CN115884169A - Processing method, device, network equipment and storage medium of identity mark - Google Patents

Abstract

The present application discloses an identity processing method, device, network node and storage medium, wherein the first network device includes a first chip and a first server running in an environment TEE supported by the first chip; The first chip includes a security chip or a trusted chip; the method includes: the first server acquires a first request sent by the first terminal device; the first request is used to request to generate the first terminal device the identity of the first request; the first request carries at least one first information; the first information represents information used to describe the identity of the first terminal device; the first chip encrypts the second information to obtain the The first identity of the first terminal device; the second information represents a digest corresponding to the at least one piece of first information; the first server sends the first identity to the first terminal device.

Description

Processing method, device, network equipment and storage medium of identity mark

technical field

The present application relates to the field of the Internet of Things, and in particular to an identification processing method, device, network device and storage medium.

Background technique

In the perception control domain of the IoT system, most IoT terminals, such as perception terminals and control terminals, need to be protected through identity identification. In related technologies, the identity identification method of the Internet of Things terminal may easily lead to tampering or counterfeiting of the identity, or requires high software and hardware costs, and it is difficult to achieve effective and low-cost security protection for the Internet of Things terminal.

Contents of the invention

In order to solve related technical problems, the embodiments of the present application provide a method, device, network device, and storage medium for processing an identity mark.

The technical scheme of the embodiment of the application is realized in this way:

An embodiment of the present application provides a method for processing identity identification, which is applied to a first network device, and the first network device includes a first chip and runs in a Trusted Execution Environment (TEE, Trusted Execution) supported by the first chip. Environment) in the first server; the first chip includes a security chip or a trusted chip; the method includes:

The first server obtains a first request sent by the first terminal device; the first request is used to request to generate an identity of the first terminal device; the first request carries at least one piece of first information; the The first information represents information used to describe the identity of the first terminal device;

The first server acquires the first identity of the first terminal device; the first identity is obtained by encrypting second information; the second information represents a summary corresponding to the at least one first information information;

The first server sends the first identity to the first terminal device.

Wherein, in the above solution, the at least one first piece of information includes at least one piece of the following piece of information about the first terminal device:

device name;

devise serial number;

Media Access Control (MAC, Media Access Control) address;

Operating mode;

Uplink connection information.

In the above solution, before the first server acquires the first identity of the first terminal device, the method further includes:

The first server or the first chip performs a hash operation on the at least one piece of first information to obtain the second information.

In the above solution, the first server obtains the first identity of the first terminal device, including:

The first server sends a second request to the first chip; the second request is used to request the first chip to encrypt the second information;

The first server obtains the response returned by the first chip based on the second request; the response carries the encryption of the second information by the first chip based on the private key in the first key pair to obtain The first identity of .

In the above solution, the network device further includes a first database running in the TEE; the first database stores at least the identity of at least one terminal device generated by the first network device; the first A server sends the first identity to the first terminal device, including:

When the first server finds that the first identity is not stored in the first database, the first server sends the first identity to the first terminal device.

In the above scheme, the method also includes:

The first server stores the first identity and at least one of the following information of the first terminal device into the first database:

The at least one piece of first information, the second information, the first key pair used to encrypt the second information, and/or the generation time of the first identity.

In the above solution, the first network device further includes a first log module running in the TEE; the method further includes:

The first log module generates and stores a first log; wherein,

The first log represents a log that records related operations of the first identity.

In the above scheme, the method also includes:

The first server obtains the second request sent by the first terminal device; the second request is used to request re-access to the first network device; the second request carries the first identity logo;

When the first server confirms that the first terminal device is bound to the first network device based on the first identity in the second request, allowing the first terminal device to bind with the second network device A network device establishes a connection.

In the above scheme, the method also includes:

When the first terminal device is unbound from the first network device, the first server sets the first identity to be invalid.

In the above scheme, the method also includes:

The first server obtains a third request sent by the first terminal device; the third request is used to request the first network device to perform a request for the second network device or the second terminal device regarding the first terminal Security authentication of the identity of the device;

Based on the first connection between the first network device and the second network device or the second terminal device, the first server acquires the information sent by the second network device or the second terminal device A second identity; the second identity represents the identity of the first terminal device acquired by the second network device or the second terminal device;

When the first server confirms that the second identity is consistent with the first identity and satisfies the set conditions, send to the second network device or the second terminal through the first connection The device sends third information; the third information is used for the second network device or the second terminal device to obtain a security authentication result for the second identity.

In the above scheme, the setting conditions include at least one of the following:

The first identity is valid;

The first terminal device accesses the first network device;

The request limitation period of the third request is within the set limitation period range.

In the above solution, the first connection between the first network device and the second network device is a trusted connection or a secure connection.

The embodiment of the present application also provides an identity processing device, the device runs in the TEE supported by the first chip in the first network device; the first chip includes a security chip or a trusted chip; the Devices include:

The first processing unit is configured to obtain a first request sent by the first terminal device; the first request is used to request generation of the identity of the first terminal device; the first request carries at least one piece of first information; The first information represents information used to describe the identity of the first terminal device;

The second processing unit is configured to acquire a first identity of the first terminal device; the first identity is obtained by encrypting second information; the second information represents a digest corresponding to the at least one first information information;

The third processing unit is configured to send the first identity to the first terminal device.

The embodiment of the present application also provides a first network device, characterized in that the first network device includes a first chip, a first processor, and a first communication interface; the first chip includes a security chip or a trusted chip; among them,

The first communication interface is used to obtain a first request sent by the first terminal device in the TEE supported by the first chip; the first request is used to request to generate the identity of the first terminal device; The first request carries at least one piece of first information; the first information represents information used to describe the identity of the first terminal device;

The first processor is configured to acquire a first identity of the first terminal device in the TEE; the first identity is obtained by encrypting second information; the second information represents the Summary information corresponding to at least one first piece of information;

The first communication interface is further configured to send the first identity to the first terminal device in the TEE.

