Device authentication and verification method, device, equipment and storage medium

Abstract

According to an embodiment of the present disclosure, a method, apparatus, device and storage medium for device authentication and verification are provided. The method for device authentication includes: at a first device, sending a device activation request to a second device, the device activation request including identity authentication information of the first device and, in response to receiving an activation certificate from the second device, storing the activation certificate in a trusted environment associated with the first device. The method also includes sending a certificate signing request to the second device, the certificate signing request being generated in a trusted environment at least in part based on the activation certificate and storing a device certificate received from the second device in a trusted environment, the device certificate being generated based on the certificate signing request. In this way, a more reliable identity authentication and authorization mechanism is implemented on the basis of saving overhead, thereby eliminating the risk of loopholes for illegal profiteering caused by counterfeiting or impersonation of devices.

Description

Technical Field

[0001] Example embodiments of the present disclosure generally relate to the field of computers, and more particularly, to methods, apparatuses, devices, and computer-readable storage media for device authentication and verification. Background Art

[0002] At present, with the development of communication technology, more and more users obtain different types of services from service providers through smart communication devices such as smartphones, tablets, wearable devices, etc. However, criminals often take advantage of the characteristics of such devices that are easy to forge and impersonate to make a large number of virtual copies to commit identity fraud and illegal profiteering. Therefore, effective means are needed to eliminate the risk of such loopholes for illegal profiteering from the source. Summary of the invention

[0003] In a first aspect of the present disclosure, a method for device authentication is provided. The method includes, at a first device, sending a device activation request to a second device, the device activation request including identity authentication information of the first device and, in response to receiving an activation certificate from the second device, storing the activation certificate in a trusted environment associated with the first device. The method also includes sending a certificate signing request to the second device, the certificate signing request being generated in the trusted environment at least in part based on the activation certificate and storing a device certificate received from the second device in the trusted environment, the device certificate being generated based on the certificate signing request.

[0004] In a second aspect of the present disclosure, a method for device verification is provided. The method includes searching for an activation certificate in a trusted environment associated with a first device, the activation certificate being generated by a second device for authenticating the first device. In response to determining that the activation certificate exists in the trusted environment, the activation certificate is locally verified. The method also includes generating an activated verification identifier for use by the first device for identity verification of a local service in response to the activation certificate passing the local verification.

[0005] In a third aspect of the present disclosure, a method for device authentication is provided. The method includes, in response to receiving a device activation request from a first device, verifying, at a second device, identity authentication information of the first device indicated in the device activation request. In response to successful verification of the identity authentication information, sending an activation certificate to the first device. The method also includes, in response to receiving a certificate signing request from the first device, sending a device certificate to the first device, the device certificate being generated based on the certificate signing request.

[0006] In a fourth aspect of the present disclosure, a device for device authentication is provided. The device includes an activation request sending module, configured to send a device activation request to a second device, the device activation request including identity authentication information of the first device; an activation certificate storage module, configured to store the activation certificate in a trusted environment associated with the first device in response to receiving an activation certificate from the second device; a certificate signing request sending module, configured to send a certificate signing request to the second device, the certificate signing request being generated in the trusted environment at least partially based on the activation certificate; and a device certificate storage module, configured to store a device certificate received from the second device in the trusted environment, the device certificate being generated based on the certificate signing request.

[0007] In a fifth aspect of the present disclosure, a device for device verification is provided. The device includes: an activation certificate search module, configured to search for an activation certificate in a trusted environment associated with a first device, the activation certificate being generated by a second device for authenticating the first device; a local verification module, configured to perform local verification on the activation certificate in response to determining that the activation certificate exists in the trusted environment; and an activated verification identification generation module, configured to generate an activated verification identification for use in identity verification of the first device for a local service in response to the activation certificate passing the local verification.

[0008] In a sixth aspect of the present disclosure, a device for device authentication is provided. The device includes an authentication information verification module, configured to verify the identity authentication information of the first device indicated in the device activation request in response to receiving a device activation request from the first device; an activation certificate sending module, configured to send an activation certificate to the first device in response to the verification of the identity authentication information being successful; and a device certificate sending module, configured to send a device certificate to the first device in response to receiving a certificate signing request from the first device, the device certificate being generated based on the certificate signing request.

[0009] In a seventh aspect of the present disclosure, an electronic device is provided. The device includes at least one processing unit; and at least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit. When the instructions are executed by the at least one processing unit, the device executes the method described in the first aspect, the second aspect, or the third aspect.

[0010] In an eighth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the medium, and when the program is executed by a processor, the method described in the first aspect, the second aspect, or the third aspect is implemented.

[0011] It should be understood that the contents described in the summary of the present invention are not intended to limit the key features or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0013] Figure 1 A schematic diagram showing an example environment in which embodiments of the present disclosure can be implemented;

[0014] Figure 2 A schematic diagram showing an interactive process for device authentication according to some embodiments of the present disclosure is shown;

[0015] Figure 3 A schematic diagram showing an interactive process for device authentication according to some embodiments of the present disclosure is shown;

[0016] Figure 4 A schematic diagram showing an interactive process for device verification according to some embodiments of the present disclosure is shown;

[0017] Figure 5 A flowchart showing a process for device authentication according to some embodiments of the present disclosure is shown;

[0018] Figure 6 A flowchart of a process for device verification according to some embodiments of the present disclosure is shown;

[0019] Figure 7 A flowchart showing a process for device authentication according to some embodiments of the present disclosure is shown;

[0020] Figure 8 A flowchart of a process for device verification according to some embodiments of the present disclosure is shown;

[0021] Fig. 9 A block diagram of an apparatus for device authentication according to some embodiments of the present disclosure is shown;

[0022] Fig.10 A block diagram of an apparatus for device verification according to some embodiments of the present disclosure is shown;

[0023] Fig.11 A block diagram of an apparatus for device authentication according to some embodiments of the present disclosure is shown;

[0024] Fig.12A block diagram showing an apparatus for device verification according to some embodiments of the present disclosure; and

[0025] Fig.13 A block diagram of a device capable of implementing various embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0026] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0027] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below.

