Data communication equipment dynamic encryption authentication method and related device

Abstract

The invention discloses a dynamic encryption authentication method for data communication equipment and a related device, and relates to the technical field of network security, and the method comprises the steps that an authentication server establishes an encryption communication channel based on a transport layer security protocol between a user terminal and the data communication equipment; on the channel, the authentication server receives the static identity credential of the user terminal for first verification; and after the verification is passed, the dynamic password is sent to the user terminal through the short message gateway, and the dynamic password submitted by the user terminal is subjected to second verification. When the user terminal initiates a control instruction, the authentication server sends a challenge value to the user terminal; the user terminal calculates a challenge value by using the pre-shared key, generates a response code and returns the response code to the authentication server; the authentication server verifies the validity of the response code, and forwards the control instruction to the target data communication equipment after the verification is passed; and the data communication device executes the instruction and records an execution event in a security audit log. According to the invention, the data transmission security and authentication efficiency of the data communication equipment in different network environments can be effectively improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a dynamic encryption authentication method and related apparatus for data communication devices. Background Technology

[0002] Against the backdrop of accelerated digital transformation, the remote operation and maintenance security of data communication equipment (such as routers, switches, and firewalls) faces severe challenges. Traditional authentication methods (such as static passwords, SSH-RSA certificates, and SMS verification codes) are no longer sufficient to cope with increasingly complex network attacks. In recent years, data communication equipment has frequently suffered from security threats such as man-in-the-middle attacks (MITM), credential leaks, and session hijacking, leading to large-scale network outages, data breaches, and other security incidents. However, traditional solutions still generally rely on static certificates and fixed verification codes, which cannot defend against advanced persistent threats. Summary of the Invention

[0003] The purpose of this application is to provide a dynamic encryption authentication method and related device for data communication devices. It systematically improves the security of data communication device management through three innovative technical points: dynamic encryption authentication for device login, random SMS enhancement for device login, and real-time command interaction verification for encryption authentication of device control command execution. It fills the gaps in the compliance and anti-attack capabilities of traditional technologies in data communication device login and command control.

[0004] To achieve the above objectives, this application provides the following solution: Firstly, this application provides a dynamic encryption authentication method for data communication devices, including: S1. An encrypted communication channel based on a transport layer security protocol is established between the user terminal and the data communication equipment through an authentication server.

[0005] S2. On the encrypted communication channel, the authentication server receives the static identity credential submitted by the user terminal for first verification; after the verification is successful, it sends a dynamic password to the user terminal through the SMS gateway and performs a second verification on the dynamic password submitted by the user terminal.

[0006] S3. After the second verification is passed, when the user terminal initiates a control command, a challenge value is sent to the user terminal through the authentication server; the user terminal uses the pre-shared key to calculate the challenge value, generates a response code, and returns the response code to the authentication server; the authentication server verifies the validity of the response code, and forwards the control command to the target data communication device after the verification is passed.

[0007] S4. The data communication device executes the received control commands and records the command execution event to the security audit log.

[0008] Optionally, the encrypted communication channel adopts the TLS 1.3 protocol.

[0009] The encrypted communication channel uses a cipher suite that supports forward secrecy.

[0010] Optionally, the dynamic password is a one-time password; when the authentication server activates a circuit breaker mechanism after the number of consecutive verification failures reaches a preset threshold, the login method using the dynamic password is locked.

[0011] Optionally, the challenge value includes a monotonically increasing sequence number and a nanosecond-level timestamp; the response code is calculated and generated using a hash-based message authentication code algorithm.

[0012] Optionally, verifying the validity of the response code specifically includes: The response code is considered valid when the difference between the nanosecond-level timestamp and the server time is within ±2 seconds.

[0013] Optionally, after step S2 and before step S3, the method further includes: The session binding process includes the following steps: A trusted context is established based on the authentication server; the trusted context is used to triple bind the user terminal identifier, the data communication device identifier, and the current session identifier.

[0014] Secondly, this application provides a data communication device dynamic encryption authentication apparatus for implementing the aforementioned data communication device dynamic encryption authentication method, comprising: The user terminal is used to initiate connection requests, submit authentication credentials, receive dynamic passwords, and send control commands and challenge values.

[0015] An authentication server is used to establish and manage TLS encrypted communication channels, verify static identity credentials and dynamic passwords, generate and verify challenge values, forward control commands, and record security audit logs.

[0016] Data communication devices are used to receive and execute control commands sent by the authentication server.

[0017] The SMS gateway communicates with the authentication server to send dynamic passwords to user terminals.

[0018] Optionally, the authentication server integrates a security chip for accelerating cryptographic operations and securely storing pre-shared keys.

[0019] Thirdly, this application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the dynamic encryption authentication method for data communication devices described in any one of the above-mentioned methods.

[0020] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements one of the above-described methods for dynamic encryption authentication of data communication devices.

