Device authentication method and its device, equipment, medium, and product

Abstract

The present application discloses a device authentication method and its apparatus, device, medium, and product, wherein one method includes: receiving a start timestamp transmitted by a terminal device electrically connected to a current playback device; generating a first private key and a first public key correspondingly, and generating a symmetric key based on the first private key and a pre-stored second public key; encrypting the credential information with the symmetric key to obtain a corresponding ciphertext; constructing the ciphertext and the first public key into authentication information, and submitting the ciphertext and the first public key to a server holding the second private key for corresponding authentication after the terminal device superimposes the start timestamp; confirming that the terminal device returns the verification random code representing successful authentication and storing the usage period information for constraining the validity period of the multimedia files stored therein called by the current playback device. The present application can safely and reliably implement device authentication between playback devices, terminal devices, and server devices.

Description

Technical Field

[0001] The present application relates to the field of data security, and in particular to a device authentication method and its corresponding apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] In the information age, the importance of data security is self-evident. Copyright protection of multimedia files such as music and videos also puts forward corresponding requirements for data security technology. In this field, there is a method in the prior art where the copyright holder distributes the multimedia files it owns to end users through multiple intermediaries. Users can authenticate to the copyright holder through any terminal device with an encryption device. After the copyright holder authenticates the encryption device, it opens the access rights of the corresponding multimedia files to the user.

[0003] In the encryption device, an encryption chip is used to authenticate the use rights of the multimedia files obtained by the user, so as to effectively identify and control the use of the multimedia files by the user. Only legally authorized encryption devices can download, transmit and play multimedia files.

[0004] In reality, the sources of multimedia files obtained by users are mostly unclear, and most of them may come from informal copyright sources. Therefore, they cannot be updated in time through formal copyright sources, and thus the sound quality and picture quality of multimedia files cannot be improved, which affects the user experience. Moreover, the current multimedia file transmission between authorized devices is also a problem that bothers users, because the transmission method is relatively cumbersome, and generally requires computer operation to perform the import and export of multimedia files between authorized devices.

[0005] In order to facilitate the authentication of multimedia file playback devices, guide users to obtain genuine resources reasonably and legally through regular copyright sources, and provide convenience for authorized playback device manufacturers to obtain genuine resources, and help promote genuine resources, this application conducts corresponding exploration. Summary of the invention

[0006] The purpose of the present application is to provide a device authentication method and its corresponding apparatus, computer equipment, non-volatile storage medium and computer program product to meet user needs.

[0007] In order to meet the various objectives of this application, this application adopts the following technical solutions:

[0008] A playback device authentication method provided for the purpose of this application includes the following steps:

[0009] Receiving a start timestamp transmitted by a terminal device electrically connected to the current playback device;

[0010] Generate a first private key and a first public key accordingly, generate a symmetric key according to the first private key and a pre-stored second public key, and a second private key corresponding to the second public key is held by the server;

[0011] Encrypting the credential information with the symmetric key to obtain a corresponding ciphertext, the credential information including a device feature code of the current playback device, a verification random code, and the start timestamp;

[0012] The ciphertext and the first public key are constructed as authentication information, and after the terminal device superimposes the start timestamp obtained from the cache of the terminal device, the information is submitted to the server holding the second private key for corresponding authentication, wherein after the server passes the authentication according to the authentication information and the start timestamp, it sends a notification message containing the verification random code to the terminal device;

[0013] Confirming that the terminal device returns the verification random code indicating successful authentication and storing the usage period information for constraining the validity period of the multimedia file stored therein called by the current playback device, includes: receiving the notification message returned by the terminal device, extracting the verification random code therein; comparing the verification random code with the verification random code cached by the current playback device, and confirming that the authentication is successful when the comparison is consistent; after the authentication is successful, receiving the usage period information sent by the terminal device and storing it in the storage medium of the current playback device.

[0014] In a further embodiment, a first private key and a first public key are generated correspondingly, and a symmetric key is generated according to the first private key and a pre-stored second public key, wherein a second private key corresponding to the second public key is held by the server, including the following steps:

[0015] Generate a temporary random number as a first private key, and use an asymmetric encryption algorithm pre-agreed with the server to calculate and determine a first public key corresponding to the first private key;

[0016] Using a key negotiation algorithm pre-agreed with the server, calculating a shared key associated with the second public key and the first private key;

[0017] A preset word length is intercepted from the shared key as a symmetric key.

[0018] In a further embodiment, encrypting the credential information with the symmetric key to obtain the corresponding ciphertext, wherein the credential information includes the device feature code of the current playback device, the verification random code and the start timestamp, comprises the following steps:

[0019] Generate a random verification code;

[0020] Construct the credential information by splicing according to the pre-protocol sequence and the pre-protocol word length, so that the credential information includes the device feature code of the current playback device, the verification random code and the start timestamp;

[0021] The credential information is encrypted with the symmetric key to obtain a corresponding ciphertext.

[0022] In a preferred embodiment, the usage period information includes current date information, effective usage period information of the current playback device, and privileged usage period information associated with the current online user of the terminal device.

[0023] In a preferred embodiment, after confirming that the terminal device returns the verification random code indicating successful authentication and storing the usage period information for constraining the validity period of the multimedia file stored in the current playback device, the following steps are included:

[0024] Receiving and storing a multimedia file transmitted by the terminal device, wherein the multimedia file is a non-encrypted file;

[0025] Storing the multimedia file in a hidden partition of a storage medium of a current playback device;

[0026] In response to a play instruction for the multimedia file, the validity of the expiration date information is verified, and when the verification is valid, the corresponding multimedia file is played.

[0027] In a preferred embodiment, after confirming that the terminal device returns the verification random code indicating successful authentication and storing the usage period information for constraining the validity period of the multimedia file stored in the current playback device, the following steps are included:

[0028] Receiving and storing a multimedia file transmitted by the terminal device, wherein the multimedia file is an encrypted file;

[0029] Storing the multimedia file in a storage medium of a current playback device;

[0030] In response to a play instruction for the multimedia file, the validity of the expiration date information is verified, and when the verification is valid, the corresponding multimedia file is decrypted and played.

[0031] A server device authentication method provided for the purpose of this application includes the following steps:

[0032] Obtaining authentication information submitted by a terminal device and a start timestamp obtained from a cache of the terminal device, wherein the authentication information includes a first public key generated by a playback device electrically connected to the terminal device and a ciphertext obtained by encrypting credential information with a symmetric key, wherein the credential information includes a device feature code of the playback device, a check random code, and the start timestamp, wherein the start timestamp is transmitted from the terminal device to the playback device, the ciphertext is generated at the playback device, and the symmetric key is generated by a first private key corresponding to the first public key and a second public key pre-allocated by a server;

[0033] Decrypt the ciphertext according to the second private key corresponding to the second public key held by the server and the first public key to obtain the credential information;

[0034] Verify that the start timestamp submitted by the terminal device is consistent with the start timestamp in the decrypted credential information;

[0035] Verify the legitimacy of the device feature code according to a preset authorized device library to confirm that the corresponding playback device is a legitimate device;

[0036] When all the above checks are passed, a notification message indicating successful authentication is sent to the terminal device, so that the terminal device forwards it to the playback device, and the notification message includes the verification random code;

[0037] Among them, the terminal device sends the notification message containing the verification random code provided by the server to the playback device to control the playback device to store the usage period information of the online user of the current terminal device, and the usage period information is used to constrain the validity period of the multimedia file stored in the playback device.

[0038] In a further embodiment, decrypting the ciphertext according to the second private key corresponding to the second public key held by the server and the first public key to obtain the credential information comprises the following steps:

[0039] Using a key negotiation algorithm pre-agreed with the playback device, calculate a shared key associated with a second private key corresponding to the second public key held by the server and the first public key of the terminal device;

[0040] Extracting a preset word length from the shared key as a symmetric key;

[0041] The symmetric key is used to decrypt the ciphertext to obtain corresponding credential information.

[0042] A terminal device authentication method provided for the purpose of this application comprises the following steps:

[0043] Transmitting a start timestamp to a playback device electrically connected to the current terminal device to control the playback device to return authentication information, wherein the authentication information includes a first public key generated by the playback device and a ciphertext obtained by encrypting credential information with a symmetric key, wherein the credential information includes a device feature code of the playback device, a check random code, and the start timestamp, and the symmetric key is generated by a first private key corresponding to the first public key and a second public key pre-allocated by a server;

[0044] Submitting the authentication information with the start timestamp obtained from the terminal device cache to the server for authentication;

[0045] After the server passes the authentication based on the authentication information and the starting timestamp, the server sends a notification message containing the verification random code provided by the server to the playback device to control the playback device to store the usage period information of the online user of the current terminal device. The usage period information is used to constrain the validity period of the multimedia files stored in the playback device.

[0046] In a further embodiment, transmitting the start timestamp to a playback device electrically connected to the local device comprises the following steps:

[0047] In response to an access event of the playback device, a verification random code corresponding to the playback device is obtained from a cache for verification by the playback device;

[0048] When the playback device returns a notification message indicating successful verification, a start timestamp is transmitted to the playback device.

