WO2020186902A1 - 用于操作物联网设备的方法和系统 - Google Patents

用于操作物联网设备的方法和系统 Download PDF

Info

Publication number
WO2020186902A1
WO2020186902A1 PCT/CN2020/070659 CN2020070659W WO2020186902A1 WO 2020186902 A1 WO2020186902 A1 WO 2020186902A1 CN 2020070659 W CN2020070659 W CN 2020070659W WO 2020186902 A1 WO2020186902 A1 WO 2020186902A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
internet
key
things device
user equipment
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2020/070659
Other languages
English (en)
French (fr)
Inventor
黄琪
廖晖
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Priority to SG11202105440QA priority Critical patent/SG11202105440QA/en
Priority to EP20772610.0A priority patent/EP3876495B1/en
Publication of WO2020186902A1 publication Critical patent/WO2020186902A1/zh
Priority to US17/313,934 priority patent/US11271745B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3231—Biological data, e.g. fingerprint, voice or retina
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0861—Network architectures or network communication protocols for network security for authentication of entities using biometrical features, e.g. fingerprint, retina-scan
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response

Definitions

  • One or more embodiments of this specification relate to Internet of Things devices, and more particularly to methods and systems for operating Internet of Things devices.
  • IoT Internet of Things
  • the user can directly operate the Internet of Things device, or can indirectly operate the Internet of Things device through other devices (such as user devices such as smart phones).
  • the user In the case of remotely operating an IoT device, the user usually first binds the user device with the IoT device, and then sends instructions to the IoT device through the user device.
  • the method of using user equipment to operate IoT devices may have security risks.
  • one or more embodiments of this specification provide a technical solution capable of enhancing the security when operating the Internet of Things device.
  • a method for operating an Internet of Things device including: receiving, by a user device, an operation instruction for the Internet of Things device from a user; identifying the user's biological characteristics by the user device; based on the Biological features, the user equipment is used to verify the identity of the user; if the user’s identity is successfully verified, the user equipment uses the user's first user key to sign the operation instruction; The user equipment transmits the signed operation instruction to the Internet of Things device; the Internet of Things device uses the user's second user key to verify the signature of the signed operation instruction, the first The second user key and the first user key form a key pair; and if the signature is successfully verified, the operation instruction is executed by the Internet of Things device.
  • the method further includes: receiving, by the user equipment, a random number from the Internet of Things device, where the random number is generated and stored by the Internet of Things device;
  • the signed operating instructions are transmitted to the IoT device together; after the signature is successfully verified, the random number received from the user device by the IoT device and the random number generated by the IoT device
  • the operation is performed by the Internet of Things device only when the random number received from the user equipment by the Internet of Things device is consistent with the random number generated by the Internet of Things device instruction.
  • the method further includes: after the operation instruction is executed, the Internet of Things device disables the random number.
  • the first user key is a user private key of the user
  • the second user key is a user public key of the user.
  • the first user key and the second user key are the same user key of the user.
  • the method further includes: before operating the Internet of Things device, binding the Internet of Things device via the user equipment.
  • binding the Internet of Things device via the user equipment further includes: identifying the user's biological characteristics by the user equipment; verifying the user's identity by the user equipment based on the biological characteristics; and If the identity of the user is successfully verified, the user equipment transmits the second user key to the Internet of Things device.
  • the method further includes generating the first user key and the second user key by the user equipment.
  • generating the first user key and the second user key by the user equipment further includes: entering the biological characteristics of the user by the user equipment; and after entering the biological characteristics , Generating the first user key and the second user key for the user by the user equipment.
  • the first user key and the second user key are stored in a secure environment of the user equipment, and the secure environment is a trusted execution environment or a hardware secure element.
  • a method executed by a user equipment including: receiving an operation instruction for an Internet of Things device from a user; identifying the user's biological characteristics; and verifying the user's identity based on the biological characteristics If the user’s identity is successfully verified, the user’s first user key is used to sign the operation instruction; the signed operation instruction is transmitted to the IoT device, where the signature can Used by the Internet of Things device to use a second user key to authenticate the identity of the user, and the second user key and the first user key form a key pair.
  • a method executed by an Internet of Things device including: receiving, from a user device, a second user key in a key pair composed of a first user key and a second user key;
  • the user equipment receives an operation instruction, the operation instruction is signed with the first user key; uses the second user key to verify the signature of the operation instruction; and if the signature is successfully verified, Then the operation instruction is executed by the Internet of Things device.
  • the method further includes: generating a first random number; and transmitting the first random number to the user equipment.
  • the method further includes: receiving a second random number when receiving an operation instruction from the user equipment; comparing the second random number with the first random number; and only when the first random number is The operation instruction is executed only when the two random numbers are consistent with the first random number.
  • the method further includes: invalidating the first random number after executing the operation instruction.
  • a system in yet another aspect, includes: a user equipment and an Internet of Things device, the user equipment having a biometric identification capability, and the user equipment is configured to: receive operations on the Internet of Things device from a user Instructions; identify the biological characteristics of the user; verify the identity of the user based on the biological characteristics; and if the identity of the user is successfully verified, use the user's first user key to perform the operation Instructions for signing; the Internet of Things device is used to: receive the signed operation instruction from the user equipment; use the user's second user key to verify the signature of the signed operation instruction, the The second user key and the first user key form a key pair; and if the signature is successfully verified, the operation instruction is executed.
  • the system further includes a router, and the user equipment communicates with the Internet of Things via the router.
  • a computer-readable storage medium storing instructions that, when executed by a computer, causes the computer to execute the above method.
  • one or more embodiments of this specification can enhance the security when operating the Internet of Things device.
  • Fig. 1 shows a schematic diagram of a system according to an embodiment of the present specification.
  • Fig. 2 shows a schematic diagram of a process for entering biometrics according to an embodiment of the present specification.
  • Fig. 3 shows a schematic diagram of a process for binding an Internet of Things device according to an embodiment of the present description.
  • Fig. 4 shows a schematic diagram of a process for operating an Internet of Things device according to an embodiment of the present description.
  • Fig. 5 shows a schematic diagram of a method for operating an Internet of Things device according to an embodiment of the present description.
  • Fig. 6 shows a schematic diagram of another method for operating an Internet of Things device according to an embodiment of the present description.
  • Fig. 7 shows a schematic diagram of another method for operating an Internet of Things device according to an embodiment of the present description.
  • Biometric identification technology is a technology that uses human biological features for identity authentication. Compared with traditional identity authentication methods, including identification items (such as keys, certificates, ATM cards, etc.) and identification knowledge (such as user names and passwords), biometric identification technology is more secure, confidential and convenient.
  • the biometric identification technology has the advantages of not easy to forget, good anti-counterfeiting and anti-theft performance, "carry" and usable anytime and anywhere.
  • fingerprints are usually used as an example, but it should be understood that other biological characteristics besides fingerprints can be used.
  • the system 100 may include a user equipment 104 and an IoT device 106. Among them, the user equipment 104 is used by the user 102.
  • the user equipment 104 is preferably a mobile device, such as a mobile communication device (such as a smart phone, etc.), a tablet computer, a notebook computer, a personal digital assistant, and so on.
  • a mobile communication device such as a smart phone, etc.
  • a tablet computer such as a tablet computer
  • a notebook computer such as a notebook computer
  • a personal digital assistant such as a personal digital assistant
  • the user equipment 104 may also be other equipment, such as a desktop computer, a set-top box, and so on.
  • the user equipment 104 may include biometric identification capabilities.
  • the user equipment 104 may include a fingerprint scanner that scans the fingerprint of the user 102 and processes the scanned data to identify the fingerprint of the user 102 Thereby authenticating the user.
  • the Internet of Things device 106 is usually an object connected by the Internet of Things, and it usually has a network connection capability to interact with other devices through the Internet of Things.
  • the IoT device 106 can be bound to the user device 104 as described above, so that the user device 104 can control the IoT device 106 or perform other interactions with the IoT device 106.
  • Examples of the IoT device 106 include, but are not limited to, industrial robots, smart medical equipment, automobiles, door locks, electric cookers, refrigerators and other industrial equipment and household equipment.
  • a smart rice cooker is taken as an example for description, but it should be understood that the embodiments of this specification are not limited to specific IoT devices.
  • an application for interacting with the IoT device 106 may be installed on the user device 104.
  • the application can be an application for one or more IoT devices.
  • the application may be a smart rice cooker application dedicated to smart rice cookers.
