Device login method and apparatus, electronic device, system, and storage medium

Abstract

The device login method, device, electronic device, system and storage medium disclosed by the embodiments of the present application, the device login method comprises: sending a login request to a target device; receiving an encrypted string returned by the target device, the encrypted string being obtained by encrypting a first string by a public key of a management device stored in a password-free service configuration table by the target device, the public key being written into the password-free service configuration table by the target device after identity authentication of the management device by a digital certificate provided by the management device and passing the authentication; decrypting the encrypted string by a private key to obtain a second string, and sending the second string to the target device; and receiving a login result returned by the target device, the login result being obtained by the target device by comparing the first string and the second string, so that the communication security can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to computer technology, and in particular to a device login method, device login apparatus, electronic device, system and storage medium. BACKGROUND

[0002] In the process of logging into a target device by a management device, the commonly used login method is the account name / password method. In the process of implementing the present application, the inventor found that the login method using the account name / password is prone to password leakage, which poses a security risk. SUMMARY

[0003] The embodiments of the present application provide a device login method, device login apparatus, electronic device, system and storage medium, which can improve communication security.

[0004] In a first aspect, the embodiments of the present application provide a device login method, comprising:

[0005] sending a login request to a target device;

[0006] receiving an encrypted string returned by the target device, the encrypted string being obtained by encrypting a first string by a public key of a management device stored in a password-free service configuration table, the public key being written into the password-free service configuration table after the target device performs identity authentication on the management device by using a digital certificate provided by the management device and passes the authentication;

[0007] decrypting the encrypted string by a private key to obtain a second string, and sending the second string to the target device;

[0008] receiving a login result returned by the target device, the login result being obtained by the target device by comparing the first string and the second string.

[0009] In a second aspect, the embodiments of the present application provide another device login method, comprising:

[0010] receiving a login request sent by a management device;

[0011] encrypting a first string by a public key of the management device stored in a password-free service configuration table to obtain an encrypted string, and sending the encrypted string to the management device, the public key being written into the password-free service configuration table after the management device performs identity authentication by using a digital certificate provided by the management device and passes the authentication;

[0012] receiving a second string sent by the management device, the second string being obtained by the management device by decrypting the encrypted string by a private key;

[0013] The first string and the second string are compared to obtain a login result, and the login result is sent to the management device.

[0014] In a third aspect, an embodiment of the present application provides a device login apparatus, comprising:

[0015] A first sending module is configured to send a login request to a target device.

[0016] A first receiving module is configured to receive an encrypted string returned by the target device, the encrypted string being obtained by encrypting a first string by a public key of a management device stored in a password-free service configuration table, the public key being written into the password-free service configuration table after the target device performs identity authentication on the management device by using a digital certificate provided by the management device and passes the authentication.

[0017] A first decrypting module is configured to decrypt the encrypted string by using a private key to obtain a second string.

[0018] The first sending module is further configured to send the second string to the target device.

[0019] The first receiving module is further configured to receive a login result returned by the target device, the login result being obtained by comparing the first string and the second string by the target device.

[0020] In a fourth aspect, an embodiment of the present application provides another device login apparatus, comprising:

[0021] A second receiving module is configured to receive a login request sent by a management device.

[0022] A second encrypting module is configured to encrypt a first string by using a public key of the management device stored in a password-free service configuration table to obtain an encrypted string, the public key being written into the password-free service configuration table after identity authentication on the management device by using a digital certificate provided by the management device and passing the authentication.

[0023] A second sending module is configured to send the encrypted string to the management device.

[0024] The second receiving module is further configured to receive a second string sent by the management device, the second string being obtained by decrypting the encrypted string by using a private key by the management device.

[0025] The second sending module is further configured to compare the first string and the second string to obtain a login result, and send the login result to the management device.

[0026] Fifthly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the device login method as described in any of the embodiments of the present invention.