The embodiment of the present application also provides an Internet of Things system, which is characterized in that it includes a first terminal device and a first network device, and the first network device includes a first chip and runs on a TEE supported by the first chip. In the first server; the first chip includes a security chip or a trusted chip; wherein,

The first server is configured to obtain a first request sent by the first terminal device; the first request is used to request to generate an identity of the first terminal device; the first request carries at least one piece of first information ; The first information represents information used to describe the identity of the first terminal device;

The first server is further configured to obtain a first identity of the first terminal device; the first identity is obtained by encrypting second information; the second information represents the at least one first Summary information corresponding to the information;

The first server is further configured to send the first identity to the first terminal device.

In this embodiment of the present application, the first network device includes a first chip and a first server running in a TEE supported by the first chip, wherein the first chip includes a security chip or a trusted chip, based on Here, the first server obtains the first request sent by the first terminal device, the first request is used to request to generate the identity of the first terminal device, and the first request carries at least one The first information of the identity of the first terminal device; the first server obtains the first identity of the first terminal device; the first identity is obtained by encrypting the second information; the first The second information represents summary information corresponding to the at least one piece of first information; and the first server sends the first identity to the first terminal device. Based on the foregoing solution, it is possible to prevent the identity of the terminal device from being tampered with or counterfeited, thereby realizing effective and low-cost security protection for the terminal device.

Description of drawings

FIG. 1 is a schematic diagram of a related technology IoT system perception control domain networking;

FIG. 2 is a schematic diagram of the processing flow of identity identification in the embodiment of the present application;

FIG. 3 is a schematic diagram of the processing flow of identity identification in the application embodiment of the present application;

FIG. 4 is a schematic diagram of the security authentication process of the identity identification in the embodiment of the present application;

FIG. 5 is a schematic diagram of the security authentication process of the identity mark in the application embodiment of the present application;

FIG. 6 is a schematic diagram of an application scenario of a method for processing an identity mark according to an embodiment of the present application;

FIG. 7 is a schematic structural diagram of an identity processing device according to an embodiment of the present application;

FIG. 8 is a schematic structural diagram of a first network device according to an embodiment of the present application.

Detailed ways

Most of the IoT terminals in the perception control domain of the IoT system, such as perception terminals and control terminals, as shown in Figure 1, need to connect devices such as IoT gateways, routers and/or smart gateways for local networking, and then Connect to the Internet to communicate with the IoT platform. Generally speaking, IoT terminals such as sensing terminals and control terminals are low in cost, without built-in security chips or trusted chips, and generally have weak computing power, storage capacity, and battery life, and do not support complex encryption and decryption operations and information security. Therefore, the identification method of the IoT terminal is relatively simple. In related technologies, common identification methods include: the device manufacturer burns a device serial number as an identification into the device memory when the device leaves the factory, or, an IoT terminal capable of direct networking uses the MAC address or IP address As an identity mark, the above method can easily lead to tampering or counterfeiting of the device serial number. A small number of IoT terminals use the pre-installed security certificate combined with the product serial number as an identity, or the IoT terminal has a built-in trusted central processing unit (CPU, Central Processing Unit) or trusted platform module (TPM, Trusted Platform Module), Trusted Platform Control Module (TPCM, Trusted Platform Control Module) and other trusted chips are used as identity marks. The above method requires high software and hardware costs and poor compatibility and applicability. Therefore, it can be known that it is difficult to achieve effective and low-cost security protection in the identification method of the Internet of Things terminal in the related art.

Based on this, in various embodiments of the present application, the first network device includes a first chip and a first server running in a TEE supported by the first chip, wherein the first chip includes a security chip or a trusted chip, the first server obtains the first request sent by the first terminal device, the first request is used to request to generate the identity of the first terminal device, and the first request carries at least one The first information used to describe the identity of the first terminal device; the first server obtains the first identity of the first terminal device; the first identity is passed to the at least one first information The corresponding digest information is obtained by encrypting; and then the first server sends the first identity to the first terminal device. Based on the foregoing solution, it is possible to prevent the identity of the terminal device from being tampered with or counterfeited, thereby realizing effective and low-cost security protection for the terminal device.

First, the system architecture applicable to the identity processing method of the embodiment of this application is described:

The system framework includes network equipment and at least one terminal equipment. In actual application, the network equipment includes but is not limited to network connection equipment such as security intelligent gateways and routers. Further, the network equipment can be security intelligent gateways, A router, etc., is used to connect various IoT terminals located in the IoT-aware control domain within the same local area network. Compared with low-cost IoT terminals, network devices such as secure intelligent gateways and routers are usually equipped with sufficient computing and storage resources, and are usually equipped with security chips or trusted chips, which have higher security. In this embodiment of the application, the network device acts as the server, and the terminal device acts as the client. The two work together to construct a secure identity for the terminal device by using the security capability of the network device.

Wherein, a security chip or a trusted chip is built into the network device, and the identity identification processing method in this embodiment of the application is implemented in a security zone supported by a security chip or a trusted chip. Or run in a TEE supported by a trusted chip.

The application will be further described in detail below in conjunction with the accompanying drawings and embodiments.

An embodiment of the present application provides a method for processing identity identification. As shown in FIG. 2 , the execution body of the method is the first network device. As mentioned above, the first network device includes the first chip and runs on the The first server in the TEE supported by the first chip; the first chip includes a security chip or a trusted chip. The method includes:

Step 201: The first server obtains the first request sent by the first terminal device.

The first request is used to request to generate the identity of the first terminal device; the first request carries at least one piece of first information; the first information represents information used to describe the identity of the first terminal device .

