Access authentication method, device and computer equipment

Abstract

The present application relates to an access authentication method, apparatus and computer equipment. First, the first end responds to the handshake request sent by the second end, and the first end performs a digital certificate verification operation; if the first digital certificate and the second digital certificate are both legal, the first end sends an information authentication instruction to the second end, and the information authentication instruction is used to obtain the access message of the second end. The first end authenticates the access message. If the access message authentication is successful, the first end sends a response message of successful authentication to the second end, and the response message indicates that data communication is allowed between the first end and the second end. This method implements an access authentication method based on a dual authentication mechanism of digital certificate authentication and access message authentication, which can ensure the secure access of the second end and effectively improve the communication security between the first end and the second end.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an access authentication method, apparatus and computer equipment. Background Art

[0002] In recent years, with the focused supervision and control of power information security, the importance of power grid information security has been further clarified, and higher requirements have been put forward for the security protection of key information infrastructure in the fields of energy and electricity.

[0003] In the power system, in order to ensure the security of power grid information, the established security protection system usually uses boundary protection devices to isolate different security zones in the power monitoring system. When data communication is carried out between business hosts in different security zones, the data message is sent to the boundary protection device, and the boundary protection device completes the data communication between different security zones.

[0004] However, when the business host in the above-mentioned power system interacts with the border protection device, if the business host is connected to the border protection device forged by the attacker, or the attacker impersonates the business host to communicate data with the border protection device, it will cause the communication data to be leaked, which will have a serious impact on the communication security in the power system. Summary of the invention

[0005] Based on this, it is necessary to provide an access authentication method, device and computer equipment to address the above technical problems, which can prevent communication data leakage and improve communication security in the power system.

[0006] In a first aspect, the present application provides an access authentication method, the method comprising:

[0007] The first end responds to the handshake request sent by the second end, and the first end performs a digital certificate verification operation; the digital certificate verification operation is used to verify the legitimacy of the first digital certificate of the first end and the second digital certificate of the second end;

[0008] If both the first digital certificate and the second digital certificate are legal, the first end sends an information authentication instruction to the second end, where the information authentication instruction is used to obtain an access message from the second end;

[0009] The first end authenticates the access message;

[0010] If the access message authentication is successful, the first end sends a response message indicating successful authentication to the second end; the response message indicates that data communication is allowed between the first end and the second end.

[0011] In one embodiment, the first end performs a digital certificate verification operation, including:

[0012] The first end sends the first digital certificate to the second end to instruct the second end to verify the legitimacy of the first digital certificate;

[0013] The first end receives a second digital certificate sent by the second end, where the second digital certificate is sent by the second end after the second end determines that the first digital certificate is legitimate;

[0014] The first end verifies the legitimacy of the second digital certificate;

[0015] If the legitimacy verification of the second digital certificate passes, the first end determines that both the first digital certificate and the second digital certificate are legal.

[0016] In one embodiment, the first end sends a first digital certificate to the second end, including:

[0017] The first end encrypts the first reference digital certificate according to the public key of the second end to obtain a first digital certificate; the first reference digital certificate includes the identity information of the first end;

[0018] The first digital certificate is sent to the second end.

[0019] In one embodiment, the first end verifies the legitimacy of the second digital certificate, including:

[0020] The first end decrypts the second digital certificate to obtain a second reference digital certificate; the second reference digital certificate includes an identification and a digital signature of a certification center to which the second reference digital certificate belongs;

[0021] Check whether the authentication center's logo exists in the pre-stored authentication center trust list, and verify the tampering status of the digital signature;

[0022] If the identity of the certification center exists in the certification center trust list, and the tampering status of the digital signature is not tampered with, then check whether there is a second reference digital certificate in the certification center's revocation list;

[0023] If the second reference digital certificate does not exist in the revocation list of the certification center, it is determined that the legitimacy verification of the second digital certificate has passed.

[0024] In one embodiment, the second reference digital certificate further includes attribute information of the second end; and verifying the tampering status of the digital signature includes:

[0025] The first end obtains the public key of the authentication center, and decrypts the digital signature according to the public key of the authentication center to obtain a first hash value;

[0026] The first end calculates the attribute information according to a preset hash algorithm to obtain a second hash value;

[0027] If the first hash value and the second hash value are the same, the first end determines that the tampering status of the digital signature is not tampered with.

[0028] In one embodiment, the method further comprises:

[0029] If both the first digital certificate and the second digital certificate are valid, the first end establishes a connection channel with the second end; the connection channel includes a transmission protocol between the first end and the second end;

[0030] The first end receives the access message from the second end through the connection channel.

[0031] In one embodiment, the access message includes access data and signature data; the second digital certificate includes a public key of the second digital certificate; and the first end authenticates the access message, including:

[0032] The first end decrypts the signature data according to the public key of the second digital certificate to obtain first summary information;

[0033] The first end determines a digest extraction method for the signature data, and extracts a digest of the access data using the digest extraction method to obtain second digest information;

[0034] The first digest information is compared with the second digest information. If the first digest information and the second digest information are the same, the first end determines that the access message authentication is successful.

[0035] In one embodiment, the access message includes access data and cyclic redundancy check data; the second digital certificate includes a public key of the second digital certificate; and the first end authenticates the access message, including:

[0036] The first end decrypts the cyclic redundancy check data according to the public key of the second digital certificate to obtain a first cyclic redundancy check value;

[0037] The first end calculates the access data according to a preset check value generation method to obtain a second cyclic redundancy check value;

[0038] The first cyclic redundancy check value and the second cyclic redundancy check value are compared. If the first cyclic redundancy check value and the second cyclic redundancy check value are the same, the first end determines that the access message authentication is successful.

[0039] In a second aspect, the present application further provides an access authentication device, the device comprising:

[0040] A verification module, used for the first end to respond to the handshake request sent by the second end, and the first end to perform a digital certificate verification operation; the digital certificate verification operation is used to verify the legitimacy of the first digital certificate of the first end and the second digital certificate of the second end;

[0041] A first sending module, configured to, if both the first digital certificate and the second digital certificate are valid, send an information authentication instruction from the first end to the second end, the information authentication instruction being used to obtain an access message from the second end;

[0042] An authentication module, used for the first end to authenticate the access message;

[0043] The second sending module is used for, if the access message authentication is passed, the first end sends a response message of successful authentication to the second end; the response message indicates that data communication is allowed between the first end and the second end.

[0044] In a third aspect, an embodiment of the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods provided in the embodiment of the first aspect are implemented.

[0045] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any one of the methods provided in the embodiment of the first aspect above are implemented.

[0046] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of any one of the methods provided in the embodiments of the first aspect above.

[0047] The embodiment of the present application provides an access authentication method, device and computer equipment. First, the first end responds to the handshake request sent by the second end, and the first end performs a digital certificate verification operation. If the first digital certificate and the second digital certificate are both legal, the first end sends an information authentication instruction to the second end, and the information authentication instruction is used to obtain the access message of the second end. The first end authenticates the access message. If the access message authentication is passed, the first end sends a response message of successful authentication to the second end, and the response message indicates that data communication is allowed between the first end and the second end. In this method, the legitimacy of the first digital certificate of the first end and the second digital certificate of the second end is verified by the digital certificate verification operation. If the first digital certificate and the second digital certificate are both legal, the first end sends an information authentication instruction to the second end to obtain the access message of the second end, and then the first end authenticates the access message again. When the access message authentication is passed, data communication can be carried out between the first end and the second end. This method implements an access authentication method based on a dual authentication mechanism of digital certificate authentication and access message authentication, which can ensure the secure access of the second end and effectively improve the communication security between the first end and the second end. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1a A diagram of an application environment of an access authentication method in an embodiment;

[0049] Figure 1b A schematic diagram of the structure of an access authentication method in an embodiment;

[0050] Figure 2 A schematic diagram of a flow chart of an access authentication method in an embodiment;

[0051] Figure 3 A schematic diagram of the structure of an access authentication method in another embodiment;

[0052] Figure 4 A schematic diagram of the structure of an access authentication method in another embodiment;

[0053] Figure 5 A schematic diagram of the structure of an access authentication method in another embodiment;