[0027] Sixthly, embodiments of the present invention also provide a device login system, including a management device for executing any of the device login methods described in the embodiments of the present invention and a target device for executing any of the device management methods described in the embodiments of the present invention.

[0028] In a seventh aspect, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the device login method as described in any of the embodiments of the present invention.

[0029] In this embodiment of the invention, a login request can be sent to the target device, and an encrypted string returned by the target device can be received. This encrypted string is obtained by the target device encrypting a first string using the public key of the management device stored in the passwordless service configuration table. This public key is obtained by the target device authenticating the management device using a digital certificate provided by the management device and writing it into the passwordless service configuration table after successful authentication. The encrypted string is decrypted using a private key to obtain a second string, which is then sent to the target device. A login result is received from the target device, which is obtained by comparing the first string and the second string. In other words, this embodiment of the invention provides a passwordless login method, avoiding the risk of password leakage. During passwordless login, the target device can authenticate the management device using a digital certificate. When authentication is successful, the public key of the management device is written into the passwordless service configuration table for use, so that the management device and the public key can be verified, thereby preventing malicious implantation of illegal public keys by criminals and improving communication security. Attached Figure Description

[0030] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a schematic diagram of a device login system provided in an embodiment of the present invention.

[0032] Figure 2 This is a flowchart illustrating a device login method provided in an embodiment of the present invention.

[0033] Figure 3This is another schematic diagram of the device login method provided in the embodiment of the present invention.

[0034] Figure 4 This is a schematic diagram of the interaction between devices in the device login system provided in this embodiment of the invention.

[0035] Figure 5 This is another flowchart illustrating the device login method provided in this embodiment of the invention.

[0036] Figure 6 This is a schematic diagram of a device login device provided in an embodiment of the present invention.

[0037] Figure 7 This is another structural schematic diagram of the device login device provided in an embodiment of the present invention.

[0038] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0039] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0040] Please refer to Figure 1 , Figure 1 This is a schematic diagram of a device login system provided in an embodiment of the present invention. The device login system includes a management device and at least one target device. The at least one target device may include target device 1, target device 2, ..., target device n, where n is an integer greater than 2. For example, the management device may be a local device, and the target devices may be remote devices. Maintenance personnel can log in to at least one target device through the management device to perform operation, maintenance, and management on the target devices. For instance, when the disk of target device 1 is about to be full of application logs, maintenance personnel can log in to target device 1 through the management device to clean up the log directory or files on target device 1 to free up disk space.

[0041] In addition, the device login system may also include a key management server, a certificate authorization server, and a public key distribution server, which can be deployed in a cluster. The key management server provides services such as data encryption, decryption, and key management; the certificate authorization server provides services such as digital certificate issuance and certificate lifecycle management; and the public key distribution server provides file or text information upload and download services.

[0042] It should be noted that, Figure 1The structure of the device login system and the number of devices shown are for illustrative purposes only and are not intended to limit the scope of the system.

[0043] Currently, the common login method for managing target devices is username / password. Since passwords are generally complex and difficult to remember, they are usually saved as text files, such as: p4rEsaewinti3gvby1F80Ca564gFhm12. In practice, due to weak security awareness, errors, or intentional actions by maintenance personnel, password texts are frequently leaked or lost, posing a security risk.

[0044] This invention provides a device login method that can improve communication security. The device login method provided by this invention can be executed by a device login device provided by this invention, which can be implemented in software and / or hardware. In a specific embodiment, the device can be integrated into a management device, for example, integrated into... Figure 1 In the management device shown. Please refer to Figure 2 , Figure 2 This is a flowchart of a device login method provided by an embodiment of the present invention, which may include the following steps:

[0045] Step 201: Send a login request to the target device.

[0046] For example, when it is necessary to perform operation and maintenance management on the target device, the management device can send a login request to the target device according to the operation and maintenance personnel. The login request can include the identification information of the management device, which can be the username, account, etc. of the management device.

