CN118632248A - Device authentication method, device, electronic device, storage medium and program product - Google Patents

Abstract

The application discloses a device authentication method, a device, electronic equipment, a storage medium and a program product, which relate to the technical field of communication and are used for improving the authentication accuracy of terminal equipment. The method comprises the following steps: acquiring an identifier of the terminal equipment, wherein the identifier comprises a fingerprint characteristic value of the terminal equipment; generating a target signature private key based on the identification; the target signature private key corresponds to the target signature public key; generating a target digital signature based on the target signature private key; the target digital signature is used for authenticating the identity of the terminal equipment; the identity and the target digital signature are transmitted to the identity authentication device such that the identity authentication device generates a target signature public key based on the identity and verifies the target digital signature based on the target signature public key. The method and the device are applied to the scene of authenticating the terminal equipment.

Description

Device authentication method, device, electronic device, storage medium and program product

Technical Field

The present application relates to the field of communication technology, and in particular to a device authentication method, apparatus, electronic device, storage medium and program product.

Background Art

Currently, when authenticating the identity of a terminal device, the identity of the terminal device can be verified by comparing the identity information (eg, media access control (MAC) address) sent by the terminal device with the identity information registered when the terminal device is registered.

However, when the identity of the terminal device is authenticated by comparing the identity information of the terminal device, the identity information of the terminal device can be easily forged, resulting in low accuracy of terminal device authentication.

Summary of the invention

The present application provides a device authentication method, apparatus, electronic device, storage medium and program product, which are used to solve the technical problem that when authenticating the identity of a terminal device by comparing the identity information of the terminal device, the identity information of the terminal device can be easily forged, resulting in low accuracy of terminal device authentication, thereby improving the accuracy of device authentication.

In order to achieve the above purpose, this application adopts the following technical solutions:

In a first aspect, a device authentication method is provided, the method comprising: obtaining an identification of a terminal device, the identification comprising a fingerprint feature value of the terminal device; generating a target signature private key based on the identification; the target signature private key corresponds to a target signature public key; generating a target digital signature based on the target signature private key; the target digital signature is used to authenticate the identity of the terminal device; sending the identification and the target digital signature to an identity authentication device, so that the identity authentication device generates a target signature public key based on the identification, and verifies the target digital signature based on the target signature public key.

In one possible implementation, a target signature private key is generated based on an identifier, including: generating a first signature private key and a first signature public key based on the identifier; sending the identifier and the first signature public key to a key management device; the key management device is used to generate a second signature public key based on the first signature public key, and to generate a second signature private key based on the identifier and the second signature public key; receiving the second signature public key and the second signature private key sent by the key management device; generating a target signature private key based on the first signature private key and the second signature private key.

In a possible implementation, a key corresponding to a device group is generated based on a channel measurement value sent by each device and multiple device fingerprints, including: determining a first baseline value based on the channel measurement value sent by each device, the first baseline value being used to characterize the difference between the channel measurement values sent by each device; and generating a key corresponding to the device group based on the first baseline value and multiple device fingerprints when the first baseline value is less than a preset value.

In a possible implementation, sending an identifier and a target digital signature to an identity authentication device includes: sending an identifier, a target digital signature, and a second signature public key to the identity authentication device; the identity authentication device is used to authenticate the identity of the terminal device based on the identifier, the target digital signature, and the second signature public key.

In the second aspect, a device authentication method is provided, the method comprising: receiving an identification of a terminal device and a target digital signature sent by the terminal device; the target digital signature is generated based on a signature private key; the target signature private key is generated based on the identification; the identification comprises a fingerprint feature value of the terminal device; the target signature private key corresponds to the target signature public key; based on the identification, a target signature public key is generated; based on the target signature public key, a target digital signature is verified; and when the target digital signature is verified successfully, it is determined that the identity authentication of the terminal device is successful.

In a possible implementation, receiving an identification of a terminal device and a target digital signature sent by a terminal device includes: receiving an identification, a target digital signature and a second signature public key sent by the terminal device, the second signature public key being generated based on the identification; generating a target signature public key based on the identification, including: generating a target signature public key based on the identification, the second signature public key, a random number and a public key of a key management device.

According to a third aspect, a device authentication method is provided, the method comprising: receiving an identification of a terminal device and a first signature public key sent by the terminal device, the identification comprising a fingerprint feature value of the terminal device, and the first signature public key being generated based on the identification; generating a second signature public key based on the first signature public key; generating a second signature private key based on the identification and the second signature public key; sending the second signature public key and the second signature private key to the terminal device, the terminal device being used to perform identity authentication based on the second signature public key and the second signature private key.

In one possible implementation, generating a second signature public key based on the first signature public key includes: generating the second signature public key based on the first signature public key and a random number; generating a second signature private key based on an identifier and the second signature public key includes: generating the second signature private key based on the identifier, the first signature public key, a random number and a private key of a key management device.

