Terminal device information transmission method, device fingerprint generation method and related products

Abstract

The embodiment of the present application provides a terminal device information transmission method, a device fingerprint generation method and related products, the terminal device information transmission method includes: the terminal device obtains a data signature and a device identification signature from a hardware security zone; generates a symmetric encryption key, collects information, uses the symmetric encryption key to symmetrically encrypt the information, data signature and device identification signature to obtain encrypted data; uses an asymmetric encryption public key to asymmetrically encrypt the symmetric encryption key to obtain an asymmetric encryption key; reports the asymmetric encrypted data to the risk probe server; the asymmetric encrypted data includes encrypted data, asymmetric encryption key and asymmetric encryption public key; receives a token sent by the risk probe server, stores the token in this end, and the token is a token corresponding to the device fingerprint generated by the risk probe server according to the encrypted data, asymmetric encryption key and asymmetric encryption public key. The embodiment of the present application can improve the security of terminal device information transmission.

Description

Technical Field

[0001] The present application relates to the field of terminal technology, and in particular to a terminal device information transmission method, a device fingerprint generation method and related products. Background Art

[0002] In computer science, fingerprinting is the process of creating unique identifiers for various types of electronic data. When we need to implement a technology to identify a single user or device, we call it device fingerprinting. Essentially, the process involves collecting information about a smartphone, computer, or other device. Sometimes, even if the user hides the Internet Protocol (IP) address or changes the browser, fingerprinting can still identify the device.

[0003] For many years, terminal devices have used the risk probe system to assess device risks, analyze legitimate network traffic, and detect potential fraud. The risk probe system is deployed in a private cloud. The business-side client triggers the risk probe to collect device information and upload it to the business-side backend; the business-side backend parses, cleans, and filters the reported data, and then forwards the agreed data to the risk probe backend; the risk probe backend receives and parses the data and generates device fingerprints; the risk probe backend performs device risk assessment based on the existing device intelligence library and returns the assessment results to the business-side backend.

[0004] In the current risk probe system, data is not encrypted during the reporting process and is transmitted in plain text, which poses a risk of transmission hijacking and data tampering. Summary of the invention

[0005] The embodiments of the present application provide a terminal device information transmission method, a device fingerprint generation method and related products, which can improve the security of terminal device information transmission.

[0006] A first aspect of an embodiment of the present application provides a terminal device information transmission method, including:

[0007] The terminal device obtains a data signature and a device identification signature from the hardware security zone;

[0008] The terminal device generates a symmetric encryption key, collects terminal device information, and uses the symmetric encryption key to symmetrically encrypt the terminal device information, the data signature, and the device identification signature to obtain encrypted data;

[0009] The terminal device uses an asymmetric encryption public key to perform asymmetric encryption processing on the symmetric encryption key to obtain an asymmetric encryption key; the asymmetric encryption public key is obtained by the terminal device from the risk probe server;

[0010] The terminal device reports the asymmetric encrypted data to the risk probe server; the asymmetric encrypted data includes the encrypted data, the asymmetric encryption key and the asymmetric encryption public key;

[0011] The terminal device receives the token sent by the risk probe server and stores the token locally. The token is a token corresponding to the device fingerprint generated by the risk probe server based on the encrypted data, the asymmetric encryption key and the asymmetric encryption public key.

[0012] A second aspect of an embodiment of the present application provides a method for generating a device fingerprint, including:

[0013] The risk probe server receives the key acquisition request sent by the terminal device, and sends an asymmetric encryption public key to the terminal device; the asymmetric encryption public key is used by the terminal device to encrypt using an asymmetric encryption method;

[0014] The risk probe server receives the asymmetric encrypted data sent by the terminal device, and decrypts the asymmetric encrypted data using the asymmetric encryption private key corresponding to the asymmetric encryption public key to obtain the terminal device information;

[0015] The risk probe server generates a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information.

[0016] A third aspect of an embodiment of the present application provides a terminal device information transmission device, including:

[0017] An acquisition unit, used to acquire a data signature and a device identification signature from a hardware security zone;

[0018] A first generating unit, used to generate a symmetric encryption key;

[0019] A collection unit, used for collecting terminal device information;

[0020] A first encryption unit, configured to symmetrically encrypt the terminal device information, the data signature and the device identification signature using the symmetric encryption key to obtain encrypted data;

[0021] The first encryption unit is further used to perform asymmetric encryption processing on the symmetric encryption key using an asymmetric encryption public key to obtain an asymmetric encryption key; the asymmetric encryption public key is obtained from the risk probe server;

[0022] A first communication unit, configured to report asymmetric encrypted data to the risk probe server; the asymmetric encrypted data includes the encrypted data, the asymmetric encryption key and the asymmetric encryption public key;

[0023] The first communication unit is further used to receive a token sent by the risk probe server;

[0024] A storage unit is used to store the token on this end, where the token is a token corresponding to the device fingerprint generated by the risk probe server according to the encrypted data, the asymmetric encryption key and the asymmetric encryption public key.

[0025] A fourth aspect of an embodiment of the present application provides a device fingerprint generation apparatus, including:

[0026] A second communication unit is used to receive a key acquisition request sent by a terminal device, and send an asymmetric encryption public key to the terminal device; the asymmetric encryption public key is used by the terminal device to encrypt using an asymmetric encryption method;

[0027] The second communication unit is further used to receive asymmetrically encrypted data sent by the terminal device;

[0028] A second encryption unit, configured to decrypt the asymmetric encrypted data using an asymmetric encryption private key corresponding to the asymmetric encryption public key to obtain terminal device information;

[0029] The second generating unit is used to generate a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information.

[0030] The fifth aspect of an embodiment of the present application provides a terminal device, including a processor and a memory, the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the step instructions in the first aspect of the embodiment of the present application.

[0031] The sixth aspect of an embodiment of the present application provides a server, including a processor and a memory, the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the step instructions in the second aspect of the embodiment of the present application.

[0032] The seventh aspect of the embodiments of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for electronic data exchange, wherein the computer program enables a computer to execute part or all of the steps described in the first aspect of the embodiments of the present application.

[0033] An eighth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for electronic data exchange, wherein the computer program enables a computer to execute part or all of the steps described in the second aspect of the embodiment of the present application.

[0034] A ninth aspect of the embodiments of the present application provides a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute some or all of the steps described in the first aspect of the embodiments of the present application. The computer program product may be a software installation package.

[0035] The tenth aspect of the embodiments of the present application provides a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute some or all of the steps described in the second aspect of the embodiments of the present application. The computer program product may be a software installation package.

[0036] In an embodiment of the present application, the terminal device obtains a data signature and a device identification signature from a hardware security zone; the terminal device generates a symmetric encryption key, collects terminal device information, and uses the symmetric encryption key to symmetrically encrypt the terminal device information, the data signature and the device identification signature to obtain encrypted data; the terminal device uses an asymmetric encryption public key to asymmetrically encrypt the symmetric encryption key to obtain an asymmetric encryption key; the asymmetric encryption public key is obtained by the terminal device from a risk probe server; the terminal device reports the asymmetric encrypted data to the risk probe server; the asymmetric encrypted data includes the encrypted data, the asymmetric encryption key and the asymmetric encryption public key; the terminal device receives a token sent by the risk probe server, and stores the token on this end, wherein the token is a token corresponding to the device fingerprint generated by the risk probe server based on the encrypted data, the asymmetric encryption key and the asymmetric encryption public key.