[0028] As mentioned above, when users use smart communication devices such as smartphones, smart tablets or wearable devices to obtain corresponding services, they often face the risk of the device being forged and used fraudulently. Criminals cheat by forging and using the device to obtain illegal profits.

[0029] Currently, there is a lack of effective means to identify illegal behaviors such as using simulators to create virtual devices to cheat, stealing or forging real users' device information to perform illegal operations, and using forged device information to obtain unauthorized service resources from the server side, which leads to the risk of damage to the interests of both users and servers.

[0030] In an embodiment of the present disclosure, the term "device authentication" may refer to the identity information registration and status activation process of a terminal device at a remote device. In an embodiment of the present disclosure, the term "device verification" may refer to the identity authentication performed on a terminal device according to the identity information of the terminal device that has been authenticated in the device authentication process during a request for a local or remote service.

[0031] According to various embodiments of the present disclosure, a scheme for device authentication and verification is proposed. For example, during the process of identity authentication of a terminal device, a service provider can provide an activation certificate for the terminal device to the device based on the identity authentication information of the terminal device. After storing the activation certificate in the trusted environment (TEE) of the terminal device, the terminal device sends a certificate signing request to the service provider. The service provider generates a device certificate by signing the public key generated by the terminal device in the certificate signing request and sends the device certificate to the terminal device. The terminal device stores the device certificate in the TEE to complete the authentication process of the terminal device.

[0032] When a terminal device requests local or remote related services, if the terminal device finds an activation certificate for the terminal device in its trusted environment, the legitimacy and validity of the activation certificate will be verified. On the one hand, if the activation certificate is successfully verified, an activated identification is generated for signature verification of locally accessible authorized services and resources. On the other hand, if the activation certificate is successfully verified, the terminal device can use the private key of the terminal device to send a remote service request to the service provider, and the service provider can use the public key in the device certificate to verify the service request to send a response to the service request.

[0033] According to the implementation of the present disclosure, by using activation certificates and device certificates in a trusted environment (TEE) and combining digital signatures to mutually confirm the identity and authorization services between the device side and the server side, a more reliable device identity authentication and verification process can be provided. In this way, counterfeiting and fraudulent use of the device can be eliminated and illegal acquisition of service resources on the device or server side can be prevented.

[0034] Example Environment

[0035] See first Figure 1 , which schematically illustrates a diagram of an example environment 100 in which example implementations according to the present disclosure may be implemented.

[0036] like Figure 1 As shown, the environment 100 may include a terminal device 110 (also referred to as a first device in the present disclosure) and a remote device 120 (also referred to as a second device in the present disclosure). In the example environment 100, the remote device 120 may communicate with the terminal device 110 to implement the provision of the service requested by the terminal device 110.

[0037] In some embodiments, the service requested by the terminal device 110 may include, for example, a service directly obtained from the remote device 120 , or may include a service provided by the remote device 120 to an application installed on the terminal device 110 .

[0038] In some embodiments, during the process of the terminal device 110 establishing a connection with the remote device 120 and requesting the required service, the remote device 120 can authenticate the identity of the terminal device 110 to determine the service permissions that the terminal device 110 can request, thereby providing the terminal device 110 with services within the scope permitted by the service permissions.

[0039] In some embodiments, the terminal device 110 can be any type of mobile terminal, fixed terminal or portable terminal, including mobile phones, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, media computers, multimedia tablets, personal communication systems (PCS) devices, personal navigation devices, personal digital assistants (PDAs), audio / video players, digital cameras / camcorders, positioning devices, television receivers, radio broadcast receivers, e-book devices, gaming devices, or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof. In some embodiments, the terminal device 110 can also support any type of interface for the user (such as "wearable" circuits, etc.). The remote device 120 can, for example, be various types of computing systems / servers that can provide computing power, including but not limited to mainframes, edge computing nodes, computing devices in cloud environments, and the like.

[0040] It should be understood that the structure and functionality of environment 100 are described for exemplary purposes only and does not imply any limitation on the scope of the present disclosure.

[0041] Device Authentication Process

[0042] Figure 2 FIG. 2 is a schematic diagram of a process 200 for device authentication according to some embodiments of the present disclosure. The process 200 may be implemented at the terminal device 110 and the remote device 120. For ease of discussion, reference will be made to FIG. Figure 1 The process 200 is described with reference to the environment 100 of FIG.

[0043] Reference now Figure 2 , the terminal device 110 sends (204) an authentication activation request for the terminal device 110 to the remote device 120. The authentication activation request may include identity authentication information of the terminal device 110.

[0044] In some embodiments, the identity authentication information may include a device ID of the terminal device 110. The device ID is a unique ID of the terminal device 110, which may generally be a chip ID of the terminal device 110 or a production serial number of the terminal device 110. The device ID may be written into a trusted environment associated with the terminal device 110 when the terminal device 110 is produced to ensure the authenticity and non-tamperability of each read.

[0045] In some embodiments, the identity authentication information may also include the activation code of the terminal device 110 itself or password information such as the account password of the application or service requested by the terminal device 110. It should be understood that in different request activation scenarios for the terminal device 110, the identity authentication information may include other information corresponding to the current request activation scenario.

[0046] The remote device 120 verifies the identity authentication information received from the terminal device 110. In some implementations, the remote device 120 may determine the scope of services authorized by the terminal device 110 based on the identity authentication information, such as the services that the terminal device 110 can use. Optionally or additionally, the remote device 120 may also determine the time limit for the terminal device 110 to use these services. The remote device 120 may generate authorization content for the terminal device 110 based on the above determined content.

