A network security authentication method and system

Abstract

The present invention belongs to the technical field of network security, and specifically relates to a network security authentication method and system, the method comprising: a terminal device sends request information about a security authentication key to a communication server; the communication server receives the request information, generates a unique security authentication key about the terminal device, and stores the security authentication key and a gateway device ID of the gateway device that sends the request information in correspondence; the terminal device receives the security authentication key, and sends a first authentication request to a corresponding gateway device; the gateway device generates a second authentication request based on the first authentication request, and also sends the second authentication request to the communication server; the communication server receives the second authentication request, determines the security of the gateway device, and stores the gateway device ID and the corresponding terminal device ID. The present invention solves the problem in the prior art that it is difficult to perform security authentication on the gateway device between the communication server and the terminal device.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a network security authentication method and system. Background Art

[0002] In real life, there are application requirements for communication servers to remotely collect and manage data generated by terminal devices. Communication servers and terminal devices are often in different networks and generally use different communication protocols, data formats, etc. A gateway device is a computer system or device that provides data conversion services between multiple networks. The received information must be repackaged to meet the needs of the destination network, while also playing a filtering and security role. For example, a communication server can connect to and control all networked devices within a home through a gateway device, and the gateway device becomes a connection bridge and portal between the home network and the external network. However, in the prior art, security authentication of the gateway device between the communication server and the terminal device is rarely performed. Malicious users may use gateway devices that have not been security authenticated to illegally control the terminal device and cause data collected from the terminal device to be leaked. The present invention proposes a network security authentication method and system to solve this technical problem. Summary of the invention

[0003] The present invention performs security authentication on the gateway device between the communication server and the terminal device, and the communication server collects relevant data from the terminal device through the secure gateway device, aiming to prevent malicious users from illegally controlling the terminal device using the gateway device that has not been security authenticated, and causing the leakage of data collected from the terminal device.

[0004] In order to achieve the above-mentioned object of the invention, a network security authentication method as described below is provided, which mainly includes the following steps:

[0005] The communication server and the terminal device share the confirmation data, and the terminal device sends the request information about its security authentication key to the communication server through the gateway device, wherein the request information includes the terminal device ID that can uniquely identify the terminal device and the encryption result of the confirmation data;

[0006] The communication server receives the terminal device ID and the encryption result of the confirmation data, and verifies the correctness of the confirmation data. If the confirmation data is correct, the communication server generates a unique security authentication key for the terminal device, stores the security authentication key and the unique gateway device ID of the gateway device that sends the request information in a corresponding manner, and sends the security authentication key to the terminal device through the gateway device;

[0007] The terminal device receives the security authentication key and sends a first authentication request to the corresponding gateway device, where the first authentication request includes the terminal device ID and the corresponding security authentication key;

[0008] The gateway device receives the first authentication request, and generates a second authentication request based on the first authentication request, wherein the second authentication request includes the gateway device ID, the terminal device ID, and the security authentication key corresponding to the terminal device ID, and the gateway device also sends the second authentication request to the communication server;

[0009] The communication server receives the second authentication request, and when the security authentication key corresponding to the terminal device ID in the second authentication request is correct, it continues to verify the consistency of the gateway device ID in the second authentication request and the gateway device ID corresponding to the security authentication key in the second authentication request stored by the communication server. When the two are consistent, it is determined that the corresponding gateway device is safe, and the communication server stores the gateway device ID and the corresponding terminal device ID, and notifies the corresponding gateway device and terminal device at the same time.

[0010] As a preferred technical solution of the present invention, the process of the communication server verifying the correctness of the confirmation data includes the following steps:

[0011] The communication server and the terminal device respectively store the shared confirmation data, the terminal device encrypts the confirmation data, stores the encryption result of the confirmation data, and sends the encryption result to the communication server through the gateway device;

[0012] The communication server receives the encryption result, decrypts the encryption result to obtain the confirmation data, compares the decrypted confirmation data with the confirmation data stored in the communication server, and when the two are consistent, determines that the confirmation data sent by the terminal device is correct, and stores the encryption result;

[0013] The communication server and the terminal device respectively update the encryption result of this time to the new confirmation data, which will be used when the terminal device sends the request information to the communication server next time.

