CN103685323A - Method for realizing intelligent home security networking based on intelligent cloud television gateway - Google Patents

Abstract

A smart home security network implementation method based on a smart cloud TV gateway, wherein the smart home internal network refers to the smart cloud TV as the gateway of the user's smart home, interacting with devices inside the home, and being able to control the network formed by the devices inside the home environment, also known as the smart home intranet. Smart cloud TV refers to a device certificate based on the PKI digital certificate system, a safe storage area that can provide safe reading and writing, and a ZigBee wireless communication pendant. . Portable UKey refers to a device with an inter-device communication module and a secure computing module. Smart home devices refer to home devices that integrate ZigBee wireless communication pendants and have functions such as detection, control, and data processing. The ZigBee wireless communication pendant refers to a pluggable module that provides ZigBee communication and secure computing. The invention has the advantages of high security and strong confidentiality, and good versatility and user experience.

Description

A kind of Smart Home safe network implementation method based on intelligent cloud TV gateway

Technical field

The invention belongs to Smart Home internal network security field, be specifically related to a kind of Smart Home safe network implementation method based on intelligent cloud TV gateway.

Background technology

Along with the deep development of Internet of Things, the integration of three networks, cloud computing generation information technology, the intellectuality of terminal equipment, networking become the main trend of electron trade development, are expected to drive the upgrading of conventional industries.Intelligence cloud TV is the fusion of traditional tv and emerging technology, as a kind of safe and reliable information carrier, not only on audio-visual quality, obtain vast improvement and raising, and can allow user live to become more intelligent, therefore, intelligent cloud TV will become the most important part of each family life.Intelligence cloud TV has the features such as intellectuality, platform immobilization and large scale display, can be used as home gateway and the perfect adaptation of Smart Home controllable device of Smart Home, carry out the secure interactive of information with public network, thoroughly realize the intelligent management and control of family, solve user simultaneously service provider is distrusted to problem (being that the intelligent cloud TV gateway that each user meets at oneself to the access control of home intelligent equipment is processed), for user brings high-quality home services, enjoy.Yet, in the face of this emerging intelligent equipment of intelligent cloud TV, relevant research institution and business organization also do not have clear and definite proposition comparatively rationally perfect scheme solve intelligent cloud TV and as wired home, control gateway and realize home equipment access control safely; In simultaneously traditional Smart Home internal network design, the simple Zigbee protocol of general employing carries out group-net communication between home equipment, only adopt this agreement to carry out networking and have safety issue, as user's intelligent home device can be controlled by the home gateway of other families, home gateway networking exists the data message of illegality equipment access, transmission can be obtained by intercepting and capturing etc.In recent years, some enterprises have started exploration and realized home equipment networking under human factor are controlled, and to meet the demand of user to Smart Home fail safe, and obtain certain achievement, but still there is no complete head it off.

Summary of the invention

The technology of the present invention is dealt with problems: overcome the deficiencies in the prior art, a kind of Smart Home safe network implementation method based on intelligent cloud TV gateway be provided, have advantages of safe, confidentiality is strong, and versatility and user experience good.

The technology of the present invention solution: a kind of Smart Home safe network implementation method based on intelligent cloud TV gateway, wherein Smart Home internal network refers to that intelligent cloud TV is as the gateway of user's Smart Home, mutual with the equipment in household internal, and can control the network environment that household internal equipment forms, also referred to as Smart Home Intranet.Intelligence cloud TV refers to the secure storage areas that obtains the device certificate based on PKI digital certificate system and safe read-write can be provided and with ZigBee radio communication suspension member, the uniform outlet as Smart Home to public network communication, also referred to as intelligent cloud TV gateway.Portable UKey refers to a kind of by USB(USB (universal serial bus)) be directly connected, have cryptographic authorization functions, reliable small memory device at a high speed with the Micro-USB mouth of intelligent movable equipment, there is the equipment of equipment room intercommunication module and safety caculation module (as safety chip).Intelligent home device refers to integrated ZigBee radio communication suspension member, has the home equipment of the functions such as detection, control, deal with data.Wherein ZigBee radio communication suspension member refers to the pluggable module that ZigBee communication and safety compute (as safety chip) are provided.

Briefly introduce the basic thought of this programme, the present invention has drawn the advantage of existing solution, and specifically, technical solution of the present invention comprises following several aspect:

Aspect one: in view of user wants oneself home equipment of Remote Visit and Control, be required to be user " key " of opening door is provided, by intelligent cloud TV gateway to UKey initialization, make UKey obtain the digital certificate of the demarcation UKey identity based on PKI certificate system, " key " (safety of signing and issuing of intelligent cloud TV gateway enter license voucher) of opening door and PKI and the sign of intelligent cloud TV gateway, thereby set up the safe and orderly mechanism of permitting the entrance that user accesses oneself Smart Home, become the important safe barrier of Smart Home secure access.

Aspect two: realize the initialization to intelligent home device by obtaining digital certificate UKey, intelligent home device the is obtained credible networking voucher be responsible for signing and issuing by UKey and the PKI that guarantees the intelligent cloud TV gateway of networking information confidentiality, for the fail safe, the reliability that strengthen based on the networking of traditional Z igBee protocol devices, establish solid foundation, guaranteed the legitimacy of networking home equipment.

Aspect three: for fear of the intelligent cloud TV gateway of illegal home equipment access user, steal subscriber household private information, the credible networking voucher that intelligent home device issues by UKey and intelligent cloud TV gateway PKI, realize the mutual trust checking networking with intelligent cloud TV gateway, and consult to obtain the secret key of symmetry of secure communication with intelligent cloud TV gateway, build safety permission mechanism and Intranet house security communication mechanism that intelligent cloud TV gateway is received intelligent home device.

