WO2018227685A1 - 一种终端设备安全接入物联网的方法及*** - Google Patents

一种终端设备安全接入物联网的方法及*** Download PDF

Info

Publication number
WO2018227685A1
WO2018227685A1 PCT/CN2017/093224 CN2017093224W WO2018227685A1 WO 2018227685 A1 WO2018227685 A1 WO 2018227685A1 CN 2017093224 W CN2017093224 W CN 2017093224W WO 2018227685 A1 WO2018227685 A1 WO 2018227685A1
Authority
WO
WIPO (PCT)
Prior art keywords
ciphertext
internet
frid
sensing information
things
Prior art date
Application number
PCT/CN2017/093224
Other languages
English (en)
French (fr)
Inventor
杜光东
Original Assignee
深圳市盛路物联通讯技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市盛路物联通讯技术有限公司 filed Critical 深圳市盛路物联通讯技术有限公司
Publication of WO2018227685A1 publication Critical patent/WO2018227685A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B5/00—Near-field transmission systems, e.g. inductive or capacitive transmission systems
    • H04B5/70—Near-field transmission systems, e.g. inductive or capacitive transmission systems specially adapted for specific purposes
    • H04B5/77—Near-field transmission systems, e.g. inductive or capacitive transmission systems specially adapted for specific purposes for interrogation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the embodiments of the present invention belong to the field of information security of an Internet of Things system, and in particular, to a method and system for a terminal device to securely access an Internet of Things.
  • ITO Internet of Things
  • Frequency Identification RFID
  • Sensing devices such as infrared sensors, global positioning systems, laser scanners, etc., connected to the Internet in accordance with agreed protocols, for information exchange and communication, intelligent identification, positioning, tracking, monitoring and management .
  • IoT applications can be divided into sensor network, transmission network, and application network.
  • the system application process can be divided into: First, identify the device or object, and then realize intelligent identification of the device or object. Intelligent identification
  • the mission and purpose of the method is to provide information about various items, equipment, and even organisms that can be moved; to achieve this, RFID tags can be attached to various devices or objects, and the RFID tags store specifications and interoperability.
  • Information in the need to connect these devices or objects into the Internet of Things system, scan the RFID tag attached to the device or object through the RFID card reader, read the necessary information from the RFID tag to access it In the Internet of Things system.
  • the RFID reader is used to obtain the sensing information in the RFID tag to connect it to the Internet of Things system, and the read sensing information is directly sent to the Internet of Things system for verification, and there is no sensing information in the process. Protection, therefore, there is a danger that the sensor information will leak or be tampered with.
  • the embodiments of the present invention provide a method and system for securely accessing an Internet of things to a terminal device, and aim to solve the existing method for accessing an Internet of Things system of a terminal device, FRID
  • the sensor information of the tag is easily leaked or tampered with, so that the problem of sensor information security cannot be guaranteed.
  • a first aspect of the embodiments of the present invention provides a method for a terminal device to securely access an Internet of Things.
  • the method for the terminal device to securely access an Internet of things includes: [0005] reading the first sensing information of the FRID tag, calling a set of random numbers as a signature key, and encrypting the signature key to obtain a first ciphertext;
  • the first sensing information of the FRID tag is read, and a set of random numbers is used as a signature key.
  • Encrypting the signature key to obtain a first ciphertext specifically including:
  • the encrypting the first sensing information, obtaining a second ciphertext, and generating a digital signature of the first sensing information specifically:
  • the sending the second ciphertext and the digital signature to the Internet of Things system authentication center so that the Internet of Things system authentication center is to the first ciphertext and the second secret
  • the method further includes:
  • the terminal device to which the ID tag belongs to the Internet of Things.
  • the method for the terminal device to securely access the Internet of Things system further includes:
  • the Internet of Things system authentication center receives and stores the identifier of the FRID tag sent by the FRID card reader and the first ciphertext; and receives the second ciphertext and the digital signature sent by the FRID card reader;
  • the Internet of Things system authentication center decrypts the first ciphertext to obtain a signature key, and decrypts the second ciphertext To the first sensing information;
  • the IoT system authentication center performs the verification of the digital signature by using the first sensing information and the signature key, and obtains the verification result, and determines whether to send the authorized access information according to the verification result. Go to the FRID card reader.
  • a second aspect of the embodiments of the present invention provides a system for a terminal device to securely access an Internet of Things, where the terminal device securely accesses an Internet of Things system includes: a FRID card reader, an Internet of Things system authentication center, where
  • the FRID card reader includes:
  • the first encryption unit is configured to read the first sensing information of the FRID tag, invoke a set of random numbers as the signature key, and encrypt the signature key to obtain the first ciphertext;
  • a first sending unit configured to invoke an identifier of the FRID tag, send the identifier of the FRID tag, and the first ciphertext to an IoT system authentication center;
  • a second encryption unit configured to encrypt the first sensing information, obtain a second ciphertext, and generate a digital signature of the first sensing information
  • a second sending unit configured to send the second ciphertext and the digital signature to the Internet of Things system authentication center, so that the Internet of Things system authentication center is to the first ciphertext, the second The ciphertext and the digital signature are decrypted and checked.
  • the first encryption unit specifically includes:
  • a signature key generation module configured to read the first sensing information of the FRID tag, invoke a random number generator to generate a set of random numbers, and use the random number as a signature key;
  • the signature key encryption module is configured to invoke the pre-stored key to encrypt the signature key to generate a first ciphertext.
  • the second encryption unit specifically includes:
  • a second ciphertext generating module configured to invoke a lightweight cryptographic algorithm, and encrypt the first sensing information into a second ciphertext
  • a digital signature generating module configured to invoke a digest algorithm, and generate a digital signature of the first sensing information by using the digest algorithm and the signature key.
  • the FRID card reader further includes:
  • a terminal device access unit configured to receive authorized access information sent by an IoT system authentication center, according to The authorized access information is connected to the terminal device to which the FRID tag belongs to the Internet of Things.
  • an IoT system authentication center provided by an Internet of Things System Certification Center includes:
  • a receiving unit configured to receive and store an identifier of the FRID tag sent by the FRID card reader and the first ciphertext; and receive a second ciphertext and a digital signature sent by the FRID card reader;
  • a decryption unit configured to decrypt the first ciphertext to obtain a signature key, and decrypt the second ciphertext to obtain first sensing information
  • an authorization access information generating unit configured to perform verification of the digital signature by using the first sensing information and the signature key, to obtain an inspection result; and determining whether to send an authorization according to the verification result Access information to the FRID card reader.
  • the FRID card reader after receiving the first sensing information of the FRID tag, invokes a set of random numbers as a signature key corresponding to the first sensing information of the FRID tag, After the signature key is encrypted, the first ciphertext is generated and sent to the Internet of Things authentication center together with the identifier of the FRID label. Since the encryption is performed before being transmitted, the signature key is not modified during the sending process. And the one-to-one correspondence with the FRID label; the FRID card reader encrypts the acquired first sensing information to generate a second ciphertext, and generates a digital signature corresponding to the first sensing information, so as to be authenticated by the IoT system.
  • the center selects a corresponding signature key according to the identifier of the FRID tag to perform verification on the received information.
  • an encryption system is formed at one end of the FRID card reader, and the first sensing information and the signature key are respectively encrypted before the first sensing information is sent, and the two encryptions ensure the secure transmission of the information; generating the first sensing
  • the digital signature of the information facilitates the subsequent verification of the information, further ensuring the security of the information received by the IoT system certification center.
  • FIG. 1 is a schematic diagram showing the working principle of a FRID tag and a FRID card reader in the prior art
  • FIG. 2 is a flowchart of a method for a terminal device to securely access an Internet of things according to a first embodiment of the present invention.
  • 3 is a flowchart of a method for a terminal device to securely access an Internet of things according to a second embodiment of the present invention.
  • FIG. 4 is a terminal device security access device according to a third embodiment of the present invention. Flow chart of the method of networking
  • FIG. 5 is a schematic diagram of information interaction of a terminal device securely accessing an Internet of Things according to a fourth embodiment of the present invention.
  • FIG. 6 is a structural block diagram of a system for securely accessing an Internet of things of a terminal device according to a fourth embodiment of the present invention.
  • the Internet of Things through information sensing devices such as radio frequency identification (RFID), infrared sensors, global positioning systems, laser scanners, etc., connects any item to the Internet according to a contracted agreement, and exchanges information and communication.
  • RFID radio frequency identification
  • a network concept that enables intelligent identification, location, tracking, monitoring, and management.
  • the basic principle of the radio frequency identification technology is to use the radio frequency signal and the spatial coupling (inductance or electromagnetic coupling) transmission characteristics to realize automatic recognition of the identified object.
  • the RFID system consists of two parts, an electronic tag and a reader (reader). As shown in Figure 1, in its practical application, the electronic tag is attached to the surface or inside of the object to be recognized.
  • the reader can read the information stored in the electronic tag in a non-contact manner or write the predetermined data into the electronic tag to realize automatic recognition and automatic data collection of the tagged object.
  • the reader sends the collected information to the data management system (IoT system) to connect various objects through the network.
  • IoT system data management system
  • a terminal device is securely connected to the Internet of Things. Method, as shown in Figure 2, where: [0049] Step S21, reading the first sensing information of the FRID tag, calling a set of random numbers as the signature key, and encrypting the signature key to obtain the first ciphertext;
  • the FRID card reader scans the RFID tag attached to the terminal device to be connected to the Internet of Things, and reads the sensing information contained in the RFID tag, that is, the first sensing information, the first sensing
  • the information includes the name and model of the terminal device, the unique identification code of the terminal device, and the external release permission. And according to the first sensing information, calling a set of random numbers in the random number generator in the RFID card reader, and setting the random number to a signature key corresponding to the first sensing information. Since the random number is random, there is a certain difference in the random number generated each time. Therefore, after the RFID reader reads a set of first sensing information, a random number is used as the first sensing information of the group.