Here, before sending the first request, the first terminal device collects information that can represent the identity of the first terminal device and has relatively fixed information content according to the type of information to be collected specified in the setting configuration, including but not limited to the device name , device serial number, MAC address, working mode and/or uplink connection information. In practical application, the first terminal device may send the collected information to the first network device in the form of information set or information sequence, and request the first network device to generate a unique identity for the first terminal device.

Step 202: The first server acquires the first identity of the first terminal device.

The first identity is obtained by encrypting the second information; the second information represents summary information corresponding to the at least one piece of first information.

After receiving the first request, the first network device uses the built-in digest algorithm in the security chip/trusted chip to process the information used to describe the identity of the first terminal device carried in the first request to obtain at least A digest corresponding to the first information, and encrypting the generated digest to obtain the first identity of the first terminal device. Since the generation process of the identity mark is completely carried out in the TEE supported by the security chip/trusted chip, the security of the identity mark can be guaranteed.

Wherein, for the abstract generation process, in an embodiment, before the first server acquires the first identity of the first terminal device, the method further includes:

The first server or the first chip performs a hash operation on the at least one piece of first information to obtain the second information.

Here, after receiving the first request, at least one digest corresponding to the first information is obtained through a hash operation using a digest algorithm built in the secure chip/trusted chip. In practical applications, if the security chip/trusted chip does not have a built-in digest algorithm, or does not open related digest computing capabilities, it is also possible to embed the digest algorithm in the first server of the TEE supported by the secure chip/trusted chip, Further, at least one abstract corresponding to the first information is obtained.

In actual application, for the case where the first terminal device sends at least two pieces of first information to the first network device, or for the first terminal device to send an information set or information set containing multiple first information to the first network device In the case of a sequence, before calculating the corresponding summary information, the first network device may combine multiple pieces of first information, for example, process multiple pieces of first information into one piece of combined information by splicing, merging, etc., and then The corresponding summary information is generated based on the combined information.

For the encryption process, in an embodiment, the first server obtains the first identity of the first terminal device, including:

The first server sends a second request to the first chip; the second request is used to request the first chip to encrypt the second information;

The first server obtains the response returned by the first chip based on the second request; the response carries the encryption of the second information by the first chip based on the private key in the first key pair to obtain The first identity of .

In actual application, after the security chip/trusted chip generates the summary information, it sends the summary information to the first server, and after receiving the summary information, the first server applies to the security chip/trusted chip to generate a pair of keys Yes, for encrypting that digest information. After the security chip/trusted chip receives the second request for the key pair from the first server, it generates the first key pair, and encrypts the summary information based on the private key in the first key pair , so as to obtain the first identity of the first terminal device.

Here, the first server sends the summary information to the security chip/trusted chip, and the security chip/trusted chip encrypts the summary information. Wherein, the summary information can be carried in the second request and sent to the security chip/trusted chip, and after receiving the second request, the security chip/trusted chip extracts the summary information from the second request and generates a key pair , encrypt the extracted digest information with the private key in the key pair. That is to say, the security chip/trusted chip does not store the summary information, but only generates or encrypts the summary information.

In practical applications, if the security chip/trusted chip does not have a built-in encryption algorithm, or does not open related encryption capabilities, the encryption algorithm can also be embedded in the first server of the TEE supported by the security chip/trusted chip to obtain An abstract corresponding to at least one first piece of information.

Step 203: the first server sends the first identity to the first terminal device.

In the above solution, without increasing the hardware cost of the equipment, the high security capability and computing performance of the network equipment are used to realize the generation of the terminal device identity in the form of software implementation, which avoids the tampering of the terminal device identity or counterfeiting, so as to achieve effective and low-cost security protection for terminal equipment.

In an embodiment, the network device further includes a first database running in the TEE; the first database stores at least the identity of at least one terminal device generated by the first network device; The first server sending the first identity to the first terminal device includes:

When the first server finds that the first identity is not stored in the first database, the first server sends the first identity to the first terminal device.

Here, the first database mainly provides services such as storage, query, and update of the identity. Specifically, the first database mainly stores the identity generated by the first network device, and supports the first server to update the identity in the first database. ID for query and/or update. Since the first database runs in the TEE, effective data security can be obtained by storing the identity mark in the first database, and further, the identity mark can be protected in the first database through encrypted storage and other methods .

After obtaining the newly generated first identity, the first server inquires whether the first identity already exists in the first database, and if the result of the query is that the first identity does not exist in the first database, the The uniqueness of the first identity, at this time, send the first identity to the first terminal device; if the query result shows that the first identity has previously existed in the first database, the first server returns to the first terminal device The result that the first identity already exists.

In one embodiment, the method also includes:

The first server stores the first identity and at least one of the following information of the first terminal device into the first database:

The at least one piece of first information, the second information, the first key pair used to encrypt the second information, and/or the generation time of the first identity.

That is to say, when the generated identity is stored in the first database, the summary information corresponding to the identity, the key pair used when generating the identity, the generation time of the identity, and the corresponding terminal device are also stored. At least one piece of first information for describing the identity is provided, so that the identity in the first database can be queried and updated based on the stored information.

In an embodiment, the first network device further includes a first log module running in the TEE; the method further includes:

The first log module generates and stores a first log; wherein,

The first log represents a log that records related operations of the first identity.

The first log module also runs in the TEE, which can effectively protect the data security of the log, and thus enable effective data security protection for the identity.

In the application embodiment shown in Fig. 3 , the security intelligent gateway/router of the Internet of Things is used as the first network device, and the terminal device of the Internet of Things is used as the first terminal device. Based on the corresponding system architecture, the generation process of the identity is shown.

See Figure 3:

1. The identity identification client running on the IoT terminal device collects the information on the IoT terminal device that can represent the identity characteristics according to the client settings, obtains the information set F, and then sends the information set F to the security server running on the IoT terminal device. The identity identification server on the smart gateway/router applies to generate a unique security identity for the IoT terminal device.