Aspect four: the secret key of communicating by letter of consulting with intelligent home device by intelligent cloud TV gateway, realize both sides' secure communication, prevent that go-between from illegally obtaining family's private data, guarantee confidentiality, the integrality of family data information, further promote the fail safe of the total system of Smart Home.

The present invention compared with prior art, has following remarkable advantage:

User experience is good, versatility, safe, confidentiality is strong.Because the present invention has adopted the Implementation Modes of safe and portable UKey, there is fabulous user-operable, applicable to general intelligent home device; Adopt two-layer voucher technology and symmetrical secret key coded communication technology based on PKI public key cryptography system simultaneously, there is extremely strong confidentiality, the anti-property denied, so user experience is good, versatility, safe, confidentiality is strong.

Accompanying drawing explanation

Fig. 1 the invention process overall framework;

The flow chart of Fig. 2 intelligence cloud TV gateway initialization UKey;

The flow chart of Fig. 3 UKey initialization intelligent home device;

The flow chart of Fig. 4 intelligence cloud TV gateway and intelligent home device mutual trust checking networking;

The flow chart of Fig. 5 intelligence cloud TV gateway and intelligent home device secure communication.

Embodiment

The present invention, by intelligent cloud TV and portable safety UKey equipment, on traditional Z igBee protocol basis, adopts two-layer voucher and symmetrical secret key communication encryption based on PKI public key cryptography system, sets up Smart Home internal network security service mechanism.This programme is by the two-layer voucher technology based on PKI public key cryptography system, realize the secret key of communicating by letter between the identity map binding of user's intelligent home device and oneself intelligent cloud TV gateway and consulting device, the intelligent home device that guarantees user can only, by oneself intelligent cloud TV gateway institute management and control, improve the personal secrets of subscriber household equipment; By symmetrical secret key coded communication information, guarantee to transmit between household equipment confidentiality, the integrality of data simultaneously, promote the coefficient of safety of intelligent domestic system.Its core is to set up the security service mechanism of Smart Home internal network, forms the controlled Smart Home of secure and trusted, promotes the sound development of Smart Home industry.

For making object of the present invention, advantage and technical scheme clearer, by following concrete, implement, and by reference to the accompanying drawings 1, the present invention is described in more detail.

The General Implementing framework of this scheme has been described on the whole for Fig. 1, in short, the one, it is a kind of by USB(USB (universal serial bus) that user uses UKey(UKey of the present invention to refer to first) be directly connected, have the memory device of cryptographic authorization functions with the Micro-USB mouth of intelligent movable equipment) time, UKey need be inserted on the ZigBee radio communication suspension member interface of intelligent cloud TV gateway TV, by the curing Smart Home App client certificate Cert of UKey _app, the legal credibility of the upper prepackage of checking TV App.After if App checking is credible, App starts PIN(full name Personal Identification Number, is called for short PIN, is exactly the individual recognition code of UKey) interface is set, user successfully arranges after the PIN code of UKey, and public private key pair, TV that UKey generates self sign and issue the security credence Ticket that enters _uKey, TV generates the secret key K of outer Network Communication _outNet, TV PKI K _{tV (pub)}with sign ID _tV, simultaneously intelligent cloud TV gateway obtains the PKI K of UKey _{uKey (pub)}with sign ID _uKeythereby, complete the initial work to UKey; The 2nd, user uses UKey to insert intelligent home device D, and intelligent home device D can obtain from UKey the PKI K of intelligent cloud TV gateway _{tV (pub)}with sign ID _tVand obtain the credible networking voucher Ticket signed and issued by UKey _dthereby, complete the initial work to intelligent home device; The 3rd, user's intelligent home device D completes after initial work, according to credible networking voucher Ticket _dwith intelligent cloud TV gateway PKI K _{tV (pub)}, independently complete with intelligent cloud TV gateway secure and trusted networking and consult both sides' the secret key of communication encryption

realize the identity map binding of user's intelligent home device and oneself intelligent cloud TV gateway; The 4th, user's intelligence cloud TV gateway is by the secret key of communication encryption

the confidentiality of realization to the security control of intelligent home device and assurance intelligent home device transmission information.Mainly comprise tetrameric content below.

One, the implementation method of intelligent cloud TV gateway initialization UKey

User wants oneself home equipment of Remote Visit and Control, is required to be user " key " of opening door is provided, and the UKey initialization of user being carried by intelligent cloud TV gateway, can make UKey acquisition enter and permit voucher Ticket _uKeyand for the initialization of intelligent home device lays the foundation, below in conjunction with accompanying drawing 2, specifically describe its implementation:

(1) when user uses UKey first, UKey is inserted on the ZigBee radio communication suspension member interface of intelligent cloud TV gateway TV, by the curing Smart Home App client certificate Cert of UKey _app, the legal credibility (this legitimate verification principle is) of the upper prepackage of checking TV App, after App checking is credible, UKey and intelligent cloud TV gateway TV set up safe trusting relationship by App;

(2) UKey and intelligent cloud TV gateway TV successfully set up safe trusting relationship, and the Smart Home App client on TV ejects PIN code interface is set, and user successfully arranges after PIN code, and UKey obtains PIN code by App, and then UKey generates public private key pair K _{uKey (pub)}and K _{uKey (pri)};

(3) UKey is by self identification ID _uKeywith PKI K _{uKey (pub)}send intelligent cloud TV gateway TV to;

