TW202224378A - Iot system and privacy authorization method - Google Patents

Abstract

A IoT system and a privacy authorization method are provided. In the method, multiple private key values are generated based on ECC. ECC includes the ECQV algorithm. A sever public key of the server is generated based on ECC through the private key value of the server. The node public key is generated based on ECC through the server public key and the private key value of the node. The sever and the node belong to the IoT of blockchain. The identification code of the server is encoded through the node public key, to generate the node certificate. The node certificate would be published on the IoT of the blockchain. Accordingly, safe privacy authorization can be implemented in the open and non-trust based IoT world.

Description

IoT system and privacy authorization method

The present invention relates to a data authorization mechanism, and particularly relates to an Internet of Things system and a privacy authorization method for blockchain.

According to an international research and consulting agency, the number of endpoints in the global enterprise Internet of Things (IoT) market will grow to 5.8 billion in 2020, an increase of 21% from 2019. How to strengthen the storage and secure exchange and transmission of huge sensitive and confidential data between IoTs, how to reduce the risk of IoT data theft, and how to build a secure IoT privacy authorization and blockchain on a zero-trust network A system for correct data verification is one of the current urgent goals of the relevant industry and researchers.

In view of this, the present invention provides an Internet of Things system and a privacy authorization method, combining cryptography and blockchain to strengthen data authentication and authorization.

The privacy authorization method of the embodiment of the present invention is applicable to a blockchain Internet of Things, and includes (but is not limited to) the following steps: randomly generating multiple private key values (private key values) based on elliptic-curve cryptography (ECC) key value). Elliptic curve cryptography includes the ECQV (Elliptic Curve Qu-Vanstone) algorithm. Based on elliptic curve cryptography, the server public key (public key) of the server is generated through the private key value of the server. Based on elliptic curve cryptography, the node public key of the node is generated through the server public key and the node's private key value. Servers and nodes belong to the Internet of Things of the blockchain. The server's ID is encoded with the node's public key to generate the node's node certificate. Publish node credentials in the IoT of the blockchain.

The IoT system of the embodiment of the present invention is applicable to the IoT of the blockchain, and includes (but not limited to) nodes, a certificate management center, and a server. Nodes are used to collect sensing data. The certificate management center is used to issue original certificates. The server is used to randomly generate multiple private key values based on elliptic curve cryptography. Based on elliptic curve cryptography, the server public key value of the server is generated through the private key value of the server. Based on elliptic curve cryptography, the server public key and node The private key value of the node generates the node public key of the node, encodes the identity code of the server through the node public key to generate the node certificate of the node, and publishes the node certificate in the Internet of Things of the blockchain. Elliptic curve cryptography includes the ECQV algorithm.

Based on the above, according to the Internet of Things system and the privacy authorization method according to the embodiment of the present invention, the server public key and the node public key are respectively generated by using elliptic curve cryptography, and the node certificate of the corresponding node is further generated by using the node public key and the original certificate, and the Node credentials are published in the blockchain for identity confirmation. In this way, it is possible to avoid using the session key as the encryption negotiation key, thereby avoiding frequent use of key exchange and increasing the chance of data being cracked, thereby preventing private data from being stolen, and ensuring the security of node-to-node data transmission .

In order to make the above-mentioned features and advantages of the present invention more obvious and easy to understand, the following embodiments are given and described in detail with the accompanying drawings as follows.

FIG. 1 is a system architecture diagram of the Internet of Things according to an embodiment of the present invention. Please refer to FIG. 1, the system 1 includes (but is not limited to) group proxy servers 20, 30, group privacy databases 25, 35, nodes 40A1~40An, 40B1~40Bm (m, n are positive integers), sensor The tester 41 and the credential management center 60 .

The group proxy servers 20, 30 may be various types of computer systems (eg, desktop or laptop computers, servers, smartphones or tablets). The IoT group proxy servers 20 , 30 can be connected to the IoT 10 . In one embodiment, the IoT group proxy servers 20, 30 belong to two groups. For example, the IoT group proxy server 20 belongs to group A, and the IoT group proxy server 30 belongs to group B.