[0049] A playback device authentication device proposed for the purpose of this application includes:

[0050] A timestamp receiving module receives a start timestamp transmitted by a terminal device electrically connected to the current playback device;

[0051] A key generation module, correspondingly generating a first private key and a first public key, generating a symmetric key according to the first private key and a pre-stored second public key, wherein a second private key corresponding to the second public key is held by the server;

[0052] A ciphertext construction module, encrypting the credential information with the symmetric key to obtain a corresponding ciphertext, wherein the credential information includes a device feature code of the current playback device, a verification random code, and the start timestamp;

[0053] The server authentication module constructs the ciphertext and the first public key into authentication information, and after the terminal device superimposes the start timestamp obtained from the cache of the terminal device, submits it to the server holding the second private key for corresponding authentication, wherein the server sends a notification message containing the verification random code to the terminal device after the authentication is passed according to the authentication information and the start timestamp;

[0054] The authentication completion module confirms that the terminal device returns the verification random code indicating successful authentication and stores the usage period information for constraining the validity period of the multimedia files stored therein called by the current playback device, including: receiving the notification message returned by the terminal device and extracting the verification random code therein; comparing the verification random code with the verification random code cached by the current playback device, and confirming that the authentication is successful when the comparison is consistent; after the authentication is successful, receiving the usage period information sent by the terminal device and storing it in the storage medium of the current playback device.

[0055] A server device authentication device proposed for the purpose of this application includes:

[0056] an authentication preparation module, which obtains authentication information submitted by a terminal device and a start timestamp obtained from a cache of the terminal device, wherein the authentication information includes a first public key generated by a playback device electrically connected to the terminal device and a ciphertext obtained by encrypting credential information with a symmetric key, wherein the credential information includes a device feature code of the playback device, a check random code, and the start timestamp, wherein the start timestamp is transmitted from the terminal device to the playback device, the ciphertext is generated at the playback device, and the symmetric key is generated by a first private key corresponding to the first public key and a second public key pre-allocated by a server;

[0057] A ciphertext decryption module, decrypting the ciphertext according to a second private key corresponding to the second public key held by the server and the first public key to obtain the credential information;

[0058] A timestamp verification module, verifying and confirming that the starting timestamp submitted by the terminal device is consistent with the starting timestamp in the credential information obtained by decryption;

[0059] The device verification module verifies the legitimacy of the device feature code according to the preset authorized device library and confirms that the corresponding playback device is a legitimate device;

[0060] A notification forwarding module, when all the above checks are passed, sends a notification message indicating successful authentication to the terminal device, so that the terminal device forwards it to the playback device, and the notification message includes the verification random code;

[0061] Among them, the terminal device sends the notification message containing the verification random code provided by the server to the playback device to control the playback device to store the usage period information of the online user of the current terminal device, and the usage period information is used to constrain the validity period of the multimedia file stored in the playback device.

[0062] A terminal device authentication device proposed for the purpose of this application includes:

[0063] an authentication information interaction module, transmitting a start timestamp to a playback device electrically connected to the current terminal device, so as to control the playback device to return authentication information, wherein the authentication information includes a first public key generated by the playback device and a ciphertext obtained by encrypting credential information with a symmetric key, wherein the credential information includes a device feature code of the playback device, a check random code, and the start timestamp, and the symmetric key is generated by a first private key corresponding to the first public key and a second public key pre-allocated by a server;

[0064] The server authentication module superimposes the authentication information with the start timestamp obtained from the terminal device cache and submits it to the server for authentication;

[0065] The authentication completion module sends a notification message including the verification random code provided by the server to the playback device after the server passes the authentication according to the authentication information and the starting timestamp, so as to control the playback device to store the usage period information of the online user of the current terminal device, and the usage period information is used to constrain the validity period of the multimedia files stored in the playback device.

[0066] A computer device provided to meet one of the purposes of the present application includes a central processing unit and a memory, wherein the central processing unit is used to call and run a computer program stored in the memory to execute the steps of the device authentication method described in the present application.

[0067] A computer-readable storage medium is provided to meet another purpose of the present application, which stores a computer program implemented according to the device authentication method in the form of computer-readable instructions. When the computer program is called and executed by a computer, the steps included in the method are executed.

[0068] A computer program product provided to meet another purpose of the present application includes a computer program / instruction, which, when executed by a processor, implements the steps of the device authentication method described in any embodiment of the present application.

[0069] Compared with the prior art, the advantages of this application are as follows:

[0070] First, the present application uses software encryption algorithms and terminal devices to coordinate the playback device and the server to perform encryption and decryption operations on the network for the corresponding authentication data, and safely and reliably implements the authorization verification of the playback device. Compared with the hardware decryption method in the prior art, it has the advantages of strong operability, convenient authentication, convenient maintenance, and lower cost. The authorized playback device can perform operations such as authentication, downloading, importing, and exporting of genuine multimedia files through the entire business chain of the terminal device connected to it, which is very efficient.

[0071] Secondly, in this application, the server pre-generates the second private key and the corresponding second public key, saves the second private key and assigns the corresponding second public key to the playback device. Each time the authentication communication starts, the playback device temporarily generates the first private key and the corresponding first public key, saves the first private key and assigns the second public key to the server. At this point, the server and the playback device can obtain the same shared key through the key negotiation algorithm, and then both parties obtain the same symmetric key through a pre-agreement method for symmetric encryption and decryption. It can be seen that due to the temporary generation of the first private key and the corresponding first public key, the symmetric key is different each time. If attacked, it only affects the current authentication communication and will not affect other authentication communication content, thereby improving forward security. Furthermore, when the server and the playback device both obtain the symmetric key, the temporarily generated first private key and the first public key can be deleted accordingly. After that, even if both parties are attacked and obtain the second public key and the second private key, they cannot obtain the symmetric key to decrypt the ciphertext, further improving the current authentication communication security. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0073] Figure 1 A flowchart of a typical embodiment of the playback device authentication method of the present application;

[0074] Figure 2 A schematic diagram of a process for generating a symmetric key by a playback device in an embodiment of the present application;

[0075] Figure 3 A schematic diagram of a process for encrypting and generating ciphertext by a playback device in an embodiment of the present application;

[0076] Figure 4 A schematic diagram of the process of reverse authentication of a playback device in an embodiment of the present application;

[0077] Figure 5 A schematic diagram of a process of playing a multimedia file by a playback device with weak decryption capability in an embodiment of the present application;

[0078] Figure 6 A schematic diagram of a process of playing a multimedia file by a playback device with strong decryption capability in an embodiment of the present application;

[0079] Figure 7 A flowchart of a typical embodiment of the server device authentication method of the present application;

[0080] Figure 8 A schematic diagram of a process of decrypting a ciphertext by a server in an embodiment of the present application;

[0081] Fig. 9 A flowchart of a typical embodiment of the terminal device authentication method of the present application;

[0082] Fig.10 A schematic diagram of the process of caching authentication and transmitting a start timestamp in an embodiment of the present application;

[0083] Fig.11 From left to right are the principle block diagrams of typical embodiments of the playback device, server device, and terminal device authentication device of the present application;

[0084] Fig.12 The figure is a schematic diagram of the structure of a computer device used in this application. DETAILED DESCRIPTION

[0085] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0086] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0087] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in common dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0088] It will be understood by those skilled in the art that the "client", "terminal" and "terminal device" used herein include both devices with wireless signal receivers, which are devices with only wireless signal receivers without transmission capabilities, and devices with receiving and transmitting hardware, which are devices with receiving and transmitting hardware capable of two-way communication on a two-way communication link. Such devices may include: cellular or other communication devices such as personal computers, tablet computers, which have single-line displays or multi-line displays or cellular or other communication devices without multi-line displays; PCS (Personal Communications Service, personal communication system), which can combine voice, data processing, fax and / or data communication capabilities; PDA (Personal Digital Assistant, personal digital assistant), which may include a radio frequency receiver, pager, Internet / intranet access, web browser, notepad, calendar and / or GPS (Global Positioning System, global positioning system) receiver; conventional laptop and / or palmtop computers or other devices, which have and / or include a conventional laptop and / or palmtop computer or other device with and / or including a radio frequency receiver. The "client", "terminal" and "terminal device" used herein may be portable, transportable, installed in a vehicle (air, sea and / or land), or suitable and / or configured to run locally, and / or in a distributed form, at any other location on the earth and / or in space. The "client", "terminal" and "terminal device" used herein may also be a communication terminal, an Internet terminal, a music / video playback terminal, such as a PDA, a MID (Mobile Internet Device) and / or a mobile phone with a music / video playback function, or a smart TV, a set-top box and other devices.

[0089] The hardware referred to by the names such as "server", "client", and "service node" in this application is essentially an electronic device with capabilities equivalent to those of a personal computer. It is a hardware device that has the necessary components revealed by the von Neumann principle, such as a central processing unit (including an arithmetic unit and a controller), a memory, an input device, and an output device. The computer program is stored in its memory, and the central processing unit calls the program stored in the external memory into the internal memory for execution, executes the instructions in the program, and interacts with the input and output devices to complete specific functions.