(4) intelligent cloud TV gateway TV receives UKey sign ID _uKeywith PKI K _{uKey (pub)}after, rise time stamp TS _tVwith the secret key K of outer Network Communication _outNet, adopt hash algorithm (as SHA1, SHA256) to calculate ID _tV, ID _uKeyand TS _tVcryptographic Hash H=Hash (ID _tV|| ID _uKey|| TS _tV), use intelligent cloud TV gateway TV private key K _{tV (pri)}private key is encrypted cryptographic Hash H, forms intelligent cloud TV gateway TV signature $S_{\mathrm{TV}}=\mathrm{Sign}{\left[\mathrm{Hash}\left({\mathrm{ID}}_{\mathrm{TV}}\right|\left|{\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{TS}}_{\mathrm{TV}}\right)\right]}_{K_{\mathrm{TV}\left(\mathrm{pri}\right)}};$

(5) intelligent cloud TV gateway TV is used its PKI K _{tV (pub)}to UKey sign ID _uKeywith time stamp T S _tVencrypt, form TV and use its K _{tV (pub)}the identification information ciphertext of encrypting

(6) the intelligent cloud TV gateway TV S that will sign _tVwith identification information ciphertext

as the license voucher of entering ${\mathrm{Ticket}}_{\mathrm{UKey}}=\mathrm{Sign}{\left[\mathrm{Hash}\left({\mathrm{ID}}_{\mathrm{TV}}\right|\left|{\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{TS}}_{\mathrm{TV}}\right)\right]}_{K_{\mathrm{TV}\left(\mathrm{pri}\right)}}\left|\right|\mathrm{Enc}{\left[{\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{TS}}_{\mathrm{TV}}\right]}_{K_{\mathrm{TV}\left(\mathrm{pub}\right)}},$ License voucher Ticket will enter _uKey, TV PKI K _{tV (pub)}, the secret key K of outer Network Communication _outNetbe handed down to UKey, simultaneously by the sign ID of UKey _uKeywith PKI K _{tV (pub)}as the important record of UKey, be stored in the secure storage areas of TV;

(7) UKey accepts TV and transmits information, uses and obtains PIN code to its private key K _{uKey (pri)}with the secret key K of outer Network Communication _outNetbe encrypted respectively protection, form private key ciphertext Enc[K _{uKey (pri)}] _pINwith the secret key ciphertext of outer Network Communication Enc[K _outNet] _pIN;

(8) UKey is by self identification ID _uKeywith other hardware informations (as memory block capacity and computing chip sign etc.), generate PIN code and protect secret key K _{uKey (EncPin)}(this secret key dynamic operation in UKey produces and does not preserve, and has strengthened the fail safe of UKey), and by this secret key K _{uKey (EncPin)}encrypt PIN code, form PIN code ciphertext

(9) UKey will enter and permit voucher Ticket _uKey, TV PKI K _{tV (pub)}, PIN code ciphertext

the secret key ciphertext of outer Network Communication Enc[K _outNet] _pIN, self PKI K _{uKey (pub)}with private key ciphertext Enc[K _{uKey (pri)}] _pINas important record storage, the initial work of UKey completes.

The successful realization of this process, sets up the safe and orderly mechanism of permitting the entrance that user accesses oneself Smart Home, becomes the important safe barrier of Smart Home secure access.

Two, the implementation method of UKey initialization intelligent home device

In intelligent home device networking process, to guarantee that intelligent home device D can only be identified by oneself intelligent cloud TV gateway TV of user, to guarantee that this process is safe and reliable simultaneously, here adopt UKey to meet above-mentioned security requirement to the initialization of intelligent home device, UKey after user uses initially inserts intelligent home device D, and intelligent home device D can obtain from UKey the PKI K of intelligent cloud TV _{tV (pub)}with the credible networking voucher Ticket being signed and issued by UKey _d, below in conjunction with accompanying drawing 3, specifically describe its implementation:

(1) user is inserted in the UKey after initial on the ZigBee radio communication suspension member interface of intelligent home device D, after intelligent home device D identification UKey, by the sign ID of himself _dsend UKey to;

(2) UKey receives the sign ID of home equipment D _d, generate random number N _uKey, adopt hash algorithm (as SHA1, SHA256) to calculate ID _d, ID _uKeyand N _uKeycryptographic Hash H=Hash (ID _uKey|| ID _d|| N _uKey);

(3) UKey is by self identification ID _uKeywith other hardware informations (as memory block capacity and computing chip sign etc.), generate PIN code and protect secret key K _{uKey (EncPin)}, and by this secret key K _{uKey (EncPin)}the PIN code ciphertext of deciphering UKey storage $\mathrm{Enc}{\left[\mathrm{PIN}\right]}_{K_{\mathrm{UKey}\left(\mathrm{EncPin}\right)}},$ Obtain PIN code;

(4) UKey is deciphered and is obtained the UKey private key K being protected by PIN code in memory block by PIN code _{uKey (pri)}, and with obtaining private key K _{uKey (pri)}(2) step cryptographic Hash is encrypted, form UKey signature $S_{\mathrm{UKey}}=\mathrm{Sign}{\left[\mathrm{Hash}\left({\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{ID}}_D\right|\left|N_{\mathrm{UKey}}\right)\right]}_{K_{\mathrm{UKey}\left(\mathrm{pri}\right)}};$

(5) UKey is used the PKI K of intelligent cloud TV gateway _{tV (pub)}to device identification ID _dand random number N _uKeyencrypt, form UKey and use K _{tV (pub)}the identification information ciphertext of encrypting

(6) the UKey S that will sign _uKey, identification information ciphertext

with the license voucher Ticket that enters _uKey, as networking voucher ${\mathrm{Ticket}}_D=\mathrm{Sign}{\left[\mathrm{Hash}\left({\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{ID}}_D\right|\left|N_{\mathrm{UKey}}\right)\right]}_{K_{\mathrm{UKey}\left(\mathrm{pri}\right)}}\left|\right|\mathrm{Enc}{\left[{\mathrm{ID}}_D\right|\left|N_{\mathrm{UKey}}\right]}_{K_{\mathrm{TV}\left(\mathrm{pub}\right)}}\left|\right|{\mathrm{Ticket}}_{\mathrm{UKey}}$ Be handed down to intelligent home device D, intelligent home device D is by this credible networking voucher Ticket _dstorage, the initial work of intelligent home device D completes.