  • the application may be a general application of a certain brand of IoT devices.
  • the application may be a system-level IoT device application.
  • a smart rice cooker application is taken as an example for description, but it should be understood that the embodiments of this specification are not limited to smart rice cooker applications.
  • the system 100 may further include a router 108 through which the user equipment 104 and the IoT device 106 can establish a network connection, thereby allowing the user equipment 104 to communicate with the IoT device 106 via the network.
  • the network is a wireless network.
  • the system 100 may not include the router 108, and the user equipment 104 and the Internet of Things device 106 may be connected in other ways, such as infrared, Bluetooth, Zigbee, and the like.
  • FIG. 2 shows a schematic diagram of a process 200 for entering biometrics according to an embodiment of the present specification, which involves a user 102 and a user equipment 104.
  • biometrics In order to use biometrics for identity authentication later, it is usually necessary to first enter the biometrics of the user 102 in order to associate the biometrics with the user 102.
  • the user 102 may request the user equipment 104 to enable biometric identification.
  • the user 102 may click a control on the smart rice cooker application in the user device 104 to request to enable biometric identification.
  • the user 102 can click the “use fingerprint recognition” button on the user equipment 104 to send a request to the user equipment 104 to enable biometric recognition.
  • the user equipment can also prompt the user to enable biometric identification when the user opens or uses the smart rice cooker application.
  • the user 102 may not have entered biometrics on the user device 104. In this case, you can continue to perform the biometric entry process as described below.
  • the user may be prompted via the user device 104 to display biometrics.
  • the user 102 may be prompted to put his finger on the fingerprint scanner.
  • this operation can be omitted.
  • the user's feature is iris
  • the user's iris can be scanned directly without prompting the user.
  • the user 102 may display the biological characteristics according to the prompt. For example, the user 102 may place a finger on the fingerprint scanner of the user device 104.
  • the biological characteristics of the user 102 may be transferred to the user device 104.
  • the fingerprint scanner of the user device 104 can read the biometric characteristics of the user 102.
  • the user device 104 may store the biological characteristics of the user 102.
  • the user 102 may also need to be prompted to move the finger in order to obtain complete fingerprint data.
  • the fingerprint of the user to be authenticated can be scanned, and the fingerprint characteristics extracted and compared with the stored user fingerprint characteristics to determine whether the two match, thereby authenticating the user's identity.
  • the user 102 may have entered biometrics on the user device 104.
  • the user 102 may have previously entered a fingerprint or the like on the user device 104, and at this time, there is no need to re-enter the biometrics, but use the biometrics that have already been registered.
  • a dedicated biometric feature can be entered for a specific IoT device.
  • the smart rice cooker application can be used to enter biological characteristics dedicated to the smart rice cooker. Using biometrics dedicated to specific IoT devices can further increase security.
  • the user equipment 104 may also generate a public/private key pair for the user 102.
  • the user public key can be stored in the IoT device 106 later, and the user private key can be stored on the user device 104, so that the user private key on the IoT device 106 can be used To verify the public key on the user device 104.
  • a symmetric encryption scheme can also be used.
  • the user device 104 may generate a single user key, and the single user key may be stored on the user device 104, and the single user key may be stored on the Internet of Things device 106 later, so that it can be used.
  • the user key on the networked device 106 is used to verify the user key on the user device 104.
  • the user equipment 104 may include a secure environment, and the private key (and/or biometrics) of the user 102 may be stored in the secure environment.
  • the security environment can be a software-level security environment, a hardware-level security environment, or a combination of the two.
  • the user equipment 104 may include a trusted execution environment (Trusted Execution Environment, TEE).
  • TEE Trusted Execution Environment
  • the trusted execution environment is a secure environment implemented by an operating system that is created in the user equipment 104 and is isolated from the main operating system of the user equipment 104. It can be used to ensure the security of key storage, operations, biometric identification, etc. Sex. In this case, the private key of the user 102 can be stored in the trusted execution environment.
  • the user equipment 104 may include a secure element (SE), and the secure element is usually provided in the form of a chip.
  • SE secure element
  • the chip as a secure element usually has an encryption/decryption logic circuit.
  • the private key of the user 102 can be stored in the secure element.
  • the embodiments of this specification can further enhance the protection of public/private key pairs.
  • the biometric input result may be returned to the user 102.
  • the user 102 may be notified that the biometric input of the user is completed.
  • the user 102 may also be notified that the public key/private key pair is generated.
  • FIG. 3 shows a schematic diagram of a process 300 for binding IoT devices according to an embodiment of the present description.
  • the user 102 may initiate a binding request to the user equipment 106.
  • the user 102 may click a control in the smart rice cooker application on the user device 106 to select the smart rice cooker to be bound.
  • the smart rice cooker may be discovered by the user equipment by searching for equipment in the local area network.
  • the user equipment 104 receives the binding request from the user 102. As shown in operation 3002 of FIG. 3, based on the binding request, the user equipment 104 may try to connect to the IoT device 106.
  • the connection may be realized via the router 108 as shown in FIG. 1, or realized via other connection methods, for example.
  • the IoT device 106 may return the connection result to the user equipment 104.
  • the user equipment can also notify the user that the connection is successful.
  • the biometric authentication process may be performed on the user equipment 104.
  • the user equipment 104 may request the user 102 to display biometrics.
  • it may be displayed in the smart rice cooker application in the user equipment 104: "Please scan your fingerprint!”.
  • the user 102 may display his biometrics to the user device 104.
  • the user 102 may place his finger on the fingerprint scanner of the user device 104.
  • the user equipment 104 may receive and verify the biological characteristics displayed by the user 102.
  • the user device 104 can scan the user's fingerprint through a fingerprint scanner, and the user device 104 can extract the fingerprint feature of the user fingerprint obtained by scanning and compare the extracted fingerprint feature with the stored user fingerprint feature to determine both Whether it matches to verify the identity of the user.
  • the identity of the user is successfully authenticated.
  • the user can be prompted that the fingerprint does not match, the biometric feature can be re-verified or the binding process can be terminated (for example, prompting that the binding is unsuccessful).
  • the user device 104 may transmit the user public key associated with the authenticated user 102 to the Internet of Things device 106, for example, via the one established in the previous operation 3002 connection.
  • the Internet of Things device 106 may store the user public key, for example, in the memory of the Internet of Things device 106. Similarly, in order to further enhance security, the Internet of Things device may store the user public key in a secure environment, such as a trusted execution environment or a secure element.
  • a secure environment such as a trusted execution environment or a secure element.
  • the IoT device 106 may return a result to the user device 104, for example, to confirm that the user's public key is successfully stored.
  • the user device 104 may return the result to the user 102, for example, via the smart rice cooker application to display the user a prompt that the binding process is completed.
  • FIG. 4 shows a schematic diagram of a process 400 for operating an Internet of Things device according to an embodiment of the present description.
  • the user 102 when the user 102 wants to operate the Internet of Things device 106, as shown in operation 4001 of FIG. 4, the user 102 may initiate an operation instruction via the user device 104.
  • the operation may be, for example, the management of the Internet of Things device 106 or other interactions with the Internet of Things device 106.
  • the user 102 can click the corresponding control in the smart rice cooker application in the user equipment to operate the Internet of Things device.
  • the user can click the “start” button on the smart rice cooker application to send an instruction to start cooking to the smart rice cooker.
  • the user equipment 104 can receive operation instructions from the user 102. As shown in operation 4002 of FIG. 4, based on the operation instruction, the user equipment 104 may try to connect to the IoT device 106. Similarly, the connection may be realized via the router 108 as shown in FIG. 1, or via other connection methods, for example. The connection can also be an automatic connection after the user opens the smart rice cooker application, and then the user can issue operation instructions through the application.
  • the Internet of Things device 106 may return the connection result to the user equipment 104.
  • the Internet of Things device 106 also returns a random number to the user equipment 104.
  • the Internet of Things device 106 may return a random number to the user device 104.
  • the random number can be generated and stored by the IoT device 106.
  • the random number can be used to ensure that the operation instruction is executed only once, thereby increasing the security of the IoT device 106. It is understood that any random number generation scheme known in the art can be used to generate random numbers.
  • the IoT device 106 may not perform the step of generating and storing random numbers. In this case, a single operation instruction may be executed multiple times.
  • the user device 104 may request the user 102 to display biometrics. For example, it may be displayed in the smart rice cooker application in the user equipment 104: "Please scan your fingerprint!”.
  • the user 102 may display his biological characteristics to the user device 104. For example, the user 102 may place his finger on the fingerprint scanner of the user device 104.
  • the user equipment 104 may receive and verify the biological characteristics displayed by the user 102.
  • the user device 104 can scan the user's fingerprint through a fingerprint scanner, and the user device 104 can extract fingerprint features and compare the extracted fingerprint features with the stored user fingerprint features to determine whether the two match, thereby authenticating the fingerprint. The identity of the user.
