述注册伪身份ID和所述时间戳计算当前时间哈希值，并将所述当前时间哈希值与所述时间验证哈希值进行对比验证，若一致，则身份合法性验证通过；
    在通过所述身份合法性验证后，基于所述远端传感器生成与所述用户终端之间的第一共享密钥，并向所述用户终端发送验证成功信息。
  5. 一种基于TEE的智能家居远程控制装置，其特征在于，包括：
    登录校验模块，用于在开启TrustZone架构中的TEE的情况下，通过用户终端根据预置登录信息与TEE存储登录信息进行用户合法性校验；
    信息发送模块，用于若通过所述用户合法性校验，则通过所述用户终端将随机生成的时间戳和身份验证信息发送给远端传感器，所述身份验证信息包括时间验证哈希值和匹配伪身份ID；
    用户验证模块，用于通过所述远端传感器根据所述时间戳和所述身份验证信息分别进行重放攻击验证和身份合法性验证，若是验证均通过，则生成第一共享密钥，并向所述用户终端发送验证成功信息；
    会话控制模块，用于通过所述用户终端在接收到所述验证成功信息后生成第二共享密钥，并基于所述第一共享密钥和所述第二共享密钥与所述远端传感器进行指令交互，实现对智能家居设备的远程控制。
  6. 根据权利要求5所述的基于TEE的智能家居远程控制装置，其特征在于，还包括：
    注册模块，用于在开启TrustZone架构中的TEE的情况下，通过用户终端在远端传感器上注册用户信息，所述用户信息包括用户ID和用户密码；
    计算模块，用于通过所述远端传感器基于哈希算法根据主密钥和所述用户信息生成注册伪身份ID、身份哈希验证值和匹配伪身份ID；
    存储模块，用于通过所述远端传感器将所述注册伪身份ID、所述身份哈希验证值和所述匹配伪身份ID存储在TEE系统形成TEE存储登录信息，同时发送至所述用户终端完成用户注册。
  7. 根据权利要求6所述的基于TEE的智能家居远程控制装置，其特征在于，所述登录校验模块，具体用于：
    在开启TrustZone架构中的TEE的情况下，通过用户终端向远端传感器发送预置登录信息，所述预置登录信息包括当前用户ID和当前用户密码；
    通过所述远端传感器根据所述预置登录信息和TEE存储登录信息中的所述注册伪身份ID计算当前身份哈希值；
    将所述当前身份哈希值与TEE存储登录信息中的所述身份哈希验证值进行对比形式的用户合法性校验，若一致则检验通过。
  8. 根据权利要求5所述的基于TEE的智能家居远程控制装置，其特征在于，所述用户验证模块，具体用于：
    通过所述远端传感器根据所述时间戳和时间阈值范围进行重放攻击验证；
    在通过所述重放攻击验证后，根据所述匹配伪身份ID查找对应的注册伪身份ID；
    依据查找到的所述注册伪身份ID和所述时间戳计算当前时间哈希值，并将所述当前时间哈希值与所述时间验证哈希值进行对比验证，若一致，则身份合法性验证通过；
    在通过所述身份合法性验证后，基于所述远端传感器生成与所述用户 终端之间的第一共享密钥，并向所述用户终端发送验证成功信息。
  9. 一种基于TEE的智能家居远程控制设备，其特征在于，所述设备包括处理器以及存储器；
    所述存储器用于存储程序代码，并将所述程序代码传输给所述处理器；
    所述处理器用于根据所述程序代码中的指令执行权利要求1-4任一项所述的基于TEE的智能家居远程控制方法。
  10. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质用于存储程序代码，所述程序代码用于执行权利要求1-4任一项所述的基于TEE的智能家居远程控制方法。
PCT/CN2023/099350 2022-09-20 2023-06-09 一种基于tee的智能家居远程控制方法及相关装置 WO2024060696A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211144330.9 2022-09-20
CN202211144330.9A CN115550002A (zh) 2022-09-20 2022-09-20 一种基于tee的智能家居远程控制方法及相关装置

Publications (1)

Publication Number Publication Date
WO2024060696A1 true WO2024060696A1 (zh) 2024-03-28

Family

ID=84727677

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/099350 WO2024060696A1 (zh) 2022-09-20 2023-06-09 一种基于tee的智能家居远程控制方法及相关装置

Country Status (2)