[0054] Figure 6 A schematic diagram of the structure of an access authentication method in another embodiment;

[0055] Figure 7 A schematic diagram of the structure of an access authentication method in another embodiment;

[0056] Figure 8 A schematic diagram of the structure of an access authentication method in another embodiment;

[0057] Fig. 9 A schematic diagram of a flow chart of an access authentication method in another embodiment;

[0058] Fig.10 A schematic diagram of the structure of an access authentication method in another embodiment;

[0059] Fig.11 A schematic diagram of the structure of an access authentication method in another embodiment;

[0060] Fig.12 A schematic diagram of a flow chart of an access authentication method in another embodiment;

[0061] Fig.13 A schematic diagram of a flow chart of an access authentication method in another embodiment;

[0062] Fig.14 A schematic diagram of a flow chart of an access authentication method in another embodiment;

[0063] Fig.15 A schematic diagram of a flow chart of an access authentication method in another embodiment;

[0064] Fig.16 A schematic diagram of a flow chart of an access authentication method in another embodiment;

[0065] Fig.17A schematic diagram of a flow chart of an access authentication method in another embodiment;

[0066] Fig.18 A schematic diagram of a flow chart of an access authentication method in another embodiment;

[0067] Fig.19 is a structural block diagram of an access authentication device in an embodiment;

[0068] Fig. 20 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0070] The access authentication method provided in the embodiment of the present application can be as follows Figure 1a In the application environment shown in the figure, Figure 1a The first end and the second end in the communication system each include at least one device, or at least one type of device; the first end and the second end may be directly or indirectly connected by wired or wireless communication, which is not limited in this embodiment. The first end and the second end may be computer devices or terminal devices in any field, for example, including but not limited to physical devices such as smart phones, tablet computers, laptop computers, desktop computers, digital assistants, smart speakers, smart wearable devices, vehicle terminals, servers, etc., and may also include software running in physical devices, such as applications, etc., but is not limited thereto. The operating systems running on the first end and the second end may include but are not limited to Android systems, IOS systems, Linux systems, Windows systems, etc. The embodiments of this application do not limit the types of the first end and the second end.

[0071] Based on the above Figure 1a , the first end responds to the handshake request sent by the second end, then the second end sends a handshake request to the first end, that is, the second end requests to establish a communication connection with the first end; the first end can also send a handshake request to the second end to request to establish a communication connection with the second end. Among them, the first end and the second end are only used to distinguish different ends and are not used to limit other information.

[0072] The embodiments of the present application provide an access authentication method, apparatus, and computer equipment, which can prevent communication data leakage and improve communication security in the power system.

[0073] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems will be described in detail below through embodiments and in conjunction with the accompanying drawings. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments.

[0074] Before describing the embodiment of the present application in detail, the first end and the second end of the embodiment of the present application are described. Figure 1b As shown, the first end and the second end represent two different ends in the access authentication process. However, according to different access directions requested in the access authentication process, the specific ends referred to by the first end and the second end are also different. For example, Figure 1b When the access request direction is the service host requesting access to the security protection device, the first end in the embodiment of the present application refers to the security protection device, and the second end refers to the service host; conversely, when the access request direction is the security protection device requesting access to the service host, the first end refers to the service host, and the second end refers to the security protection device.

[0075] Among them, the business host can be a device in each security zone in the power monitoring system, and the security protection device is a security gateway device in the power monitoring system.

[0076] It should also be noted that when the second end applies for access to the first end, a digital certificate verification operation and an access message authentication process are involved, and whether the first end applies for access to the second end or the second end applies for access to the first end, the digital certificate verification process and the access message authentication process are the same. Specifically, when the second end applies for access to the first end, the first end performs a digital certificate verification operation and an access message authentication process; when the first end applies for access to the second end, the second end performs a digital certificate verification operation and an access message authentication process.

[0077] The access authentication process is described below through a specific embodiment.

[0078] In one embodiment, an access authentication method is provided, such as Figure 2As shown, an access authentication method is provided. This embodiment involves a specific process in which the first end responds to a handshake request sent by the second end, and verifies the legitimacy of the first digital certificate of the first end and the second digital certificate of the second end. If both the first digital certificate and the second digital certificate are legal, the first end sends an information authentication instruction to the second end, and the information authentication instruction is used to obtain an access message from the second end. The first end authenticates the access message. If the access message authentication passes, the first end sends a response message of successful authentication to the second end. The embodiment includes the following steps:

[0079] S201, in response to a handshake request sent by a second end, the first end performs a digital certificate verification operation; the digital certificate verification operation is used to verify the legitimacy of a first digital certificate of the first end and a second digital certificate of the second end.

[0080] When exchanging information between the first end and the second end, both parties use a communication protocol to exchange data. The process of their communication is called "handshake". When the second end needs to send data to the first end, the second end will first send a handshake request to the first end.

[0081] Optionally, the handshake request includes information such as version information, a candidate list of encryption algorithms, a random number, and an extension field.

[0082] After receiving the handshake request, the first end will perform a digital certificate verification operation to verify the legitimacy of the first digital certificate of the first end and the second digital certificate of the second end.

[0083] A digital certificate is a string of numbers that marks the identity of the parties in Internet communication. It provides a way to verify the identity of the communication entity on the Internet, similar to a driver's license or an ID card in daily life. It is issued by a Certificate Authority (CA) center and can be used to identify the identity of the other party on the Internet.

[0084] The digital certificate can be a public key infrastructure (PKI) digital certificate, a 509 certificate, etc. The type of the digital certificate can be set according to actual application requirements.

[0085] Optionally, the digital certificate includes a public key, a name, and a digital signature of a certificate authority; specifically, the first digital certificate of the first end may include the public key of the first digital certificate and the identity information of the first end, and the second digital certificate of the second end may include the public key of the second digital certificate and the identity information of the second end.

[0086] The first end may perform a digital certificate verification operation by verifying whether the certificate authority is legitimate.

[0087] In one embodiment, the first end may perform a digital certificate verification operation by using the digital certificate as an input of a preset verification algorithm and outputting the legitimacy of the digital certificate by running the verification algorithm. The digital certificate includes a first digital certificate of the first end and a second digital certificate of the second end.

[0088] As mentioned above, the request access methods of the first end and the second end are different, and the specific references will also be different. Figure 3 In the scenario, the first end refers to the security protection device, and the second end refers to the business host. Based on this scenario, the business host sends a handshake request to the security protection device, and after receiving the handshake request, the security protection device performs a digital certificate verification operation, which is an operation used to verify whether the first digital certificate of the security protection device and the second digital certificate of the business host are legal; in actual applications, an authentication client can be set on the business host, and the network can be accessed through the authentication client to send a handshake request and the second digital certificate of the business host to the security protection device.

[0089] exist Figure 4 In the scenario, the first end refers to the service host, and the second end refers to the security protection device. Based on this scenario, the security protection device sends a handshake request to the service host, and after receiving the handshake request, the service host performs a digital certificate verification operation, which is an operation to verify whether the first digital certificate of the service host and the first digital certificate of the security protection device are legal.

[0090] Among them, the business host can be the equipment in each safety zone in the power monitoring system, and the safety protection equipment can also be the security gateway equipment of the power monitoring system. Correspondingly, the business host can be the equipment in the business system and the plant system. Among them, the business system can include the dispatching automation master station system and the operation ticket system of the power monitoring system, etc. The dispatching automation master station system includes the master station operation control system (Operational Control System, OCS), automatic generation control (Automatic Gain Control, AGC) system and automatic voltage control (Automatic Voltage Control, AVC) system, etc. The plant system can include substations and power plants, etc.

[0091] S202: If both the first digital certificate and the second digital certificate are valid, the first end sends an information authentication instruction to the second end, where the information authentication instruction is used to obtain an access message from the second end.

[0092] If both the first digital certificate and the second digital certificate are legal, the first end sends an information authentication instruction to the second end. After the second end receives the information authentication instruction, the second end sends an access message to the first end.

[0093] The information authentication instruction may be a sending signal, which is a signal instructing the second end to send an access message to the first end, and the access message may be a connection message.

[0094] Optionally, the first end sends an information authentication instruction to the second end, and the sending method may be through a post or get method; the first end obtains the access message of the second end, which may be obtained by the first end from the second end, or actively sent by the second end to the first end.