  • the identity of the user is successfully authenticated.
  • the user can be prompted that the fingerprint does not match, the biometric feature can be re-verified or the operation process can be terminated.
  • the user equipment 104 may assemble instruction data. For example, based on an instruction issued by the user 102 via the user device 104 (such as an instruction to start cooking) and a random number returned by the IoT device 106 in operation 4003, the user device 104 may generate instruction data for the IoT device 106. Without using random numbers (ie, the IoT device 106 does not return a random number in operation 4003), the user device 104 may assemble the instruction data based only on the instruction issued by the user 102.
  • the user equipment 104 may use the stored user private key to sign the instruction data.
  • the method of signing data with a private key is well known to those skilled in the art, and will not be repeated here.
  • the user equipment 104 may use the stored user public key/user key to sign the instruction data.
  • the user device 104 may transmit the signed instruction data to the IoT device 106, for example, via the connection established in operation 4002.
  • the IoT device 106 may receive the signed instruction data from the user device 104. Subsequently, as shown in operation 4010 of FIG. 4, the Internet of Things device 106 uses the user public key stored in the Internet of Things device 106 to verify the instruction data signed with the user's private key.
  • the IoT device 106 will refuse to execute the user instruction (such as the cooking instruction) and return an error to the user device 104 report. In this case, the user device 104 may display the information that the signature is incorrect to the user 102.
  • the IoT device 106 continues to perform subsequent steps.
  • the IoT device 106 may compare the random number with the stored previously generated random number. If the random number included in the instruction data is the same as the stored random number, as shown in operation 4012 of FIG. 4, the IoT device 106 may execute the instruction in the instruction data. For example, the IoT device 106 can extract instructions in the instruction data and execute the instructions.
  • the IoT device 106 can invalidate the random number (for example, by deleting the random number). If the random number included in the instruction data is different from the stored random number, or the instruction data does not include a random number, the IoT device 106 may not execute the instruction in the instruction data and return an error report to the user device.
  • step of comparing random numbers can also be performed before the key verification step.
  • the aforementioned random number comparison operation can be omitted.
  • the user equipment 104 may transmit operation instructions multiple times, and as shown in operation 4012 of FIG. 4, the IoT device 106 may execute these operation instructions multiple times.
  • the IoT device 106 may return the execution result to the user equipment.
  • the Internet of Things device 106 may return to the user device 104 a confirmation that the cooking instruction was successfully executed.
  • the user equipment 104 may return the execution result to the user 102.
  • the user device 104 may display to the user 102 "It has started cooking! in the smart rice cooker application.
  • the public/private key pair is generated during the process of binding the Internet of Things device.
  • step 2006 in FIG. 2 may be moved after step 3006 in FIG. 3.
  • the user equipment 104 may first determine the security level of the operation instruction, and only request the user to display biometrics for verification when the security level is high.
  • asymmetric encryption scheme that is, a public key/private key pair
  • a symmetric encryption scheme can also be used, in which the user public key and the user private key can be shared by the same User key replacement.
  • the Internet of Things device is taken as an example for description in this article, it should be understood that the Internet of Things device may be replaced by any device that can be authenticated via a user device.
  • FIG. 5 shows a schematic diagram of a method 500 for operating an Internet of Things device according to an embodiment of the present description.
  • the method 500 may include: in step 502, the user device may receive an operation instruction for the Internet of Things device from the user. For example, the user can send out the operation instruction by clicking a control in the application interface of the Internet of Things device on the user device, such as an instruction to start cooking for an electric rice cooker.
  • the method 500 may further include: in step 504, the user's biological characteristics may be recognized by the user equipment. Specifically, as described above, the user equipment may request the user to display the biological characteristics, and then receive the biological characteristics displayed by the user.
  • the method 500 may further include: in step 506, the user equipment may verify the identity of the user based on the biological characteristics. For example, the user equipment may compare the biological characteristics displayed by the user with the previously entered biological characteristics of the user to verify whether the user is a user associated with the IoT device.
  • the method 500 may further include: in step 508, if the user's identity is successfully verified, the user device may use the user's first user key to sign the operation instruction.
  • the first user key and the second user key may be previously generated by the user equipment for a user who has entered biometrics.
  • the first user key is a user private key of the user
  • the second user key is a user public key of the user.
  • the first user key and the second user key are the same user key of the user.
  • the first user key and the second user key may be generated by the user equipment in the process of biometric entry or Internet of Things device binding. Generating the first user key and the second user key by the user equipment further includes: entering the biological characteristics of the user by the user equipment; and after entering the biological characteristics, The user equipment generates the first user key and the second user key for the user.
  • the first user key and the second user key are stored in a secure environment of the user equipment, and the secure environment is a trusted execution environment or a hardware secure element.
  • the method 500 may further include: in step 510, the user equipment may transmit a signed operation instruction to the Internet of Things device.
  • the user equipment also transmits the random number previously received from the Internet of Things device together with the signed operation instruction to the Internet of Things device.
  • the method 500 may further include: in step 512, the Internet of Things device may use the user's second user key to verify the signature of the signed operation instruction, wherein the second user key is identical to the first user key.
  • a user key constitutes a key pair.
  • the method 500 may further include: in step 514, if the signature is successfully verified, the operation instruction may be executed by the Internet of Things device.
  • the Internet of Things device also compares the random number received from the user equipment with the random number generated by the Internet of Things device, and only if the Internet of Things device will receive from the user equipment When the random number of is consistent with the random number generated by the Internet of Things device, the operation instruction is executed by the Internet of Things device. After the operation instruction is executed, the random number can be invalidated by the Internet of Things device.
  • the Internet of Things device can be bound via the user equipment through the following operations: the user device recognizes the user’s biological characteristics; based on the biological characteristics, The user equipment verifies the identity of the user; and if the identity of the user is successfully verified, the user equipment transmits the second user key to the Internet of Things device.
  • FIG. 6 shows a schematic diagram of another method 600 for operating an Internet of Things device according to an embodiment of the present description.
  • the method 600 may be executed by user equipment.
  • the method 600 may include: in step 602, an operation instruction for the Internet of Things device may be received from a user.
  • the method 600 may further include: in step 604, the biometric characteristics of the user may be recognized.
  • the method 600 may further include: in step 606, the identity of the user may be verified based on the biometrics.
  • the method 600 may further include: in step 608, if the user's identity is successfully verified, the first user key of the user may be used to sign the operation instruction.
  • the method 600 may further include: in step 610, the signed operation instruction may be transmitted to the IoT device.
  • the signature can be used by the Internet of Things device to authenticate the identity of the user using a second user key, and the second user key and the first user key form a key pair.
  • FIG. 7 shows a schematic diagram of another method 700 for operating an Internet of Things device according to an embodiment of the present description.
  • the method 700 may be executed by an IoT device.
  • the method 700 may include: in step 702, a second user key in a key pair formed by a first user key and a second user key may be received from a user equipment.
  • the method 700 may further include: in step 704, an operation instruction may be received from the user equipment, the operation instruction being signed with the first user key.
  • the method 700 may further include: in step 706, the second user key may be used to verify the signature of the operation instruction.
  • the method 700 may further include: in step 708, if the signature is successfully verified, the operation instruction may be executed by the Internet of Things device.
  • the method 700 may further include generating a first random number and transmitting the first random number to the user equipment.
  • a second random number is also received from the user equipment.
  • the second random number can be compared with the first random number, and the operation instruction is executed only when the second random number is consistent with the first random number.
  • the first random number is invalidated. For example, the first random number can be deleted.
  • this application also discloses a computer-readable storage medium including computer-executable instructions stored thereon, which, when executed by a processor, causes the processor to perform the various implementations described herein. Example method.
  • this application also discloses a system, which includes a device for implementing the methods of the various embodiments described herein.
  • modules or elements described or shown as separate herein may be combined into a single module or element, and modules or elements described or shown herein as a single module or element may be split into multiple modules or elements.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • Biomedical Technology (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Biodiversity & Conservation Biology (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Medical Informatics (AREA)
  • Telephonic Communication Services (AREA)
  • Selective Calling Equipment (AREA)
  • Control And Safety Of Cranes (AREA)
  • Control By Computers (AREA)