[0047] In some embodiments, the remote device 120 may generate an asymmetric key pair (also referred to as a first asymmetric key pair in the present disclosure). The first asymmetric key pair may be generated, for example, by a public key system (RSA). Optionally or additionally, the asymmetric key pair may also be generated, for example, by other digital signature methods such as a digital signature algorithm (DSA) and an elliptic curve digital signature algorithm (ECDSA).

[0048] The remote device 120 may perform a hash calculation on the determined authorization content for the terminal device 110 to generate a digest value. By encrypting the authorization content and the digest value using the first private key in the first asymmetric key pair, the remote device 120 may generate (206) an activation certificate (activate.crt) for the terminal device 110. In addition to the encrypted content confidence, the activation certificate may also include the first public key in the first asymmetric key pair. In addition, the activation certificate may also include the device identity of the terminal device 110. It should be understood that an activation certificate is uniquely issued by the remote device 120 for one terminal device.

[0049] The remote device 120 sends (208) the generated activation certificate to the terminal device 110. After receiving the activation certificate, the terminal device 110 can perform signature verification on the activation certificate. For example, the terminal device 110 can use the first public key in the activation certificate to decrypt the signature of the activation certificate to obtain field information in the activation certificate, such as the authorization content and the summary value associated with the authorization content. The terminal device 110 can also perform a hash calculation on the authorization content to generate another summary value, and compare the other summary value with the summary value decrypted from the activation certificate. If the two summary values ​​are the same, it means that the activation certificate is successfully verified.

[0050] The successfully verified activation certificate may be stored (210) by the terminal device 110 in a trusted environment associated with the terminal device 110. In some embodiments, the trusted environment of the terminal device 110 depends on the type of operating system running on the terminal device 110. For example, if the system running on the terminal device 110 is an Android system, the trusted environment may be a trusted environment based on the Android system. Optionally or additionally, the trusted environment of the terminal device 110 may also depend on other hardware and / or software environments associated with the terminal device 110. By introducing a trusted environment, sensitive information such as certificates and keys carried by trust can be guaranteed not to be leaked.

[0051] A pair of asymmetric key pairs (also referred to as second asymmetric key pairs in the present disclosure) may also be generated at the terminal device 110. The terminal device 110 may encrypt field information obtained from the activation certificate, such as authorization content, using a second private key in the second asymmetric key pair, and generate (212) a certificate signing request based on the encrypted field information and a second public key in the second asymmetric key pair. The certificate signing request may be, for example, a signature request file (CSR).

[0052] The terminal device 110 sends (214) the certificate signing request to the remote device 120. The remote device 120 may generate (216) a device certificate based on the certificate signing request.

[0053] Optionally, the remote device 120 may use the third private key in the third asymmetric key pair to encrypt the second public key and field information included in the certificate signing request to generate a device certificate (device.crt). The device certificate may also include the third public key in the third asymmetric key pair.

[0054] In addition, the device certificate may also include the device identity of the terminal device 110. It should be understood that a device certificate is uniquely issued by the remote device 120 for one terminal device.

[0055] The remote device 120 sends (218) the device certificate to the terminal device 110. The terminal device 110 can obtain the second public key and the field information by decrypting the device certificate using the third public key. If the terminal device 110 determines that the second public key has not been tampered with, the device certificate is stored (220) in a trusted environment. In addition, the terminal device 110 can also send an activation confirmation request for the terminal device 110 to the remote device 120. Once the remote device 120 receives the activation confirmation request, the current state of the terminal device 110 is set to activated.

[0056] Optionally, the terminal device 110 may restart the device after sending the activation confirmation request to the remote device 120 .

[0057] exist Figure 2 In the example process 200 shown, optionally or additionally, the terminal device 110 can establish (202) a secure connection with the remote device 120. In some embodiments, the secure connection can be an mTLS connection. The mTLS connection is a connection based on the link layer security protocol, which can establish a two-way encrypted channel between the terminal device 110 and the remote device 120 to ensure the security of communication between the terminal device 110 and the remote device 120. Once the mTLS connection is established, the communication between the terminal device 110 and the remote device 120 can be carried out under the link layer security protocol. For example, the authentication activation request and certificate signing request sent by the terminal device 110 to the remote device and the activation certificate and device certificate sent by the remote device 120 to the terminal device described above can all be transmitted via the mTLS connection.

[0058] By adopting a secure connection based on mTLS, a secure channel for trust transmission can be established in the initial stage of information interaction between the terminal device 110 and the remote device 120, thereby providing preliminary security guarantees for the communication process between the terminal device 110 and the remote device 120.

[0059] In some implementations, the mTLS connection can be established through a pre-set certificate (pre.crt). The pre-set certificate can be included in the factory settings of the terminal device 110. The pre-set certificate includes a private key (pre.key). The private key can be stored in the terminal device 110. The pre-set certificate can also include a batch certificate of the terminal device 110 and a public key of the pre-set certificate. The pre-set certificate can be set as a long-term valid type of certificate.

[0060] In some embodiments, the same pre-set certificate can be configured for different terminal devices. For example, different terminal devices can be different terminal devices produced in the same batch. In this way, the cost of configuring different pre-set certificates for different terminal devices can be reduced.

[0061] It should be understood that the mTLS connection established between the terminal device 110 and the remote device 120 is only one implementation of the present disclosure. Optionally or additionally, the terminal device 110 and the remote device 120 may also communicate based on other security protocols.

[0062] In this way, the terminal device 110 and the remote device 120 each hold a digital certificate containing authentication content, thereby achieving complete identity authentication of the device by the server through the mutual nesting of the activation certificate and the device certificate.