[0021] According to the specific embodiments provided in this application, the following technical effects are disclosed: This application provides a dynamic encryption authentication method and related apparatus for data communication devices. The method first establishes an encrypted communication channel based on a transport layer security protocol between the user terminal and the data communication device using an authentication server. This ensures the confidentiality and integrity of communication data during transmission, effectively preventing data theft or tampering and significantly enhancing communication security. Then, the authentication server receives static identity credentials submitted by the user terminal on the encrypted channel for initial verification. This is the preliminary identity confirmation step, determining the user's legitimacy based on pre-set identity information. After successful static identity credential verification, a dynamic password is sent to the user terminal via an SMS gateway, and the dynamic password submitted by the user terminal is verified a second time. The use of a dynamic password increases the randomness and timeliness of identity verification. Even if the static identity credential information is inadvertently leaked, attackers cannot pass verification without a real-time dynamic password, further strengthening the security of identity verification. After successful second verification, when the user terminal initiates a control command, the authentication server sends a challenge value to the user terminal. The user terminal uses a pre-shared key to calculate the challenge value and generate a response code, which the authentication server then verifies. This mechanism dynamically generates challenge values ​​and response codes to further verify the legitimacy of user terminals, prevent malicious acts such as man-in-the-middle attacks, and ensure the authenticity and security of the control command source. The data communication device executes the received control commands and records the command execution event to the security audit log. This ensures the traceability of device operations, facilitating the backtracking of the entire operation process in case of problems, aiding in fault diagnosis and security incident analysis, and maintaining system security and stability. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is an application environment diagram of a dynamic encryption authentication method for data communication devices according to an embodiment of this application.

[0024] Figure 2 This is a flowchart illustrating a dynamic encryption authentication method for data communication devices provided in an embodiment of this application.

[0025] Figure 3 This is a structural diagram of a structural relationship device provided in an embodiment of this application.

[0026] Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0027] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0028] In the current field of drones, patents related to technologies such as "multi-agent collaboration," "dynamic defense mechanisms," and "high-concurrency command management" are mainly applicable to various fields and application scenarios. Patents specifically for drone control and management, especially for high-concurrency command management and network defense dynamic strategy optimization and adjustment, are currently lacking.

[0029] After reviewing existing patents in relevant fields, current patents related to drones, dynamic optimization of network defense strategies, and high-concurrency command control management can provide optimization for multi-agent collaborative task formation; can provide collaborative optimization and effect evaluation of agent task strategies; can address network attack surface assessment and effectiveness judgment of dynamic defense mechanisms; can accurately distinguish business behaviors, improve modeling and defense effectiveness, and solve the problem of abnormal alarm analysis in the dynamic defense mechanism management of data collection terminal services; can provide management of high-synchronization concurrent task command group control; and can address the problem of multi-person, multi-task collaborative interactive operation. However, they do not currently solve the problems of dynamic defense mechanism generation and execution, nor do they handle the management and execution of high-concurrency command control. Specific technical issues are as follows: 1. Encrypted authentication for device login (search for related technology patents for login and encryption authentication): 1.1. Patent title: "User login authentication method and related device".

[0030] (1) Publication number: CN115150154A: (2) Problem Solving: This application provides a user login authentication method and related apparatus. The method includes: when a first server receives a login authentication request from an electronic device, it verifies the authenticity and validity of the target account information according to the login authentication request. If the authenticity and validity of the target account information is verified, it determines whether there is an authorization credential with the second server as a GUID in the first server's first database. If the authorization credential of the second server exists in the first database, a target authorization credential is selected from the authorization credentials, and the target authorization credential in the first database is deleted. The target authorization credential is then sent to the second server through the electronic device. This allows the second server to determine that the login authentication of the target account is successful if the target authorization credential exists in the second database of the second server; otherwise, it determines that the login authentication of the target account is unsuccessful. This application embodiment can improve the security of user login.

[0031] (3) Technical Features: Based on the deployment of multiple verification servers, the authenticity and validity of the target account information are verified according to the login authentication request. If the authenticity and validity of the target account information are verified, it is determined whether there is an authorization credential with the GUID of the second server in the first database of the first server. If an authorization credential exists, a target authorization credential is selected from the authorization credentials and deleted from the first database. The target authorization credential is sent to the second server through an electronic device, so that if the target authorization credential exists in the second database of the second server, the login authentication of the target account is determined to be successful; otherwise, the login authentication of the target account is determined to be unsuccessful. This application embodiment can improve the security of user login.

[0032] (4) Development status: The patent application published on May 26, 2023, applies the deployment of multiple servers in the user login authentication application scenario to carry out multiple rounds of mutual verification and authorization authentication result verification, thus solving the problem of improving the security of user login.

[0033] (5) Technical issues: This application provides security enhancement support for user login, but does not provide applications for "encrypted authentication for device login" or "SMS authentication for device login", does not handle the issue of "encrypted authentication for device control command execution", and cannot provide the above dynamic encryption authentication capabilities for data communication devices.

[0034] 1.2. Patent title: "Login authentication method and related equipment based on wireless communication".

[0035] (1) Publication number: CN112332992A.

[0036] (2) Problem solved: This patented technology is based on a login authentication method using wireless communication, which is used to limit the physical login area of ​​an account.