[0014] As a preferred technical solution of the present invention, after the communication server generates a unique security authentication key for the terminal device, it also includes setting a first validity period for the security authentication key.

[0015] As a preferred technical solution of the present invention, the communication server determines that the gateway device is safe, and after storing the gateway device ID and the corresponding terminal device ID, it also includes setting a second validity period for the gateway device.

[0016] As a preferred technical solution of the present invention, after the communication server verifies that the security authentication key corresponding to the terminal device ID in the second authentication request is correct, the following steps are also included:

[0017] The communication server checks whether a first reception time of the second authentication request is within the first validity period of the security authentication key in the second authentication request;

[0018] When the first receiving time is within the first validity period, the consistency of the gateway device ID in the second authentication request and the gateway device ID corresponding to the security authentication key in the second authentication request stored by the communication server is continued to be verified; when the first receiving time is not within the first validity period, the communication server determines that the corresponding gateway device is unsafe;

[0019] The terminal device resends the request information to the communication server to obtain the new security authentication key.

[0020] As a preferred technical solution of the present invention, the communication server collects data generated by the terminal device through the gateway device, including the following steps:

[0021] The gateway device sends a data collection request to the communication server, wherein the data collection request includes the gateway device ID;

[0022] The communication server receives the data collection request from the gateway device, and searches for a terminal device ID corresponding to the gateway device ID in the data collection request based on the gateway device ID and the corresponding terminal device ID stored in the communication server, and when the corresponding terminal device ID exists, proceeds to the next step, otherwise, ends the step;

[0023] The communication server determines whether the second reception time of the data collection request is within the second validity period of the gateway device corresponding to the gateway device ID in the data collection request, and when the second reception time is within the second validity period, proceeds to the next step, otherwise, ends the step;

[0024] The communication server generates and stores a unique access key for the gateway device corresponding to the gateway device ID in the data collection request, and the communication server sends the found terminal device ID and the access key to the corresponding gateway device;

[0025] The gateway device sends the received access key to the terminal device corresponding to the terminal device ID;

[0026] The terminal device receives the access key and sends the terminal device data, including the data generated by itself and the access key, to the communication server through the gateway device;

[0027] The communication server receives the terminal device data and verifies whether the gateway device ID of the gateway device that sends the terminal device data and the access key in the terminal device data are consistent with the gateway device ID and the corresponding access key stored in itself. If the two are consistent, the communication server completes collecting data from the terminal device, otherwise, the step ends.

[0028] The present invention also provides a network security authentication system, which mainly includes the following modules:

[0029] A communication server, configured to receive a request from a terminal device for a security authentication key, generate a unique security authentication key for the terminal device, and store the security authentication key and a unique gateway device ID of the gateway device that sent the request information in correspondence, and further configured to receive a second authentication request, determine the security of the gateway device, and store the gateway device ID and the corresponding terminal device ID, and further configured to collect data generated by the terminal device through the gateway device;

[0030] A gateway device, used to forward the request information of the terminal device about the security authentication key to the communication server, and send the security authentication key generated by the communication server to the terminal device, and also used to receive the first authentication request sent by the terminal device, and simultaneously generate and send the second authentication request to the communication server, and also used to send the data generated by the terminal device to the communication server;

[0031] The terminal device is used to generate request information about a security authentication key, receive a security authentication key generated by a communication server, and send a first authentication request to a corresponding gateway device, and is also used to send generated data to the communication server via the gateway device.