[0095] As mentioned above, the request access methods of the first end and the second end are different, and the specific references will also be different. Figure 5 In the scenario, the first end refers to the security protection device, and the second end refers to the service host. Based on this scenario, the service host sends a handshake request to the security protection device. After receiving the handshake request, the security protection device performs a digital certificate verification operation. If the first digital certificate of the security protection device and the second digital certificate of the service host are both legal, the security protection device sends an information authentication instruction to the service host. After receiving the information authentication instruction, the service host sends an access message to the security protection device.

[0096] exist Figure 6 In the scenario, the first end refers to the service host, and the second end refers to the security protection device. Based on this scenario, the security protection device sends a handshake request to the service host. After receiving the handshake request, the service host performs a digital certificate verification operation. If the first digital certificate of the service host and the second digital certificate of the security protection device are both valid, the service host sends an information authentication instruction to the security protection device. After receiving the information authentication instruction, the security protection device sends an access message to the service host.

[0097] S203: The first end authenticates the access message.

[0098] A message is a unit of data exchanged and transmitted in a network, that is, a block of data that a station wants to send at one time; a message contains complete data information to be sent, and its length is very inconsistent, with unlimited and variable length; a message is also the unit of network transmission, and during the transmission process it will be continuously encapsulated into groups, packets, and frames for transmission. The encapsulation method is to add some information segments, that is, data organized in a certain format in the message header.

[0099] An access message is a message sent by the second end when applying for access to the first end. Authentication methods of the access message include authentication using traditional encryption methods, message authentication code methods using keys, authentication using one-way hash functions, and digital signature authentication methods. For example, if a one-way hash function is used to authenticate the access message, the one-way hash function includes a message authentication code (MAC), a cyclic redundancy check code, a secure hash algorithm (SHA), etc.

[0100] Optionally, the first end authenticates the access message of the second end to verify whether the second end can obtain access to the first end.

[0101] S204, if the access message authentication is successful, the first end sends a response message indicating successful authentication to the second end; the response message indicates that data communication is allowed between the first end and the second end.

[0102] Passing the access message authentication may indicate that the second end has obtained the right to access the first end, and the second end can communicate normally with the first end.

[0103] If the access message authentication is successful, indicating that the second end is a trusted device, that is, the second end access authentication is successful, then the first end sends a response message of successful authentication to the second end, and the second end can start normal communication with the first end.

[0104] The response message consists of a status line, a response header, a blank line, and a response body. The status line consists of three parts: the HyperText Transfer Protocol (HTTP) version field, a status code, and a description text of the status code. The status code consists of three digits. If the response message indicates a successful authentication response message, the status code is 200OK.

[0105] As mentioned above, the request access methods of the first end and the second end are different, and the specific references will also be different. Figure 7 In the scenario, the first end refers to the security protection device, and the second end refers to the service host. Based on this scenario, the security protection device authenticates the access message sent by the service host. If the access message authentication is successful, the security protection device sends a response message of successful authentication to the service host, which indicates that the service host and the security protection device can communicate normally.

[0106] exist Figure 8In the scenario, the first end refers to the security device, and the second end refers to the security device. Based on this scenario, the service host authenticates the access message sent by the security device. If the access message authentication is successful, the service host sends a response message of successful authentication to the security device, which indicates that the security device and the service host can communicate normally.

[0107] If the access message authentication fails, it indicates that the second end may be a device forged by an attacker. To ensure security, the second end can actively disconnect the connection channel between itself and the first end to prevent the first end from accessing, and the entire access authentication method process ends. At the same time, the second end can also reply to the first end with a response message refusing access.

[0108] In the above access authentication method, first, the first end responds to the handshake request sent by the second end, and the first end performs a digital certificate verification operation. If the first digital certificate and the second digital certificate are both legal, the first end sends an information authentication instruction to the second end, and the information authentication instruction is used to obtain the access message of the second end. The first end authenticates the access message. If the access message authentication is successful, the first end sends a response message of successful authentication to the second end, and the response message indicates that data communication is allowed between the first end and the second end. In this method, the legitimacy of the first digital certificate of the first end and the second digital certificate of the second end is verified by a digital certificate verification operation. If the first digital certificate and the second digital certificate are both legal, the first end sends an information authentication instruction to the second end to obtain the access message of the second end, and then the first end authenticates the access message again. When the access message authentication is successful, data communication can be carried out between the first end and the second end. This method implements an access authentication method based on a dual authentication mechanism of digital certificate authentication and access message authentication, which can ensure the secure access of the second end and effectively improve the communication security between the first end and the second end.

[0109] In one embodiment, Fig. 9 As shown, the first end performs a digital certificate verification operation, including the following steps:

[0110] S901: The first end sends a first digital certificate to the second end to instruct the second end to verify the legitimacy of the first digital certificate.

[0111] Based on the above embodiment, when the first end receives the handshake request sent by the second end, the first end will send the first digital certificate to the second end. When the second end receives the first digital certificate, the second end will verify the legitimacy of the first digital certificate.

[0112] The first digital certificate is a digital certificate of the first end, and the first digital certificate includes identity information of the first end.

[0113] Digital certificates rely on the trust transfer mechanism of the root certificate, so to verify the legitimacy of a digital certificate, its superior certificate needs to be involved in the verification. In addition to the root certificate, each digital certificate contains the signature of its superior certificate, that is, the certificate summary (abbreviated as H1) is encrypted with the private key of the superior certificate.

[0114] Therefore, the method for verifying the legitimacy of a digital certificate can be: verify whether the root certificate is a trusted root certificate, and whether the certificate summary (H2) after decryption of each digital certificate in the certificate chain below it is consistent with the summary (H1) calculated from the certificate content; if H2 is consistent with H1, it means that the digital certificate is legal, otherwise, it is determined that the digital certificate is illegal; wherein, the certificate summary (H2) after decryption of the digital certificate is decrypted using the public key of the superior certificate.

[0115] S902, the first end receives a second digital certificate sent by the second end, where the second digital certificate is sent by the second end after the second end determines that the first digital certificate is legitimate.

[0116] When the second end determines that the first digital certificate is legitimate, it sends the second digital certificate to the first end, and the first end receives the second digital certificate.

[0117] The second digital certificate is a digital certificate of the second end, and the second digital certificate includes identity information of the second end.

[0118] S903: The first end verifies the validity of the second digital certificate.

[0119] After receiving the second digital certificate, the first end will verify the legitimacy of the second digital certificate, wherein the verification method may be the same as the verification method of the first digital certificate, which will not be described in detail here.

[0120] S904: If the validity verification of the second digital certificate passes, the first end determines that both the first digital certificate and the second digital certificate are valid.

[0121] If the legitimacy verification of the second digital certificate passes, because the second end will send the second digital certificate to the first end only after the legitimacy verification of the first digital certificate passes, therefore, if the legitimacy verification of the second digital certificate passes, the first end can determine that both the first digital certificate and the second digital certificate are legal.

[0122] As mentioned above, the request access methods of the first end and the second end are different, and the specific references will also be different. Fig.10In the scenario, the first end refers to the security protection device, and the second end refers to the business host. Based on this scenario, the business host sends a handshake request to the security protection device, and after receiving the handshake request, the security protection device performs a digital certificate verification operation, which includes: the security protection device sends a first digital certificate to the business host, and the business host verifies the legitimacy of the first digital certificate. If the first digital certificate is legal, the business host sends a second digital certificate to the security protection device, and the security protection device verifies the legitimacy of the second digital certificate. If the second digital certificate is legal, it is determined that both the first digital certificate of the security protection device and the second digital certificate of the business host are legal.

[0123] exist Fig.11 In the scenario, the first end refers to the business host, and the second end refers to the security protection device. Based on this scenario, the security protection device sends a handshake request to the business host, and after receiving the handshake request, the business host performs a digital certificate verification operation, which includes: the business host sends a first digital certificate to the security protection device, and the security protection device verifies the legitimacy of the first digital certificate. If the first digital certificate is legal, the security protection device sends a second digital certificate to the business host, and the business host verifies the legitimacy of the second digital certificate. If the second digital certificate is legal, it is determined that both the first digital certificate of the business host and the second digital certificate of the security protection device are legal.

