Authentication method and device for terminal equipment

Abstract

The embodiment of the disclosure discloses a terminal device authentication method and device, wherein the method comprises: in response to a user triggered authentication request, obtaining an identifier ID of the terminal device; sending an authentication request carrying the identifier ID to a server through a switch, so that the server returns terminal authentication data in response to the authentication request; receiving an authentication challenge sent by the switch, wherein the authentication challenge is encrypted data generated by encrypting a random number through the terminal authentication data and the identifier ID; sending a challenge response in response to the authentication challenge to the switch, so that the switch authenticates the terminal device according to the challenge response, wherein the challenge response is generated by the encrypted private key of the terminal device. The method solves the illegal behavior of illegal access of the terminal device, realizes the anti-repudiation of the terminal device authentication, and facilitates the efficient authentication and safe management and control of the terminal device by the enterprise.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of data processing, and particularly relates to a terminal device authentication method and device. BACKGROUND

[0002] With the rapid development of the Internet, more and more users pay attention to the use safety of the network. In the existing network of an enterprise, terminal devices access the network generally based on a username and password for identity authentication.

[0003] However, the current terminal device identity authentication method based on the username and password has many defects. For example, different terminal devices can complete authentication using the same username and password, and different IP addresses of the same terminal device can also complete authentication using the same username and password, that is, the username and password have a many-to-one relationship with the device and the IP address. When performing security analysis on the terminal device, it is difficult to quickly and accurately locate the unique terminal device source.

[0004] Therefore, the authentication method for the terminal device in the related art has a large configuration workload and low efficiency, and there is an urgent need for a way of efficiently authenticating the terminal device based on the unique identifier of the terminal device to strengthen the security management and control of the network access device of the enterprise. SUMMARY

[0005] Therefore, the authentication method for the terminal device in the related art has a large configuration workload and low efficiency, and there is an urgent need for a way of efficiently authenticating the terminal device based on the unique identifier of the terminal device to strengthen the security management and control of the network access device of the enterprise.

[0006] In a first aspect, an embodiment of the present disclosure provides an authentication method for a terminal device, which comprises the following steps.

[0007] In response to an authentication request triggered by a user, an identifier ID of the terminal device is obtained, wherein the identifier ID is used to uniquely identify the terminal device triggering the authentication request.

[0008] An authentication request carrying the identifier ID is sent to a server through a switch, so that the server returns terminal authentication data in response to the authentication request.

[0009] An authentication challenge sent by the switch is received, wherein the authentication challenge is encrypted data generated by encrypting a random number through the terminal authentication data and the identifier ID.

[0010] A challenge response in response to the authentication challenge is sent to the switch, so that the switch authenticates the terminal device according to the challenge response, wherein the challenge response is generated by an encryption private key of the terminal device.

[0011] In some embodiments, the challenge response responsive to the authentication challenge is sent to the switch so that the switch authenticates the terminal device according to the challenge response, comprising:

[0012] The encrypted data in the authentication challenge is decrypted by the built-in encryption private key and the identification ID to obtain a decrypted random number;

[0013] The decrypted random number is sent to the switch so that the switch verifies the terminal device according to the decrypted random number.

[0014] In some embodiments, the terminal authentication data is an encrypted master public key pre-stored on the server, the encrypted master public key is generated based on an encrypted master private key and a random number; the encryption private key is generated based on the encrypted master private key and the identification ID, and is built into the terminal authentication device.

[0015] In some embodiments, the method further comprises:

[0016] When the terminal device authentication is successful, the identification ID and the terminal MAC address are automatically bound by the switch, the terminal device is allowed to access the network, and the packet of the terminal MAC address is normally forwarded;

[0017] When the terminal device authentication fails, the terminal device is rejected to access the network by the switch, and the packet of the terminal device is prohibited to be forwarded.

[0018] In some embodiments, when the terminal device authentication is successful or fails, the terminal device is periodically authenticated by the switch according to a preset period.

[0019] In some embodiments, the encryption operation of the terminal authentication data and the decryption operation of the encrypted data are performed based on the SM9 asymmetric encryption and decryption algorithm.