The successful realization of this process, has established solid foundation for the fail safe, the reliability that strengthen based on the networking of traditional Z igBee protocol devices, has guaranteed the legitimacy of networking home equipment.

Three, the implementation method of intelligent cloud TV gateway and intelligent home device mutual trust checking networking

After intelligent home device D initialization completes, mainly by obtaining believable networking voucher Ticket _dwith intelligent cloud TV gateway PKI K _{tV (pub)}, independently carry out secure and trusted networking and consult both sides' the secret key of communication encryption with intelligent cloud TV gateway realize the identity map binding of user's intelligent home device and oneself intelligent cloud TV gateway, below in conjunction with accompanying drawing 4, specifically describe its implementation:

(1) after intelligent home device D initialization completes, generate random number N D, use this random number N _dto device identification ID _dwith equipment network voucher Ticket _dencrypt, form networking voucher ciphertext

then use intelligent cloud TV gateway PKI K _{tV (pub)}to N _dencrypt, form random number ciphertext finally using the subsidiary networking voucher ciphertext of random number ciphertext as equipment network broadcast message

zigBee communication module by intelligent home device D is broadcasted;

(2) intelligent cloud TV gateway TV receives after the networking information of intelligent home device D broadcast, uses its private key K _{tV (pri)}decrypted random is counted ciphertext, obtains random number N _d, then use N _ddeciphering networking voucher ciphertext, equipment sign ID _dwith equipment network voucher Ticket _d, finally verify networking voucher Ticket _dlegitimacy, intelligent cloud TV gateway is used UKey PKI K _{uKey (pub)}the signature of checking UKey obtain cryptographic Hash H=Hash (ID _uKey|| ID _d|| N _uKey), and with intelligent cloud TV gateway private key K _{tV (pri)}deciphering is used K by UKey _{tV (pub)}the identification information ciphertext of encrypting

equipment sign ID _drandom number N with UKey generation _uKey, and from its safe storage, obtain UKey sign ID _uKey, adopt identical hash algorithm (as SHA1, SHA256) the calculating ID that signs with UKey _d, N _uKeyand ID _uKeycryptographic Hash H ₁=Hash (ID _uKey|| ID _d|| N _uKey), compare cryptographic Hash H and H ₁whether equate, if both are not identical, show that UKey is undesired, networking voucher Ticket _dillegal, TV stops next step work; If both are identical, show that UKey is normal, TV is used its PKI K _{tV (pub)}certifying signature

obtain cryptographic Hash H=Hash (ID _tV|| ID _uKey|| TS _tV), and with its private key K _{tV (pri)}deciphering is by K _{tV (pub)}the identification information ciphertext of encrypting

obtain UKey sign ID _uKeytime stamp T S with TV generation _tV, adopt identical hash algorithm (as SHA1, SHA256) the calculating ID that signs with TV _tV, ID _uKeyand TS _tVcryptographic Hash H ₁=Hash (ID _tV|| ID _uKey|| TS _tV), compare cryptographic Hash H and H ₁whether equate, if both are not identical, show that TV signature is forged, networking voucher Ticket _dillegal, TV stops next step work; If both are identical, show that TV is normal, networking voucher Ticket _dchecking legitimacy, is presented at equipment D information the networking equipment list of intelligent cloud TV gateway; If other legal intelligent home device D in subscriber household ^.receive after intelligent home device D broadcast message, will, based on Zigbee protocol as routing node, forward this information of broadcast; If illegal intelligent home device D in user's wired home ^*receive after intelligent home device D broadcast message, cannot obtain by N _dthe particular content of enciphered data and initiate man-in-the-middle attack to TV; If intelligent cloud TV gateway requires networking to possess high security and ageing, can control checking networking voucher Ticket _dnumber of times and the time stamp T S of this voucher _tVrealize, i.e. equipment network voucher Ticket _din N _dhave uniqueness, the proving time of the voucher of networking simultaneously can not surpass the certain hour starting from timestamp;

(3) user selects a certain equipment D(in home equipment networking list in intelligent cloud TV gateway TV to operate as added), intelligent cloud TV gateway produces Traffic encryption key(TEK) at random for this equipment D

and by the sign ID of equipment _d, networking voucher Ticket _dand Traffic encryption key(TEK) as an equipment records, be stored in its secure storage areas;

(4) intelligent cloud TV gateway is used (2) step to obtain random number N _d+ 1 couple of device identification ID _dand Traffic encryption key(TEK)

encrypt, form the secret key ciphertext of communication

by this ciphertext attendant equipment sign ID _dby its ZigBee communication module, broadcast;

(5) intelligent home device D receives after TV broadcast data, uses its (1) step to generate random number N _dthe sign ID of the secret key ciphertext of+1 decrypt communication equipment _dwith the secret key of communication encryption

checking receives the consistency of device identification and deciphering equipment sign, if both verify unanimously, by the secret key of communication encryption

networking voucher Ticket _d, intelligent cloud TV gateway PKI K _{tV (pub)}as a record, preserve; If both verify inconsistent, intelligent home device D repeats (1) step, if carry out M(M>=1) inferior, the sign ID of acquisition _dobtain sign ID with deciphering _dstill consistent, quit work.If legal intelligent home device D receives after TV broadcast message in subscriber household, by the wireless network protocol based on ZigBee(low speed short-distance transmission, the low-power consumption of an IEEE802.15.4 standard territory fidonetFido) agreement, as routing node, forwards this information of broadcast; If illegal intelligent home device D in subscriber household ^*receive after TV broadcast message, cannot obtain by N _dthe particular content of enciphered data, initiates man-in-the-middle attack to intelligent home device D.