  • the signature key can make the first sensing information and the signature key correspond one-to-one. The signature key is sent to the authentication center of the Internet of Things system for subsequent verification of the true uniqueness of the first sensory information.
  • the signature key is first encrypted to generate a first ciphertext.
  • the encryption key encrypts the signature key by calling a public key of the pre-stored IoT system; the public key of the Internet of Things system is pre-stored in the RFID card reader.
  • the reading the first sensing information of the FRID tag, calling a set of random numbers as the signature key, and encrypting the signature key to obtain the first ciphertext specifically:
  • an encryption system is first established at the FRID card reader, and the sensing information is read by the FRID card reader.
  • Calling a set of random numbers generated by a random number generator in the encryption system using the random number as a signature key corresponding to the first sensing information read this time, and the signature key is used for subsequent processing
  • Invoking the pre-stored key in the encryption system for the generated signature key The line is encrypted, and the first ciphertext is generated, and the first ciphertext is sent in the process of subsequent information transmission to ensure the security of the signature key in the information transmission process.
  • Step S22 calling the identifier of the FRID tag, sending the identifier of the FRID tag and the first ciphertext to the Internet of Things system authentication center;
  • the identifier of the FRID tag is invoked, and the identifier is used to uniquely mark the FRID tag, and is generated together with the FRID tag. Identification, fixing the identification in the FRID label is not changeable.
  • the FRID tag identifier can be generated by simply using the size of the number.
  • the FRID tag can also be generated by combining the generation and location of the FRID tag. For example, the FRID tag produced by different companies can be used first. Label the unique logo of the company, and then mark the generation of the FRID label.
  • the labels generated for the same time can be marked in a certain order and finally mark the FRID label after the company's unique identifier.
  • the FRID tag After the FRID tag is generated, its identifier is generated, and its identifier is fixed in the FRID tag, which is unchangeable, that is, a unique tag is formed for the FRID tag, and the FRID tag is applied to the terminal device, and the terminal device is connected to the Internet of Things system. After that, the terminal device can be uniquely identified in the Internet of Things system.
  • the identifier of the FRID tag and the first ciphertext are sent to the IoT authentication center, so that the subsequent IoT system authentication center receives the first ciphertext corresponding to the FRID tag information call and checks it. sign.
  • Step S23 encrypting the first sensing information, obtaining a second ciphertext, and generating a digital signature of the first sensing information
  • an encryption system is first established at the FRID card reader end, and the first sensing information is Encrypt.
  • the encrypting the first sensing information, obtaining a second ciphertext, and generating a digital signature of the first sensing information specifically:
  • the call is pre-stored in the FRID card reader.
  • the lightweight cryptographic algorithm is encrypted in one end of the encryption system.
  • the lightweight cryptographic algorithm has the characteristics of high execution efficiency, low computational resource consumption, and strong adaptability.
  • the lightweight cryptographic algorithm can be in the stream cipher.
  • the RES4 algorithm or the PRESENT algorithm in the block cipher algorithm is not limited herein; the first sensing information obtained by the F RID card reader may be encrypted to determine the first sensing information in advance, if obtained
  • the first sensing information is not required for security, or needs to be quickly encrypted, and can be encrypted by calling the RC4 algorithm in the stream password pre-stored in the FRID card reader encryption system, such as a FRID card reader.
  • the peer acquires the first sensing information, needs to be processed in the short interval, and the obtained first sensing information is in the middle of the message, and the security requirement is general, and the stream password can be called.
  • the RC4 algorithm performs encryption.
  • the PRESENT algorithm in the block cipher algorithm can be called to perform encryption operation to ensure security.
  • the digest algorithm in the FRID card reader encryption system is called to generate a hash value from the first sensing information, and the generated hash value is encrypted by the signature key to generate a digital signature.
  • the first sensing information can be securely transmitted.
  • the processing efficiency of the received first sensing information is improved by the FRID card reader, and the digital signature of the first sensing information is generated at the same time as the first sensing information is encrypted, so as to facilitate the subsequent Internet of Things.
  • the system authentication center judges and verifies the received encrypted first sensing information.
  • Step S24 sending the identifier of the FRID tag, the second ciphertext, and the digital signature to the IoT system authentication center, so that the IoT system authentication center is to the second secret
  • the text and the digital signature are decrypted and checked.
  • the FRID card reader sends the second ciphertext obtained by encrypting the first sensing information, the digital signature and the identifier of the FRID tag corresponding to the first sensing information to the Internet of Things system authentication center.
  • the FRID card reader acquires the first sensing information of the plurality of FRID tags and processes the same, the plurality of processed first sensing information are processed according to a preset sending rule.
  • the pre-set sending rule may send the processed first sensing information to the Internet of Things authentication center according to the strength of the acquired first sensing information signal; The signal is strong, which indicates that it is easier to be connected to the Internet of Things system.
  • the terminal equipment of the network system can save the waiting time of the subsequent terminal equipment access and improve the access efficiency of the access Internet of Things system.
  • the pre-set sending rule may further be: sending the processed first sensing information to the Internet of Things authentication center according to the inter-sequence of the first sensing information acquired by the FRID card reader; the FRI D card reader is
  • the first sensing information on the FRID label of a certain terminal device acquired in the first time may be processed as in step S21 to step S23 immediately after acquisition, with respect to the FRID label of the terminal device acquired later.
  • the first sensing information can send the processed result to the IoT system authentication center earlier, thereby reducing the processing task backlog at one end of the FRID card reader.
  • the above two transmission rules are alternately selected according to the situation.
  • the specific selection of the transmission rules can be selected according to the actual situation, and is not limited herein.
  • the sending rule can be selected according to the actual situation, which can meet the needs of the terminal device to quickly access the Internet of Things system. It is also possible to reduce the number of tasks of the first sensory information to be processed at one end of the FRID card reader.
  • the FRID card reader is provided with an encryption system on one end, and after receiving the first sensing information of the FRID tag, calling a set of random numbers generated in the random number generator as the first sensing information with the FRID tag.
  • the first ciphertext is encrypted and the identifier of the FRID tag is sent to the Internet of Things authentication center, and the signature key is encrypted before being sent.
  • the first sensing device for the received terminal device of the Internet of Things system to be accessed, the first sensing device to be obtained from the FRID tag corresponding to the terminal device
  • the information is encrypted to generate a second ciphertext, and a digital signature corresponding to the first sensing information is generated, and sent to the Internet of Things system authentication center for determining, identifying the FRID tag, the second ciphertext, and the The digital signature is sent together, so that the subsequent IoT system authentication center selects the corresponding signature key according to the identifier of the FRID tag to check the received information. sign.
  • an encryption system is formed at one end of the FRID card reader, and the first sensing information and the signature key are respectively encrypted before the first sensing information is sent, and the two encryptions ensure the secure transmission of the information; generating the first sensing
  • the digital signature of the information facilitates the subsequent verification of the information, further ensuring the security of the information received by the IoT system certification center.
  • FIG. 3 shows a flow of a method for a terminal device to securely access an Internet of Things according to a second embodiment of the present invention.
  • the method shown in Figure 3 includes:
  • Step S31 reading the first sensing information of the FRID tag, calling a set of random numbers as the signature key, encrypting the signature key, and obtaining the first ciphertext;
  • Step S32 calling the identifier of the FRID tag, and sending the identifier and the first ciphertext to the Internet of Things system authentication center;
  • Step S33 Encrypt the first sensing information to obtain a second ciphertext, and generate a digital signature of the first sensing information.
  • step S34 sending the identifier of the FRID tag, the second ciphertext, and the digital signature to the IoT system authentication center, so that the IoT system authentication center is to the second secret And the digital signature for decryption and verification;
  • Steps 31-34 respectively correspond to steps 21-24 in the first embodiment, and details are not described herein again.
  • Step S35 Receive authorized access information sent by the IoT system authentication center, and connect the terminal device to which the FRID tag belongs to the Internet of Things system according to the authorized access information.
  • the authorized terminal device is sent to access the authorized access information of the Internet of Things system, and the FRID card reader receives the authorized access information. Then, the identifier of the FRID tag corresponding to the authorized access information is invoked, and the access of the corresponding terminal device is selected and confirmed by the identifier of the FRID tag. The terminal device of the IoT system authentication center is confirmed by the identifier of the FRID tag, which reduces the probability of erroneous access.
  • Step S41 the Internet of Things System Authentication Center receives and stores the FRID sent by the FRID card reader. The identifier of the label and the first ciphertext; and receiving the second ciphertext and the digital signature sent by the FRID card reader;
  • the IoT system authentication center receives the identifier of the FRID tag sent by the FRID card reader and the first ciphertext, and stores the identifier of the FRID tag and the first ciphertext in the memory.
  • the identifier of the F RID tag and the first ciphertext are stored, and the identifier of the FRID tag is analyzed, and stored according to different categories of the identifier of the F RID tag.
  • the labels attached to the terminal devices in the same area are classified according to the manufacturer of the identifier of the FRID label, or classified according to the equipment attached to the FRID label; specifically, the first processed after receiving the processing of the Internet of Things system authentication center Sensing letter
  • the classification and storage method of interest is not limited.
  • the identification of the FRID tag helps to quickly find the identity of the FRI D tag to be called, and then quickly invokes the corresponding signature key.
  • Step S42 the Internet of Things system authentication center decrypts the first ciphertext to obtain a signature key, and decrypts the second ciphertext to obtain first sensing information.
