Identity authentication and key negotiation method, gateway equipment and terminal

Abstract

The invention relates to an identity authentication and key negotiation method, gateway equipment and a terminal. The method is applied to gateway equipment and comprises the following steps: receiving an equipment certificate sent by a terminal and digital signature information based on first timestamp information; verifying the validity and legality of the device certificate, the validity of the first timestamp information and the validity of the digital signature information; when the verification is passed, randomly generating a session key, and setting a calculation initial value and current time; sending a first encryption result of the calculation initial value and the current time and a second encryption result of the session key to the terminal; and receiving a ciphertext which is sent by the terminal and encrypted by the session key, and determining that terminal identity authentication and key negotiation are successful under the condition that the result of decrypting the ciphertext is a target value which is the sum of the calculation initial value and the preset change value. By adopting the method, the security and reliability of communication between the terminal and the gateway equipment can be improved.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to an identity authentication and key negotiation method, gateway device and terminal. Background Technology

[0002] With the large-scale integration of new energy sources into the power grid and the continuous deepening of power system reform, the number of adjustable load devices such as charging piles, smart buildings, and distributed energy storage has increased dramatically. The diverse access scenarios of these devices and the ubiquitous connection of massive terminals have brought unprecedented challenges to the traditional security protection system.

[0003] Secondly, the protocols used by older terminal devices are often relatively closed, and their computing power is relatively weak, making it difficult to support and execute complex encryption algorithms, which greatly reduces their security protection capabilities. In the face of the real-time control needs of a massive number of terminal devices, it is necessary to ensure low latency while taking into account high reliability. This places extremely high demands on the performance of the security protection system, and traditional protection methods are obviously unable to meet the actual needs of this complex scenario.

[0004] Therefore, providing a method for identity authentication and key negotiation in complex terminal scenarios has become an urgent technical problem to be solved. Summary of the Invention

[0005] Therefore, it is necessary to provide an identity authentication and key negotiation method, gateway device, and terminal that can achieve security protection in complex terminal scenarios, addressing the aforementioned technical issues.

[0006] Firstly, this application provides an authentication and key negotiation method for use in a gateway device, comprising:

[0007] The device certificate sent by the receiving terminal, and digital signature information based on the first timestamp information; the first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate;

[0008] Verify the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information;

[0009] If all verifications pass, a session key is randomly generated, and the initial value and current time are set for calculation.

[0010] The first encrypted result of calculating the initial value and the current time, and the second encrypted result of the session key are sent to the terminal;

[0011] If the ciphertext sent by the receiving terminal is encrypted with the session key, and the result of decrypting the ciphertext is the target value, it is determined that the terminal authentication and key negotiation are successful. The target value is the sum of the initial value and the preset change value.

[0012] In one embodiment, the validity and legality of the verification device certificate, the validity of the first timestamp information, and the validity of the digital signature information include:

[0013] Verify that the equipment certificate is within the preset validity period and has not been revoked;

[0014] Verify the signature of the device certificate using the pre-installed CA root certificate;

[0015] The time window mechanism is used to determine whether the difference between the first timestamp and the current time is within a preset threshold range;

[0016] The public key contained in the device certificate is used to decrypt and verify the digital signature information based on the first timestamp information.

[0017] In one embodiment, sending the first encrypted result of calculating the initial value and the current time, and the second encrypted result of the session key to the terminal, includes:

[0018] The initial value and the current time are concatenated to obtain the concatenated information;

[0019] The concatenated information is encrypted using the first encryption algorithm to obtain the first encryption result;

[0020] The session key is encrypted using a second encryption algorithm to obtain a second encryption result;

[0021] The first and second encryption results are sent to the terminal.

[0022] In one embodiment, before receiving the device certificate sent by the receiving terminal and the digital signature information based on the first timestamp information, the above method further includes:

[0023] After the gateway device starts up, a service receiving thread is created through the proxy module;

[0024] The service receiving thread continuously monitors the preset port listening list;

[0025] The port listening list is a list of service ports that can currently receive terminal data. Service ports are communication ports assigned by the gateway to authenticated terminals for dedicated data transmission.

[0026] In one embodiment, after determining that terminal authentication and key negotiation are successful, the above method further includes:

[0027] Assign a new service port to the terminal and add the new service port to the listening list of the service receiving thread;

[0028] The service receiving thread receives service request messages from the terminal and adds the received service request messages to the task queue; the service request message is a message sent by the terminal through the assigned service port.

[0029] The business processing thread retrieves request messages sequentially from the task queue, processes them, and returns the processing results to the terminal.

[0030] In one embodiment, during the process of sequentially retrieving request messages from the task queue and processing them via a business processing thread, the above method further includes:

[0031] When operating on the task queue through the business receiving thread and the business processing thread, set mutual exclusion protection;

[0032] When the gateway device detects that a terminal has gone offline, it releases the service port corresponding to the terminal and removes the service port corresponding to the terminal from the listening list.

[0033] Secondly, this application provides an identity authentication and key negotiation method, applied to a terminal, including:

[0034] Send a device certificate and a digital signature generated based on the first timestamp information to the gateway device. The first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate.

[0035] The gateway device receives a first encryption result and a second encryption result, wherein the first encryption result is the encryption result obtained by concatenating the initial value set by the gateway device using the first encryption algorithm and the current time, and the second encryption result is the encryption result of the session key randomly generated by the gateway device using the second encryption algorithm.

[0036] Use the terminal private key to decrypt the second encrypted result to obtain the session key, and then use the session key to decrypt the first encrypted result to obtain the initial value and the current time.

[0037] After verifying the validity of the current time, the target value is encrypted using the session key to generate ciphertext. The target value is the sum of the initial value and the preset change value.

[0038] The ciphertext is sent to the gateway device, which then decrypts the ciphertext and determines whether the result is the target value, thus confirming whether the authentication and key negotiation were successful.

[0039] Thirdly, this application also provides a gateway device, comprising:

[0040] The receiving module is used to receive the device certificate sent by the terminal, as well as the digital signature information based on the first timestamp information; the first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate;

[0041] The verification module is used to verify the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information;

[0042] The settings module is used to randomly generate a session key and set the initial value and current time when all verifications pass.