[0032] Compared with the prior art, the beneficial effects of the present invention are at least as follows:

[0033] 1. A network security authentication method of the present invention, first, the terminal device sends request information about the security authentication key to the communication server; then, the communication server receives the request information, generates a unique security authentication key about the terminal device, and stores the security authentication key and the gateway device ID of the gateway device that sends the request information in correspondence; secondly, the terminal device receives the security authentication key, and sends a first authentication request to the corresponding gateway device; thirdly, the gateway device generates a second authentication request based on the first authentication request, and also sends the second authentication request to the communication server; finally, the communication server receives the second authentication request, determines the security of the gateway device, and stores the gateway device ID and the corresponding terminal device ID in correspondence.

[0034] 2. The present invention solves the problem in the prior art that it is difficult to perform security authentication on the gateway device between the communication server and the terminal device. The present invention can also rely on the gateway device that has passed security authentication to collect data from the terminal device to ensure the reliability of the data, while preventing malicious users from using gateway devices that have not passed security authentication to illegally control the terminal device and cause the leakage of data collected from the terminal device. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A flowchart of the steps of a network security authentication method of the present invention;

[0036] Figure 2 A flowchart of the steps of collecting data of a terminal device according to the present invention;

[0037] Figure 3 The present invention is a structural diagram of a network security authentication system. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0039] It is understood that the terms "first", "second", etc. used in this application may be used herein to describe various elements, but unless otherwise specified, these elements are not limited by these terms. These terms are only used to distinguish a first element from another element. For example, without departing from the scope of this application, a first xx script may be referred to as a second xx script, and similarly, a second xx script may be referred to as a first xx script.

[0040] The inventor found that it is difficult to perform security authentication on the gateway device between the communication server and the terminal device in the prior art. Malicious users may use the gateway device that has not been security authenticated to illegally control the terminal device and cause the leakage of data collected from the terminal device. In response to this technical problem, the inventor proposed the following method: Figure 1 A network security authentication method is shown, which is mainly implemented by executing the following steps:

[0041] Step 1: The communication server and the terminal device share confirmation data, and the terminal device sends request information about its security authentication key to the communication server through the gateway device, where the request information includes a terminal device ID that can uniquely identify the terminal device and an encryption result of the confirmation data;

[0042] Step 2: The communication server receives the terminal device ID and the encryption result of the confirmation data, and verifies the correctness of the confirmation data. If the confirmation data is correct, the communication server generates a unique security authentication key for the terminal device, stores the security authentication key and the unique gateway device ID of the gateway device that sent the request information in a corresponding manner, and sends the security authentication key to the terminal device through the gateway device;

[0043] Step 3: The terminal device receives the security authentication key and sends a first authentication request to the corresponding gateway device, where the first authentication request includes the terminal device ID and the corresponding security authentication key.

[0044] Step 4: The gateway device receives the first authentication request, and generates a second authentication request based on the first authentication request, wherein the second authentication request includes the gateway device ID, the terminal device ID, and the security authentication key corresponding to the terminal device ID, and the gateway device also sends the second authentication request to the communication server;

[0045] Step 5: The communication server receives the second authentication request. When the security authentication key corresponding to the terminal device ID in the second authentication request is correct, the communication server continues to verify the consistency of the gateway device ID in the second authentication request and the gateway device ID corresponding to the security authentication key in the second authentication request stored by the communication server. When the two are consistent, the corresponding gateway device is determined to be safe, and the communication server stores the gateway device ID and the corresponding terminal device ID, and notifies the corresponding gateway device and terminal device at the same time.