The successful execution of this process, intelligent home device and intelligent cloud TV gateway complete mutual trust checking networking and consult the secret key of symmetry of both sides' secure communication, build safety permission mechanism and Intranet house security communication mechanism that intelligent cloud TV gateway is received intelligent home device.

Four, the implementation method of intelligent cloud TV gateway and intelligent home device secure communication

Intelligence cloud TV gateway receives after the remote control commands of intelligent home device D, uses the secret key K of outer Network Communication of its storage _outNet(this K _outNetcorresponding one by one with UKey) this equipment control command of deciphering acquisition, then by the secret key of this equipment D communication encryption

complete and intelligent home device between the safe access control of information, below in conjunction with accompanying drawing 5, specifically describe its implementations:

(1) intelligent cloud TV gateway TV receive intelligent home device D remote control commands (this command format:

use UKey sign ID in intelligent cloud TV gateway secure storage areas _uKeythe corresponding secret key K of outer Network Communication _outNetto ciphertext instruction

be decrypted, obtain the sign ID of this equipment _dwith control command cmd;

(2) Intelligent television terminal gateway TV is used Traffic encryption key(TEK) corresponding to home equipment D in its secure storage areas

to device identification ID _dencrypt with control command cmd, forming device D Intranet is encrypted control command the Intranet generating is encrypted to control command attendant equipment sign ID _d, the ZigBee-network module by intelligent cloud TV gateway is by this control information $<<{\mathrm{ID}}_D\left|\right|\mathrm{Enc}{\left[{\mathrm{ID}}_D\right|\left|\mathrm{cmd}\right]}_{K_{D_{\mathrm{InNet}}}}>>$ Broadcast;

(3) intelligent home device D receives after the information of intelligent cloud TV gateway TV broadcast, with the secret key of communication encryption of its storage

to encrypting control command

be decrypted, obtain control command cmd and sign ID _d, checking obtains sign ID _dwhether consistent with self identification, if checking is consistent, home equipment D carries out these data of data data(data after the execution that this control command cmd obtains this order and comprises obtaining information after the exectorial state of home equipment or home equipment fill order, as the humiture value information of Intelligent electric lamp switch state, intelligent temperature and humidity equipment); If verify inconsistently, home equipment D does not do any operation.If legal intelligent home device D receives after TV broadcast message in subscriber household, will, based on Zigbee protocol as routing node, forward this information of broadcast; If illegal intelligent home device D in subscriber household ^*receive after TV broadcast message, cannot obtain the particular content of encrypted instruction and initiate man-in-the-middle attack to D;

(4) intelligent home device D obtains data Data and intelligent home device D sign ID by instruction successful execution _d, with the secret key of intelligent home device D communication encryption

encrypt, form enciphered data d is by subsidiary its sign of enciphered data ID _das return data zigBee communication module by D is broadcasted;

(5) intelligent cloud TV gateway TV receives the return data of D broadcast after, utilize equipment sign ID _dsearch Traffic encryption key(TEK) corresponding to home equipment D in secure storage areas and use decrypt encrypted data

obtain the device identification ID encrypting _dwith executing data data, the sign ID that checking directly obtains _dobtain sign ID with deciphering _dwhether consistent, if checking is consistent, use UKey sign ID in (1) step _uKeythe corresponding secret key K of outer Network Communication _outNetto sign ID _dencrypt with data data, form outer net and encrypt execution result

and outer net is encrypted to the subsidiary UKey sign of execution result ID _uKeyas partial data record

send to remote control terminal; If verify inconsistently, intelligent cloud TV gateway repeats (2) step, if carry out M(M>=1) inferior, the sign ID of acquisition _dobtain sign ID with deciphering _dstill consistent, return to execution unsuccessfully to remote control terminal.If other legal intelligent home device D in subscriber household ^.receive after intelligent home device D broadcast message, by the wireless network protocol based on ZigBee(low speed short-distance transmission, the low-power consumption of an IEEE802.15.4 standard territory fidonetFido) agreement is as routing node, and this information is broadcasted in forwarding; If illegal intelligent home device D in subscriber household ^*receive after intelligent home device D broadcast message, cannot obtain the particular content of encrypted data, to TV, initiate man-in-the-middle attack.

The successful execution of this process, realizes the secure communication of Smart Home Intranet, prevents that go-between from illegally obtaining family's private data and launching a offensive, and guarantees confidentiality, the integrality of family data information, further promotes the fail safe of the total system of Smart Home.

Non-elaborated part of the present invention belongs to techniques well known.

The above; be only part embodiment of the present invention, but protection scope of the present invention is not limited to this, in the technical scope that any those skilled in the art disclose in the present invention; the variation that can expect easily or replacement, within all should being encompassed in protection scope of the present invention.