[0043] The sending module is used to send the first encrypted result of calculating the initial value and the current time, as well as the second encrypted result of the session key, to the terminal;

[0044] The determination module is used to send the first encrypted result of calculating the initial value and the current time, as well as the second encrypted result of the session key, to the terminal.

[0045] Fourthly, this application also provides a terminal, including:

[0046] The sending module is used to send the device certificate and the digital signature information generated based on the first timestamp information to the gateway device. The first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate.

[0047] The receiving module is used to receive the first encryption result and the second encryption result sent by the gateway device. The first encryption result is the encryption result of the gateway device using the first encryption algorithm to concatenate the calculated initial value and the current time. The second encryption result is the encryption result of the gateway device using the second encryption algorithm to encrypt the session key it randomly generates.

[0048] The acquisition module is used to decrypt the second encryption result using the terminal private key to obtain the session key, and then use the session key to decrypt the first encryption result to obtain the initial value and the current time.

[0049] The verification module verifies the validity of the current time and then uses the session key to encrypt the target value to generate ciphertext. The target value is the sum of the initial value and the preset change value.

[0050] The determination module is used to send the ciphertext to the gateway device, so that the gateway device can decrypt the ciphertext and determine whether the result is the target value, thereby determining whether the identity authentication and key negotiation were successful.

[0051] Fifthly, this application also provides a gateway device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0052] The device certificate sent by the receiving terminal, and digital signature information based on the first timestamp information; the first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate;

[0053] Verify the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information;

[0054] If all verifications pass, a session key is randomly generated, and the initial value and current time are set for calculation.

[0055] The first encrypted result of calculating the initial value and the current time, and the second encrypted result of the session key are sent to the terminal;

[0056] If the ciphertext sent by the receiving terminal is encrypted with the session key, and the result of decrypting the ciphertext is the target value, it is determined that the terminal authentication and key negotiation are successful. The target value is the sum of the initial value and the preset change value.

[0057] Sixthly, this application also provides a terminal, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0058] Send a device certificate and a digital signature generated based on the first timestamp information to the gateway device. The first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate.

[0059] The gateway device receives a first encryption result and a second encryption result, wherein the first encryption result is the encryption result obtained by concatenating the initial value set by the gateway device using the first encryption algorithm and the current time, and the second encryption result is the encryption result of the session key randomly generated by the gateway device using the second encryption algorithm.

[0060] Use the terminal private key to decrypt the second encrypted result to obtain the session key, and then use the session key to decrypt the first encrypted result to obtain the initial value and the current time.

[0061] After verifying the validity of the current time, the target value is encrypted using the session key to generate ciphertext. The target value is the sum of the initial value and the preset change value.

[0062] The ciphertext is sent to the gateway device, which then decrypts the ciphertext and determines whether the result is the target value, thus confirming whether the authentication and key negotiation were successful.

[0063] The aforementioned authentication and key negotiation methods, gateway devices, and terminals significantly improve the security and reliability of communication between the terminal and the gateway device by introducing timestamps, digital signatures, and two-way encryption verification mechanisms. Attached Figure Description

[0064] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0065] Figure 1 This is a diagram illustrating the application environment of the identity authentication and key negotiation method in one embodiment.

[0066] Figure 2 This is a flowchart illustrating the identity authentication and key negotiation method in one embodiment;

[0067] Figure 3 This is a flowchart illustrating the identity authentication and key negotiation method in another embodiment;

[0068] Figure 4 This is a flowchart illustrating the identity authentication and key negotiation method in another embodiment;

[0069] Figure 5 This is a flowchart illustrating the identity authentication and key negotiation method in another embodiment;

[0070] Figure 6 This is a flowchart illustrating the identity authentication and key negotiation method in another embodiment;

[0071] Figure 7 This is a flowchart illustrating the identity authentication and key negotiation method in another embodiment;

[0072] Figure 8 This is a flowchart illustrating the identity authentication and key negotiation method in another embodiment;

[0073] Figure 9 This is a structural block diagram of an identity authentication and key negotiation device in one embodiment;

[0074] Figure 10 This is a structural block diagram of an identity authentication and key negotiation device in one embodiment;

[0075] Figure 11 This is an internal structure diagram of a gateway device in one embodiment. Detailed Implementation

[0076] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0077] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0078] With the large-scale integration of new energy sources into the power grid and the continuous deepening of power system reform, the number of adjustable load devices such as charging piles, smart buildings, and distributed energy storage has increased dramatically. The diverse access scenarios of these devices and the ubiquitous connection of massive terminals have brought unprecedented challenges to the traditional security protection system.

[0079] Secondly, older terminal devices often employ relatively closed protocols and have relatively weak computing power, making it difficult to support and execute complex encryption algorithms. This significantly reduces their security capabilities. Facing the real-time control needs of massive numbers of terminal devices, it is essential to ensure both low latency and high reliability. This places extremely high demands on the performance of security systems, and traditional protection methods are clearly insufficient to meet the practical needs of this complex scenario. Therefore, providing an authentication and key negotiation method for complex terminal scenarios has become an urgent technical problem to be solved. This application provides a novel authentication and key negotiation method aimed at addressing the aforementioned issues.

[0080] The authentication and key negotiation methods provided in this application can be applied to, for example... Figure 1 In the application environment shown, the environment includes a gateway device 10 and a terminal 20. The terminal 20 communicates with the gateway device 10 via a network. In this embodiment, the gateway device 10 can be an adjustable load vertical lightweight security access gateway. This type of gateway is designed for new power systems or virtual power plant scenarios and must simultaneously meet three rigid requirements: vertical encryption authentication, lightweight hardware, and flexible load access. The gateway device 10 can be integrated into the terminal 20 or placed in the cloud or on other network servers. The terminal 20 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart vehicle devices, projection devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc.