[0046] Specifically, in the above steps 1 to 5, the terminal device first sends a request message to the communication server in order to obtain a security authentication key, which is subsequently used to perform security authentication on the gateway device. The communication server then decrypts the encryption result of the confirmation data in the request message and verifies the correctness of the confirmation data. If the confirmation data is correct, it means that the corresponding terminal device is safe. At this time, the communication server generates a security authentication key for the terminal device. At the same time, the communication server stores the security authentication key and the gateway device ID of the gateway device that sends the request message. Secondly, the terminal device sends a first authentication request to the gateway device, and the first authentication request includes the security authentication key. The gateway device generates a second authentication request, which includes the gateway device ID of the gateway device itself. The gateway device sends the second authentication request to the communication server to verify its own security. Finally, the communication server compares the security authentication key and terminal device ID in the second authentication request with the security authentication key previously generated for the specific terminal device. If they are consistent, the communication server continues to check whether the gateway device ID in the second authentication request is consistent with the gateway device ID corresponding to the security authentication key in the second authentication request stored previously. The gateway device ID is also the gateway device ID of the gateway device that sent the request information. If they are consistent, the communication server determines that the gateway device is safe and completes the security authentication of the gateway device.

[0047] Furthermore, the process of the communication server verifying the correctness of the above confirmation data includes the following steps:

[0048] The first step is that the communication server and the terminal device respectively store the shared confirmation data, the terminal device encrypts the confirmation data, stores the encryption result of the confirmation data, and sends the encryption result to the communication server through the gateway device;

[0049] Step 2: The communication server receives the encryption result, decrypts the encryption result, obtains the confirmation data, compares the decrypted confirmation data with the confirmation data stored in the communication server, and when the two are consistent, determines that the confirmation data sent by the terminal device is correct, and stores the encryption result;

[0050] Step 3: The communication server and the terminal device respectively update the encryption result of this time into the new confirmation data, which is used when the terminal device sends the request information to the communication server next time;

[0051] Specifically, the inventor took into account that the same terminal device may send request information to the communication server multiple times to obtain the security authentication key, thereby performing security authentication on the gateway device. If the confirmation data shared by the communication server and the terminal device remains unchanged, once the confirmation data is leaked, a malicious user may impersonate the identity of the terminal device. The malicious user may even make the gateway device he uses pass security authentication. In order to solve this problem, the above-mentioned first step to the above-mentioned third step are proposed. The terminal device transmits the encryption result of the confirmation data to the communication server. After receiving the encryption result, the communication server decrypts it and compares the decrypted result with the pre-stored confirmation data. If they are the same, it means that the terminal device is safe. At the same time, the encryption result is updated to the new confirmation data. Even if the encryption result is stolen by a malicious user and the confirmation data is obtained during the process of the terminal device sending the encryption result to the communication server, since the confirmation data is always changing, the malicious user can no longer use the confirmation data to impersonate the identity of the terminal device.

[0052] Furthermore, after the communication server generates a unique security authentication key for the terminal device, it also includes setting a first validity period for the security authentication key;

[0053] Further, after the communication server verifies that the security authentication key corresponding to the terminal device ID in the second authentication request is correct, the following steps are also included:

[0054] The first step is that the communication server checks whether the first reception time of the second authentication request is within the first validity period of the security authentication key in the second authentication request;

[0055] Step 2: When the first receiving time is within the first validity period, the consistency of the gateway device ID in the second authentication request and the gateway device ID corresponding to the security authentication key in the second authentication request stored by the communication server is further verified; when the first receiving time is not within the first validity period, the communication server determines that the corresponding gateway device is unsafe;

[0056] Step 3: The terminal device resends the request information to the communication server to obtain a new security authentication key;

[0057] Specifically, in order to further improve the security of the process of security authentication of the gateway device, the inventor should also set a first validity period for the security authentication key generated by the communication server for the terminal device, and provide the above-mentioned first step to the above-mentioned third step. After the communication server verifies that the security authentication key in the above-mentioned second authentication request is correct, it is determined whether the time when the communication server receives the above-mentioned second authentication request is within the first validity period of the security authentication key. Because if the time of receiving the above-mentioned second authentication request is not within the first validity period of the security authentication key, it means that the second authentication request has lost its timeliness, that is, it is no longer possible to perform security authentication on the gateway device according to the second authentication request, and the gateway device is considered to be unsafe. At this time, the corresponding terminal device should re-send the request information about the security authentication key to the communication server, so as to perform security authentication on the gateway device again. If the time of receiving the above-mentioned second authentication request is within the first validity period of the security authentication key, the consistency of the gateway device ID in the above-mentioned second authentication request and the gateway device ID corresponding to the security authentication key in the above-mentioned second authentication request previously stored by the communication server is verified. When the two are consistent, it can be determined that the gateway device is safe.