2. After receiving the security identity creation application from the IoT terminal device, the identity server running on the IoT security smart gateway/router will combine and calculate the elements in the information set F representing the identity feature information of the device to form The combined device identity feature information S, and then send the combined device identity feature information S to the security chip/trusted chip, and apply for generating summary information. Wherein, S=Aggregation(F), and Aggregation( ) represents the information aggregation of the information set F.

3. The security chip/trusted chip uses the built-in related cryptographic algorithm to generate summary information MD _s for the combined device identity feature information S, and returns the result to the identity server, where: MD _s = Hash(S), Hash () indicates that a hash operation is performed on the combined device identity feature information S.

4. After receiving the summary information MD _s of the combined device identity feature information S, the identity identification server applies to the security chip/trusted chip to generate a pair of public-private key pairs, and sends the summary information MD _s to the security chip/trusted chip. Letter chip, apply for private key encryption of MD _s .

5. The security chip/trusted chip uses the built-in related cryptographic algorithm to generate a pair of public-private key pair PrivateKey:PublicKey, and uses the private key PrivateKey to encrypt the summary information MD _s , and then returns the result to the identification server.

6. The identity identification server uses the encrypted value of the received MD _s as the Security ID of the IoT terminal device, and sends the newly generated Security ID to the identity identification database for query, wherein, SecurityID=Crypt(MD _s , PrivateKey ), Crypt() characterizes the corresponding encrypted string returned by the identity database.

7. The identity identification database queries whether the newly generated SecurityID already exists in the database, and returns the query result to the identity identification server.

8. According to the query result, if the new security identity does not exist in the identity database, the identity server will use the new security identity SecurityID, summary information MD _s , public-private key pair PrivateKey:PublicKey, and security identity generation time Information such as Time and the original information set F of the IoT terminal device are stored in the identity database.

9. The identity server stores the log information related to the generation of the security identity into the identity log.

10. The identity server returns the security identity SecurityID to the identity client running on the IoT terminal device.

After the above-mentioned generation process of the security identity, the newly generated security identity for the IoT terminal device is finally:

SecurityID=Crypt(Hash(Aggregation(F)),PrivateKey)

In the IoT system, during actual deployment, the IoT terminal device and the IoT security smart gateway/router are usually paired or configured in a secure manner to establish the first connection, then the first time when the first connection is successfully established can be taken as The timing for IoT terminal devices to apply for identity identification.

Based on the above scheme, with the support of trusted IoT security intelligent gateways/routers, the identity generated for IoT terminal devices is associated with multiple characteristics of IoT terminal devices, which is unique and has high security sex. In actual application, IoT terminal devices can apply identity identification to other identification systems according to the requirements of IoT applications, such as Unique Device Identifier (UDID, Unique Device Identifier), Universally Unique Identifier (UUID, Universally Unique Identifier) ) or IEID and other identification systems.

In one embodiment, the method also includes:

The first server obtains the second request sent by the first terminal device; the second request is used to request re-access to the first network device; the second request carries the first identity logo;

When the first server confirms that the first terminal device is bound to the first network device based on the first identity in the second request, allowing the first terminal device to bind with the second network device A network device establishes a connection.

In the IoT system, when the IoT terminal device is bound to the IoT security smart gateway/router, each time the IoT terminal device reconnects, it needs to send the identity to the IoT security smart gateway/router for confirmation. If the identity server in the IoT security smart gateway/router confirms that the IoT terminal device and the identity belong to the bound device, the IoT terminal device is allowed to remain connected; if the identity server confirms that the IoT terminal device and If the ID does not belong to the bound device, the IoT terminal device will be disconnected, and an alarm message will be generated and recorded in the ID log.

In one embodiment, the method also includes:

When the first terminal device is unbound from the first network device, the first server sets the first identity to be invalid.

Once the IoT terminal device is unbound from the previous IoT security smart gateway/router and added to a new IoT security smart gateway/router, the IoT security smart gateway/router will set the original identity of the IoT terminal device to Invalid, and the IoT terminal device needs to apply to the newly bound IoT security smart gateway/router to generate a new SecurityID.

In actual application, when the first terminal device interacts with the cloud or the remote device, it can send the identity of the first terminal device to the other party to indicate the identity. In one embodiment, as shown in Figure 4, the method further includes:

Step 401: The first server acquires a third request sent by the first terminal device.

The third request is used to request the first network device to perform security authentication on the identity of the first terminal device for the second network device or the second terminal device.

In the IoT system, the second network device can be understood as an IoT cloud platform, and the second terminal device can be understood as an IoT terminal device under the same local area network as the first terminal device. In actual application, before step 401, the first terminal device will send its own identity to the second network device or the second terminal device, and the second network device or the second terminal device needs to identify the identity after receiving the identity Therefore, the second network device or the second terminal device sends an identity authenticity certification request to the first terminal device. After receiving the identity authenticity certification request, the first terminal device sends a third request to the first network device, and includes the address information of the second network device or the second terminal device, such as an IP address, in the third request to notify First network device.

Step 402: Based on the first connection between the first network device and the second network device or the second terminal device, the first server acquires the second network device or the second terminal The second identity sent by the device.

The second identity represents the identity of the first terminal device acquired by the second network device or the second terminal device.

Here, after receiving the third request, the first network device first records the third request and the request time, then sets an authenticity certificate valid time and starts timing, and then sends the IP address of the first network device to The first terminal device, and then the first terminal device sends the IP address of the first network device to the second network device or the second terminal device. In this way, both the first network device and the second network device or the second terminal device know each other's real address information. Letter connection/secure connection, that is, the first connection. Based on the first connection, the first network device obtains the second identity sent by the second network device or the second terminal device, and the second identity is the identity sent by the first terminal device to the second network device or the second terminal device logo.