[0037] In an embodiment of the present application, the terminal device sends asymmetrically encrypted data containing terminal device information to the risk probe server. Since the data signature and the device identification signature are obtained from the hardware security zone, the security of the data signature and the device identification signature is guaranteed, and the security of the data sent by the terminal device is guaranteed. Since a symmetric encryption key is used to symmetrically encrypt the terminal device information, the data signature and the device identification signature, and an asymmetrical encryption public key is used to asymmetrically encrypt the symmetric encryption key to obtain an asymmetrical encryption key, the security of the asymmetrically encrypted data sent by the terminal device to the risk probe server is guaranteed, and the security of the data received by the risk probe server is guaranteed. In the process of terminal device information transmission, the security of the transmitted data is guaranteed from both the data sending end and the data receiving end, thereby improving the security of terminal device information transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 is a schematic diagram of the structure of a risk probe system provided in an embodiment of the present application;

[0040] Figure 2 It is a flowchart of a method for transmitting information of a terminal device provided in an embodiment of the present application;

[0041] Figure 3 It is a flow chart of a method for generating a device fingerprint provided in an embodiment of the present application;

[0042] Figure 4 It is a flowchart of another device fingerprint generation method provided in an embodiment of the present application;

[0043] Figure 5 It is a flowchart of another device fingerprint generation method provided in an embodiment of the present application;

[0044] Figure 6 It is a flowchart of another device fingerprint generation method provided in an embodiment of the present application;

[0045] Figure 7 It is a flowchart of another device fingerprint generation method provided in an embodiment of the present application;

[0046] Figure 8 This is a schematic diagram of a service access process provided by an embodiment of the present application;

[0047] Fig. 9 A schematic diagram of the structure of a terminal device information transmission device provided in an embodiment of the present application;

[0048] Fig.10 A schematic diagram of the structure of a device fingerprint generation apparatus provided in an embodiment of the present application;

[0049] Fig.11 It is a structural diagram of a terminal device provided in an embodiment of the present application;

[0050] Fig.12 It is a structural diagram of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0052] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0053] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0054] The terminal devices involved in the embodiments of the present application may include various handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices, computing devices or other processing devices connected to a wireless modem, as well as various forms of user equipment (UE), mobile station (MS), terminal device, etc. For the convenience of description, the above-mentioned devices are collectively referred to as terminal devices.

[0055] See also Figure 1 , Figure 1It is a structural diagram of a risk probe system provided in an embodiment of the present application, including a risk probe server 100 and at least one terminal device 101 that is communicatively connected to the risk probe server 100. A client may be installed on the terminal device 101, and a risk probe server may be installed on the risk probe server 100. The client refers to a program that corresponds to the risk probe server and provides local services to clients. The risk probe server is also a program installed on the risk probe server. The risk probe server serves the client, and the services provided include providing computing or application services to the client, providing resources to the client, and saving client data. For example, the risk probe server can provide risk assessment services for terminal devices to the client. The risk probe server 100 can directly establish a communication connection with the terminal device 101 through the Internet, and the risk probe server 100 can also establish a communication connection with the terminal device 101 through other servers through the Internet. This is not limited in the embodiments of the present application.

[0056] The risk detection server in the embodiment of the present application may have the following functions: (1) Generate a unique identifier of the terminal device: the terminal device fingerprint. (2) Classify the business type tendency of the terminal device based on big data and perform risk assessment on the terminal device.

[0057] See also Figure 2 , Figure 2 1 is a flow chart of a method for transmitting information of a terminal device provided in an embodiment of the present application. Figure 2 As shown, the terminal device information transmission method may include the following steps.

[0058] 201, the terminal device obtains a data signature and a device identification signature from the hardware security zone.

[0059] The terminal device can support REE operation, for example, general OS: Android, iOS, Linux and other REE. REE can provide all the functions of the device for the upper layer application (App). REE is open, extensible and universal. The application provided by REE is RA.

[0060] Terminal devices can also support trusted execution environment (TEE) operation. TEE is protected by hardware mechanism and isolated from REE. The application provided by TEE is Trusted Application (TA). REE can only communicate with TA in TEE through specific entrances. TEE has hardware exclusivity. When TEE is running, TEE can use the full performance of the central processing unit (CPU) of the terminal device. TEE also has a fast communication mechanism. TEE can access the memory of REE, but REE cannot access the memory of TEE protected by hardware. Multiple TAs can run simultaneously in TEE.

[0061] TA is an application in TEE. TEE belongs to an independent hardware security zone. Even if the Android OS is rooted or flashed with ROM, it will not affect the security of TEE.

[0062] The RA in the REE can obtain the data signature SIGN1 and the device identification signature SIGN2 from the TA.

[0063] The data signature SIGN1 is the signature of the terminal device information key field set (Key Field Set, KeyFieldSet) data, and KeyFieldSet is a subset of the terminal device information (Information Set, InfoSet). The device identification signature SIGN2 is the signature of the unique identification of the terminal device. Since the device identification at the software layer is unreliable and there is a risk of tampering, the device identification in the embodiment of the present application is generated in the hardware security zone, and the unique device identification is maintained in the hardware security zone. The RA in the REE can ensure the security of the preset keys and signatures therein and the uniqueness of the device fingerprint.

[0064] The data signature and the device identification signature are obtained by encrypting the hardware security zone using a message digest algorithm.

[0065] The hardware security zone generates data signatures and device identification signatures in the following ways:

[0066] The TA in the hardware security zone generates a random number TRAN through the hardware in the hardware security zone, and signs (KeyFieldSet+TRAN) and (sk_2) respectively to obtain the data signature SIGN1 and the device identification signature SIGN2; then asymmetric encryption is performed on (SIGN1+SIGN2+TRAN) (the key is pk_1) to obtain EncSign; TA returns the encryption result EncSign to the RA of the terminal device. Among them, sk_2 is the unique identifier of the terminal device. Here, sk_2 can be considered as the private key in the key pair, and pk_2 is the public key corresponding to sk_2 in the key pair.

[0067] TA signs (KeyFie ldSet+TRAN) and (sk_2) respectively, and specifically can use MD5 encryption method to sign.

[0068] Specifically, SIGN1=MD5(KeyFieldSet+TRAN); SIGN2=MD5(sk_2).

[0069] 202, the terminal device collects and generates a symmetric encryption key and terminal device information, and uses the symmetric encryption key to symmetrically encrypt the terminal device information, the data signature and the device identification signature to obtain encrypted data.

[0070] In the embodiment of the present application, the terminal device can randomly generate a symmetric encryption key through software. For example, the terminal device can randomly generate a symmetric encryption key through a rich application (RA) provided by a rich execution environment (REE) using a random number generation method. The RA in the REE can generate a symmetric encryption key.

[0071] In the embodiment of the present application, the terminal device can collect terminal device information through the RA in the TEE. The terminal device information may include hardware information, system information, operating environment information, network information, etc. of the terminal device.

[0072] The symmetric encryption key (key) is generated by the terminal device in step 201. When encrypting, the symmetric encryption key (key) is used to symmetrically encrypt the terminal device information InfoSet, the data signature SIGN1 and the device identification signature SIGN2 to obtain the encrypted data (EnData); when decrypting, the symmetric encryption key (key) is needed to decrypt the encrypted data (EnData) to obtain the terminal device information InfoSet, the data signature SIGN1 and the device identification signature SIGN2.