Claims (6)

1. A method for implementing a smart home security network based on an intelligent cloud TV gateway, characterized in that the steps of implementation are as follows: (1) When the user uses UKey for the first time, the UKey needs to be inserted into the ZigBee wireless communication pendant interface of the smart cloud TV gateway TV, and the smart home App client certificate Cert _App solidified by UKey is used to verify the legitimacy and credibility of the pre-installed App on the TV The UKey refers to a storage device that is directly connected to the Micro-USB port of the mobile smart device through the Universal Serial Bus interface USB and has a password verification function; if the App verification is credible, the App starts the personal identification password PIN of the UKey On the setting interface, after the user successfully sets the PIN code of UKey, UKey generates its own public-private key pair, TV issues the entry security certificate Ticket _UKey , TV generates the external network communication secret key K _OutNet , TV public key K _TV(pub) and TV’s Identify the ID _TV , and at the same time, the smart cloud TV gateway TV obtains the public key K _{UKey (pub)} of UKey and the identification ID _UKey of UKey, thereby completing the initialization of UKey; (2) The user uses the UKey to insert the smart home device D, and the smart home device D obtains the public key K _{TV (pub)} of the smart cloud TV gateway and the ID _TV of the smart cloud TV gateway from the UKey, and obtains the trusted networking issued by the UKey Voucher Ticket _D to complete the initialization of smart home devices; (3) After the user's smart home device D completes the initialization work, according to the trusted networking certificate Ticket _D and the public key K _{TV (pub)} of the smart cloud TV gateway, it independently completes the secure and trusted networking with the smart cloud TV gateway and negotiates with both parties communication encryption key

Realize the identity mapping and binding between the user's smart home device D and his own smart cloud TV gateway TV; (4) The user's smart cloud TV gateway TV encrypts the key through communication

Realize the security control of the smart home device D and ensure the confidentiality of the information transmitted by the smart home device. 2. The smart home security networking implementation method based on the smart cloud TV gateway according to claim 1, characterized in that: the initialization of UKey in the step (1) is specifically implemented as follows: (1) When the user uses UKey for the first time, the UKey should be inserted into the ZigBee wireless communication pendant interface of the smart cloud TV gateway TV, and the smart home App client certificate Cert _App solidified by UKey should be used to verify the legitimacy and credibility of the pre-installed App on the TV After the App is verified and trusted, UKey and the smart cloud TV gateway TV establish a secure trust relationship with the App; (2) UKey has successfully established a secure trust relationship with the smart cloud TV gateway TV, and the smart home App client on the TV pops up the PIN code setting interface. After the user successfully sets the PIN code, UKey obtains the PIN code through the App, and then UKey generates a public-private key pair K _UKey(pub) and K _UKey(pri) ; (3) UKey transmits its own identification ID _UKey and public key K _UKey(pub) to the smart cloud TV gateway TV; (4) After the smart cloud TV gateway TV receives the UKey identification ID _UKey and public key K _{UKey (pub)} , it generates a time stamp TS _TV and an external network communication key K _OutNet , and uses a hash algorithm to calculate ID _TV , ID _UKey and TS Hash value H of _TV = Hash(ID _TV ||ID _UKey ||TS _TV ), use smart cloud TV gateway TV private key K _TV(pri) private key to encrypt hash value H to form smart cloud TV gateway TV signature $S_{\mathrm{TV}}=\mathrm{sign}{\left[\mathrm{Hash}\left({\mathrm{ID}}_{\mathrm{TV}}\right|\left|{\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{TS}}_{\mathrm{TV}}\right)\right]}_{K_{\mathrm{TV}\left(\mathrm{the\; price}\right)}};$ (5) Smart cloud TV gateway TV uses its public key K _TV(pub) to encrypt UKey's identification ID _UKey and time stamp TS _TV to form a ciphertext of identification information encrypted by TV using its K _TV(pub)

(6) Smart cloud TV gateway TV will sign S _TV and identify information ciphertext

as entry permit ${\mathrm{Ticket}}_{\mathrm{UKey}}=\mathrm{sign}{\left[\mathrm{Hash}\left({\mathrm{ID}}_{\mathrm{TV}}\right|\left|{\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{TS}}_{\mathrm{TV}}\right)\right]}_{K_{\mathrm{TV}\left(\mathrm{the\; price}\right)}}\left|\right|\mathrm{Enc}{\left[{\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{TS}}_{\mathrm{TV}}\right]}_{K_{\mathrm{TV}\left(\mathrm{pub}\right)}},$ And send the entry license Ticket _UKey , TV public key K _TV(pub) , and external network communication key K _OutNet to UKey, and at the same time, TV stores UKey's identification ID _UKey and public key K _TV(pub) as important records of UKey in the secure storage area of the TV; (7) UKey accepts the information transmitted by TV, uses the obtained PIN code to encrypt and protect its private key K _UKey(pri) and external network communication key K _OutNet respectively, and forms the private key ciphertext Enc[K _UKey(pri) ] _PIN and External network communication key cipher text Enc[K _OutNet ] _PIN ; (8) UKey generates a PIN code protection key K UKey _(EncPin) through its own identification ID _UKey and other hardware information including storage area capacity and computing chip identification, and encrypts the PIN code through this key K _{UKey (EncPin)} , forming the PIN code ciphertext $\mathrm{Enc}{\left[\mathrm{PIN}\right]}_{K_{\mathrm{UKey}\left(\mathrm{EncPin}\right)}};$ (9) UKey will enter the door permit ticket Ticket _UKey , TV public key K _TV(pub) , PIN code ciphertext