Abstract

公开了一种用于操作物联网设备的方法，包括：由用户设备从用户接收对物联网设备的操作指令；由所述用户设备识别所述用户的生物特征；基于所述生物特征，由所述用户设备验证所述用户的身份；如果所述用户的身份被成功验证，则由所述用户设备使用所述用户的第一用户密钥来对所述操作指令进行签名；由所述用户设备将经签名的操作指令传送至所述物联网设备；由所述物联网设备使用所述用户的第二用户密钥来验证所述经签名的操作指令的签名，所述第二用户密钥与所述第一用户密钥构成密钥对；以及如果所述签名被成功验证，则由所述物联网设备执行所述操作指令。还公开了由用户设备执行的方法、由物联网设备执行的方法和相应的系统。

Description

用于操作物联网设备的方法和系统 技术领域
本说明书的一个或多个实施例涉及物联网设备，尤其涉及用于操作物联网设备的方法和系统。
背景技术
当今，物联网(IoT)设备得到了越来越多的应用。用户可直接操作物联网设备，或者可通过其它设备(例如智能电话等用户设备)来间接操作物联网设备。在远程操作物联网设备的情况下，用户通常首先将用户设备与物联网设备绑定，随后通过用户设备来向物联网设备发出指令。然而，使用用户设备操作物联网设备的方法可能存在安全隐患。
因此，需要能够增强操作物联网设备时的安全性的方法和系统。
发明内容
为了克服现有技术的缺陷，本说明书的一个或多个实施例提供了能够增强操作物联网设备时的安全性的技术方案。
本说明书的一个或多个实施例通过以下技术方案来实现其上述目的。
在一个方面中，公开了一种用于操作物联网设备的方法，包括：由用户设备从用户接收对物联网设备的操作指令；由所述用户设备识别所述用户的生物特征；基于所述生物特征，由所述用户设备验证所述用户的身份；如果所述用户的身份被成功验证，则由所述用户设备使用所述用户的第一用户密钥来对所述操作指令进行签名；由所述用户设备将经签名的操作指令传送至所述物联网设备；由所述物联网设备使用所述用户的第二用户密钥来验证所述经签名的操作指令的签名，所述第二用户密钥与所述第一用户密钥构成密钥对；以及如果所述签名被成功验证，则由所述物联网设备执行所述操作指令。
优选地，所述方法进一步包括：由所述用户设备从所述物联网设备接收随机数，所述随机数由所述物联网设备生成并存储；由所述用户设备将所述随机数与所述经签名的操作指令一起传送至所述物联网设备；在所述签名被成功验证后，由所述物联网设备将从所述用户设备接收的随机数与由所述物联网设备生成的随机数进行比对；以及仅当由所述物联网设备将从所述用户设备接收的随机数与由所述物联网设备生成的随机数一 致时，才由所述物联网设备执行所述操作指令。
优选地，所述方法进一步包括：在执行所述操作指令后，由所述物联网设备使所述随机数失效。
优选地，所述第一用户密钥为所述用户的用户私钥，且所述第二用户密钥为所述用户的用户公钥。
优选地，所述第一用户密钥和所述第二用户密钥为所述用户的同一用户密钥。
优选地，所述方法进一步包括：在操作所述物联网设备之前，经由所述用户设备绑定所述物联网设备。
优选地，经由所述用户设备绑定所述物联网设备进一步包括：由所述用户设备识别所述用户的生物特征；基于所述生物特征，由所述用户设备验证所述用户的身份；以及如果所述用户的身份被成功验证，则由所述用户设备将所述第二用户密钥传送至所述物联网设备。
优选地，所述方法进一步包括由所述用户设备生成所述第一用户密钥和所述第二用户密钥。
优选地，由所述用户设备生成所述第一用户密钥和所述第二用户密钥进一步包括：由所述用户设备录入所述用户的所述生物特征；以及在录入所述生物特征之后，由所述用户设备为所述用户生成所述第一用户密钥和所述第二用户密钥。
优选地，所述第一用户密钥和所述第二用户密钥被存储在所述用户设备的安全环境中，所述安全环境为可信执行环境或硬件安全元件。
在另一方面中，公开了一种由用户设备执行的方法，包括：从用户接收对物联网设备的操作指令；识别所述用户的生物特征；基于所述生物特征，验证所述用户的身份；如果所述用户的身份被成功验证，则使用所述用户的第一用户密钥来对所述操作指令进行签名；将经签名的操作指令传送至所述物联网设备，其中所述签名能被所述物联网设备用来使用第二用户密钥认证所述用户的所述身份，所述第二用户密钥与所述第一用户密钥构成密钥对。
在又一方面中，公开了一种由物联网设备执行的方法，包括：从用户设备接收由第一用户密钥和第二用户密钥构成的密钥对中的第二用户密钥；从所述用户设备接收操作指令，所述操作指令是用所述第一用户密钥签名的；使用所述第二用户密钥来验证所述 操作指令的签名；以及如果所述签名被成功验证，则由所述物联网设备执行所述操作指令。
优选地，所述方法进一步包括：生成第一随机数；以及将所述第一随机数传送至所述用户设备。
优选地，所述方法进一步包括：在从所述用户设备接收操作指令时还接收第二随机数；将所述第二随机数与所述第一随机数进行比对；以及仅当所述第二随机数与所述第一随机数相一致时才执行所述操作指令。
优选地，所述方法进一步包括：在执行所述操作指令后，使所述第一随机数失效。
在又一方面中，公开了一种系统，所述系统包括：用户设备和物联网设备，所述用户设备具有生物特征识别能力，所述用户设备用于：从用户接收对物联网设备的操作指令；识别所述用户的生物特征；基于所述生物特征，验证所述用户的身份；以及如果所述用户的身份被成功验证，则使用所述用户的第一用户密钥来对所述操作指令进行签名；所述物联网设备用于：从所述用户设备接收所述经签名的操作指令；使用所述用户的第二用户密钥来验证所述经签名的操作指令的签名，所述第二用户密钥与所述第一用户密钥构成密钥对；以及如果所述签名被成功验证，则执行所述操作指令。
优选地，所述系统还包括路由器，所述用户设备经由所述路由器与所述物联网通信。
在又一方面中，公开了一种存储指令的计算机可读存储介质，所述指令当被计算机执行时，使所述计算机执行上述方法。
与现有技术相比，本说明书的一个或多个实施例能够增强操作物联网设备时的安全性。
附图说明
以上发明内容以及下面的具体实施方式在结合附图阅读时会得到更好的理解。需要说明的是，附图仅作为所请求保护的发明的示例。在附图中，相同的附图标记代表相同或类似的元素。
图1示出根据本说明书实施例的系统的示意图。
图2示出根据本说明书的实施例的用于录入生物特征的过程的示意图。
图3示出根据本说明的实施例的用于绑定物联网设备的过程的示意图。
图4示出根据本说明的实施例的用于操作物联网设备的过程的示意图。
图5示出根据本说明的实施例的用于操作物联网设备的一种方法的示意图。
图6示出根据本说明的实施例的用于操作物联网设备的另一种方法的示意图。
图7示出根据本说明的实施例的用于操作物联网设备的另一种方法的示意图。
具体实施方式
以下具体实施方式的内容足以使任何本领域技术人员了解本说明书的一个或多个实施例的技术内容并据以实施，且根据本说明书所揭露的说明书、权利要求及附图，本领域技术人员可轻易地理解本说明书的一个或多个实施例相关的目的及优点。
生物特征识别技术是一种利用人体生物特征进行身份认证的技术。相比传统的身份认证方法，包括身份标识物品(诸如钥匙、证件、ATM卡等)和身份标识知识(诸如用户名和密码)，生物特征识别技术更具安全、保密和方便性。生物特征识别技术具有不易遗忘、防伪防盗性能好、随身“携带”和随时随地可用等优点。
当今已经出现了许多种类的生物特征识别技术，如指纹识别、掌纹(手掌几何学)识别、虹膜识别、人脸识别、声音识别、签名识别、基因识别等。在后文中，通常用指纹作为示例，但应当领会，可采用除指纹外的其它生物特征。
系统概述
参见图1，其示出了根据本说明书一实施例的系统100的示意图。如图所示，系统100可包括用户设备104和物联网设备106。其中，用户设备104由用户102使用。
用户设备104优选地是移动设备，例如移动通信设备(例如智能电话等)、平板计算机、笔记本计算机、个人数字助理等等。然而，用户设备104也可以是其它设备，例如台式计算机、机顶盒等等。
通常，用户设备104可包括生物特征识别能力，例如用户设备104可包括指纹扫描仪，该指纹扫描仪可扫描用户102的指纹，并将所扫描的数据进行处理，以对用户102的指纹进行识别从而认证用户。
物联网设备106通常是由物联网连接的物品，其通常具备网络连接能力以便通过物联网与其它设备进行交互。在许多实施例中，可将物联网设备106与如上所述的用户设备104进行绑定，以便通过该用户设备104来控制物联网设备106或与物联网设备106 进行其它交互。
物联网设备106的示例包括但不限于工业机器人、智能医疗设备、汽车、门锁、电饭煲、冰箱等工业设备和家用设备。在下面的示例中以智能电饭煲为例进行说明，但应领会，本说明书实施例不限于特定的物联网设备。
在一些示例中，可在用户设备104上安装用于与物联网设备106交互的应用。该应用可以是针对一个或多个物联网设备的应用。例如，该应用可以是专用于智能电饭煲的智能电饭煲应用。或者，该应用可以是某品牌的物联网设备的通用应用。或者，该应用可以是系统级物联网设备应用。在下面的示例中以智能电饭煲应用为例进行说明，但应领会，本说明书实施例不限于智能电饭煲应用。
如图1所示，在一些示例中，系统100还可包括路由器108，用户设备104和物联网设备106可通过路由器108建立网络连接，从而允许通过用户设备104经由网络与物联网设备106通信。优选地，该网络为无线网络。
替代地，系统100可不包括路由器108，且用户设备104和物联网设备106可通过其它方式连接，例如经由红外、蓝牙、Zigbee等方式连接。
生物特征录入
如图2所示，其示出了根据本说明书的实施例的用于录入生物特征的过程200的示意图，其中涉及用户102和用户设备104。
为了在稍后使用生物特征进行身份认证，通常需要首先将用户102的生物特征录入，以便将生物特征与用户102相关联。
