In-depth application of digital certificate authentication based on SM2 algorithm in tobacco industrial logistics IoT devices

This paper aims to support the strategic vision of "Digital Tobacco" by constructing an IoT device authentication solution tailored for cigarette industrial logistics scenarios that complies with national cryptographic standards. With the advancement of this strategy, China's tobacco industrial logistics has gradually evolved into an integrated intelligent architecture centered on "perception–control–management–collaboration." According to the China Tobacco Industry Informatization Development Report (2024), the IoT deployment density in major tobacco enterprises has reached 120 units per 10,000 square meters, covering over 15 types of equipment including AGVs, RFID readers, and temperature and humidity sensors, achieving end-to-end data transparency from raw material storage and in-factory transportation to finished product delivery. However, the large-scale adoption of IoT has also revealed significant security challenges. On the one hand, devices have inherent limitations—for example, low-power sensors possess limited computing capability, making it difficult to support complex encryption algorithms; industrial equipment (such as AGVs) is tightly integrated with manufacturing execution systems, and once compromised, can lead to severe operational disruptions. On the other hand, existing authentication methods have notable weaknesses: password-based authentication is vulnerable to weak passwords and leaks; MAC address binding is prone to spoofing. Moreover, the critical nature of logistics data —including inventory records, distribution routes, customer information, and quality-related environmental parameters—further amplifies the potential impact of security incidents. These challenges urgently call for a robust, standards -compliant, and lightweight authentication solution designed for tobacco logistics. This research fills a gap in the application of national cryptographic algorithms in IoT authentication for tobacco logistics. Employing the SM2 elliptic curve cryptography standard certified by the State Cryptography Administration, which provides security strength comparable to 2048-bit RSA using only 256-bit keys while reducing computational overhead by 87.5%, our approach is particularly suitable for resource-constrained hardware environments. Building on the algorithmic efficiency, we further propose an authentication framework that integrates offline verification, adaptive authorization, and context-aware mechanisms. Unlike one-sizefits- all IoT authentication models, our solution supports diverse devices including AGVs, sensors, and handheld terminals, adapting to all operational scenarios in tobacco logistics, thereby establishing a new paradigm for context-aware industrial IoT authentication. The practical contributions of this work include: (1) ensuring end-to-end data integrity through mutual authentication among devices, gateways, and platforms, preventing unauthorized access and counterfeit data transmission that may affect product quality; (2) significantly reducing operational burdens—SM2 certificates remain valid for 1–3 years, decreasing the renewal frequency to one-tenth of that of traditional credential systems; (3) complying with mandatory requirements of the Tobacco Industry Data Security Management Measures, enabling the use of national cryptographic algorithms for authenticating critical devices. Existing research generally suffers from three shortcomings: inability to adapt to low-power, multi-scenario IoT environments; disconnect between authentication and fine-grained permission management; and lack of effective support for offline or intermittently connected edge networks. By constructing an SM2-based scalable certificate authentication infrastructure, we achieve deep integration of cryptographic performance with industrial logistics requirements, thus systematically addressing these issues.