The group privacy databases 25, 35 are connected to the IoT group proxy servers 20, 30, respectively. The group privacy databases 25, 35 may be storage servers or various types of storage (eg, solid state drives (SSD), conventional hard disk drives (HDD), or cache memory).

Nodes 40A1~40An, 40B1~40Bm can be routers, relay stations or switches. Nodes 40A1~40An, 40B1~40Bm can be connected to the Internet of Things 10. In one embodiment, each node 40A1 ˜ 40An, 40B1 ˜ 40Bm respectively collects sensing data (eg, related to weather, strength, electricity, sound, other physical, mechanical or software states) of the corresponding sensor 41 . In some embodiments, nodes 40A1-40An belong to group A, and nodes 40B1-40Bm belong to group B.

The Certificate Authority (CA) 60 is used to manage, authenticate and issue certificates, and its operation can be realized by a computer system. The role of the digital certificate is to prove that the user listed in the certificate legally owns the public key listed in the certificate.

Hereinafter, the method described in the embodiment of the present invention will be described in conjunction with each device in the system 1 . Each process of the method can be adjusted according to the implementation situation, and is not limited to this.

FIG. 2 is a flowchart of an identity authentication stage according to an embodiment of the present invention. Referring to FIG. 2 , the identity authentication stage of the nodes 40A1~40An, 40B1~40Bm in the Internet of Things 10 is the process stage of the nodes 40A1~40An, 40B1~40Bm establishing the identity registration mechanism for the trusted certificate system to generate the identity certificate method. The group privacy authorization proxy server 20, 30 obtains the certificate of the certificate management center, and then uses ECQV (Elliptic Curve Qu-Vanstone) or other elliptic curve cryptography (Elliptic-curve cryptography, ECC) related algorithms to generate multiple groups of public and private keys by itself. The proxy certificate mechanism is redistributed to the nodes 40A1~40An and 40B1~40Bm in the IoT 10 for use.

Specifically, the group privacy authorization proxy servers 20 and 30 respectively apply for the original certificate request to the certificate management center 60 (step S101 ). The certificate management center 60 can issue the original certificate to the corresponding group proxy servers 20 and 30 (step S102 ). The nodes 40A1 ˜ 40An, 40B1 ˜ 40Bm can submit a registration application to the group proxy server 20 , 30 to request to join the group (step S103 ). The group proxy servers 20, 30 can issue registration serial numbers to the nodes 40A1-40An, 40B1-40Bm according to the registration application and read the access passwords of the privacy databases 25, 35 (step S104).

Next, the group proxy servers 20 and 30 can use the original certificates issued by the certificate management center 60 to generate multiple sets of node certificates by themselves using ECQV or other ECC-related algorithms for each node 40A1-40An, 40B1-40Bm (step S105 ). ). Specifically, FIG. 3 is a flowchart of a key generation stage according to an embodiment of the present invention. Referring to FIG. 3 , the group proxy server 20 is taken as an example below, but the group proxy server 30 can implement the same or similar procedures. For the certificate application (step S200 ), the group proxy server 20 randomly generates a plurality of private key values based on the ECC (step S201 ). ECC is an algorithm that establishes public key encryption, also known as asymmetric encryption. Public key cryptography is the foundation of modern cybersecurity or chain of trust. A major feature of public key encryption is that both sides of the communication terminal each have a pair of public and private keys, which have a specific mathematical relationship between the public and private keys. In addition, each communication terminal stores its own private key and discloses its own public key. Even if a third party maliciously obtains the public key of any one, it cannot be decrypted smoothly. And ECC is to introduce the discrete logarithm problem on elliptic curve into a specific mathematical relationship between public and private keys. In addition, in addition to ECQV, algorithms such as ECDH (Elliptic Curve Diffie–Hellman) and EdDSA (Edwards-curve Digital Signature Algorithm) belong to ECC.

The group proxy server 20 may generate a server public key based on the ECC through its own private key value (step S202 ). For example, the group proxy server 20 performs a dot-multiplication operation on its own private key value and one of a plurality of parameter base points on the elliptic curve to generate a server public key belonging to the server. The group proxy server 20 can transmit the server public key and its own identification code (eg, name, organization, country, purpose, period, etc.) to the certificate management center 60 (step S203 ).