Step 403: When the first server confirms that the second identity is consistent with the first identity and satisfies the set conditions, send the second network device or the The second terminal device sends third information.

The third information is used for the second network device or the second terminal device to obtain a security authentication result for the second identity.

Here, after receiving the second identity, the first network device verifies the second identity, and judges whether the second identity sent by the first terminal device to the second network device or the second terminal device is consistent with that of the first network device. The generated first identity of the first terminal device is consistent, or, on the basis of judging that the two are consistent, further judging whether the first identity is valid, so as to obtain the security authentication result of the corresponding identity, and Returning the security authentication result to the second network device or the second terminal device through the first connection.

Specifically, the setting conditions include at least one of the following:

The first identity is valid;

The first terminal device accesses the first network device;

The request limitation period of the third request is within the set limitation period range.

In the application embodiment shown in Fig. 5 , the security intelligent gateway/router of the Internet of Things is used as the first network device, and the terminal device of the Internet of Things is the first terminal device, and the security authentication process of identity identification is shown based on the corresponding system architecture. See Figure 5:

1. The IoT terminal device sends its own identity identification SecurityID to the IoT cloud platform/remote device.

2. If the Internet of Things cloud platform/remote device needs to verify the SecurityID, send an identity authenticity certification request to the Internet of Things terminal device.

3. The IoT terminal device notifies the identity identification service in the IoT security smart gateway/router of the identity authenticity certification request and the relevant information of the IoT cloud platform/remote device, such as the IP address of the IoT cloud platform/remote device end.

4. The identity server in the Internet of Things security smart gateway/router records the identity authenticity certificate request information and request time sent by the Internet of Things terminal device, and sets an authenticity certificate valid time, and then sends the Internet of Things security The IP address of the smart gateway/router is used as the IP address of the identity generator/certifier and sent to the IoT terminal device.

5. The IoT terminal device sends the IP address of the identity generator/certifier to the IoT cloud platform/remote device.

6. The IoT cloud platform/remote device tries to establish contact with the IoT security intelligent gateway/router according to the IP address of the identity generator/certifier provided by the IoT terminal device. The two parties establish a trusted/secure connection after going through a secure process such as trusted remote attestation or two-way authentication.

7. Through a trusted/safe connection, the IoT cloud platform/remote device sends the SecurityID of the IoT terminal device to be verified to the IoT security smart gateway/router, and applies for authenticity certification of the SecurityID.

8. After receiving the application of the IoT cloud platform/remote device for the identity identification server of the IoT security smart gateway/router, it first checks whether the SecurityID sent by the IoT cloud platform/remote device is in the database, and confirms the SecurityID Whether the corresponding IoT terminal device is currently connected to the IoT security smart gateway/router; Proof of authenticity whether the application is still within the set statute of limitations. If the above conditions are met, then return the MDs, PublicKey and asymmetric cryptographic algorithm type corresponding to the SecurityID to the IoT cloud platform/remote device through a trusted/secure connection. It should be noted that during the above-mentioned security authentication process of the Internet of Things security intelligent gateway/router, if any abnormality occurs, an alarm message will be generated, and the security authentication event needs to be recorded in the identity log.

9. After receiving MDs, PublicKey and asymmetric encryption algorithm type, the IoT cloud platform/remote device uses the PublicKey to decrypt the SecurityID to obtain MDs', and then judges whether MDs' is consistent with MDs, and if they are consistent, it proves the IoT terminal device The SecurityID is real and secure.

The security authentication process of the above identity identification can not only be applied to the security authentication of the Security ID authenticity of the IoT terminal device connected to the IoT security smart gateway/router by the IoT cloud platform/remote device, but also can be applied to the same IoT Security authentication of the authenticity of the SecurityID between two IoT terminal devices connected to the security smart gateway/router. In the above two application scenarios, the security authentication process of identity identification is basically similar, the only difference is: when two IoT terminal devices connected to the same IoT security smart gateway/router are connected to the SecurityID authenticity During security authentication, the IoT terminal device that initiates security authentication and the IoT security smart gateway/router do not need to go through security processes such as trusted remote attestation or two-way authentication to establish a trusted/secure connection, because the IoT terminal device that initiates security authentication The networked terminal devices are also connected to the Internet of Things security intelligent gateway/router, and the connection between them is a confirmed local connection, which is safe and reliable.

In addition, the identity security authentication scheme provided by the embodiment of the present application can also be applied to devices with trusted functions and Internet direct connection capabilities. The terminal is installed and runs in the common operating area on the trusted Internet of Things security intelligent gateway/router, as shown in Figure 6, so that the identity identification client and the identity identification server communicate through the internal local network. Moreover, when the identity identification client is installed and operated in the common operating area on the trusted Internet of Things security intelligent gateway/router, the generation of the identity identification and related usage methods are completely consistent with the realization of the related solutions of the embodiments of the present application.

Based on the solution of the embodiment of this application, with the support of a trusted IoT security intelligent gateway/router, the identity generated for the IoT terminal device is associated with multiple types of characteristics of the IoT terminal device, including the fact that it can be added during actual deployment. The scene characteristics of the IoT terminal device can reflect the identity status of the IoT terminal device, which is unique and has high security. Furthermore, the identity generated by this scheme can be widely used in various scenarios as a public identity. Moreover, on the IoT terminal device, only a lightweight identity client needs to be integrated, and the IoT terminal device does not need to participate in any encryption operations during the generation and use of the identity, nor does it need to perform identity verification. Therefore, the application of this solution has a very low impact on the performance and cost of the IoT terminal equipment itself, and it is easy to use. In addition, when the IoT terminal device is migrated, the IoT security smart gateway/router will set the corresponding identity to invalid, which also plays a certain security role in the migration and misappropriation of the IoT terminal device.