[0063] In combination Figure 2 In the device authentication process described above, the terminal device 110 ensures the reliability of the device authentication process by obtaining a security certificate issued by the remote device 120 in a trusted environment. In some embodiments, the interaction between the terminal device 110 and the remote device 120 may also include the interaction between the various components involved in the terminal device 110 and the remote device 120.

[0064] Figure 3 A schematic diagram of an interactive process for device authentication according to some embodiments of the present disclosure is shown. Figure 3 In the embodiment, the remote device 120 may include a gateway 121, a server 122, a database 123 and a certificate center 124. Figure 3 The process 300 of device authentication is further described in detail. The detailed description of the steps in the process 300 that are the same or similar to the steps in the process 200 will not be repeated here.

[0065] Reference now Figure 3 , the terminal device 110 can establish (302) a secure connection with the gateway 121. The terminal device 110 sends (304) an authentication activation request for the terminal device 110 to the gateway 120. The authentication activation request may include the identity authentication information of the terminal device 110. The gateway 121 may forward (306) the authentication activation request to the server 122. The server 122 may query (308) the identity authentication information associated with the terminal device 110 from the database 123. If the database 123 determines that the received identity authentication information of the terminal device 110 matches the identity authentication information queried in the database 123, the result of the successful query is sent (310) to the server 122. The server 122 generates an activation certificate issuance request and sends (312) the activation certificate issuance request to the certificate center 124. The issuance request may, for example, include the service scope of the terminal device 110 that is authorized as determined by the server 122, such as the services that the terminal device 110 can use.

[0066] In some embodiments, the certificate center 124 may generate a digest value for the service scope (also referred to as authorized content in the present disclosure) authorized for the terminal device 110 through hash calculation and encrypt the authorized content and the digest value using the first private key in the first asymmetric key pair to generate an activation certificate. The activation certificate is sent (314) from the certificate center 124 to the terminal device 110 via the server 123 and the gateway 122. The activation certificate may include the first public key in the first asymmetric key pair.

[0067] After the activation certificate is successfully verified by the terminal device 110 based on the first public key, the terminal device 110 stores ( 316 ) the activation certificate in a trusted environment.

[0068] The terminal device 110 can encrypt the field information, such as the authorization content, obtained from the activation certificate by using the second private key pair in the second asymmetric key pair generated by it, and generate (318) a certificate signing request based on the encrypted field information and the second public key in the second asymmetric key pair.

[0069] The terminal device 110 sends (320) the certificate signing request to the server 122 via the gateway 121. The server 122 calls (322) the certificate issuing interface of the certificate center 124 based on the certificate signing request. In the certificate center 124, the second public key and field information included in the certificate signing request can be encrypted using the third private key in the third asymmetric key pair to generate a device certificate. The device certificate can also include the third public key in the third asymmetric key pair.

[0070] The certificate center 124 sends ( 324 ) the issued device certificate to the server 122 , and the server 122 sends ( 326 ) the device certificate to the terminal device 110 via the gateway 121 .

[0071] The terminal device 110 stores (328) the device certificate in the trusted environment and sends (330) an activation confirmation request to the server 122 via the gateway 121. After receiving the activation confirmation request, the server 122 requests (332) the database 123 to change the status of the terminal device 110 in the database 123 to activation success.

[0072] pass Figure 3 The interaction process between the corresponding components in the terminal device 110 and the remote device 120 is further described. It should be understood that Figure 3 The components included in the remote device 120 are shown only as examples. Figure 3 The components included in the remote device 120 shown in FIG. 1 may be modified or replaced.

[0073] Equipment calibration process

[0074] When the terminal device 110 requests a local or remote service, it can be used in conjunction with Figure 2 and Figure 3 The security certificate obtained during the device authentication process described above is used to ensure the data security of both the service provider and the service receiver. Figure 4 FIG. 4 is a flowchart of a process 400 for device verification according to some embodiments of the present disclosure. The process 400 may be implemented at the terminal device 110 and the remote device 120. For ease of discussion, reference will be made to FIG. Figure 1 The process 400 is described with reference to the environment 100 of FIG.

[0075] Reference now Figure 4 After the terminal device 110 is restarted or powered on, the terminal device 110 searches (402) whether an activation certificate is stored in its trusted environment. If it is determined that the activation certificate already exists, the terminal device 110 can determine whether the activation certificate is still valid based on the legitimacy and / or validity of the activation certificate indicated in the activation certificate.

[0076] If it is determined that the activation certificate does not exist, an activation status flag is generated to trigger, for example, Figure 2 and Figure 3 Describes the device authentication process.

[0077] In some embodiments, if the terminal device 110 determines that the activation certificate is still valid, an activation status identifier is generated (404). The activation status identifier can be generated, for example, by a device certificate stored in a trusted environment associated with the terminal device 110. For example, a digest value is generated based on field information (e.g., authorization content) in the device certificate through a hash calculation, and then the digest value is encrypted by a private key in a second asymmetric key pair generated by the terminal device 110 to generate the activation status identifier.

[0078] In some embodiments, if the terminal device 110 determines that the activation certificate is invalid or tampered with, the terminal device 110 is triggered to shut down and / or a warning is sent to the remote device 120 .

[0079] As described above, the terminal device 110 can request local services or remote services. Local services can be regarded as services that have been provided to the terminal device 110 locally by the remote device 120, which may include offline services that have been installed at the terminal device 110 or authorized to the terminal device 110, such as offline services provided by applications installed on the terminal device 110, offline games or offline books, etc. On the contrary, remote services can be regarded as online services that need to be provided by the remote device 120.