The certificate management center 60 can verify the server public key generated by the group proxy server 20 according to the ECC (step S204 ), and issue the original certificate to the group proxy server 20 according to the verification result (step S205 ). The group proxy server 20 can select the private key value of a node 40A1, 40A2, . , but not limited to), generate the node public key of this node 40A1 (step S207). For example, the group proxy server 20 performs a dot product operation on the private key value of the node 40A1 and one of a plurality of parameter base points on the elliptic curve to generate the node public key belonging to the node 40A1.

The group proxy server 20 can generate the node certificate of the node 40A1 (eg, encode the generated certificate value) by encoding the identity code belonging to the server and other data required for the certificate through the node public key (step S208 ). That is, a digital signature is applied to the node public key through the private key value to generate the node certificate. The node credentials of all groups and all nodes 40A1~40An in the IoT 10 will be published in the IoT 10 of the blockchain for all nodes 40A1~40An, 40B1~40Bm to query to confirm their identity.

FIG. 4 is a flowchart of a data authorization phase according to an embodiment of the present invention. Referring to FIG. 4 , the nodes 40A1 ˜ 40An, 40B1 ˜ 40Bm collect the sensing data detected by the sensors 41 to which they belong, and can make a privacy authorization form. The content of the privacy authorization form includes the authorization item, the data content of the authorization item, the sensing time of the authorization data, and the authority of the authorization item. The group proxy servers 20, 30 encrypt the authorized privacy form data by using the asymmetric public keys of the group proxy servers 20, 30 of the nodes 40A1~40An, 40B1~40Bm that apply for authorization, and write the privacy authorization form into the application In the privacy databases 25 and 35 of the group authorization proxy servers 20 and 30 of the authorized nodes 40A1 to 40An and 40B1 to 40Bm, the authorized nodes 40A1 to 40An and 40B1 to 40Bm can use their own registration numbers and access passwords to access the data. Decryption, in order to achieve the purpose of efficiently obtaining authorized private information in a short time.

For example, the sensor 41 of the node 40A1 of group A detects to obtain sensing data. The node 40A1 encrypts the sensing data with the signature made by its own node certificate and the registered access password, and transmits it to the privacy database 25 of the group A for centralized storage (step S301 ).

It is assumed that the node 40B1 of the group B applies to the group A for authorization of the sensor data of the node 40A1 (ie, issues an access request) (step S302 ). The group proxy server 20 of the group A can read the sensing data of the sensor 41 of the node 40A1 from the privacy database 25 of the group A, and decrypt the encrypted data with the access password obtained by the registration of the node 40A1. Sensing data (step S303). The group proxy server 20 of group A uses the group certificate (for example, the original certificate) corresponding to group A and the node certificate of node 40A1 to generate public key encryption for the sensing data obtained by the sensor 41 of node 40A1 algorithm (for example, Elliptic Curve Digital Signature Algorithm (ECDSA), RSA encryption algorithm, or Digital Signature Algorithm (DSA)) signature, and the signature with node 40A1 The sensing data of the sensor 41 is encrypted with the public key of asymmetric encryption (for example, RSA, ElGamal, or Rabin) of the group proxy server 30 of the group B, and the encrypted privacy authorization data is transmitted to group B (step S304).

The group proxy server 30 of the group B decrypts the privacy authorization data of the node 40A1 of the group A with the asymmetric encryption private key (for example, the RSA private key, corresponding to the RSA used in step S304), and extracts the data from the privacy block The chain 70 reads the group certificate of the group A and the node certificate of the node 40A1 to verify the signatures of the group A and the node 40A1, and then confirm their identity and privacy authorization information (step S305).

Finally, the group proxy server 30 of the group B can encrypt the privacy authorization data of the node 40A1 of the group A with the access password registered by the node 40B1 and transmit it to the node 40B1 (step S306 ).

For the one-to-many authorization, it is assumed that the node 40B1 of the group B applies to the group A for authorization of the sensing data packages of all the sensors 41 of the node 40A1, the node 40A2 and the node 40A3 (step S307).