[0090] It should be pointed out that the concept of "server" referred to in this application can also be extended to the case of server clusters. According to the network deployment principle understood by those skilled in the art, the servers should be logically divided. In physical space, these servers can be independent of each other but can be called through interfaces, or integrated into a physical computer or a set of computer clusters. Those skilled in the art should understand this flexibility, and should not use it to restrict the implementation of the network deployment method of this application.

[0091] Unless expressly specified, one or more technical features of the present application can be deployed on a server for implementation and accessed by a client through a remote call to obtain an online service interface provided by the server, or can be directly deployed and run on a client for access.

[0092] The neural network models cited or may be cited in this application, unless expressly specified, can be deployed on a remote server and remotely called on the client, or can be deployed on a client with sufficient device capabilities and directly called. Those skilled in the art should understand that as long as the device operating resources are qualified, they can be used as model training devices and model operating devices corresponding to the neural network model. In some embodiments, when it runs on the client, its corresponding intelligence can be obtained through transfer learning, so as to reduce the requirements for the client hardware operating resources and avoid excessive occupation of the client hardware operating resources.

[0093] Unless explicitly specified, the various data involved in this application can be stored remotely on a server or on a local terminal device, as long as it is suitable for being called by the technical solution of this application.

[0094] Those skilled in the art should be aware that, although the various methods of the present application are described based on the same concept and thus present commonality to each other, unless otherwise specified, these methods can be independently executed. Similarly, for each embodiment disclosed in the present application, they are all proposed based on the same inventive concept, therefore, concepts with the same expression, and concepts that are appropriately changed for convenience despite different expressions, should be understood as equivalent.

[0095] Unless the mutually exclusive relationship between the embodiments to be disclosed in this application is explicitly stated, the relevant technical features involved in each embodiment can be cross-combined to flexibly construct a new embodiment, as long as such combination does not deviate from the creative spirit of this application and can meet the needs of the prior art or solve certain deficiencies in the prior art. Those skilled in the art should be aware of this flexibility.

[0096] The various device authentication methods of the present application can be programmed as computer program products and deployed in terminal devices, playback devices, and servers for execution and implementation.

[0097] See also Figure 1 The present application discloses a playback device authentication method, in its typical embodiment, including steps S1100 to S1500, which are as follows:

[0098] Step S1100, receiving a start timestamp transmitted by a terminal device electrically connected to the current playback device;

[0099] The terminal device is electrically connected to the current playback device, and uses the OTG function to transmit the start timestamp data to the playback device.

[0100] The starting timestamp data is an initial timestamp obtained when the APP pre-loaded on the terminal device accesses its corresponding server device. In an exemplary implementation, the initial timestamp is four-byte data, representing year, month, and day respectively.

[0101] The OTG function usually appears on terminal devices such as tablets and mobile phones. The full name is USB On-The-Go. It can use terminal devices such as tablets and mobile phones as a host, and other USB devices as USB peripherals (such as U disk, playback device, etc.) connected to terminal devices such as mobile phones and tablets through OTG adapters, so that the OTG function can build a data transmission channel between terminal devices such as mobile phones and tablets and USB peripheral devices, and can directly read and write data of USB peripheral devices. The OTG connection line is generally a data line that electrically connects the terminal device and the corresponding USB peripheral device. The interface at one end of the terminal device is generally Type-C, Micro USB, Lightning interface, and the interface at one end of the USB peripheral device is generally Type-C, MicroUSB, USB 2.0 / 3.0 / 3.1 interface.

[0102] Step S1200, correspondingly generating a first private key and a first public key, generating a symmetric key according to the first private key and a pre-stored second public key, wherein a second private key corresponding to the second public key is held by the server;

[0103] The server generates a second public key PubkeyA and a second private key PrikeyA in advance through a pre-agreed asymmetric encryption algorithm, and pre-assigns the second public key PrikeyA to the playback device (usually the assignment is completed when the playback device leaves the factory), and the corresponding second private key PrikeyA is marked and associated with its corresponding second public key PubkeyA and stored in the server.

[0104] After receiving the start timestamp, the playback device starts the authentication business logic. Driven by this business logic, the playback device also uses the asymmetric encryption algorithm pre-agreed with the server to generate the first private key PrikeyB, and correspondingly generates the first public key PubkeyB, which can be subsequently distributed to the server. Accordingly, for the server and the playback device, both parties hold the public key generated by the other party, and both of them hold the corresponding private key. To this end, the two parties use the ECDH key negotiation algorithm to calculate the same shared key, and process the shared key in the same way to obtain the same symmetric private key. Finally, the symmetric private key is used to realize the symmetric encryption and decryption of the credential information by the communicating parties, thereby realizing secure communication.

[0105] The symmetric encryption algorithm is also called a shared key encryption algorithm. In a symmetric encryption algorithm, only one key is used, and both the sender and the receiver use the same key to encrypt and decrypt data. It is required that both the encrypting and decrypting parties must know the encryption key in advance.

[0106] The asymmetric encryption algorithm is also called a public key encryption algorithm. It requires two keys, one is called a public key, and the other is called a private key.

[0107] Step S1300, encrypting the credential information with the symmetric key to obtain a corresponding ciphertext, wherein the credential information includes a device feature code of the current playback device, a device MAC address, a verification random code, and the start timestamp;

[0108] The playback device calculates a shared key based on the second public key PubkeyA pre-assigned by the server and the first private key PrikeyB generated by itself, and obtains the corresponding symmetric key by intercepting the shared key in a pre-agreed manner with the server. The playback device uses the symmetric key to encrypt the credential information according to the symmetric encryption algorithm pre-agreed with the server to obtain the corresponding ciphertext.

[0109] The credential information mainly includes the device feature code of the current playback device, the device MAC address, the verification random code and the start timestamp. In other embodiments, other components, such as product feature codes, etc., can also be flexibly added.

[0110] The device feature code may be a device MAC address. Each playback device corresponds to a unique MAC address, which facilitates accurate identification of the playback device by means of the MAC address.

[0111] The verification random code can be a random number generated by the playback device as a verification random code, which is used as a verification random code required for authentication verification between multiple devices and can be stored in the cache of each device.

[0112] The start timestamp is the start timestamp transmitted by the terminal device when the playback device receives it, and is used to indicate the start time point of authentication between the current devices. Similarly, it can also be used as one of the authentication bases.

[0113] Step S1400, constructing the ciphertext and the first public key into authentication information, and submitting the authentication information to the server holding the second private key after the terminal device superimposes the start timestamp obtained from the cache of the terminal device for corresponding authentication, wherein the server sends a notification message containing the verification random code to the terminal device after passing the authentication according to the authentication information and the start timestamp;

[0114] The server needs to obtain the same symmetric key through the second private key it holds and the first public key of the playback device to symmetrically decrypt the ciphertext. For this purpose, the playback device needs to transmit the first public key it generates and the ciphertext to the server.

[0115] Since the playback device may be captured and the start timestamp may be tampered with during the process of receiving the start timestamp transmitted by the terminal device, or the playback device may be attacked during the process of transmitting the ciphertext, the ciphertext is decrypted and the start timestamp therein is changed. Therefore, in order to ensure the accuracy of the start timestamp, the terminal device will obtain the start timestamp from the cache and transmit it to the server for authentication. The server will compare the start timestamp in the decrypted ciphertext with the timestamp transmitted by the terminal device to verify whether the start timestamps are the same.

[0116] Step S1500, confirming that the terminal device returns the verification random code indicating successful authentication and storing the usage period information to constrain the validity period of the multimedia file stored therein when the current playback device calls it.

[0117] The multimedia files are audio files or video files. Audio files include mp3, m4a, wma, ogg, aac, wav, ape, flac, and video files include avi, dat, mkv, flv, vob and other format files.

[0118] The server decrypts the ciphertext to obtain the corresponding plaintext credential information, authenticates the legitimacy of the verification random code and the device feature code in the credential information, and after successful authentication, returns authentication success information and the verification random code to the terminal device.

[0119] The terminal device receives the successful authentication reply and sends the verification random code to the playback device for further authentication.

[0120] The playback device obtains the verification random code from the cache and compares it with the verification random code sent back by the terminal device to confirm that the two verification random codes are the same random code. At this point, the playback device successfully reversely authenticates and reaches a handshake agreement with the terminal device, and stores the verification random code in the cache, so that the playback device can quickly authenticate when it reconnects with the terminal device within a certain period of time.

[0121] After successful authentication, the playback device performs a sign-in operation on the multimedia APP loaded on the terminal device, generates a ReportDate file on the playback device, records the usage period information and the user account privilege usage period, and the ReportDate file is stored in the storage medium of the playback device after generation. The usage period information includes the sign-in date and validity period. During the validity period, the playback device has the authority to call the multimedia files stored therein. After the validity period expires, the playback device needs to re-authenticate with the terminal device through an OTG connection to regain the authority.

[0122] The user account privilege usage period is the privilege usage period of the current user account obtained by the terminal device accessing the server, and is used to limit the multimedia files related to privileges that can be called by the playback device within the current privilege usage period. In specific applications, it can be expressed as the privilege usage period corresponding to VIP users.