[0073] 203, the terminal device uses the asymmetric encryption public key to perform asymmetric encryption processing on the symmetric encryption key to obtain an asymmetric encryption key; the asymmetric encryption public key is obtained by the terminal device from the risk probe server.

[0074] After the symmetric encryption key is encrypted, once the symmetric encryption key is cracked, the cracker can directly use the symmetric encryption key to decrypt, which will cause information leakage. Therefore, the embodiment of the present application uses an asymmetric encryption public key (pk_1) to perform asymmetric encryption processing on the symmetric encryption key (key) to obtain an asymmetric encryption key (Enkey). Under the premise of symmetric encryption key encryption, the symmetric encryption key is encrypted with an asymmetric encryption public key, which can further improve the security of data transmission.

[0075] Among them, the asymmetric encryption public key is obtained by the terminal device from the risk probe server. Specifically, the risk probe server can generate an asymmetric encryption public key (pk_1) and an asymmetric encryption private key (sk_1), and the terminal device requests the risk probe server to obtain the asymmetric encryption public key. The asymmetric encryption public key (pk_1) and the asymmetric encryption private key (sk_1) are key pairs, which are used for encryption and decryption respectively.

[0076] Optionally, before executing step 201, the following steps may also be performed:

[0077] The terminal device sends a key acquisition request to the risk probe server and obtains an asymmetric encryption public key from the risk probe server.

[0078] 204, the terminal device reports the asymmetric encrypted data to the risk probe server; the asymmetric encrypted data includes encrypted data, an asymmetric encryption key and an asymmetric encryption public key.

[0079] In the embodiment of the present application, after the terminal device reports the asymmetric encrypted data to the risk probe server, the risk probe server can decrypt the asymmetric encryption key (Enkey) by using the asymmetric encryption private key (sk_1) corresponding to the asymmetric encryption public key (pk_1) to obtain the symmetric encryption key (key). The encrypted data (EnData) is decrypted using the symmetric encryption key (key) to obtain the terminal device information InfoSet, the data signature SIGN1, the device identification signature SIGN2, and TRAN.

[0080] The risk probe server can generate a device fingerprint and a token Token corresponding to the device fingerprint based on the terminal device information InfoSet.

[0081] Optionally, the risk probe server can verify the data signature SIGN1. Specifically, the KeyFieldSet+TRAN is MD5 signed and compared with SIGN1. If they are consistent, the signature verification is successful (KeyFieldSet is a subset of InfoSet).

[0082] Optionally, the risk probe server can generate a backend verification element VerCode based on the device identification signature SIGN2 and TAND, where TAND is a random number generated by the risk probe server.

[0083] Optionally, the risk probe server can generate a backend verification factor based on the backend verification element VerCode. Specifically, verify whether SIGN2 exists in the device identification signature library of the risk probe server. If it exists, the public key pk_2 corresponding to sk_2 in the key pair can be obtained (the mapping between the device identification signature SIGN2 and pk_2 exists in the device identification signature library). The risk probe server can use the public key pk_2 to asymmetrically encrypt the backend verification element VerCode to obtain the backend verification factor EnVerCode.

[0084] 205, the terminal device receives the token sent by the risk probe server and stores the token in the terminal. The token is a token corresponding to the device fingerprint generated by the risk probe server according to the encrypted data, the asymmetric encryption key and the asymmetric encryption public key.

[0085] In the embodiment of the present application, after the terminal device reports the asymmetric encrypted data to the risk probe server, the risk probe server decrypts the asymmetric encrypted data to obtain the terminal device information, generates a device fingerprint and a token corresponding to the device fingerprint according to the terminal device information, and the risk probe server can send the token to the terminal device, and the terminal device can store the token locally. For example, the terminal device can store the token persistently in the non-volatile memory of the terminal device.

[0086] Among them, the token is an object that represents the right to perform certain operations. As an alias for device fingerprints, the token is spread across the network, which can effectively prevent the risk of malicious collection of device fingerprints during the spread process. At the same time, the token is time-sensitive, which prevents malicious users from forging and cheating the token.

[0087] Optionally, the risk probe server may send the backend verification factor to the terminal device, and the terminal device may verify the backend verification factor through the hardware security zone, generate a frontend verification factor based on the backend verification factor, and send the frontend verification factor to the risk probe server, and the frontend verification factor is used by the risk probe server to perform security verification;

[0088] When the risk probe server successfully verifies the front-end verification factor, the terminal device executes step 205 .

[0089] In an embodiment of the present application, the terminal device can decrypt the back-end verification factor EnVerCode through the TA in the hardware security zone to obtain the back-end verification element VerCode. The terminal device can asymmetrically encrypt the back-end verification element VerCode and the device identification signature SIGN2 through the TA in the hardware security zone using the asymmetric encryption public key (pk_1) to obtain the front-end verification factor EnSIGN2. The terminal device sends the front-end verification factor EnSIGN2 to the risk probe server through RA, and the risk probe server performs a security verification on the front-end verification factor EnSIGN2. Specifically, the risk probe server decrypts the front-end verification factor EnSIGN2 through the asymmetric encryption private key (sk_1) to obtain the back-end verification element VerCode and the device identification signature SIGN2, and the risk probe server verifies the back-end verification element VerCode and the device identification signature SIGN2.

[0090] When the risk probe server successfully verifies the front-end verification factor, the risk probe server sends a token Token to the terminal device.

[0091] In the embodiment of the present application, the back-end verification of the risk probe server can be enhanced, and the back-end verification factor after asymmetric encryption can be generated at the risk probe server, and the front-end verification of the terminal device can also be enhanced. The terminal device and the risk probe server can interact with each other for verification, which can increase the cheating cost of the terminal device and make up for the unreliability and insecurity of RA.

[0092] In an embodiment of the present application, the terminal device sends asymmetrically encrypted data containing terminal device information to the risk probe server. Since the data signature and the device identification signature are obtained from the hardware security zone, the security of the data signature and the device identification signature is guaranteed, and the security of the data sent by the terminal device is guaranteed. Since a symmetric encryption key is used to symmetrically encrypt the terminal device information, the data signature and the device identification signature, and an asymmetrical encryption public key is used to asymmetrically encrypt the symmetric encryption key to obtain an asymmetrical encryption key, the security of the asymmetrically encrypted data sent by the terminal device to the risk probe server is guaranteed, and the security of the data received by the risk probe server is guaranteed. In the process of terminal device information transmission, the security of the transmitted data is guaranteed from both the data sending end and the data receiving end, thereby improving the security of terminal device information transmission.

[0093] See also Figure 3 , Figure 3is a flow chart of a device fingerprint generation method provided in an embodiment of the present application. Figure 3 As shown, the device fingerprint generation method may include the following steps.

[0094] 301, the risk probe server receives the key acquisition request sent by the terminal device, and sends an asymmetric encryption public key to the terminal device; the asymmetric encryption public key is used by the terminal device to encrypt using an asymmetric encryption method.

[0095] In the embodiment of the present application, the risk probe server can generate an asymmetric encryption public key (pk_1) and an asymmetric encryption private key (sk_1). After receiving the key acquisition request sent by the terminal device, the risk probe server can send the asymmetric encryption public key (pk_1) to the terminal device. After the terminal device receives the asymmetric encryption public key (pk_1), the terminal device uses the asymmetric encryption public key (pk_1) to perform asymmetric encryption processing on the symmetric encryption key (key) to obtain the asymmetric encryption key (Enkey).

