CN105516980B - A kind of wireless sensor network token authentication method based on Restful frameworks - Google Patents

Abstract

The invention discloses a token authentication method for a wireless sensor network based on a Restful architecture. Sensor nodes and aggregation nodes are self-organized into a network, the aggregation nodes are connected to a Web server based on a Restful architecture, and a challenge is adopted between the aggregation node and the Web server. Response authentication, SSL authentication is used between the Web server and the client, and token authentication is used between the client and the aggregation node. The above three authentications are two-way authentication, and the user accesses the Web server through the client to obtain the data of the wireless sensor node. . The invention can effectively prevent malicious attackers from destroying data and ensure the safety of data in the wireless sensor network.

Description

A Token Authentication Method for Wireless Sensor Networks Based on Restful Architecture

technical field

The invention relates to the technical field of computer networks, in particular to a token authentication method for a wireless sensor network based on a Restful framework.

Background technique

A wireless sensor network (Wireless Sensor Networks, WSN) is a wireless network composed of a group of micro sensor nodes in a self-organizing manner. observer. Each sensor in the wireless sensor network has one or more nodes, and the sensor node is usually a miniature embedded system. Each node monitors its own perception range objects, monitors specific behaviors, uses nodes to collect data, and transmits the collected data to the nearest aggregation node, and then enters the aggregation stage to analyze and analyze the data collected from close nodes. Processing, and then sending the results as needed to the base station, which transmits the final result to the observer.

Due to the poor configuration environment of sensor networks and the inherent vulnerability of wireless networks, they are extremely vulnerable to various attacks. In order to ensure the safe transmission of information, there needs to be a mechanism to verify the legitimacy of the identities of the communicating parties. In the traditional wired network, public key infrastructure effectively solves this problem. It provides comprehensive public key encryption and digital signature services through the use and management of digital certificates. Through the public key infrastructure, the public key can be bound to the identity of the legal owner, thereby establishing and maintaining a trusted network environment. However, asymmetric encryption requires high computation, communication and storage overhead, which makes it infeasible to use digital signature and public key certificate mechanisms on resource-constrained sensors. In order to ensure the safe transmission of information, there needs to be a mechanism to verify the legitimacy of the identities of the communicating parties, and a set of reasonable sensor network identity authentication schemes must be established that comprehensively consider security, efficiency, and performance.

Contents of the invention

The purpose of the present invention is to provide a token authentication method for a wireless sensor network based on a Restful architecture, which can effectively prevent malicious attackers from destroying data and ensure the security of data in a wireless sensor network.

The technical scheme adopted by the present invention is: a wireless sensor network token authentication method based on Restful architecture, which self-organizes sensor nodes and aggregation nodes into a network, connects the aggregation nodes to a Web server based on Restful architecture, and connects the aggregation nodes to the Web server. Challenge-response authentication is used between the Web server and client, SSL authentication is used between the Web server and the client, and token authentication is used between the client and the aggregation node. The above three types of authentication are two-way authentication. data from sensor nodes.

The challenge response authentication between the described aggregation node and the web server comprises the following steps:

A sink node initiates an identity registration request to the web server and enters step B;

B The Web server assigns an ID to the sink node, saves the ID information of the sink node and the authentication key negotiated with the sink node locally, and sends the ID to the sink node, and enters step C;

C The sink node receives the ID information, sends an authentication request containing the sink node ID information to the Web server, and enters step D;

D The web server inquires locally whether the received ID exists, if it exists, generates the first random number and sends it to the sink node, and at the same time sends a set of function algorithm tables to the sink node, and enters step E; if it does not exist, enters step H ;

E The sink node uses the authentication key to encrypt the first random number, and uses an algorithm in the function algorithm table to re-encrypt the encrypted first random number, and the sink node will re-encrypt the first random number and the selected The encryption algorithm is sent to the web server and enters step F;

F The Web server uses the authentication key to encrypt the first random number, uses the encryption algorithm sent by the sink node to re-encrypt the encrypted first random number, and judges the encrypted result and the re-encrypted first random number sent by the sink node Whether they are consistent, if they are consistent, pass the verification and go to step G, otherwise, fail the verification and go to step H;

G Web server negotiates with the aggregation node to obtain the session key;

The H Web server refuses to receive data from the sink node.