In order to implement the method of the embodiment of the present application, the embodiment of the present application also provides an identity processing device, which is set on the first network device, and the device runs on the TEE supported by the first chip in the first network device. In; the first chip includes a security chip or a trusted chip; as shown in Figure 7, the device includes:

The first processing unit 701 is configured to acquire a first request sent by the first terminal device; the first request is used to request to generate an identity of the first terminal device; the first request carries at least one piece of first information; The first information represents information used to describe the identity of the first terminal device;

The second processing unit 702 is configured to obtain the first identity of the first terminal device; the first identity is obtained by encrypting the second information; the second information represents the at least one piece of first information corresponding to summary information;

The third processing unit 703 is configured to send the first identity to the first terminal device.

Wherein, in an embodiment, the at least one piece of first information includes at least one piece of information of the first terminal device as follows:

device name;

devise serial number;

MAC address;

Operating mode;

Uplink connection information.

In one embodiment, the device also includes:

The fourth processing unit is configured to perform a hash operation on the at least one piece of first information to obtain the second information before the first server acquires the first identity of the first terminal device.

In an embodiment, the second processing unit 702 is configured to:

sending a second request to the first chip; the second request is used to request the first chip to encrypt the second information;

Obtaining a response returned by the first chip based on the second request; the response carries the first identity obtained by encrypting the second information by the first chip based on the private key in the first key pair logo.

In an embodiment, the network device further includes a first database running in the TEE; the first database stores at least the identity of at least one terminal device generated by the first network device; The third processing unit 703 is used for:

Sending the first identity to the first terminal device when it is found that the first identity is not stored in the first database.

In one embodiment, the device also includes:

A fifth processing unit, configured to store the first identity and at least one of the following information of the first terminal device into the first database:

The at least one piece of first information, the second information, the first key pair used to encrypt the second information, and/or the generation time of the first identity.

In an embodiment, the first network device further includes a first log module running in the TEE; the device further includes:

A sixth processing unit, configured to generate and store the first log; wherein,

The first log represents a log that records related operations of the first identity.

In one embodiment, the device also includes:

A seventh processing unit, configured to obtain a second request sent by the first terminal device; the second request is used to request re-access to the first network device; the second request carries the first identification;

If it is confirmed that the first terminal device is bound to the first network device based on the first identity in the second request, the first terminal device is allowed to establish a connection with the first network device.

In one embodiment, the device also includes:

An eighth processing unit, configured to set the first identity to be invalid when the first terminal device is unbound from the first network device.

In one embodiment, the device also includes:

A ninth processing unit, configured to acquire a third request sent by the first terminal device; the third request is used to request the first network device to perform a request for the second network device or the second terminal device regarding the first Security authentication of the identity of the terminal device;

Based on the first connection between the first network device and the second network device or the second terminal device, acquiring a second identity sent by the second network device or the second terminal device; The second identity represents the identity of the first terminal device acquired by the second network device or the second terminal device;

When the first server confirms that the second identity is consistent with the first identity and satisfies the set conditions, send to the second network device or the second terminal through the first connection The device sends third information; the third information is used for the second network device or the second terminal device to obtain a security authentication result for the second identity.

In one embodiment, the setting conditions include at least one of the following:

The first identity is valid;

The first terminal device accesses the first network device;

The request limitation period of the third request is within the set limitation period range.

In an embodiment, the first connection between the first network device and the second network device is a trusted connection or a secure connection.

In actual application, the first processing unit 701, the third processing unit 703, the seventh processing unit and the ninth processing unit can be realized by the communication interface in the identification processing device; the second processing unit 702 and the fourth, The fifth, sixth, and eighth processing units may be realized by a processor in the identification processing device.

It should be noted that: when the identity processing device provided in the above embodiment processes the identity, it only uses the division of the above-mentioned program modules as an example for illustration. In practical applications, the above-mentioned processing can be assigned to different programs according to needs. Module completion means that the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the identity processing device and the identity processing method embodiment provided by the above embodiment belong to the same idea, and the specific implementation process thereof is detailed in the method embodiment, and will not be repeated here.

Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a first network device. As shown in FIG. 8 , the first network device 800 includes:

The first communication interface 801 is capable of exchanging information with other network nodes;

The first processor 802 is connected to the first communication interface 801 to implement information exchange with other network nodes, and is used to execute the methods provided by one or more of the above technical solutions when running a computer program. Instead, the computer program is stored on the first memory 803 .

Specifically, the first communication interface 801 is used to acquire the first request sent by the first terminal device in the TEE supported by the first chip; the first request is used to request to generate the first request sent by the first terminal device the identity of the first request; the first request carries at least one first information; the first information represents information used to describe the identity of the first terminal device;

The first processor 802 is configured to acquire a first identity of the first terminal device in the TEE; the first identity is obtained by encrypting second information; the second information represents the Summary information corresponding to the at least one piece of first information;

The first communication interface 801 is further configured to send the first identity to the first terminal device in the TEE.

Wherein, in an embodiment, the at least one piece of first information includes at least one piece of information of the first terminal device as follows:

device name;

devise serial number;

MAC address;

Operating mode;

Uplink connection information.

In an embodiment, the first processor 802 is further configured to, before the first server acquires the first identity of the first terminal device, perform the at least one first identifier in the TEE A hash operation is performed on the information to obtain the second information.

In an embodiment, the first processor 802 is configured to send a second request to the first chip in the TEE; the second request is used to request the first chip to encrypt the second information; obtain the response returned by the first chip based on the second request; the response carries the first chip that encrypts the second information based on the private key in the first key pair. an identification mark.

In an embodiment, the network device further includes a first database running in the TEE; the first database stores at least the identity of at least one terminal device generated by the first network device; The first communication interface 801 is further configured to send the first identity to the first terminal when it is found in the TEE that the first identity does not exist in the first database equipment.