In a fourth aspect, a device authentication device is provided, which includes: a transmission unit and a processing unit; the transmission unit is used to obtain an identification of a terminal device, the identification including a fingerprint feature value of the terminal device; the processing unit is used to generate a target signature private key based on the identification; the target signature private key corresponds to the target signature public key; the processing unit is also used to generate a target digital signature based on the target signature private key; the target digital signature is used to authenticate the identity of the terminal device; the transmission unit is also used to send the identification and the target digital signature to an identity authentication device, so that the identity authentication device generates a target signature public key based on the identification, and verifies the target digital signature based on the target signature public key.

In a possible implementation, the processing unit is further used to generate a first signature private key and a first signature public key based on the identifier; the transmission unit is further used to send the identifier and the first signature public key to the key management device; the key management device is used to generate a second signature public key based on the first signature public key, and to generate a second signature private key based on the identifier and the second signature public key; the transmission unit is further used to receive the second signature public key and the second signature private key sent by the key management device; the processing unit is further used to generate a target signature private key based on the first signature private key and the second signature private key.

In a possible implementation, the transmission unit is further used to send the identification, the target digital signature and the second signature public key to the identity authentication device; the identity authentication device is used to authenticate the identity of the terminal device based on the identification, the target digital signature and the second signature public key.

In a fifth aspect, a device authentication device is provided, which includes: a transmission unit and a processing unit; the transmission unit is used to receive the identification of a terminal device and a target digital signature sent by the terminal device; the target digital signature is generated based on a signature private key; the target signature private key is generated based on the identification; the identification includes a fingerprint feature value of the terminal device; the target signature private key corresponds to the target signature public key; the processing unit is used to generate a target signature public key based on the identification; the processing unit is also used to verify the target digital signature based on the target signature public key; the processing unit is also used to determine that the identity authentication of the terminal device has passed when the target digital signature verification has passed.

In a possible implementation, the transmission unit is also used to receive an identification, a target digital signature, and a second signature public key sent by a terminal device, where the second signature public key is generated based on the identification; the processing unit is also used to generate a target signature public key based on the identification, the second signature public key, a random number, and the public key of a key management device.

In a sixth aspect, a device authentication device is provided, which includes: a transmission unit and a processing unit; the transmission unit is used to receive an identification of a terminal device and a first signature public key sent by the terminal device, the identification includes a fingerprint feature value of the terminal device, and the first signature public key is generated based on the identification; the processing unit is used to generate a second signature public key based on the first signature public key; the processing unit is also used to generate a second signature private key based on the identification and the second signature public key; the transmission unit is also used to send the second signature public key and the second signature private key to the terminal device, and the terminal device is used to perform identity authentication based on the second signature public key and the second signature private key.

In a possible implementation, the processing unit is further used to generate a second signature public key based on the first signature public key and the random number; the processing unit is further used to generate a second signature private key based on the identifier, the first signature public key, the random number and the private key of the key management device.

In the seventh aspect, an electronic device comprises: a processor and a memory; wherein the memory is used to store one or more programs, and the one or more programs include computer execution instructions. When the electronic device is running, the processor executes the computer execution instructions stored in the memory to enable the electronic device to perform the method of the first aspect, the method of the second aspect, or the method of the third aspect.

In an eighth aspect, a computer-readable storage medium is provided that stores one or more programs, wherein the one or more programs include instructions, and when the instructions are executed by a computer, the computer executes the method of the first aspect, the method of the second aspect, or the method of the third aspect.

In a ninth aspect, a computer program product is provided. When the computer instructions are executed on an electronic device, the electronic device executes the method of the first aspect, the method of the second aspect, or the method of the third aspect.

The present application provides a device authentication method, apparatus, electronic device, storage medium and program product, which are applied in the scenario of device authentication. When it is necessary to authenticate the terminal device, the terminal device can obtain the identification of the terminal device including the fingerprint characteristic value of the terminal device, and generate a target signature private key based on the identification, and then generate a target digital signature based on the target signature private key, and then send the identification and the target digital signature to the identification authentication device, so that the identification authentication device generates a target signature public key based on the identification, and verifies the target digital signature based on the target signature public key. That is, under normal circumstances, the identification of the terminal device generated based on the fingerprint characteristic value of the terminal device can uniquely identify the terminal device, so by digitally signing with the signature private key generated based on the identification of the terminal device to verify the identity of the terminal device, the accuracy of the identity authentication can be further improved while the identity of the terminal device is accurately authenticated by using the digital signature.