[0123] This typical embodiment reflects the advantages of the present application. Through the software encryption algorithm and the terminal device coordinating the playback device and the server to perform the corresponding authentication data encryption and decryption operations on the network, the authorization verification of the playback device is realized safely and reliably. Compared with the hardware decryption method in the prior art, it has the advantages of strong operability, convenient authentication, convenient maintenance, and lower cost. The authorized playback device can perform operations such as authentication, downloading, importing, and exporting of genuine multimedia files through the entire business chain of the terminal device connected to it, which is very efficient.

[0124] Furthermore, the server pre-generates a second private key and a corresponding second public key, saves the second private key and assigns the corresponding second public key to the playback device. Each time the authentication communication starts, the playback device temporarily generates a first private key and a corresponding first public key, saves the first private key and assigns the second public key to the server. At this point, the server and the playback device can obtain the same shared key through the key negotiation algorithm, and then both parties obtain the same symmetric key through a pre-agreement method for symmetric encryption and decryption. It can be seen that due to the temporary generation of the first private key and the corresponding first public key, the symmetric key is different each time. If attacked, it will only affect the current authentication communication and will not affect other authentication communication content, thereby improving forward security. Furthermore, when both the server and the playback device obtain the symmetric key, the temporarily generated first private key and the first public key can be deleted accordingly. After that, even if both parties are attacked and obtain the second public key and the second private key, they cannot obtain the symmetric key to decrypt the ciphertext, thereby further improving the current authentication communication security.

[0125] See also Figure 2 In a further embodiment, a first private key and a first public key are generated correspondingly, and a symmetric key is generated according to the first private key and a pre-stored second public key, wherein a second private key corresponding to the second public key is held by the server, including the following steps:

[0126] Step S1210, generating a temporary random number as a first private key, and using an asymmetric encryption algorithm pre-agreed with the server to calculate and determine a first public key corresponding to the first private key;

[0127] The playback device uses an asymmetric encryption algorithm pre-agreed with the server to generate a first private key PrikeyB and its corresponding first public key PubkeyB. In this embodiment, the asymmetric encryption algorithm is recommended to use the ECC algorithm, which is specifically executed according to the ECC elliptic curve using P-192 in FIPS 186-2, and a 24-byte random number is temporarily generated as the first private key PrikeyB through a random number generation method, and the corresponding 48-byte first public key PubkeyB is generated according to the first private key PrikeyB and the generator parameter G of the elliptic curve.

[0128] Step S1220, using a key negotiation algorithm pre-agreed with the server to calculate a shared key associated with the second public key and the first private key;

[0129] For the first private key PrikeyB, the first public key PubkeyB and the second private key PrikeyA, the second public key PubkeyA, the two pairs of keys are generated using the same ECC algorithm to select the same elliptic curve equation and the generator parameter G, that is, the encryption party's playback device and the decryption party's server device have common ECDH shared parameters before the EDCH key negotiation. Therefore, through the pre-agreement ECDH key negotiation algorithm, the playback device receives the second public key PubkeyA generated by the server and combines it with the first private key PrikeyB generated by itself to calculate the 24-Byte shared key DHkey. According to the elliptic curve associative law, the server can also use the pre-agreement ECDH key negotiation algorithm to obtain the same shared key DHkey according to the corresponding public key and private key.

[0130] Step S1230, extracting a preset word length from the shared key as a symmetric key.

[0131] In this embodiment, according to the pre-agreement between the playback device and the server device, the first 16 bytes of the 24-byte shared key DHkey are intercepted as the symmetric key Aeskey, and the playback device uses the pre-agreement symmetric encryption algorithm to encrypt the credential information using the symmetric key Aeskey to generate the corresponding ciphertext.

[0132] In this embodiment, the server pre-generates the second private key and the corresponding second public key using the ECC asymmetric encryption algorithm, and pre-assigns the second public key to the playback device. Both parties save the second public key and the second private key to their corresponding storage media. In order to obtain the corresponding symmetric key using the ECDH key negotiation algorithm, the playback device uses the pre-agreement ECC asymmetric encryption algorithm to temporarily generate the required first private key and the corresponding first public key, and assigns the first public key to the server. After the two parties negotiate a shared key, they can delete the first private key and the corresponding first public key respectively. Since the first private key and the first public key are temporary, even if the second private key and the second public key are obtained under attack, they cannot be combined with the first private key and the first public key to use the ECDH algorithm to decrypt and obtain the ciphertext. The encryption and decryption operations are scientifically and rationally relied on to ensure the information security between the server and the playback device.

[0133] See also Figure 3 In a further embodiment, encrypting the credential information with the symmetric key to obtain the corresponding ciphertext, the credential information including the device feature code of the current playback device, the verification random code and the start timestamp, comprises the following steps:

[0134] Step S1310, generating a random verification code;

[0135] The playback device generates an 8-Byte random number as a verification random code through a random number generation method.

[0136] Step S1320, constructing the credential information according to the pre-protocol sequence and the pre-protocol word length, so that the credential information includes the device feature code of the current playback device, the verification random code and the start timestamp;

[0137] The 6-byte device feature code, i.e., MAC address, the 4-byte start timestamp, the 8-byte check random code, and the 4-byte product feature code PID are sequentially concatenated to form 22-byte plaintext credential information, which is then padded to 32 bytes by adding 0s.

[0138] Step S1330: encrypt the credential information with the symmetric key to obtain a corresponding ciphertext.

[0139] The playback device adopts the AES encryption algorithm pre-agreed with the server, and inputs the plaintext credential information and the symmetric key Aeskey as parameters of the AES encryption function to obtain a function output result of 32-Byte ciphertext. The AES algorithm is a symmetric encryption algorithm that implements encryption and decryption of plaintext and ciphertext through a symmetric key.

[0140] In this embodiment, compared with directly transmitting the credential information over the network, the credential information can be obtained by capturing packets during network transmission. Since the credential information content can be directly read without encryption, the playback device calls the AES encryption algorithm to symmetrically encrypt the credential information and convert it into corresponding ciphertext, which effectively increases the difficulty of obtaining the credential information content and provides strong scientific and reliable credential information security protection.

[0141] See also Figure 4 In a preferred embodiment, confirming that the terminal device returns the verification random code indicating successful authentication and storing the usage period information to constrain the validity period of the multimedia file stored in the current playback device includes the following steps:

[0142] Step S1510, receiving the notification message sent back by the terminal device, and extracting the verification random code therein;

[0143] Playback devices generally use the SCSI protocol for communication, and the communication method is USB Bulk-Only transmission, that is, the SCSI command is packaged in a bulk data packet and sent from the host to the playback device. For this purpose, the playback device and the terminal device pre-agree on the SCSI command, the data structure of the CBW packet, and the reply code in the communication process, so as to perform request and reply operations between devices. The corresponding reply and request formats for the same command words are basically the same, which can facilitate the playback device to process data. One data structure can represent the reply and request.

[0144] The playback device communicates with the terminal device by using the SCSI protocol through a pre-agreement, and receives a command word of 121 reverse authentication request and a random verification code issued.

[0145] Step S1520, comparing the verification random code with the verification random code cached by the current playback device, and when they are consistent, confirming that the authentication is successful;

[0146] The playback device generates a verification random code and stores it in a cache when receiving an authentication request with a command word of 120 sent by the terminal device, and takes the verification random code out of the cache when receiving a reverse authentication request with a command word of 121 sent by the terminal device.

[0147] The verification random code in the playback device cache is reversely authenticated with the verification random code issued by the terminal device. If the two sides are consistent, the reverse authentication is successful, and the device sends a command word of 121 to reply to the terminal device for successful reverse authentication; otherwise, if the two sides are inconsistent, the reverse authentication fails, and the device sends a command word of 121 to reply to the reverse authentication failure and the corresponding reply code.

[0148] Step S1530, after successful authentication, receiving the usage period information sent by the terminal device and storing it in the storage medium of the current playback device, the usage period information includes the current date information, the effective usage period information of the current playback device, and the privileged usage period information associated with the current online user of the terminal device.

[0149] After receiving the command word 121, the terminal device reaches a handshake agreement with the playback device. The playback device receives the usage period information and generates a corresponding file based on it and stores it in the memory. The current date is the sign-in time on the terminal device after the handshake, the current device effective usage period information is the effective time of the handshake agreement, and the user account privilege usage period is the privilege usage period of the current user account obtained by the terminal device accessing the server, which is used to limit the playback device to call privilege-related multimedia files within the current privilege usage period.

[0150] In this embodiment, the playback device reaches a handshake agreement with the terminal device through reverse authentication, thereby allowing the playback device to perform related operations of multimedia files through requests and replies between the playback device and the terminal device, and safely and scientifically opening the interaction rights between the playback device and the terminal device. According to the expiration date information, the playback device itself can accurately control the calling rights of the related multimedia files in its storage.