[0081] In one exemplary embodiment, such as Figure 2 As shown, an authentication and key negotiation method is provided, which is applied to... Figure 1 Taking the gateway device in the example, the explanation includes:

[0082] S201. Receive the device certificate sent by the terminal, and the digital signature information based on the first timestamp information; the first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate.

[0083] In this embodiment, the terminal can first send the device certificate cert and digital signature information based on the first timestamp information to the network management device. The first timestamp information refers to the timestamp information corresponding to when the terminal sends the device certificate cert.

[0084] S202. Verify the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information.

[0085] In this embodiment, after receiving the device certificate cert and the digital signature information based on the first timestamp information, the validity and legality of the device certificate can be verified, as well as the validity of the first timestamp information and the validity of the digital signature information.

[0086] Optionally, the validity and legitimacy of a device certificate can be verified by: verifying the certificate chain signature level by level using the root CA public key trusted by the system, discarding it if any level fails the verification; or by checking the purpose field in the device certificate, which must include the required purpose such as "digitalSignature" or "timeStamping".

[0087] Optionally, the validity of the first timestamp information can be verified by: verifying the legitimacy of the TSA certificate using the same root chain, or by checking whether the issuance time falls between NotBefore and NotAfter of the Time Stamping Authority (TSA) certificate.

[0088] Optionally, the validity of digital signature information can be verified by: retrieving the signature algorithm and public key from the device certificate, decrypting / verifying the signature value, and comparing the result with the file digest calculated on the spot.

[0089] S203. When all verifications pass, a session key is randomly generated, and the initial value and current time are set for calculation.

[0090] In this embodiment, after the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information are all verified, a session key can be randomly generated, and the initial value N and the current time T2 can be set.

[0091] S204. Send the first encryption result of the initial value and the current time, and the second encryption result of the session key to the terminal.

[0092] In this embodiment, after obtaining the initial value and the current time, the initial value and the current time can be encrypted to obtain a first encryption result of the initial value and the current time, and the session key can be encrypted to obtain a second encryption result of the session key. The first encryption result of the initial value and the current time, and the second encryption result of the session key are then sent to the terminal.

[0093] Optionally, the following provides a process for obtaining a first encryption result and a second encryption result, and sending the first encryption result and the second encryption result to the terminal, see [link to documentation]. Figure 3 The aforementioned S204 includes:

[0094] S2041. The initial value and the current time are concatenated to obtain the concatenated information.

[0095] In this embodiment, after obtaining the initial calculation value and the current time, the initial calculation value and the current time can be spliced ​​together to obtain spliced ​​information.

[0096] S2042. The spliced ​​information is encrypted using the first encryption algorithm to obtain the first encryption result.

[0097] In this embodiment, after obtaining the spliced ​​information as described above, the session key key can be used to perform encryption operations on the spliced ​​information using the SM1 / SM4 algorithm to obtain the first encryption result.

[0098] S2043. The session key is encrypted using the second encryption algorithm to obtain the second encryption result.

[0099] In this embodiment, the session key key can be encrypted using the SM2 algorithm by utilizing the public key of the digital certificate cert to obtain the second encryption result.

[0100] S2044. Send the first encryption result and the second encryption result to the terminal.

[0101] In this embodiment, after obtaining the first encryption result and the second encryption result, the first encryption result and the second encryption result can be sent to the terminal.

[0102] Thus, this embodiment provides a method for obtaining the first encryption result and the second encryption result, as well as a specific implementation method for sending the first encryption result and the second encryption result to the terminal.

[0103] After receiving the first and second encryption results, the terminal can use the private key securely stored in the security chip to decrypt the session key key, and use the session key key to decrypt the current time T2 and calculate the initial value N. Then, it uses the time window mechanism to verify the current time T2. After successful verification, it uses the session key key to encrypt and calculate the initial value N+1 to obtain the encryption result, and sends the encryption result to the gateway device.

[0104] S205. Receive ciphertext encrypted with the session key sent by the receiving terminal. If the result of decrypting the ciphertext is the target value, determine that the terminal authentication and key negotiation are successful. The target value is the sum of the initial value and the preset change value.

[0105] In this embodiment, after the terminal sends the encryption result to the gateway device, the gateway device receives the ciphertext encrypted with the session key sent by the terminal, decrypts the ciphertext, obtains the result of decrypting the ciphertext, and determines that the terminal authentication and key negotiation are successful if the result of decrypting the ciphertext is the initial value and the preset change value.

[0106] The aforementioned authentication and key negotiation methods, by introducing timestamps, digital signatures, and two-way encryption verification mechanisms, significantly improve the security and reliability of communication between the terminal and the gateway device.

[0107] In this embodiment, in the above Figure 2 Based on the previous embodiments, this embodiment will describe in detail the process of verifying the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information. See [link to previous embodiment]. Figure 4 The aforementioned S202 includes:

[0108] S301. Verify that the equipment certificate is within the preset validity period and has not been revoked.

[0109] In this embodiment, the start and end dates of the validity period recorded in the certificate are checked to confirm that the current time is within the time window. At the same time, the certificate serial number is verified to be not explicitly marked as invalid or revoked by the Certificate Authority (CA) through real-time online query or local cache of the Certificate Revocation List (CRL) and OCSP (Online Certificate Status Protocol) response, thereby ensuring that the certificate of the device used is legal and valid in both time and trust status dimensions.

[0110] S302. Verify the signature of the device certificate using the pre-installed CA root certificate.

[0111] In this embodiment, the gateway device can first read the pre-set CA root certificate from local secure storage and extract its public key; then parse the device certificate sent by the terminal to obtain the digital signature value and signature algorithm identifier issued by the CA private key in the certificate; finally, perform decryption or verification operation on the signature value with the CA root public key, recalculate the digest of the certificate content and compare it with the decryption result. If the two are completely consistent, it proves that the device certificate was indeed issued by a trusted CA and has not been tampered with, thereby establishing its source trustworthiness and integrity.

[0112] S303. Determine whether the difference between the first timestamp information and the current time is within a preset threshold range through a time window mechanism.