Through the above method, the identity of the terminal device can be authenticated based on the identification and digital signature of the terminal device. Thus, the technical problem that when authenticating the identity of the terminal device by comparing the identity information of the terminal device, the identity information of the terminal device is easily forged, resulting in low accuracy of terminal device authentication is solved, and the accuracy of device authentication is improved.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of the structure of a device authentication system provided in an embodiment of the present application;

FIG2 is a flow chart of a device authentication method provided in an embodiment of the present application;

FIG3 is a schematic diagram of key generation and use provided by an embodiment of the present application;

FIG4 is a second flow chart of a device authentication method provided in an embodiment of the present application;

FIG5 is a third flow chart of a device authentication method provided in an embodiment of the present application;

FIG6 is a fourth flow chart of a device authentication method provided in an embodiment of the present application;

FIG7 is a flowchart diagram 5 of a device authentication method provided in an embodiment of the present application;

FIG8 is a sixth flow chart of a device authentication method provided in an embodiment of the present application;

FIG9 is a flow chart of a device authentication method according to an embodiment of the present application;

FIG10 is a schematic diagram of a PUF-based certificateless identification cryptographic application framework provided in an embodiment of the present application;

FIG11 is a schematic diagram of an identity authentication based on a terminal device provided in an embodiment of the present application;

FIG12 is a structural schematic diagram 1 of a device authentication apparatus provided in an embodiment of the present application;

FIG13 is a second structural diagram of a device authentication apparatus provided in an embodiment of the present application;

FIG14 is a third structural diagram of a device authentication apparatus provided in an embodiment of the present application;

FIG15 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

DETAILED DESCRIPTION

The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

In the description of this application, unless otherwise specified, "/" means "or", for example, A/B can mean A or B. "And/or" in this article is only a description of the association relationship of associated objects, indicating that three relationships can exist. For example, A and/or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" and "plurality" refer to two or more. The words "first", "second", etc. do not limit the quantity and execution order, and the words "first", "second", etc. do not limit them to be different.

Physical Unclonable Functions (PUF) (i.e., fingerprint feature values in this application) refers to the use of random distribution, non-copyable, non-cloneable physical features caused by slight process deviations in the manufacturing process of the terminal device chip to give each chip a chip fingerprint, which is used as a root of trust for chip identity authentication and data encryption, making the chip safer. Therefore, the key generated based on PUF has the advantages of low cost, volatility, unpredictability and simple structure.

Currently, in the field of pan-Internet of Things, especially for terminal devices with three lows (low power consumption, low storage, and low computing power), the technical feasibility of building public key strong identity capabilities is weak, and the identity of the terminal devices cannot be accurately authenticated. Therefore, there is an urgent need for a method that can accurately authenticate the unique identity of the terminal device.

The present application provides a device authentication method, when it is necessary to authenticate the identity of a terminal device, the terminal device can obtain the terminal device identification generated based on the fingerprint feature value of the terminal device and/or the integrated circuit card identification code, and generate a target signature private key based on the identification, and then generate a target digital signature based on the target signature private key, and then send the identification and the target digital signature to the identity authentication device, so that the identity authentication device authenticates the identity of the terminal device based on the identification and the target digital signature. That is, under normal circumstances, the terminal device identification generated based on the fingerprint feature value of the terminal device and/or the integrated circuit card identification code can uniquely identify the terminal device, so by digitally signing the signature private key generated based on the identification of the terminal device to verify the identity of the terminal device, the accuracy of identity authentication can be further improved while the identity of the terminal device is accurately authenticated by using the digital signature.

Through the above method, the identity of the terminal device can be authenticated based on the terminal device's identification and digital signature. Thus, the technical problem that when authenticating the identity of the terminal device by comparing the terminal device's identity information, the terminal device's identity information is easily forged, resulting in low accuracy of terminal device authentication is solved, and the accuracy of device authentication is improved.

A device authentication method provided in an embodiment of the present application can be applied to a device authentication system. Figure 1 shows a schematic diagram of the structure of a device authentication system. As shown in Figure 1, the device authentication system 10 includes: a terminal device 11, a key management device (Key Generation Center, KGC) (also referred to as a key management system) 12 and an identity authentication device (also referred to as a secure identity authentication gateway) 13. The terminal device 11, the key management device 12 and the identity authentication device 13 can be connected by wire or by wireless, and the embodiment of the present invention does not limit this.

The terminal device 11 is used to generate an identification of the terminal device based on the fingerprint feature value and/or the integrated circuit card identification code of the terminal device 11, generate a first signature private key (also called terminal private key component 1) and a first signature public key (also called terminal public key component 1) based on the identification, send the identification and the first signature public key to the key management device 12, receive the second signature public key and the second signature private key (also called terminal private key component 2) sent by the key management device 12, generate a target signature private key based on the first signature private key and the second signature private key, generate a target digital signature based on the target signature private key, and send the identification and the target digital signature to the identity authentication device 13.

The key management device 12 is used to receive the identification of the terminal device 11 and the first signature public key sent by the terminal device 11, generate a second signature public key (also called terminal public key component 2) based on the first signature public key, generate a second signature private key based on the identification and the first signature public key, and send the second signature public key and the second signature private key to the terminal device 11.

The identity authentication device 13 is used to receive the identification of the terminal device 11 and the target digital signature sent by the terminal device 11, generate the target signature public key based on the identification, verify the target digital signature based on the target signature public key, and determine that the identity authentication of the terminal device 11 is passed when the target digital signature verification is passed.

The terminal device 11, the key management device 12 and the identity authentication device 13 may be physical machines, such as a terminal device, an Internet of Things device, a server, or a server group consisting of multiple servers.