[0080] When requesting a local service, the terminal device 110 may perform a signature verification on the generated activation status identifier (406). During the verification process, the activation status identifier is decrypted by the public key in the second asymmetric key pair generated by the terminal device 110 to obtain a digest value. The terminal device 110 may compare the digest value obtained by the decryption with the digest value obtained by the hash calculation. If the two match each other, it is determined that the signature verification on the generated activation status identifier is successful. The terminal device 110 may access or obtain the requested local service. If the two do not match, the requested service is refused to be provided to the terminal device 110.

[0081] When requesting remote service, it is also necessary to perform signature verification on the generated activation status identifier. If the activation status identifier is successfully verified, the requested remote service content is encrypted by the private key in the second asymmetric key pair generated by the terminal device 110 to generate a service request. The terminal device 110 sends (408) the service request to the remote device 120. The remote device 120 decrypts the service request by the public key in the second asymmetric key pair generated by the terminal device 110 to verify (410) the service request. Similarly, the remote device 120 obtains the requested service content and the summary value obtained by the terminal device 110 by hashing the service content through public key decryption. The remote device 120 can perform hash calculation on the requested service content to obtain a summary value and compare the summary value with the summary value obtained by decryption. If the two match each other, it is determined that the service request is successfully verified. In this case, the remote device 120 can provide (412) the requested service content to the terminal device 110.

[0082] In this way, when a device makes a service request, the device identity is verified based on the security certificate obtained during the device authentication phase, thereby effectively preventing counterfeiting and impersonation of the device, and preventing the interests of the service provider and service recipient from being illegally infringed.

[0083] Example Process

[0084] Figure 5 A flow chart of a process 500 for device authentication according to some embodiments of the present disclosure is shown. The process 500 may be implemented at the first device 110.

[0085] In block 510, a first device sends a device activation request to a second device, wherein the device activation request includes identity authentication information of the first device.

[0086] At block 520 , the first device determines whether an activation certificate is received. If the first device determines that an activation certificate is received, then at block 530 , the activation certificate is stored in a trusted environment associated with the first device.

[0087] In some embodiments, the first device may perform signature verification on the activation certificate based on the first public key in the first asymmetric key pair, and the first private key in the first asymmetric key pair is used by the second device to sign the activation certificate. If it is determined that the signature verification is successful, the first device may store the activation certificate in a trusted environment.

[0088] In some embodiments, the first device may generate a second asymmetric key pair. The first device may sign the certificate signing request using a second private key in the second asymmetric key pair and send a second public key in the second asymmetric key pair to the second device.

[0089] At block 540, the first device sends a certificate signing request to the second device. The certificate signing request is generated in the trusted environment based at least in part on the activation certificate.

[0090] At block 550, the first device stores the device certificate received from the second device in a trusted environment. The device certificate is generated based on the certificate signing request.

[0091] In some embodiments, the first device may establish a secure connection between the first device and the device for transmission of at least one of a device activation request, an activation certificate, a certificate signing request, and a device certificate.

[0092] In some embodiments, the first device may send an activation confirmation to the second device.

[0093] Figure 6 A flow chart of a process 600 for device verification according to some embodiments of the present disclosure is shown. The process 600 may be implemented at the first device 110.

[0094] At block 610 , the first device looks up an activation certificate in a trusted environment associated with the first device, the activation certificate being generated by a second device for authenticating the first device.

[0095] In block 610, the first device determines whether there is an activation certificate through the search result. If it is determined that there is an activation certificate, then in block 630, the activation certificate is locally verified. If it is determined that there is no activation certificate, then in block 660, execution of the activation authentication process is triggered.

[0096] At block 640, the first device determines whether the activation certificate passes local verification. If the activation certificate passes local verification, then at block 650, the first device generates an activated verification mark. If the activation certificate fails local verification, then at block 670, the first device is shut down and / or a warning is sent to the second device.

[0097] In some embodiments, locally verifying the activation certificate includes verifying at least one of the legitimacy of the activation certificate and the validity period of the activation certificate.

[0098] In some embodiments, if it is determined that the activation certificate passes the local verification, the first device may generate a verification request. The verification request is signed using a second private key in a second asymmetric key pair, which may be generated in a trusted environment, wherein the second public key has been sent by the first device to the second device in a previous device authentication process. The first device may also send a signed verification request to the second device for identity verification of the first device in the remote service.

[0099] Figure 7 A flow chart of a process 700 for device authentication according to some embodiments of the present disclosure is shown. The process 700 may be implemented at the second device 120.

[0100] In block 710, the second device determines whether a device activation request is received from the first device. If it is determined that a device activation request is received, then in block 720, the second device verifies the identity authentication information of the first device indicated in the device activation request.

[0101] At block 730, the second device determines whether the identity authentication information is successfully verified. If it is determined that the identity authentication information is successfully verified, then at block 740, the second device sends an activation certificate to the first device. At block 750, if the second device determines that a certificate signing request is received from the first device, then at block 750, the second device sends a device certificate to the first device. The device certificate is generated based on the certificate signing request.

[0102] In some embodiments, at least one of the device activation request, the activation certificate, the certificate signing request, and the device certificate is transmitted over a secure connection between the first device and the second device.

[0103] In some embodiments, the second device may also sign the activation certificate using the first private key in the first asymmetric key pair and send the first public key in the first asymmetric key pair to the first device.

[0104] In some embodiments, the second device may also obtain a second public key in a second asymmetric key pair from the certificate signing request. The second asymmetric key pair is generated in a trusted environment associated with the first device. The second device generates a device certificate by signing the second public key.

[0105] In some embodiments, the second device may also receive an activation confirmation for the first device from the first device.

[0106] Figure 8A flow chart of a process 800 for device verification according to some embodiments of the present disclosure is shown. The process 800 may be implemented at the second device 120.