In the step B and step G, the Web server and the aggregation node use the DH algorithm to generate the authentication key and the session key respectively.

The function algorithm table in the step D is a one-way Hash function algorithm table.

The token authentication between the client and the Web server includes successively identity authentication between the client and the Web server and identity registration between the client and the Web server;

The identity authentication between the client and the web server includes the following steps in turn:

A1. The client initiates a connection request to the web server, and receives the first CA certificate returned by the web server and information related to the first CA certificate;

B1. The client verifies the legitimacy of the identity of the Web server, and saves the public key of the Web server;

C1. The client sends the second CA certificate to the Web server;

D1. The web server verifies the legitimacy of the client's identity and saves the client's public key;

E1. The client sends the communication symmetric encryption scheme supported by itself to the Web server;

F1. The web server selects a cipher scheme from the received communication symmetric cipher schemes, and encrypts the cipher scheme with the client's public key and sends it to the client;

G1. The client decrypts the received encrypted password scheme, obtains the password scheme selected by the Web server, determines the call key, and sends the call key to the Web server after encrypting it with the public key of the Web server;

H1. The web server receives the encrypted call key, decrypts it, and obtains the call key;

The identity registration between the client and the web server includes the following steps in turn:

A2. The client initiates a registration request to the Web server, and sends the registration information to the Web server through the SSL secure channel;

B2. When the client logs in for the first time, the web server directs the user to the authorization page, and the user defines the access rights of personal data, and sends it to the web server through the SSL secure channel;

C2. The web server stores the user authorization status in the access control list, generates a temporary token according to the user name, password and current time of the user, and sends the temporary token to the client;

D2. The client uses the temporary token to send a data operation request to the Web server;

E2. The web server judges whether the temporary token is invalid. If it is invalid, the client is required to log in again and generate a new temporary token and send it to the client as a certificate; if the token is not invalid, it responds to the client's request.

In step C2, if the user has a private sink node, the web server will also send the generated temporary token to the sink node.

During the token authentication process between the client and the sink node, the user obtains a unique identification number when purchasing a private sink node, and the Web server binds the ID of the sink node to the identification number.

The token authentication process between the client and the sink node includes the following steps in turn:

A3. The client initiates a registration request to the web server, and fills in the ID and identification number of the private aggregation node;

B3. The web server receives the registration information of the client, and if it finds that the ID of the sink node matches the identification number, it recognizes that the sink node is the private sink node of the user, and when the temporary token is generated after the client logs in, the temporary token will be While sending to the client, it is also sent to the user's private sink node;

C3. The user's private sink node receives the temporary token, and the client connects to the private sink node through the temporary token.

The present invention self-organizes sensor nodes and convergence nodes into a network, connects the convergence nodes to a Web server based on the Restful architecture, adopts challenge response authentication between the convergence node and the Web server, adopts SSL authentication between the Web server and the client, and adopts SSL authentication between the client and the client. Token authentication is adopted between the aggregation node, the above three authentications are two-way authentication, the user accesses the Web server through the client to obtain the data of the wireless sensor node, the wireless sensor network token authentication based on the Restful architecture of the present invention The method can effectively prevent malicious attackers from destroying data and ensure the security of data in wireless sensor networks.

Description of drawings

Fig. 1 is a wireless sensor network topology diagram based on the Restful architecture of the present invention;

Fig. 2 is the challenge response authentication flow chart between aggregation node and Web server among the present invention;

Fig. 3 is the flow chart of identity authentication between the client and the Web server in the present invention;

Fig. 4 is the flow chart of identity registration between the client and the Web server in the present invention;

Fig. 5 is the token authentication process between the client and the sink node in the present invention.