The group proxy server 20 of the group A reads the sensing data of all the sensors 41 of the node 40A1, the node 40A2 and the node 40A3 from the privacy database 25 of the group A, and uses 40A1, the node 40A2 and the node The encrypted sensing data is decrypted by the access code obtained from the registration of 40A3 (step S308). The group proxy server 20 of group A uses the group certificate corresponding to group A and the node certificates of node 40A1, node 40A2 and node A340 to sense the sensors 41 of node 40A1, node 40A2 and node 40A3 respectively The data creates a signature of the public key encryption algorithm, and the signature and the sensing data of the sensors 41 of the node 40A1, the node 40A2 and the node 40A3 are respectively publicized by the asymmetric encryption of the group proxy server 30 of the group B. The encryption key (for example, RSA supply) is encrypted, and the privacy authorization data generated by the encryption is transmitted to the group B (step S309).

The group proxy server 30 of group B decrypts the privacy authorization data of node 40A1, node 40A2 and node 40A3 of group A respectively with the asymmetric encryption private key (for example, RSA private key) of group B, and extracts the data from the private key. The blockchain 70 reads the group certificate of group A and the respective node certificates of node 40A1, node 40A2 and node 40A3 to verify the signatures of group A and node 40A1, node 40A2 and node 40A3, and then confirm Identity and privacy authorization information (step S310).

Finally, the group proxy server 30 of the group B can encrypt the privacy authorization data of the node 40A1, the node 40A2 and the node 40A3 of the group A with the access password registered by the node 40B1 and transmit it to the node 40B1 (step S311).

To sum up, in the IoT system and the privacy authorization method of the embodiments of the present invention, the proxy server manages the IoT node group, and establishes the identity verification mechanism of the implicit certificate ECC-related algorithm in the IoT block chain system. The authorization method of IoT nodes is the multi-identity confirmation method of certificates using ECC-related algorithms, and is connected to the anchored blockchain system, so that the nodes do not need to continuously generate session keys to exchange private data. Transmission, from the characteristics of achieving fast mutual access authorization and verification of private data.

The embodiment of the present invention further includes the following features and effects:

In the embodiment of the present invention, the group proxy server applies to the certificate management center to issue the original certificate, and then generates multiple sets of node certificates of the ECC-related algorithm by itself and distributes them to the proxy certificate mechanism used by the nodes. In addition, the node credentials of all nodes will be published in the IoT blockchain system. Using multiple sets of node credentials generated by ECC-related algorithms and original credentials to perform multiple authentication, the security of the original node authorization can be verified, and it has the advantage of quickly authorizing private data.

The group proxy server in the embodiment of the present invention uses the certificate issued by the certificate management center to perform package authorization on the privacy authorization data generated by the node. The node performs multiple identity verification through the corresponding node certificate and the original certificate. The embodiment of the present invention provides a package structure for authorization of privacy data by multiple nodes, and performs identity confirmation between nodes and collective authorization of privacy data, so as to achieve the purpose of directly authorizing privacy data of multiple nodes by multiple nodes.

The embodiment of the present invention utilizes the security features of the asymmetric cryptographic system. As long as both nodes establish identity verification, the asymmetric encryption public key of the group proxy server can be used to provide multiple transmissions of privacy authorization data, thereby reducing the general use of session fees. key to authorize data, and avoid frequent use of key exchange to increase the chance of data being cracked. In this way, privacy data can be prevented from being stolen, and the security of node-to-node data authorization transmission can be ensured.

Although the present invention has been disclosed above by the embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the technical field can make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, The protection scope of the present invention shall be determined by the scope of the appended patent application.

1: System 10: The Internet of Things 20, 30: Group proxy server 25, 35: Group Privacy Database 40A1~40An, 40B1~40Bm: Node 41: Sensor 60: Credential Management Center 70: Blockchain S101~S105, S200~S208, S301~S311: Steps

FIG. 1 is a system architecture diagram of the Internet of Things according to an embodiment of the present invention. FIG. 2 is a flowchart of an identity authentication stage according to an embodiment of the present invention. FIG. 3 is a flowchart of a key generation stage according to an embodiment of the present invention. FIG. 4 is a flowchart of a data authorization phase according to an embodiment of the present invention.