[0107] In block 810, if the second device receives a verification request from the first device, then in block 820, the second device performs signature verification on the verification request using a second public key in a second asymmetric key pair. The second asymmetric key pair is generated in a trusted environment associated with the first device. In block 830, the second device sends a corresponding verification response to the first device based on the result of the signature verification.

[0108] Example devices and equipment

[0109] The embodiments of the present disclosure also provide corresponding devices for implementing the above methods or processes. Fig. 9 A schematic structural block diagram of an apparatus 900 for device authentication according to some embodiments of the present disclosure is shown.

[0110] like Fig. 9 As shown, the device 900 may include an activation request sending module 910, which is configured to send a device activation request to the second device. The device activation request includes identity authentication information of the first device. The device 900 may include an activation certificate storage module 920, which is configured to store the activation certificate in a trusted environment associated with the first device in response to receiving an activation certificate from the second device. The device 900 may also include a certificate signing request sending module 930, which is configured to send a certificate signing request to the second device, the certificate signing request is generated in a trusted environment at least in part based on the activation certificate, and a device certificate storage module 940, which is configured to store the device certificate received from the second device in the trusted environment. The device certificate is generated based on the certificate signing request.

[0111] In some embodiments, the apparatus 900 may also be configured to establish a secure connection between the first device and the device for transmission of at least one of a device activation request, an activation certificate, a certificate signing request, and a device certificate.

[0112] In some embodiments, the activation certificate storage module 920 may also be configured to perform signature verification on the activation certificate based on the first public key in the first asymmetric key pair, where the first private key in the first asymmetric key pair is used by the second device to sign the activation certificate. If it is determined that the signature verification passes, the activation certificate is stored in a trusted environment.

[0113] In some embodiments, the apparatus 900 may be further configured to generate a second asymmetric key pair and sign the certificate signing request using a second private key in the second asymmetric key pair and send a second public key in the second asymmetric key pair to the second device.

[0114] In some embodiments, the apparatus 900 may also be configured to send an activation confirmation to the second device.

[0115] Fig.10 A schematic structural block diagram of an apparatus 1000 for device verification according to some embodiments of the present disclosure is shown.

[0116] like Fig.10 As shown, the apparatus 1000 may include an activation certificate search module 1010, configured to search for an activation certificate in a trusted environment associated with the first device. The activation certificate is generated by a second device for authenticating the first device. The apparatus 1000 may include a local verification module 1020, configured to locally verify the activation certificate in response to determining that the activation certificate exists in the trusted environment. The apparatus 1000 may also include an activated verification identifier generation module 1030, configured to generate an activated verification identifier for use in the identity verification of the first device for a local service in response to the activation certificate passing the local verification.

[0117] In some embodiments, locally verifying the activation certificate includes verifying at least one of the legitimacy of the activation certificate and the validity period of the activation certificate.

[0118] In some embodiments, the device 1000 may also include generating a verification request in response to the activation certificate passing local verification; signing the verification request using a second private key in a second asymmetric key pair, the second asymmetric key pair being generated in a trusted environment, wherein the second public key of the second asymmetric key pair has been sent from the first device to the second device during a previous device authentication process; and sending the signed verification request to the second device for identity verification of the first device in the remote service.

[0119] Fig.11 A schematic structural block diagram of an apparatus 1100 for device authentication according to some embodiments of the present disclosure is shown.

[0120] like Fig.11 As shown, the apparatus 1100 may include an authentication information verification module 1110, configured to verify the identity authentication information of the first device indicated in the device activation request in response to receiving a device activation request from the first device. The apparatus 1100 may include an activation certificate sending module 1120, configured to send an activation certificate to the first device in response to successful verification of the identity authentication information. The apparatus 1100 may also include a device certificate sending module 1130, configured to send a device certificate to the first device in response to receiving a certificate signing request from the first device. The device certificate is generated based on the certificate signing request.

[0121] In some embodiments, at least one of the activation request, the activation certificate, the certificate signing request, and the device certificate is transmitted over a secure connection between the first device and the second device.

[0122] In some embodiments, the apparatus 1100 may also be configured to sign the activation certificate using a first private key in a first asymmetric key pair; and send a first public key in the first asymmetric key pair to the first device.

[0123] In some embodiments, the apparatus 1100 may also be configured to obtain a second public key in a second asymmetric key pair from a certificate signing request, where the second asymmetric key pair is generated in a trusted environment associated with the first device; and generate a device certificate by signing the second public key.

[0124] In some embodiments, the apparatus 1100 may also be configured to receive an activation confirmation for the first device from the first device.

[0125] Fig.12 A schematic structural block diagram of an apparatus 1200 for device verification according to some embodiments of the present disclosure is shown.

[0126] like Fig.12 As shown, the apparatus 1200 may include a signature verification module 1210, configured to, in response to receiving a verification request from the first device, perform signature verification on the verification request using a second public key in a second asymmetric key pair, the second asymmetric key pair being generated in a trusted environment associated with the first device; and a verification response sending module 1220, configured to send a corresponding verification response to the first device based on the result of the signature verification.

[0127] The units included in the device 900, the device 1000, the device 1100 and / or the device 1200 can be implemented in various ways, including software, hardware, firmware or any combination thereof. In some embodiments, one or more units can be implemented using software and / or firmware, such as machine executable instructions stored on a storage medium. In addition to or as an alternative to machine executable instructions, some or all of the units in the device 900, the device 1000, the device 1100 and / or the device 1200 can be implemented at least in part by one or more hardware logic components. As an example and not limitation, exemplary types of hardware logic components that can be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0128] Fig.13 1 shows a block diagram of a computing device / server 1300 in which one or more embodiments of the present disclosure may be implemented. It should be understood that Fig.13 The computing device / server 1300 shown is merely exemplary and should not constitute any limitation on the functionality and scope of the embodiments described herein.