[0124] In the above access authentication method, the first end sends a first digital certificate to the second end to instruct the second end to verify the legitimacy of the first digital certificate. The first end receives the second digital certificate sent by the second end. The second digital certificate is sent by the second end after the second end determines that the first digital certificate is legitimate. The first end verifies the legitimacy of the second digital certificate. If the legitimacy of the second digital certificate is verified, the first end determines that both the first digital certificate and the second digital certificate are legitimate. In this method, the legitimacy of the first digital certificate of the first end and the second digital certificate of the second end are verified, thereby improving the communication security between the first end and the second end.

[0125] In one embodiment, Fig.12 As shown, the first end sends a first digital certificate to the second end, including the following steps:

[0126] S1201, the first end encrypts the first reference digital certificate according to the public key of the second end to obtain a first digital certificate; the first reference digital certificate includes the identity information of the first end.

[0127] In order to prevent the digital certificate from being leaked, the first end and the second end can send their respective digital certificates to each other by using an encryption algorithm.

[0128] Before the first end sends the first digital certificate to the second end, the first end needs to encrypt the first reference digital certificate according to the public key of the second end to obtain the first digital certificate. The first reference certificate includes the identity information of the first end and can uniquely identify the first end.

[0129] The method for encrypting the first reference digital certificate may be that the first end uses an encryption algorithm and a public key of the second end to encrypt the first parameter digital certificate to obtain an encrypted first reference digital certificate, i.e., the first digital certificate. The encryption algorithm includes a symmetric algorithm and an asymmetric algorithm. It should be noted that the type of encryption algorithm is not limited in the embodiments of the present application.

[0130] S1202, sending the first digital certificate to the second end.

[0131] After obtaining the first digital certificate, the first end sends the first digital certificate to the second end, wherein, optionally, the sending method may be a get or post method.

[0132] Please continue to see Fig.10 and Fig.11 .

[0133] exist Fig.10 In the scenario, the security protection device encrypts the first reference digital certificate of the security protection device according to the public key of the business host to obtain the first digital certificate, and then the security protection device sends the first digital certificate to the business host.

[0134] exist Fig.11 In the scenario, the business host encrypts the first reference digital certificate of the business host according to the public key of the security protection device to obtain the first digital certificate, and then the business host sends the first digital certificate to the security protection device.

[0135] In the above access authentication method, the first end encrypts the first reference digital certificate according to the public key of the second end to obtain the first digital certificate; the first reference digital certificate includes the identity information of the first end; and the first digital certificate is sent to the second end. In this method, the first end encrypts the first reference digital certificate and sends the first digital certificate obtained after encryption to the second end, thereby ensuring the communication security between the first end and the second end.

[0136] In one embodiment, Fig.13 As shown, the first end verifies the legitimacy of the second digital certificate, including the following steps:

[0137] S1301, the first end decrypts the second digital certificate to obtain a second reference digital certificate; the second reference digital certificate includes the identifier and digital signature of the certification center to which the second reference digital certificate belongs.

[0138] The first end decrypts the second digital certificate, wherein the decryption method is that the first end decrypts the second digital certificate according to the private key of the first end and the decryption algorithm corresponding to the encryption of the second digital certificate to obtain a second reference digital certificate.

[0139] The second reference digital certificate includes the identifier and digital signature of the certification center to which the second reference digital certificate belongs. The identifier of the certification center to which the second reference digital certificate belongs indicates the issuing authority of the second reference digital certificate.

[0140] S1302, check whether the authentication center's logo exists in the pre-stored authentication center trust list, and verify the tampering status of the digital signature.

[0141] The first end will pre-store a certification center trust list, which includes the identifiers of certification centers that the first end can trust, and the second reference digital certificate includes the identifier and digital signature of the certification center to which the second reference digital certificate belongs.

[0142] Therefore, when verifying the legitimacy of the second reference digital certificate, firstly, check whether the identification of the certification center to which the second reference digital certificate belongs is in the pre-stored certification center trust list, and verify the tampering status of the digital signature.

[0143] In one embodiment, Fig.14 As shown, the second reference digital certificate also includes attribute information of the second end; verifying the tampering status of the digital signature includes the following steps:

[0144] S1401, the first end obtains the public key of the authentication center, and decrypts the digital signature according to the public key of the authentication center to obtain a first hash value.

[0145] The second reference digital certificate includes the identifier of the authentication center to which the second reference digital certificate belongs. Therefore, the first end obtains the public key of the authentication center from the authentication center according to the identifier of the authentication center.

[0146] After the first end obtains the public key of the authentication center, it can decrypt the digital signature according to the public key of the authentication center. The decryption method can be to decrypt the digital signature according to the public key of the authentication center using a preset decryption algorithm to obtain a hash value, and determine the hash value as the first hash value.

[0147] S1402: The first end calculates the attribute information according to a preset hash algorithm to obtain a second hash value.

[0148] Map a binary value string of arbitrary length to a binary value string of fixed length. The mapping rule is the hash algorithm, and the binary value string obtained after mapping the original data is the hash value.

[0149] Therefore, by calculating the attribute information according to the preset hash algorithm, a hash value is obtained, and the hash value is determined as the second hash value.

[0150] Hash algorithms include SHA algorithms and message digest algorithms, etc. It should be noted that the embodiments of the present application do not impose any limitation on the type of Hexi algorithm.

[0151] S1403: If the first hash value and the second hash value are the same, the first end determines that the tampering status of the digital signature is not tampered with.

[0152] The above-mentioned digital signature is obtained based on the attribute information of the second end, and the digital signature is decrypted to obtain a first hash value; the attribute information is calculated using a preset hash algorithm to obtain a second hash value. Therefore, if the first hash value and the second hash value are different, it means that the digital signature has been changed, and the tampering status of the digital signature is determined to be tampered; if the first hash value and the second hash value are the same, the first end determines that the tampering status of the digital signature is not tampered.

[0153] S1303: If the certification center's logo exists in the certification center's trust list and the digital signature's tampering status is not tampered with, then check whether there is a second reference digital certificate in the certification center's revocation list.

[0154] The certification center is the issuing authority of the certificate. It is an authoritative, trustworthy, and impartial institution in the Public Key Infrastructure (PKI) application and must have authoritative characteristics. It is the core of the PKI system and the trust basis of PKI. It manages the entire life cycle of the public key. The main function of the certification center is to issue and manage digital certificates, which involves the entire life cycle of digital certificates, including issuing certificates, specifying the validity period of certificates, and ensuring that certificates can be revoked when necessary by issuing Certificate Revocation Lists (CRL, also known as Certificate Revocation Lists or Certificate Blacklists).

[0155] Therefore, if the first end's authentication center trust list contains the identifier of the authentication center to which the second reference digital certificate belongs, and the tampering status of the digital signature is not tampered with, it is necessary to continue to check whether the second reference digital certificate exists in the authentication center's revocation list.

[0156] S1304: If the second reference digital certificate does not exist in the revocation list of the certification center, it is determined that the legitimacy verification of the second digital certificate has passed.

[0157] If the second reference digital certificate does not exist in the revocation list of the certification center to which the second reference digital certificate belongs, it means that the second reference digital certificate is not in the certificate blacklist of the certification center or the second reference digital certificate is within the validity period of the specified certificate.

[0158] Therefore, if the second reference digital certificate does not exist in the revocation list of the certification center to which the second reference digital certificate belongs, it is determined that the legitimacy verification of the second digital certificate has passed; if the legitimacy verification of the second digital certificate has passed, it means that the certification center's logo exists in the certification center's trust list, the tampering status of the digital signature is not tampered with, and the second reference digital certificate does not exist in the revocation list of the certification center.

[0159] The above describes the case where the legitimacy verification of the second digital certificate passes. The following describes the case where the legitimacy verification of the second digital certificate fails through an embodiment. In one embodiment, if the authentication center's logo does not exist in the authentication center's trust list, or the tampering status of the digital signature is tampered with, or the second reference digital certificate exists in the authentication center's revocation list, if any one of the above three conditions is met, it means that the legitimacy verification of the second digital certificate fails.