  • the Internet of Things Authentication Center decrypts the received first ciphertext and the second ciphertext, respectively obtains a signature key and first sensing information, and firstly stores the first ciphertext together with the first ciphertext before decryption.
  • the identifier of the FRID tag of the networked system authentication center and the identifier of the FRID tag sent to the IoT system authentication center together with the second ciphertext are compared with each other, and the two are consistent, indicating the first ciphertext to be decrypted and
  • the second ciphertext belongs to the same information as an FRID tag.
  • the first ciphertext and the second ciphertext that belong to the same FRID tag are then decrypted.
  • Step S43 the Internet of Things system authentication center performs verification on the digital signature by using the first sensing information and the signature key, and obtains an inspection result, and determines whether to send an authorization according to the verification result. Access information to the FRID card reader.
  • the verification of the digital signature by the signature key also yields a set of hash values, which are referred to as a second hash value; Whether the hash value is the same as the second hash value, and if the two are the same, the digital signature corresponding to the second hash value is generated by the first sensing information corresponding to the first hash value, and the The first sensing information is not tampered with during the delivery process, thereby completing the verification of the digital signature.
  • the center of the Internet of Things system decrypts and checks the received first ciphertext, second ciphertext, and digital signature respectively, and decrypts, first determines whether the first ciphertext and the second ciphertext are The information belonging to the same F RID tag is then decrypted to ensure that the decrypted signature key corresponds to the first sensor information; since the digital signature represents the characteristics of the file, if the file changes, the digital signature will also occur. The change, therefore, by verifying the digital signature, both the digital signature and the first sensor information are guaranteed to be from the same FRID tag, and the integrity and originality of the received first sensor information can be ensured. Thus again The security of the first sensor information transfer process is confirmed.
  • FIG. 5 shows an information interaction diagram of the foregoing terminal device secure access Internet of Things system, which is described in detail as follows: [0088] In step S51, the FRID card reader acquires the first sensing information in the FRID tag. And calling a set of random numbers as the signature key;
  • the FRID card reader obtains the first sensing information by scanning or sensing the FRID tag for the terminal device to be connected to the Internet of Things system, and then acquiring the random number generator from the FRID card reader. A set of random numbers is used as a signature key corresponding to the acquired first sensor information.
  • step S52 the FRID card reader encrypts the signature key to obtain a first ciphertext, and invokes an identifier of the FRID tag;
  • the FRID card reader encrypts the signature key by using a pre-stored key to obtain a first ciphertext, so as to ensure the security of the signature key in the information transmission process; and then call the FRID tag.
  • the identifier of the FRID tag is used to uniquely mark the FRID tag.
  • step S53 the FRID card reader sends the FRID tag and the first ciphertext to the Internet of Things (IoT) authentication center;
  • IoT Internet of Things
  • the FRID card reader and the Internet of Things system authentication center are connected by wireless.
  • the above wireless connection may be based on infrared, Bluetooth, Wireless-Fidelity (Wi-Fi), Zigbee protocol (Zigbe e Or the connection of the protocol, wherein the above-mentioned protocol is a lightweight Internet of Things protocol, and the data transmitted based on the above-mentioned protocol is data, and the data includes only the minimum credit load, A transfer-pointing arrow, a simple non-unique address, and a suitable checksum are a lightweight, widely spread packet.
  • the FRID card reader can also be connected to the IoT system authentication center in other ways, which is not limited herein.
  • step S54 the Internet of Things system authentication center receives and stores the identifier of the FRID tag and the first ciphertext
  • step S55 the FRID card reader encrypts the first sensing information to obtain a second ciphertext, and generates a digital signature of the first sensing information.
  • the FRID card reader first encrypts the acquired first sensing information to obtain a second ciphertext.
  • step S56 the FRID card reader sends the FRID tag, the second ciphertext and the digital signature to the Internet of Things system authentication center; in this step, the information transfer process refers to the implementation process of step 53 above. No longer.
  • step S57 the Internet of Things Authentication Center decrypts the stored first ciphertext, and decrypts and verifies the received second ciphertext and the digital signature; and generates authorized access information after the verification pass passes;
  • the Internet of Things system authentication center first decrypts the first ciphertext to obtain a signature key, and then decrypts the second ciphertext to obtain the first sensing information, and obtains the first signature key and the first The sensing information is checked for the digital signature to confirm the originality of the first sensing information. After the digital signature verification is passed, the authorized terminal device is configured to access the authorized access information of the Internet of Things authentication center.
  • step S58 the Internet of Things system authentication center sends the authorized access information to the FRID card reader;
  • step S59 the FRID card reader connects the terminal device to the Internet of Things system according to the received authorized access information.
  • the acquired first sensing and signing keys are respectively encrypted at the FRID card reader end, and the signature key of the first sensing information is obtained, and then The encrypted information and digital signature are sent to the IoT system certification center, and then the IoT system authentication center performs two decryption and verification of the digital signature, and the first sensing information obtained by the Baozhen FRID card reader is obtained.
  • the security of information transmission ensures that the terminal equipment is securely connected to the Internet of Things system.
  • the size of the sequence numbers of the foregoing processes does not mean the order of execution sequence, and the execution order of each process should be determined by its function and internal logic, and should not be taken to the embodiment of the present invention.
  • the implementation process constitutes any limitation.
  • FIG. 6 is a block diagram showing a structure of a system for securely accessing an Internet of things of a terminal device according to a fifth embodiment of the present invention. For the convenience of description, only parts related to the embodiment of the present invention are shown.
  • the system for securely accessing an Internet of Things system of the terminal device includes: an FRID card reader 61 and an Internet of Things system authentication center 62, wherein the FRID card reader includes: The unit 611, the first sending unit 612, the second encrypting unit 613, and the second sending unit 614, where: [0107]
  • the first encryption unit 611 is configured to read the first sensing information of the FRID tag, invoke a set of random numbers as a signature key, and encrypt the signature key to obtain a first ciphertext;
  • the first encryption unit 612 specifically includes:
  • a signature key generation module configured to read the first sensing information of the FRID tag, invoke a random number generator to generate a set of random numbers, and use the random number as a signature key;
  • the signature key encryption module is configured to invoke the pre-stored key to encrypt the signature key to generate a first ciphertext.
  • the first sending unit 612 is configured to invoke the identifier of the FRID tag, send the identifier of the FRID tag, and the first ciphertext to the Internet of Things system authentication center;
  • the second encryption unit 613 is configured to encrypt the first sensing information, obtain a second ciphertext, and generate a digital signature of the first sensing information.
  • the second encryption unit 613 specifically includes:
  • a second ciphertext generating module configured to invoke a lightweight cryptographic algorithm, to encrypt the first sensing information into a second ciphertext
  • the digital signature generating module is configured to invoke a digest algorithm, and generate a digital signature of the first sensing information by using the digest algorithm and the signature key.
  • the second sending unit 614 is configured to send the second ciphertext and the digital signature to the IoT system authentication center, so that the Internet of Things system authentication center is configured to the first ciphertext, The second ciphertext and the digital signature are decrypted and checked.
  • the FRID card reader further includes:
  • the terminal device access unit is configured to receive the authorized access information sent by the IoT system authentication center, and connect the terminal device to which the FRID tag belongs to the Internet of Things system according to the authorized access information.
  • the IoT system authentication center includes: a receiving unit 621, a decrypting unit 622, and an authorized access information generating unit 623, where:
  • the receiving unit 621 is configured to receive and store the identifier of the FRID tag sent by the FRID card reader and the first ciphertext; and receive the second ciphertext and the digital signature sent by the FRID card reader;
  • the decryption unit 622 is configured to decrypt the first ciphertext to obtain a signature key, and decrypt the second ciphertext to obtain first sensing information.
  • the authorization access information generating unit 623 is configured to perform verification of the digital signature by using the first sensing information and the signature key to obtain an authentication result; and determine whether to send according to the verification result. Authorize access to the FRID reader.
  • the IoT system center decrypts and checks the received first ciphertext, second ciphertext, and digital signature respectively, and decrypts, first determines whether the first ciphertext and the second ciphertext are The information belonging to the same F RID tag is then decrypted to ensure that the decrypted signature key corresponds to the first sensor information; since the digital signature represents the characteristics of the file, if the file changes, the digital signature will also occur. The change, therefore, by verifying the digital signature, both the digital signature and the first sensor information are guaranteed to be from the same FRID tag, and the integrity and originality of the received first sensor information can be ensured. Thereby, the security of the first sensor information transmission process is confirmed again.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division, and the actual implementation may have another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not executed.
  • the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical, mechanical or otherwise.
  • the unit described as a separate component may or may not be physically distributed, and the component displayed as a unit may or may not be a physical unit, that is, may be located in one place, or may be distributed to multiple On the network unit. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as separate products, may be stored in a computer readable storage medium.
  • the technical solution of the present invention The portion of the technical contribution, or the portion of the technical solution, may be embodied in the form of a software product stored in a storage medium, including instructions for causing a computer device ( It may be a personal computer, a server, or a network device, etc.) performing all or part of the steps of the method described in various embodiments of the present invention.
  • the foregoing storage medium includes: u disk
  • RAM random access memory
  • disk disk or optical disk, and other media that can store program code.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本实施例提供了一种终端设备安全接入物联网的方法及***。所述方法包括：读取FRID标签的第一传感信息，调用一组随机数作为签名密钥，并加密所述签名密钥，得到第一密文；调用所述FRID标签的标识，发送所述FRID标签的标识及所述第一密文到物联网***认证中心;加密所述第一传感信息，得到第二密文，并生成所述第一传感信息的数字签名；发送所述第二密文以及和所述数字签名到所述物联网***认证中心。本实施例中FRID读卡器对待发送的信息进行了两次加密，保证了信息的安全发送；生成第一传感信息的数字签名，方便后续对其进行验签，进一步保证了物联网***认证中心所接收到的信息的安全性。