[0037] (3) Technical features: The application embodiment is characterized in that the wireless authenticator receives the authentication challenge sent by the authentication device through wireless communication. The authentication challenge is used to authenticate the login validity of the target account. The authentication challenge is generated by the server and sent to the computer device, and sent to the authentication device by the computer device which is hardware-connected or software-connected to the authentication device. The wireless authenticator generates an authentication response based on the authentication challenge. The wireless authenticator broadcasts the authentication response to the external space so that the authentication device in the external space receives the authentication response and the authentication device sends the authentication response back to the server through the computer device.

[0038] (4) Development Status: The patent application published on January 3, 2025, discloses a login authentication method based on wireless communication for limiting the physical login area of ​​an account. When applied to a wireless authenticator, the method includes: the wireless authenticator receiving an authentication challenge sent by an authentication device via wireless communication, the authentication challenge being used to authenticate the login validity of a target account; the wireless authenticator generating an authentication response based on the authentication challenge; and the wireless authenticator broadcasting the authentication response to external space so that an authentication device in the external space receives the authentication response. When applied to an authentication device, the method includes: the authentication device connecting to a computer device; the authentication device receiving an authentication challenge, the authentication challenge being used to authenticate the login validity of a target account; the authentication device sending the authentication challenge via wireless communication to a wireless authenticator in external space; and the authentication device receiving an authentication response returned by the wireless authenticator.

[0039] (5) Technical issues: This application provides a login authentication method based on wireless communication to limit the physical login area of ​​the account, but does not provide applications for "encrypted authentication of device login" or "SMS authentication of device login", does not handle the issue of "encrypted authentication of device control command execution", and cannot provide the above dynamic encryption authentication capabilities for data communication devices.

[0040] 2. Regarding SMS authentication for device login (search for relevant technology patents for login and SMS authentication): Patent Title: "SMS Authentication Method, System, SMS Gateway Device, and Terminal Device" (1) Publication number: CN113132925A.

[0041] (2) Problem Solving: This SMS authentication method includes: the SMS gateway device receiving an SMS sending request, which includes the target number and an SMS verification code; the SMS gateway device randomly assigning an extraction code and establishing a mapping relationship between the extraction code and the SMS verification code; the SMS gateway device storing the SMS verification code in the database of the target application; the SMS gateway device generating an extraction code SMS and sending the extraction code SMS to the terminal device according to the target number; the terminal device receiving the extraction code SMS; the terminal device completing the login verification of the target application according to the extraction code and the access password entered by the user; the terminal device obtaining the SMS verification code from the database of the target application according to the mapping relationship; and the terminal device completing SMS authentication according to the SMS verification code. This SMS authentication method can improve the security of SMS authentication.

[0042] (3) Technical features: A text message authentication method, characterized in that the method includes: a text message gateway device receiving a text message sending request, wherein the text message sending request includes a target number and a text message verification code; the text message gateway device randomly assigning an extraction code and establishing a mapping relationship between the extraction code and the text message verification code; the text message gateway device storing the text message verification code in the database of the target application; the text message gateway device generating an extraction code text message using a preset template and sending the extraction code text message to a terminal device according to the target number, wherein the extraction code text message includes the extraction code; the terminal device receiving the extraction code text message and obtaining the extraction code; the terminal device completing login verification of the target application according to the extraction code and the access password entered by the user; the terminal device obtaining the text message verification code from the database of the target application according to the mapping relationship; and the terminal device completing text message authentication according to the text message verification code.

[0043] (4) Development status: The patent application published on February 18, 2022, applies a text message authentication method, system, text message gateway device and terminal device.

[0044] (5) Technical issues: This application provides a text message authentication method, system, text message gateway device and terminal device, but does not provide the application of "encrypted authentication for device login" and "text message authentication for device login", does not handle the problem of "encrypted authentication for device control command execution", and cannot provide the above dynamic encrypted authentication capabilities for data communication devices.

[0045] 3. Regarding encryption and authentication of equipment control commands (search for relevant patents on encryption and authentication technologies for control commands): Patent title: "Device Cluster Scheduling Method, Apparatus, Equipment and Medium Based on Instruction Encryption".

[0046] (1) Publication number: CN117009951A.

[0047] (2) Problem Solving: This application relates to scheduling technology and discloses a device cluster scheduling method based on instruction encryption, including: calculating the correlation degree between each target device according to device parameters, and constructing a device cluster based on the correlation degree; sending device scheduling instructions to the device cluster, parsing the device scheduling instructions to obtain instruction parameters, encrypting the instruction parameters to obtain encrypted instruction parameters; extracting the cluster identifier from the instruction parameters, and determining the device cluster corresponding to the device scheduling instruction based on the cluster identifier; decrypting the encrypted instruction parameters using the built-in chip of each target device in the device cluster to obtain decrypted instruction parameters; performing instruction authentication between the instruction parameters and the decrypted instruction parameters to obtain the instruction authentication result; and scheduling the device cluster when the instruction authentication result is successful. This application also proposes a device cluster scheduling device, equipment, and medium based on instruction encryption. This application can improve the security of device scheduling.