[0160] If the first end determines that the legitimacy verification of the second digital certificate fails, it is considered that the second end sending the second digital certificate may be a forged end by an attacker. Therefore, in order to ensure security, the first end can actively disconnect the connection channel between itself and the second end.

[0161] In the above access authentication method, the first end decrypts the second digital certificate to obtain a second reference digital certificate, the second reference digital certificate includes the identifier and digital signature of the authentication center to which the second reference digital certificate belongs, detects whether the identifier of the authentication center exists in the pre-stored authentication center trust list, and verifies the tampering status of the digital signature. If the identifier of the authentication center exists in the authentication center trust list, and the tampering status of the digital signature is not tampered with, then detects whether the second reference digital certificate exists in the revocation list of the authentication center. If the second reference digital certificate does not exist in the revocation list of the authentication center, it is determined that the legitimacy verification of the second digital certificate has passed. In this method, the communication security between the first end and the second end is improved by detecting the identifier of the authentication center to which the second digital certificate belongs, the tampering status of the digital signature, and whether the second digital certificate is in the revocation list of the authentication center.

[0162] The above embodiment verifies the legitimacy of the second digital certificate. Optionally, the method for verifying the legitimacy of the first digital certificate may be the same as the method for verifying the legitimacy of the second digital certificate, which will not be described in detail here.

[0163] If the second end determines that the legitimacy verification of the first digital certificate fails, it can be considered that the first end sending the first digital certificate may be a forged end by an attacker. Therefore, in order to ensure security, the second end can actively disconnect the connection channel between itself and the first end.

[0164] In one embodiment, Fig.15 As shown, this embodiment includes the following steps:

[0165] S1501, if the first digital certificate and the second digital certificate are both valid, the first end establishes a connection channel with the second end; the connection channel includes a transmission protocol between the first end and the second end.

[0166] If both the first digital certificate and the second digital certificate are legal, it can be considered that the first end sending the first digital certificate is credible, and the second end sending the second digital certificate is credible, that is, the two-way digital certificate verification is passed.

[0167] When the two-way digital certificate verification is passed, the first end can establish a secure connection channel between itself and the second end. The connection channel can be established by the first end sending a transmission protocol between the first end and the second end to the second end.

[0168] Optionally, the type of the connection channel can be determined according to actual conditions. For example, the connection channel can be a Transport Layer Security (TLS) connection channel, a Transmission Control Protocol (TCP) connection channel, and a Secure Sockets Layer (SSL) connection channel.

[0169] The first end establishes a secure connection channel with the second end, which can ensure the reliability and security of message transmission between the first end and the second end.

[0170] S1502: The first end receives an access message from the second end through a connection channel.

[0171] Based on the above-mentioned first end building a connection channel with the second end, after the second end receives the information of building the connection channel sent by the first end, the second end will send an access message to the first end through the connection channel.

[0172] After the connection channel between the first end and the second end is established, the second end can obtain access data and generate an access message based on the access data. The access message can be obtained by signing the access data using the private key of the second digital certificate of the second end; the access data is the access authentication request data sent by the second end to the first end.

[0173] In the above access authentication method, if both the first digital certificate and the second digital certificate are legal, the first end builds a connection channel with the second end; the connection channel includes a transmission protocol between the first end and the second end, and the first end receives the access message of the second end through the connection channel. In this method, before performing access authentication, the first end and the second end first exchange digital certificates and perform two-way digital certificate verification. After the two-way verification is passed, the first end builds a connection channel with the second end to receive the access message of the second end, which can effectively ensure the legitimacy of the devices of both parties, thereby effectively ensuring the security of the access authentication process.

[0174] In one embodiment, Fig.16 As shown, the access message includes access data and signature data; the second digital certificate includes the public key of the second digital certificate; then the first end authenticates the access message, including:

[0175] S1601, the first end decrypts the signature data according to the public key of the second digital certificate to obtain first summary information.

[0176] After the first end verifies the legitimacy of the second digital certificate, it will save the second digital certificate and obtain the public key of the second digital certificate from the second digital certificate.

[0177] The access message includes access data and signature data; wherein the signature data is obtained by signing the second end according to the access data and the private key of the second digital certificate.

[0178] The signature data may be generated by extracting the summary of the access message according to a summary extraction method pre-agreed between the second end and the first end to obtain summary information of the access message, and encrypting the summary information of the access message using the private key of the second digital certificate. The encryption method is based on an encryption algorithm pre-determined between the second end and the first end to generate encrypted summary information, i.e., the signature data.

[0179] Among them, the summary extraction method can be set according to actual application requirements, for example, the summary algorithm (Digest), the summary algorithm is divided into the message digest algorithm (Message Digest, MD), the secure hash algorithm and the message authentication code (Message Authentication Code, MAC); the encryption algorithm can also be set according to actual application requirements, for example, the block cipher algorithm, the elliptic curve public key cryptography algorithm and the hash algorithm, etc.; this embodiment does not impose any restrictions on the summary extraction method and the type of encryption algorithm.

[0180] After obtaining the signature data, the second end sends the access data and the signature data as an access message to the first end; after receiving the access message, the first end first decrypts the signature data according to the public key of the second digital certificate to obtain the first summary information.

[0181] When decrypting the signature data, the decryption algorithm used is the decryption algorithm agreed upon in advance by the first end and the second end, and is the decryption algorithm corresponding to the encryption algorithm used when the second end obtains the signature data.

[0182] If the first end successfully decrypts the signature data, it means that the access message is sent by the second end. If the signature data cannot be decrypted, it means that the access message is not sent by the second end. If it is determined that the access message is not sent by the second end, the first end can actively disconnect the connection channel with the second end.

[0183] S1602: The first end determines a digest extraction method for signature data, and extracts a digest of access data using the digest extraction method to obtain second digest information.

[0184] If the first end successfully decrypts the signature data of the access message according to the public key of the second digital certificate to obtain the first summary information, the first end will extract the summary of the access data in the access message according to the summary extraction method pre-agreed with the second end to obtain the second summary information.

[0185] It should be noted that the digest extraction method corresponding to the second digest information is the same as the digest extraction method for obtaining the signature data, which is a digest extraction method agreed upon in advance by the first end and the second end, and the embodiment of the present application does not impose any limitation on the digest extraction method.

[0186] S1603: Compare the first summary information with the second summary information. If the first summary information and the second summary information are the same, the first end determines that the access message authentication is successful.

[0187] The first summary information and the second summary information obtained above are compared. If the first summary information and the second summary information are the same, it means that the access data has not been tampered with, and the first end determines that the access message authentication is successful; if the first summary information and the second summary information are different, it means that the access data has been tampered with.

[0188] In the above access authentication method, the first end decrypts the signature data according to the public key of the second digital certificate to obtain the first summary information, the first end determines the summary extraction method of the signature data, and extracts the summary of the access data by the summary extraction method to obtain the second summary information, and compares the first summary information and the second summary information. If the first summary information and the second summary information are the same, the first end determines that the access message authentication is passed. In this method, the access data in the access message is authenticated to ensure the communication security between the first end and the second end.

[0189] In one embodiment, Fig.17 As shown, the access message includes access data and cyclic redundancy check data; the second digital certificate includes the public key of the second digital certificate; the first end authenticates the access message, including the following steps:

[0190] S1701, the first end decrypts the cyclic redundancy check data according to the public key of the second digital certificate to obtain a first cyclic redundancy check value.

[0191] After the first end verifies the legitimacy of the second digital certificate, it will save the second digital certificate and obtain the public key of the second digital certificate from the second digital certificate.

[0192] The access message includes access data and cyclic redundancy check data; wherein the cyclic redundancy check data is generated by the second end according to the access data and the private key of the second digital certificate.

[0193] Cyclic Redundancy Check (CRC) is a channel coding technology that generates a short fixed-bit check code based on data such as network packets or computer files. It is mainly used to detect or verify errors that may occur after data transmission or storage. It uses the principle of division and remainder for error detection.

[0194] During the data transmission process, no matter how perfect the design of the transmission system is, errors will always exist. Such errors may cause one or more frames transmitted on the link to be destroyed (bit errors occur, 0 becomes 1, or 1 becomes 0), so that the receiver receives erroneous data. In order to maximize the accuracy of the data received by the receiver, the data needs to be error-checked before the receiver receives the data. The receiver will actually receive the data only when the detection result is correct.