Detailed ways

A kind of wireless sensor network token authentication method based on the Restful architecture described in the present invention, the sensor node sensor and the sink node of the sink node are self-organized into a network, the sink node of the sink node is connected to the Web server based on the Restful architecture, and the sink node of the sink node Challenge response authentication is adopted between the node and the web server, SSL authentication is adopted between the web server and the client user, and token authentication is adopted between the client user and the sink node of the sink node. Access the Web server through the client user to obtain the data of the wireless sensor node sensor.

The full name of REST is Representational State Transfer, which refers to a set of architectural constraints and principles. If an architecture conforms to the constraints and principles of REST, it is called a Restful architecture. Currently HTTP is the only REST related instance.

Restful architecture follows the principle of stateless communication. The principle of stateless communication refers to the fact that each request is stateless during the interaction process between the client user and the web server. REST requires that the state is either put into the resource state or saved on the client user, that is, the web server cannot maintain any communication state with the client user it communicates with except for a single request. This kind of communication state makes the available space of the web server scalable. If the web server needs to maintain the client user state, a large number of client user interactions will seriously affect the available memory space (footprint) of the web server. To achieve stateless communication, authentication requests based on the Restful architecture should not depend on cookies or sessions, and each request should carry some type of authentication credentials.

Figure 1 is a topology diagram of a wireless sensor network based on the Restful architecture. A sink node of a sink node is connected to several sensor nodes. The data of the sensor and the connection with the external network can be regarded as a gateway node. A Web server can be connected to a large number of sink nodes, and the Web server is used to store the measurement data sent by the sink node. Users can log in to the Web server through the client user of the web page, and send data operation requests through the browser to complete the task. Or view collected data saved in the web server. If the user has a private sink node, the client user can directly establish a connection with the sink node without viewing or manipulating data through the web server.

Figure 2 is a challenge response authentication flowchart between the sink node and the Web server, including the following steps:

S101: the sink node of the sink node initiates an identity registration request to the web server;

When the sink node connects to the sensor network for the first time, it initiates an identity authentication request to the Web server, that is, performs identity registration.

S102: The web server assigns an ID to the sink node of the sink node, locally saves the ID information of the sink node of the sink node and the authentication key negotiated with the sink node of the sink node, and sends the ID to the sink node of the sink node;

In this embodiment, when the sink node of the sink node performs identity registration, the Web server assigns an ID to the sink node of the sink node, and saves the ID information of the sink node of the sink node locally. Authentication key.

S103: The sink node of the sink node receives the ID information, and sends an authentication request including the ID information of the sink node of the sink node to the Web server;

The sink node of the sink node receives the ID information, and initiates an authentication request to the server when reconnecting, and the authentication request includes the sink node's ID.

S104: The Web server inquires locally whether the received ID exists, and if it exists, generates a first random number and sends it to the sink node, and sends a set of function algorithm tables to the sink node at the same time; if it does not exist, the Web server Refuse to receive data from the sink node of the sink node;

In this embodiment, the Web server inquires from the local database whether the ID of the sink node received exists, and if it exists, a random number is generated internally to return to the sink node of the sink node, and a group of sink nodes of the sink node is returned at the same time One-way Hash function algorithm table, one-way Hash function algorithm table includes MD5, SHA and HMAC, etc.

S105: The sink node of the sink node encrypts the first random number with the authentication key, and re-encrypts the encrypted first random number with an algorithm in the function algorithm table, and the sink node of the sink node encrypts the first random number after re-encryption. The random number and the selected encryption algorithm are sent to the Web server;

In this embodiment, the sink node performs an XOR operation on the received first random number and the authentication key generated during registration, and selects an algorithm in the one-way Hash function algorithm table to process the XORed string Then generate a character string as a response, and send the character string and the selected encryption algorithm to the Web server.