[0129] like Fig.13 As shown, computing device / server 1300 is in the form of a general-purpose computing device. Components of computing device / server 1300 may include, but are not limited to, one or more processors or processing units 1310, memory 1320, storage device 1330, one or more communication units 1340, one or more input devices 1360, and one or more output devices 1360. Processing unit 1310 may be an actual or virtual processor and is capable of performing various processes according to a program stored in memory 1320. In a multi-processor system, multiple processing units execute computer executable instructions in parallel to increase the parallel processing capabilities of computing device / server 1300.

[0130] The computing device / server 1300 typically includes a plurality of computer storage media. Such media may be any available media accessible to the computing device / server 1300, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 1320 may be a volatile memory (e.g., registers, caches, random access memory (RAM)), a non-volatile memory (e.g., a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 1330 may be a removable or non-removable medium, and may include a machine-readable medium, such as a flash drive, a disk, or any other medium, which may be capable of being used to store information and / or data (e.g., training data for training) and may be accessed within the computing device / server 1300.

[0131] The computing device / server 1300 may further include additional removable / non-removable, volatile / non-volatile storage media. Fig.13 As shown in , a disk drive for reading or writing from a removable, non-volatile disk (e.g., a "floppy disk") and an optical drive for reading or writing from a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to the bus (not shown) by one or more data media interfaces. Memory 1320 may include a computer program product 1325 having one or more program modules that are configured to perform various methods or actions of various embodiments of the present disclosure.

[0132] The communication unit 1340 enables communication with other computing devices via a communication medium. Additionally, the functionality of the components of the computing device / server 1300 can be implemented in a single computing cluster or multiple computing machines that can communicate via a communication connection. Thus, the computing device / server 1300 can operate in a networked environment using a logical connection with one or more other servers, a network personal computer (PC), or another network node.

[0133] Input device 1350 may be one or more input devices, such as a mouse, keyboard, trackball, etc. Output device 1360 may be one or more output devices, such as a display, speaker, printer, etc. Computing device / server 1300 may also communicate with one or more external devices (not shown) as needed, such as storage devices, display devices, etc., with one or more devices that enable a user to interact with computing device / server 1300, or with any device that enables computing device / server 1300 to communicate with one or more other computing devices (e.g., a network card, a modem, etc.) through communication unit 1340. Such communication may be performed via an input / output (I / O) interface (not shown).

[0134] According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which one or more computer instructions are stored, wherein the one or more computer instructions are executed by a processor to implement the method described above.

[0135] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products implemented according to the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0136] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0137] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0138] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple implementations of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some implementations as replacements, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0139] The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to best explain the principles of the implementations, practical applications, or improvements to the technology in the marketplace, or to enable other persons of ordinary skill in the art to understand the implementations disclosed herein.

Claims

1. A method for device authentication, comprising: Sending a device activation request at the first device to the second device, wherein the device activation request includes identity authentication information of the first device; In response to receiving an activation certificate from the second device, storing the activation certificate in a trusted environment associated with the first device, wherein the activation certificate is generated by the second device by encrypting authorization content and a digest value using a first private key in a first asymmetric key pair, the authorization content includes a service scope authorized by the first device, the first asymmetric key pair is generated by the second device, and the digest value is generated by the second device performing a hash calculation on the authorization content determined for the first device; Sending a certificate signing request to the second device, the certificate signing request being generated in the trusted environment at least in part based on the activation certificate, comprising: generating a second asymmetric key pair in the trusted environment, encrypting field information obtained from the activation certificate using a second private key in the second asymmetric key pair, and generating the certificate signing request based on the encrypted field information and a second public key in the second asymmetric key pair; as well as A device certificate received from the second device is stored in the trusted environment, the device certificate being generated based on the certificate signing request.

2. The method according to claim 1, further comprising: A secure connection is established between the first device and the second device for transmission of at least one of the device activation request, the activation certificate, the certificate signing request, and the device certificate.

3. The method of claim 1 , wherein storing the activation certificate in a trusted environment associated with the first device comprises: performing signature verification on the activation certificate based on a first public key in a first asymmetric key pair, wherein a first private key in the first asymmetric key pair is used by the second device to sign the activation certificate; as well as In response to the signature verification being passed, the activation certificate is stored in the trusted environment.

4. The method according to claim 1, further comprising: In the trusted environment, generating a second asymmetric key pair; Signing the certificate signing request using a second private key in the second asymmetric key pair; as well as The second public key in the second asymmetric key pair is sent to the second device.

5. The method according to claim 1, further comprising: An activation confirmation is sent to the second device.

6. A method for device verification, comprising: Searching for an activation certificate in a trusted environment associated with the first device, the activation certificate being generated by a second device used to authenticate the first device, wherein generating the activation certificate comprises: the second device encrypting authorization content and a digest value using a first private key in a first asymmetric key pair to generate the activation certificate, the authorization content comprising a service scope authorized by the first device, the first asymmetric key pair being generated by the second device, and the digest value being generated by the second device performing a hash calculation on the authorization content determined for the first device; In response to determining that the activation certificate exists in the trusted environment, locally verifying the activation certificate; and In response to the activation certificate passing the local verification, generating an activated verification identifier for use in identity verification of the first device for a local service by using a device certificate stored in a trusted environment associated with the first device, wherein the device certificate is generated by the second device based on a certificate signing request sent by the first device, and the certificate signing request is generated by the first device based on the activation certificate; In response to the activation certificate passing the local verification, generating a verification request; Signing the verification request using a second private key of a second asymmetric key pair generated in the trusted environment, wherein a second public key of the second asymmetric key pair has been sent from the first device to the second device in a previous device authentication process; and The signed verification request is sent to the second device for identity verification of the first device in the remote service.