[0047] Step 202: Receive the encrypted string returned by the target device. This encrypted string is obtained by the target device encrypting the first string using the public key of the management device stored in the passwordless service configuration table. This public key is written into the passwordless service configuration table by the target device after authenticating the management device using the digital certificate provided by the management device.

[0048] In practice, the management device can generate its own key pair containing a public and private key to avoid data incompatibility issues. For example, the management device can install the OpenSSH tool, which it can use to pre-generate the key pair. Using this public key and the device's identification information, it requests a digital certificate from a certificate authority server. The requested digital certificate and public key are then distributed to the target device via a public key distribution server. Upon receiving the digital certificate and public key, the target device can authenticate the management device based on the digital certificate, verifying its authenticity and validity, and confirming the match between the public key and the digital certificate. After successful authentication, the public key is written to the passwordless service configuration table. Furthermore, if the management device's public key already exists in the passwordless service configuration table, the newly obtained public key can be used to update the existing public key.

[0049] When the target device receives a login request from the management device, it can randomly generate a string, namely the first string. Based on the identification information of the management device, it can extract the public key of the management device from the passwordless service configuration table, encrypt the first string using the public key of the management device, obtain the encrypted string, and send the encrypted string to the management device, which will then receive the encrypted string.

[0050] Step 203: Decrypt the encrypted string using the private key to obtain the second string, and send the second string to the target device.

[0051] The management device can extract its own private key, use the private key to decrypt the encrypted string, and thus obtain the second string.

[0052] Step 204: Receive the login result returned by the target device. The login result is obtained by the target device by comparing the first string and the second string.

[0053] For example, the login result can be either success or failure. The login result is successful when the first string and the second string are the same, and the login result is failure when the first string and the second string are different.

[0054] When the login result is successful, the operation and maintenance personnel can perform operation and maintenance management on the target device through the management device. When the login result fails, the operation and maintenance personnel can try to log in to the target device again through the management device.

[0055] As can be seen, the entire login process is passwordless, eliminating the risk of password leakage. Furthermore, during passwordless login, the target device can use a digital certificate to authenticate the management device. Once authentication is successful, the management device's public key is written into the passwordless service configuration table, allowing the management device and its public key to be verified. This prevents malicious implantation of unauthorized public keys by criminals and improves communication security.

[0056] Please refer to Figure 3 , Figure 3 A flowchart illustrating another device login method provided in this embodiment of the invention. This method can be executed by a device login device provided in this embodiment of the invention, which can be integrated into a management device, for example, integrated into... Figure 1 The management device shown. The device login method may include the following steps:

[0057] Step 301: Generate a key pair, which includes a public key and a private key.

[0058] For example, the management device can generate its own key pair containing a public and private key to avoid data incompatibility issues. For instance, the management device can use its built-in OpenSSH tool to generate a key pair containing public and private keys. Of course, in other embodiments, the key pair can also be generated for the management device by other devices, such as a certificate authority server; this is not specifically limited here. The public key is typically used to encrypt session keys, verify digital signatures, or encrypt data that can be decrypted using the corresponding private key. The public and private keys are a key pair obtained through an algorithm. One key is publicly disclosed and called the public key, while the other is kept secret and called the private key. The key pair obtained through this algorithm is guaranteed to be unique worldwide. When using this key pair, if data is encrypted with one key, it must be decrypted with the other key. For example, if data is encrypted with the public key, it must be decrypted with the private key, and vice versa; otherwise, decryption will fail.

[0059] Step 302: Request a digital certificate from the certificate authority server.

[0060] A digital certificate is a digital authentication that identifies the identity of a party in internet communication. It can be used to verify the identity of another party online.

[0061] In practice, to enable the target device to authenticate the management device and verify the public key distribution, the management device sends its own identification information and generated public key to a certificate authority server (CAS), requesting the CAS to issue a digital certificate. The identification information can include the management device's username, account, etc. Upon receiving this identification information and public key, the CAS verifies whether the received public key belongs to the management device. If it does, the CAS generates a digital certificate for the management device. The digital certificate may include information about the electronic certification authority, the management device's identification information, the public key, the authority's signature, and the validity period. The management device then retrieves the digital certificate from the CAS server.