[0151] See also Figure 5 In a preferred embodiment, after confirming that the terminal device returns the verification random code indicating successful authentication and storing the validity period information for constraining the current playback device to call the validity period of the multimedia file stored therein, the following steps are included:

[0152] Step S1600, receiving and storing a multimedia file transmitted by the terminal device, wherein the multimedia file is a non-encrypted file;

[0153] Due to the different decoding capabilities of different playback devices, playback devices with weaker decoding capabilities can only store and play non-encrypted multimedia files.

[0154] In one embodiment, the playback device and the terminal device reach a handshake agreement through authentication, and then the playback device sends a request to download the multimedia file to the terminal device. The terminal device responds to the request, accesses the server to obtain the multimedia file download link in the request, uses the network to download and specifies the download storage address as the storage address corresponding to the playback device, and the playback device receives and stores the multimedia file through the OTG connection with the terminal device.

[0155] In another embodiment, the playback device and the terminal device reach a handshake agreement through authentication, and then the playback device sends a request to download the multimedia file to the terminal device. The terminal device responds to the request, obtains the corresponding multimedia file requested to be downloaded in advance from the memory, packages it into a data packet and sends it to the playback device, and the playback device receives the data packet and stores the multimedia file therein accordingly.

[0156] Step S1601, storing the multimedia file in a hidden partition of a storage medium of a current playback device;

[0157] The hidden partition is a hidden partition that can only be identified through a certain protocol divided by the playback device in its storage medium. The multimedia file is stored in the hidden partition. The multimedia file stored in the hidden partition will be accompanied by a file information, which is recorded in an information recording file. The file is stored in the same level directory as the multimedia file. The file contains the check-in time, the expiration date, the multimedia file details information, and the md5 data.

[0158] The check-in time is corrected and updated by the start timestamp issued by the playback device and the terminal device through authentication.

[0159] Step S1602, in response to a play instruction for the multimedia file, verifying the validity of the usage period information, and playing the corresponding multimedia file when the verification is valid.

[0160] The playback device system responds to the playback instruction of the multimedia file, queries the md5 data corresponding to the multimedia file in the information record file of the hidden partition, and calculates the hash value of each multimedia file to be played using the MD5 algorithm as the md5 data. The data for calculating the hash value may include the multimedia file itself and its related information, including its storage date, expiration date, etc., which can be flexibly set according to needs. After the hash value is calculated, the md5 data of the multimedia file is compared. If the two are consistent, the playback is allowed, otherwise the playback is not allowed.

[0161] The md5 data is a string of data consisting of a 16-byte random number generated by the MD5 algorithm when the multimedia file is downloaded, and the md5 data corresponding to each multimedia file is different.

[0162] In this embodiment, compared with the cumbersome operation of operating a computer to export multimedia files and then importing them into a playback device, since the playback device successfully reversely authenticates and reaches a handshake agreement with the terminal device, a secure and reliable data communication channel is established between the two parties, and the playback device downloads the multimedia files through the terminal device. This operation is simpler and ensures the security of the multimedia files during the data transmission process. The corresponding md5 data is calculated by the MD5 algorithm for each multimedia file as a verification identifier, and the validity of the corresponding multimedia file is quickly and accurately verified based on this.

[0163] See also Figure 6 In a preferred embodiment, after confirming that the terminal device returns the verification random code indicating successful authentication and storing the validity period information for constraining the current playback device to call the validity period of the multimedia file stored therein, the following steps are included:

[0164] Step S1610, receiving and storing a multimedia file transmitted by the terminal device, wherein the multimedia file is an encrypted file;

[0165] Due to the different decoding capabilities of different playback devices, for playback devices with strong decoding capabilities, there is no need to divide the storage partitions additionally. The encrypted multimedia files can be directly stored and decrypted with the corresponding decryption library for playback.

[0166] In one embodiment, the encrypted multimedia file is a kgm encryption mode file, and a specific decryption library is used to perform XOR calculations, thereby quickly decrypting and restoring the multimedia file.

[0167] In another embodiment, the playback device and the terminal device reach a handshake agreement, and then the playback device sends a request to download the multimedia file to the terminal device. The terminal device responds to the request, obtains the corresponding multimedia file requested to be downloaded in advance from the memory, encrypts it accordingly, packages it into a data packet and sends it to the playback device, and the playback device receives the data packet and decrypts and stores the encrypted multimedia file therein accordingly.

[0168] Step S1611, storing the multimedia file in the storage medium of the current playback device;

[0169] The encrypted multimedia file is stored in the memory of the playback device, and the playback device system calls the corresponding decryption library to decrypt the encrypted multimedia file, thereby restoring the multimedia file and transferring it to the hard disk of the playback device, and writing the file information of the multimedia file in the information recording file.

[0170] The information recording file is a file generated by the playback device. The file is stored in the same directory as the multimedia file, and the file content includes the check-in time, the expiration date, the multimedia file details information, and the md5 data.

[0171] The check-in time is corrected and updated by the start timestamp issued by the playback device and the terminal device through authentication.

[0172] Step S1612, in response to the play instruction acting on the multimedia file, verify the validity of the usage period information, and when the verification is valid, decrypt and play the corresponding multimedia file.

[0173] The playback device system responds to the playback instruction of the multimedia file, uses the MD5 algorithm to calculate the md5 data corresponding to the media file and compares it with the md5 data of the multimedia file corresponding to the information recording file on the hard disk. If the md5 data are the same, the verification is valid and the corresponding multimedia file is played; if the md5 data are different, the verification is invalid and the corresponding multimedia file cannot be played.

[0174] In this embodiment, the playback device and the terminal device reach a handshake agreement, establish a secure and reliable data communication channel between the two parties, and then transmit the encrypted multimedia file, which increases the difficulty of obtaining the multimedia source file and provides a strong guarantee for the data security of the multimedia file.

[0175] See also Figure 7 The present application discloses a server device authentication method, in its typical embodiment, including steps S2100 to S2500, which are as follows:

[0176] Step S2100, obtaining authentication information submitted by the terminal device and a start timestamp obtained from a cache of the terminal device, wherein the authentication information includes a first public key generated by a playback device electrically connected to the terminal device and a ciphertext obtained by encrypting the credential information with a symmetric key, wherein the credential information includes a device feature code of the playback device, a check random code, and the start timestamp, wherein the start timestamp is transmitted from the terminal device to the playback device, the ciphertext is generated at the playback device, and the symmetric key is generated by a first private key corresponding to the first public key and a second public key pre-allocated by a server;

[0177] The server uses an asymmetric encryption algorithm pre-agreed with the playback device to generate a second private key PrikeyA and its corresponding second public key PubkeyA. The asymmetric encryption algorithm is an ECC algorithm, which is specifically executed according to the ECC elliptic curve using P-192 in FIPS186-2. A 24-Byte random number is temporarily generated as the second private key PrikeyA through a random number generation method, and a corresponding 48-Byte second public key PubkeyA is generated according to the second private key PrikeyA and the elliptic curve generation meta-parameter G. The server pre-assigns the second public key PubkeyA to the playback device, and stores the corresponding second private key PrikeyA in association with the second public key in the memory.

[0178] The starting timestamp of the terminal device is obtained by the terminal device accessing the server before authentication. The starting timestamp is currently sent to the server for comparison and verification with the starting timestamp in the ciphertext.

[0179] Step S2200, decrypting the ciphertext according to the second private key corresponding to the second public key held by the server and the first public key to obtain the credential information;

[0180] For the first private key PrikeyB, the first public key PubkeyB, the first private key PrikeyA, and the second public key PubkeyA, the two pairs of keys are generated using the same ECC algorithm to select the same elliptic curve equation and the generator parameter G, that is, the encrypting party's playback device and the decrypting party's server device have common ECDH shared parameters before the EDCH key negotiation. Therefore, through the pre-agreement ECDH key negotiation algorithm, the server calculates the 24-Byte shared key DHkey based on the first public key PubkeyB generated by the playback device and the second private key PrikeyA held by itself. According to the elliptic curve associative law, the shared key DHkey is actually the same as the DHkey generated by the playback device to encrypt the ciphertext. Further, the server performs the same operation as the playback device to generate the corresponding symmetric key on the shared key DHkey. For this reason, the symmetric key obtained by the server is the same as the symmetric key used by the playback device during encryption. Based on this, the ciphertext can be decrypted through the pre-agreement AES symmetric encryption algorithm to obtain the corresponding credential information.

[0181] Step S2300, verifying and confirming that the start timestamp submitted by the terminal device is consistent with the start timestamp in the credential information obtained by decryption;

[0182] After decryption, the server device obtains the start timestamp in the credential information and performs an XOR calculation with the start timestamp sent by the terminal device. If the calculation result is 1, it means that the two start timestamps are the same and the verification result is consistent; if the calculation result is not 1, it means that the two start timestamps are different and the verification result is inconsistent.

[0183] Step S2400, verifying the legitimacy of the device feature code according to a preset authorized device library, and confirming that the corresponding playback device is a legitimate device;

[0184] After decryption, the server device obtains the device feature code (some embodiments, and PID) in the credential information. The PID is a product identification code. Each playback device product is assigned a corresponding unique identification code when it leaves the factory. Therefore, the server quickly locates the model series of the playback device in the authorized device library through the PID, and then verifies whether there is a MAC address identical to the device feature code in the authorized device library belonging to the PID. If so, the MAC address is a legal address, confirming that the corresponding playback device is a legal device; if so, the MAC address is an illegal address, confirming that the corresponding playback device is an illegal device.