[0096] Among them, the symmetric encryption key (key) is generated by the terminal device, and the symmetric encryption key (key) is used by the terminal device to symmetric encrypt the terminal device information InfoSet, the data signature SIGN1 and the device identification signature SIGN2. The data signature SIGN1 and the device identification signature SIGN2 are obtained by the terminal device from the TA in the hardware security zone.

[0097] The terminal device can collect terminal device information through the RA in the TEE (the terminal device information may include the terminal device's hardware information, system information, operating environment information, network information, etc.), and the terminal device can use a symmetric encryption key (key) to symmetrically encrypt the terminal device information InfoSet, data signature SIGN1 and device identification signature SIGN2 to obtain encrypted data (EnData).

[0098] The terminal device can use the asymmetric encryption public key (pk_1) to perform asymmetric encryption processing on the symmetric encryption key (key) to obtain an asymmetric encryption key (Enkey).

[0099] 302, the risk probe server receives the asymmetric encrypted data sent by the terminal device, and decrypts the asymmetric encrypted data using the asymmetric encryption private key corresponding to the asymmetric encryption public key to obtain the terminal device information.

[0100] Optionally, the asymmetric encrypted data includes encrypted data, an asymmetric encryption key and an asymmetric encryption public key; in step 302, the risk probe server uses an asymmetric encryption private key corresponding to the asymmetric encryption public key to decrypt the asymmetric encrypted data to obtain terminal device information, including the following steps:

[0101] (11) The risk probe server uses the asymmetric encryption private key corresponding to the asymmetric encryption public key to decrypt the asymmetric encryption key to obtain a symmetric encryption key;

[0102] (12) The risk probe server uses the symmetric encryption key to decrypt the encrypted data to obtain the terminal device information.

[0103] In the embodiment of the present application, the asymmetric encrypted data includes encrypted data (EnData), an asymmetric encryption key (Enkey) and an asymmetric encryption public key (pk_1). After the risk probe server receives the asymmetric encrypted data sent by the terminal device, the risk probe server can decrypt the asymmetric encryption key (Enkey) by using the asymmetric encryption private key (sk_1) corresponding to the asymmetric encryption public key (pk_1) to obtain the symmetric encryption key (key). The encrypted data (EnData) is decrypted using the symmetric encryption key (key) to obtain the terminal device information InfoSet, the data signature SIGN1 and the device identification signature SIGN2.

[0104] 303, the risk probe server generates a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information.

[0105] In the embodiment of the present application, the device fingerprint refers to a device feature or a unique device identifier that can be used to uniquely identify the device. The terminal device information of each terminal device is unique, so the generated device fingerprint is also unique.

[0106] Optionally, after executing step 303, the following steps may also be executed:

[0107] The risk probe server sends the token to the terminal device.

[0108] Optionally, after executing step 303, the following steps may also be executed:

[0109] The risk probe server generates a backend verification factor and sends the backend verification factor to the terminal device. The backend verification factor is used by the terminal device to perform security verification through the hardware security zone.

[0110] In an embodiment of the present application, the risk probe server can generate a backend verification element VerCode based on the device identification signature SIGN2 and TAND. Among them, TAND is a random number generated by the risk probe server. The risk probe server can generate a backend verification factor based on the backend verification element VerCode. Specifically, through the mapping relationship between the device identification signature SIGN2 and pk_2 in the device identification signature library, the public key pk_2 corresponding to sk_2 in the key pair can be obtained. The risk probe server can use the public key pk_2 to asymmetrically encrypt the backend verification element VerCode to obtain the backend verification factor EnVerCode.

[0111] Optionally, when the terminal device successfully verifies the backend verification factor through the hardware security zone, the risk probe server receives the frontend verification factor sent by the terminal device;

[0112] The risk probe server performs security verification on the front-end verification factor;

[0113] In the case where the risk probe server successfully verifies the front-end verification factor, the risk probe server executes the step of sending the token to the terminal device.

[0114] In an embodiment of the present application, the terminal device can decrypt the back-end verification factor EnVerCode through the TA in the hardware security zone, obtain the back-end verification element VerCode, and verify the device identification signature SIGN2. After the verification is passed, the terminal device can asymmetrically encrypt the back-end verification element VerCode and the device identification signature SIGN2 through the TA in the hardware security zone using the asymmetric encryption public key (pk_1) to obtain the front-end verification factor EnSIGN2. The terminal device sends the front-end verification factor EnSIGN2 to the risk probe server through RA, and the risk probe server performs a security verification on the front-end verification factor EnSIGN2. Specifically, the risk probe server decrypts the front-end verification factor EnSIGN2 through the asymmetric encryption private key (sk_1), obtains the back-end verification element VerCode and the device identification signature SIGN2, and the risk probe server verifies the back-end verification element VerCode and the device identification signature SIGN2. When the risk probe server successfully verifies the front-end verification factor, the risk probe server sends a token Token to the terminal device.

[0115] In the embodiment of the present application, the back-end verification of the risk probe server can be enhanced, and the back-end verification factor after asymmetric encryption can be generated at the risk probe server, and the front-end verification of the terminal device can also be enhanced. The terminal device and the risk probe server can interact with each other for verification, which can increase the cheating cost of the terminal device and make up for the unreliability and insecurity of RA.

[0116] In the embodiment of the present application, the risk probe server receives the asymmetric encrypted data sent by the terminal device, and uses the asymmetric encryption private key corresponding to the asymmetric encryption public key to decrypt the asymmetric encrypted data to obtain the terminal device information. Since the asymmetric encrypted data is encrypted by the terminal device using the symmetric encryption key, the security of the asymmetric encrypted data received by the risk probe server from the terminal device is guaranteed, and the security of the data received by the risk probe server is guaranteed. Thereby, the security of the device fingerprint generation is guaranteed.

[0117] See also Figure 4 , Figure 4 FIG. 1 is a flow chart of another device fingerprint generation method provided in an embodiment of the present application. Figure 4 As shown, the device fingerprint generation method may include the following steps.

[0118] 401, the risk probe server receives the key acquisition request sent by the terminal device and sends an asymmetric encryption public key to the terminal device; the asymmetric encryption public key is used by the terminal device to encrypt using an asymmetric encryption method.

[0119] 402, the risk probe server receives the asymmetric encrypted data sent by the terminal device, and decrypts the asymmetric encrypted data using the asymmetric encryption private key corresponding to the asymmetric encryption public key to obtain the terminal device information.

[0120] 403. The risk probe server generates a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information.

[0121] The specific implementation of steps 401 to 403 in the embodiment of the present application can be found in Figure 3 Steps 301 to 303 are shown and will not be described in detail here.

[0122] 404. The risk probe server performs big data calculations based on the terminal device information, historical reporting data, and business risk control data, identifies the business tendency classification of the terminal device, and identifies the device risk level of the terminal device.

[0123] In the embodiment of the present application, the risk probe server can build a terminal device portrait library. The risk probe server can clean the terminal device information Infoset reported by the terminal device, and perform big data calculations based on historical reporting data and business risk control data, classify the business tendency and mark the risk of the device fingerprint, so as to build a terminal device portrait library.

[0124] Optionally, after executing step 404, the following steps may also be executed:

[0125] The risk probe service end sends a device risk level identifier of the terminal device to the terminal device.

[0126] The risk probe server of the embodiment of the present application can combine terminal device information (such as operating environment, system status, etc.), business data and risk control intelligence, and identify the device risk level through big data technology and machine learning, so as to quickly and accurately obtain the device risk level and provide risk warning services for the terminal device.