[0048] (3) Technical features: This application uses a device cluster scheduling method based on instruction encryption. The method is characterized by: S1. Obtaining the device parameters of each target device, calculating the correlation degree between each target device based on the device parameters using a preset correlation degree algorithm, and constructing a device cluster based on the correlation degree. The calculation of the correlation degree between each target device based on the device parameters using the preset correlation degree algorithm includes: S11. Extracting the device functional attributes from the device parameters; S12. Determining the device information amount of the device functional attributes using a preset entropy algorithm; S13. Calculating the correlation coefficient of each target device based on the device information amount using the following correlation degree algorithm: where is the correlation coefficient of the i-th target device, is the device information amount of the i-th target device, is the average device information amount of all target devices, is the number of target devices, is the minimum value function, and is the maximum value function; S14. Determining the correlation degree between each target device based on the correlation coefficient; S2. Sending a device scheduling instruction to the device cluster using a preset scheduling terminal, parsing the device scheduling instruction to obtain instruction parameters, and encrypting the instruction parameters using a preset hybrid encryption algorithm to obtain encrypted instruction parameters; S3. Extract the cluster identifier from the instruction parameters, and determine the device cluster corresponding to the device scheduling instruction based on the cluster identifier; S4. Decrypt the encrypted instruction parameters using the built-in chip of each target device in the device cluster to obtain decrypted instruction parameters; S5. Perform instruction authentication between the instruction parameters and the decrypted instruction parameters to obtain an instruction authentication result. When the instruction authentication result is successful, schedule the device cluster using a preset balanced scheduling algorithm; wherein, encrypting the instruction parameters using a preset hybrid encryption algorithm to obtain encrypted instruction parameters includes: performing an initial permutation on the instruction parameters to obtain permuted instruction parameters; dividing the permuted instruction parameters to obtain left-hand instruction parameters and right-hand instruction parameters; iterating the left-hand instruction parameters and the right-hand instruction parameters using a preset iterative formula and a preset public key to obtain iterative left-hand instruction parameters and iterative right-hand instruction parameters: Wherein, is the left-hand instruction parameter of the iteration in the i-th iteration, is the right-hand instruction parameter of the iteration in the i-th iteration, is a fixed permutation function, is a bit mapping function, is the public key, and is the subkey in the hybrid encryption algorithm; the encryption instruction parameter is obtained by performing inverse permutation on the left-hand instruction parameter and the right-hand instruction parameter of the iteration through a preset inverse permutation table.

[0049] (4) Development status: The patent application published on December 15, 2023, applies a device cluster scheduling method with encrypted instructions. It calculates the correlation between each target device based on device parameters and constructs a device cluster based on the correlation. It sends a device scheduling instruction to the device cluster, parses the device scheduling instruction to obtain instruction parameters, encrypts the instruction parameters to obtain encrypted instruction parameters, extracts the cluster identifier from the instruction parameters, and determines the device cluster corresponding to the device scheduling instruction based on the cluster identifier. It uses the built-in chip of each target device in the device cluster to decrypt the encrypted instruction parameters to obtain decrypted instruction parameters. It performs instruction authentication with the decrypted instruction parameters to obtain the instruction authentication result. When the instruction authentication result is successful, it schedules the device cluster and improves the security of device scheduling.

[0050] (5) Technical issues: This application is based on instruction encryption for device cluster scheduling, but it does not solve the application of "encrypted authentication for device login" and "SMS authentication for device login", does not handle the problem of "encrypted authentication for device control instruction execution", and cannot provide the above dynamic encryption authentication capabilities for data communication devices.

[0051] The purpose of this application is to provide a dynamic encryption authentication method and related device for data communication devices. It systematically improves the security of data communication device management through three innovative technical points: dynamic encryption authentication for device login, random SMS enhancement for device login, and real-time command interaction verification for encryption authentication of device control command execution. It fills the gaps in the compliance and anti-attack capabilities of traditional technologies in data communication device login and command control.

[0052] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0053] This application provides a dynamic encryption authentication method for data communication devices, which can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be set up independently, integrated into server 104, or placed in the cloud or on another server.

[0054] The terminal 102 can be, but is not limited to, various desktop computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, and smart in-vehicle devices. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted devices. The server 104 can be implemented using a standalone server or a server cluster composed of multiple servers, or it can be a cloud server.

[0055] In one exemplary embodiment, such as Figure 2 As shown, a dynamic encryption authentication method for data communication devices is provided. This method is executed by a computer device, specifically by a terminal or server alone, or by both a terminal and a server. In this embodiment, the method is applied to... Figure 1 Taking server 104 as an example, the explanation includes the following steps S1 to S4. Wherein: S1. An encrypted communication channel based on a transport layer security protocol is established between the user terminal and the data communication equipment through an authentication server.

[0056] S2. On the encrypted communication channel, the authentication server receives the static identity credential submitted by the user terminal for first verification; after the verification is successful, it sends a dynamic password to the user terminal through the SMS gateway and performs a second verification on the dynamic password submitted by the user terminal.

[0057] S3. After the second verification is passed, when the user terminal initiates a control command, a challenge value is sent to the user terminal through the authentication server; the user terminal uses the pre-shared key to calculate the challenge value, generates a response code, and returns the response code to the authentication server; the authentication server verifies the validity of the response code, and forwards the control command to the target data communication device after the verification is passed.