Description

说明书 发明名称：一种终端设备安全接入物联网的方法及*** 技术领域
[0001] 本发明实施例属于物联网***信息安全领域， 尤其涉及一种终端设备安全接入 物联网的方法及***。
背景技术
[0002] 物联网 ITO ( Internet of Things；)是把所有物品通过射频识别技术 (Radio
Frequency Identification, RFID ). 红外感应器、 全球定位***、 激光扫描器等传 感设备， 按照约定的协议， 与互联网连接起来， 进行信息交换和通讯， 实现智 能化识别、 定位、 跟踪、 监控和管理。 物联网应用可以分为传感网络， 传输网 络， 应用网络三层， ***应用流程可以分为： 首先对设备或物体进行标识， 再 实现对所述的设备或物体进行智能化识别， 智能化识别方法的任务和目的就是 提供关于各种物品、 设备甚至可以移动的生物的信息； 为了实现这一目的， 可 在各种设备或物体上附着 RFID标签， RFID标签中存储着规范而具有互用性的信 息， 在需要将这些的设备或物体接入物联网***吋， 通过 RFID读卡器扫描附着 于设备或物体上的 RFID标签， 从所述 RFID标签中读取必要的信息以将其接入物 联网***中。 但使用 RFID读卡器获取 RFID标签中传感信息以将其接入物联网系 统吋， 直接将读取到的传感信息发送到物联网***进行验证， 这一过程中不存 在对传感信息的保护， 因此， 存在传感信息外漏或被篡改的危险。
技术问题
[0003] 鉴于现有技术中存在的不足， 本发明实施例提供了一种终端设备安全接入物联 网的方法及***， 旨在解决现有的终端设备接入物联网***的方法中， FRID标 签的传感信息容易被泄漏或篡改， 从而不能保证传感信息安全的问题。
问题的解决方案
技术解决方案
[0004] 本发明实施例第一方面， 提供了一种终端设备安全接入物联网的方法， 所述终 端设备安全接入物联网的方法包括： [0005] 读取 FRID标签的第一传感信息， 调用一组随机数作为签名密钥， 加密所述签 名密钥， 得到第一密文；
[0006] 调用所述 FRID标签的标识， 发送所述 FRID标签的标识及所述第一密文到物联 网***认证中心；
[0007] 加密所述第一传感信息， 得到第二密文， 并生成所述第一传感信息的数字签名
[0008] 发送所述第二密文以及所述数字签名到所述物联网***认证中心， 以使所述物 联网***认证中心对所述第一密文、 第二密文和所述数字签名进行解密和验签
[0009] 优选地， 所述读取 FRID标签的第一传感信息， 调用一组随机数作为签名密钥
， 加密所述签名密钥， 得到第一密文， 具体包括：
[0010] 读取 FRID标签的第一传感信息， 调用随机数发生器生产一组随机数， 将所述 随机数作为签名密钥；
[0011] 调用预先存储的密钥加密所述签名密钥， 生成第一密文。
[0012] 优选地， 所述加密所述第一传感信息， 得到第二密文， 并生成所述第一传感信 息的数字签名， 具体包括：
[0013] 调用轻量级密码算法， 加密所述第一传感信息成第二密文；
[0014] 调用摘要算法， 通过所述摘要算法以及所述签名密钥生成所述第一传感信息的 数字签名。
[0015] 优选地， 在所述发送所述第二密文以及所述数字签名到所述物联网***认证中 心， 以使所述物联网***认证中心对所述第一密文、 第二密文和所述数字签名 进行解密和验签之后， 还包括：
[0016] 接收物联网***认证中心发送的授权接入信息， 根据所述授权接入信息连接 FR
ID标签所属的终端设备到物联网。
[0017] 优选地， 所述终端设备安全接入物联网***的方法还包括：
[0018] 物联网***认证中心接收并存储所述 FRID读卡器发送的 FRID标签的标识和第 一密文； 并接收所述 FRID读卡器发送的第二密文及数字签名；
[0019] 物联网***认证中心解密所述第一密文得到签名密钥， 并解密所述第二密文得 到第一传感信息；
[0020] 物联网***认证中心通过所述第一传感信息和所述签名密钥对所述数字签名进 行验签， 得到验签结果， 并根据所述验签结果判断是否发送授权接入信息到所 述 FRID读卡器。
[0021] 本发明实施例的第二方面， 提供一种终端设备安全接入物联网的***， 所述终 端设备安全接入物联网的***包括： FRID读卡器、 物联网***认证中心， 其中
， 所述 FRID读卡器包括：
[0022] 第一加密单元， 用于读取 FRID标签的第一传感信息， 调用一组随机数作为签 名密钥， 加密所述签名密钥， 得到第一密文；
[0023] 第一发送单元， 用于调用所述 FRID标签的标识， 发送所述 FRID标签的标识及 所述第一密文到物联网***认证中心；
[0024] 第二加密单元， 用于加密所述第一传感信息， 得到第二密文， 并生成所述第一 传感信息的数字签名；
[0025] 第二发送单元， 用于发送所述第二密文以及所述数字签名到所述物联网***认 证中心， 以使所述物联网***认证中心对所述第一密文、 第二密文和所述数字 签名进行解密和验签。
[0026] 优选地， 所述第一加密单元， 具体包括：
[0027] 签名密钥生成模块， 用于读取 FRID标签的第一传感信息， 调用随机数发生器 生产一组随机数， 将所述随机数作为签名密钥；
[0028] 签名密钥加密模块， 用于调用预先存储的密钥加密所述签名密钥， 生成第一密 文。
[0029] 优选地， 所述第二加密单元， 具体包括：
[0030] 第二密文生成模块， 用于调用轻量级密码算法， 加密所述第一传感信息成第二 密文；
[0031] 数字签名生成模块， 用于调用摘要算法， 通过所述摘要算法以及所述签名密钥 生成所述第一传感信息的数字签名。
[0032] 优选地， 所述 FRID读卡器还包括：
[0033] 终端设备接入单元， 用于接收物联网***认证中心发送的授权接入信息， 根据 所述授权接入信息连接 FRID标签所属的终端设备到物联网。
[0034] 本发明实施例的第三方面， 提供一种物联网***认证中心所述物联网***认证 中心包括：
[0035] 接收单元， 用于接收并存储所述 FRID读卡器发送的 FRID标签的标识和第一密 文； 并接收所述 FRID读卡器发送的第二密文及数字签名；
[0036] 解密单元， 用于解密所述第一密文得到签名密钥， 解密所述第二密文得到第一 传感信息；
[0037] 授权接入信息生成单元， 用于通过所述第一传感信息和所述签名密钥对所述数 字签名进行验签， 得到验签结果； 根据所述验签结果判断是否发送授权接入信 息到所述 FRID读卡器。
发明的有益效果
有益效果
[0038] 在本发明实施例中， FRID读卡器接收到 FRID标签的第一传感信息后， 调用一 组随机数作为与 FRID标签的第一传感信息相对应的签名密钥， 将所述签名密钥 加密后生成第一密文和所述 FRID标签的标识一起发送到物联网认证中心， 由于 在发送前对其进行了加密保证了所述签名密钥在发送过程中不被修改， 并且和 所述 FRID标签一一对应； FRID读卡器对获取的第一传感信息加密生成第二密文 ， 并生成与所述第一传感信息对应的数字签名， 以便后续物联网***认证中心 根据所述 FRID标签的标识选择对应的签名密钥对所接收到的信息进行验签。 此 过程中在 FRID读卡器一端形成加密***， 在发送第一传感信息前对第一传感信 息和签名密钥分别进行加密， 两次加密保证了信息的安全发送； 生成第一传感 信息的数字签名， 方便后续对其进行验签， 进一步保证了物联网***认证中心 所接收到的信息的安全性。
对附图的简要说明
附图说明
[0039] 图 1是现有技术中 FRID标签和 FRID读卡器工作原理示意图；
[0040] 图 2是本发明第一实施例提供的一种终端设备安全接入物联网的方法的流程图 [0041] 图 3是本发明第二实施例提供的一种终端设备安全接入物联网的方法的流程图 [0042] 图 4是本发明第三实施例提供的一种终端设备安全接入物联网的方法的流程图
[0043] 图 5是本发明第四实施例提供的一种终端设备安全接入物联网的信息交互示意 图；
[0044] 图 6是本发明第四实施例提供的一种终端设备安全接入物联网的***的结构框 图；
本发明的实施方式
[0045] 为了使本发明的目的、 技术方案及优点更加清楚明白， 以下结合附图及实施例 ， 对本发明进行进一步详细说明。 应当理解， 此处所描述的具体实施例仅仅用 以解释本发明， 并不用于限定本发明。