S106: The web server uses the authentication key to encrypt the first random number, uses the encryption algorithm sent by the sink node to re-encrypt the encrypted first random number, and judges that the encrypted result is consistent with the re-encrypted number sent by the sink node. Whether the first random number is consistent, if consistent, the verification is passed; otherwise, the verification fails, and the Web server refuses to receive the data of the sink node;

In this embodiment, the Web server performs an XOR operation on the first random number and the authentication key, and uses the received one-way Hash function algorithm returned by the sink node for processing, and compares the calculation result with the one-way Hash function algorithm returned by the sink node of the sink node. Strings are compared, if the two are the same, the authentication is passed; otherwise, the authentication fails, and the Web server refuses to receive the data of the sink node.

S107: The web server negotiates with the sink node to obtain a session key;

In this embodiment, after passing the authentication, the Web server and the sink node use the DH algorithm to generate a session key, and the subsequent connection uses the session key as an encryption key to meet data confidentiality security requirements.

The token authentication between the client user and the Web server includes the identity authentication between the client user and the Web server and the identity registration between the client user and the Web server;

Figure 3 is a flowchart of the authentication process between the client user and the Web server, which includes the following steps in turn:

S201: The client user initiates a connection request to the web server, and receives the first CA certificate and information related to the first CA certificate returned by the web server;

S202: The client user verifies the legitimacy of the identity of the web server, and saves the public key of the web server;

In this embodiment, the client user verifies whether the first CA certificate sent by the web server is issued by a trusted CA center. If not, the client user will give the user a warning message, warning the user that the first CA certificate is untrustworthy, and asking the user whether to continue accessing. If so, the client user compares the information in the first CA certificate, such as whether the domain name and public key are consistent with the relevant information sent by the web server. If they are consistent, the client browser recognizes the legal identity of the web server and saves the public key of the web server. key.

S203: the client user sends the second CA certificate to the web server;

S204: The web server verifies the legitimacy of the identity of the client user, and saves the public key of the client user;

The web server verifies the second CA certificate of the client user, and rejects the connection if it fails the verification; if it passes the verification, the web server obtains the public key of the client user.

S205: the client user sends the communication symmetric encryption scheme supported by itself to the web server;

S206: The web server selects a cryptographic scheme from the received communication symmetric cryptographic schemes, encrypts the cryptographic scheme with the public key of the client user, and sends it to the client user;

S207: The client user decrypts the received encrypted password scheme, obtains the password scheme selected by the Web server, determines the call key, and encrypts the call key with the public key of the Web server before sending it to the Web server;

S208: The web server receives the encrypted call key, decrypts it, and obtains the call key;

Figure 4 is a flow chart of the registration process between the client user and the Web server, which includes the following steps in turn:

S301: the client user initiates a registration request to the web server, and sends the registration information to the web server through the SSL secure channel;

In this embodiment, the user initiates a registration request to the Web server at the client user, and fills in relevant information, such as user name, password, etc.; if the user has a private sink node, the relevant information needs to be filled in, which involves the sink node and The authentication of the client user will be explained in detail later in the authentication process between the sink node and the client user. The user's information is sent to the Web server through the SSL secure channel. The web server saves user registration information, and the user name of the user must not be repeated during registration.

S302: When the client user logs in for the first time, the web server directs the user to an authorization page, and the user defines the access rights of personal data, and sends it to the web server through the SSL secure channel;

When the client user logs in for the first time, if the login password is correct, the web server will direct the user to the authorization page, and the user can customize the access rights of personal data, such as only the individual can see or all can be seen, and the defined access rights will be sent through the SSL secure channel. to the web server;

S303: The web server stores the user authorization status in the access control list, generates a temporary token token based on the user name, password, and current time, and sends the temporary token token to the client user. If the user has a private sink node node, the web server will also generate a temporary token Token and send it to the sink node;

The access control list is a list specially used to store access rights. If user A wants to access the node data of data user B, he needs to send an access application to the web server. After receiving the access application, the web server first checks the access control list. If the access permission of user B in the list is set to personal visibility, the web server returns a message that user A has no access permission; if the access permission of user B is set to all visibility, the web server returns the data that user A wants to view. If user A does not have the right to access user B's data, he can further apply for access. The web server initiates an application to user B and waits for user B's response. If user B agrees to access, user A can continue to view user B's data. The access control list structure is as follows:

The temporary token Token consists of user name, password and the current system time as elements, the web server generates the temporary token Token, and the web server sends the generated temporary token Token to the client user.