[0185] Step S2500: When all the above checks are passed, a notification message indicating successful authentication is sent to the terminal device, so that the terminal device forwards it to the playback device, and the notification message includes the verification random code.

[0186] After the server verifies that the starting timestamp verification is the same and the device feature code verification is legal, a notification message of successful authentication is sent to the terminal device as a reply, and the verification random code obtained after decrypting the ciphertext is returned. The terminal device communicates with the playback device using the SCSI protocol, sends a reverse authentication request with a command word of 121, and issues the verification random code required for reverse authentication to the playback device.

[0187] In this embodiment, the server ECC asymmetric encryption algorithm generates a second private key and a corresponding second public key, and obtains a symmetric key that is the same as the symmetric key used when encrypting the playback device based on the second private key and the first public key, and obtains the corresponding credential information by decrypting the symmetric key using the AES symmetric encryption algorithm, and then authenticates the start timestamp and device feature code therein, thereby ensuring the security of the credential information.

[0188] See also Figure 8 In a further embodiment, decrypting the ciphertext according to the second private key corresponding to the second public key held by the server and the first public key to obtain the credential information comprises the following steps:

[0189] Step S2210, using a key negotiation algorithm pre-agreed with the playback device to calculate a shared key associated with a second private key corresponding to the second public key held by the server and the first public key of the terminal device;

[0190] The method in which the server and the playback device pre-agree to obtain a shared key through the ECDH key negotiation algorithm is specifically implemented as follows: the two parties generate two corresponding pairs of private keys and corresponding public keys respectively by sharing EDCH parameters, and then the two parties exchange their own generated public keys and thereby obtain the other party's public key. Through the key negotiation algorithm, the two parties calculate the same shared key according to the private keys generated by themselves and the other party's public keys obtained from the exchange.

[0191] The shared EDCH parameters are that the server and the playback device pre-agree to use the same ECC asymmetric encryption algorithm and the same set of parameters required accordingly, that is, the same elliptic curve equation and generator parameter G.

[0192] Therefore, the server calculates the second private key PrikeyA generated by itself through the ECDH key agreement algorithm, and the first public key PubkeyB corresponding to the first private key generated by the playback device transmitted by the terminal device to calculate the same shared key used by the playback device to generate symmetric key encryption.

[0193] Step S2220, extracting a preset word length from the shared key as a symmetric key;

[0194] The server obtains the symmetric key in the same way as the playback device, that is, the first 16 bytes of the 24-byte shared key DHkey are intercepted as the symmetric key Aeskey. As can be seen from the above, the shared key DHkey of the server and the playback device is the same, and both parties obtain the symmetric key in the same way, so the symmetric keys of both parties are also the same.

[0195] Step S2230: Decrypt the ciphertext using the symmetric key to obtain corresponding credential information.

[0196] Since the symmetric keys of the playback device and the server are the same, when the playback device uses the symmetric key to encrypt the credential information into corresponding ciphertext through the AES symmetric encryption algorithm, the corresponding server can use the symmetric key to decrypt the ciphertext through the AES symmetric encryption algorithm to obtain the credential information.

[0197] In this implementation, the playback device and the server both use the ECDH key negotiation algorithm, and use the same G base point each time, effectively avoiding frequent generation of the G occupying a large amount of CPU memory. Each time the authentication communication is performed, the playback device will temporarily generate a random number as the first private key, and the corresponding first public key, so the shared key for each communication is different. Even if the first private key and the second public key are obtained under attack, it will only affect this authentication communication, and will not have any impact on the previous authentication communication content, thereby improving forward security. What is even safer is that by using the ECDH key negotiation algorithm, after the shared key is negotiated, the playback device and the server can delete the temporarily generated first private key and the first public key from the memory. After that, even if both parties are attacked and obtain the second public key and the second private key, they cannot decrypt the ciphertext, further improving security, and generating encryption and decryption symmetric keys according to the shared key in a limited time and effective space.

[0198] See also Fig. 9 The present application discloses a terminal device authentication method, in its typical embodiment, including steps S3100 to S3300, which are as follows:

[0199] Step S3100, transmitting a start timestamp to a playback device electrically connected to the current terminal device to control the playback device to return authentication information, wherein the authentication information includes a first public key generated by the playback device and a ciphertext obtained by encrypting the credential information with a symmetric key, wherein the credential information includes a device feature code of the playback device, a check random code, and the start timestamp, and the symmetric key is generated by a first private key corresponding to the first public key and a second public key pre-allocated by the server;

[0200] The terminal device transmits data with the playback device through its OTG function and uses custom SCSI commands for request and reply operations. The communication between the terminal device and the playback device adopts a single-step rule. Except for special Non-Response Request or data stream transmission mode, the rest adopts the Request -> Response question-and-answer mode. The Request and Response are matched by Byte[3] (command word) and Byte[5] (Seq Num). If the Response does not match, the Request is resent and the Seq Num remains unchanged. If the Request is sent for more than 2 seconds without receiving a Response, it is considered to have timed out and the Request is resent; if the Request is resent for more than 3 times and still does not receive a Response, an error is reported and no further attempts are made.

[0201] The terminal device and the playback device pre-agree on a SCSI command with a command word of 120. The terminal device sends a request with a command word of 120 and a start timestamp to the playback device. The playback device receives and responds to the request with a command word of 120, completes the construction of the authentication information, and initiates a reply with a command word of 120 and the PID required for authentication, and the first public key corresponding to the first private key, which are then transmitted back to the terminal device.

[0202] The start timestamp is a start timestamp obtained by a request initiated by the multimedia APP loaded on the terminal device to its server.

[0203] The authentication information is constructed by generating a random number for the playback device as a verification random code, and combining it with the factory-provided PID (product feature code), device feature code (MAC address) and the start timestamp of the playback device by appending 0 to construct the credential information as plain text. The playback device uses the first private key generated by the pre-protocol ECC algorithm and the second public key pre-assigned by the server to obtain a symmetric key based on the ECDH algorithm, and encrypts the plain text using the AES algorithm according to the symmetric key to obtain the corresponding ciphertext as the authentication information.

[0204] Step S3200, the authentication information is superimposed with the start timestamp obtained from the cache of the terminal device and submitted to the server for authentication;

[0205] The terminal device forwards the stored start timestamp, the ciphertext sent back by the playback device, the PID required for authentication, and the first public key to the server. The server uses the second private key generated in advance by the pre-protocol and the first public key to obtain a symmetric key according to the ECDH algorithm, decrypts the plaintext using the AES algorithm according to the symmetric key to obtain the credential information, performs the authentication operation, and returns a random code to the terminal device if the authentication is legal. If the authentication fails, an error code is returned to the terminal device.

[0206] The authentication operation is a two-step verification. The first step is to compare the start timestamp in the credential information obtained by decryption by the server with the start timestamp transmitted by the terminal device. If the comparison is consistent, the start timestamp in the credential information is a legal timestamp, otherwise it is an illegal timestamp; the second step is to compare the device feature code in the credential information obtained by decryption by the server with the device feature code in the authorized device library preset by the server. If the comparison is consistent, the device feature code in the credential information is a legal device feature code, otherwise it is an illegal device feature code. If both the two-step verification are legal, the authentication is legal. Otherwise, if any of the verification steps is illegal, the authentication fails.

[0207] Step S3300, after the server passes the authentication based on the authentication information and the starting timestamp, the notification message provided by the server and containing the verification random code is sent to the playback device to control the playback device to store the usage period information of the online user of the current terminal device. The usage period information is used to constrain the validity period of the multimedia files stored in the playback device.

[0208] In one embodiment, the server decrypts the authentication information to obtain the corresponding credential information, authenticates the start timestamp and device feature code therein, and after the authentication is legal, sends the verification random code together with the authentication success notification to the terminal device. The terminal device initiates a command word 121 to request the verification random code to the playback device, and the playback device receives a command word 121 to request a reverse authentication operation. If the playback device successfully reverse authenticates, a handshake agreement is reached with the terminal device, and the playback device generates a usage period information file about the online user of the current terminal device, and obtains the permission to download multimedia files and call the multimedia files through the terminal device within the usage period according to the usage period recorded in the file.

[0209] In another embodiment, the server decrypts the credential information to obtain corresponding credential information, and authenticates the start timestamp and device feature code therein, and if the authentication fails, returns an error code to the terminal device.

[0210] In this embodiment, the terminal device makes corresponding requests and replies through the customized SCSI commands pre-agreed with the playback device, standardizes the communication format between the two parties, and interacts with the server efficiently. It can be seen that the terminal device reasonably manages the playback device and reduces the load of the server facing multiple playback devices, ensuring that the playback device and the server perform their related operations in an orderly and accurate manner, and improving robustness.