如图2的操作2001所示，用户102可向用户设备104请求开通生物特征识别。例如，用户102可点击用户设备104中的智能电饭煲应用上的控件，以便请求开通生物特征识别。例如，用户102可点击用户设备104上的“使用指纹识别”按钮来向用户设备104发出开通生物特征识别的请求。用户设备也可在用户打开或使用智能电饭煲应用时提示用户开通生物特征识别。
在一些实施例中，用户102可能尚未在用户设备104上录入生物特征。在此情况下，可继续执行如下所述的生物特征录入过程。
如图2的操作2002所示，可经由用户设备104提示用户展示生物特征。例如，可提示用户102将其手指放到指纹扫描仪上。在一些情况下，此操作可被省略。例如，当用 户特征是虹膜时，可无需提示用户而直接扫描用户的虹膜。
随后，如图2的操作2003所示，用户102可根据提示展示生物特征。例如，用户102可将手指放到用户设备104的指纹扫描仪上。
随后，如图2的操作2004所示，用户102的生物特征可被传入用户设备104。例如，用户设备104的指纹扫描仪可读取用户102的生物特征。
随后，如图2的操作2005所示，用户设备104可存储用户102的生物特征。
在扫描过程中还可能需要提示用户102移动手指，以便获得完整的指纹数据。
在稍后的身份认证过程中，可扫描待进行身份认证的用户的指纹，提取指纹特征与所存储的用户指纹特征进行比较，以确定两者是否匹配，从而认证该用户的身份。
在另一些实施例中，用户102可能已经在用户设备104上录入了生物特征。例如，用户102可能先前已经在用户设备104上录入了指纹等，此时可无需重新录入生物特征，而是使用已经录入的生物特征。
在另一些示例中，不管用户设备104上是否已经存在已录入的生物特征，可针对特定物联网设备录入专用生物特征。例如，可使用该智能电饭煲应用来录入专用于智能电饭煲的生物特征。使用专用于特定物联网设备的生物特征可进一步增加安全性。
不同于现有技术，在本说明书的实施例中，如图2的操作2006所示，用户设备104还可为用户102生成公钥/私钥对。优选地，如下面详细描述的，用户公钥稍后可被存储到物联网设备106中，而用户私钥可被存储在用户设备104上，从而使得可以用物联网设备106上的用户私钥来对用户设备104上的公钥进行验证。
替代地，还可采用对称加密方案。例如，用户设备104可生成单个用户密钥，且该单个用户密钥可被存储在用户设备104上，且该单个用户密钥稍后可被存储到物联网设备106上，从而使得可以用物联网设备106上的用户密钥来对用户设备104上的用户密钥进行验证。
优选地，用户设备104可包括安全环境，且用户102的私钥(和/或生物特征)可被存储在该安全环境中。该安全环境可以是软件层面的安全环境，也可以是硬件层面的安全环境，或两者的结合。
例如，该用户设备104可包括可信执行环境(Trusted Execution Environment,TEE)。可信执行环境是由在用户设备104中创建的与用户设备104的主操作系统隔离的独立运 行的操作系统实现的安全环境，其可用于保障密钥存储、运算、生物特征识别等操作的安全性。在此情况下，用户102的私钥可被存储在该可信执行环境中。
又例如，该用户设备104可包括安全元件(Secure Element,SE)，该安全元件通常是以芯片形式提供的。为防止外部恶意解析攻击，保护数据安全，在作为安全元件的芯片中通常具有加密/解密逻辑电路。在此情况下，用户102的私钥可被存储在该安全元件中。
通过使用安全环境，本说明书实施例可以进一步增强对公钥/私钥对的保护。
随后，如图2的操作2007所示，可向用户102返回生物特征录入结果。例如，可向用户102告知用户生物特征录入完成。此外，可选地，也可向用户102告知公钥/私钥对生成完成。
物联网设备绑定
在用户102可以操作物联网设备106之前，通常应当首先将物联网设备106与用户102进行绑定。图3示出了根据本说明的实施例的用于绑定物联网设备的过程300的示意图。
在一个实施例中，如图3的操作3001所示，用户102可向用户设备106发起绑定请求。例如，用户102可以点击用户设备106上的智能电饭煲应用中的控件，以选择要绑定的智能电饭煲。例如，该智能电饭煲可以是由用户设备通过搜索局域网内的设备来发现的。
用户设备104接收来自用户102的绑定请求。如图3的操作3002所示，基于该绑定请求，用户设备104可尝试连接到物联网设备106。该连接例如可经由如图1所示的路由器108实现，或经由其它连接方式实现。
可选地，如图3的操作3003所示，在连接成功后，物联网设备106可向用户设备104返回连接结果。此外，用户设备也可通知用户连接成功。
在本说明书的实施例中，可在用户设备104上执行生物特征认证过程。例如，如图3的操作3004所示，用户设备104可向用户102请求展示生物特征。例如，可在用户设备104中的智能电饭煲应用中显示：“请扫描指纹！”。
如图3的操作3005所示，响应于该请求，用户102可向用户设备104展示其生物特征。例如，用户102可将其手指放在用户设备104的指纹扫描仪上。
随后，如图3的操作3006所示，用户设备104可接收并验证用户102所展示的生物特征。例如，用户设备104可通过指纹扫描仪来扫描用户指纹，且用户设备104可提取扫描获得的用户指纹的指纹特征并将所提取的指纹特征与所存储的用户指纹特征进行比较，以确定两者是否匹配，从而认证该用户的身份。
在用户提供的指纹特征与所存储的用户指纹特征相匹配的情况下，该用户的身份被成功认证。在用户提供的指纹特征与所存储的用户指纹特征不匹配的情况下，可提示用户指纹不匹配，可重新验证生物特征或者结束绑定过程(例如提示绑定不成功)。
如图3的操作3007所示，在用户指纹验证成功之后，用户设备104可将与经认证的用户102相关联的用户公钥传送给物联网设备106，例如经由在先前的操作3002中建立的连接。
在接收到与用户102相关联的用户公钥之后，如图3的操作3008所示，物联网设备106可存储该用户公钥，例如存储在该物联网设备106的存储器中。类似地，为了进一步增强安全性，物联网设备可将该用户公钥存储在安全环境中，例如可信执行环境或安全元件中。
随后，如图3的操作3010所示，物联网设备106可向用户设备104返回结果，例如以确认用户公钥存储成功。
随后，如图3的操作3011所示，在接收到来自物联网设备106的确认之后，用户设备104可向用户102返回结果，例如经由智能电饭煲应用向用户显示绑定过程完成的提示。
物联网设备操作
参见图4，其示出了根据本说明的实施例的用于操作物联网设备的过程400的示意图。
在一个实施例中，在用户102想要操作物联网设备106时，如图4的操作4001所示，用户102可经由用户设备104发起操作指令。所述操作例如可以是对物联网设备106的管理，或者与物联网设备106的其它交互。
例如，用户102可以点击用户设备中的智能电饭煲应用中的相应控件来操作物联网设备。例如，在智能电饭煲应用中，用户在选择“米种”、“口感”等参数后，可点击智能电饭煲应用上的“开始”按钮，以便向智能电饭煲传送开始煮饭的指令。
用户设备104可接收来自用户102的操作指令。如图4的操作4002所示，基于该操作指令，用户设备104可尝试连接到物联网设备106。类似地，该连接例如可经由如图1所示的路由器108实现，或经由其它连接方式实现。连接也可以是用户打开智能电饭煲应用后自动连接，随后用户可通过应用发出操作指令。
可选地，如图4的操作4003所示，在连接成功后，物联网设备106可向用户设备104返回连接结果。
优选地，在连接成功后，如图4的操作4003所示，物联网设备106还向用户设备104返回随机数。在打开智能电饭煲应用后自动连接的情况下，在用户发出操作指令后，物联网设备106可向用户设备104返回随机数。该随机数可由物联网设备106生成并存储。随机数可被用来保证操作指令仅被执行一次，从而增加了物联网设备106的安全性。可以理解，可使用本领域已知的任何随机数生成方案来生成随机数。
在一些实施例中，物联网设备106可不执行生成并存储随机数的步骤。在这样的情况下，单个操作指令可能被多次执行多次。
例如，如图4的操作4004所示，用户设备104可向用户102请求展示生物特征。例如，可在用户设备104中的智能电饭煲应用中显示：“请扫描指纹！”。
如图4的操作4005所示，响应于该请求，用户102可向用户设备104展示其生物特征。例如，用户102可将其手指放在用户设备104的指纹扫描仪上。
随后，如图4的操作4006所示，用户设备104可接收并验证用户102所展示的生物特征。例如，用户设备104可通过指纹扫描仪来扫描用户指纹，且用户设备104可提取指纹特征并将所提取的指纹特征与所存储的用户指纹特征进行比较，以确定两者是否匹配，从而认证该用户的身份。
在用户提供的指纹特征与所存储的用户指纹特征相匹配的情况下，该用户的身份被成功认证。在用户提供的指纹特征与所存储的用户指纹特征不匹配的情况下，可提示用户指纹不匹配，可重新验证生物特征或者结束操作过程。
在用户指纹验证成功之后，如图4的操作4007所示，用户设备104可组装指令数据。例如，基于由用户102经由用户设备104发出的指令(例如开始煮饭指令)和在操作4003中由物联网设备106返回的随机数，用户设备104可生成用于物联网设备106的指令数据。在不利用随机数(即物联网设备106在操作4003中不返回随机数)的情况下，用户设备104可仅基于由用户102发出的指令来组装指令数据。
随后，如图4的操作4008所示，用户设备104可利用其存储的用户私钥对指令数据进行签名。用私钥对数据进行签名的方法对本领域技术人员是公知的，在此不再赘述。同样地，应当领会，在其它实施例中，用户设备104可利用其存储的用户公钥/用户密钥来对指令数据进行签名。