[0046] 为了说明本发明所述的技术方案， 下面通过具体实施例来进行说明。
[0047] 实施例 1
[0048] 物联网即通过射频识别 (RFID)、 红外感应器、 全球定位***、 激光扫描器等信 息传感设备， 按约定的协议， 把任何物品与互联网相连接， 进行信息交换和通 信， 以实现智能化识别、 定位、 跟踪、 监控和管理的一种网络概念。 其中无线 射频识别技术基本原理是利用射频信号和空间耦合 （电感或电磁耦合） 传输特 性,实现对被识别物体的自动识别。 无线射频识别***由电子标签和读写器 （读 卡器） 两个部份组成如图 1所示， 在其实际应用中， 电子标签附在被识别物体的 表面或者内部， 当该物体带着标签经过读写器作用范围吋， 读写器可以用非接 触方式读取电子标签里面存放的信息或将预定数据写入电子标签实现了对带标 签物体自动识别和自动收集数据的功能。 读写器将收集到的信息发送到数据管 理*** （物联网***） 即可实现将各种物体通过网络连接起来。 但在读写器将 收集到的信息发送至物联网***的过程中存在数据泄漏或数据被篡改的可能， 因此， 在本发明第一实施例中提供了一种终端设备安全接入物联网的方法， 如 图 2所示， 其中： [0049] 步骤 S21， 读取 FRID标签的第一传感信息， 调用一组随机数作为签名密钥， 加 密所述签名密钥， 得到第一密文；
[0050] 该步骤中， FRID读卡器扫描要接入物联网的终端设备上附着的 RFID标签， 读 取 RFID标签中包含的传感信息， 即第一传感信息， 所述第一传感信息包括终端 设备的名称、 型号、 终端设备的为唯一标识码、 对外幵放权限等信息。 根据所 述第一传感信息， 调用 RFID读卡器中的随机数发生器中的一组随机数， 设置所 述随机数为与所述第一传感信息相对应的签名密钥。 由于随机数具有随机性， 每次产生的随机数都存在一定的差异， 因此， 在 RFID读卡器读取到一组第一传 感信息吋， 将一个随机数作为该组第一传感信息的签名密钥， 可以使第一传感 信息与签名密钥一一对应。 所述签名密钥被发送至物联网***的认证中心， 用 于后续对第一传感信息真实唯一性的验证。
[0051] 为了避免签名密钥在发送至物联网***过程中被篡改， 首先对所述签名密钥进 行加密处理以生成第一密文。 加密吋调用预先存储的物联网***的公钥对所述 签名密钥进行加密； 所述物联网***的公钥预先存储在所述 RFID读卡器中。 利 用预先存储的物联网***的公钥对所述签名密钥进行加密生成第一密文， 在发 送所述第一密文到物联网***的过程中即使所述第一密文被无权限终端获取， 由于无权限终端无法获知物联网***的私钥， 因此， 也无法获取第一密文中的 签名密钥的信息， 保证了签名密钥在信息传递过程中的安全、 唯一性。
[0052] 优选地， 所述读取 FRID标签的第一传感信息， 调用一组随机数作为签名密钥 ， 加密所述签名密钥， 得到第一密文， 具体包括：
[0053] 读取 FRID标签的第一传感信息， 调用随机数发生器生产一组随机数， 将所述 随机数作为签名密钥；
[0054] 调用预先存储的密钥加密所述签名密钥， 生成第一密文。
[0055] 具体地， 为了使 FRID读卡器与物联网认证中心之间能够安全的进行信息传递 ， 首先在 FRID读卡器一端建立加密***， 在 FRID读卡器读取到传感信息吋， 调 用加密***中的随机数发生器产生的一组随机数， 将所述随机数作为与此次读 取的第一传感信息相对应的签名密钥， 所述签名密钥用于后续对处理后的第一 传感信息的验签。 对于产生的签名密钥调用加密***中预先存储的密钥对其进 行加密， 生成第一密文， 在后续信息传递的过程中发送所述第一密文， 以确保 签名密钥在信息传递过程中的安全性。
[0056] 步骤 S22， 调用所述 FRID标签的标识， 发送所述 FRID标签的标识及所述第一密 文到物联网***认证中心；
[0057] 该步骤中， 在对签名密钥加密生成第一密文后， 调用所述 FRID标签的标识， 所述标识用于对所述 FRID标签进行唯一标记， 并在 FRID标签生成吋一起生成标 识， 将所述标识固定在 FRID标签中不可改变。 在生成 FRID标签的标识吋可以单 纯的利用数字的大小排序生成 FRID标签的标识， 也可将 FRID标签的生成吋间及 地点相结合生成 FRID标签的标识， 例如对于不同公司生产的 FRID标签可以首先 标注公司独有的标识， 然后再标注 FRID标签的生成吋间， 对于同一吋间生成的 标签可以按一定的顺序标注在公司独有的标识后面最终构成 FRID标签的标识。 在 FRID标签生成吋即生成其标识， 并将其标识固定在 FRID标签中不可改变， 即形成对 FRID标签的唯一标记， 在将此 FRID标签应用到终端设备吋并将终端设 备连接到物联网***中后， 即可在物联网***中对所述终端设备进行唯一标识 。 该步骤中， 将 FRID标签的标识和第一密文发送中到物联网认证中心， 以便后 续物联网***认证中心接收到与所述 FRID标签信息吋调用与其对应的第一密文 对其进行验签。
[0058] 步骤 S23， 加密所述第一传感信息， 得到第二密文， 并生成所述第一传感信息 的数字签名；
[0059] 该步骤中， 为了使 FRID读卡器得到的第一传感信息能够安全的传送到物联网 ***认证中心， 首先在 FRID读卡器端建立加密***， 对所述第一传感信息进行 加密。
[0060] 优选地， 所述加密所述第一传感信息， 得到第二密文， 并生成所述第一传感信 息的数字签名， 具体包括：
[0061] 调用轻量级密码算法， 加密所述传感信息成第二密文；
[0062] 调用摘要算法， 通过所述摘要算法以及所述签名密钥加密所述第一传感信息以 生成所述传感信息的数字签名。
[0063] 具体地， 对于 FRID读卡器获取的第一传感信息， 调用预先存储在 FRID读卡器 一端的加密***中的轻量级密码算法对其进行加密， 轻量级密码算法具有执行 效率高、 计算资源消耗少， 适应能力强等特点， 所述轻量级密码算法可以为流 密码中的 RC4算法或分组密码算法中的 PRESENT算法等， 在此不做限定； 在对 F RID读卡器获取的第一传感信息进行加密可对所述第一传感信息预先进行判断， 若所获取的第一传感信息对于安全性要求不高， 或者需要快速对其进行加密， 则可以调用 FRID读卡器加密***中预先存储的流密码中的 RC4算法对其进行加 密， 例如 FRID读卡器同吋获取了对个第一传感信息， 需要在短吋间内对其进行 处理， 并且所获得的第一传感信息在进行消息传递吋对安全性要求一般， 则既 可以调用流密码中的 RC4算法进行加密。 若 FRID读卡器获取的第一传感信息在 信息传递吋要求高的安全性， 但对处理吋间无特殊要求， 则可以调用分组密码 算法中的 PRESENT算法进行加密运算， 以保证其安全性。 进一步地， 调用 FRID 读卡器加密***中的摘要算法从所述第一传感信息生成一个散列值， 通过签名 密钥对生成的散列值进行加密后生成数字签名。
[0064] 该步骤中， 在对第一传感信息进行加密吋， 通过对获取的第一传感信息进行判 断， 选择合适的轻量级加密算法， 可以在保证第一传感信息安全传递的前提下 ， 提高 FRID读卡器对接收到的第一传感信息的处理效率， 并且在对第一传感信 息进行加密的同吋， 生成第一传感信息的数字签名， 以方便后续物联网***认 证中心对接收的加密后的第一传感信息的判断和验签。
[0065] 步骤 S24， 发送所述 FRID标签的标识、 所述第二密文以及和所述数字签名到所 述物联网***认证中心， 以使所述物联网***认证中心对所述第二密文和所述 数字签名进行解密和验签。