In an embodiment, the first processor 802 is configured to store the first identity and at least one of the following information of the first terminal device in the first database in the TEE:

The at least one piece of first information, the second information, the first key pair used to encrypt the second information, and/or the generation time of the first identity.

In an embodiment, the first network device further includes a first log module running in the TEE; the first processor 802 is configured to generate and store a first log in the TEE; wherein,

The first log represents a log that records related operations of the first identity.

In an embodiment, the first communication interface 801 is further configured to obtain a second request sent by the first terminal device in the TEE; the second request is used to request re-access to the first A network device; the second request carries the first identity;

If it is confirmed that the first terminal device is bound to the first network device based on the first identity in the second request, the first terminal device is allowed to establish a connection with the first network device.

In an embodiment, when the first terminal device is unbound from the first network device, the first processor 802 is configured to set the first identity to invalid in the TEE.

In an embodiment, the first communication interface 801 is further configured to obtain a third request sent by the first terminal device; the third request is used to request the first network device to be the second network device or The second terminal device performs security authentication on the identity of the first terminal device; based on the first connection between the first network device and the second network device or the second terminal device, the second terminal device A server obtains the second identity sent by the second network device or the second terminal device; the second identity represents the second identity obtained by the second network device or the second terminal device The identity of a terminal device; when it is confirmed that the second identity is consistent with the first identity and meets the set conditions, send a message to the second network device or the second network device through the first connection The terminal device sends third information; the third information is used for the second network device or the second terminal device to obtain a security authentication result for the second identity.

In one embodiment, the setting conditions include at least one of the following:

The first identity is valid;

The first terminal device accesses the first network device;

The request limitation period of the third request is within the set limitation period range.

In an embodiment, the first connection between the first network device and the second network device is a trusted connection or a secure connection.

It should be noted that: the specific processing process of the first processor 802 and the first communication interface 801 can be understood with reference to the above method.

Of course, in practical application, various components in the first network device 800 are coupled together through the bus system 804 . It can be understood that the bus system 804 is used to realize connection and communication between these components. In addition to the data bus, the bus system 804 also includes a power bus, a control bus and a status signal bus. However, for clarity of illustration, the various buses are labeled as bus system 804 in FIG. 8 .

The first memory 803 in the embodiment of the present application is used to store various types of data to support the operation of the first network device 800 . Examples of such data include: any computer programs for operating on the first network device 800 .

The methods disclosed in the foregoing embodiments of the present application may be applied to the first processor 802 or implemented by the first processor 802 . The first processor 802 may be an integrated circuit chip, which has a signal processing capability. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the first processor 802 or an instruction in the form of software. The aforementioned first processor 802 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. The first processor 802 may implement or execute various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the first memory 803, and the first processor 802 reads the information in the first memory 803, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the first network device 800 may be implemented by one or more Application Specific Integrated Circuits (ASIC, Application Specific Integrated Circuit), DSP, Programmable Logic Device (PLD, Programmable Logic Device), complex programmable logic device (CPLD, Complex Programmable LogicDevice), field-programmable gate array (FPGA, Field-Programmable Gate Array), general-purpose processor, controller, microcontroller (MCU, Micro Controller Unit), microprocessor (Microprocessor), or others Electronic components are implemented for performing the aforementioned methods.

It can be understood that the first memory 803 in this embodiment of the present application may be a volatile memory or a nonvolatile memory, and may also include both volatile and nonvolatile memories. Wherein, the non-volatile memory can be a read-only memory (ROM, Read Only Memory), a programmable read-only memory (PROM, Programmable Read-Only Memory), an erasable programmable read-only memory (EPROM, Erasable Programmable Read-Only Memory), Only Memory), Electrically Erasable Programmable Read-Only Memory (EEPROM, Electrically Erasable Programmable Read-Only Memory), Magnetic Random Access Memory (FRAM, ferromagnetic random access memory), Flash Memory (FlashMemory), Magnetic Surface Memory, Optical disc, or compact disc read-only memory (CD-ROM, Compact Disc Read-Only Memory); magnetic surface storage can be magnetic disk storage or magnetic tape storage. The volatile memory may be random access memory (RAM, Random Access Memory), which is used as an external cache. By way of illustration and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM, Static Random Access Memory), Synchronous Static Random Access Memory (SSRAM, Synchronous Static Random Access Memory), Dynamic Random Access Memory Memory (DRAM, Dynamic Random Access Memory), synchronous dynamic random access memory (SDRAM, Synchronous Dynamic Random Access Memory), double data rate synchronous dynamic random access memory (DDRSDRAM, Double Data Rate Synchronous Dynamic Random Access Memory), enhanced Type Synchronous Dynamic Random Access Memory (ESDRAM, Enhanced Synchronous Dynamic Random Access Memory), Synchronous Link Dynamic Random Access Memory (SLDRAM, SyncLink Dynamic Random Access Memory), Direct Memory Bus Random Access Memory (DRRAM, Direct Rambus Random Access Memory). The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

In an exemplary embodiment, the embodiment of the present application also provides a storage medium, that is, a computer storage medium, specifically a computer-readable storage medium, for example, including a first memory 803 storing a computer program, and the above computer program can be accessed by the first network The first processor 802 of the device 800 executes to complete the steps described in the foregoing method. The computer-readable storage medium may be memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM.

It should be noted that: "first", "second", etc. are used to distinguish similar objects, and not necessarily used to describe a specific order or sequence.

The term "and/or" in this article is just an association relationship describing associated objects, which means that there can be three relationships, for example, A and/or B can mean: A exists alone, A and B exist simultaneously, and there exists alone B these three situations. In addition, the term "at least one" herein means any combination of any one or more of at least two of a plurality, for example, including at least one of A, B, and C, which may mean including from A, Any one or more elements selected from the set formed by B and C.

