Wireless terminal and interface access authentication method of wireless terminal in Uboot mode

Abstract

The application discloses a wireless terminal and an interface access authentication method of the wireless terminal in Uboot mode. The method comprises the following steps: in response to an authentication request of interface access, acquiring authentication request key information carried by the authentication request; verifying the authentication request key information according to preset key verification information; when the verification is successful, acquiring interface access permission of the wireless terminal; and when the verification fails, outputting a key query information. The key query information and the key verification information are acquired according to the same plaintext key. Since the authentication step is required for acquiring the interface access permission of the wireless terminal, the security measure of the wireless terminal interface access is increased, and malicious access to the wireless terminal interface is prevented.

Description

TECHNICAL FIELD

[0001] The embodiment of the present application relates to the field of wireless terminal, in particular to the field of wireless terminal and the interface access authentication method of wireless terminal in Uboot mode. BACKGROUND

[0002] With the continuous development of communication technology, various different wireless terminals have been widely popularized and applied, and the existing wireless terminals generally need to call and obtain data through various interfaces. For example, the serial port of the wireless terminal is an important communication interface for software debugging and fault diagnosis in the product development stage, through which the running mechanism of the wireless terminal can be understood, sensitive data and reverse firmware information can be obtained. In order to prevent malicious attacks, reading or tampering, the wireless terminal only closes part of the serial port functions, and most of the serial port functions are retained in order to meet the needs of after-sales service fault diagnosis, which increases the security risks of the wireless terminal. Therefore, security measures need to be added to the interface access of the wireless terminal to prevent malicious access to the interface of the wireless terminal. SUMMARY

[0003] The interface access authentication method of the wireless terminal in Uboot mode provided by the embodiment of the present application mainly solves the technical problem that the interface access of the wireless terminal has security risks.

[0004] To solve the above technical problems, the embodiment of the present application provides an interface access authentication method of a wireless terminal in Uboot mode, which is used for obtaining the interface access permission of the wireless terminal, and the interface access authentication method comprises the following steps:

[0005] In response to an authentication request of interface access, obtaining authentication request key information carried by the authentication request;

[0006] Verifying the authentication request key information according to preset key verification information;

[0007] If the verification is successful, obtaining the interface access permission of the wireless terminal;

[0008] If the verification fails, outputting a key query information; the key query information and the key verification information are obtained according to the same plaintext key.

[0009] In an embodiment, the key query information and the key verification information are obtained according to the same plaintext key, which comprises the following steps:

[0010] Generating the plaintext key randomly according to a preset password strength policy;

[0011] Using a first encryption algorithm to generate the key verification information from the plaintext key, and using a second encryption algorithm to generate the key query information from the plaintext key.

[0012] In one embodiment, the password strength policy includes a minimum length of password characters and a minimum number of character types included.

[0013] In one embodiment, the first encryption algorithm and the second encryption algorithm are different; the first encryption algorithm includes a symmetric encryption algorithm or a hash algorithm; and the second encryption algorithm includes an asymmetric encryption algorithm.

[0014] In one embodiment, the first encryption algorithm includes an AES, MD5 or SHA encryption algorithm.

[0015] In one embodiment, the second encryption algorithm includes an RSA or elliptic curve asymmetric encryption algorithm.

[0016] Embodiments of the present application also provide a wireless terminal, including a processor and a memory;

[0017] The processor is configured to execute one or more programs stored in the memory to implement the steps of the interface access authentication method described above; and the memory is coupled to the processor.

[0018] Embodiments of the present application also provide a wireless terminal, including:

[0019] An interface opening module configured to open access permission of a serial port interface of the wireless terminal;

[0020] A storage module configured to store a preset secret key authentication information and a secret key query information of the wireless terminal; the secret key query information and the secret key authentication information are obtained based on the same plain text secret key;

[0021] An authentication module configured to, in response to an authentication request of interface access, obtain authentication request secret key information carried by the authentication request, and verify the authentication request secret key information based on the secret key authentication information; when the verification is successful, obtain the interface access permission of the wireless terminal; and when the verification fails, output the secret key query information.