[0058] S4. The data communication device executes the received control commands and records the command execution event to the security audit log.

[0059] This embodiment employs a multi-layered dynamic encryption mechanism to achieve end-to-end security protection from device login to command execution. The system adopts a modular design, integrating key technologies such as SSL / TLS encrypted communication, multi-factor authentication, and dynamic challenge / response mechanisms to construct a security architecture comprising four core components: user terminal, authentication server, data communication equipment, and SMS gateway. The solution places particular emphasis on the cryptographic strength design of each stage, significantly improving authentication security while ensuring system compatibility. It effectively defends against common threats such as man-in-the-middle attacks, replay attacks, and credential brute-force attacks, while also meeting the real-time requirements of industrial environments.

[0060] Specifically, when executing steps S1-S4, the specific steps can be as follows: A three-stage security model of "channel encryption – identity verification – command protection" is established, constructing progressive protection at three different layers through cryptographic means. At the communication layer, TLS 1.3-based encrypted channel technology is adopted, and the ECDHE-ECDSA-AES256-GCM-SHA384 cipher suite is selected to achieve forward confidentiality. At the authentication layer, two-factor authentication is combined with static credentials (account password) and dynamic credentials (SMS OTP), and timeliness control is used to prevent credential reuse. At the command layer, a challenge / response mechanism based on HMAC-SHA256 is introduced, and an independent security token is attached to each control command.

[0061] The system runtime sequence is divided into two main phases: device login and command execution. The login phase employs a three-step verification method: "SSL tunnel establishment → static authentication → dynamic verification," ensuring the legitimacy of the login user through two identity verifications. The authentication server plays a crucial role in this process, acting as both an SSL endpoint handling encrypted connections and a certification center managing credential verification, while also coordinating with the SMS gateway to complete OTP delivery. All authentication events are recorded in the security audit module, forming a complete log containing fields such as timestamp, source IP, and operation type.

[0062] The instruction execution phase introduces the concept of session-state security, establishing a trusted context through a triple-binding mechanism (device ID - session ID - user ID). Each control instruction must first obtain a challenge value issued by the server. The client uses a pre-shared key to calculate the response code, and the server only forwards the instruction to the target device after successful verification. A dedicated security chip is configured on the data communication device to handle the TLS terminal function of the MQTT protocol and instruction signature verification, ensuring that even if the control channel is breached, a single instruction still requires cryptographic verification.

[0063] This embodiment features a specially designed anti-brute-force protection mechanism: the PBKDF2-HMAC-SHA512 algorithm is used in the password verification stage, with 10,000 iterations; OTP verification has a 300-second validity period and a 5-attempt limit; the challenge response value includes a nanosecond-level timestamp, with a time tolerance of only ±2 seconds. For performance optimization, fast reconnection is achieved through SSL session tickets, with RTT time controlled within 50ms; the command channel uses UDP to carry the DTLS protocol, reducing latency by 40% compared to traditional solutions.

[0064] Security analysis shows that this implementation is resistant to the following attacks: 1. Resist man-in-the-middle attacks (TLS certificate pinning technology).

[0065] 2. Resist replay attacks (challenge value includes a monotonically increasing sequence number).

[0066] 3. Resistant to brute-force attacks (multi-factor authentication + attempt limit).

[0067] 4. Resist session hijacking (each command requires a fresh challenge response).

[0068] Compared with existing technologies, this embodiment achieves proactive security defense and protection in the above four dimensions of attack resistance under the same hardware conditions, while maintaining more than 95% compatibility with existing devices. The specific implementation scheme is designed as follows: Step 1: Establish a secure channel for the management and control of data communication equipment: 1) Execution entities: Data communication device user login terminal and data communication device login authentication server.

[0069] 2) The role of key steps: The client sends a ClientHello message containing a list of supported TLS versions and cipher suites.

[0070] The server selected the ECDHE-ECDSA-AES256-GCM-SHA384 suite to respond with ServerHello.

[0071] Complete key exchange and certificate verification (using OV SSL certificate, key length 384 bits).

[0072] Establish encrypted application data transmission channels.

[0073] 3) The role of key steps: Provides end-to-end encrypted communication; prevents traffic sniffing and man-in-the-middle attacks; and provides a secure carrier for subsequent authentication.

[0074] Step 2: Authenticate the static credentials for logging into the data communication device: 1) Execution subject: Data communication device login authentication server.

[0075] 2) Key steps: The client sends an AuthRequest = {Username, HASH(Password||Salt)}.

[0076] Server query database verification: Calculate HASH'(StoredPassword||Salt).

[0077] Compare HASH' == HASH.

[0078] Error count accumulates upon failure; 5 errors trigger a 15-minute lockout.

[0079] 3) The role of key steps: Verify user identity; defend against brute-force attacks; prevent brute-force attacks by limiting the number of attempts.

[0080] Step 3: Verify the dynamic password for accessing the data communication device: 1) Execution subject: Data communication device login authentication server → SMS gateway → user terminal.

[0081] 2) Key steps: Server-generated: OTP = (Truncate(Timestamp / 30) + ServerSeed) mod 1000000.

[0082] Send to the user's registered mobile phone number via the SMPP protocol.