20: Group proxy server

S200~S208: Steps

Claims (10)

A privacy authorization method applicable to a blockchain (Internet of Things, IoT), including: A plurality of private key values (private key values) are randomly generated based on an elliptic-curve cryptography (ECC), wherein the elliptic-curve cryptography includes the ECQV (Elliptic Curve Qu-Vanstone) algorithm; generating a server public key of a server through a private key value of a server based on the elliptic curve cryptography; Generate a node public key of the node through the server public key and a private key value of a node based on the elliptic curve cryptography, wherein the server and the node belong to the Internet of Things of the blockchain; Encode the server's ID with the node's public key to generate a node certificate for the node; and Publish the node credentials in the IoT of the blockchain. The privacy authorization method according to claim 1, wherein the step of generating the server public key of the server comprises: Dot multiplication of the private key value for the server and one of a plurality of parameter base points on an elliptic curve to generate the server public key for the server. The privacy authorization method according to claim 1, wherein after the step of generating the server public key of the server, the method further comprises: sending the server public key and the ID to a certificate management center; verifying, through the certificate management center, the server public key according to the elliptic curve cryptography; and Issue an original certificate to the server according to the verification result. The privacy authorization method according to claim 1, before the step of generating the server public key of the server, further comprising: receiving, through the server, a registration application from the node; and According to the registration application, a registration serial number is issued to the node and an access password for reading a privacy database is read. The privacy authorization method according to claim 4, wherein after the step of publishing the node credential in the Internet of Things of the blockchain, it further comprises: Encrypting the collected sensing data through the node with the corresponding node certificate and the access password, and storing it in the privacy database, wherein the sensing data is obtained by a sensor; In response to an access request, creating a signature of the public key encryption algorithm for the sensing data corresponding to the node certificate and a group certificate; encrypting the signature and the sensing data through an asymmetric encryption public key to generate a privacy authorization data; decrypt the privacy authorization data through an asymmetric encryption private key corresponding to the asymmetric encryption public key, and verify the signature through the group certificate and the node certificate; and According to the verification result, the privacy authorization data is encrypted with the access password of the other node that issued the access request. An Internet of Things system, applicable to the Internet of Things of a blockchain, includes: a node for collecting a sensing data; a certificate management center for issuing an original certificate; and a server for randomly generating a plurality of private key values based on an elliptic curve cryptography, generating a server public key of the server through a private key value of the server based on the elliptic curve cryptography, based on the elliptic curve cryptography Curve cryptography generates a node public key of the node through the server public key and a private key value of the node, and encodes the server's identity code through the node public key to generate a node certificate for the node, And publish the node credentials in the Internet of Things of the blockchain, wherein the elliptic curve cryptography includes the ECQV algorithm. The Internet of Things system of claim 6, wherein the server performs a point multiplication operation on the private key value of the server and one of a plurality of parameter base points on an elliptic curve to generate the server public key. The Internet of Things system of claim 6, wherein the server transmits the server public key and the identity code to the certificate management center, and the certificate management center verifies the server public key according to the elliptic curve cryptography, and The certificate management center issues an original certificate to the server according to the verification result. The Internet of Things system as claimed in claim 6, wherein the server receives a registration application from the node, and the server issues a registration serial number and an access password for reading a privacy database to the node according to the registration application. The Internet of Things system according to claim 9, further comprising: a second node; and a second server, wherein The node encrypts the collected sensing data with the corresponding node credential and the access password, and stores it in the privacy database, wherein the sensing data is obtained by a sensor and reflects the response from the first An access request from two nodes, the server uses the corresponding node certificate and a group certificate to create a public key encryption algorithm signature for the sensing data, the server uses an asymmetric encryption public key to the signature and the sensing data is encrypted to generate a privacy authorization data, the second server decrypts the privacy authorization data through an asymmetric encryption private key corresponding to the asymmetric encryption public key, and uses the group certificate and the node certificate to decrypt the privacy authorization data. Chapter verification, the second server encrypts the privacy authorization data with the access password of the second node that issued the access request according to the verification result and transmits it to the second node.

Images