[0127] See also Figure 5 , Figure 5 1 is a flow chart of another device fingerprint generation method provided in an embodiment of the present application. The terminal device may include a terminal device RA, and the risk probe service end may be an OPPO Risk Probe (ORP) backend. Figure 5 As shown, the device fingerprint generation method may include the following steps.

[0128] 501, the terminal device RA sends a key acquisition request to the ORP backend, and obtains an asymmetric encryption public key from the ORP backend.

[0129] Among them, the ORP backend can generate a key pair (asymmetric encryption public key pk_1 and asymmetric encryption private key sk_1).

[0130] 502, the terminal device RA requests the terminal device TA in the hardware security zone to obtain a data signature and a device identification signature.

[0131] The specific method for the terminal device TA in the hardware security zone to generate the data signature and the device identification signature is as follows:

[0132] The terminal device TA in the hardware security zone generates a random number TRAN through the hardware in the hardware security zone, and signs (KeyFie ldSet+TRAN) and (sk_2) respectively to obtain the data signature SIGN1 and the device identification signature SIGN2; then asymmetric encryption is performed on (SIGN1+SIGN2+TRAN) (the key is pk_1) to obtain EncSign; the terminal device TA returns the encryption result EncSign to the RA end of the terminal device. Among them, sk_2 is the unique identifier of the terminal device. Here, sk_2 can be considered as the private key in the key pair, and pk_2 is the public key corresponding to sk_2 in the key pair.

[0133] The terminal device TA signs (KeyFie ldSet+TRAN) and (sk_2) respectively, and specifically can use MD5 encryption method to sign.

[0134] Specifically, SIGN1=MD5(KeyFieldSet+TRAN); SIGN2=MD5(sk_2).

[0135] 503, the terminal device RA generates a symmetric encryption key, collects the terminal device information, and uses the symmetric encryption key to symmetrically encrypt the terminal device information, the data signature and the device identification signature to obtain encrypted data.

[0136] The specific implementation of step 503 can refer to the description of step 202, which will not be repeated here.

[0137] 504. The terminal device RA uses the asymmetric encryption public key to perform asymmetric encryption processing on the symmetric encryption key to obtain the asymmetric encryption key.

[0138] The specific implementation of step 504 can refer to the description of step 203, which will not be repeated here.

[0139] 505, the terminal device RA reports the asymmetric encryption data to the ORP backend; the asymmetric encryption data includes the encrypted data, the asymmetric encryption key and the asymmetric encryption public key.

[0140] The specific implementation of step 505 can refer to the description of step 204, which will not be repeated here.

[0141] 506, the ORP backend receives the asymmetric encrypted data sent by the terminal device RA, and decrypts the asymmetric encrypted data using the asymmetric encryption private key corresponding to the asymmetric encryption public key to obtain the terminal device information.

[0142] The specific implementation of step 506 can refer to the description of step 302, which will not be repeated here.

[0143] 507, the ORP backend generates a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information.

[0144] The specific implementation of step 507 can refer to the description of step 303, which will not be repeated here.

[0145] 508. The terminal device RA receives the token sent by the ORP backend and stores the token locally.

[0146] The specific implementation of step 508 can refer to the description of step 205, which will not be repeated here.

[0147] In the embodiment of the present application, the terminal device sends asymmetric encrypted data containing terminal device information to the risk probe server. Since the data signature and the device identification signature are obtained from the hardware security zone, the security of the data signature and the device identification signature is guaranteed, and the security of the data sent by the terminal device is guaranteed. Since the terminal device information, the data signature and the device identification signature are symmetrically encrypted using a symmetric encryption key, and the symmetric encryption key is asymmetrically encrypted using an asymmetric encryption public key to obtain an asymmetric encryption key, the security of the asymmetric encrypted data sent by the terminal device to the risk probe server is guaranteed, and the security of the data received by the risk probe server is guaranteed. In the process of terminal device information transmission, the security of the transmitted data is guaranteed from both the data sending end and the data receiving end, thereby improving the security of terminal device information transmission. The risk probe server receives the asymmetric encrypted data sent by the terminal device, and uses the asymmetric encryption private key corresponding to the asymmetric encryption public key to decrypt the asymmetric encrypted data to obtain the terminal device information. Since the asymmetric encrypted data is encrypted by the terminal device using a symmetric encryption key, the security of the asymmetric encrypted data received by the risk probe server from the terminal device is guaranteed, and the security of the data received by the risk probe server is guaranteed. This ensures the security of device fingerprint generation.

[0148] See also Figure 6 , Figure 6 1 is a flow chart of another device fingerprint generation method provided in an embodiment of the present application. The terminal device may include a terminal device RA, and the risk probe service end may be an OPPO Risk Probe (ORP) backend. Figure 6 As shown, the device fingerprint generation method may include the following steps.

[0149] 601, the terminal device RA sends a key acquisition request to the ORP backend, and obtains an asymmetric encryption public key from the ORP backend.

[0150] 602, the terminal device RA requests the terminal device TA in the hardware security zone to obtain a data signature and a device identification signature.

[0151] 603, the terminal device RA generates a symmetric encryption key, collects the terminal device information, and uses the symmetric encryption key to symmetrically encrypt the terminal device information, the data signature and the device identification signature to obtain encrypted data.

[0152] 604. The terminal device RA uses the asymmetric encryption public key to perform asymmetric encryption processing on the symmetric encryption key to obtain the asymmetric encryption key.

[0153] 605, the terminal device RA reports the asymmetric encryption data to the ORP backend; the asymmetric encryption data includes the encrypted data, the asymmetric encryption key and the asymmetric encryption public key.

[0154] 606, the ORP backend receives the asymmetric encrypted data sent by the terminal device RA, and decrypts the asymmetric encrypted data using the asymmetric encryption private key corresponding to the asymmetric encryption public key to obtain the terminal device information.

[0155] The specific implementation of steps 601 to 606 can be found in Figure 5 Steps 501 to 506 are shown and will not be described in detail here.

[0156] 607, the ORP backend generates a backend verification factor, and sends the backend verification factor to the terminal device TA through the terminal device RA.

[0157] 608. The terminal device TA verifies the backend verification factor.

[0158] 609, if the verification is successful, the terminal device TA generates a front-end verification factor, and sends the front-end verification factor to the ORP back-end through the terminal device RA.

[0159] 610. The ORP backend performs security verification on the front-end verification factor.

[0160] In an embodiment of the present application, the ORP backend can generate a backend verification element VerCode based on the device identification signature SIGN2 and TAND. Among them, TAND is a random number generated by the ORP backend. The ORP backend can generate a backend verification factor based on the backend verification element VerCode. Specifically, for the device identification signature SIGN2, the ORP backend can use the MD5 decryption method to obtain sk_2, and then obtain the public key pk_2 corresponding to sk_2 in the key pair. The ORP backend can use the public key pk_2 to asymmetrically encrypt the backend verification element VerCode to obtain the backend verification factor EnVerCode.

[0161] The terminal device TA decrypts the back-end verification factor EnVerCode to obtain the back-end verification element VerCode, and verifies the device identification signature SIGN2. After the verification is passed, the terminal device TA uses the asymmetric encryption public key (pk_1) to asymmetrically encrypt the back-end verification element VerCode and the device identification signature SIGN2 to obtain the front-end verification factor EnSIGN2. The terminal device TA sends the front-end verification factor EnSIGN2 to the ORP back-end through the terminal device RA, and the ORP back-end performs a security verification on the front-end verification factor EnSIGN2. Specifically, the ORP back-end decrypts the front-end verification factor EnSIGN2 through the asymmetric encryption private key (sk_1), obtains the back-end verification element VerCode and the device identification signature SIGN2, and the ORP back-end verifies the back-end verification element VerCode and the device identification signature SIGN2. When the ORP back-end successfully verifies the front-end verification factor, step 611 is executed.