In addition, the technical solutions described in the embodiments of the present application may be combined arbitrarily if there is no conflict.

The above descriptions are only preferred embodiments of the present application, and are not intended to limit the protection scope of the present application.

Claims (15)

1. The identity identification processing method is applied to a first network device, wherein the first network device comprises a first chip and a first service end running in a Trusted Execution Environment (TEE) supported by the first chip; the first chip comprises a secure chip or a trusted chip; the method comprises the following steps:

the first server side obtains a first request sent by first terminal equipment; the first request is used for requesting to generate the identity of the first terminal equipment; the first request carries at least one first message; the first information represents information describing the identity of the first terminal device;

the first server side obtains a first identity mark of the first terminal equipment; the first identity mark is obtained by encrypting second information; the second information represents summary information corresponding to the at least one first information;

and the first server sends the first identity identification to the first terminal equipment.

2. The method according to claim 1, characterized in that said at least one first information comprises at least one of the following information of said first terminal device:

a device name;

a device serial number;

a media access control layer MAC address;

a working mode;

and uplink connection information.

3. The method of claim 1, wherein before the first server obtains the first identity of the first terminal device, the method further comprises:

and the first server or the first chip performs hash operation on the at least one piece of first information to obtain the second information.

4. The method of claim 1, wherein the obtaining, by the first server, the first identity of the first terminal device includes:

the first server sends a second request to the first chip; the second request is for requesting the first chip to encrypt the second information;

the first server acquires a response returned by the first chip based on the second request; the response carries the first identity obtained by encrypting the second information by the first chip based on a private key in a first key pair.

5. The method of claim 1, wherein the network device further comprises a first database running in the TEE; the first database at least stores the identity of at least one terminal device generated by the first network device; the sending, by the first server, the first identity identifier to the first terminal device includes:

and under the condition that the first server side inquires that the first identity identifier does not exist in the first database, the first server side sends the first identity identifier to the first terminal equipment.

6. The method of claim 5, further comprising:

the first server stores the first identity identifier and at least one of the following information of the first terminal equipment into the first database:

the at least one first information, the second information, a first key pair for encrypting the second information and/or a time of generation of the first identity.

7. The method of claim 1, wherein the first network device further comprises a first log module running in the TEE; the method further comprises the following steps:

the first log module generates and stores a first log; wherein,

the first log representation records a log of relevant operations of the first identity.

8. The method of claim 1, further comprising:

the first server acquires a second request sent by the first terminal equipment; the second request is for requesting re-access to the first network device; the second request carries the first identity identifier;

and allowing the first terminal device to establish connection with the first network device under the condition that the first service terminal confirms that the first terminal device is bound with the first network device based on the first identity in the second request.

9. The method of claim 1, further comprising:

and under the condition that the first terminal equipment is unbound with the first network equipment, the first server sets the first identity identifier to be invalid.

10. The method according to any one of claims 1 to 9, further comprising:

the first server acquires a third request sent by the first terminal equipment; the third request is used for requesting the first network device to perform security authentication on the identity of the first terminal device for a second network device or a second terminal device;

based on a first connection between the first network device and the second network device or the second terminal device, the first server obtains a second identity sent by the second network device or the second terminal device; the second identity represents the identity of the first terminal device acquired by the second network device or the second terminal device;

under the condition that the first service end confirms that the second identity mark is consistent with the first identity mark and meets set conditions, third information is sent to the second network equipment or the second terminal equipment through the first connection; the third information is used for the second network device or the second terminal device to obtain a security authentication result of the second identity identifier.

11. The method of claim 10, wherein the set condition comprises at least one of:

the first identity token is valid;

the first terminal equipment is accessed to the first network equipment;

the requested aging of the third request is within a set aging range.

12. The method of claim 10, wherein the first connection between the first network device and the second network device is a trusted connection or a secure connection.

13. An identity processing apparatus, wherein the apparatus operates in a TEE supported by a first chip in a first network device; the first chip comprises a secure chip or a trusted chip; the device comprises:

the first processing unit is used for acquiring a first request sent by first terminal equipment; the first request is used for requesting to generate the identity of the first terminal equipment; the first request carries at least one first message; the first information represents information describing an identity of the first terminal device;

the second processing unit is used for acquiring a first identity of the first terminal equipment; the first identity mark is obtained by encrypting second information; the second information represents summary information corresponding to the at least one first information;

and the third processing unit is used for sending the first identity identification to the first terminal equipment.

14. A first network device, wherein the first network device comprises a first chip, a first processor, and a first communication interface; the first chip comprises a secure chip or a trusted chip; wherein,

the first communication interface is used for acquiring a first request sent by first terminal equipment in a TEE supported by the first chip; the first request is used for requesting to generate the identity of the first terminal equipment; the first request carries at least one piece of first information; the first information represents information describing the identity of the first terminal device;

the first processor is configured to obtain a first identity of the first terminal device in the TEE; the first identity mark is obtained by encrypting second information; the second information represents summary information corresponding to the at least one first information;

the first communication interface is further configured to send the first identity to the first terminal device in the TEE.

15. The Internet of things system is characterized by comprising a first terminal device and a first network device, wherein the first network device comprises a first chip and a first service end running in a TEE (trusted external equipment) supported by the first chip; the first chip comprises a secure chip or a trusted chip; wherein,

the first service end is used for acquiring a first request sent by first terminal equipment; the first request is used for requesting to generate the identity of the first terminal equipment; the first request carries at least one piece of first information; the first information represents information describing an identity of the first terminal device;

the first service end is further used for acquiring a first identity of the first terminal device; the first identity mark is obtained by encrypting second information; the second information represents summary information corresponding to the at least one first information;

the first service end is further configured to send the first identity identifier to the first terminal device.

Images