[0066] 该步骤中， FRID读卡器将加密第一传感信息得到的第二密文， 数字签名以及 与所述第传感信息对应的 FRID标签的标识一起发送至物联网***认证中心。 在 发送过程中， 若 FRID读卡器同吋获取了多个 FRID标签的第一传感信息并对其进 行了处理， 则按照预先设定的发送规则对多份处理后的第一传感信息进行发送 。 可选地， 所述预先设定的发送规则可以为按所获取的第一传感信息的信号的 强弱来发送处理后的第一传感信息到物联网认证中心； 第一传感信息的信号较 强吋， 在一定程度上说明其更容易被接入物联网***， 首先处理容易接入物联 网***的终端设备， 可以节约后续终端设备接入的等待吋间， 提高接入物联网 ***的接入效率。 所述预先设定的发送规则还可以为： 按照 FRID读卡器获取的 第一传感信息的吋间排序来发送处理后的第一传感信息到物联网认证中心； FRI D读卡器对于第一吋间获取到的某一终端设备的 FRID标签上的第一传感信息， 可以在获取后立即对其进行如步骤 S21-步骤 S23的处理， 相对于后获取的终端设 备的 FRID标签上的第一传感信息， 可以较早的发送处理后结果到物联网***认 证中心， 从而减少 FRID读卡器一端的处理任务积压量。 当然也根据情况交替选 择上述两种发送规则。 具体的选择怎样的发送规则可根据实际情况进行选择， 在此不做限定。 该步骤中， 在发送 FRID标签的标识、 第二密文以及数字签名到 所述物联网***认证中心吋， 可以根据实际情况选择发送的规则， 既可以满足 终端设备快速接入物联网***的需要也可减少 FRID读卡器一端待处理的第一传 感信息的任务数量。
[0067] 本实施例中 FRID读卡器一端设置加密***， 接收到 FRID标签的第一传感信息 后， 调用随机数发生器中产生的一组随机数作为与 FRID标签的第一传感信息相 对应的签名密钥， 将所述签名密钥加密后生成第一密文和所述 FRID标签的标识 一起发送到物联网认证中心， 由于在发送前对其进行了加密保证所述签名密钥 在发送过程中不被修改， 并且和所述 FRID标签一一对应； 对于接收到的待接入 物联网***的终端设备， 将从与所述终端设备对应的 FRID标签中获取的第一传 感信息加密生成第二密文， 并生成与所述第一传感信息对应的数字签名， 在发 送到物联网***认证中心进行判断吋将所述 FRID标签的标识、 所述第二密文以 及所述数字签名一起发送， 以便后续物联网***认证中心根据所述 FRID标签的 标识选择对应的签名密钥对所接收到的信息进行验签。 此过程中在 FRID读卡器 一端形成加密***， 在发送第一传感信息前对第一传感信息和签名密钥分别进 行加密， 两次加密保证了信息的安全发送； 生成第一传感信息的数字签名， 方 便后续对其进行验签， 进一步保证了物联网***认证中心所接收到的信息的安 全性。
[0068] 实施例 2
[0069] 图 3示出了本发明第二实施例提供的一种终端设备安全接入物联网的方法的流 程图， 如图 3所示的所述方法包括：
[0070] 步骤 S31， 读取 FRID标签的第一传感信息， 调用一组随机数作为签名密钥， 加 密所述签名密钥， 得到第一密文；
[0071] 步骤 S32， 调用所述 FRID标签的标识， 发送所述标识及所述第一密文到物联网 ***认证中心；
[0072] 步骤 S33， 加密所述第一传感信息， 得到第二密文， 并生成所述第一传感信息 的数字签名；
[0073] 步骤 S34， 发送所述 FRID标签的标识、 所述第二密文以及和所述数字签名到所 述物联网***认证中心， 以使所述物联网***认证中心对所述第二密文和所述 数字签名进行解密和验签；
[0074] 其中， 步骤 31- 34与实施例一中步骤 21- 24分别相对应， 在此不再赘述。
[0075] 步骤 S35， 接收物联网***认证中心发送的授权接入信息， 根据所述授权接入 信息连接 FRID标签所属的终端设备到物联网***。
[0076] 该步骤中， 在物联网***认证中心对所接收到信息认证通过后， 即发送授权终 端设备接入物联网***的授权接入信息， FRID读卡器接收到所述授权接入信息 后调用与所述授权接入信息对应的 FRID标签的标识， 通过所述 FRID标签的标识 选择并确认相应的终端设备的接入。 通过 FRID标签的标识对待接入物联网*** 认证中心的终端设备进行确认， 减少了错误接入的概率。
[0077] 实施例 3
[0078] 图 4为实施例三中提供的终端设备安全接入物联网的方法的流程图， 其中： [0079] 步骤 S41， 物联网***认证中心接收并存储所述 FRID读卡器发送的 FRID标签的 标识和第一密文； 并接收所述 FRID读卡器发送的第二密文及数字签名；
[0080] 该步骤中， 物联网***认证中心接收所述 FRID读卡器发送的 FRID标签的标识 和第一密文， 并将所述 FRID标签的标识和第一密文存储在存储器内， 在对所述 F RID标签的标识和第一密文进行存储吋， 分析所述 FRID标签的标识， 按照所述 F RID标签的标识的不同类别分类进行存储。 例如同一地区终端设备上所附着的标 签根据 FRID标签的标识的生产厂家不同将其分类存储， 或者按照 FRID标签所附 着的设备进行分类； 具体对物联网***认证中心接收到的处理后的第一传感信 息的分类存储方法不做限定。 将 FRID标签的标识有助于快速的找到要调用的 FRI D标签的标识， 进而快速调用与之对应的签名密钥。
[0081] 步骤 S42， 物联网***认证中心解密所述第一密文得到签名密钥， 并解密所述 第二密文得到第一传感信息；
[0082] 具体地， 物联网认证中心解密接收到的第一密文和第二密文， 分别得到签名密 钥和第一传感信息， 在解密前首先调用与第一密文一起存储在物联网***认证 中心的 FRID标签的标识和与第二密文一起发送到物联网***认证中心的 FRID标 签的标识， 对比二者是否一致， 在二者一致吋， 说明要解密的第一密文和第二 密文同属于一个 FRID标签的信息。 然后再对同属于一个 FRID标签的第一密文和 第二密文进行解密。
[0083] 步骤 S43， 物联网***认证中心通过所述第一传感信息和所述签名密钥对所述 数字签名进行验签， 得到验签结果， 并根据所述验签结果判断是否发送授权接 入信息到所述 FRID读卡器。
[0084] 具体地， 解密得到第一传感信息和签名密钥后， 调用预先存储在物联网***认 证中心的摘要算法计算出所述第一传感信息的一组散列值， 为清楚的描述这里 称所述散列值为第一散列值； 通过所述签名密钥对所述数字签名进行验签同样 得出一组散列值， 称其为第二散列值； 对比第一散列值与第二散列值是否相同 ， 在二者相同吋， 说明与第二散列值对应的数字签名是由与第一散列值对应的 第一传感信息生成的， 并且所述第一传感信息在传递过程中未被篡改， 从而完 成对所述数字签名的验签。 在所述第一传感信息未被篡改吋， 生成授权与所述 第一传感信息对应的 FRID标签接入物联网***的授权接入指令， 并发送所述授 权接入指令到 FRID读卡器， 以保证所述 FRID标签安全的接入物联网***。
[0085] 本发明实施例中物联网***中心对接收到的第第一密文、 第二密文以及数字签 名分别进行解密和验签， 解密吋首先判断第一密文和第二密文是否同属于一个 F RID标签的信息， 然后再进行解密， 保证了解密后的签名密钥和第一传感信息相 对应； 由于数字签名代表了文件的特征， 文件如果发生改变， 数字签名也将发 生变化， 因此通过对数字签名的验签， 既保证了数字签名和第一传感信息来自 同一 FRID标签， 又能确保所述接受的第一传感信息的完整性和原始性。 从而再 次确认了第一传感信息传递过程的安全性。
[0086] 实施例 4
[0087] 图 5示出了上述终端设备安全接入物联网***的一种信息交互图， 详述如下： [0088] 在步骤 S51中， FRID读卡器获取 FRID标签中的第一传感信息， 并调用一组随机 数作为签名密钥；
[0089] 在本发明实施例中 FRID读卡器对于要接入物联网***的终端设备通过扫描或 感知 FRID标签获取第一传感信息， 然后从 FRID读卡器中的随机数发生器中获取 一组随机数作为与所获取的第一传感信息对应的签名密钥。
[0090] 在步骤 S52中， FRID读卡器加密所述签名密钥得到第一密文， 并调用 FRID标签 的标识；
[0091] 本发明实施例中 FRID读卡器通过预先存储的密钥对所述签名密钥进行加密得 到第一密文， 以保证签名密钥在信息传递过程中的安全性； 然后调用 FRID标签 的标识， 所述 FRID标签的标识用于对 FRID标签进行唯一标记。
[0092] 在步骤 S53中， FRID读卡器发送所述 FRID标签和所述第一密文到物联网***认 证中心；