[0022] In one embodiment, the wireless terminal further includes an encryption module configured to encrypt the authentication request secret key information based on a first preset encryption algorithm, so as to enable the authentication module to verify the encrypted authentication request secret key information based on the secret key authentication information.

[0023] In one embodiment, the encryption module is further configured to randomly generate the plain text secret key based on a preset password strength policy, generate the secret key authentication information from the plain text secret key based on a first encryption algorithm, and generate the secret key query information from the plain text secret key based on a second encryption algorithm.

[0024] The embodiment of the present application further provides a computer storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the interface access authentication method.

[0025] The wireless terminal in the Uboot mode, the interface access authentication method, the wireless terminal and the computer storage medium provided by the embodiment of the present application are used for obtaining the authentication request key information carried by the authentication request in response to the authentication request of the interface access, verifying the authentication request key information according to preset key verification information, obtaining the interface access permission of the wireless terminal when the verification is successful, and outputting a key query information when the verification fails. The key query information and the key verification information are obtained according to the same plaintext key. In some implementation processes, the authentication step is required for obtaining the interface access permission of the wireless terminal, which increases the security measures of the interface access of the wireless terminal, and further prevents malicious access to the interface of the wireless terminal.

[0026] Other features and corresponding advantages of the present application are described in the latter part of the specification, and it should be understood that at least part of the advantages is apparent from the description of the present application in the specification. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 FIG. 1 is a flowchart of the interface access authentication method in the Uboot mode of the embodiment one of the present application;

[0028] Figure 2 FIG. 2 is a structural schematic diagram of the wireless terminal of the embodiment two of the present application;

[0029] Figure 3 FIG. 3 is a flowchart of the interface access authentication method of the serial port of the wireless terminal of the embodiment three of the present application;

[0030] Figure 4 FIG. 4 is a flowchart of the method for obtaining the key verification information and the key query information of the embodiment three of the present application;

[0031] Figure 5 FIG. 5 is a structural schematic diagram of the wireless terminal in another embodiment. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical scheme and advantages of the present application more clear, the embodiment of the present application is further described in detail below with reference to the drawings. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0033] Embodiment one:

[0034] The serial port of a wireless terminal is a crucial tool for software debugging and fault diagnosis during product development. However, it also holds significant value for attackers, who can use it to understand device operating mechanisms, obtain sensitive data, and reverse engineer firmware. While only some wireless terminal projects disable the serial port function, most projects require it for after-sales fault diagnosis. Therefore, security measures are needed to prevent unauthorized users from accessing the serial port. To protect interface access in U-Boot mode, no commands other than authentication requests are allowed by default in U-Boot mode, and the wireless device's interface console is not opened even after the kernel boots. For example, to enable the serial port command input function, a password must be entered and authenticated. This password is unique to each wireless terminal, generated by the terminal itself, and stored in Flash memory.

[0035] Please refer to Figure 1 This is a flowchart illustrating the interface access authentication method in Uboot mode according to Embodiment 1 of the present invention. This method is used to obtain interface access permissions for a wireless terminal, including:

[0036] Step 1: Obtain the authentication request key information.

[0037] After the wireless terminal boots into Uboot mode, the command input function of the interface is disabled. If you want to enable the command input function for interface access, you need to enter an authentication request command carrying the authentication request key information. After entering the authentication request in Uboot mode, the interface access authentication request will be responded to, and the authentication request key information carried in the authentication request will be obtained.

[0038] Step 2: Verify the authentication request key information.

[0039] The authentication request key information is verified based on a preset key verification information. This preset key verification information is obtained from a plaintext key. In one embodiment, the preset key verification information is obtained by encrypting the plaintext key using a first encryption algorithm. The obtained key verification information is first encrypted using the first encryption algorithm, and then the encrypted key verification information is compared with the preset key verification information. If they are the same, the verification is successful; otherwise, the verification fails. In one embodiment, the first encryption algorithm includes a symmetric encryption algorithm or a hash algorithm.

[0040] Step 3: Obtain API access permissions.

[0041] Verification successful. Access permissions to the wireless terminal's interface are granted, which enables the command input function for interface access.

[0042] Step 4: Output key lookup information.