[0211] See also Fig.10 In a further embodiment, transmitting the start timestamp to a playback device electrically connected to the local device comprises the following steps:

[0212] Step S3400, in response to the access event of the playback device, obtaining a verification random code relative to the playback device from a cache for verification by the playback device;

[0213] The terminal device obtains the random verification code issued during the most recent handshake agreement with the playback device and the MAC address of the playback device from the cache. The MAC address is the MAC address of the playback device obtained by the terminal device through the system when the terminal device is connected to the playback device. Similarly, the MAC address of the currently connected playback device can also be obtained in the above manner. The terminal device compares the MAC address in the cache with the MAC address of the currently connected playback device. When the comparison is consistent, it sends a command word 124 request to the current playback device with the random verification code.

[0214] The command word is 124 request, and the reply is a custom SCSI command pre-agreed between the terminal device and the playback device. When the playback device receives the 124 request issued by the terminal device, it performs a reverse authentication operation. If the reverse authentication is successful, it returns a reply notification message with the command word 124 success to the terminal device and reaches a handshake agreement. Otherwise, it returns an error code. After the terminal device receives the error code, it sends a command word 120 request to the playback device.

[0215] The reverse authentication is that the playback device verifies and compares the verification random code cached when the handshake agreement was reached most recently with the verification random code transmitted by the terminal device. If the comparison is consistent, the reverse authentication is successful, otherwise the reverse authentication fails.

[0216] Step S3500: When the playback device returns a notification message indicating successful verification, a start timestamp is transmitted to the playback device.

[0217] The terminal device receives the reverse authentication success and then returns the command word 124 success reply notification information, accesses the corresponding server of the multimedia APP loaded on the terminal device to obtain the start timestamp, and sends it to the playback device. The playback device receives the start timestamp and updates the corresponding time in the usage period information file of the online user of the current terminal device stored therein according to it.

[0218] In this embodiment, the terminal device and the playback device obtain the verification random code of the most recently reached handshake agreement in the storage for comparison and identification, so as to quickly reach a handshake agreement, reasonably simplify the steps and improve the efficiency.

[0219] Furthermore, by functionalizing each step in the method disclosed in the above embodiments, a playback device authentication device of the present application can be constructed. Fig.11In a typical embodiment, the device includes: a timestamp receiving module 1100, receiving a start timestamp transmitted by a terminal device electrically connected to a current playback device; a key generation module 1200, correspondingly generating a first private key and a first public key, generating a symmetric key according to the first private key and a pre-stored second public key, wherein the second private key corresponding to the second public key is held by a server; a ciphertext construction module 1300, encrypting credential information with the symmetric key to obtain a corresponding ciphertext, wherein the credential information includes a device feature code of the current playback device, a check random code and the start timestamp; a server authentication module 1400, constructing the ciphertext and the first public key into authentication information, and after the terminal device superimposes the start timestamp obtained from the cache of the terminal device, Submit to the server holding the second private key for corresponding authentication, wherein, after the server authenticates successfully according to the authentication information and the starting timestamp, it sends a notification message containing the verification random code to the terminal device; the authentication completion module 1500 confirms that the terminal device returns the verification random code indicating successful authentication and stores the usage period information for constraining the validity period of the multimedia file stored therein called by the current playback device, including: receiving the notification message returned by the terminal device, extracting the verification random code therein; comparing the verification random code with the verification random code cached by the current playback device, and confirming that the authentication is successful when the comparison is consistent; after the authentication is successful, receiving the usage period information issued by the terminal device and storing it in the storage medium of the current playback device.

[0220] In a further embodiment, the key generation module 1200 includes:

[0221] The public-private key generation submodule generates a temporary random number as a first private key, and uses an asymmetric encryption algorithm pre-agreed with the server to calculate and determine the first public key corresponding to the first private key; the shared key generation submodule uses a key negotiation algorithm pre-agreed with the server to calculate a shared key associated with the second public key and the first private key; the symmetric key generation submodule extracts a preset word length from the shared key as a symmetric key.

[0222] In a further embodiment, the key generation module 1200 includes:

[0223] The verification code generation submodule generates a verification random code; the credential information construction submodule constructs the credential information according to the pre-protocol sequence and the pre-protocol word length, so that the credential information includes the device feature code of the current playback device, the verification random code and the starting timestamp; the ciphertext generation submodule encrypts the credential information with the symmetric key to obtain the corresponding ciphertext.

[0224] In a preferred embodiment, the authentication completion module 1500 includes:

[0225] The verification code acquisition submodule receives the notification message sent back by the terminal device and extracts the verification random code therein; the verification submodule compares the verification random code with the verification random code cached by the current playback device, and when the comparison is consistent, confirms that the authentication is successful; the storage submodule receives the usage period information sent by the terminal device after the authentication is successful and stores it in the storage medium of the current playback device, the usage period information includes the current date information, the effective usage period information of the current playback device, and the privileged usage period information associated with the current online user of the terminal device.

[0226] In a preferred embodiment, after the authentication completion module 1500 is executed, it includes:

[0227] A receiving module receives and stores the multimedia file transmitted by the terminal device, wherein the multimedia file is a non-encrypted file; a storage module stores the multimedia file in a hidden partition of the storage medium of the current playback device; and a playback response module responds to a playback instruction acting on the multimedia file, verifies the validity of the usage period information, and plays the corresponding multimedia file when the verification is valid.

[0228] In a preferred embodiment, after the authentication completion module 1500 is executed, it includes:

[0229] A receiving module receives and stores the multimedia file transmitted by the terminal device, wherein the multimedia file is an encrypted file; a storage module stores the multimedia file in the storage medium of the current playback device; and a playback response module responds to the playback instruction acting on the multimedia file, verifies the validity of the usage period information, and decrypts and plays the corresponding multimedia file when the verification is valid.

[0230] Furthermore, by functionalizing each step in the method disclosed in the above embodiments, a server device authentication device of the present application can be constructed. Fig.11In a typical embodiment, the device includes: an authentication preparation module 2100, which obtains authentication information submitted by a terminal device and a start timestamp obtained from a cache of the terminal device, wherein the authentication information includes a first public key generated by a playback device electrically connected to the terminal device and a ciphertext obtained by encrypting the credential information with a symmetric key, wherein the credential information includes a device feature code of the playback device, a check random code and the start timestamp, wherein the start timestamp is transmitted from the terminal device to the playback device, wherein the ciphertext is generated at the playback device, and the symmetric key is generated by a first private key corresponding to the first public key and a second public key pre-assigned by a server; a ciphertext decryption module 2200, which decrypts the ciphertext according to a second private key corresponding to the second public key held by the server and the first public key to obtain the credential. The timestamp verification module 2300 verifies and confirms that the starting timestamp submitted by the terminal device is consistent with the starting timestamp in the credential information obtained by decryption; the device verification module 2400 verifies the legitimacy of the device feature code according to the preset authorized device library, and confirms that the corresponding playback device is a legal device; the notification forwarding module 2500 sends a notification message indicating successful authentication to the terminal device when all the above checks are passed, so that the terminal device forwards it to the playback device, and the notification message includes the verification random code; wherein the terminal device sends the notification message including the verification random code provided by the server to the playback device to control the playback device to store the usage period information of the online user of the current terminal device, and the usage period information is used to constrain the validity period of the multimedia files stored therein called by the playback device.

[0231] In a further embodiment, the ciphertext decryption module 2200 includes:

[0232] A shared key generation submodule, which uses a key negotiation algorithm pre-agreed with the playback device to calculate a shared key associated with a second private key corresponding to the second public key held by the server and the first public key of the terminal device; a symmetric key submodule, which extracts a preset word length from the shared key as a symmetric key; and a decryption submodule, which uses the symmetric key to decrypt the ciphertext to obtain corresponding credential information.

[0233] Furthermore, by functionalizing each step in the method disclosed in the above embodiments, a terminal device authentication device of the present application can be constructed. According to this idea, please refer to Fig.11In a typical embodiment, the device includes: an authentication information interaction module 3100, transmitting a start timestamp to a playback device electrically connected to the current terminal device to control the playback device to return authentication information, wherein the authentication information includes a first public key generated by the playback device and a ciphertext obtained by encrypting the credential information with a symmetric key, wherein the credential information includes a device feature code of the playback device, a check random code, and the start timestamp, and the symmetric key is generated by a first private key corresponding to the first public key and a second public key pre-assigned by the server; a server authentication module 3200, superimposing the authentication information with the start timestamp obtained from the cache of the terminal device and submitting it to the server for authentication; an authentication completion module 3300, after the server passes the authentication according to the authentication information and the start timestamp, sending a notification message provided by the server and including the check random code to the playback device to control the playback device to store the usage period information of the online user of the current terminal device, wherein the usage period information is used to constrain the validity period of the multimedia files stored therein called by the playback device.

[0234] In a further embodiment, the playback device verification module 3400 includes the following steps:

[0235] The access verification submodule responds to the access event of the playback device and obtains the verification random code relative to the playback device from the cache for verification by the playback device; the verification completion submodule transmits the start timestamp to the playback device when the playback device returns a notification message of successful verification.

[0236] In order to solve the above technical problems, the embodiment of the present application also provides a computer device for running a computer program implemented according to each of the device authentication methods described above. Fig.12 , Fig.12 This is a basic structural block diagram of the computer device in this embodiment.