[0083] The client must submit a correct OTP within 300 seconds.

[0084] The server verifies the time window and the numerical matching.

[0085] 3) The role of key steps: Implement two-factor authentication; prevent unauthorized access due to credential leakage; bind the user's physical device (mobile phone).

[0086] Step 4: Negotiate the session key for the data communication device (derive three keys): 1) Execution entities: Data communication device user login terminal and data communication device login authentication server.

[0087] 2) Key steps: The SharedKey = (g^a mod p)^b mod p is generated by exchanging ECDHE.

[0088] Derive three subkeys: SessionKey = HKDF(SharedKey, "SESSION", 256).

[0089] MACKey = HKDF(SharedKey, "MAC", 256).

[0090] IVSeed = HKDF(SharedKey, "IV", 128).

[0091] 3) The role of key steps: Establish temporary session keys; achieve forward security; provide cryptographic material for challenge responses.

[0092] Step 5: Challenge (Generate Challenge Value) Data Communication Equipment Control Command: 1) Execution subject: Data communication device login authentication server.

[0093] 2) Key steps: Receive client command request CommandReq = {DeviceID, CmdType}.

[0094] Generate challenge value: Challenge = HMAC(SessionID || SeqNo || Timestamp, MACKey).

[0095] Returns {Chall, Validity=5s} to the client.

[0096] 3) The role of key steps: Ensure command freshness; bind to specific sessions and devices; defend against replay attacks.

[0097] Step Six: Verify the command response of the data communication device: 1) Execution subject: Data communication device user login terminal → Data communication device login authentication server.

[0098] 2) Key steps: Client-side calculation: Resp = HMAC(Chall || CmdBody, MACKey).

[0099] Submit the complete command package: {Chall, Resp, CmdBody, Timestamp}.

[0100] Server verification: Time validity (±2 seconds).

[0101] Challenge value matching.

[0102] HMAC verification of correctness.

[0103] 3) The role of key steps: Verify the integrity of the instruction; confirm the legitimacy of the operator; provide non-repudiation.

[0104] Step 7: Forward security instructions from data communication devices: 1) Execution subject: Data communication device login authentication server → Data communication device.

[0105] 2) Key steps: Server signature instruction: Sig = ECDSA_Sign(CmdHash, ServerPrivateKey).

[0106] Publish to the / cmd / DeviceID topic via MQTT over TLS.

[0107] Equipment verification: Certificate chain validity.

[0108] Authenticity of the signature.

[0109] Timestamp freshness.

[0110] 3. Key steps and their functions: Ensure the source of commands is trustworthy; prevent tampering within the channel; implement device-level access control.

[0111] In this embodiment, through the close coordination of the above seven steps, a security protection system covering the entire authentication lifecycle is constructed. Each step not only independently completes a specific security function, but also forms a defense depth through cryptographic association, ultimately achieving a security effect superior to traditional solutions.

[0112] In some embodiments, a complete security protection system from user access to device control is constructed based on the layered security architecture design concept. The system adopts a "three-layer, four-module" overall architecture, and achieves secure interoperability between components through standardized interface protocols, ensuring high performance while meeting the requirements for secure login, access, and management of data communication devices.

[0113] This embodiment is explained from two dimensions: overall architecture and layered details. The system's hierarchical design adopts a clear vertical layered architecture, which is divided into three main layers from bottom to top: the device layer, the transport layer, and the application layer.

[0114] like Figure 3 As shown in the product structure diagram, the device includes a device layer, a transmission layer, and an application layer, as detailed below: 1. Equipment layer: This layer comprises various data communication devices and their security modules, responsible for executing final instructions and protecting security boundaries. The devices incorporate the SSX1405 security chip, compliant with national cryptographic standards, supporting SM2 / SM3 / SM4 algorithm suites and providing hardware-level key protection and a secure computing environment. This layer establishes a root of trust for the devices through technologies such as secure boot and firmware signature verification.

[0115] 2. Transport Layer: As the nerve center of the system, it consists of an authentication server cluster and a message bus. It adopts a dual-active high-availability deployment, with a single node processing capacity of 5000 TPS, and supports linear scaling. Core components include: Protocol conversion gateway: Enables adaptation to industrial protocols such as MQTT / Modbus / DNP3.

[0116] Security policy engine: Access control decision point based on the RBAC model.

[0117] Real-time audit module: A blockchain-based evidence storage system that records all security events.

[0118] 3. Application Layer: The user interface and management system are designed for end users, offering access via WEB, mobile app, and CLI. It adopts a micro-frontend architecture and integrates the following functional modules: The system includes a device topology visualization module, an authentication policy configurator, a security posture dashboard, and an emergency response console.

[0119] Specifically, the functions of each layer, the basic components involved, and typical technical information are shown in Table 1: Table 1: Functions of Each Layer of System Operation, Involved Basic Components, and Typical Technical Information

[0120] The specific interactions between the various structures are as follows: Between the device layer and the transport layer, data communication devices bear the crucial task of uploading their own operational status and login information to the data communication device login authentication server. Specifically, the data communication device uses an SNMP agent and the Syslog protocol to send or push login information or device operational status information to the transport layer, encapsulating this information in XML format. The transport layer then distributes the data through Kafka, segmenting and streaming it according to device type, ultimately ensuring the accurate delivery of login information to the data communication device login authentication server.