[0162] 611, if the verification is successful, the ORP backend generates a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information.

[0163] 612. The terminal device RA receives the token sent by the ORP backend and stores the token locally.

[0164] The specific implementation of step 611 to step 612 can be found in Figure 5 Steps 507 to 508 are shown and will not be described in detail here.

[0165] In the embodiment of the present application, the back-end verification of the risk probe server can be enhanced, and the back-end verification factor after asymmetric encryption can be generated at the risk probe server, and the front-end verification of the terminal device can also be enhanced. The terminal device and the risk probe server can interact with each other for verification, which can increase the cheating cost of the terminal device and make up for the unreliability and insecurity of RA.

[0166] See also Figure 7 , Figure 7 It is a flow chart of another device fingerprint generation method provided by an embodiment of the present application. The terminal device may include a terminal device RA and a terminal device TA, and the risk probe service end may be an OPPO Risk Probe (ORP) backend. Figure 7 yes Figure 6 The specific implementation process. Figure 7 As shown, the device fingerprint generation method may include the following steps.

[0167] 701, RA requests pk_1 from the ORP backend;

[0168] 702, ORP backend generates a key pair (pk_1, sk_1);

[0169] 703, ORP backend returns pk_1 to RA;

[0170] 704, RA requests identity information (KeyFieldSet, pk_1) from TA;

[0171] 705, TA generates a data signature SIGN1 and a device identification signature SIGN2; wherein, SIGN1 = MD5 (KeyFieldSet + TRAN); SIGN2 = MD5 (sk_2);

[0172] 706, TA uses pk_1 to asymmetrically encrypt the data signature SIGN1 and the device identification signature SIGN2 to obtain EnSign; wherein EnSign = RSA_ENC (pk_1, SIGN1 + SIGN2 + TRAN);

[0173] 707, TA returns EnSign to RA;

[0174] 708, RA generates key, collects Infoset, uses key to symmetric encrypt Infoset and EnSign to obtain EnData, and uses pk_1 to asymmetric encrypt key to obtain Enkey; wherein, EnData = AES_ENC (key, Infoset + EnSign); Enkey = RSA_ENC (pk_1, key);

[0175] 709, RA uploads data EnData, Enkey and pk_1 to the ORP backend;

[0176] 710, the ORP backend uses sk_1 to decrypt Enkey to obtain key, uses key to decrypt EnData to obtain Information+EnSign, and uses sk_1 to decrypt EnSign to obtain SIGN1 and SIGN2;

[0177] 711, ORP backend signature verification SIGN1 (specifically, MD5 signature is performed on KeyFieldSet+TRAN and compared with SIGN1. If they are consistent, the signature verification is passed). The backend verification element VerCode is generated according to the device identification signature SIGN2 and TAND. The backend verification element VerCode is asymmetrically encrypted using the public key pk_2 to obtain the backend verification factor EnVerCode; wherein VerCode = (SIGN2 + TAND), EnVerCode = RSA_ENC (pk_2, VerCode);

[0178] 712, ORP backend returns EnVerCode to RA;

[0179] 713, RA returns EnVerCode to TA;

[0180] 714, TA uses the private key sk_2 to decrypt EnVerCode to obtain VerCode; wherein VerCode = RSA_DNC (sk_2, EnVerCode);

[0181] 715, TA verifies the signature of SIGN2 (verifies whether SIGN2 exists in the device identification signature library of the risk probe server), uses pk_1 to asymmetrically encrypt SIGN2 and VerCode, and obtains the front-end verification factor EnSIGN2; wherein, EnSIGN2 = RSA_ENC (pk_1, SIGN2 + VerCode);

[0182] 716, TA returns EnSIGN2 to RA;

[0183] 717, RA returns EnSIGN2 to the ORP backend;

[0184] 718, ORP backend uses sk_1 to decrypt EnSIGN2 and obtains SIGN2+VerCode;

[0185] 719, ORP backend verifies SIGN2 and VerCode;

[0186] 720, ORP backend generates Token;

[0187] 721, ORP returns Token to RA.

[0188] See also Figure 8 , Figure 8 This is a schematic diagram of a service access process provided by an embodiment of the present application. Figure 8 As shown, on the business client, the software development kit (SDK) is accessed, and the business client sends a request message to the business backend. The request message includes a token Token and a terminal device information key field set KeyFie ldSet. After the business backend adds an application identifier (Application Identity document, APPID) to the request message, it sends the request message to the ORP backend, and the ORP backend returns the risk assessment result to the business backend.

[0189] In the embodiment of the present application, the business deployment is simple. The business client only needs to access the lightweight SDK to obtain the Token and KeyFie ldSet persistently stored in the terminal device, and upload the data to the business backend; the business backend only needs to access an interface of the ORP backend to obtain the risk label of the terminal device. The business client only needs to access the lightweight SDK. The business client accesses the lightweight SDK, collects very little terminal device information, and requires very few permissions, so the impact on the business client can be ignored. TA is built into the hardware of the terminal device, and RA follows the operating system of the terminal device, that is, the risk probe client is bound to the terminal device, and provides unified services for all businesses on the terminal device. The security of the risk probe SDK can be improved, and the lightweight SDK can be reinforced, which effectively increases the difficulty of reversing and cracking the SDK.

[0190] The above mainly introduces the scheme of the embodiment of the present application from the perspective of the execution process on the method side. It is understandable that in order to realize the above functions, the terminal device includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiment provided in this article, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0191] The embodiment of the present application can divide the terminal device into functional units according to the above method example. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one processing unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0192] In line with the above, see Fig. 9 , Fig. 9 A schematic diagram of the structure of a terminal device information transmission device provided in an embodiment of the present application, wherein the terminal device information transmission device 900 is applied to a terminal device, and the terminal device information transmission device 900 may include an acquisition unit 901, a first generation unit 902, a collection unit 903, a first encryption unit 904, a first communication unit 905, and a storage unit 906, wherein:

[0193] The acquisition unit 901 is used to acquire the data signature and the device identification signature from the hardware security zone;

[0194] The first generating unit 902 is used to generate a symmetric encryption key;

[0195] The collecting unit 903 is used to collect terminal device information;

[0196] The first encryption unit 904 is used to symmetrically encrypt the terminal device information, the data signature and the device identification signature using the symmetric encryption key to obtain encrypted data;

[0197] The first encryption unit 904 is further used to perform asymmetric encryption processing on the symmetric encryption key using an asymmetric encryption public key to obtain an asymmetric encryption key; the asymmetric encryption public key is obtained from the risk probe server;

[0198] The first communication unit 905 is used to report the asymmetric encrypted data to the risk probe server; the asymmetric encrypted data includes the encrypted data, the asymmetric encryption key and the asymmetric encryption public key;

[0199] The first communication unit 905 is further used to receive a token sent by the risk probe server;

[0200] The storage unit 906 is used to store the token on the local end, where the token is a token corresponding to the device fingerprint generated by the risk probe server according to the encrypted data, the asymmetric encryption key and the asymmetric encryption public key.