[0058] Furthermore, the communication server determines that the gateway device is safe, and after storing the gateway device ID and the corresponding terminal device ID, it also includes setting a second validity period for the gateway device;

[0059] For further reference, see Figure 2 As shown, the communication server collects data generated by the terminal device through the gateway device, including the following steps:

[0060] The first step is that the gateway device sends a data collection request to the communication server, and the data collection request includes the gateway device ID;

[0061] Step 2: The communication server receives the data collection request from the gateway device, and searches for a terminal device ID corresponding to the gateway device ID in the data collection request based on the gateway device ID and the corresponding terminal device ID stored in the communication server. If a corresponding terminal device ID exists, the communication server proceeds to the next step; otherwise, the communication server ends the step.

[0062] Step 3: The communication server determines whether the second receiving time of the data collection request is within the second validity period of the gateway device corresponding to the gateway device ID in the data collection request. If the second receiving time is within the second validity period, proceed to the next step; otherwise, end the step.

[0063] Step 4: The communication server generates and stores a unique access key for the gateway device corresponding to the gateway device ID in the data collection request, and the communication server sends the found terminal device ID and the access key to the corresponding gateway device;

[0064] Step 5: The gateway device sends the received access key to the terminal device corresponding to the terminal device ID;

[0065] Step 6: The terminal device receives the access key and sends the terminal device data, including the data generated by itself and the access key, to the communication server through the gateway device.

[0066] Step 7: The communication server receives the terminal device data and verifies whether the gateway device ID of the gateway device that sent the terminal device data and the access key in the terminal device data are consistent with the gateway device ID and the corresponding access key stored in the communication server. If the two are consistent, the communication server completes collecting data from the terminal device. Otherwise, the step ends.

[0067] Specifically, the inventors have considered that in actual application scenarios, there is often a need for multiple terminal devices to use the same gateway device to send data to the communication server. Therefore, setting a second validity period for the gateway device that has passed security authentication can achieve the above function. For example, the second validity period of the gateway device with a gateway device ID of A for the terminal device with a terminal device ID of 100 is from 8:00am to 9:00am, and the second validity period of the gateway device with a gateway device ID of A for the terminal device with a terminal device ID of 101 is from 9:00am to 10:00am. In addition, a gateway device that has passed security authentication should not be always secure. As time goes by, in order to improve the security of the gateway device, the gateway device should be re-authenticated.

[0068] Based on the gateway device that has passed security authentication, the communication server can collect data from the terminal device through the first step to the seventh step mentioned above, while preventing malicious users from using gateway devices that have not passed security authentication to illegally control the terminal device and causing the leakage of data collected from the terminal device. First, the gateway device sends a data collection request to the communication server. The data collection request can be sent by the gateway device at a fixed time. The communication server searches for a terminal device ID corresponding to the gateway device ID in the data collection request among the previously stored corresponding gateway device IDs and terminal device IDs. The gateway device ID previously stored by the communication server is a gateway device ID corresponding to a gateway device that has passed security authentication. Therefore, a gateway device that has not passed security authentication cannot collect data from the terminal device. Then the communication server determines whether the second reception time for the data collection request is within the gateway device ID corresponding to the gateway device ID in the data collection request. If it is not within the second validity period, it means that the corresponding gateway device has lost its security, that is, the data of the terminal device collected by the corresponding gateway device may also be unsafe. If it is within the second validity period, it means that the data of the terminal device can be collected by relying on the corresponding gateway device. Secondly, when the corresponding gateway device is safe, the communication server generates an access key for it and sends it to its corresponding terminal device ID. At the same time, the corresponding gateway device also sends the access key to the terminal device corresponding to the terminal device ID. Again, the terminal device sends the data and access key generated by itself to the communication server. Finally, the communication server verifies whether the gateway device ID of the gateway device that sends the terminal device data and the access key in the terminal device data are consistent with the access key previously generated by itself for the gateway device. If they are consistent, it means that the identity of the terminal device is safe, that is, the terminal device data is also reliable.