[0113] In this embodiment, after receiving the first timestamp sent by the terminal along with the device certificate, the gateway device immediately reads the current time of the local system and calculates the absolute difference between the two with a precision of seconds or milliseconds. Then, it compares the difference with a pre-configured acceptable time tolerance threshold (e.g., 5 min, 300 s, etc.). If the difference falls within the threshold range, the first timestamp is determined to be fresh and valid, and can resist replay attacks. If it exceeds the threshold, it is considered expired or abnormal, and subsequent processes are directly rejected and a security log is recorded, thereby ensuring the legitimacy of the identity authentication request in terms of timeliness.

[0114] S304. Use the public key contained in the device certificate to decrypt and verify the digital signature information based on the first timestamp information.

[0115] In this embodiment, the gateway device first extracts the public key held by the terminal from the verified and valid device certificate. Then, it uses the public key to perform a signature verification operation on the digital signature sent by the terminal, which is encrypted with the terminal's private key and based on the first timestamp information. It recalculates the digest of the original timestamp data and compares it with the decryption result. If the two are consistent, it proves that the timestamp was indeed generated by the legitimate terminal's private key and has not been tampered with, thereby confirming the authenticity and integrity of the timestamp.

[0116] In this embodiment, the system first ensures the certificate is fresh within the time window, then confirms that the certificate's lifecycle is valid and has not been publicly revoked by the CA, then uses the root public key to lock the authenticity of the certificate's source, and finally uses the public key within the certificate to reverse verify the timestamp signature, which can only be generated by the corresponding private key holder. This ensures the authenticity of the terminal's identity and the timeliness of communication, while also achieving non-repudiation and forward security. Overall, it reduces the attack surface such as man-in-the-middle attacks, replay attacks, forgery, and delayed revocation to a negligible level, significantly improving the trust strength and system robustness of authentication and key negotiation between the IoT gateway and the terminal.

[0117] In this embodiment, before the device certificate sent by the receiving terminal and the digital signature information based on the first timestamp information, see [link to previous document]. Figure 5 The above methods also include:

[0118] S205. After the gateway device starts up, a service receiving thread is created through the proxy module.

[0119] The service receiving thread continuously checks whether new data has arrived on the ports in the listening list. The initial number of ports in the listening list is 0.

[0120] The service receiving threads can be divided into an access request processing thread, a service receiving thread, and a service processing thread. The service receiving thread and the service processing thread jointly operate on the task queue; the service receiving thread adds all user service request messages to the task queue; the service processing thread retrieves request messages sequentially from the task queue and returns the processing results to the corresponding users; mutual exclusion protection must be set up when the service receiving thread and the service processing thread operate on the task queue.

[0121] In this embodiment, after the gateway device starts up, a service receiving thread can be created through the proxy module.

[0122] S206. Continuously monitor the preset port listening list through the service receiving thread; wherein, the port listening list is a list of service ports that can currently receive terminal data, and the service port is a communication port allocated by the gateway to the terminal that has passed authentication for dedicated data transmission.

[0123] In this embodiment, after the service receiving thread is created, the preset port listening list can be continuously monitored through the service receiving thread.

[0124] In this embodiment, after the gateway device starts, the proxy module immediately initiates a service receiving thread to continuously poll the dynamic port listening list that is only for terminals that have passed identity authentication. On the one hand, the listening scope is narrowed from traditional fixed ports to the dedicated service ports of authenticated terminals, minimizing the exposure surface and scanning risk. On the other hand, the threads and ports are matched one-to-one and added or removed in real time according to the authentication status, realizing zero-latency elastic resource management that opens the window when authentication is successful and closes the door when the session ends. This significantly reduces the overhead of invalid listening and the denial-of-service attack surface, while ensuring the isolation, real-time and traceability of each terminal's data in high-concurrency scenarios, thereby improving the overall system resource utilization and controllability of secure access.

[0125] In this embodiment, after confirming successful terminal authentication and key negotiation, see [link to relevant documentation]. Figure 6 The above methods also include:

[0126] S207. Assign a new service port to the terminal and add the new service port to the listening list of the service receiving thread.

[0127] In this embodiment, after the service receiving thread is created through the proxy module, the terminal sends an access request to the gateway device. After verifying the legitimacy of the terminal based on the access request, the gateway device will allocate a new service port to the terminal and add the newly allocated port to the listening list of the service receiving thread.

[0128] S208. Receive the terminal's service request message through the service receiving thread and add the received service request message to the task queue; wherein, the service request message is a message sent by the terminal through the allocated service port.

[0129] In this embodiment, after adding the service port corresponding to the terminal to the service receiving thread, the service receiving thread can receive the service request message of the terminal and add the received service request message to the task queue.

[0130] S209. The business processing thread retrieves request messages from the task queue in sequence, processes them, and returns the processing results to the terminal.

[0131] In this embodiment, after receiving the service request message from the terminal through the service receiving thread and adding the received service request to the task queue, the service processing thread can sequentially retrieve the request message from the task queue for processing and return the processing result to the terminal.

[0132] Optionally, the following also provides a scenario involving processing request messages sequentially retrieved from the task queue by the business processing thread; see [link to relevant documentation]. Figure 7 The aforementioned S209 includes:

[0133] S2091. When operating on the task queue through the business receiving thread and the business processing thread, set mutual exclusion protection.

[0134] In this embodiment, a lightweight mutex or spin lock is used to encapsulate the two critical sections of queue insertion and queue retrieval into atomic operations. After receiving a message, the business receiving thread must successfully acquire the lock before pushing the requesting node to the tail of the queue; otherwise, it will block and wait. Similarly, the business processing thread must first acquire the same lock before popping a node from the head of the queue for processing, and then release the lock after completion. This ensures that only one thread touches the queue pointer and length count at any given time, completely avoiding race conditions, duplicate consumption, data tearing, or null pointer exceptions caused by multi-threaded concurrency. At the same time, a blocking and notification mechanism is implemented in conjunction with condition variables to suspend the processing thread when there is no data and wake it up immediately when there is data. This ensures the integrity and consistency of the task queue in high-concurrency scenarios while minimizing the performance loss caused by lock conflicts, achieving a win-win situation for both security and efficiency.