[0062] Step 303: Send the public key and digital certificate to the target device through the public key distribution server, so that the target device can use the digital certificate to authenticate the management device and write the public key into the passwordless service configuration table after successful authentication.

[0063] For example, a management device can package and upload its own identification information, public key, digital certificate, etc., to a public key distribution server. Target devices can periodically download the identification information, public key, digital certificate, etc., uploaded by the management device from the public key distribution server. After downloading, the target device can authenticate the management device based on the downloaded information. For example, the target device can authenticate whether the digital certificate is genuine and valid, whether the public key matches the digital certificate, and whether the identification information matches the digital certificate. After successful authentication, the public key is written into the passwordless service configuration table. Furthermore, if the management device's public key already exists in the passwordless service configuration table, the newly obtained management device's public key can be used to update the existing public key.

[0064] Step 304: Use the key management server to encrypt the private key to obtain the ciphertext form of the private key.

[0065] For example, the management device can send an encryption request to the key management server to encrypt the private key, thereby obtaining the ciphertext form of the private key. For example, the key management server can encrypt the private key using a symmetric encryption algorithm, such as Advanced Encryption Standard (AES) or SM4.

[0066] Step 305: Store the private key in encrypted form locally.

[0067] Storing the private key in encrypted form can prevent it from being maliciously spied on or stolen, fundamentally eliminating the problems of key leakage and tampering, and ensuring the security of the private key.

[0068] Step 306: Send a login request to the target device.

[0069] For example, when it is necessary to perform operation and maintenance management on the target device, the management device can send a login request to the target device based on the operation and maintenance personnel's actions. The login request may include the identification information of the management device.

[0070] Step 307: Receive the encrypted string returned by the target device. The encrypted string is obtained by the target device encrypting the first string using the public key of the management device stored in the passwordless service configuration table.

[0071] In practice, when the target device receives a login request from the management device, it can randomly generate a string, namely the first string. Based on the identification information of the management device, it extracts the public key of the management device from the passwordless service configuration table, encrypts the first string using the public key of the management device, and sends the encrypted string to the management device. The management device then receives the encrypted string returned by the target device.

[0072] Step 308: Use the key management server to decrypt the encrypted private key stored locally to obtain the plaintext private key.

[0073] For example, the management device can send a decryption request to the key management server to request the key management server to decrypt the private key in ciphertext form stored locally, thereby obtaining the private key in plaintext form.

[0074] Step 309: Decrypt the encrypted string using the private key in plaintext to obtain the second string.

[0075] Step 310: Send the second string to the target device.

[0076] Step 311: Receive the login result returned by the target device. The login result is obtained by the target device by comparing the first string and the second string.

[0077] For example, when the target device receives the second string, it can compare whether the first string and the second string are the same. If they are the same, it can return a successful login result to the management device. If they are different, it can return a failed login result to the management device.

[0078] When the login result is successful, the operation and maintenance personnel can perform operation and maintenance management on the target device through the management device. When the login result fails, the operation and maintenance personnel can try to log in to the target device again through the management device.

[0079] It should be understood that, although Figure 3The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 3 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0080] In this embodiment of the invention, the entire login process is passwordless, requiring no login password, thus avoiding the risk of password leakage. Furthermore, storing the private key in encrypted form prevents malicious eavesdropping or theft, fundamentally eliminating the problems of key leakage and tampering. Even if the encrypted private key file is stolen and removed from the key management server, it cannot be decrypted, preventing the key information from being used on other unauthorized devices and ensuring the security of the private key. Moreover, during passwordless login, the target device can use a digital certificate to authenticate the management device. Upon successful authentication, the management device's public key is written into the passwordless service configuration table, allowing the management device and its public key to be verified. This prevents malicious implantation of unauthorized public keys by criminals and improves communication security.