[0195] There are many ways to detect, the most common ones are parity check, Internet check and cyclic redundancy check. Cyclic redundancy check is a calculation method used to check the accuracy of digital transmission on a communication link. It uses a certain mathematical operation to establish the agreed relationship between data bits and check bits; the sending computer uses a formula to calculate a value of the information contained in the transmitted data, and attaches this value to the transmitted data. The receiving computer performs the same calculation on the same data and should get the same result. If the two CRC results are inconsistent, it means that an error occurred during the transmission, and the receiving computer can ask the sending computer to resend the data.

[0196] Therefore, the second end may send an access message with cyclic redundancy check data to the first end, and determine whether the access message sent by the second end has been tampered with by verifying the cyclic redundancy check data.

[0197] The access message sent by the second end to the first end includes access data and cyclic redundancy check data, wherein the cyclic redundancy check data may be generated in a manner that the second end uses a check value generation method pre-agreed with the first end to calculate a cyclic redundancy check value of the access data, and simultaneously uses a private key of a second digital certificate to encrypt the cyclic redundancy check value of the access data, wherein the encryption method is based on encryption using an encryption algorithm pre-determined by the second end and the first end to generate an encrypted cyclic redundancy check value, i.e., cyclic redundancy check data.

[0198] Among them, the check value generation method can be set according to actual application requirements. For example, the CRC method can be used. The encryption algorithm can be the same as the limited content of the above embodiment, which will not be repeated here.

[0199] After the second end obtains the cyclic redundancy check data, it sends the access data and the cyclic redundancy check data as an access message to the first end; after the first end receives the access message, it first decrypts the cyclic redundancy check data according to the public key of the second digital certificate to obtain a first cyclic redundancy check value.

[0200] When decrypting the cyclic redundancy check data, the decryption algorithm used is a decryption algorithm agreed upon in advance by the first end and the second end, and is a decryption algorithm corresponding to the encryption algorithm used when the second end obtains the cyclic redundancy check data.

[0201] If the first end successfully decrypts the cyclic redundancy check data, it means that the access message is sent by the second end. If the cyclic redundancy check data cannot be decrypted, it means that the access message is not sent by the second end. If it is determined that the access message is not sent by the second end, the first end can actively disconnect the connection channel with the second end.

[0202] S1702: The first end calculates the access data according to a preset check value generation method to obtain a second cyclic redundancy check value.

[0203] If the first end successfully decrypts the cyclic redundancy check data of the access message according to the public key of the second digital certificate and obtains the first cyclic redundancy check value, then the first end will calculate the access data in the access message according to the check value generation method pre-agreed with the second end to obtain the second cyclic redundancy check value.

[0204] It should be noted that the method for generating the check value corresponding to the second cyclic redundancy check value is the same as the method for generating the check value of the cyclic redundancy check data, which is a method for generating a check value agreed upon in advance by the first end and the second end, and the embodiment of the present application does not impose any limitation on the method for generating the check value.

[0205] S1703, comparing the first cyclic redundancy check value and the second cyclic redundancy check value, if the first cyclic redundancy check value and the second cyclic redundancy check value are the same, the first end determines that the access message authentication is successful.

[0206] The first cyclic redundancy check value and the second cyclic redundancy check value obtained above are compared. If the first cyclic redundancy check value and the second cyclic redundancy check value are the same, it indicates that the access data has not been tampered with, and the first end determines that the access message authentication is successful; if the first cyclic redundancy check value and the second cyclic redundancy check value are different, it indicates that the access data has been tampered with.

[0207] In the above access authentication method, the first end decrypts the cyclic redundancy check data according to the public key of the second digital certificate to obtain a first cyclic redundancy check value; the first end calculates the access data according to a preset check value generation method to obtain a second cyclic redundancy check value; compares the first cyclic redundancy check value and the second cyclic redundancy check value; if the first cyclic redundancy check value and the second cyclic redundancy check value are the same, the first end determines that the access message authentication is passed. In this method, the access data in the access message is authenticated to ensure the communication security between the first end and the second end.

[0208] In one embodiment, the first end parses the access message, determines the data transmission protocol corresponding to the access message, checks the order of the access message according to the data transmission protocol, and corrects the messages with incorrect order; in actual applications, when the first end sends multiple access messages to the second end, the delivery order of each access message may be different from the sending order. At this time, the order of the access messages can be checked according to the data transmission protocol, and the messages with incorrect order can be corrected.

[0209] In one embodiment, when the access message authentication is passed, the first end adds the second end to the whitelist. Using the whitelist method, network services are provided to the second end that has passed the access authentication. When the second end goes offline, it is removed from the whitelist, and the second end needs to re-authenticate when it accesses again.

[0210] For example, when the second end communicates normally with the first end, if the first end obtains a message sent by the second end, it can determine whether the second end is in the whitelist. If so, the message is received normally and the message is subjected to corresponding security analysis and sent down. If not, the sending of the message is blocked.

[0211] In one embodiment, taking the first end as a security protection device and the second end as a business host as an example, by exchanging digital certificates with the business host, performing two-way digital certificate verification, and verifying the access message sent by the business host, the business host that passes the verification is allowed to access, thereby realizing an access authentication scheme based on a dual verification mechanism of identity verification and instruction verification, which can ensure the secure access of the business host, thereby effectively improving the communication security between the business host and the security protection device, and avoiding the communication risks brought to the business host and the security protection device by key leakage or lack of identity authentication mechanism.

[0212] In one embodiment, the first end is a security protection device, the second end is a service host, and the access message is an access authentication request message. Fig.18 As shown, this embodiment includes:

[0213] S1801, after receiving the handshake request sent by the service host, the security protection device sends the second digital certificate of the security protection device to the service host, so that the service host verifies the second digital certificate.

[0214] Wherein, the second digital certificate includes the identity information of the security protection device;

[0215] Before the security protection device sends the second digital certificate to the service host, the second digital certificate may be encrypted using the public key of the service host;

[0216] Before the service host verifies the second digital certificate, the service host decrypts the second digital certificate using the service host's private key;

[0217] The business host verifies the second digital certificate, which may include: determining whether the second digital certificate is issued by a certification center, whether it has been tampered with, and whether it is in a revocation list; if the second digital certificate is issued by a certification center, has not been tampered with, and is not in a revocation list, determining that the second digital certificate has been verified;

[0218] The verification method is related to the type of certificate, which includes Public Key Infrastructure (PKI) digital certificates, 509 certificates, etc.

[0219] S1802, after the service host verifies the second digital certificate, it sends the first digital certificate to the security protection device; after receiving the first digital certificate, the security protection device verifies the first digital certificate.

[0220] The first digital certificate includes the identity information of the service host.

[0221] Before the business host sends the first digital certificate to the security protection device, the first digital certificate is encrypted using the public key of the security protection device; before the security protection device verifies the first digital certificate, the first digital certificate is decrypted using the private key of the security protection device; verifying the first digital certificate of the business host may include: determining whether the first digital certificate is issued by an authentication center, whether it has been tampered with, and whether it is in a revocation list; if the first digital certificate is issued by an authentication center, has not been tampered with, and is not in a revocation list, then determining that the first digital certificate has been verified successfully.

[0222] S1803: If the service host determines that the second digital certificate verification is successful, and the security protection device determines that the first digital certificate verification is successful, it is determined that the two-way digital certificate verification is successful.

[0223] In addition, the security protection device saves the first digital certificate of the business host and obtains the public key of the first digital certificate, and the business host saves the second digital certificate of the security protection device and obtains the public key of the second digital certificate.

[0224] If the business host determines that the second digital certificate verification fails, the business host disconnects the connection channel between the security protection device; if the security protection device determines that the first digital certificate verification fails, the security protection device disconnects the connection channel between the business host.

[0225] S1804: The security protection device builds a secure connection channel between itself and the service host.

[0226] The secure connection channel may be a Transport Layer Security (TLS) connection channel or a Transmission Control Protocol (TCP) connection channel, etc.