[0043] Verification failed, and a key lookup message was output. The key lookup message and key verification message are obtained using the same plaintext key. The methods for obtaining the key lookup message and key verification message include:

[0044] A plaintext key is randomly generated according to a preset password strength strategy. This strategy includes requiring the plaintext key to contain uppercase letters, lowercase letters, special characters, and / or numbers. The strategy also includes a minimum character length and a minimum number of character types for the plaintext key. A first encryption algorithm is used to generate key verification information from the plaintext key, and a second encryption algorithm is used to generate key lookup information from the plaintext key. In one embodiment, the first and second encryption algorithms are different. The first encryption algorithm includes a symmetric encryption algorithm or a hash algorithm, and the second encryption algorithm includes an asymmetric encryption algorithm. In one embodiment, the first encryption algorithm includes AES, MD5, or SHA encryption algorithms; in another embodiment, the second encryption algorithm includes RSA or elliptic curve asymmetric encryption algorithms.

[0045] Since the key query information and key verification information are obtained based on the same plaintext key, the plaintext key can be obtained by using the second encryption algorithm based on the output key query information. The plaintext key is then used as the authentication request key information, which means that the access authentication is successful, and thus the interface access permission of the wireless terminal is obtained.

[0046] This invention provides an interface access authentication method for a wireless terminal in Uboot mode. By responding to an interface access authentication request, the method obtains the authentication request key information carried in the authentication request. It then verifies the authentication request key information based on preset key verification information. If verification is successful, interface access permissions for the wireless terminal are obtained; if verification fails, key query information is output. The key query information and key verification information are obtained using the same plaintext key. In some implementations, since obtaining interface access permissions for the wireless terminal requires an authentication step, security measures for wireless terminal interface access are added to prevent malicious access to the wireless terminal interface. In one embodiment, when verification fails, R&D or testing personnel will use a tool or IT system containing a second encryption algorithm private key to decrypt the key query information into a plaintext key. Then, they will input the decrypted plaintext key carried in the authentication request into the wireless terminal to enable the interface debugging function of the wireless terminal.

[0047] Example 2:

[0048] Please refer to Figure 2This is a schematic diagram of the structure of a wireless terminal according to Embodiment 2 of the present invention. The wireless terminal 100 includes an interface opening module 110, a storage module 120, and an authentication module 130. The interface opening module 110 is used to enable access permissions to the serial port interface of the wireless terminal. The storage module 120 is used to store a preset key verification information and a key query information of the wireless terminal 100. The key query information and the key verification information are obtained based on the same plaintext key. The authentication module 130 is used to respond to the authentication request for interface access, obtain the authentication request key information carried in the authentication request, and verify the authentication request key information according to the key verification information. When the verification is successful, the interface access permissions of the wireless terminal are obtained; when the verification fails, the key query information is output. In one embodiment, the wireless terminal 100 further includes an encryption module 140, used to encrypt the authentication request key information according to a first preset encryption algorithm, so that the authentication module 130 can verify the encrypted authentication request key information according to the key verification information. The encryption module 140 is also used to randomly generate the plaintext key according to a preset password strength strategy, use a first encryption algorithm to generate the key verification information from the plaintext key, and use a second encryption algorithm to generate the key query information from the plaintext key.

[0049] In this embodiment, the wireless terminal includes an interface opening module, a storage module, and an authentication module. The interface opening module is used to enable access to the serial port interface of the wireless terminal. The storage module is used to store key verification information and key query information. The authentication module is used to respond to the authentication request for interface access, obtain the authentication request key information, and verify the authentication request key information based on the key verification information. When the verification is successful, the interface access permission of the wireless terminal is obtained; when the verification fails, the key query information is output. The key query information and the key verification information are obtained using the same plaintext key.

[0050] Example 3:

[0051] Please refer to Figure 3 This is a flowchart illustrating an access authentication method for a wireless terminal serial port interface according to Embodiment 3 of the present invention. The method is used to obtain access permissions for the serial port interface of a wireless terminal. The wireless terminal includes a serial port module 200 and an authentication module 300. After the wireless terminal powers on, the command input function of the serial port module 200 is disabled in uboot mode. To enable access permissions for the uboot serial port interface, an authentication request with authentication request information needs to be entered during the countdown phase of the wireless terminal entering uboot boot mode. This access authentication method includes:

[0052] Step S101: The serial port module 200 receives an authentication request carrying authentication request information from the serial port of the wireless terminal.