[0081] The following is about logging in. Figure 1 Taking the target device 1 shown as an example, the device login method provided in this embodiment of the invention is explained as follows: Figure 4 As shown, the specific details are as follows:

[0082] The management device can generate a key pair including a public key and a private key, request the key management server to encrypt the private key to obtain a ciphertext private key, and store the ciphertext private key locally; in addition, the management device can request a digital certificate from a certificate authorization server, and upload the public key and the requested digital certificate to the public key distribution server; the target device 1 downloads the public key and digital certificate from the public key distribution server, uses the digital certificate to authenticate the management device, and writes the public key into the passwordless service configuration table after successful authentication.

[0083] When the management device needs to log in to target device 1, it can send a login request to target device 1. After receiving the login request, target device 1 can generate a first string, encrypt the first string using the management device's public key to obtain an encrypted string, and send the encrypted string to the management device. The management device requests the key management server to decrypt the encrypted private key stored locally to obtain the plaintext private key, and uses the obtained plaintext private key to decrypt the encrypted string to obtain a second string, which is then sent to target device 1. When target device 1 receives the second string, it can compare whether the first string and the second string are the same. If they are the same, it can return a successful login result to the management device; otherwise, it can return a failed login result to the management device.

[0084] Please refer to Figure 5 , Figure 5 This is a flowchart illustrating another device login method provided in an embodiment of the present invention. This method can be executed by a device login device provided in an embodiment of the present invention. This device can be integrated into the target device, for example, integrated into... Figure 1 The login method for any of the target devices shown may include the following steps:

[0085] Step 401: Receive the login request sent by the management device.

[0086] For example, when it is necessary to perform operation and maintenance management on the target device, the management device can send a login request to the target device according to the operation and maintenance personnel. The login request can include the identification information of the management device, such as the username and account of the management device. The target device receives the login request sent by the management device.

[0087] Step 402: Encrypt the first string using the public key of the management device stored in the passwordless service configuration table to obtain an encrypted string, and send the encrypted string to the management device. The public key is used to authenticate the management device using the digital certificate provided by the management device and is written into the passwordless service configuration table after successful authentication.

[0088] In practice, the target device can pre-download the identification information, public key, and digital certificate uploaded by the management device from the public key distribution server. After downloading, the target device can authenticate the management device based on the downloaded information. For example, the target device can authenticate whether the digital certificate is genuine and valid, whether the public key matches the digital certificate, and whether the identification information matches the digital certificate. After successful authentication, the public key is written into the passwordless service configuration table. Furthermore, if the management device's public key already exists in the passwordless service configuration table, the newly obtained public key can be used to update the existing public key.

[0089] When the target device receives a login request from the management device, it can randomly generate a string, namely the first string. Based on the identification information of the management device, it can extract the public key of the management device from the passwordless service configuration table, encrypt the first string using the public key of the management device, obtain the encrypted string, and send the encrypted string to the management device.

[0090] Step 403: Receive the second string sent by the management device. The second string is obtained by the management device decrypting the encrypted string using its private key.

[0091] For example, when a management device receives an encrypted string, it can extract its private key, use the private key to decrypt the encrypted string to obtain a second string, and send the second string to the target device, which then receives the second string sent by the management device.

[0092] Step 404: Compare the first string and the second string to obtain the login result, and send the login result to the management device.

[0093] For example, when the target device receives the second string, it can compare whether the first string and the second string are the same. If they are the same, it can return a successful login result to the management device. If they are different, it can return a failed login result to the management device.

[0094] When the login result is successful, the operation and maintenance personnel can perform operation and maintenance management on the target device through the management device. When the login result fails, the operation and maintenance personnel can try to log in to the target device again through the management device.

[0095] As can be seen, the entire login process is passwordless, eliminating the risk of password leakage. Furthermore, during passwordless login, a digital certificate is used to authenticate the management device. Once authentication is successful, the management device's public key is written into the passwordless service configuration table, allowing the management device and its public key to be verified. This prevents malicious individuals from implanting unauthorized public keys and enhances communication security.