The following describes a device authentication method provided by an embodiment of the present application in conjunction with the accompanying drawings. As shown in FIG2 , a device authentication method provided by an embodiment of the present application includes S201-S204:

S201. Obtain the identifier of the terminal device.

The identifier (ie, user identification (UID)) is generated based on a fingerprint feature value and/or an integrated circuit card identity (ICCID) of the terminal device.

It will be appreciated that the terminal device may be based on an identification of the terminal device.

Optionally, a national security subscriber identification module (SIM) card can be manually implanted in the terminal device. Further, the terminal device can perform an XOR operation on the ICCID of the national security SIM card and the fingerprint feature value of the terminal device (i.e., PUF) through the SIM security identification password application to generate the terminal device identification (i.e., the unique hardware fingerprint value of the SIM card, ID _A ).

It should be noted that the national security SIM card can provide device identity password services for IoT applications through the 7816 interface.

S202: Generate a target signature private key based on the identifier.

Among them, the target signature private key corresponds to the target signature public key.

It can be understood that based on the identification, the terminal device can generate a target signature private key.

Optionally, as shown in FIG3 , the terminal device may generate a first signature private key (i.e., d' _A ) and a first signature public key (P' _A ) based on ID _A through a SIM security identification password application, and send ID _A , d' _A and P' _A to the key management device through a secure link. Further, the key management device may randomly generate a random number (i.e., r), add P' _A and r to obtain a second signature public key (i.e., _PA ), and generate a second signature private key (i.e., d" _A = f(ID _A , _PA , r, s)) based on ID _A , _PA , r and the public key of KGC (i.e., KGC master key, s) according to a key generation algorithm.

Further, as shown in FIG3 , KGC may send _PA and d” _A to the terminal device. The terminal device may encrypt and store d” _A locally without storing _PA . Further, when the identity of the terminal device needs to be authenticated, the terminal device may decrypt d” _A locally and add d” _A and d' _A to obtain the target signature private key (i.e., d _A ).

It should be noted that (d' _{A, P'A} ) is terminal key component 1, and (d" _A, P _A ) is terminal key component 2.

S203: Generate a target digital signature based on the target signature private key.

Among them, the target digital signature is used to authenticate the identity of the terminal device.

Optionally, as shown in FIG3 , the terminal device may digitally sign the authentication request based on d _A to generate a target digital signature (ie, k).

S204: Send the identification and the target digital signature to the identity authentication device, so that the identity authentication device generates a target signature public key based on the identification, and verifies the target digital signature based on the target signature public key.

Optionally, as shown in Figure 3, the terminal device may send ID _A , _PA , k and an authentication request to the identity authentication device, or may send ID _A , _PA to the identity authentication device through KGC. The identity authentication device may authenticate the identity of the terminal device based on ID _A , _PA , k and the authentication request.

Exemplarily, the authentication request may be a timestamp.

In one design, as shown in FIG. 4 , an embodiment of the present application provides a device authentication method, the method in step S202 specifically includes S301-S304:

S301. Generate a first signature private key and a first signature public key based on the identifier.

Optionally, based on the identifier, the terminal device may generate a first signature private key and a first signature public key.

S302: Send an identifier and a first signature public key to a key management device.

The key management device is used to generate a second signature public key based on the first signature public key, and to generate a second signature private key based on the identifier and the second signature public key.

Optionally, the terminal device may send the identifier and the first signature public key to the key management device.

S303: Receive a second signature public key and a second signature private key sent by a key management device.

S304: Generate a target signature private key based on the first signature private key and the second signature private key.

Optionally, the terminal device may receive the second signature public key and the second signature private key sent by the key management device, and generate a target signature private key based on the first signature private key and the second signature private key when authentication of the terminal device is required.

It should be noted that the first signature private key and the second signature private key are both partial private keys of the complete target signature private key, and the first signature public key and the second signature public key are both partial private keys of the complete target signature public key.

In a possible implementation, the public key and private key of the terminal device are managed by a key management device, so that the security of the public key and private key of the terminal device can be guaranteed.

In one design, as shown in FIG. 5 , an embodiment of the present application provides a device authentication method, and the method in step S204 specifically includes S401:

S401. Send an identifier, a target digital signature, and a second signature public key to an identity authentication device.

Among them, the identity authentication device is used to authenticate the identity of the terminal device based on the identification, the target digital signature and the second signature public key.

Optionally, the terminal device may send an identification, a target digital signature, and a second signature public key to the identity authentication device.

In one possible implementation, the identity authentication device can generate a target signature public key based on information such as the identification and the second signature public key, and verify the target digital signature through the target signature public key to verify the identity of the terminal device. The target signature public key can be generated in real time to ensure the security of the key.

As shown in FIG6 , an embodiment of the present application provides a device authentication method, the method comprising S501-S504:

S501: Receive a terminal device identifier and a target digital signature sent by a terminal device.

Among them, the target digital signature is generated based on the signature private key; the target signature private key is generated based on the identifier; the identifier is generated based on the fingerprint feature value and/or integrated circuit card identification code of the terminal device; the target signature private key corresponds to the target signature public key.