[0093] FRID读卡器与物联网***认证中心通过无线连接， 可选地， 上述无线连接可 以为基于红外、 蓝牙、 无线保真 （Wireless-Fidelity, Wi-Fi) 、 紫蜂协议 （Zigbe e) 或者啁啾协议的连接， 其中， 上述啁啾协议是一种轻量级的物联网协议， 基 于上述啁啾协议传播的数据为啁啾数据， 上述啁啾数据仅包含最小的幵销负载 、 传输指向箭头、 简单的非唯一性地址以及合适的校验和， 是一种轻量级的、 传播广泛的数据包。 当然， FRID读卡器也可以通过其它方式与物联网***认证 中心连接， 此处不作限定。
[0094] 在步骤 S54中， 物联网***认证中心接收并存储所述 FRID标签的标识和所述第 一密文；
[0095] 在步骤 S55中， FRID读卡器对所述第一传感信息进行加密得到第二密文， 并生 成所述第一传感信息的数字签名；
[0096] 本实施例中 FRID读卡器对所获取的第一传感信息首先进行加密得到第二密文
， 并获取所述第一传感信息的数字签名， 其中所述第一传信息由 FRID读卡器通 过扫描或感知 FRID标签获取。 具体加密过程可参照上述步骤 S23的实现过程， 此 处不再赘述。
[0097] 在步骤 S56中， FRID读卡器发送所述 FRID标签、 所述第二密文和所述数字签名 到物联网***认证中心； 该步骤中信息传递过程参照上述步骤 53的实现过程， 不再赘述。
[0098] 在步骤 S57中， 物联网认证中心解密所存储的第一密文， 并对接收到的第二密 文和数字签名进行解密和验签； 在验签通过吋生成授权接入信息；
[0099] 本发明实施例中， 物联网***认证中心首先解密第一密文得到签名密钥， 然后 解密第二密文得到第一传感信息， 通过所得到的第一签名密钥和第一传感信息 对数字签名进行验签， 以确认第一传感信息的原始性。 在对所述数字签名验签 通过吋， 生成授权终端设备接入物联网认证中心的授权接入信息。
[0100] 在步骤 S58中， 物联网***认证中心发送授权接入信息到 FRID读卡器；
[0101] 在步骤 S59中， FRID读卡器根据所接收到的授权接入信息， 连接终端设备到物 联网***。
[0102] 由此可见， 本发明实施例中， 通过在 FRID读卡器端对所获取的第一传感和签 名密钥分别进行加密， 并得到第一传感信息的签名密钥， 然后将加密后的信息 及数字签名发送到物联网***认证中心， 再由物联网***认证中心进行两次解 密和对数字签名的验签， 比包拯 FRID读卡器对获取的第一传感信息进行信息传 递吋的安全性， 保证终端设备安全接入物联网***。
[0103] 应理解， 在本发明实施例中， 上述各过程的序号的大小并不意味着执行顺序的 先后， 各过程的执行顺序应以其功能和内在逻辑确定， 而不应对本发明实施例 的实施过程构成任何限定。
[0104] 实施例 5
[0105] 图 6示出了本发明第五实施例提供一种终端设备安全接入物联网的***的结构 框图， 为了便于说明， 仅示出了与本发明实施例相关的部分。
[0106] 如图 6所示， 所述一种终端设备安全接入物联网***的***包括： FRID读卡器 61、 物联网***认证中心 62， 其中所述 FRID读卡器包括： 第一加密单元 611， 第 一发送单元 612， 第二加密单元 613， 第二发送单元 614， 其中： [0107] 第一加密单元 611， 用于读取 FRID标签的第一传感信息， 调用一组随机数作为 签名密钥， 加密所述签名密钥， 得到第一密文；
[0108] 优选地， 所述第一加密单元 612， 具体包括：
[0109] 签名密钥生成模块， 用于读取 FRID标签的第一传感信息， 调用随机数发生器 生产一组随机数， 将所述随机数作为签名密钥；
[0110] 签名密钥加密模块， 用于调用预先存储的密钥加密所述签名密钥， 生成第一密 文。
[0111] 第一发送单元 612， 用于调用所述 FRID标签的标识， 发送所述 FRID标签的标识 及所述第一密文到物联网***认证中心；
[0112] 第二加密单元 613， 用于加密所述第一传感信息， 得到第二密文， 并生成所述 第一传感信息的数字签名；
[0113] 优选地， 所述第二加密单元 613， 具体包括：
[0114] 第二密文生成模块， 用于调用轻量级密码算法， 加密所述第一传感信息成第二 密文；
[0115] 数字签名生成模块， 用于调用摘要算法， 通过所述摘要算法以及所述签名密钥 生成所述第一传感信息的数字签名。
[0116] 第二发送单元 614， 用于发送所述第二密文以及所述数字签名到所述物联网系 统认证中心， 以使所述物联网***认证中心对所述第一密文、 第二密文和所述 数字签名进行解密和验签。
[0117] 可选的， 所述 FRID读卡器， 还包括：
[0118] 终端设备接入单元， 用于接收物联网***认证中心发送的授权接入信息， 根据 所述授权接入信息连接 FRID标签所属的终端设备到物联网***。
[0119] 所述物联网***认证中心包括： 接收单元 621、 解密单元 622、 授权接入信息生 成单元 623， 其中：
[0120] 接收单元 621， 用于接收并存储所述 FRID读卡器发送的 FRID标签的标识和第一 密文； 并接收所述 FRID读卡器发送的第二密文及数字签名；
[0121] 解密单元 622， 用于解密所述第一密文得到签名密钥， 解密所述第二密文得到 第一传感信息； [0122] 授权接入信息生成单元 623， 用于通过所述第一传感信息和所述签名密钥对所 述数字签名进行验签， 得到验签结果； 根据所述验签结果判断是否发送授权接 入信息到所述 FRID读卡器。
[0123] 本发明实施例中物联网***中心对接收到的第第一密文、 第二密文以及数字签 名分别进行解密和验签， 解密吋首先判断第一密文和第二密文是否同属于一个 F RID标签的信息， 然后再进行解密， 保证了解密后的签名密钥和第一传感信息相 对应； 由于数字签名代表了文件的特征， 文件如果发生改变， 数字签名也将发 生变化， 因此通过对数字签名的验签， 既保证了数字签名和第一传感信息来自 同一 FRID标签， 又能确保所述接受的第一传感信息的完整性和原始性。 从而再 次确认了第一传感信息传递过程的安全性。
[0124] 所属领域的技术人员可以清楚地了解到， 为描述的方便和简洁， 上述描述的系 统、 装置和单元的具体工作过程， 可以参考前述方法实施例中的对应过程， 在 此不再赘述。
[0125] 在本申请所提供的几个实施例中， 应该理解到， 所揭露的***、 装置和方法， 可以通过其它的方式实现。 例如， 以上所描述的装置实施例仅仅是示意性的， 例如， 所述单元的划分， 仅仅为一种逻辑功能划分， 实际实现吋可以有另外的 划分方式， 例如多个单元或组件可以结合或者可以集成到另一个***， 或一些 特征可以忽略， 或不执行。 另一点， 所显示或讨论的相互之间的耦合或直接耦 合或通信连接可以是通过一些接口， 装置或单元的间接耦合或通信连接， 可以 是电性， 机械或其它的形式。
[0126] 所述作为分离部件说明的单元可以是或者也可以不是物理上分幵的， 作为单元 显示的部件可以是或者也可以不是物理单元， 即可以位于一个地方， 或者也可 以分布到多个网络单元上。 可以根据实际的需要选择其中的部分或者全部单元 来实现本实施例方案的目的。
[0127] 另外， 在本发明各个实施例中的各功能单元可以集成在一个处理单元中， 也可 以是各个单元单独物理存在， 也可以两个或两个以上单元集成在一个单元中。
[0128] 所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用吋， 可 以存储在一个计算机可读取存储介质中。 基于这样的理解， 本发明的技术方案 本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产 品的形式体现出来， 该计算机软件产品存储在一个存储介质中， 包括若干指令 用以使得一台计算机设备 （可以是个人计算机， 服务器， 或者网络设备等） 执 行本发明各个实施例所述方法的全部或部分步骤。 而前述的存储介质包括： u盘
、 移动硬盘、 只读存储器 （ROM, Read-Only
Memory) 、 随机存取存储器 （RAM, Random Access Memory) 、 磁碟或者光盘 等各种可以存储程序代码的介质。
以上所述， 仅为本发明的具体实施方式， 但本发明的保护范围并不局限于此， 任何熟悉本技术领域的技术人员在本发明揭露的技术范围内， 可轻易想到变化 或替换， 都应涵盖在本发明的保护范围之内。 因此， 本发明的保护范围应所述 以权利要求的保护范围为准。