[0096] Figure 6 This is a structural diagram of a device login apparatus provided in an embodiment of the present invention. This apparatus is suitable for executing the device login method provided in the embodiment of the present invention, and can be integrated into a management device. Figure 6 As shown, the device may specifically include:

[0097] The first sending module 501 is used to send a login request to the target device;

[0098] The first receiving module 502 is used to receive the encrypted string returned by the target device. The encrypted string is obtained by the target device encrypting the first string using the public key of the management device stored in the passwordless service configuration table. The public key is written into the passwordless service configuration table by the target device after authenticating the management device using the digital certificate provided by the management device.

[0099] The first decryption module 503 is used to decrypt the encrypted string using a private key to obtain the second string;

[0100] The first sending module 501 is further configured to send the second string to the target device;

[0101] The first receiving module 502 is further configured to receive a login result returned by the target device, wherein the login result is obtained by the target device by comparing the first string and the second string.

[0102] In one embodiment, the device further includes:

[0103] A key generation module is used to generate key pairs, wherein the key pairs include the public key and the private key.

[0104] In one embodiment, the device further includes:

[0105] The request module is used to request the digital certificate from the certificate authority server;

[0106] The first sending module 501 is further configured to send the public key and the digital certificate to the target device through a public key distribution server, so that the target device can use the digital certificate to authenticate the management device and write the public key into the passwordless service configuration table after successful authentication.

[0107] In one embodiment, the device further includes:

[0108] The key management module is used to encrypt the private key using a key management server to obtain the ciphertext form of the private key; and to store the ciphertext form of the private key locally.

[0109] In one embodiment, the first decryption module 503 is specifically used for,

[0110] The private key in ciphertext form is decrypted locally stored using the key management server to obtain the private key in plaintext form;

[0111] The encrypted string is decrypted using the private key in plaintext form to obtain the second string.

[0112] In one embodiment, the login result is successful when the first string and the second string are the same, and the login result is unsuccessful when the first string and the second string are different.

[0113] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional modules is merely an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the functional modules described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0114] The device of this invention can log in to the target device using a passwordless login method, avoiding the risk of password leakage. During passwordless login, the target device can use a digital certificate to authenticate the identity of the management device. When the authentication is successful, the public key of the management device is written into the passwordless service configuration table for use, so that the management device and the public key can be verified, thereby preventing malicious implantation of illegal public keys by criminals and improving communication security.

[0115] Figure 7 This is a structural diagram of a device login apparatus provided in an embodiment of the present invention. This apparatus is suitable for executing the device login method provided in the embodiment of the present invention, and can be integrated into a target device. Figure 7 As shown, the device may specifically include:

[0116] The second receiving module 601 is used to receive login requests sent by the management device;

[0117] The second encryption module 602 is used to encrypt the first string using the public key of the management device stored in the passwordless service configuration table to obtain an encrypted string. The public key is written into the passwordless service configuration table after the management device is authenticated using a digital certificate provided by the management device.

[0118] The second sending module 603 is used to send the encrypted string to the management device;

[0119] The second receiving module 601 is further configured to receive a second string sent by the management device, the second string being obtained by the management device decrypting the encrypted string using a private key;

[0120] The second sending module 603 is further configured to compare the first string and the second string to obtain a login result, and send the login result to the management device.

[0121] In one embodiment, the device further includes:

[0122] The acquisition module is used to obtain the public key and the digital certificate provided by the management device from the public key distribution server;

[0123] The writing module is used to authenticate the management device using the digital certificate and, after successful authentication, write the public key into the passwordless service configuration table.

[0124] The device of this invention allows management devices to log in without a password, thus avoiding the risk of password leakage. During passwordless login, a digital certificate is used to authenticate the management device. Once authentication is successful, the public key of the management device is written into the passwordless service configuration table for use, so that the management device and the public key can be verified. This prevents malicious implantation of illegal public keys by criminals and improves communication security.