[0135] S2092. When the gateway device detects that a terminal is offline, it releases the service port corresponding to the terminal and removes the service port corresponding to the terminal from the listening list.

[0136] In this embodiment, when the gateway device determines that a terminal has gone offline through heartbeat timeout, TCP RST / FIN, or active probing, it immediately executes a lock-and-receive-and-release cleanup process within the proxy module: first, a mutex lock is added to lock the listening list; then, the service receiving thread is notified to close the socket corresponding to the terminal and reclaim the buffer resources; finally, the service port is removed from the list, the port status is set to idle, and SO_LINGER is sent to the kernel to accelerate port reclamation and return the number to the port pool, ensuring that there are no residual handles or half-open connections in the system. The entire process is completed atomically, which not only prevents the ports of offline terminals from being listened to or reused, but also allows newly authenticated terminals to obtain clean ports immediately, realizing zero-delay resource management of release upon offline and reuse upon release, significantly reducing the risk of port exhaustion and forged renewal packets, and improving the long-term operational stability and access controllability of the gateway.

[0137] In this embodiment, a three-stage pipeline—authentication and allocation of dedicated ports, thread-level real-time monitoring, and queued asynchronous processing—achieves deep decoupling between terminal access and service forwarding. The gateway dynamically adds service ports only to authenticated terminals and immediately includes them in the monitoring list, preventing conflicts between exposed idle ports and reuse. The service receiving thread is dedicated to receiving packets and efficiently queuing them, avoiding I / O blocking and ensuring zero packet loss under high concurrency. The service processing thread asynchronously processes requests according to the queue order, fully utilizing the parallel capabilities of multi-core CPUs and accurately returning the processing results to the terminal. Overall, this achieves millisecond-level response, single-terminal fault isolation, and linear scaling of system throughput with ports / threads, significantly improving the access controllability, resource utilization, and service stability of the IoT gateway.

[0138] In one exemplary embodiment, such as Figure 8 As shown, an authentication and key negotiation method is provided, which is applied to... Figure 1 Taking the terminal in the example, the explanation includes:

[0139] S401. Send the device certificate and the digital signature information generated based on the first timestamp information to the gateway device. The first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate.

[0140] S402. Receive the first encryption result and the second encryption result sent by the gateway device, wherein the first encryption result is the encryption result of the gateway device using the first encryption algorithm to concatenate the calculated initial value and the current time, and the second encryption result is the encryption result of the gateway device using the second encryption algorithm to encrypt the session key it randomly generates.

[0141] S403. Use the terminal private key to decrypt the second encryption result to obtain the session key, and then use the session key to decrypt the first encryption result to obtain the initial value and the current time.

[0142] S404. After verifying the validity of the current time, the target value is encrypted using the session key to generate ciphertext. The target value is the sum of the calculated initial value and the preset change value.

[0143] S405. Send the ciphertext to the gateway device so that the gateway device can decrypt the ciphertext and determine whether the result is the target value, thereby determining whether the authentication and key negotiation were successful.

[0144] This embodiment has been described in detail in the foregoing embodiments and will not be repeated here.

[0145] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0146] Based on the same inventive concept, this application also provides an identity authentication and key negotiation apparatus for implementing the aforementioned identity authentication and key negotiation method. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more of the identity authentication and key negotiation apparatus embodiments provided below can be found in the limitations of the identity authentication and key negotiation method described above, and will not be repeated here.

[0147] In one exemplary embodiment, such as Figure 9 As shown, an identity authentication and key negotiation device is provided, including: a receiving module 10, a verification module 11, a setting module 12, a sending module 13, and a determining module 14, wherein:

[0148] The receiving module 10 is used to receive the device certificate sent by the terminal, as well as the digital signature information based on the first timestamp information; the first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate.

[0149] Verification module 11 is used to verify the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information.

[0150] The setting module 12 is used to randomly generate a session key and set the initial calculation value and the current time when all verifications pass.

[0151] The sending module 13 is used to send the first encrypted result of calculating the initial value and the current time, and the second encrypted result of the session key to the terminal;

[0152] The determination module 14 is used to receive ciphertext encrypted with the session key sent by the terminal. If the result of decrypting the ciphertext is the target value, it determines that the terminal authentication and key negotiation are successful. The target value is the sum of the calculated initial value and the preset change value.

[0153] In an exemplary embodiment, the verification module 11 includes:

[0154] The first verification unit is specifically used to verify whether the device certificate is within the preset validity period and has not been revoked.

[0155] The second verification unit is specifically used to verify the signature of the device certificate using a pre-set CA root certificate;

[0156] The judgment unit is specifically used to determine whether the difference between the first timestamp information and the current time is within a preset threshold range through a time window mechanism;

[0157] The decryption unit is specifically used to decrypt and verify digital signature information based on the first timestamp information using the public key contained in the device certificate.

[0158] In an exemplary embodiment, the sending module 13 described above includes:

[0159] The splicing unit is specifically used to splice the initial calculation value and the current time to obtain spliced ​​information;

[0160] The first encryption unit is specifically used to encrypt the concatenated information using a first encryption algorithm to obtain a first encryption result;

[0161] The second encryption unit is specifically used to encrypt the session key using a second encryption algorithm to obtain a second encryption result;

[0162] The sending unit is specifically used to send the first encryption result and the second encryption result to the terminal.

[0163] In one exemplary embodiment, the above-described apparatus further includes:

[0164] Create a module to create a service receiving thread through the proxy module after the gateway device starts up;

[0165] The monitoring module is used to continuously monitor a preset port listening list through the service receiving thread. The port listening list is a list of service ports that can currently receive terminal data. The service ports are communication ports assigned by the gateway to authenticated terminals for dedicated data transmission.

[0166] In one exemplary embodiment, the above-described apparatus further includes:

[0167] The allocation module is used to allocate new service ports to terminals and add the new service ports to the listening list of the service receiving thread;

[0168] The module is used to receive service request messages from the terminal through the service receiving thread and add the received service request messages to the task queue; wherein, the service request message is a message sent by the terminal through the allocated service port;

[0169] The processing module is used to retrieve request messages from the task queue sequentially through the business processing thread, process them, and return the processing results to the terminal.