[0201] Optionally, the terminal device information transmission apparatus 900 may further include a first verification unit 907;

[0202] The first communication unit 905 is further configured to receive a backend verification factor sent by the risk probe server after reporting the asymmetrically encrypted data to the risk probe server;

[0203] The first verification unit 907 is used to verify the backend verification factor through the hardware security zone;

[0204] The first generating unit 902 is further configured to generate a front-end check factor based on the back-end check factor;

[0205] The first communication unit 905 is also used to send the front-end verification factor to the risk probe server, and the front-end verification factor is used by the risk probe server to perform security verification; and to receive the token sent by the risk probe server when the risk probe server successfully verifies the front-end verification factor.

[0206] Among them, the acquisition unit 901, the first generation unit 902, the collection unit 903, the first encryption unit 904, and the first verification unit 907 in the embodiment of the present application can be processors in the terminal device, the first communication unit 905 can be a communication interface in the terminal device, and the storage unit 906 can be a memory in the terminal device (for example, a non-volatile memory).

[0207] In an embodiment of the present application, the terminal device sends asymmetrically encrypted data containing terminal device information to the risk probe server. Since the data signature and the device identification signature are obtained from the hardware security zone, the security of the data signature and the device identification signature is guaranteed, and the security of the data sent by the terminal device is guaranteed. Since a symmetric encryption key is used to symmetrically encrypt the terminal device information, the data signature and the device identification signature, and an asymmetrical encryption public key is used to asymmetrically encrypt the symmetric encryption key to obtain an asymmetrical encryption key, the security of the asymmetrically encrypted data sent by the terminal device to the risk probe server is guaranteed, and the security of the data received by the risk probe server is guaranteed. In the process of terminal device information transmission, the security of the transmitted data is guaranteed from both the data sending end and the data receiving end, thereby improving the security of terminal device information transmission.

[0208] In line with the above, see Fig.10 , Fig.10 This is a schematic diagram of the structure of a device fingerprint generation device provided in an embodiment of the present application. The device fingerprint generation device 1000 is applied to a risk probe server. The device fingerprint generation device 1000 may include a second communication unit 1001, a decryption unit 1002, and a second generation unit 1003, wherein:

[0209] The second communication unit 1001 is used to receive a key acquisition request sent by a terminal device, and send an asymmetric encryption public key to the terminal device; the asymmetric encryption public key is used by the terminal device to encrypt using an asymmetric encryption method;

[0210] The second communication unit 1001 is further used to receive asymmetrically encrypted data sent by the terminal device;

[0211] The decryption unit 1002 is used to decrypt the asymmetric encrypted data using the asymmetric encryption private key corresponding to the asymmetric encryption public key to obtain terminal device information;

[0212] The second generating unit 1003 is used to generate a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information.

[0213] Optionally, the device fingerprint generating apparatus 1000 may include an identification unit 1004 .

[0214] The identification unit 1004 is used to perform big data calculations based on the terminal device information, historical reported data, and business risk control data after the second generation unit 1003 generates a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information, so as to identify the business tendency classification of the terminal device and the device risk level of the terminal device.

[0215] Optionally, the asymmetric encrypted data includes encrypted data, an asymmetric encryption key, and an asymmetric encryption public key; the decryption unit 1002 uses an asymmetric encryption private key corresponding to the asymmetric encryption public key to decrypt the asymmetric encrypted data to obtain terminal device information, specifically:

[0216] The asymmetric encryption key is decrypted using an asymmetric encryption private key corresponding to the asymmetric encryption public key to obtain a symmetric encryption key; the encrypted data is decrypted using the symmetric encryption key to obtain the terminal device information.

[0217] Optionally, the second communication unit 1001 is further used to send the token to the terminal device after the second generation unit 1003 generates a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information.

[0218] Optionally, the second generating unit 1003 is further configured to generate a backend verification factor after the second generating unit 1003 generates a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information;

[0219] The second communication unit 1001 is further used to send the backend verification factor to the terminal device, and the backend verification factor is used by the terminal device to perform security verification through the hardware security zone.

[0220] Optionally, the device fingerprint generating apparatus 1000 may include a second verification unit 1005 .

[0221] The second communication unit 1001 is further configured to receive the front-end check factor sent by the terminal device when the terminal device successfully checks the back-end check factor through the hardware security zone;

[0222] The second verification unit 1005 is used to perform security verification on the front-end verification factor;

[0223] The second communication unit 1001 is further configured to send the token to the terminal device when the second verification unit 1005 successfully verifies the front-end verification factor.

[0224] In the embodiment of the present application, the risk probe server receives the asymmetric encrypted data sent by the terminal device, and uses the asymmetric encryption private key corresponding to the asymmetric encryption public key to decrypt the asymmetric encrypted data to obtain the terminal device information. Since the asymmetric encrypted data is encrypted by the terminal device using the symmetric encryption key, the security of the asymmetric encrypted data received by the risk probe server from the terminal device is guaranteed, and the security of the data received by the risk probe server is guaranteed. Thereby, the security of the device fingerprint generation is guaranteed.

[0225] See also Fig.11 , Fig.11 is a schematic diagram of the structure of a terminal device provided in an embodiment of the present application, such as Fig.11 As shown, the terminal device 1100 includes a processor 1101 and a memory 1102. The processor 1101 and the memory 1102 can be connected to each other via a communication bus 1103. The communication bus 1103 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industrial Standard Architecture (EISA) bus. The communication bus 1103 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.11 The memory 1102 is used to store computer programs. The computer programs include program instructions. The processor 1101 is configured to call the program instructions. The program includes instructions for executing Figure 2 The method shown.

[0226] The processor 1101 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the above program.

[0227] The memory 1102 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via a bus. The memory may also be integrated with the processor.

[0228] In addition, the terminal device 1100 may also include common components such as a communication interface and an antenna, which will not be described in detail here.

[0229] In an embodiment of the present application, the terminal device sends asymmetrically encrypted data containing terminal device information to the risk probe server. Since the data signature and the device identification signature are obtained from the hardware security zone, the security of the data signature and the device identification signature is guaranteed, and the security of the data sent by the terminal device is guaranteed. Since a symmetric encryption key is used to symmetrically encrypt the terminal device information, the data signature and the device identification signature, and an asymmetrical encryption public key is used to asymmetrically encrypt the symmetric encryption key to obtain an asymmetrical encryption key, the security of the asymmetrically encrypted data sent by the terminal device to the risk probe server is guaranteed, and the security of the data received by the risk probe server is guaranteed. In the process of terminal device information transmission, the security of the transmitted data is guaranteed from both the data sending end and the data receiving end, thereby improving the security of terminal device information transmission.

[0230] See also Fig.12 , Fig.12 is a schematic diagram of the structure of a server provided in an embodiment of the present application, such as Fig.12As shown, the server 1200 includes a processor 1201 and a memory 1202. The processor 1201 and the memory 1202 can be connected to each other via a communication bus 1203. The communication bus 1203 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industrial Standard Architecture (EISA) bus. The communication bus 1203 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.12 The memory 1202 is used to store computer programs. The computer programs include program instructions. The processor 1201 is configured to call the program instructions. The above program includes instructions for executing Figures 2 to 4 The method shown.

[0231] The processor 1201 may be a general purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the above program.

[0232] The memory 1202 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via a bus. The memory may also be integrated with the processor.

[0233] In addition, the server 1200 may also include common components such as a communication interface and an antenna, which will not be described in detail here.

[0234] The server 1200 may be a risk probe server.