The external network communication secret key ciphertext Enc[K _OutNet ] _PIN , its own public key K _UKey(pub) and private key ciphertext Enc[K _UKey(pri) ] _PIN are stored as important records, and the initialization of UKey is completed. 3. The method for implementing smart home security networking based on smart cloud TV gateway according to claim 1, characterized in that: the initialization of smart home devices in the step (2) is specifically implemented as follows: (1) The user inserts the initial UKey into the ZigBee wireless communication pendant interface of the smart home device D. After the smart home device D recognizes the UKey, it transmits its own identification ID _D to the UKey; (2) UKey receives the ID _D of the home device D, generates a random number N _UKey , and uses a hash algorithm to calculate the hash value of ID _D , ID _UKey and N _UKey H=Hash(ID _UKey ||ID _D ||N _UKey ); (3) UKey generates a PIN code protection key K _{UKey (EncPin)} through its own identification ID _UKey and other hardware information including storage area capacity and computing chip identification, and decrypts UKey through this key K _{UKey (EncPin)} Stored PIN ciphertext $\mathrm{Enc}{\left[\mathrm{PIN}\right]}_{K_{\mathrm{UKey}\left(\mathrm{EncPin}\right)}},$ Obtain a PIN code; (4) UKey decrypts the PIN code to obtain the UKey private key K _UKey(pri) protected by the PIN code in the storage area, and uses the obtained private key K _UKey(pri) to encrypt the hash value of step (2) to form a UKey signature $S_{\mathrm{UKey}}=\mathrm{sign}{\left[\mathrm{Hash}\left({\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{ID}}_{\mathrm{D.}}\right|\left|N_{\mathrm{UKey}}\right)\right]}_{K_{\mathrm{UKey}\left(\mathrm{the\; price}\right)}};$ (5) UKey uses the public key K _TV(pub) of the smart cloud TV gateway to encrypt the device identification ID _D and the random number N _UKey to form the ciphertext of the identification information encrypted by UKey using K _TV(pub)

(6) UKey will sign S _UKey and identify information ciphertext

And the entry permit Ticket _UKey , as the networking certificate ${\mathrm{Ticket}}_{\mathrm{D.}}=\mathrm{sign}{\left[\mathrm{Hash}\left({\mathrm{ID}}_{\mathrm{UKey}}\right|\left|{\mathrm{ID}}_{\mathrm{D.}}\right|\left|N_{\mathrm{UKey}}\right)\right]}_{K_{\mathrm{UKey}\left(\mathrm{the\; price}\right)}}\left|\right|\mathrm{Enc}{\left[{\mathrm{ID}}_{\mathrm{D.}}\right|\left|N_{\mathrm{UKey}}\right]}_{K_{\mathrm{TV}\left(\mathrm{pub}\right)}}\left|\right|{\mathrm{Ticket}}_{\mathrm{UKey}}$ Send it to the smart home device D, and the smart home device D stores the trusted networking certificate Ticket _D , and the initialization of the smart home device D is completed. 4. The smart home security networking implementation method based on the smart cloud TV gateway according to claim 1, characterized in that: the user smart home device in the step (3) is bound with the identity mapping of the home smart cloud TV gateway The specific implementation is as follows: (1) After the initialization of the smart home device D is completed, a random number N _D is generated, and the random number N _D is used to encrypt the device identification ID _D and the device network certificate Ticket _D to form a network certificate ciphertext

Then use the smart cloud TV gateway public key K _{TV (pub)} to encrypt N _D to form random number ciphertext

Finally, the random number ciphertext with the network certificate ciphertext is used as the device network broadcast information Broadcast through the ZigBee communication module of the smart home device D; (2) After the smart cloud TV gateway TV receives the networking information broadcast by the smart home device D, it uses its private key K _TV(pri) to decrypt the random number ciphertext, obtains the random number _ND , and then uses _ND to decrypt the networking certificate The ciphertext, obtain the device identification ID _D and the device network certificate Ticket _D , and finally verify the legitimacy of the network certificate Ticket _D , the smart cloud TV gateway TV uses the UKey public key K _{UKey (pub)} to verify the UKey signature

Obtain the hash value H=Hash(ID _UKey ||ID _D ||N _UKey ), and use the smart cloud TV gateway private key K _TV(pri) to decrypt the ciphertext of the identification information encrypted by UKey using K _TV(pub)

Obtain the random number N _UKey generated by the device identification ID _D and UKey, and obtain the UKey identification ID _UKey from its safe storage, and use the same hash algorithm as the UKey signature to calculate the hash value H ₁ of ID _D , N _UKey and ID _UKey ＝Hash(ID _UKey ||ID _D ||N _UKey ), compare whether the hash value H and H ₁ are equal, if the two are not the same, it indicates that the UKey is abnormal, the network certificate Ticket _D is invalid, and the TV stops the next step If the two are the same, it means that the UKey is normal, and the smart cloud TV gateway TV uses its public key K _{TV (pub)} to verify the signature

Obtain the hash value H=Hash(ID _TV ||ID _UKey ||TS _TV ), and use its private key K _TV(pri) to decrypt the ciphertext of the identification information encrypted by K _TV(pub)