[0125] This invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the device login method provided in any of the above embodiments.

[0126] This invention also provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the device login method provided in any of the above embodiments.

[0127] The following is for reference. Figure 8 It shows a schematic diagram of the structure of a computer system 700 suitable for implementing an electronic device according to embodiments of the present invention. Figure 8 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0128] like Figure 8 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 702 or programs loaded from storage section 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the system 700. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0129] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0130] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit (CPU) 701, it performs the functions defined above in the system of this invention.

[0131] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0132] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0133] The modules and / or units described in the embodiments of the present invention can be implemented in software or hardware. The described modules and / or units can also be housed in a processor; for example, a processor may be described as including a first transmitting module, a first receiving module, and a first decryption module; or a processor may be described as including a second receiving module, a second encryption module, and a second transmitting module. The names of these modules do not necessarily constitute a limitation on the module itself.

[0134] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs that, when executed by the device, cause the device to: send a login request to a target device; receive an encrypted string returned by the target device, the encrypted string being obtained by the target device encrypting a first string using the public key of a management device stored in a passwordless service configuration table, the public key being written into the passwordless service configuration table after the target device authenticates the management device using a digital certificate provided by the management device; decrypt the encrypted string using a private key to obtain a second string, and send the second string to the target device; and receive a login result returned by the target device, the login result being obtained by the target device comparing the first string and the second string.

[0135] Alternatively, when one or more of the above procedures are executed by the device, the device includes: receiving a login request sent by a management device; encrypting a first string using the public key of the management device stored in the passwordless service configuration table to obtain an encrypted string, and sending the encrypted string to the management device, wherein the public key is written into the passwordless service configuration table after the management device has been authenticated using a digital certificate provided by the management device; receiving a second string sent by the management device, wherein the second string is obtained by the management device decrypting the encrypted string using its private key; comparing the first string and the second string to obtain a login result, and sending the login result to the management device.

[0136] According to the technical solution of the present invention, a method for passwordless login to a target device is provided, which avoids the risk of password leakage. During passwordless login, the target device can use a digital certificate to authenticate the identity of the management device. When the authentication is successful, the public key of the management device is written into the passwordless service configuration table for use, so that the management device and the public key can be verified, thereby preventing malicious implantation of illegal public keys by criminals and improving communication security.

[0137] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A device login method, characterized in that, include: Send a login request to the target device; The target device receives an encrypted string returned by the target device. The encrypted string is obtained by the target device encrypting the first string using the public key of the management device stored in the passwordless service configuration table. The public key is written into the passwordless service configuration table by the target device after authenticating the management device using the digital certificate provided by the management device. The encrypted string is decrypted using the private key to obtain a second string, and the second string is sent to the target device. The system receives a login result returned by the target device, which is obtained by the target device by comparing the first string and the second string. Before sending a login request to the target device, it also includes: Requesting the digital certificate from the certificate authority includes: sending the identification information of the management device and the generated public key to the certificate authority to request the certificate authority to issue a digital certificate for itself; when the certificate authority receives the identification information and the public key, it confirms whether the received public key belongs to the management device; if it confirms that the received public key belongs to the management device, it generates a digital certificate for the management device. The public key and the digital certificate are sent to the target device through a public key distribution server, so that the target device can use the digital certificate to authenticate the management device and write the public key into the passwordless service configuration table after successful authentication.

2. The device login method according to claim 1, characterized in that, Before sending a login request to the target device, it also includes: The private key is encrypted using a key management server to obtain the ciphertext form of the private key; The private key in encrypted form is stored locally.

3. The device login method according to claim 2, characterized in that, Using the private key to decrypt the encrypted string yields the second string, which includes: The private key in ciphertext form is decrypted locally stored using the key management server to obtain the private key in plaintext form; The encrypted string is decrypted using the private key in plaintext form to obtain the second string.