Optionally, the identity authentication device may receive ID _A , _PA , k and an authentication request sent by the terminal device.

S502: Generate a target signature public key based on the identifier.

Optionally, as shown in FIG3 , the identity authentication device may obtain the public key of KGC (ie, P _PUB ) and calculate the target public key signature (ie, Q _A =g(ID _A , P _A , k, P _PUB )) based on ID _A , P _A , k and P _PUB according to the key generation algorithm.

S503: Verify the target digital signature based on the target signature public key.

Optionally, the identity authentication device may verify the target digital signature based on Q _A. Further, the identity authentication device may obtain an authentication request corresponding to the target digital signature based on Q _A. In the case where the authentication request obtained based on Q _A is consistent with the authentication request sent by the terminal device, the identity authentication device may determine that the target digital signature verification has passed. In the case where the authentication request obtained based on Q _A is inconsistent with the authentication request sent by the terminal device, the identity authentication device may determine that the target digital signature verification has not passed.

S504: When the target digital signature is verified, determine that the identity authentication of the terminal device is passed.

Optionally, when the target digital signature verification passes, the identity authentication device may determine that the identity authentication of the terminal device passes; when the target digital signature verification fails, the identity authentication device may determine that the identity authentication of the terminal device fails.

In one design, as shown in FIG. 7 , an embodiment of the present application provides a device authentication method, wherein the method in step S501 specifically includes S601, and the method in step S502 specifically includes S602:

S601: Receive an identifier, a target digital signature, and a second signature public key sent by a terminal device.

The second signature public key is generated based on the identifier.

S602: Generate a target signature public key based on the identifier, the second signature public key, the random number and the public key of the key management device.

Optionally, the identity authentication device may receive the identification, target digital signature and second signature public key sent by the terminal device. Further, the identity authentication device may generate the target signature public key based on the identification, second signature public key, random number and public key of the key management device.

In one possible approach, the security of the signature public key can be improved by generating the signature public key using a random number and a public key of a key management device.

As shown in FIG8 , an embodiment of the present application provides a device authentication method, the method comprising S701-S704:

S701. Receive a terminal device identifier and a first signature public key sent by a terminal device.

The identifier is generated based on the fingerprint feature value and/or the integrated circuit card identification code of the terminal device, and the first signature public key is generated based on the identifier.

Optionally, the KGC may receive ID _A and P' _A sent by the terminal device.

S702: Generate a second signature public key based on the first signature public key.

Alternatively, KGC may randomly generate r and add _P'A and r to obtain _PA .

S703: Generate a second signature private key based on the identifier and the second signature public key.

Optionally, the KGC may generate a second signature private key (ie, d″ _A =f(ID _A , _PA , r, s)) based on ID _A , _PA , r, and s according to a key generation algorithm.

S704. Send the second signature public key and the second signature private key to the terminal device.

Among them, the terminal device is used to perform identity authentication based on the second signature public key and the second signature private key.

Optionally, the KGC may send the second signature public key and the second signature private key to the terminal device.

In one design, as shown in FIG. 9 , an embodiment of the present application provides a device authentication method, the method in step S702 specifically includes S801, and the method in step S703 specifically includes S802:

S801. Generate a second signature public key based on the first signature public key and a random number.

S802: Generate a second signature private key based on the identifier, the first signature public key, the random number, and the private key of the key management device.

Optionally, the KGC may generate a second signature public key based on the first signature public key and the random number. Further, the KGC may generate a second signature private key based on the identifier, the first signature public key, the random number and the private key of the key management device.

In a possible implementation, the signature private key is generated by using a random number and a private key of a key management device, which can improve the security of the signature private key.

In a possible implementation, as shown in FIG10 , an IoT pan-terminal (i.e., a terminal device) may include: a national secret security SIM card and an IoT security module. Among them, the national secret security SIM card includes a SIM security identification password application. The IoT pan-terminal can obtain the unique characteristic value (i.e., PUF) of the ICCID and the national secret security chip through the SIM security identification password application, and perform an XOR operation on the ICCID and the PUF to generate a SIM unique hardware fingerprint value. The SIM unique hardware fingerprint value is used as the device identification number of the certificateless identification key system (i.e., the certificateless identification password service platform) to generate the corresponding SM2 public-private key pair (i.e., the target signature public key and the target signature private key in this application), and the SM2 public-private key pair is used to sign and protect business instructions (i.e., authentication requests). The certificateless identification password service platform is used to verify the signed data (i.e., the target digital signature in this application) to achieve two-way identity authentication.

Afterwards, the SIM security identification cryptographic application can send an attention (AT) command to the IoT security module, and based on the identification, perform key application, key calculation and other business interactions with the certificateless identification cryptographic service platform (including KGC and IoT cryptographic application service system) through the IoT security module.

KGC may include: key registration system (KRS), key service system (KSS), key distribution system (KDS) and key generation system (KGS).