[0069] Furthermore, when the communication server generates an access key for the gateway device, it can also generate an access key for different users of the same gateway device. Thus, different users of the same gateway device can send different terminal device data to the communication server according to their respective data collection rules. For example, user A sends all the data of the terminal device to the communication server, while user B sends the statistical data of the terminal device over a period of time to the communication server.

[0070] References Figure 3 As shown, the present invention also provides a network security authentication system, which is used to implement a network security authentication method as described above. Specifically, the functions of each module are described as follows:

[0071] A communication server, configured to receive a request from a terminal device for a security authentication key, generate a unique security authentication key for the terminal device, and store the security authentication key and a unique gateway device ID of the gateway device that sent the request information in correspondence, and further configured to receive a second authentication request, determine the security of the gateway device, and store the gateway device ID and the corresponding terminal device ID, and further configured to collect data generated by the terminal device through the gateway device;

[0072] A gateway device, used to forward the request information of the terminal device about the security authentication key to the communication server, and send the security authentication key generated by the communication server to the terminal device, and also used to receive the first authentication request sent by the terminal device, and simultaneously generate and send the second authentication request to the communication server, and also used to send the data generated by the terminal device to the communication server;

[0073] The terminal device is used to generate request information about a security authentication key, receive a security authentication key generated by a communication server, and send a first authentication request to a corresponding gateway device, and is also used to send generated data to the communication server via the gateway device.

[0074] It should be understood that, although each step in the flow chart of each embodiment of the present invention is shown in sequence according to the indication of the arrow, these steps are not necessarily performed in sequence according to the order indicated by the arrow. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be performed in other orders. Moreover, at least a portion of the steps in each embodiment may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0075] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The above-mentioned program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0076] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0077] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

[0078] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network security authentication method, characterized in that: The steps include: The communication server and the terminal device share the confirmation data, and the terminal device sends the request information about its security authentication key to the communication server through the gateway device, wherein the request information includes the terminal device ID that can uniquely identify the terminal device and the encryption result of the confirmation data; The communication server receives the terminal device ID and the encryption result of the confirmation data, and verifies the correctness of the confirmation data. If the confirmation data is correct, the communication server generates a unique security authentication key for the terminal device, stores the security authentication key and the unique gateway device ID of the gateway device that sends the request information in a corresponding manner, and sends the security authentication key to the terminal device through the gateway device; The terminal device receives the security authentication key and sends a first authentication request to the corresponding gateway device, where the first authentication request includes the terminal device ID and the corresponding security authentication key; The gateway device receives the first authentication request, and generates a second authentication request based on the first authentication request, wherein the second authentication request includes the gateway device ID, the terminal device ID, and the security authentication key corresponding to the terminal device ID, and the gateway device also sends the second authentication request to the communication server; The communication server receives the second authentication request, and when the security authentication key corresponding to the terminal device ID in the second authentication request is correct, it continues to verify the consistency of the gateway device ID in the second authentication request and the gateway device ID corresponding to the security authentication key in the second authentication request stored by the communication server. When the two are consistent, it is determined that the corresponding gateway device is safe, and the communication server stores the gateway device ID and the corresponding terminal device ID, and notifies the corresponding gateway device and terminal device at the same time.