[0170] In one exemplary embodiment, the above-described processing module includes:

[0171] The configuration unit is specifically used to set mutual exclusion protection when the task queue is operated on by the business receiving thread and the business processing thread;

[0172] The release unit is specifically used to release the service port corresponding to the terminal and remove the service port corresponding to the terminal from the listening list when the gateway device detects that the terminal is offline.

[0173] In one exemplary embodiment, such as Figure 10 As shown, an identity authentication and key negotiation device is provided, including: a sending module 20, a receiving module 21, an acquisition module 22, a verification module 23, and a sending module 24, wherein:

[0174] The sending module 20 is used to send a device certificate and digital signature information generated based on the first timestamp information to the gateway device. The first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate.

[0175] The receiving module 22 is used to receive the first encryption result and the second encryption result sent by the gateway device. The first encryption result is the encryption result of the gateway device using the first encryption algorithm to concatenate the calculated initial value and the current time. The second encryption result is the encryption result of the gateway device using the second encryption algorithm to encrypt the session key it randomly generates.

[0176] The acquisition module 22 is used to decrypt the second encryption result using the terminal private key to obtain the session key, and then use the session key to decrypt the first encryption result to obtain the initial value and the current time.

[0177] The verification module 23 is used to verify the validity of the current time and then encrypt the target value with the session key to generate ciphertext. The target value is the sum of the initial value and the preset change value.

[0178] The sending module 24 is used to send the ciphertext to the gateway device, so that the gateway device can decrypt the ciphertext and determine whether the result is the target value, thereby determining whether the identity authentication and key negotiation are successful.

[0179] Each module in the aforementioned identity authentication and key negotiation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0180] In one exemplary embodiment, a gateway device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 11 As shown, the computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores digital signature data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements a gateway device method.

[0181] Those skilled in the art will understand that Figure 11The structure shown is merely a block diagram of a portion of the structure related to the solution of this application and does not constitute a limitation on the gateway device to which the solution of this application is applied. A specific gateway device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0182] In one exemplary embodiment, a gateway device is provided, comprising:

[0183] The receiving module is used to receive the device certificate sent by the terminal, as well as the digital signature information based on the first timestamp information; the first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate;

[0184] The verification module is used to verify the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information;

[0185] The settings module is used to randomly generate a session key and set the initial value and current time when all verifications pass.

[0186] The sending module is used to send the first encrypted result of calculating the initial value and the current time, as well as the second encrypted result of the session key, to the terminal;

[0187] The determination module is used to send the first encrypted result of calculating the initial value and the current time, as well as the second encrypted result of the session key, to the terminal.

[0188] In one exemplary embodiment, a terminal is provided, comprising:

[0189] The sending module is used to send the device certificate and the digital signature information generated based on the first timestamp information to the gateway device. The first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate.

[0190] The receiving module is used to receive the first encryption result and the second encryption result sent by the gateway device. The first encryption result is the encryption result of the gateway device using the first encryption algorithm to concatenate the calculated initial value and the current time. The second encryption result is the encryption result of the gateway device using the second encryption algorithm to encrypt the session key it randomly generates.

[0191] The acquisition module is used to decrypt the second encryption result using the terminal private key to obtain the session key, and then use the session key to decrypt the first encryption result to obtain the initial value and the current time.

[0192] The verification module verifies the validity of the current time and then uses the session key to encrypt the target value to generate ciphertext. The target value is the sum of the initial value and the preset change value.

[0193] The determination module is used to send the ciphertext to the gateway device, so that the gateway device can decrypt the ciphertext and determine whether the result is the target value, thereby determining whether the identity authentication and key negotiation were successful.

[0194] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0195] The device certificate sent by the receiving terminal, and digital signature information based on the first timestamp information; the first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate;

[0196] Verify the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information;

[0197] If all verifications pass, a session key is randomly generated, and the initial value and current time are set for calculation.

[0198] The first encrypted result of calculating the initial value and the current time, and the second encrypted result of the session key are sent to the terminal;

[0199] If the ciphertext sent by the receiving terminal is encrypted with the session key, and the result of decrypting the ciphertext is the target value, it is determined that the terminal authentication and key negotiation are successful. The target value is the sum of the initial value and the preset change value.

[0200] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0201] Verify that the equipment certificate is within the preset validity period and has not been revoked;

[0202] Verify the signature of the device certificate using the pre-installed CA root certificate;

[0203] The time window mechanism is used to determine whether the difference between the first timestamp and the current time is within a preset threshold range;

[0204] The public key contained in the device certificate is used to decrypt and verify the digital signature information based on the first timestamp information.

[0205] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0206] The initial value and the current time are concatenated to obtain the concatenated information;

[0207] The concatenated information is encrypted using the first encryption algorithm to obtain the first encryption result;

[0208] The session key is encrypted using a second encryption algorithm to obtain a second encryption result;

[0209] The first and second encryption results are sent to the terminal.

[0210] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0211] After the gateway device starts up, a service receiving thread is created through the proxy module;

[0212] The service receiving thread continuously monitors the preset port listening list;

[0213] The port listening list is a list of service ports that can currently receive terminal data. Service ports are communication ports assigned by the gateway to authenticated terminals for dedicated data transmission.

[0214] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0215] Assign a new service port to the terminal and add the new service port to the listening list of the service receiving thread;

[0216] The service receiving thread receives service request messages from the terminal and adds the received service request messages to the task queue; the service request message is a message sent by the terminal through the assigned service port.

[0217] The business processing thread retrieves request messages sequentially from the task queue, processes them, and returns the processing results to the terminal.

[0218] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0219] When operating on the task queue through the business receiving thread and the business processing thread, set mutual exclusion protection;

[0220] When the gateway device detects that a terminal has gone offline, it releases the service port corresponding to the terminal and removes the service port corresponding to the terminal from the listening list.

[0221] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0222] Send a device certificate and a digital signature generated based on the first timestamp information to the gateway device. The first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate.