Claims

权利要求书
[权利要求 1] 一种终端设备安全接入物联网的方法， 其特征在于， 所述终端设备安 全接入物联网的方法包括：
读取 FRID标签的第一传感信息， 调用一组随机数作为签名密钥， 加 密所述签名密钥， 得到第一密文；
调用所述 FRID标签的标识， 发送所述 FRID标签的标识及所述第一密 文到物联网***认证中心；
加密所述第一传感信息， 得到第二密文， 并生成所述第一传感信息的 数字签名；
发送所述第二密文以及所述数字签名到所述物联网***认证中心， 以 使所述物联网***认证中心对所述第一密文、 第二密文和所述数字签 名进行解密和验签。
[权利要求 2] 根据权利要求 1所述的终端设备安全接入物联网的方法， 其特征在于
， 所述读取 FRID标签的第一传感信息， 调用一组随机数作为签名密 钥， 加密所述签名密钥， 得到第一密文， 具体包括：
读取 FRID标签的第一传感信息， 调用随机数发生器生产一组随机数 ， 将所述随机数作为签名密钥；
调用预先存储的密钥加密所述签名密钥， 生成第一密文。
[权利要求 3] 根据权利要求 1所述的终端设备安全接入物联网的方法， 其特征在于
， 所述加密所述第一传感信息， 得到第二密文， 并生成所述第一传感 信息的数字签名， 具体包括：
调用轻量级密码算法， 加密所述第一传感信息成第二密文； 调用摘要算法， 通过所述摘要算法以及所述签名密钥生成所述第一传 感信息的数字签名。
[权利要求 4] 根据权利要求 1-3任一项所述的终端设备安全接入物联网的方法， 其 特征在于， 在所述发送所述第二密文以及所述数字签名到所述物联网 ***认证中心， 以使所述物联网***认证中心对所述第一密文、 第二 密文和所述数字签名进行解密和验签之后， 还包括： 接收物联网***认证中心发送的授权接入信息， 根据所述授权接入信 息连接 FRID标签所属的终端设备到物联网。
[权利要求 5] 根据权利要求 4所述的终端设备安全接入物联网的方法， 其特征在于
， 所述终端设备安全接入物联网的方法还包括： 物联网***认证中心接收并存储所述 FRID读卡器发送的 FRID标签的 标识和第一密文； 并接收所述 FRID读卡器发送的第二密文及数字签 名；
物联网***认证中心解密所述第一密文得到签名密钥， 并解密所述第 二密文得到第一传感信息；
物联网***认证中心通过所述第一传感信息和所述签名密钥对所述数 字签名进行验签， 得到验签结果， 并根据所述验签结果判断是否发送 授权接入信息到所述 FRID读卡器。
[权利要求 6] —种终端设备安全接入物联网的***， 其特征在于， 所述终端设备安 全接入物联网的***包括： FRID读卡器、 物联网***认证中心， 其 中所述 FRID读卡器包括：
第一加密单元， 用于读取 FRID标签的第一传感信息， 调用一组随机 数作为签名密钥， 加密所述签名密钥， 得到第一密文；
第一发送单元， 用于调用所述 FRID标签的标识， 发送所述 FRID标签 的标识及所述第一密文到物联网***认证中心； 第二加密单元， 用于加密所述第一传感信息， 得到第二密文， 并生成 所述第一传感信息的数字签名；
第二发送单元， 用于发送所述第二密文以及所述数字签名到所述物联 网***认证中心， 以使所述物联网***认证中心对所述第一密文、 第 二密文和所述数字签名进行解密和验签。
[权利要求 7] 根据权利要求 6所述的终端设备安全接入物联网的***， 其特征在于
， 所述第一加密单元具体包括：
签名密钥生成模块， 用于读取 FRID标签的第一传感信息， 调用随机 数发生器生产一组随机数， 将所述随机数作为签名密钥； 签名密钥加密模块， 用于调用预先存储的密钥加密所述签名密钥， 生 成第一密文。
[权利要求 8] 根据权利要求 6所述的终端设备安全接入物联网的***， 其特征在于 ， 所述第二加密单元具体包括：
第二密文生成模块， 用于调用轻量级密码算法， 加密所述第一传感信 息成第二密文；
数字签名生成模块， 用于调用摘要算法， 通过所述摘要算法以及所述 签名密钥生成所述第一传感信息的数字签名。
[权利要求 9] 根据权利要求 6-8任一项所述的终端设备安全接入物联网的***， 其 特征在于， 所述 FRID读卡器还包括：
终端设备接入单元， 用于接收物联网***认证中心发送的授权接入信 息， 根据所述授权接入信息连接 FRID标签所属的终端设备到物联网
[权利要求 10] —种物联网***认证中心， 其特征在于， 所述物联网***认证中心包 括：
接收单元， 用于接收并存储所述 FRID读卡器发送的 FRID标签的标识 和第一密文； 并接收所述 FRID读卡器发送的第二密文及数字签名； 解密单元， 用于解密所述第一密文得到签名密钥， 解密所述第二密文 得到第一传感信息；
授权接入信息生成单元， 用于通过所述第一传感信息和所述签名密钥 对所述数字签名进行验签， 得到验签结果； 根据所述验签结果判断是 否发送授权接入信息到所述 FRID读卡器。
PCT/CN2017/093224 2017-06-16 2017-07-17 一种终端设备安全接入物联网的方法及*** WO2018227685A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710462756.1A CN107231231B (zh) 2017-06-16 2017-06-16 一种终端设备安全接入物联网的方法及***
CN201710462756.1 2017-06-16

Publications (1)

Publication Number Publication Date
WO2018227685A1 true WO2018227685A1 (zh) 2018-12-20

Family

ID=59935129

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/093224 WO2018227685A1 (zh) 2017-06-16 2017-07-17 一种终端设备安全接入物联网的方法及***

Country Status (2)

Country Link
CN (1) CN107231231B (zh)
WO (1) WO2018227685A1 (zh)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109982309A (zh) * 2019-03-19 2019-07-05 湘潭大学 基于rfid认证与混合加密的楼宇微网用电数据安全传输技术
CN110049019B (zh) * 2019-03-26 2020-09-01 合肥工业大学 主动安全的医疗物联网设备识别与监控方法
CN110232296B (zh) * 2019-04-25 2020-06-30 苏州车付通信息科技有限公司 Rfid标签与读写器加密通讯的***
CN112702305B (zh) * 2019-10-23 2023-05-16 中电智能科技有限公司 ***接入认证方法及设备
CN111132152B (zh) * 2019-12-16 2023-04-07 成都三零瑞通移动通信有限公司 一种基于多层密钥体制的rfid标签认证方法
CN112804214A (zh) * 2020-12-31 2021-05-14 四川瑞霆电力科技有限公司 一种基于智慧物联网的感知层数据安全接入方法及其***
WO2022141600A1 (zh) * 2020-12-31 2022-07-07 华为技术有限公司 一种鉴权方法及通信装置
CN113965617A (zh) * 2021-08-26 2022-01-21 天地融科技股份有限公司 一种基于物联网打车的方法、装置及***
CN117955740A (zh) * 2024-03-26 2024-04-30 长城信息股份有限公司 一种设备安全认证方法及***

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102801722A (zh) * 2012-08-09 2012-11-28 福建物联天下信息科技有限公司 物联网认证方法及***
CN102833260A (zh) * 2012-09-05 2012-12-19 胡祥义 一种采用安全单钥管理技术的物联网密码认证方法
CN103237302A (zh) * 2013-03-28 2013-08-07 北京市科学技术情报研究所 一种物联网电子标签的传感信息安全防护方法
US20160352732A1 (en) * 2015-05-31 2016-12-01 Massachusetts lnstitute of Technology System and Method for Continuous Authentication in Internet of Things

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9785880B2 (en) * 2015-11-06 2017-10-10 Bank Of America Corporation Radio frequency identification activation
KR101721510B1 (ko) * 2016-11-14 2017-04-11 에스지에이솔루션즈 주식회사 프라이버시 보호를 위한 rfid 인증 방법

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102801722A (zh) * 2012-08-09 2012-11-28 福建物联天下信息科技有限公司 物联网认证方法及***
CN102833260A (zh) * 2012-09-05 2012-12-19 胡祥义 一种采用安全单钥管理技术的物联网密码认证方法
CN103237302A (zh) * 2013-03-28 2013-08-07 北京市科学技术情报研究所 一种物联网电子标签的传感信息安全防护方法
US20160352732A1 (en) * 2015-05-31 2016-12-01 Massachusetts lnstitute of Technology System and Method for Continuous Authentication in Internet of Things

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HU , XIANGYI ET AL.: "The Perception Layer Information Security Scheme for Internet of Things Based on Lightweight Cryptography", NETWORK SECURITY TECHNOLOGY & APPLICATION, 31 December 2013 (2013-12-31) *

Also Published As

Publication number Publication date
CN107231231A (zh) 2017-10-03
CN107231231B (zh) 2020-09-25

Similar Documents

Publication Publication Date Title
WO2018227685A1 (zh) 一种终端设备安全接入物联网的方法及***
US11038694B1 (en) Devices, methods, and systems for cryptographic authentication and provenance of physical assets
TWI683567B (zh) 安全校驗方法、裝置、伺服器及終端
CN102831529B (zh) 一种基于射频的商品信息识别方法及***
US20150002260A1 (en) System and method for authenticating rfid tags
EP3017580B1 (en) Signatures for near field communications
CN102663591A (zh) 基于电子标签的产品防伪方法和***
CN102576397B (zh) 令牌的验证和数据完整性保护
CN107181714A (zh) 基于业务码的验证方法和装置、业务码的生成方法和装置
US11985245B2 (en) Access security system using security card and mobile terminal, and security method for same
CN103281189A (zh) 一种射频识别设备的轻量级安全协议认证***及方法
CN110290134A (zh) 一种身份认证方法、装置、存储介质及处理器
CN110969445B (zh) 基于nfc的防伪方法
US20180205714A1 (en) System and Method for Authenticating Electronic Tags
CN102970676A (zh) 一种对原始数据进行处理的方法、物联网***及终端
WO2019161285A1 (en) Devices and systems for industrial internet of things security
CN106789024A (zh) 一种远程解锁方法、装置和***
CN202870898U (zh) 一种基于射频的商品信息识别***
JP2015103048A (ja) 被認証体、認証システム、および、認証方法
CN102867260A (zh) 一种基于蓝牙的商品信息识别方法及***
US20200076589A1 (en) Security authentication method for generating secure key by combining authentication elements of multi-users
CN104883260B (zh) 证件信息处理和验证方法、处理终端及验证服务器
CN110650019A (zh) 基于puf和安全概略的rfid认证方法及***
Bilal et al. A hierarchical anti-counterfeit mechanism: securing the supply chain using RFIDs
JP2009004971A (ja) 通信システム、タグ装置、タグリーダ装置及びサーバ装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17913759

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 15/05/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 17913759

Country of ref document: EP

Kind code of ref document: A1