[0053] In step S102, the serial port module 200 obtains the authentication request information from the authentication request and sends the authentication request information to the authentication module 300.

[0054] In step S103, the authentication module 300 encrypts the authentication request information using the same encryption method as the key verification information to be compared. In one embodiment, a first encryption algorithm is used, which includes AES, MD5, or SHA encryption algorithms.

[0055] Step S104: Verify the key verification information and the encrypted authentication request information;

[0056] Step S105: If verification fails, send key query information to serial port module 200;

[0057] In step S106, the serial port module 200 outputs the received key query information, does not enable access permissions for the serial port interface, and closes the serial port console.

[0058] In one embodiment, the access authentication method further includes:

[0059] Step S107: Obtain key verification information based on key query information. The key query information and key verification information are obtained based on the same plaintext key. A first encryption algorithm is used to generate key verification information from the plaintext key, and a second encryption algorithm is used to generate key query information from the plaintext key. In one embodiment, the first encryption algorithm and the second encryption algorithm are different. The first encryption algorithm includes a symmetric encryption algorithm or a hash algorithm, and the second encryption algorithm includes an asymmetric encryption algorithm. In one embodiment, the first encryption algorithm includes AES, MD5, or SHA encryption algorithms, and the second encryption algorithm includes RSA or elliptic curve asymmetric encryption algorithms.

[0060] Step S108: The authentication request carries the plaintext key to the serial port module 200, and the serial port module 200 sends the plaintext key to the authentication module 300 for access authentication of the wireless terminal serial port interface.

[0061] Step S109: Encrypt the plaintext key and verify the key verification information and the encrypted plaintext key;

[0062] Step S110: Send a verification success message to the serial port module 200;

[0063] Step S111: Serial port module 200 enables access permissions to the serial port interface of the wireless terminal.

[0064] Example 4:

[0065] Please refer to Figure 4This is a flowchart illustrating the method for obtaining key verification information and key query information according to Embodiment 3 of the present invention. It is used to generate key verification information and key query information for securely opening the serial port interface of a wireless terminal through a key generation device. First, it checks whether the key verification information already exists. If it exists, the generation of the key verification information and key query information is stopped. If it does not exist, the method includes:

[0066] Step S201: Generate plaintext key. Generate a random password as plaintext key according to a preset password strength strategy. The password strength strategy includes the minimum password length and the minimum number of character types (e.g., uppercase, lowercase, numbers, special characters, etc.).

[0067] Step S202: The plaintext key is encrypted using the second encryption algorithm to generate and store key query information. Since the key query information does not need to be generated in uboot mode, the second encryption algorithm can use a complex asymmetric encryption algorithm to generate the key query information in a preset dedicated key generation device.

[0068] Step S203: The plaintext key is encrypted using a first encryption algorithm to generate and store key verification information. Since the pre-verification authentication request information needs to be encrypted using the first encryption algorithm in U-Boot mode during the authentication process, the first encryption algorithm must be a symmetric encryption algorithm or a hash algorithm. This eliminates the need for U-Boot to integrate a complex encryption algorithm library, thus simplifying and making the encryption process easier to implement. In one embodiment, the first encryption algorithm includes encryption algorithms such as AES, MD5, or SHA.

[0069] This embodiment also provides a wireless terminal, including a processor and a memory. The processor executes one or more programs stored in the memory to implement the steps of the interface access authentication method described in Embodiment 1. The memory is coupled to the processor.

[0070] This embodiment also provides a computer-readable storage medium, which includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), DVD or other optical disc storage, magnetic cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible by a computer.

[0071] This embodiment also provides a computer program (or computer software) that can be distributed on a computer-readable medium and executed by a computing device to implement at least one step of the interface access authentication method, the wireless terminal serial port interface access authentication method, and the key verification information and key query information acquisition method in the Uboot mode of the above embodiments one, three, and four; and in some cases, at least one step shown or described can be executed in a different order than that described in the above embodiments.