Country Link
CN (1) CN115550002A (zh)
WO (1) WO2024060696A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115550002A (zh) * 2022-09-20 2022-12-30 贵州电网有限责任公司 一种基于tee的智能家居远程控制方法及相关装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105610783A (zh) * 2015-11-05 2016-05-25 珠海格力电器股份有限公司 一种数据传输方法及物联网系统
CN106533861A (zh) * 2016-11-18 2017-03-22 郑州信大捷安信息技术股份有限公司 一种智能家居物联网安全控制系统及认证方法
US20170118015A1 (en) * 2015-10-23 2017-04-27 Ajou University Industry-Academic Cooperation Foun Dation Method for managing smart home environment, method for joining smart home environment and method for connecting communication session with smart device
CN108337253A (zh) * 2018-01-29 2018-07-27 苏州南尔材料科技有限公司 一种基于计算机的智能家电控制方法
CN113115307A (zh) * 2021-04-12 2021-07-13 北京邮电大学 一种面向智能家居场景下的双因素身份认证方法
CN115550002A (zh) * 2022-09-20 2022-12-30 贵州电网有限责任公司 一种基于tee的智能家居远程控制方法及相关装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102739626A (zh) * 2011-04-12 2012-10-17 索尼公司 时间同步方法和装置、时间戳设备以及可信时间服务器
CN105634884B (zh) * 2015-07-28 2019-07-30 宇龙计算机通信科技(深圳)有限公司 一种控制指令写入方法、智能家居控制方法及相关装置
US11924322B2 (en) * 2017-05-16 2024-03-05 Arm Ltd. Blockchain for securing and/or managing IoT network-type infrastructure
CN109462652B (zh) * 2018-11-21 2021-06-01 杭州电子科技大学 智能家居系统中基于哈希算法的终端网关负载分配方法
CN110445827B (zh) * 2019-06-06 2021-05-18 中国科学院上海微系统与信息技术研究所 基于分布式账本技术的传感网的安全管理方法及安全系统
CN110351727B (zh) * 2019-07-05 2020-06-02 北京邮电大学 一种适于无线传感网络的认证与密钥协商方法
CN112087304B (zh) * 2020-09-18 2021-08-17 湖南红普创新科技发展有限公司 可信计算环境的异构融合方法、装置及相关设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170118015A1 (en) * 2015-10-23 2017-04-27 Ajou University Industry-Academic Cooperation Foun Dation Method for managing smart home environment, method for joining smart home environment and method for connecting communication session with smart device
CN105610783A (zh) * 2015-11-05 2016-05-25 珠海格力电器股份有限公司 一种数据传输方法及物联网系统
CN106533861A (zh) * 2016-11-18 2017-03-22 郑州信大捷安信息技术股份有限公司 一种智能家居物联网安全控制系统及认证方法
CN108337253A (zh) * 2018-01-29 2018-07-27 苏州南尔材料科技有限公司 一种基于计算机的智能家电控制方法
CN113115307A (zh) * 2021-04-12 2021-07-13 北京邮电大学 一种面向智能家居场景下的双因素身份认证方法
CN115550002A (zh) * 2022-09-20 2022-12-30 贵州电网有限责任公司 一种基于tee的智能家居远程控制方法及相关装置

Also Published As

Publication number Publication date
CN115550002A (zh) 2022-12-30

Similar Documents

Publication Publication Date Title
JP6882254B2 (ja) 生体特徴に基づく安全性検証方法、クライアント端末、及びサーバ
US10979427B2 (en) Method and device for authenticating based on authenticating device
CN109347835B (zh) 信息传输方法、客户端、服务器以及计算机可读存储介质
US11063941B2 (en) Authentication system, authentication method, and program
WO2017206250A1 (zh) 终端的备份销毁方法和装置
WO2020041747A1 (en) Methods, apparatuses, and computer program products for frictionless electronic signature management
EP3206329B1 (en) Security check method, device, terminal and server
US20220159462A1 (en) Router, network connection method and mobile terminal
US11930116B2 (en) Securely communicating service status in a distributed network environment
US20220245631A1 (en) Authentication method and apparatus of biometric payment device, computer device, and storage medium
KR20190120899A (ko) 브라우저 지문을 이용한 싱글 사인온 방법
WO2024060696A1 (zh) 一种基于tee的智能家居远程控制方法及相关装置
CN113395406A (zh) 一种基于电力设备指纹的加密认证方法及系统
JP2022534677A (ja) ブロックチェーンを使用するオンラインアプリケーションおよびウェブページの保護
CN114844644A (zh) 资源请求方法、装置、电子设备及存储介质
CN114430324A (zh) 基于哈希链的线上快速身份验证方法
CN114143343A (zh) 雾计算环境中远程访问控制系统、控制方法、终端及介质
WO2016131272A1 (zh) 一种基于智能卡的在线认证方法、智能卡及认证服务器
TW202207667A (zh) 通訊系統中改善安全性之認證及驗證方法
CN111291398B (zh) 基于区块链的认证方法、装置、计算机设备及存储介质
US11240661B2 (en) Secure simultaneous authentication of equals anti-clogging mechanism
CN111628985A (zh) 安全访问控制方法、装置、计算机设备和存储介质
US11177958B2 (en) Protection of authentication tokens
US20150170150A1 (en) Data verification
CN106792667B (zh) 一种用于机器人的网络接入认证方法以及机器人

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23866992

Country of ref document: EP

Kind code of ref document: A1