In a possible implementation, as shown in FIG11 , first, the terminal device can generate ID _A based on ICCID and PUF, and send ID _A to the digital security identity authentication platform (including the identity management module, the terminal authority management module and the certificateless identity password service platform), register ID _A through the digital security identity authentication platform, configure the terminal authentication policy and the authority management policy, and issue the terminal authentication policy and the authority management policy to the security identity authentication gateway (i.e., the identity authentication device) through the digital security identity authentication platform.

Further, the terminal device can generate a first signature private key and a first signature public key, and send ID _A , the first signature private key and the first signature public key to the digital security identity authentication platform. Further, a second signature private key and a second signature public key are generated through the digital security identity authentication platform. The terminal device can receive the second signature private key and the second signature public key, and generate a target signature private key based on the first signature private key and the second signature private key when authenticating the identity of the terminal device.

The terminal device can generate the target digital signature of the authentication request through the target signature private key, and send ID _A , the second signature public key, the authentication request and the target digital signature to the digital security identity authentication platform. Further, the digital security identity authentication platform and the security identity authentication gateway are synchronized in policy. The security identity authentication gateway can generate the target signature public key based on ID _A , the second signature public key, the random number and the public key of KGC, and verify the target digital signature based on the target signature public key. When the target digital signature is verified, it is determined that the terminal device's identity authentication is passed. Further, when the terminal device's identity authentication is passed, the terminal device can access the IoT master station platform through the security identity authentication gateway.

It should be noted that the security identity authentication gateway can also apply for a key from the digital security identity authentication platform in the same way as the terminal device, and use the applied key for two-way identity authentication with the terminal device.

The present application provides a device authentication method, which uses the ICCID of a SIM card as the device's unique identifier for a certificateless elliptic curve algorithm (SM2) identification key generation system, and combines the fingerprint feature value of a PUF chip hardware to generate an actual public key identifier for the device identity, thereby forming a security mechanism for hardware anti-counterfeiting of an Internet of Things terminal, establishing a chip-level public key identifier cryptographic security system and a strong security identity capability of an Internet of Things terminal, realizing the cryptographic capability of a unique identity, and providing precise security identity capabilities.

The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to realize the above functions, it includes hardware structures and/or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

The embodiment of the present application can divide the functional modules of a device authentication method according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

FIG12 is a schematic diagram of the structure of a device authentication apparatus provided in an embodiment of the present application. As shown in FIG12 , a device authentication apparatus 100 is used to improve the accuracy of terminal device authentication, for example, to execute a device authentication method shown in FIG2 . The device authentication apparatus 100 includes: a transmission unit 1001 and a processing unit 1002 .

The transmission unit 1001 is used to obtain an identification of a terminal device, where the identification includes a fingerprint feature value of the terminal device.

Processing unit 1002 is used to generate a target signature private key based on the identifier; the target signature private key corresponds to the target signature public key; processing unit 1002 is also used to generate a target digital signature based on the target signature private key; the target digital signature is used to authenticate the identity of the terminal device.

The transmission unit 1001 is further used to send the identification and the target digital signature to the identity authentication device, so that the identity authentication device generates a target signature public key based on the identification, and verifies the target digital signature based on the target signature public key.

In one possible implementation, the processing unit 1002 is further used to generate a first signature private key and a first signature public key based on the identifier; the transmission unit 1001 is further used to send the identifier and the first signature public key to the key management device; the key management device is used to generate a second signature public key based on the first signature public key, and to generate a second signature private key based on the identifier and the second signature public key; the transmission unit 1001 is further used to receive the second signature public key and the second signature private key sent by the key management device; the processing unit 1002 is further used to generate a target signature private key based on the first signature private key and the second signature private key.

In a possible implementation, the transmission unit 1001 is further used to send the identification, the target digital signature and the second signature public key to the identity authentication device; the identity authentication device is used to authenticate the identity of the terminal device based on the identification, the target digital signature and the second signature public key.

FIG13 is a schematic diagram of the structure of a device authentication apparatus provided in an embodiment of the present application. As shown in FIG13 , a device authentication apparatus 110 is used to improve the accuracy of terminal device authentication, for example, to execute a device authentication method shown in FIG6 . The device authentication apparatus 110 includes: a transmission unit 1101 and a processing unit 1102 .

Transmission unit 1101 is used to receive the terminal device identification and target digital signature sent by the terminal device; the target digital signature is generated based on the signature private key; the target signature private key is generated based on the identification; the identification includes the fingerprint feature value of the terminal device; the target signature private key corresponds to the target signature public key.

The processing unit 1102 is used to generate a target signature public key based on the identifier.

The processing unit 1102 is further configured to verify the target digital signature based on the target signature public key.

The processing unit 1102 is further configured to determine whether the identity authentication of the terminal device has passed when the target digital signature verification has passed.

In a possible implementation, the transmission unit 1101 is also used to receive an identification, a target digital signature, and a second signature public key sent by a terminal device, where the second signature public key is generated based on the identification; the processing unit 1102 is also used to generate a target signature public key based on the identification, the second signature public key, a random number, and the public key of the key management device.