随后，如图4的操作4009所示，用户设备104可将经签名的指令数据传送至物联网设备106，例如经由在操作4002中建立的连接。
物联网设备106可接收来自用户设备104的经签名的指令数据。随后，如图4的操作4010所示，物联网设备106用存储在所述物联网设备106中的用户公钥来验证所述用用户私钥签名的指令数据。
如果所述经签名的指令数据无法通过验证，说明该指令数据没有用有效的用户私钥来签名，因此物联网设备106将拒绝执行用户指令(例如煮饭指令)，并向用户设备104返回错误报告。在此情况下，用户设备104可向用户102显示签名错误的信息。
如果所述经签名的指令数据通过了验证，则说明该指令数据是用有效数据签名的，此时物联网设备106继续执行后续步骤。
随后，如果物联网设备106先前生成了随机数，则如在图4的操作4011所示，物联网设备106可将该随机数与所存储的先前生成的随机数进行比对。如果指令数据中包括的随机数与所存储的随机数相同，则如在图4的操作4012中所示，物联网设备106可执行指令数据中的指令。例如，物联网设备106可提取指令数据中的指令，并执行该指令。
优选地，物联网设备106可使所述随机数失效(例如通过删除该随机数)。如果指令数据中包括的随机数与所存储的随机数不同，或者指令数据中不包括随机数，则物联网设备106可不执行指令数据中的指令，并向用户设备返回错误报告。
可以领会，比对随机数的步骤也可在密钥验证步骤之前执行。
如果物联网设备106先前没有生成随机数，则上述随机数比对操作可以省略。在此情况下，用户设备104可多次传送操作指令，且如在图4的操作4012中所示，物联网设备106可多次执行这些操作指令。
在执行完指令数据中的指令后，如在图4的操作4013所示，物联网设备106可向用户设备返回执行结果。例如，物联网设备106可向用户设备104返回煮饭指令被成功执行的确认。
随后，如在图4的操作4014所示，用户设备104可向用户102返回该执行结果。例如，用户设备104可在智能电饭煲应用中向用户102显示“已经开始煮饭！”
可以看出，在本发明中，通过使用生物特征来验证用户的身份，避免了与用户名/密码被盗等相关的风险，进一步增强了系统的安全性。
需要领会，本说明书的实施例存在许多变型。
例如，在一种变型中，不是在用户生物特征录入过程期间生成公钥/私钥对，而是在绑定物联网设备过程期间生成公钥/私钥对。例如，在图2中的步骤2006可被移动至图3中的步骤3006之后。
在再一种变型中，并非所有操作指令均需采用用户生物特征来验证。例如，在一些示例中，用户设备104在接收到操作指令后，可首先确定该操作指令的安全等级，且仅将安全等级较高时才请求用户展示生物特征以便验证。
此外，尽管前文示出的是非对称加密方案(即公钥/私钥对)的示例，但应领会，在其它示例中，也可采用对称加密方案，其中用户公钥和用户私钥均可由相同的用户密钥替换。
尽管在本文中以物联网设备为例进行说明，但应该理解，所述物联网设备可以用能够经由用户设备来认证的任何设备来替代。
示例方法
参见图5，其示出了根据本说明的实施例的用于操作物联网设备的一种方法500的示意图。
方法500可包括：在步骤502，可由用户设备从用户接收对物联网设备的操作指令。例如，用户可通过点击用户设备上的物联网设备应用界面中的控件来发出该操作指令，比如针对电饭煲的开始煮饭指令。
方法500还可包括：在步骤504，可由所述用户设备识别所述用户的生物特征。具体而言，如上所述，用户设备可向用户请求展示生物特征，随后接收用户所展示的生物特征。
方法500还可包括：在步骤506，可基于所述生物特征，由所述用户设备验证所述用户的身份。例如，用户设备可将用户展示的生物特征与先前录入的用户的生物特征进行比较，以验证所述用户是否为与物联网设备相关联的用户。
方法500还可包括：在步骤508，如果所述用户的身份被成功验证，则可由所述用户设备使用所述用户的第一用户密钥来对所述操作指令进行签名。例如，该第一用户密钥和第二用户密钥可以是由用户设备先前针对已录入生物特征的用户生成的。优选地，所述第一用户密钥为所述用户的用户私钥，且所述第二用户密钥为所述用户的用户公钥。替代地，所述第一用户密钥和所述第二用户密钥为所述用户的同一用户密钥。
所述第一用户密钥和所述第二用户密钥可以是在生物特征录入或物联网设备绑定过程中由用户设备生成的。由所述用户设备生成所述第一用户密钥和所述第二用户密钥进一步包括：由所述用户设备录入所述用户的所述生物特征；以及在录入所述生物特征之后，由所述用户设备为所述用户生成所述第一用户密钥和所述第二用户密钥。
优选地，所述第一用户密钥和所述第二用户密钥被存储在所述用户设备的安全环境中，所述安全环境为可信执行环境或硬件安全元件。
方法500还可包括：在步骤510，可由所述用户设备将经签名的操作指令传送至所述物联网设备。优选地，还由用户设备将先前从物联网设备接收的随机数与所述经签名的操作指令一起传送至物联网设备。
方法500还可包括：在步骤512，可由所述物联网设备使用所述用户的第二用户密钥来验证所述经签名的操作指令的签名，其中所述第二用户密钥与所述第一用户密钥构成密钥对。
方法500还可包括：在步骤514，如果所述签名被成功验证，则可由所述物联网设备执行所述操作指令。优选地，所述物联网设备还将从所述用户设备接收的随机数与由所述物联网设备生成的随机数进行比对，并且仅当由所述物联网设备将从所述用户设备接收的随机数与由所述物联网设备生成的随机数一致时，才由所述物联网设备执行所述操作指令。在执行所述操作指令后，可由所述物联网设备使所述随机数失效。
优选地，在操作所述物联网设备之前，可通过以下操作经由所述用户设备绑定所述物联网设备：由所述用户设备识别所述用户的生物特征；基于所述生物特征，由所述用户设备验证所述用户的身份；以及如果所述用户的身份被成功验证，则由所述用户设备将所述第二用户密钥传送至所述物联网设备。
参见图6，其示出了根据本说明的实施例的用于操作物联网设备的另一种方法600的示意图。方法600可以是由用户设备执行的。
方法600可包括：在步骤602，可从用户接收对物联网设备的操作指令。
方法600还可包括：在步骤604，可识别所述用户的生物特征。
方法600还可包括：在步骤606，可基于所述生物特征，验证所述用户的身份。
方法600还可包括：在步骤608，如果所述用户的身份被成功验证，则可使用所述用户的第一用户密钥来对所述操作指令进行签名。
方法600还可包括：在步骤610，可将经签名的操作指令传送至所述物联网设备。其中所述签名能被所述物联网设备用来使用第二用户密钥认证所述用户的所述身份，所述第二用户密钥与所述第一用户密钥构成密钥对。
相关步骤的具体操作可参考前面针对图5的描述。
参见图7，其示出了根据本说明的实施例的用于操作物联网设备的另一种方法700的示意图。方法700可以是由物联网设备执行的。
方法700可包括：在步骤702，可从用户设备接收由第一用户密钥和第二用户密钥构成的密钥对中的第二用户密钥。
方法700还可包括：在步骤704，可从所述用户设备接收操作指令，所述操作指令是用所述第一用户密钥签名的。
方法700还可包括：在步骤706，可使用所述第二用户密钥来验证所述操作指令的签名。
方法700还可包括：在步骤708，如果所述签名被成功验证，则可由所述物联网设备执行所述操作指令。
优选地，方法700还可包括生成第一随机数并将所述第一随机数传送至所述用户设备。随后，在从所述用户设备接收操作指令，还从所述用户设备接收第二随机数。随后，可将所述第二随机数与所述第一随机数进行比对，并且仅当所述第二随机数与所述第一随机数相一致时才执行所述操作指令。在执行所述操作指令后，使所述第一随机数失效。例如，可删除该第一随机数。
而且，本申请还公开了一种包括存储于其上的计算机可执行指令的计算机可读存储介质，所述计算机可执行指令在被处理器执行时使得所述处理器执行本文所述的各实施例的方法。
此外，本申请还公开了一种系统，该系统包括用于实现本文所述的各实施例的方法的装置。
可以理解，根据本说明书的一个或多个实施例的方法可以用软件、固件或其组合来实现。
应该理解，本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同或相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于装置和系统实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
应该理解，上述对本说明书特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
应该理解，本文用单数形式描述或者在附图中仅显示一个的元件并不代表将该元件的数量限于一个。此外，本文中被描述或示出为分开的模块或元件可被组合为单个模块或元件，且本文中被描述或示出为单个的模块或元件可被拆分为多个模块或元件。
还应理解，本文采用的术语和表述方式只是用于描述，本说明书的一个或多个实施例并不应局限于这些术语和表述。使用这些术语和表述并不意味着排除任何示意和描述(或其中部分)的等效特征，应认识到可能存在的各种修改也应包含在权利要求范围内。其他修改、变化和替换也可能存在。相应的，权利要求应视为覆盖所有这些等效物。
同样，需要指出的是，虽然已参照当前的具体实施例来描述，但是本技术领域中的普通技术人员应当认识到，以上的实施例仅是用来说明本说明书的一个或多个实施例，在没有脱离本发明精神的情况下还可做出各种等效的变化或替换，因此，只要在本发明的实质精神范围内对上述实施例的变化、变型都将落在本申请的权利要求书的范围内。