[0223] The gateway device receives a first encryption result and a second encryption result, wherein the first encryption result is the encryption result obtained by concatenating the initial value set by the gateway device using the first encryption algorithm and the current time, and the second encryption result is the encryption result of the session key randomly generated by the gateway device using the second encryption algorithm.

[0224] Use the terminal private key to decrypt the second encrypted result to obtain the session key, and then use the session key to decrypt the first encrypted result to obtain the initial value and the current time.

[0225] After verifying the validity of the current time, the target value is encrypted using the session key to generate ciphertext. The target value is the sum of the initial value and the preset change value.

[0226] The ciphertext is sent to the gateway device, which then decrypts the ciphertext and determines whether the result is the target value, thus confirming whether the authentication and key negotiation were successful.

[0227] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0228] The device certificate sent by the receiving terminal, and digital signature information based on the first timestamp information; the first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate;

[0229] Verify the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information;

[0230] If all verifications pass, a session key is randomly generated, and the initial value and current time are set for calculation.

[0231] The first encrypted result of calculating the initial value and the current time, and the second encrypted result of the session key are sent to the terminal;

[0232] If the ciphertext sent by the receiving terminal is encrypted with the session key, and the result of decrypting the ciphertext is the target value, it is determined that the terminal authentication and key negotiation are successful. The target value is the sum of the initial value and the preset change value.

[0233] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0234] Verify that the equipment certificate is within the preset validity period and has not been revoked;

[0235] Verify the signature of the device certificate using the pre-installed CA root certificate;

[0236] The time window mechanism is used to determine whether the difference between the first timestamp and the current time is within a preset threshold range;

[0237] The public key contained in the device certificate is used to decrypt and verify the digital signature information based on the first timestamp information.

[0238] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0239] The initial value and the current time are concatenated to obtain the concatenated information;

[0240] The concatenated information is encrypted using the first encryption algorithm to obtain the first encryption result;

[0241] The session key is encrypted using a second encryption algorithm to obtain a second encryption result;

[0242] The first and second encryption results are sent to the terminal.

[0243] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0244] After the gateway device starts up, a service receiving thread is created through the proxy module;

[0245] The service receiving thread continuously monitors the preset port listening list;

[0246] The port listening list is a list of service ports that can currently receive terminal data. Service ports are communication ports assigned by the gateway to authenticated terminals for dedicated data transmission.

[0247] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0248] Assign a new service port to the terminal and add the new service port to the listening list of the service receiving thread;

[0249] The service receiving thread receives service request messages from the terminal and adds the received service request messages to the task queue; the service request message is a message sent by the terminal through the assigned service port.

[0250] The business processing thread retrieves request messages sequentially from the task queue, processes them, and returns the processing results to the terminal.

[0251] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0252] When operating on the task queue through the business receiving thread and the business processing thread, set mutual exclusion protection;

[0253] When the gateway device detects that a terminal has gone offline, it releases the service port corresponding to the terminal and removes the service port corresponding to the terminal from the listening list.

[0254] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0255] Send a device certificate and a digital signature generated based on the first timestamp information to the gateway device. The first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate.

[0256] The gateway device receives a first encryption result and a second encryption result, wherein the first encryption result is the encryption result obtained by concatenating the initial value set by the gateway device using the first encryption algorithm and the current time, and the second encryption result is the encryption result of the session key randomly generated by the gateway device using the second encryption algorithm.

[0257] Use the terminal private key to decrypt the second encrypted result to obtain the session key, and then use the session key to decrypt the first encrypted result to obtain the initial value and the current time.

[0258] After verifying the validity of the current time, the target value is encrypted using the session key to generate ciphertext. The target value is the sum of the initial value and the preset change value.

[0259] The ciphertext is sent to the gateway device, which then decrypts the ciphertext and determines whether the result is the target value, thus confirming whether the authentication and key negotiation were successful.

[0260] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0261] The device certificate sent by the receiving terminal, and digital signature information based on the first timestamp information; the first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate;

[0262] Verify the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information;

[0263] If all verifications pass, a session key is randomly generated, and the initial value and current time are set for calculation.

[0264] The first encrypted result of calculating the initial value and the current time, and the second encrypted result of the session key are sent to the terminal;

[0265] If the ciphertext sent by the receiving terminal is encrypted with the session key, and the result of decrypting the ciphertext is the target value, it is determined that the terminal authentication and key negotiation are successful. The target value is the sum of the initial value and the preset change value.

[0266] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0267] Verify that the equipment certificate is within the preset validity period and has not been revoked;

[0268] Verify the signature of the device certificate using the pre-installed CA root certificate;

[0269] The time window mechanism is used to determine whether the difference between the first timestamp and the current time is within a preset threshold range;

[0270] The public key contained in the device certificate is used to decrypt and verify the digital signature information based on the first timestamp information.

[0271] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0272] The initial value and the current time are concatenated to obtain the concatenated information;

[0273] The concatenated information is encrypted using the first encryption algorithm to obtain the first encryption result;

[0274] The session key is encrypted using a second encryption algorithm to obtain a second encryption result;

[0275] The first and second encryption results are sent to the terminal.

[0276] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0277] After the gateway device starts up, a service receiving thread is created through the proxy module;

[0278] The service receiving thread continuously monitors the preset port listening list;

[0279] The port listening list is a list of service ports that can currently receive terminal data. Service ports are communication ports assigned by the gateway to authenticated terminals for dedicated data transmission.

[0280] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0281] Assign a new service port to the terminal and add the new service port to the listening list of the service receiving thread;

[0282] The service receiving thread receives service request messages from the terminal and adds the received service request messages to the task queue; the service request message is a message sent by the terminal through the assigned service port.

[0283] The business processing thread retrieves request messages sequentially from the task queue, processes them, and returns the processing results to the terminal.

[0284] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0285] When operating on the task queue through the business receiving thread and the business processing thread, set mutual exclusion protection;

[0286] When the gateway device detects that a terminal has gone offline, it releases the service port corresponding to the terminal and removes the service port corresponding to the terminal from the listening list.