[0227] S1805: The service host sends an access authentication request message to the security protection device based on the secure connection channel.

[0228] S1806: The security protection device uses the public key of the first digital certificate to authenticate the access authentication request message.

[0229] If the access authentication request message includes the access authentication data and signature data, the security protection device authenticates the access authentication request message using the public key of the first digital certificate.

[0230] The signature data is obtained by signing the access authentication data according to the private key of the first digital certificate of the service host.

[0231] The specific method of obtaining the signature data is as follows: the summary of the access authentication data is extracted using the HASH algorithm (summary extraction method) to obtain the first summary information, and the first summary information is encrypted using the private key of the first digital certificate to obtain the encrypted summary information, i.e., the signature data.

[0232] Specifically, the signature verification method is: the security protection device uses the public key of the first digital certificate to decrypt the signature data in the access authentication request message to obtain the first summary information; the security protection device extracts the access authentication data in the access authentication request message based on the summary extraction method corresponding to the signature data (a pre-agreed method) to obtain the second summary information; the first summary information and the second summary information are compared; if the first summary information and the second summary information are the same, it means that the access authentication data has not been tampered with, and it is determined that the access authentication request message has passed the signature verification; otherwise, the signature verification fails.

[0233] If the access authentication request message includes access authentication data and cyclic redundancy check data, the security protection device uses the public key of the first digital certificate to verify the signature of the access authentication request message.

[0234] Among them, the cyclic redundancy check data is generated by the service host according to a pre-agreed check value generation method, and the first cyclic redundancy check value is calculated according to the access authentication data. At the same time, the private key of the first digital certificate is used to encrypt the first cyclic redundancy check value based on the pre-agreed encryption algorithm to generate an encrypted cyclic redundancy check value, thereby obtaining the cyclic redundancy check data.

[0235] The signature verification method is: the security protection device uses the public key of the first digital certificate and a pre-agreed decryption algorithm to decrypt the cyclic redundancy check data to obtain a first cyclic redundancy check value; the security protection device obtains a second cyclic redundancy check value based on the pre-agreed check value generation method and the access authentication data; the first cyclic redundancy check value and the second cyclic redundancy check value are the same, indicating that the access authentication data has not been tampered with, and it is determined that the access authentication request message has passed the signature verification; otherwise, the signature verification fails.

[0236] S1807, when the access authentication request message passes the authentication, a response message of access authentication success is sent to the service host; when the access authentication request message fails the signature verification, a response message of access authentication failure is sent to the service host.

[0237] When the access authentication request message passes the signature verification, the business host is allowed to access, and a response message of successful access authentication is sent to the business host. At the same time, the security protection device can start normal communication with the business host; when the access authentication request message fails the signature verification, the security protection device can actively disconnect the connection channel between itself and the business host, and send a response message of access authentication failure to the business host (reply to the message of access rejection).

[0238] In addition, when the access authentication request message passes the signature verification, the security protection device adds the service host to the whitelist.

[0239] You can use the whitelist method to provide network services to business hosts that have passed access authentication. When a business host goes offline, it is removed from the whitelist and needs to be re-authenticated when it accesses again.

[0240] When the service host and the security protection device communicate normally, if the security protection device obtains the message sent by the service host, it can determine whether the service host is on the whitelist. If so, the message is received normally and the message is subjected to corresponding security analysis and sent down. If not, the sending of the message is blocked.

[0241] The specific definition of the access authentication method provided in this embodiment can refer to the step definition of each embodiment of the access authentication method above, which will not be repeated here.

[0242] It should be understood that, although each step in the attached flow chart in the above-described embodiment is shown in sequence according to the indication of the arrow, these steps are not necessarily performed in sequence according to the order indicated by the arrow. Unless there is clear explanation in this article, the execution of these steps does not have strict order restriction, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the attached figure in the above-described embodiment may include a plurality of steps or a plurality of stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of the steps or stages in other steps or other steps.

[0243] In one embodiment, Fig.19 As shown, the embodiment of the present application further provides an access authentication device 1900, the device 1900 includes: a verification module 1901, a first sending module 1902, an authentication module 1903 and a second sending module 1904, wherein:

[0244] Verification module 1901, used for the first end to respond to the handshake request sent by the second end, and the first end to perform a digital certificate verification operation; the digital certificate verification operation is used to verify the legitimacy of the first digital certificate of the first end and the second digital certificate of the second end;

[0245] A first sending module 1902, configured to send an information authentication instruction from the first end to the second end if both the first digital certificate and the second digital certificate are valid, wherein the information authentication instruction is used to obtain an access message from the second end;

[0246] Authentication module 1903, used for the first end to authenticate the access message;

[0247] The second sending module 1904 is configured to, if the access message authentication is successful, cause the first end to send a response message indicating successful authentication to the second end; the response message indicates that data communication is allowed between the first end and the second end.

[0248] In one embodiment, the verification module 1901 includes:

[0249] A first sending unit, configured to send the first digital certificate from the first end to the second end to instruct the second end to verify the legitimacy of the first digital certificate;

[0250] A second sending unit, configured to receive at the first end a second digital certificate sent by the second end, wherein the second digital certificate is sent after the second end determines that the first digital certificate is legitimate;

[0251] A verification unit, configured to verify the legitimacy of the second digital certificate at the first end;

[0252] The first determining unit is configured to determine, at the first end, that both the first digital certificate and the second digital certificate are legal if the legality verification of the second digital certificate passes.

[0253] In one embodiment, the first sending unit includes:

[0254] The encryption subunit is used for the first end to encrypt the first reference digital certificate according to the public key of the second end to obtain the first digital certificate; the first reference digital certificate includes the identity information of the first end;

[0255] The first sending subunit is used to send the first digital certificate to the second end.

[0256] In one embodiment, the verification unit includes:

[0257] A first decryption subunit is used for the first end to decrypt the second digital certificate to obtain a second reference digital certificate; the second reference digital certificate includes an identifier and a digital signature of a certification center to which the second reference digital certificate belongs;

[0258] A first detection subunit is used to detect whether there is an identification of the authentication center in the pre-stored authentication center trust list, and to verify the tampering status of the digital signature;

[0259] A second detection subunit is used to detect whether there is a second reference digital certificate in the revocation list of the certification center if the certification center's identification exists in the certification center's trust list and the tampering status of the digital signature is not tampered with;

[0260] The first determination subunit is used to determine whether the legitimacy verification of the second digital certificate has passed if the second reference digital certificate does not exist in the revocation list of the certification center.

[0261] In one embodiment, the first detection subunit comprises:

[0262] A second decryption subunit is used for the first end to obtain the public key of the authentication center, and decrypt the digital signature according to the public key of the authentication center to obtain a first hash value;

[0263] A calculation subunit, configured to calculate the attribute information at the first end according to a preset hash algorithm to obtain a second hash value;

[0264] The second determining subunit is configured to determine, at the first end, that the tampering status of the digital signature is not tampered with if the first hash value and the second hash value are the same.

[0265] In one embodiment, the apparatus 1900 further includes:

[0266] A construction module, configured to, if both the first digital certificate and the second digital certificate are valid, cause the first end to construct a connection channel with the second end; the connection channel includes a transmission protocol between the first end and the second end;

[0267] The receiving module is used for the first end to receive the access message from the second end through the connection channel.

[0268] In one embodiment, the authentication module 1903 includes:

[0269] A first decryption unit, configured to decrypt the signature data at the first end according to the public key of the second digital certificate to obtain first summary information;

[0270] An extraction unit, configured to determine, at the first end, a method for extracting a summary of the signature data, and extract the summary of the access data by using the summary extraction method to obtain second summary information;

[0271] The second determining unit is configured to compare the first summary information with the second summary information, and if the first summary information and the second summary information are the same, the first end determines that the access message authentication is successful.

[0272] In one embodiment, the authentication module 1903 includes:

[0273] A second decryption unit, configured to decrypt the cyclic redundancy check data at the first end according to the public key of the second digital certificate to obtain a first cyclic redundancy check value;

[0274] A calculation unit, configured to calculate the access data at the first end according to a preset check value generation method to obtain a second cyclic redundancy check value;

[0275] The third determination unit is used to compare the first cyclic redundancy check value and the second cyclic redundancy check value. If the first cyclic redundancy check value and the second cyclic redundancy check value are the same, the first end determines that the access message authentication is successful.