Claims (32)

  1. 一种用于操作物联网设备的方法，其特征在于，包括：
    由用户设备从用户接收对物联网设备的操作指令；
    由所述用户设备识别所述用户的生物特征；
    基于所述生物特征，由所述用户设备验证所述用户的身份；
    如果所述用户的身份被成功验证，则由所述用户设备使用所述用户的第一用户密钥来对所述操作指令进行签名；
    由所述用户设备将经签名的操作指令传送至所述物联网设备；
    由所述物联网设备使用所述用户的第二用户密钥来验证所述经签名的操作指令的签名，所述第二用户密钥与所述第一用户密钥构成密钥对；以及
    如果所述签名被成功验证，则由所述物联网设备执行所述操作指令。
  2. 如权利要求1所述的方法，其特征在于，进一步包括：
    由所述用户设备从所述物联网设备接收随机数，所述随机数由所述物联网设备生成并存储；
    由所述用户设备将所述随机数与所述经签名的操作指令一起传送至所述物联网设备；
    在所述签名被成功验证后，由所述物联网设备将从所述用户设备接收的随机数与由所述物联网设备生成的随机数进行比对；以及
    仅当由所述物联网设备将从所述用户设备接收的随机数与由所述物联网设备生成的随机数一致时，才由所述物联网设备执行所述操作指令。
  3. 如权利要求2所述的方法，其特征在于，进一步包括：
    在执行所述操作指令后，由所述物联网设备使所述随机数失效。
  4. 如权利要求1所述的方法，其特征在于，所述第一用户密钥为所述用户的用户私钥，且所述第二用户密钥为所述用户的用户公钥。
  5. 如权利要求1所述的方法，其特征在于，所述第一用户密钥和所述第二用户密钥为所述用户的同一用户密钥。
  6. 如权利要求1所述的方法，其特征在于，进一步包括：
    在操作所述物联网设备之前，经由所述用户设备绑定所述物联网设备。
  7. 如权利要求1所述的方法，其特征在于，经由所述用户设备绑定所述物联网设备进一步包括：
    由所述用户设备识别所述用户的生物特征；
    基于所述生物特征，由所述用户设备验证所述用户的身份；以及
    如果所述用户的身份被成功验证，则由所述用户设备将所述第二用户密钥传送至所述物联网设备。
  8. 如权利要求1所述的方法，其特征在于，所述方法进一步包括由所述用户设备生成所述第一用户密钥和所述第二用户密钥。
  9. 如权利要求8所述的方法，其特征在于，由所述用户设备生成所述第一用户密钥和所述第二用户密钥进一步包括：
    由所述用户设备录入所述用户的所述生物特征；以及
    在录入所述生物特征之后，由所述用户设备为所述用户生成所述第一用户密钥和所述第二用户密钥。
  10. 如权利要求1所述的方法，其特征在于，所述第一用户密钥和所述第二用户密钥被存储在所述用户设备的安全环境中，所述安全环境为可信执行环境或硬件安全元件。
  11. 一种由用户设备执行的方法，其特征在于，包括：
    从用户接收对物联网设备的操作指令；
    识别所述用户的生物特征；
    基于所述生物特征，验证所述用户的身份；
    如果所述用户的身份被成功验证，则使用所述用户的第一用户密钥来对所述操作指令进行签名；
    将经签名的操作指令传送至所述物联网设备，其中所述签名能被所述物联网设备用来使用第二用户密钥认证所述用户的所述身份，所述第二用户密钥与所述第一用户密钥构成密钥对。
  12. 如权利要求11所述的方法，其特征在于，进一步包括：
    从所述物联网设备接收随机数，所述随机数由所述物联网设备生成并存储；
    将所述随机数与所述经签名的操作指令一起传送至所述物联网设备。
  13. 如权利要求11所述的方法，其特征在于，进一步包括：
    在操作所述物联网设备之前，经由所述用户设备绑定所述物联网设备。
  14. 如权利要求13所述的方法，其特征在于，经由所述用户设备绑定所述物联网设备进一步包括：
    识别所述用户的生物特征；
    基于所述生物特征，验证所述用户的身份；以及
    如果所述用户的身份被成功验证，则将所述第二用户密钥传送至所述物联网设备。
  15. 如权利要求11所述的方法，其特征在于，进一步包括：
    录入所述用户的所述生物特征；以及
    在录入所述生物特征之后，为所述用户生成所述第一用户密钥和所述第二用户密钥。
  16. 如权利要求11所述的方法，其特征在于，所述第一用户密钥和所述第二用户密钥被存储在所述用户设备的安全环境中，所述安全环境为可信执行环境或硬件安全元件。
  17. 一种由物联网设备执行的方法，其特征在于，包括：
    从用户设备接收由第一用户密钥和第二用户密钥构成的密钥对中的第二用户密钥；
    从所述用户设备接收操作指令，所述操作指令是用所述第一用户密钥签名的；
    使用所述第二用户密钥来验证所述操作指令的签名；以及
    如果所述签名被成功验证，则由所述物联网设备执行所述操作指令。
  18. 如权利要求17所述的方法，其特征在于，进一步包括：
    生成第一随机数；以及
    将所述第一随机数传送至所述用户设备。
  19. 如权利要求18所述的方法，其特征在于，进一步包括：
    在从所述用户设备接收操作指令时还接收第二随机数；
    将所述第二随机数与所述第一随机数进行比对；以及
    仅当所述第二随机数与所述第一随机数相一致时才执行所述操作指令。
  20. 如权利要求19所述的方法，其特征在于，进一步包括：
    在执行所述操作指令后，使所述第一随机数失效。
  21. 一种系统，其特征在于，所述系统包括：
    用户设备，所述用户设备具有生物特征识别能力，所述用户设备用于：
    从用户接收对物联网设备的操作指令；
    识别所述用户的生物特征；
    基于所述生物特征，验证所述用户的身份；以及
    如果所述用户的身份被成功验证，则使用所述用户的第一用户密钥来对所述操作指令进行签名；以及
    物联网设备，所述物联网设备用于：
    从所述用户设备接收经签名的操作指令；
    使用所述用户的第二用户密钥来验证所述经签名的操作指令的签名，所述第二用户密钥与所述第一用户密钥构成密钥对；以及
    如果所述签名被成功验证，则执行所述操作指令。
  22. 如权利要求21所述的系统，其特征在于，
    所述用户设备仅一步用于：
    从所述物联网设备接收随机数，所述随机数由所述物联网设备生成并存储；以及
    将所述随机数与所述经签名的操作指令一起传送至所述物联网设备；
    所述物联网设备进一步用于：
    在所述签名被成功验证后，将从所述用户设备接收的所述随机数与由所述物联网设备生成的随机数进行比对；以及
    仅当由所述物联网设备将从所述用户设备接收的所述随机数与由所述物联网设备生成的随机数一致时，才执行所述操作指令。
  23. 如权利要求22所述的系统，其特征在于，进一步包括：
    在执行所述操作指令后，由所述物联网设备使所述随机数失效。
  24. 如权利要求22所述的系统，其特征在于，进一步包括：
    在操作所述物联网设备之前，所述用户设备被绑定到所述物联网设备。
  25. 如权利要求24所述的系统，其特征在于，所述绑定包括：
    由所述用户设备识别所述用户的生物特征；
    基于所述生物特征，由所述用户设备验证所述用户的身份；以及
    如果所述用户的身份被成功验证，则由所述用户设备将所述第二用户密钥传送至所述物联网设备。
  26. 如权利要求22所述的系统，其特征在于，由所述用户设备生成所述第一用户密钥和所述第二用户密钥。
  27. 如权利要求22所述的系统，其特征在于，由所述用户设备生成所述第一用户密钥和所述第二用户密钥进一步包括：
    由所述用户设备录入所述用户的所述生物特征；以及
    在录入所述生物特征之后，由所述用户设备为所述用户生成所述第一用户密钥和所述第二用户密钥。
  28. 如权利要求22所述的系统，其特征在于，所述用户设备包括安全环境，所述第一用户密钥和所述第二用户密钥被存储在所述安全环境中，所述安全环境为可信执行环境或硬件安全元件。
  29. 如权利要求22所述的系统，其特征在于，还包括路由器，所述用户设备经由所述路由器与所述物联网通信。
  30. 一种存储指令的计算机可读存储介质，所述指令当被计算机执行时，使所述计 算机执行如权利要求1-10中任一项所述的方法。
  31. 一种存储指令的计算机可读存储介质，所述指令当被计算机执行时，使所述计算机执行如权利要求11-16中任一项所述的方法。
  32. 一种存储指令的计算机可读存储介质，所述指令当被计算机执行时，使所述计算机执行如权利要求17-20中任一项所述的方法。
PCT/CN2020/070659 2019-03-19 2020-01-07 用于操作物联网设备的方法和系统 Ceased WO2020186902A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
SG11202105440QA SG11202105440QA (en) 2019-03-19 2020-01-07 Method and system for operating internet of things device
EP20772610.0A EP3876495B1 (en) 2019-03-19 2020-01-07 Method and system for operating internet of things device
US17/313,934 US11271745B2 (en) 2019-03-19 2021-05-06 Method and system for operating internet of things device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910210669.6 2019-03-19
CN201910210669.6A CN110011985A (zh) 2019-03-19 2019-03-19 用于操作物联网设备的方法和系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/313,934 Continuation US11271745B2 (en) 2019-03-19 2021-05-06 Method and system for operating internet of things device

Publications (1)

Publication Number Publication Date
WO2020186902A1 true WO2020186902A1 (zh) 2020-09-24

Family

ID=67167438

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/070659 Ceased WO2020186902A1 (zh) 2019-03-19 2020-01-07 用于操作物联网设备的方法和系统

Country Status (6)