S304: the client user uses the temporary token Token to send a data operation request to the web server;

The client user does not need to log in every time the connection is made, and the temporary token Token can be used for data interaction with the Web server.

S305: The web server judges whether the temporary token Token is invalid. If it is invalid, the client user is required to log in again and generate a new temporary token Token and send it to the client user as a credential; if the token is not invalid, respond to the client user's request ask.

The web server judges whether the user name and password in the temporary token Token are correct, and obtains the generation time of the temporary token Token, and compares it with the current time to determine whether the temporary token Token is invalid. If it is invalid, the client user is required to log in again and Generate a new temporary token Token and send it to the client user as a credential; if the token is not invalid, respond to the request of the client user.

Existing token authentication usually adopts dynamic password technology. The dynamic password technology is an improvement to the traditional static password technology. The user needs to have some credentials, such as the temporary token Token issued by the system, and the number on the temporary token Token is constantly changing, and it is synchronized with the authenticated Web server , so the password for the user to log in to the system is also constantly changing, which is the so-called "one-time pad".

There are two synchronization schemes in the existing dynamic password technology: time synchronization and event synchronization.

1. Time synchronization means that the temporary token Token uses time as a seed of the dynamic password, and the Web server verifies the password generated by the temporary token Token by using the time as a seed.

2. Event synchronization means that the current count is used as a seed each time a dynamic password is generated by the temporary token Token. After each generation of a dynamic password is completed, the count is automatically incremented, and the web server also uses the count as a seed for verification.

The temporary token Token does not have any data communication with the outside world, and the web server also saves the same seed in the temporary token Token, adopts the same encryption algorithm as in the temporary token Token, obtains the same encrypted data, and then obtains the same random The password is verified. The random password of the temporary token Token must be bound with the customer's account to determine whether the password matches. When the web server performs authentication, the same password can only be verified once.

The core of token authentication lies in the algorithm, which is relatively flexible to use and does not need to memorize passwords. The two-factor authentication mechanism can play the role of double insurance, which is simple and easy; token authentication is a new development direction of identity authentication mechanism, which provides The higher security of static passwords is an important identity authentication technology that adapts to the characteristics of current information security development.

During the token authentication process between the client user and the sink node, the user obtains a unique identification number when purchasing a private sink node, and the web server binds the sink node ID with this identification number .

Figure 5 shows the token authentication process between the client user and the sink node, including the following steps:

S401: The client user initiates a registration request to the web server, and fills in the ID and identification number of the private sink node;

S402: The web server receives the registration information of the client user, and if it finds that the ID of the sink node matches the identification number, it recognizes that the sink node is the private sink node of the user, and generates it after the client user logs in. When sending the temporary token Token, while sending the temporary token Token to the client user, it is also sent to the user’s private sink node;

S403: The private sink node of the user receives the temporary token Token, and the client user connects with the private sink node through the temporary token Token.

So far, the multi-party authentication in the wireless sensor network is completed, which can ensure the data security of all parties in the entire communication system.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and equivalent technologies thereof, the present invention also intends to include these modifications and variations.

Claims (5)

1. a kind of wireless sensor network token authentication method based on Restful frameworks, it is characterised in that：By sensor node It is organized themselves into as network with aggregation node, aggregation node is connected to the Web server based on Restful frameworks, aggregation node Challenge responses certification is used between Web server, and SSL certifications, client and convergence are used between Web server and client It is two-way authentication that token authentication, three of the above certification are used between node, and user accesses Web server by client and obtains The data of wireless sensor node；

Wherein, the challenge responses certification between the aggregation node and Web server, includes the following steps：

Step A：Aggregation node initiates identity registration request to Web server, enters step B；

The step B：Web server is that aggregation node distributes ID, is saved in the id information for locally preserving aggregation node and with convergence Point negotiates obtained authentication key, and this ID is sent to aggregation node, enters step C；