4. The device login method according to claim 1, characterized in that, The login result is successful when the first string and the second string are the same; the login result is unsuccessful when the first string and the second string are different.

5. The device login method according to claim 1, characterized in that, Before sending a login request to the target device, it also includes: Generate a key pair, which includes the public key and the private key.

6. A device login method, characterized in that, include: Receive login requests sent by the management device; The first string is encrypted using the public key of the management device stored in the passwordless service configuration table to obtain an encrypted string, and the encrypted string is sent to the management device. The public key is written into the passwordless service configuration table after the management device is authenticated using the digital certificate provided by the management device. The management device receives a second string, which is obtained by the management device decrypting the encrypted string using its private key. The login result is obtained by comparing the first string and the second string, and the login result is sent to the management device. Before receiving the login request sent by the management device, it also includes: The management device obtains the public key and digital certificate provided by the management device from the public key distribution server; wherein the generation of the digital certificate includes: the management device sending its own identification information and the generated public key to the certificate authority server to request the certificate authority server to issue a digital certificate for itself; when the certificate authority server receives the identification information and the public key, it confirms whether the received public key belongs to the management device; if it confirms that the received public key belongs to the management device, it generates a digital certificate for the management device. The management device is authenticated using the digital certificate, and the public key is written into the passwordless service configuration table after successful authentication.

7. A device login device, characterized in that, include: The first sending module is used to send a login request to the target device; The first receiving module is used to receive the encrypted string returned by the target device. The encrypted string is obtained by the target device encrypting the first string using the public key of the management device stored in the passwordless service configuration table. The public key is written into the passwordless service configuration table by the target device after authenticating the management device using the digital certificate provided by the management device. The first decryption module is used to decrypt the encrypted string using the private key to obtain the second string. The first sending module is further configured to send the second string to the target device; The first receiving module is further configured to receive a login result returned by the target device, wherein the login result is obtained by the target device by comparing the first string and the second string; The request module is used to request the digital certificate from the certificate authority server, including: sending the identification information of the management device and the generated public key to the certificate authority server to request the certificate authority server to issue a digital certificate for itself; when the certificate authority server receives the identification information and the public key, it confirms whether the received public key belongs to the management device; if it confirms that the received public key belongs to the management device, it generates a digital certificate for the management device. The first sending module is further configured to send the public key and the digital certificate to the target device through a public key distribution server, so that the target device can use the digital certificate to authenticate the management device and write the public key into the passwordless service configuration table after successful authentication.

8. A device login device, characterized in that, include: The second receiving module is used to receive login requests sent by the management device; The second encryption module is used to encrypt the first string using the public key of the management device stored in the passwordless service configuration table to obtain an encrypted string. The public key is used to authenticate the management device using the digital certificate provided by the management device and is written into the passwordless service configuration table after the authentication is successful. The second sending module is used to send the encrypted string to the management device; The second receiving module is further configured to receive a second string sent by the management device, the second string being obtained by the management device decrypting the encrypted string using a private key; The second sending module is further configured to compare the first string and the second string to obtain a login result, and send the login result to the management device; The acquisition module is used to obtain the public key and the digital certificate provided by the management device from the public key distribution server; The generation of the digital certificate includes: the management device sending its own identification information and the generated public key to a certificate authority server to request the certificate authority server to issue a digital certificate for itself; when the certificate authority server receives the identification information and the public key, it confirms whether the received public key belongs to the management device; if it confirms that the received public key belongs to the management device, it generates a digital certificate for the management device. The writing module is used to authenticate the management device using the digital certificate and, after successful authentication, write the public key into the passwordless service configuration table.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the device login method as described in any one of claims 1 to 5, or when the processor executes the program, it implements the device login method as described in claim 6.

10. A device login system, characterized in that, It includes a management device for performing the device login method as described in any one of claims 1 to 5, and a target device for performing the device login method as described in claim 6.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the device login method as described in any one of claims 1 to 5, or when the program is executed by the processor, it implements the device login method as described in claim 6.

Images