Obtain the UKey identification ID _UKey and the timestamp TS _TV generated by TV, and use the same hash algorithm as the TV signature to calculate the hash value H 1 of ID _TV , ID _UKey and TS _TV H ₁ =Hash(ID _TV ||ID _UKey ||TS _TV ), compare whether the hash values H and H ₁ are equal, if the two are not the same, it indicates that the TV signature is forged, the networking certificate Ticket _D is invalid, and the TV stops the next work; if the two are the same, it indicates that the TV Normal, if the validity of the networking certificate Ticket _D is verified, the information of the smart home device D will be displayed in the network device list of the smart cloud TV gateway; if other legal smart home devices ^D in the user's home receive the broadcast information of the smart home device D Afterwards, it will forward and broadcast the information based on the ZigBee protocol as a routing node; if the illegal smart home device D ^× in the user’s home receives the broadcast information of the smart home device D, it will not be able to obtain the specific content of the _ND encrypted data and send the TV Initiate a man-in-the-middle attack; if the smart cloud TV gateway requires high security and timeliness in networking, you can control the number of times to verify the network certificate Ticket _D and the time stamp TS _TV of the certificate to achieve it, that is, the device network certificate Ticket _D The _ND is unique, and the verification time of the networking certificate cannot exceed a certain time from the timestamp; (3) The user selects a smart home device D in the home device networking list in the smart cloud TV gateway TV, and the smart cloud TV gateway randomly generates a communication encryption key for the smart home device D

And the identification ID _D of the device, the network certificate Ticket _D and the communication encryption key

Save as a device record in the TV security storage area of the smart cloud TV gateway; (4) The smart cloud TV gateway uses the step (2) to obtain the random number N _D + 1 pair of device identification ID _D and communication encryption key

Encrypt to form communication key ciphertext Broadcast the ciphertext with the device identification ID _D through its ZigBee communication module; (5) After the smart home device D receives the TV broadcast data, use the step (1) to generate a random number _ND + 1 to decrypt the communication key ciphertext to obtain the device's identification ID _D and communication encryption key

Verify the consistency of the device ID received and decrypted to obtain the device ID. If the two verifications are consistent, the communication encryption key will be

The network certificate Ticket _D and the smart cloud TV gateway public key K _TV(pub) are saved as a record; if the two verifications are inconsistent, the smart home device D repeats the step (1). If it is executed M (M≥1) times, If the obtained identification ID _D and the decrypted identification ID _D are still consistent, stop working; if the legal smart home device D in the user's home receives the TV broadcast information, it will forward and broadcast the information based on the ZigBee protocol as a routing node; if After receiving the TV broadcast information, the illegal smart home device D ^× in the user's home cannot obtain the specific content of the encrypted data by _ND , so it launches a man-in-the-middle attack on the smart home device D. 5. The method for implementing smart home security networking based on smart cloud TV gateway according to claim 1, characterized in that: the specific implementation in the step (4) is as follows: (1) The smart cloud TV gateway TV receives the remote control command from the smart home device D. The format of the command is:

Use the external network communication key K _OutNet corresponding to the UKey ID _UKey in the secure storage area of the smart cloud TV gateway to pair the ciphertext instructions Decrypt to obtain the ID _D and control command cmd of the smart home device; (2) Smart TV terminal gateway TV uses the communication encryption key corresponding to smart home device D in its safe storage area

Encrypt the device identification ID _D and the control command cmd to form a smart home device D intranet encrypted control command

The generated internal network encryption control command is attached with the device identification ID _D , and the control information is transmitted through the ZigBee network module of the smart cloud TV gateway.

to broadcast; (3) After the smart home device D receives the information broadcast by the smart cloud TV gateway TV, it uses its stored communication encryption key Encryption Control Instructions

Decrypt to obtain the control command cmd and identification ID _D , and verify whether the obtained identification ID _D is consistent with its own identification. If the verification is consistent, the smart home device D executes the control command cmd to obtain the data data after the execution of the command. The data data Contains the status of home devices executing commands or information obtained after home devices execute commands, including smart light switch status, temperature and humidity value information of smart temperature and humidity devices; if the verification is inconsistent, smart home device D will not do anything; if the user's home After the legitimate smart home device D receives the TV broadcast information, it will act as a routing node based on the ZigBee protocol to forward and broadcast the information; if the illegal smart home device D ^× in the user's home receives the TV broadcast information, it cannot obtain the encrypted command specific content, launch a man-in-the-middle attack on the smart home device D; (4) The smart home device D successfully executes the command to obtain the data Data and the smart home device D identification ID _D , and uses the smart home device D communication encryption key encryption, forming encrypted data Smart home device D returns encrypted data with its ID _D as return data

Broadcast through the ZigBee communication module of D; (5) The smart cloud TV gateway TV receives the return data broadcast by the smart home device D

After that, use the obtained device identification ID _D to find the communication encryption key corresponding to the smart home device D in the secure storage area

and use

decrypt encrypted data

Obtain the encrypted device identification ID _D and execution data data, and verify whether the directly obtained identification ID _D and the decrypted identification ID _D are consistent. If the verification is consistent, use the external network communication key corresponding to the UKey identification ID _UKey in step (1) K _OutNet encrypts the identification ID _D and data data to form the execution result of external network encryption

And the execution result of external network encryption is attached with UKey ID _UKey as a complete data record Send it to the remote control terminal; if the verification is inconsistent, the smart cloud TV gateway repeats the step (2). If it is executed M (M≥1) times, the obtained ID _D and the decrypted ID _D are still consistent, and the execution failure will be returned to the remote control terminal; if other legitimate smart home devices ^D in the user’s home receive the broadcast information of the smart home device D, they will be based on the ZigBee protocol as a routing node and forward and broadcast the information; if illegal smart home devices in the user’s home After D ^× receives the broadcast information of the smart home device D, it cannot obtain the specific content of the encrypted data to launch a man-in-the-middle attack on the TV. 6. The smart home security networking implementation method based on the smart cloud TV gateway according to claim 2, characterized in that: the generated PIN code protection key K _{UKey (EncPin)} in the step (2) is in the UKey The dynamic operation is generated without saving, which enhances the security of UKey.

Images