[0276] For the specific definition of the access authentication device, please refer to the definition of each step in the access authentication method above, which will not be repeated here. Each module in the above access authentication device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above modules can be embedded in or independent of the target device in the form of hardware, or can be stored in the memory of the target device in the form of software, so that the target device can call and execute the operations corresponding to each of the above modules.

[0277] In one embodiment, a computer device is provided, such as Fig. 20 As shown, the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, an access authentication method is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0278] Those skilled in the art will appreciate that the structural description of the above-mentioned computer device is only a partial structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0279] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0280] The implementation principles and technical effects of each step implemented by the processor in this embodiment are similar to those of the above-mentioned access authentication method, and will not be repeated here.

[0281] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0282] The implementation principles and technical effects of the steps implemented when the computer program in this embodiment is executed by the processor are similar to the principles of the above-mentioned access authentication method, and will not be repeated here.

[0283] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0284] The implementation principles and technical effects of the steps implemented when the computer program in this embodiment is executed by the processor are similar to the principles of the above-mentioned access authentication method, and will not be repeated here.

[0285] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0286] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0287] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0288] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An access authentication method, characterized in that: The method comprises: The first end responds to the handshake request sent by the second end, and the first end performs a digital certificate verification operation; the digital certificate verification operation is used to verify the legitimacy of the first digital certificate of the first end and the second digital certificate of the second end; in the case where the first end is a business host, the second end is a security protection device, and, in the case where the first end is a security protection device, the second end is a business host; the business host refers to the equipment in each security zone in the power monitoring system, and the security protection device refers to the security gateway device in the power monitoring system; If both the first digital certificate and the second digital certificate are legal, the first end sends an information authentication instruction to the second end, where the information authentication instruction is used to obtain an access message from the second end; The first end authenticates the access message; If the access message is authenticated, the first end sends a response message of successful authentication to the second end; the response message indicates that data communication is allowed between the first end and the second end; The first end performs a digital certificate verification operation, including: The first end sends the first digital certificate to the second end to instruct the second end to verify the legitimacy of the first digital certificate; The first end receives a second digital certificate sent by the second end, where the second digital certificate is sent by the second end after the second end determines that the first digital certificate is legitimate; The first end verifies the legitimacy of the second digital certificate; If the legitimacy verification of the second digital certificate passes, the first end determines that both the first digital certificate and the second digital certificate are legal; The first end verifies the legitimacy of the second digital certificate, including: The first end decrypts the second digital certificate to obtain a second reference digital certificate; the second reference digital certificate includes an identifier and a digital signature of a certification authority to which the second reference digital certificate belongs; Detecting whether the identification of the authentication center exists in the pre-stored authentication center trust list, and verifying the tampering status of the digital signature; If the identification of the certification center exists in the certification center trust list, and the tampering status of the digital signature is not tampered with, then detecting whether the second reference digital certificate exists in the certification center's revocation list; If the second reference digital certificate does not exist in the revocation list of the certification center, determining that the legitimacy verification of the second digital certificate passes; The second reference digital certificate also includes attribute information of the second end; and the verifying the tampering status of the digital signature includes: The first end obtains the public key of the authentication center, and decrypts the digital signature according to the public key of the authentication center to obtain a first hash value; The first end calculates the attribute information according to a preset hash algorithm to obtain a second hash value; If the first hash value and the second hash value are the same, the first end determines that the tampering status of the digital signature is not tampered with.

2. The method according to claim 1, characterized in that The first end sends a first digital certificate to the second end, including: The first end encrypts the first reference digital certificate according to the public key of the second end to obtain the first digital certificate; the first reference digital certificate includes the identity information of the first end; The first digital certificate is sent to the second end.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: If both the first digital certificate and the second digital certificate are valid, the first end establishes a connection channel with the second end; the connection channel includes a transmission protocol between the first end and the second end; The first end receives the access message from the second end through the connection channel.

4. The method according to claim 1 or 2, characterized in that: The access message includes access data and signature data; The second digital certificate includes a public key of the second digital certificate; The first end authenticates the access message, including: The first end decrypts the signature data according to the public key of the second digital certificate to obtain first summary information; The first end determines a digest extraction method for the signature data, and extracts a digest of the access data by using the digest extraction method to obtain second digest information; The first end compares the first summary information with the second summary information. If the first summary information is the same as the second summary information, the first end determines that the access message is authenticated.

5. The method according to claim 1 or 2, characterized in that: The access message includes access data and cyclic redundancy check data; The second digital certificate includes a public key of the second digital certificate; The first end authenticates the access message, including: The first end decrypts the cyclic redundancy check data according to the public key of the second digital certificate to obtain a first cyclic redundancy check value; The first end calculates the access data according to a preset check value generation method to obtain a second cyclic redundancy check value; The first end compares the first cyclic redundancy check value with the second cyclic redundancy check value. If the first cyclic redundancy check value is the same as the second cyclic redundancy check value, the first end determines that the access message authentication is successful.

6. The method according to claim 1 or 2, characterized in that: The information authentication instruction refers to a sending signal of the second end sending the access message to the first end; The access message is a connection message.

7. The method according to claim 1 or 2, characterized in that: The authentication methods of the access message include authentication using a traditional encryption method, a message authentication code method using a key, an authentication method using a one-way hash function, and a digital signature authentication method.

8. The method according to claim 1 or 2, characterized in that: The response message consists of a status line, a response header, a blank line and a response body. The status line consists of a HyperText Transfer Protocol (HTTP) version field, a status code and a description text of the status code. The status code consists of three digits.

9. An access authentication device, characterized in that: The device comprises: A verification module, for a first end to respond to a handshake request sent by a second end, the first end performing a digital certificate verification operation; the digital certificate verification operation is used to verify the legitimacy of a first digital certificate of the first end and a second digital certificate of the second end; in the case where the first end is a business host, the second end is a security protection device, and, in the case where the first end is a security protection device, the second end is a business host; the business host refers to a device in each security zone in a power monitoring system, and the security protection device refers to a security gateway device in the power monitoring system; A first sending module, configured to, if both the first digital certificate and the second digital certificate are legal, send an information authentication instruction by the first end to the second end, wherein the information authentication instruction is used to obtain an access message from the second end; An authentication module, configured for the first end to authenticate the access message; A second sending module, configured to, if the access message is authenticated successfully, cause the first end to send a response message of successful authentication to the second end; the response message indicates that data communication is allowed between the first end and the second end; The verification module includes: a sending unit, a receiving unit, a checking unit and a determining unit, wherein: a sending unit, specifically configured for the first end to send the first digital certificate to the second end, so as to instruct the second end to verify the legitimacy of the first digital certificate; A receiving unit, specifically configured for the first end to receive a second digital certificate sent by the second end, where the second digital certificate is sent by the second end after the second end determines that the first digital certificate is legitimate; A verification unit, specifically configured for the first end to verify the legitimacy of the second digital certificate; a determination unit, specifically configured to determine, by the first end, that both the first digital certificate and the second digital certificate are legal if the legality verification of the second digital certificate passes; The verification unit is specifically further used for the first end to decrypt the second digital certificate to obtain a second reference digital certificate; the second reference digital certificate includes the identifier and digital signature of the authentication center to which the second reference digital certificate belongs; detecting whether the identifier of the authentication center exists in the pre-stored authentication center trust list, and verifying the tampering status of the digital signature; if the identifier of the authentication center exists in the authentication center trust list, and the tampering status of the digital signature is not tampered with, detecting whether the second reference digital certificate exists in the revocation list of the authentication center; if the second reference digital certificate does not exist in the revocation list of the authentication center, determining that the legitimacy verification of the second digital certificate has passed; The second reference digital certificate also includes attribute information of the second end; the verification unit is specifically used for the first end to obtain the public key of the authentication center, and decrypt the digital signature according to the public key of the authentication center to obtain a first hash value; the first end calculates the attribute information according to a preset hash algorithm to obtain a second hash value; if the first hash value and the second hash value are the same, the first end determines that the tampering status of the digital signature is not tampered with.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images