[0287] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0288] Send a device certificate and a digital signature generated based on the first timestamp information to the gateway device. The first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate.

[0289] The gateway device receives a first encryption result and a second encryption result, wherein the first encryption result is the encryption result obtained by concatenating the initial value set by the gateway device using the first encryption algorithm and the current time, and the second encryption result is the encryption result of the session key randomly generated by the gateway device using the second encryption algorithm.

[0290] Use the terminal private key to decrypt the second encrypted result to obtain the session key, and then use the session key to decrypt the first encrypted result to obtain the initial value and the current time.

[0291] After verifying the validity of the current time, the target value is encrypted using the session key to generate ciphertext. The target value is the sum of the initial value and the preset change value.

[0292] The ciphertext is sent to the gateway device, which then decrypts the ciphertext and determines whether the result is the target value, thus confirming whether the authentication and key negotiation were successful.

[0293] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0294] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0295] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0296] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for identity authentication and key negotiation, characterized in that, Applied to gateway devices, including: The receiving terminal sends a device certificate and digital signature information based on a first timestamp; the first timestamp is the timestamp information corresponding to when the terminal sends the device certificate. Verify the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information; If all verifications pass, a session key is randomly generated, and the initial value and current time are set for calculation. The first encryption result of the initial value and the current time, and the second encryption result of the session key are sent to the terminal; The terminal receives ciphertext encrypted with the session key. If the result of decrypting the ciphertext is the target value, the terminal's authentication and key negotiation are determined to be successful. The target value is the sum of the calculated initial value and the preset change value.

2. The method according to claim 1, characterized in that, The verification of the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information includes: Verify that the device certificate is within the preset validity period and has not been revoked; The signature of the device certificate is verified using a pre-configured CA root certificate; The time window mechanism is used to determine whether the difference between the first timestamp information and the current time is within a preset threshold range; The digital signature information based on the first timestamp information is decrypted and verified using the public key contained in the device certificate.

3. The method according to claim 1, characterized in that, The step of sending the first encryption result of the initial value and the current time, and the second encryption result of the session key to the terminal includes: The initial calculated value and the current time are concatenated to obtain concatenated information; The spliced ​​information is encrypted using a first encryption algorithm to obtain the first encryption result; The session key is encrypted using a second encryption algorithm to obtain a second encryption result; The first encryption result and the second encryption result are sent to the terminal.

4. The method according to claim 1, characterized in that, Before the device certificate sent by the receiving terminal and the digital signature information based on the first timestamp information, the following is also included: After the gateway device starts up, a service receiving thread is created through the proxy module; The service receiving thread continuously monitors a preset port listening list; The port listening list is a list of service ports that can currently receive terminal data. The service port is a communication port assigned by the gateway to a terminal that has passed authentication and is used for dedicated data transmission.

5. The method according to claim 4, characterized in that, After confirming the successful terminal authentication and key negotiation, the process further includes: Assign a new service port to the terminal and add the new service port to the listening list of the service receiving thread; The service receiving thread receives the service request message from the terminal and adds the received service request message to the task queue; wherein, the service request message is a message sent by the terminal through the allocated service port; The business processing thread retrieves request messages sequentially from the task queue, processes them, and returns the processing results to the terminal.

6. The method according to claim 5, characterized in that, The process of sequentially retrieving request messages from the task queue and processing them via the business processing thread also includes: When operating on the task queue through the service receiving thread and the service processing thread, mutual exclusion protection is set; When the gateway device detects that the terminal is offline, it releases the service port corresponding to the terminal and removes the service port corresponding to the terminal from the monitoring list.

7. A method for identity authentication and key negotiation, characterized in that, Applied to terminals, including: Send a device certificate and digital signature information generated based on a first timestamp information to the gateway device, wherein the first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate; The gateway device receives a first encryption result and a second encryption result, wherein the first encryption result is the encryption result obtained by concatenating the initial value set by the gateway device using a first encryption algorithm with the current time, and the second encryption result is the encryption result obtained by the gateway device using a second encryption algorithm to encrypt the session key it randomly generates; The second encryption result is decrypted using the terminal private key to obtain the session key, and then the first encryption result is decrypted using the session key to obtain the initial calculation value and the current time; After verifying the validity of the current time, the target value is encrypted using the session key to generate ciphertext, wherein the target value is the sum of the initial value and the preset change value. The ciphertext is sent to the gateway device, so that the gateway device can decrypt the ciphertext and determine whether the result is the target value, thereby determining whether the authentication and key negotiation were successful.

8. A gateway device, characterized in that, include: The receiving module is used to receive the device certificate sent by the terminal, as well as the digital signature information based on the first timestamp information; The first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate; The verification module is used to verify the validity and legality of the device certificate, the validity of the first timestamp information, and the validity of the digital signature information; The settings module is used to randomly generate a session key and set the initial value and current time when all verifications pass. A sending module is used to send a first encryption result of the initial calculation value and the current time, and a second encryption result of the session key to the terminal; The determination module is used to send the first encryption result of the initial calculation value and the current time, and the second encryption result of the session key to the terminal.

9. A terminal, characterized in that, include: The sending module is used to send a device certificate and digital signature information generated based on a first timestamp information to the gateway device. The first timestamp information is the timestamp information corresponding to when the terminal sends the device certificate. The receiving module is used to receive a first encryption result and a second encryption result sent by the gateway device, wherein the first encryption result is the encryption result obtained by concatenating the initial value set by the gateway device using a first encryption algorithm with the current time, and the second encryption result is the encryption result of the session key randomly generated by the gateway device using a second encryption algorithm. The acquisition module is used to decrypt the second encryption result using the terminal private key to obtain the session key, and then use the session key to decrypt the first encryption result to obtain the initial calculation value and the current time; The verification module is used to verify the validity of the current time, and then encrypt the target value using the session key to generate ciphertext. The target value is the sum of the initial value and the preset change value. The determination module is used to send the ciphertext to the gateway device, so that the gateway device can determine whether the identity authentication and key negotiation are successful by decrypting the ciphertext and judging whether the result is the target value.

10. A gateway device comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

Images