[0235] In the embodiment of the present application, the risk probe server receives the asymmetric encrypted data sent by the terminal device, and uses the asymmetric encryption private key corresponding to the asymmetric encryption public key to decrypt the asymmetric encrypted data to obtain the terminal device information. Since the asymmetric encrypted data is encrypted by the terminal device using the symmetric encryption key, the security of the asymmetric encrypted data received by the risk probe server from the terminal device is guaranteed, and the security of the data received by the risk probe server is guaranteed. Thereby, the security of the device fingerprint generation is guaranteed.

[0236] An embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for electronic data exchange, and the computer program enables a computer to execute part or all of the steps of any one of the network standard switching methods recorded in the above method embodiments.

[0237] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program enables a computer to execute part or all of the steps of any network standard switching method recorded in the above method embodiments.

[0238] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0239] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0240] In the several embodiments provided in the present application, it should be understood that the disclosed device can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the device or unit can be electrical or other forms.

[0241] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0242] In addition, the functional units in the various embodiments of the application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware or in the form of software program modules.

[0243] If the integrated unit is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned memory includes: U disk, read-only memory (ROM), random access memory (RAM), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0244] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable memory, which can include: a flash drive, a read-only memory, a random access memory, a magnetic disk or an optical disk, etc.

[0245] The embodiments of the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for transmitting information of a terminal device, characterized in that: include: The terminal device obtains a data signature and a device identification signature from the hardware security zone, wherein the data signature is a signature of a set of terminal device information key fields; The terminal device generates a symmetric encryption key, collects terminal device information, and uses the symmetric encryption key to symmetrically encrypt the terminal device information, the data signature, and the device identification signature to obtain encrypted data; The terminal device uses an asymmetric encryption public key to perform asymmetric encryption processing on the symmetric encryption key to obtain an asymmetric encryption key; the asymmetric encryption public key is obtained by the terminal device from the risk probe server; The terminal device reports the asymmetric encrypted data to the risk probe server; the asymmetric encrypted data includes the encrypted data, the asymmetric encryption key and the asymmetric encryption public key; The terminal device receives the token sent by the risk probe server and stores the token locally. The token is a token corresponding to the device fingerprint generated by the risk probe server based on the encrypted data, the asymmetric encryption key and the asymmetric encryption public key.

2. The method according to claim 1, characterized in that After the terminal device reports the asymmetrically encrypted data to the risk probe server, the method further includes: The terminal device receives the backend verification factor sent by the risk probe server, verifies the backend verification factor through the hardware security zone, generates a frontend verification factor based on the backend verification factor, and sends the frontend verification factor to the risk probe server, where the frontend verification factor is used by the risk probe server for security verification; In a case where the risk probe server successfully verifies the front-end verification factor, the terminal device executes the step of receiving the token sent by the risk probe server.

3. A method for generating a device fingerprint, characterized in that: include: The risk probe server receives the key acquisition request sent by the terminal device and sends the asymmetric encryption public key to the terminal device; The asymmetric encryption public key is used for the terminal device to encrypt using an asymmetric encryption method; The risk probe server receives the asymmetric encrypted data sent by the terminal device, and uses the asymmetric encryption private key corresponding to the asymmetric encryption public key to decrypt the asymmetric encrypted data to obtain terminal device information; the asymmetric encrypted data includes encrypted data, an asymmetric encryption key and the asymmetric encryption public key; the encrypted data is obtained by the terminal device using the symmetric encryption key to symmetrically encrypt the terminal device information, data signature and device identification signature; The risk probe server generates a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information.

4. The method according to claim 3, characterized in that: After the risk probe server generates a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information, the method further includes: The risk probe server performs big data calculations based on the terminal device information, historical reporting data, and business risk control data, identifies the business tendency classification of the terminal device, and identifies the device risk level of the terminal device.

5. The method according to claim 3 or 4, characterized in that: The risk probe server uses the asymmetric encryption private key corresponding to the asymmetric encryption public key to decrypt the asymmetric encrypted data to obtain terminal device information, including: The risk probe server uses the asymmetric encryption private key corresponding to the asymmetric encryption public key to decrypt the asymmetric encryption key to obtain a symmetric encryption key; The risk probe server uses the symmetric encryption key to decrypt the encrypted data to obtain the terminal device information.

6. The method according to claim 3, characterized in that After the risk probe server generates a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information, the method further includes: The risk probe server sends the token to the terminal device.

7. The method according to claim 6, characterized in that After the risk probe server generates a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information, the method further includes: The risk probe server generates a backend verification factor and sends the backend verification factor to the terminal device. The backend verification factor is used by the terminal device to perform security verification through the hardware security zone.

8. The method according to claim 7, characterized in that The method further comprises: When the terminal device successfully verifies the backend verification factor through the hardware security zone, the risk probe server receives the frontend verification factor sent by the terminal device; The risk probe server performs security verification on the front-end verification factor; In the case where the risk probe server successfully verifies the front-end verification factor, the risk probe server executes the step of sending the token to the terminal device.

9. A terminal device information transmission device, characterized in that: include: An acquisition unit, used to acquire a data signature and a device identification signature from the hardware security zone, wherein the data signature is a signature of a key field set of terminal device information; A first generating unit, used to generate a symmetric encryption key; A collection unit, used for collecting terminal device information; A first encryption unit, configured to symmetrically encrypt the terminal device information, the data signature and the device identification signature using the symmetric encryption key to obtain encrypted data; The first encryption unit is further used to perform asymmetric encryption processing on the symmetric encryption key using an asymmetric encryption public key to obtain an asymmetric encryption key; the asymmetric encryption public key is obtained from the risk probe server; A first communication unit, configured to report asymmetric encrypted data to the risk probe server; the asymmetric encrypted data includes the encrypted data, the asymmetric encryption key and the asymmetric encryption public key; The first communication unit is further used to receive a token sent by the risk probe server; A storage unit is used to store the token on this end, where the token is a token corresponding to the device fingerprint generated by the risk probe server according to the encrypted data, the asymmetric encryption key and the asymmetric encryption public key.

10. A device fingerprint generation apparatus, characterized in that: include: A second communication unit is used to receive a key acquisition request sent by a terminal device, and send an asymmetric encryption public key to the terminal device; the asymmetric encryption public key is used by the terminal device to encrypt using an asymmetric encryption method; The second communication unit is further used to receive asymmetrically encrypted data sent by the terminal device; A second encryption unit is used to decrypt the asymmetric encrypted data using an asymmetric encryption private key corresponding to the asymmetric encryption public key to obtain terminal device information; the asymmetric encrypted data includes encrypted data, an asymmetric encryption key and the asymmetric encryption public key; the encrypted data is obtained by symmetrically encrypting the terminal device information, the data signature and the device identification signature by the terminal device using the symmetric encryption key; The second generating unit is used to generate a device fingerprint and a token corresponding to the device fingerprint based on the terminal device information.

11. A terminal device, characterized in that: The method comprises a processor and a memory, wherein the memory is used to store a computer program, the computer program comprises program instructions, and the processor is configured to call the program instructions to execute the method according to any one of claims 1 to 2.

12. A server, characterized in that: The method comprises a processor and a memory, wherein the memory is used to store a computer program, the computer program comprises program instructions, and the processor is configured to call the program instructions to execute the method according to any one of claims 3 to 8.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor is enabled to perform the method according to any one of claims 1 to 2.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor is caused to execute the method according to any one of claims 3 to 8.

Images