2. A network security authentication method according to claim 1, characterized in that: The process of the communication server verifying the correctness of the confirmation data comprises the following steps: The communication server and the terminal device respectively store the shared confirmation data, the terminal device encrypts the confirmation data, stores the encryption result of the confirmation data, and sends the encryption result to the communication server through the gateway device; The communication server receives the encryption result, decrypts the encryption result to obtain the confirmation data, compares the decrypted confirmation data with the confirmation data stored in the communication server, and when the two are consistent, determines that the confirmation data sent by the terminal device is correct, and stores the encryption result; The communication server and the terminal device respectively update the encryption result of this time to the new confirmation data, which will be used when the terminal device sends the request information to the communication server next time.

3. A network security authentication method according to claim 1, characterized in that: After the communication server generates a unique security authentication key for the terminal device, the process also includes setting a first validity period for the security authentication key.

4. A network security authentication method according to claim 1, characterized in that: The communication server determines that the gateway device is safe, and after storing the gateway device ID and the corresponding terminal device ID, it also includes setting a second validity period for the gateway device.

5. A network security authentication method according to claim 3, characterized in that: After the communication server verifies that the security authentication key corresponding to the terminal device ID in the second authentication request is correct, the following steps are also included: The communication server checks whether a first reception time of the second authentication request is within the first validity period of the security authentication key in the second authentication request; When the first receiving time is within the first validity period, the consistency of the gateway device ID in the second authentication request and the gateway device ID corresponding to the security authentication key in the second authentication request stored by the communication server is continued to be verified; when the first receiving time is not within the first validity period, the communication server determines that the corresponding gateway device is unsafe; The terminal device resends the request information to the communication server to obtain the new security authentication key.

6. A network security authentication method according to claim 4, characterized in that: The communication server collects data generated by the terminal device through the gateway device, including the following steps: The gateway device sends a data collection request to the communication server, wherein the data collection request includes the gateway device ID; The communication server receives the data collection request from the gateway device, and searches for a terminal device ID corresponding to the gateway device ID in the data collection request based on the gateway device ID and the corresponding terminal device ID stored in the communication server, and when the corresponding terminal device ID exists, proceeds to the next step, otherwise, ends the step; The communication server determines whether the second reception time of the data collection request is within the second validity period of the gateway device corresponding to the gateway device ID in the data collection request, and when the second reception time is within the second validity period, proceeds to the next step, otherwise, ends the step; The communication server generates and stores a unique access key for the gateway device corresponding to the gateway device ID in the data collection request, and the communication server sends the found terminal device ID and the access key to the corresponding gateway device; The gateway device sends the received access key to the terminal device corresponding to the terminal device ID; The terminal device receives the access key and sends the terminal device data, including the data generated by itself and the access key, to the communication server through the gateway device; The communication server receives the terminal device data and verifies whether the gateway device ID of the gateway device that sends the terminal device data and the access key in the terminal device data are consistent with the gateway device ID and the corresponding access key stored in itself. If the two are consistent, the communication server completes collecting data from the terminal device, otherwise, the step ends.

7. A network security authentication system, used to implement the method according to any one of claims 1 to 6, characterized in that: Includes the following modules: A communication server, configured to receive a request from a terminal device for a security authentication key, generate a unique security authentication key for the terminal device, and store the security authentication key and a unique gateway device ID of the gateway device that sent the request information in correspondence, and further configured to receive a second authentication request, determine the security of the gateway device, and store the gateway device ID and the corresponding terminal device ID, and further configured to collect data generated by the terminal device through the gateway device; A gateway device, used to forward the request information of the terminal device about the security authentication key to the communication server, and send the security authentication key generated by the communication server to the terminal device, and also used to receive the first authentication request sent by the terminal device, and simultaneously generate and send the second authentication request to the communication server, and also used to send the data generated by the terminal device to the communication server; The terminal device is used to generate request information about a security authentication key, receive a security authentication key generated by a communication server, and send a first authentication request to a corresponding gateway device, and is also used to send generated data to the communication server via the gateway device.

Images