FIG14 is a schematic diagram of the structure of a device authentication device provided in an embodiment of the present application. As shown in FIG14 , a device authentication device 120 is used to improve the accuracy of terminal device authentication, for example, to execute a device authentication method shown in FIG8 . The device authentication device 120 includes: a transmission unit 1201 and a processing unit 1202 .

The transmission unit 1201 is used to receive the terminal device identification and the first signature public key sent by the terminal device, where the identification includes the fingerprint feature value of the terminal device, and the first signature public key is generated based on the identification; the processing unit 1202 is used to generate the second signature public key based on the first signature public key.

The processing unit 1202 is further configured to generate a second signature private key based on the identifier and the second signature public key.

The transmission unit 1201 is also used to send the second signature public key and the second signature private key to the terminal device, and the terminal device is used to perform identity authentication based on the second signature public key and the second signature private key.

In one possible implementation, the processing unit 1202 is further used to generate a second signature public key based on the first signature public key and the random number; the processing unit 1202 is further used to generate a second signature private key based on the identifier, the first signature public key, the random number and the private key of the key management device.

In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, an embodiment of the present application provides a possible structural diagram of the electronic device involved in the above-mentioned embodiment. As shown in Figure 15, an electronic device 130 is used to improve the accuracy of terminal device authentication, for example, for executing a device authentication method shown in Figure 2. The electronic device 130 includes a processor 1301, a memory 1302 and a bus 1303. The processor 1301 and the memory 1302 can be connected via a bus 1303.

The processor 1301 is the control center of the communication device, which can be a processor or a general term for multiple processing elements. For example, the processor 1301 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

As an embodiment, the processor 1301 may include one or more CPUs, such as CPU 0 and CPU 1 shown in FIG. 15 .

The memory 1302 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

As a possible implementation, the memory 1302 may exist independently of the processor 1301, and the memory 1302 may be connected to the processor 1301 via the bus 1303 to store instructions or program codes. When the processor 1301 calls and executes the instructions or program codes stored in the memory 1302, a device authentication method provided in an embodiment of the present application can be implemented.

In another possible implementation, the memory 1302 may also be integrated with the processor 1301 .

The bus 1303 may be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, FIG15 only uses one thick line, but does not mean that there is only one bus or one type of bus.

It should be noted that the structure shown in Fig. 15 does not constitute a limitation on the electronic device 130. In addition to the components shown in Fig. 15, the electronic device 130 may include more or fewer components than shown, or combine certain components, or arrange the components differently.

As an example, in conjunction with FIG12, the functions implemented by the transmission unit 1001 and the processing unit 1002 in the device authentication apparatus 100 are the same as the functions of the processor 1301 in FIG15. In conjunction with FIG13, the functions implemented by the transmission unit 1101 and the processing unit 1102 in the device authentication apparatus 110 are the same as the functions of the processor 1301 in FIG15. In conjunction with FIG14, the functions implemented by the transmission unit 1201 and the processing unit 1202 in the device authentication apparatus 120 are the same as the functions of the processor 1301 in FIG15.

Optionally, as shown in FIG. 15 , the electronic device 130 provided in the embodiment of the present application may further include a communication interface 1304 .

The communication interface 1304 is used to connect with other devices through a communication network. The communication network may be Ethernet, wireless access network, wireless local area network (WLAN), etc. The communication interface 1304 may include a receiving unit for receiving data and a sending unit for sending data.

In one design, in the electronic device provided in the embodiment of the present application, the communication interface can also be integrated into the processor.

Through the description of the above implementation methods, those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above functional units is used as an example. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device is divided into different functional units to complete all or part of the functions described above. The specific working process of the above-described system, device and unit can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When a computer executes the instructions, the computer executes each step in the method flow shown in the above method embodiment.

An embodiment of the present application provides a computer program product. When a computer instruction is executed on an electronic device, the electronic device executes a device authentication method in the above method embodiment.

Among them, the computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk. Random access memory (RAM), read-only memory (ROM), erasable programmable read only memory (EPROM), registers, hard disks, optical fibers, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any other form of computer-readable storage media in a suitable combination of the above, or values in the art.

An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC).

In the embodiments of the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program, which may be used by or in conjunction with an instruction execution system, apparatus, or device.

Since the electronic device, computer-readable storage medium, and computer program product in the embodiments of the present application can be applied to the above method, the technical effects that can be obtained can also refer to the above method embodiments, and the embodiments of the present application will not be repeated here.

The above are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto, and any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application.

Claims (13)

1. A method of device authentication, the method comprising:

acquiring an identifier of a terminal device, wherein the identifier comprises a fingerprint characteristic value of the terminal device;

generating a target signature private key based on the identification; the target signature private key corresponds to the target signature public key;

generating a target digital signature based on the target signature private key; the target digital signature is used for authenticating the identity of the terminal equipment;

And sending the identification and the target digital signature to an identity authentication device, so that the identity authentication device generates the target public signature key based on the identification and verifies the target digital signature based on the target public signature key.