[0121] From the transport layer to the application layer, the communication module uses the Internet (TCP / IP), cellular networks, or dedicated networks to transmit data to the intelligent agent management platform deployed on the server / cloud platform. This platform is responsible for adjusting and optimizing command execution policies, traffic scrubbing thresholds, and firewall rules. The specific process is as follows: First, the Syslog is parsed and associated with the CMDB database to supplement the operator's department information; then, threshold checks are performed on the SNMP data, such as triggering an alarm when CPU utilization exceeds 80%; next, a log index is created in Elasticsearch to support queries; finally, topology change events are pushed to the operations and maintenance terminal in real time via WebSocket.

[0122] From the application layer to the transport layer, the intelligent agent management platform server or cloud platform will use APIs or message queues to push the dynamic defense strategy adjustment results and high-concurrency command processing results to the drone command management intelligent agents deployed on the drone control and management systems of various manufacturers.

[0123] The transport layer sends network dynamic defense adjustment strategies and high-concurrency control commands for UAVs to the perception layer through the transport layer, and adjusts the execution strategy or execution parameters of the control commands.

[0124] Furthermore, this application compares this embodiment with traditional solutions. This application has significant advantages over the prior art, mainly due to the application of agent distributed consensus algorithm and edge computing technology, game theory or reinforcement learning algorithm, and the design of utility function resource scheduling strategy. These technologies work synergistically to achieve high-concurrency processing. The agent, through distributed consensus algorithms and edge computing, can provide thousands of policy negotiation requests per second. It possesses dynamic adaptability; the agent, combining game theory or reinforcement learning algorithms, dynamically generates policies in ≤500ms. Resource utilization is optimized; the agent schedules resources based on utility functions, reducing resource waste by 50%. Security is enhanced; through real-time updates and adjustments to defense strategies, proactive security defenses are implemented in four dimensions: resisting man-in-the-middle attacks (TLS certificate fixing technology), resisting replay attacks (challenge values ​​include monotonically increasing sequence numbers), resisting brute-force attacks (multi-factor authentication + attempt limit), and resisting session hijacking (each instruction requires a fresh challenge response). Furthermore, it maintains over 95% compatibility with existing devices, effectively ensuring the communication security of data communication equipment. Policy execution efficiency is also improved; the agent directly sends adjustment instructions to the device layer through the transport layer, reducing intermediate steps and shortening policy execution latency. A comparison of traditional solutions and this embodiment is shown in Table 2 below: Table 2: Comparison of Technical Features Between Traditional Solutions and This Embodiment

[0125] As can be seen, this application surpasses traditional solutions in terms of policy generation, response speed, resource utilization, system coordination, and security through distributed collaboration of intelligent agents, real-time edge computing processing, and dynamic learning algorithms, achieving a paradigm upgrade from "static passive" to "dynamic active".

[0126] Specifically, the core of this application lies in "dynamic, multi-dimensional, and physically interactive": 1) Dynamic key for data communication device login: The national cryptographic SM2 algorithm is used to generate a temporary session key for each login, replacing the static certificate.

[0127] Traditional device login relies on static RSA certificates or fixed passwords, posing a risk of long-term validity issues. This implementation employs a dynamic key negotiation mechanism, generating temporary session keys (ECDH exchange) based on the SM2 algorithm, which are automatically updated every 5 minutes to prevent long-term misuse after key leakage. Simultaneously, a two-factor authentication system is introduced, requiring maintenance personnel to provide both the device's digital certificate (X.509v3 extended field) and a TOTP dynamic password to ensure identity trustworthiness. To prevent man-in-the-middle attacks, the device displays the last four digits of the key fingerprint via LED flashing encoding; maintenance personnel must manually verify the fingerprint's consistency before logging in. This solution has been deployed in a financial data center, successfully resisting SSH certificate forgery attacks and improving the security of data communication device logins.

[0128] 2) Random verification code for data communication equipment: A 6-bit mixed code is generated by combining equipment characteristics (serial number, location information) (to resist hijacking attacks by fake base stations).

[0129] Traditional data communication equipment uses only 4-digit SMS verification codes, making them vulnerable to interception by fake base stations and brute-force attacks. This embodiment uses a random number generator to generate a 6-digit hybrid verification code, which includes the last 3 digits of the device serial number and a geographic location hash value, ensuring a strong binding between the verification code and the device. After three consecutive failed attempts, the system automatically triggers a circuit breaker mechanism, closing the device management port and notifying the security operations center. Furthermore, the verification code SMS content is encrypted and stored to prevent tampering with the operator's channel. This embodiment intercepts 100% of fake base station attacks, significantly improving security compared to traditional solutions.

[0130] 3) Data communication equipment instruction-level encryption + physical confirmation: Each control instruction is encrypted, and high-risk operations require triggering the physical buttons on the equipment.