The step C：Aggregation node receives id information, and the certification request for including aggregation node id information is sent to Web server, Enter step D；

The step D：The ID that Web server is received in local search whether there is, and if it exists, then generate the first random number simultaneously It is sent to aggregation node, while being sent to one group of function algorithm table of aggregation node, enters step E；If being not present, H is entered step；

The step E：Aggregation node is encrypted using the first random number of authentication key pair, and using one in function algorithm table Kind of algorithm re-encrypts encrypted first random number, aggregation node will re-encrypt after the first random number and it is selected plus Close algorithm is sent to Web server, enters step F；

The step F：Web server is encrypted using the first random number of authentication key pair, is added using what aggregation node was sent First after close algorithm re-encrypts encrypted first random number, and judge that encrypted result and aggregation node send re-encrypt Whether random number is consistent, if unanimously, by verification, entering step G, otherwise, verification does not pass through, and enters step H；

The step G：Web server is negotiated to obtain session key with aggregation node；

The step H：Web server rejects the data of aggregation node；

Wherein, the SSL certifications between the client and Web server include between client and Web server successively Identity registration between authentication and client and Web server；

Authentication between client and Web server, includes the following steps successively：

A1, client initiate the connection request to Web server, and receive the first CA certificate of Web server return and with the The relevant information of one CA certificate；

The legitimacy of B1, client validation Web server identity, and preserve the public key of Web server；

C1, client send the second CA certificate to Web server；

The legitimacy of D1, Web server verification client identity, and preserve the public key of client；

The communication symmetric cryptography scheme that itself is supported is sent to Web server by E1, client；

F1, Web server select a kind of cryptography scheme from the communication symmetric cryptography scheme received, and this cryptography scheme are adopted With being sent to client after the public key encryption of client；

G1, client decrypt the encrypted cryptography scheme received, obtain the cryptography scheme of Web server selection, determine Converse key, and will converse key using Web server public key encryption after be sent to Web server；

H1, Web server receive encrypted call key, are decrypted, and obtain call key；

Wherein, the identity registration between client and Web server, includes the following steps successively：

A2, client initiate registration request to Web server, and log-on message are issued Web service by SSL safe lanes Device；

When B2, client log in for the first time, Web server is by user guiding mandate page, the access of User Defined personal data Permission, and Web server is issued by SSL safe lanes；

C2, Web server by user's authorization conditions be stored in accesses control list, according to the user name of user, password and it is current when Between generate interim token, and interim token is sent to client；

D2, client send out data operation request using interim token to Web server；

E2, Web server judge whether interim token fails, if failure requirement client re-starts register and generates new Interim token be sent to client as voucher；If token does not fail, the request of client is responded；

Token authentication process between the client and aggregation node, includes the following steps successively：

A3, client initiate registration request to Web server, fill in the ID and identifier number of private aggregation node；

B3, Web server receive the log-on message of client, if finding, the ID of aggregation node is matched with identifier number, is recognized The private aggregation node of this aggregation node user thus, and when generating interim token after client logs in, interim token is sent out The private aggregation node of user is sent to while giving client；

C3, user private aggregation node receive interim token, client passes through interim token and is carried out with private aggregation node Connection.

2. the wireless sensor network token authentication method according to claim 1 based on Restful frameworks, feature exist In：In the step B and step G, Web server generates certification secret key respectively using DH algorithms with aggregation node and session is close Key.

3. the wireless sensor network token authentication method according to claim 1 based on Restful frameworks, feature exist In：Function algorithm table in the step D is One-way Hash Function Algorithm table.

4. the wireless sensor network token authentication method according to claim 1 based on Restful frameworks, feature exist In：In the step C2, if user possesses private aggregation node, the interim token of generation is also sent to convergence by Web server Node.

5. the wireless sensor network token authentication method according to claim 1 based on Restful frameworks, feature exist During the token authentication between client and aggregation node, user obtains one uniquely in the private aggregation node of purchase Identifier number, Web server bind the ID of this aggregation node and this identifier number.