2. The method of claim 1, wherein the generating a target signature private key based on the identification comprises:

generating a first private signature key and a first public signature key based on the identification;

Transmitting the identification and the first signed public key to a key management device; the key management device is configured to generate a second public signature key based on the first public signature key, and generate a second private signature key based on the identification and the second public signature key;

Receiving the second signature public key and the second signature private key sent by the key management equipment;

The target signature private key is generated based on the first signature private key and the second signature private key.

3. The method of claim 2, wherein the sending the identification and the target digital signature to an authentication device comprises:

Transmitting the identification, the target digital signature and the second signature public key to the identity authentication device; the identity authentication device is configured to authenticate an identity of the terminal device based on the identity, the target digital signature, and the second signature public key.

4. A method of device authentication, the method comprising:

Receiving an identifier and a target digital signature of the terminal equipment, which are sent by the terminal equipment; the target digital signature is generated based on the signature private key; the target signature private key is generated based on the identification; the identification comprises a fingerprint characteristic value of the terminal equipment; the target signature private key corresponds to the target signature public key;

generating the target signature public key based on the identification;

verifying the target digital signature based on the target signature public key;

and under the condition that the target digital signature passes verification, determining that the identity authentication of the terminal equipment passes.

5. The method of claim 4, wherein receiving the identification of the terminal device and the target digital signature transmitted by the terminal device comprises:

receiving the identifier, the target digital signature and a second signature public key sent by the terminal equipment, wherein the second signature public key is generated based on the identifier;

The generating the target signature public key based on the identification includes:

the target public signature key is generated based on the identification, the second public signature key, a random number, and a public key of a key management device.

6. A method of device authentication, the method comprising:

receiving an identifier of the terminal equipment and a first signature public key, wherein the identifier comprises a fingerprint characteristic value of the terminal equipment, and the first signature public key is generated based on the identifier;

Generating a second public signature key based on the first public signature key;

generating a second signature private key based on the identification and the second signature public key;

And sending the second signature public key and the second signature private key to the terminal equipment, wherein the terminal equipment is used for carrying out identity authentication based on the second signature public key and the second signature private key.

7. The method of claim 6, wherein the generating a second public signature key based on the first public signature key comprises:

Generating the second signature public key based on the first signature public key and a random number;

The generating a second signature private key based on the identification and the second signature public key includes:

the second signed private key is generated based on the identification, the first signed public key, a random number, and a private key of a key management device.

8. A device authentication apparatus, characterized in that the device authentication apparatus comprises: a transmission unit and a processing unit;

the transmission unit is used for acquiring the identifier of the terminal equipment, wherein the identifier comprises a fingerprint characteristic value of the terminal equipment;

The processing unit is used for generating a target signature private key based on the identification; the target signature private key corresponds to the target signature public key;

the processing unit is further used for generating a target digital signature based on the target signature private key; the target digital signature is used for authenticating the identity of the terminal equipment;

the transmission unit is further configured to send the identifier and the target digital signature to an authentication device, so that the authentication device generates the target public signature key based on the identifier, and verifies the target digital signature based on the target public signature key.

9. A device authentication apparatus, characterized in that the device authentication apparatus comprises: a transmission unit and a processing unit;

The transmission unit is used for receiving the identification of the terminal equipment and the target digital signature sent by the terminal equipment; the target digital signature is generated based on the signature private key; the target signature private key is generated based on the identification; the identification comprises a fingerprint characteristic value of the terminal equipment; the target signature private key corresponds to the target signature public key;

the processing unit is used for generating the target signature public key based on the identification;

the processing unit is further configured to verify the target digital signature based on the target signature public key;

the processing unit is further configured to determine that the identity authentication of the terminal device passes if the target digital signature passes.

10. A device authentication apparatus, characterized in that the device authentication apparatus comprises: a transmission unit and a processing unit;

the transmission unit is used for receiving an identifier of the terminal equipment and a first signature public key, wherein the identifier comprises a fingerprint characteristic value of the terminal equipment, and the first signature public key is generated based on the identifier;

the processing unit is used for generating a second signature public key based on the first signature public key;

the processing unit is further configured to generate a second signature private key based on the identifier and the second signature public key;

the transmission unit is further configured to send the second public signature key and the second private signature key to the terminal device, where the terminal device is configured to perform identity authentication based on the second public signature key and the second private signature key.

11. An electronic device, comprising: a processor and a memory;

Wherein the memory is configured to store one or more programs, the one or more programs comprising computer-executable instructions that, when executed by the electronic device, cause the electronic device to perform the method of any of claims 1-3, the method of any of claims 4-5, or the method of any of claims 6-7.

12. A computer readable storage medium storing one or more programs, wherein the one or more programs comprise instructions, which when executed by a computer, cause the computer to perform the method of any of claims 1-3, the method of any of claims 4-5, or the method of any of claims 6-7.

13. Computer program product, characterized in that it comprises computer instructions which, when run on an electronic device, perform the method according to any of claims 1-3, the method according to any of claims 4-5, or the method according to any of claims 6-7.