Country Link
US (1) US11271745B2 (zh)
EP (1) EP3876495B1 (zh)
CN (1) CN110011985A (zh)
SG (1) SG11202105440QA (zh)
TW (1) TWI770422B (zh)
WO (1) WO2020186902A1 (zh)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12124545B2 (en) * 2014-04-29 2024-10-22 Taliware, Inc. Communication network based non-fungible token creation platform with integrated creator biometric authentication
CN110011985A (zh) 2019-03-19 2019-07-12 阿里巴巴集团控股有限公司 用于操作物联网设备的方法和系统
CN110445774B (zh) * 2019-07-24 2022-04-22 创新先进技术有限公司 IoT设备的安全防护方法、装置及设备
CN112153051A (zh) * 2019-12-27 2020-12-29 陈玉鋆 基于物联网和云计算的信息处理方法及系统
CN111586074B (zh) * 2020-05-26 2022-06-10 深圳市迪安杰智能识别科技有限公司 一种通信方法、服务器、物联网系统及可读存储介质
CN111887897B (zh) * 2020-07-20 2024-10-25 上饶大森医疗科技中心(个人独资) 一种搭载5g网络的男性临床检验便盆
CN114124403B (zh) * 2021-11-10 2024-09-06 中国电信股份有限公司 实现设备远程控制的方法、装置和系统
CN114615044A (zh) * 2022-03-08 2022-06-10 深圳国众智能有限公司 基于云边端架构的洗车设备控制方法及系统
CN115065522A (zh) * 2022-06-09 2022-09-16 北谷电子有限公司 安全认证方法、车载控制器、远程通信终端和存储介质

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170118181A1 (en) * 2015-05-26 2017-04-27 Dell Software Inc. Securing Internet of Things Communications Across Multiple Vendors
CN106850664A (zh) * 2017-02-28 2017-06-13 重庆步航科技有限公司 基于智能移动终端的物联网终端安全控制方法及其系统
US20170171204A1 (en) * 2015-12-14 2017-06-15 Afero, Inc. System and method for performing asset and crowd tracking in an iot system
CN107370597A (zh) * 2017-07-11 2017-11-21 深圳市雪球科技有限公司 基于物联网的安全认证方法以及安全认证系统
CN107919962A (zh) * 2017-12-22 2018-04-17 国民认证科技（北京）有限公司 一种物联网设备注册和认证方法
CN109150508A (zh) * 2017-06-27 2019-01-04 腾讯科技（深圳）有限公司 设备控制和受控方法、装置、计算机设备和存储介质
US20190058586A1 (en) * 2017-08-18 2019-02-21 Samsung Electronics Co., Ltd. METHOD AND AN APPARATUS FOR ONBOARDING IN AN IoT NETWORK
CN110011985A (zh) * 2019-03-19 2019-07-12 阿里巴巴集团控股有限公司 用于操作物联网设备的方法和系统

Family Cites Families (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130227653A1 (en) 2008-11-29 2013-08-29 Yu Yung Choi System and method for streamlined registration of products over a communication network and for verification and management of information related thereto
US9832019B2 (en) * 2009-11-17 2017-11-28 Unho Choi Authentication in ubiquitous environment
US9319404B2 (en) 2011-09-23 2016-04-19 Jerome Svigals Security for the internet of things
US10164966B2 (en) 2013-02-25 2018-12-25 Lockstep Technologies Pty Ltd Decoupling identity from devices in the internet of things
EP3140779A4 (en) 2014-05-09 2017-11-29 Google LLC Systems and methods for using eye signals with secure mobile communications
CN111628870B (zh) 2014-05-13 2022-03-18 埃利蒙特公司 用于电子钥匙供应、用户验证和访问管理的系统和方法
GB2533348B (en) 2014-12-17 2021-07-07 Arm Ip Ltd Management of relationships between a device and a service provider
EP3288214B1 (en) * 2015-04-23 2021-03-03 Unho Choi Authentication in ubiquitous environment
US20160364553A1 (en) 2015-06-09 2016-12-15 Intel Corporation System, Apparatus And Method For Providing Protected Content In An Internet Of Things (IOT) Network
CN106325078A (zh) * 2015-06-15 2017-01-11 思普尔黄石物联科技有限公司 一种基于物联网技术的智能家居安全控制系统
US10572640B2 (en) 2015-11-16 2020-02-25 Personnus System for identity verification
US10516540B2 (en) * 2016-01-28 2019-12-24 Apple Inc. Management of profiles in an embedded universal integrated circuit card (eUICC)
US11130042B2 (en) 2016-02-02 2021-09-28 Bao Tran Smart device
KR102483832B1 (ko) * 2016-02-19 2023-01-03 삼성전자주식회사 생체 정보 기반 인증을 이용한 전자 장치들 간 연결 방법 및 장치
US9985964B2 (en) 2016-03-28 2018-05-29 Black Gold Coin, Inc. Systems and methods for providing block chain-based multifactor personal identity verification
JP6441544B2 (ja) * 2016-05-17 2018-12-19 株式会社オプティム 情報機器操作システム、情報機器操作方法及びプログラム
CN105959287A (zh) * 2016-05-20 2016-09-21 中国银联股份有限公司 一种基于生物特征的安全认证方法及装置
SG11201810431PA (en) 2016-08-30 2018-12-28 Visa Int Service Ass Biometric identification and verification among iot devices and applications
CN106850209A (zh) * 2017-02-28 2017-06-13 苏州福瑞思信息科技有限公司 一种身份认证方法及装置
CN107026874A (zh) * 2017-06-02 2017-08-08 李维刚 一种指令签名与验证方法及系统
US10387689B2 (en) 2017-09-22 2019-08-20 Tocreo Labs, L.L.C. NFC cryptographic security module
US11288740B2 (en) 2017-12-29 2022-03-29 Intel Corporation Securing distributed electronic wallet shares
US20190034919A1 (en) 2017-12-29 2019-01-31 Intel Corporation Securing Electronic Wallet Transactions
CN108600183A (zh) * 2018-03-28 2018-09-28 湖南东方华龙信息科技有限公司 目标设备控制方法
US10921787B1 (en) * 2019-08-06 2021-02-16 Bank Of America Corporation Centralized resource transfer engine for facilitating resource transfers between distributed internet-of-things (IoT) components

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170118181A1 (en) * 2015-05-26 2017-04-27 Dell Software Inc. Securing Internet of Things Communications Across Multiple Vendors
US20170171204A1 (en) * 2015-12-14 2017-06-15 Afero, Inc. System and method for performing asset and crowd tracking in an iot system
CN106850664A (zh) * 2017-02-28 2017-06-13 重庆步航科技有限公司 基于智能移动终端的物联网终端安全控制方法及其系统
CN109150508A (zh) * 2017-06-27 2019-01-04 腾讯科技（深圳）有限公司 设备控制和受控方法、装置、计算机设备和存储介质
CN107370597A (zh) * 2017-07-11 2017-11-21 深圳市雪球科技有限公司 基于物联网的安全认证方法以及安全认证系统
US20190058586A1 (en) * 2017-08-18 2019-02-21 Samsung Electronics Co., Ltd. METHOD AND AN APPARATUS FOR ONBOARDING IN AN IoT NETWORK
CN107919962A (zh) * 2017-12-22 2018-04-17 国民认证科技（北京）有限公司 一种物联网设备注册和认证方法
CN110011985A (zh) * 2019-03-19 2019-07-12 阿里巴巴集团控股有限公司 用于操作物联网设备的方法和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3876495A4 *

Also Published As

Publication number Publication date
CN110011985A (zh) 2019-07-12
SG11202105440QA (en) 2021-06-29
US20210266171A1 (en) 2021-08-26
TWI770422B (zh) 2022-07-11
TW202037113A (zh) 2020-10-01
US11271745B2 (en) 2022-03-08
EP3876495A1 (en) 2021-09-08
EP3876495A4 (en) 2022-01-19
EP3876495B1 (en) 2025-03-19

Similar Documents

Publication Publication Date Title
TWI770422B (zh) 用於操作物聯網設備的方法和系統
US10671716B2 (en) User authentication method and system using variable keypad and biometric identification
CN104969528B (zh) 确定验证功能的查询系统和方法
EP3138265B1 (en) Enhanced security for registration of authentication devices
US9219732B2 (en) System and method for processing random challenges within an authentication framework
US9083689B2 (en) System and method for implementing privacy classes within an authentication framework
CN105516104B (zh) 一种基于tee的动态口令的身份验证方法及系统
US20140189360A1 (en) System and method for implementing transaction signing within an authentication framework
US20230262057A1 (en) Systems and methods for authenticating users within a computing or access control environment
CN111884806A (zh) 用于对用户进行认证或确保交互安全的系统和认证令牌
WO2015188424A1 (zh) 一种密钥存储设备及其使用方法
US11115215B2 (en) Methods and devices of enabling authentication of a user of a client device over a secure communication channel based on biometric data
CN110268407B (zh) 指纹的两步中央匹配
CN106156573A (zh) 一种控制智能终端的方法及控制智能终端的装置
WO2017071498A1 (zh) 一种身份验证方法和装置
KR101814078B1 (ko) 본인 부인 방지 인증 서비스 제공 방법, 인증 서비스 장치 및 인증 어플리케이션이 탑재된 사용자 모바일 단말기
US11165772B2 (en) Methods and devices of enabling authentication of a user of a client device over a secure communication channel based on biometric data
TWM599939U (zh) 身分驗證系統
HK40010667A (zh) 用於操作物联网设备的方法和系统
TW202134915A (zh) 身分驗證方法以及使用其之系統
WO2018006350A1 (zh) 一种基于图片密码开启智能门禁的方法及系统
HK1263015A1 (zh) 确定验证功能的查询系统和方法
HK1263015B (zh) 确定验证功能的查询系统和方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20772610

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020772610

Country of ref document: EP

Effective date: 20210604

NENP Non-entry into the national phase

Ref country code: DE

WWG Wipo information: grant in national office

Ref document number: 11202105440Q

Country of ref document: SG

WWP Wipo information: published in national office

Ref document number: 11202105440Q

Country of ref document: SG