7. The method of claim 6, wherein locally verifying the activation certificate comprises verifying at least one of the following: the legitimacy of the activation certificate, and The validity period of the activation certificate.

8. A method for device authentication, comprising: In response to receiving a device activation request from a first device, verifying, at a second device, identity authentication information of the first device indicated in the device activation request; In response to the successful verification of the identity authentication information, sending an activation certificate to the first device, wherein the activation certificate is generated by the second device using a first private key in a first asymmetric key pair to encrypt authorization content and a digest value, the authorization content includes a service scope authorized by the first device, the first asymmetric key pair is generated by the second device, and the digest value is generated by the second device performing a hash calculation on the authorization content determined for the first device; as well as In response to receiving a certificate signing request from a first device, wherein the certificate signing request is generated by the first device based on the activation certificate; Sending a device certificate to the first device, where the device certificate is generated based on a certificate signing request, includes: using a third private key in a third asymmetric key pair to encrypt a second public key and field information included in the certificate signing request to generate the device certificate.

9. The method of claim 8, wherein at least one of the activation request, the activation certificate, the certificate signing request, and the device certificate is transmitted over a secure connection between the first device and the second device.

10. The method according to claim 8, further comprising: Signing the activation certificate using a first private key in a first asymmetric key pair; as well as Sending a first public key in the first asymmetric key pair to the first device.

11. The method according to claim 8, further comprising generating the device certificate in the following manner: Obtaining a second public key of a second asymmetric key pair from the certificate signing request, the second asymmetric key pair being generated in a trusted environment associated with the first device; and The device certificate is generated by signing the second public key.

12. The method according to claim 8, further comprising: An activation confirmation is received from the first device for the first device.

13. The method according to claim 8, further comprising verifying the first device in the following manner: In response to receiving a verification request from the first device, performing signature verification on the verification request using a second public key in a second asymmetric key pair, where the second asymmetric key pair is generated in a trusted environment associated with the first device; and According to the result of the signature verification, a corresponding verification response is sent to the first device.

14. An apparatus for device authentication, comprising: an activation request sending module, configured to send a device activation request to the second device, wherein the device activation request includes identity authentication information of the first device; an activation certificate storage module, configured to, in response to receiving an activation certificate from the second device, store the activation certificate in a trusted environment associated with the first device, wherein the activation certificate is generated by the second device by encrypting authorization content and a digest value using a first private key in a first asymmetric key pair, the authorization content includes a service scope authorized by the first device, the first asymmetric key pair is generated by the second device, and the digest value is generated by the second device performing a hash calculation on the authorization content determined for the first device; a certificate signing request sending module, configured to send a certificate signing request to the second device, the certificate signing request being generated in the trusted environment at least partially based on the activation certificate, comprising: generating a second asymmetric key pair in the trusted environment, encrypting field information obtained from the activation certificate using a second private key in the second asymmetric key pair, and generating a certificate signing request based on the encrypted field information and a second public key in the second asymmetric key pair; as well as The device certificate storage module is configured to store the device certificate received from the second device in the trusted environment, wherein the device certificate is generated based on the certificate signing request.

15. A device for equipment calibration, comprising: an activation certificate search module, configured to search for an activation certificate in a trusted environment associated with a first device, the activation certificate being generated by a second device used to authenticate the first device, wherein generating the activation certificate comprises: the second device encrypting authorization content and a digest value using a first private key in a first asymmetric key pair to generate the activation certificate, the authorization content comprising a service scope authorized by the first device, the first asymmetric key pair being generated by the second device, and the digest value being generated by the second device performing a hash calculation on the authorization content determined for the first device; a local verification module, configured to, in response to determining that the activation certificate exists in the trusted environment, locally verify the activation certificate; an activated verification mark generation module, configured to generate an activated verification mark for use in identity verification of the first device for a local service by using a device certificate stored in a trusted environment associated with the first device in response to the activation certificate passing the local verification, wherein the device certificate is generated by the second device based on a certificate signing request sent by the first device, and the certificate signing request is generated by the first device based on the activation certificate; a verification request generating module, configured to generate a verification request in response to the activation certificate passing the local verification; a verification request signing module, configured to sign the verification request using a second private key in a second asymmetric key pair generated in the trusted environment, wherein a second public key of the second asymmetric key pair has been sent by the first device to the second device in a previous device authentication process; and The verification request sending module is configured to send the signed verification request to the second device for identity verification of the first device in the remote service.

16. An apparatus for device authentication, comprising: an authentication information verification module, configured to, in response to receiving a device activation request from a first device, verify the identity authentication information of the first device indicated in the device activation request; an activation certificate sending module, configured to send an activation certificate to the first device in response to the successful verification of the identity authentication information, wherein the activation certificate is generated by the second device by encrypting authorization content and a digest value using a first private key in a first asymmetric key pair, the authorization content includes a service scope authorized by the first device, the first asymmetric key pair is generated by the second device, and the digest value is generated by the second device performing a hash calculation on the authorization content determined for the first device; as well as a device certificate sending module, configured to respond to receiving a certificate signing request from a first device, wherein the certificate signing request is generated by the first device based on the activation certificate; Sending a device certificate to the first device, where the device certificate is generated based on a certificate signing request, includes: using a third private key in a third asymmetric key pair to encrypt a second public key and field information included in the certificate signing request to generate the device certificate.

17. An electronic device comprising: at least one processing unit; as well as At least one memory, the at least one memory being coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, causing the electronic device to perform a method according to any one of claims 1 to 5, any one of claims 6 to 7, any one of claims 8 to 12, or according to claim 13.

18. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the method according to any one of claims 1 to 5, any one of claims 6 to 7, any one of claims 8 to 12 or claim 13 is implemented.

Images