[0072] This embodiment also provides a data transmission device; please refer to [reference needed]. Figure 5 The diagram below illustrates the structure of a wireless terminal in another embodiment, which includes a processor 51, a memory 53, and a communication bus 52, wherein:

[0073] Communication bus 52 is used to realize the connection and communication between processor 51 and memory 52;

[0074] The processor 51 is used to execute one or more computer programs stored in the memory 53 to implement at least one step in the data transmission method of the above embodiment 1.

[0075] It should be understood that, in some cases, at least one step shown or described may be performed in a different order than that described in the above embodiments.

[0076] This embodiment also provides a computer program product, including a computer-readable device on which the computer program as shown above is stored. In this embodiment, the computer-readable device may include the computer-readable storage medium as shown above.

[0077] In one embodiment of this application, since the interface authentication key verification information and key query information used by each wireless terminal are randomly generated and unique, and the interface access permissions of the wireless terminal are controlled during the boot phase of uboot mode, high security is achieved. In another embodiment of this application, the interface authentication password supports a password query function. If R&D or testing personnel do not know the authentication password, they can enter the authentication password to query it, and then use tools or IT systems to decrypt it into a plaintext key, thereby improving the user experience. The key verification information and key query information are generated by a preset key generation device, which can operate in non-uboot mode, thereby reducing the implementation difficulty of the interface access authentication method disclosed in this application.

[0078] Therefore, those skilled in the art should understand that all or some of the steps, systems, and devices disclosed above, as well as the functional modules / units, can be implemented as software (which can be implemented using computer program code executable by a computing device), firmware, hardware, and suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as integrated circuits, such as application-specific integrated circuits (ASICs).

[0079] Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, computer program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium. Therefore, this invention is not limited to any particular combination of hardware and software.

Claims

1. A method used in a wireless terminal, the method comprising: Enter Uboot mode; Disable all command input except for authentication requests; The authentication request is received via a serial port module, and the authentication request includes authentication request key information. Randomly generate plaintext keys according to a preset password strength strategy; The plaintext key is used to generate key verification information using a hash algorithm; Verify the authentication request key information based on the key verification information; The authentication request key information was successfully verified. Obtain interface access permissions for the wireless terminal; and Enable command input functionality; and Verification of the authentication request key information failed. An asymmetric encryption algorithm is used to generate key lookup information from the plaintext key. Output the key query information; In response to the key query information, a subsequent authentication request is received via the serial port module, wherein the subsequent authentication request includes a plaintext key obtained based on the key query information; as well as Enable API debugging.

2. The method as described in claim 1, characterized in that, The password strength strategy includes the minimum password character length and the minimum number of character types included.

3. The method as described in claim 1, characterized in that, The first encryption algorithm includes AES, MD5, or SHA encryption algorithms; the second encryption algorithm includes RSA or elliptic curve asymmetric encryption algorithms.

4. A wireless terminal, characterized in that, include: Serial port module; as well as Processor, wherein the serial port module and the processor are configured as follows: Enter Uboot mode; Disable all command input except for authentication requests; The authentication request is received via the serial port module, and the authentication request includes authentication request key information. Randomly generate plaintext keys according to a preset password strength strategy; The plaintext key is used to generate key verification information using a hash algorithm; Verify the authentication request key information based on the key verification information; The authentication request key information was successfully verified. Obtain interface access permissions for wireless terminals; and Enable command input functionality; and Verification of the authentication request key information failed. An asymmetric encryption algorithm is used to generate key lookup information from the plaintext key. Output the key query information; In response to the key query information, a subsequent authentication request is received via the serial port module, wherein the subsequent authentication request includes a plaintext key obtained based on the key query information; as well as Enable API debugging.

5. The wireless terminal as described in claim 4, characterized in that, Also includes: An encryption module is used to encrypt the authentication request key information according to a first preset encryption algorithm, so that the authentication module can verify the encrypted authentication request key information based on the key verification information.

6. A wireless terminal, characterized in that, Including processor and memory; The processor is used to execute one or more programs stored in the memory to implement the steps of the interface access authentication method as described in any one of claims 1 to 3; The memory is coupled to the processor.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more computer programs, which can be executed by one or more processors to implement the steps of the method as described in any one of claims 1 to 3.

Images