[0237] like Fig.12 As shown, a schematic diagram of the internal structure of a computer device. The computer device includes a processor, a non-volatile storage medium, a memory, and a network interface connected via a system bus. Among them, the non-volatile storage medium of the computer device stores an operating system, a database, and computer-readable instructions. The database may store a control information sequence. When the computer-readable instructions are executed by the processor, the processor can implement a device authentication method. The processor of the computer device is used to provide computing and control capabilities to support the operation of the entire computer device. The memory of the computer device may store computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor can execute a device authentication method. The network interface of the computer device is used to connect and communicate with a terminal. Those skilled in the art can understand that Fig.12The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0238] In this embodiment, the processor is used to execute the specific functions of each module in each device authentication device of the present invention, and the memory stores the program code and various data required to execute the above modules. The network interface is used to transmit data between user terminals or servers. The memory in this embodiment stores the program code and data required to execute all modules / submodules in the device authentication device, and the server can call the program code and data of the server to execute the functions of all submodules.

[0239] The present application also provides a non-volatile storage medium, in which each device authentication method is written into a computer program and stored in the storage medium in the form of computer-readable instructions. When the computer-readable instructions are executed by one or more processors, it means that the program is run in the computer, thereby enabling one or more processors to execute the steps of the device authentication method of any of the above-mentioned embodiments.

[0240] The present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the device authentication method described in any embodiment of the present application.

[0241] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0242] In summary, through software encryption algorithms and terminal devices, the playback device and the server coordinate to perform corresponding authentication data encryption and decryption operations on the network, thereby safely and reliably realizing the authorization verification of the playback device, which is controllable and stable.

[0243] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0244] Those skilled in the art will appreciate that the various operations, methods, steps, measures, and schemes in the processes discussed in this application may be alternated, altered, combined, or deleted. Further, other steps, measures, and schemes in the various operations, methods, and processes discussed in this application may also be alternated, altered, rearranged, decomposed, combined, or deleted. Further, the steps, measures, and schemes in the prior art that are similar to those disclosed in this application may also be alternated, altered, rearranged, decomposed, combined, or deleted.

[0245] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A playback device authentication method, characterized in that: It includes the following steps: Receiving a start timestamp transmitted by a terminal device electrically connected to the current playback device; Generate a first private key and a first public key accordingly, generate a symmetric key according to the first private key and a pre-stored second public key, and a second private key corresponding to the second public key is held by the server; Encrypting the credential information with the symmetric key to obtain a corresponding ciphertext, the credential information including a device feature code of the current playback device, a verification random code, and the start timestamp; The ciphertext and the first public key are constructed as authentication information, and after the terminal device superimposes the start timestamp obtained from the cache of the terminal device, the information is submitted to the server holding the second private key for corresponding authentication, wherein after the server passes the authentication according to the authentication information and the start timestamp, it sends a notification message containing the verification random code to the terminal device; Confirming that the terminal device returns the verification random code indicating successful authentication and storing the usage period information for constraining the validity period of the multimedia file stored therein called by the current playback device, includes: receiving the notification message returned by the terminal device, extracting the verification random code therein; comparing the verification random code with the verification random code cached by the current playback device, and confirming that the authentication is successful when the comparison is consistent; after the authentication is successful, receiving the usage period information sent by the terminal device and storing it in the storage medium of the current playback device.

2. The playback device authentication method according to claim 1, characterized in that: Generate a first private key and a first public key correspondingly, generate a symmetric key according to the first private key and a pre-stored second public key, wherein the second private key corresponding to the second public key is held by the server, including the following steps: Generate a temporary random number as a first private key, and use an asymmetric encryption algorithm pre-agreed with the server to calculate and determine a first public key corresponding to the first private key; Using a key negotiation algorithm pre-agreed with the server, calculating a shared key associated with the second public key and the first private key; A preset word length is intercepted from the shared key as a symmetric key.

3. The playback device authentication method according to claim 1, characterized in that: Encrypting the credential information with the symmetric key to obtain the corresponding ciphertext, wherein the credential information includes the device feature code of the current playback device, the verification random code and the start timestamp, comprises the following steps: Generate a random verification code; Construct the credential information by splicing according to the pre-protocol sequence and the pre-protocol word length, so that the credential information includes the device feature code of the current playback device, the verification random code and the start timestamp; The credential information is encrypted with the symmetric key to obtain a corresponding ciphertext.

4. The playback device authentication method according to claim 1, characterized in that: The usage period information includes current date information, effective usage period information of the current playback device, and privilege usage period information associated with the current online user of the terminal device.

5. The playback device authentication method according to any one of claims 1 to 4, characterized in that: After confirming that the terminal device returns the verification random code indicating successful authentication and storing the usage period information for constraining the validity period of the multimedia file stored in the multimedia file called by the current playback device, the following steps are included: Receiving and storing a multimedia file transmitted by the terminal device, wherein the multimedia file is a non-encrypted file; Storing the multimedia file in a hidden partition of a storage medium of a current playback device; In response to a play instruction for the multimedia file, the validity of the expiration date information is verified, and when the verification is valid, the corresponding multimedia file is played.

6. The playback device authentication method according to any one of claims 1 to 4, characterized in that: After confirming that the terminal device returns the verification random code indicating successful authentication and storing the usage period information for constraining the validity period of the multimedia file stored in the multimedia file called by the current playback device, the following steps are included: Receiving and storing a multimedia file transmitted by the terminal device, wherein the multimedia file is an encrypted file; Storing the multimedia file in a storage medium of a current playback device; In response to a play instruction for the multimedia file, the validity of the expiration date information is verified, and when the verification is valid, the corresponding multimedia file is decrypted and played.

7. A server device authentication method, characterized in that: It includes the following steps: Obtaining authentication information submitted by a terminal device and a start timestamp obtained from a cache of the terminal device, wherein the authentication information includes a first public key generated by a playback device electrically connected to the terminal device and a ciphertext obtained by encrypting credential information with a symmetric key, wherein the credential information includes a device feature code of the playback device, a check random code, and the start timestamp, wherein the start timestamp is transmitted from the terminal device to the playback device, the ciphertext is generated at the playback device, and the symmetric key is generated by a first private key corresponding to the first public key and a second public key pre-allocated by a server; Decrypt the ciphertext according to the second private key corresponding to the second public key held by the server and the first public key to obtain the credential information; Verify that the start timestamp submitted by the terminal device is consistent with the start timestamp in the decrypted credential information; Verify the legitimacy of the device feature code according to a preset authorized device library to confirm that the corresponding playback device is a legitimate device; When all the above checks are passed, a notification message indicating successful authentication is sent to the terminal device, so that the terminal device forwards it to the playback device, and the notification message includes the verification random code; Among them, the terminal device sends the notification message containing the verification random code provided by the server to the playback device to control the playback device to store the usage period information of the online user of the current terminal device, and the usage period information is used to constrain the validity period of the multimedia file stored in the playback device.

8. The server device authentication method according to claim 7, characterized in that: Decrypting the ciphertext according to the second private key corresponding to the second public key held by the server and the first public key to obtain the credential information includes the following steps: Using a key negotiation algorithm pre-agreed with the playback device, calculate a shared key associated with a second private key corresponding to the second public key held by the server and the first public key of the terminal device; Extracting a preset word length from the shared key as a symmetric key; The symmetric key is used to decrypt the ciphertext to obtain corresponding credential information.

9. A terminal device authentication method, characterized in that: It includes the following steps: Transmitting a start timestamp to a playback device electrically connected to the current terminal device to control the playback device to return authentication information, wherein the authentication information includes a first public key generated by the playback device and a ciphertext obtained by encrypting credential information with a symmetric key, wherein the credential information includes a device feature code of the playback device, a check random code, and the start timestamp, and the symmetric key is generated by a first private key corresponding to the first public key and a second public key pre-allocated by a server; Submitting the authentication information with the start timestamp obtained from the terminal device cache to the server for authentication; After the server passes the authentication based on the authentication information and the starting timestamp, the server sends a notification message containing the verification random code provided by the server to the playback device to control the playback device to store the usage period information of the online user of the current terminal device. The usage period information is used to constrain the validity period of the multimedia files stored in the playback device.

10. The playback device authorization method according to claim 9, characterized in that: Transmitting a start timestamp to a playback device electrically connected to the local device comprises the following steps: In response to an access event of the playback device, a verification random code corresponding to the playback device is obtained from a cache for verification by the playback device; When the playback device returns a notification message indicating successful verification, a start timestamp is transmitted to the playback device.

11. A computer device comprising a central processing unit and a memory, characterized in that: The central processing unit is used to call and run a computer program stored in the memory to execute the steps of the method according to any one of claims 1 to 10.

12. A computer-readable storage medium, characterized in that: It stores a computer program implemented according to the method described in any one of claims 1 to 10 in the form of computer-readable instructions, and when the computer program is called and executed by a computer, the steps included in the corresponding method are executed.

13. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method described in any one of claims 1 to 10 are implemented.

Images