[0131] Traditional data communication devices only encrypt the entire SSH session, failing to prevent malicious command injection within legitimate sessions. This embodiment implements fine-grained encryption at the command level, with each data communication device command encrypted independently. The initial vector of each command is dynamically generated using a timestamp and command counter. For high-risk operations (such as port switching, configuration clearing, etc.), the system requires real-time authorization verification for maintenance personnel (triggered signal verification) to ensure that the command executor has immediate access to device login and control permissions.

[0132] This embodiment systematically improves the security of data communication device management through three innovative technologies: dynamic encrypted authentication for device login, random SMS enhancement for device login, and real-time interactive verification of encrypted authentication for device control command execution. It fills the gaps in the compliance and anti-attack capabilities of traditional technologies in data communication device login and command control.

[0133] Based on the same inventive concept, this application also provides a dynamic encryption authentication device for data communication devices to implement the aforementioned dynamic encryption authentication method. The solution provided by this device is similar to the implementation described in the above method. Therefore, the specific limitations in one or more embodiments of the dynamic encryption authentication device for data communication devices provided below can be found in the limitations of the dynamic encryption authentication method for data communication devices described above, and will not be repeated here.

[0134] In one exemplary embodiment, a data communication device dynamic encryption authentication apparatus for implementing the aforementioned data communication device dynamic encryption authentication method is provided, comprising: The user terminal is used to initiate connection requests, submit authentication credentials, receive dynamic passwords, and send control commands and challenge values.

[0135] An authentication server is used to establish and manage TLS encrypted communication channels, verify static identity credentials and dynamic passwords, generate and verify challenge values, forward control commands, and record security audit logs.

[0136] Data communication devices are used to receive and execute control commands sent by the authentication server.

[0137] The SMS gateway communicates with the authentication server to send dynamic passwords to user terminals.

[0138] The authentication server integrates a security chip to accelerate cryptographic operations and securely store pre-shared keys.

[0139] In one exemplary embodiment, a computer device is provided, which may be a server or a terminal, and its internal structure diagram may be as follows. Figure 4 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network. When executed by the processor, the computer program implements a dynamic encryption authentication method for data communication devices.

[0140] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0141] In one exemplary embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0142] In one exemplary embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0143] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0144] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0145] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0146] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0147] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A dynamic encryption authentication method for data communication equipment, characterized in that, include: S1. An encrypted communication channel based on a transport layer security protocol is established between the user terminal and the data communication equipment through an authentication server; S2. On the encrypted communication channel, the authentication server receives the static identity credential submitted by the user terminal for first verification; after the verification is successful, it sends a dynamic password to the user terminal through the SMS gateway and performs a second verification on the dynamic password submitted by the user terminal. S3. After the second verification is passed, when the user terminal initiates a control command, the challenge value is sent to the user terminal through the authentication server. The user terminal uses the pre-shared key to calculate the challenge value, generates a response code, and returns the response code to the authentication server; The authentication server verifies the validity of the response code and forwards the control command to the target data communication device after successful verification. S4. The data communication device executes the received control commands and records the command execution event to the security audit log.

2. The dynamic encryption authentication method for data communication equipment according to claim 1, characterized in that, The encrypted communication channel uses the TLS 1.3 protocol; The encrypted communication channel uses a cipher suite that supports forward secrecy.

3. The dynamic encryption authentication method for data communication equipment according to claim 2, characterized in that, The dynamic password is a one-time password; when the authentication server activates the circuit breaker mechanism after the number of consecutive verification failures reaches a preset threshold, the login method using the dynamic password will be locked.

4. The dynamic encryption authentication method for data communication equipment according to claim 3, characterized in that, The challenge value includes a monotonically increasing sequence number and a nanosecond-level timestamp; the response code is generated using a hash-based message authentication code algorithm.

5. The dynamic encryption authentication method for data communication equipment according to claim 4, characterized in that, Verifying the validity of the response code specifically includes: The response code is considered valid when the difference between the nanosecond-level timestamp and the server time is within ±2 seconds.

6. The dynamic encryption authentication method for data communication equipment according to claim 5, characterized in that, After step S2 and before step S3, the following is also included: The session binding process includes the following steps: A trusted context is established based on the authentication server; the trusted context is used to triple bind the user terminal identifier, the data communication device identifier, and the current session identifier.

7. A dynamic encryption authentication device for data communication equipment for implementing the dynamic encryption authentication method for data communication equipment as described in any one of claims 1-6, characterized in that, include: The user terminal is used to initiate connection requests, submit authentication credentials, receive dynamic passwords, and send control commands and challenge values. The authentication server is used to establish and manage TLS encrypted communication channels, verify static identity credentials and dynamic passwords, generate and verify challenge values, forward control commands, and record security audit logs. Data communication equipment is used to receive and execute control commands sent by the authentication server; The SMS gateway communicates with the authentication server to send dynamic passwords to user terminals.

8. The dynamic encryption authentication device for data communication equipment according to claim 7, characterized in that, The authentication server integrates a security chip to accelerate cryptographic operations and securely store pre-shared keys.

9. A computer device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement a dynamic encryption authentication method for data communication devices according to any one of claims 1-6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements a dynamic encryption authentication method for data communication devices as described in any one of claims 1-6.

Images