[0020] In a second aspect, the embodiments of the present disclosure further provide a terminal device authentication method, comprising:

[0021] In response to an authentication request sent by a terminal authentication device on a terminal device, an identification ID for uniquely identifying a terminal device triggering the authentication request carried in the authentication request is acquired;

[0022] sending terminal authentication data corresponding to the identity ID to a switch, so that the switch sends encrypted data generated by encrypting a random number with the terminal authentication data and the identity ID as an authentication challenge to the terminal device, the terminal device sends a challenge response responsive to the authentication challenge to the switch, so that the switch authenticates the terminal device according to the challenge response, wherein the challenge response is generated by an encryption private key of the terminal device.

[0023] In some embodiments, the encryption operation of the terminal authentication data is performed based on an SM9 asymmetric encryption and decryption algorithm, and the decryption operation of the encrypted data is performed.

[0024] In a third aspect, the embodiments of the present disclosure further provide an authentication device of a terminal device, which comprises:

[0025] A first obtaining module configured to obtain an identity ID of the terminal device in response to an authentication request triggered by a user, wherein the identity ID is used to uniquely identify the terminal device triggering the authentication request;

[0026] A sending module configured to send the authentication request carrying the identity ID to a server through a switch, so that the server returns terminal authentication data responsive to the authentication request;

[0027] A receiving module configured to receive an authentication challenge sent by the switch, wherein the authentication challenge is encrypted data generated by encrypting a random number with the terminal authentication data and the identity ID;

[0028] A first authentication module configured to send a challenge response responsive to the authentication challenge to the switch, so that the switch authenticates the terminal device according to the challenge response, wherein the challenge response is generated by an encryption private key of the terminal device.

[0029] In a fourth aspect, the embodiments of the present disclosure further provide an authentication device of a terminal device, which comprises:

[0030] A second obtaining module configured to obtain an identity ID carried in an authentication request sent by a terminal authentication device on a terminal device, wherein the identity ID is used to uniquely identify the terminal device triggering the authentication request in response to the authentication request sent by the terminal authentication device on the terminal device;

[0031] a second authentication module configured to send terminal authentication data corresponding to the identification ID to a switch, so that the switch sends encrypted data generated by encrypting a random number with the terminal authentication data and the identification ID as an authentication challenge to the terminal device, the terminal device sends a challenge response responsive to the authentication challenge to the switch, so that the switch authenticates the terminal device according to the challenge response, wherein the challenge response is generated by an encryption private key of the terminal device.

[0032] In a fifth aspect, the embodiments of the present disclosure further provide an electronic device, which adopts the technical scheme as follows:

[0033] The electronic device comprises:

[0034] at least one processor; and

[0035] a memory in communication connection with the at least one processor; wherein

[0036] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the authentication method of the terminal device as described in any one of the above.

[0037] In a sixth aspect, the embodiments of the present disclosure further provide a computer readable storage medium storing computer instructions for causing a computer to execute the authentication method of the terminal device as described in any one of the above.

[0038] The authentication method and device of the terminal device provided by the embodiments of the present disclosure comprise: in response to an authentication request triggered by a user, obtaining an identification ID of a terminal device, wherein the identification ID is used to uniquely identify the terminal device triggering the authentication request; sending an authentication request carrying the identification ID to a server through a switch, so that the server returns terminal authentication data responsive to the authentication request; receiving an authentication challenge sent by the switch, wherein the authentication challenge is encrypted data generated by encrypting a random number with the terminal authentication data and the identification ID; sending a challenge response responsive to the authentication challenge to the switch, so that the switch authenticates the terminal device according to the challenge response, wherein the challenge response is generated by an encryption private key of the terminal device.

[0039] The embodiments of the present disclosure can quickly and efficiently accurately locate and authenticate the terminal device according to the unique identification ID of the terminal device, and through the encryption of the terminal authentication data and the identification ID and the decryption of the encrypted data by the encryption private key, the illegal access of the terminal device is solved, the anti-repudiation of the terminal device authentication is realized, so as to facilitate the efficient authentication and safe management and control of the terminal device by enterprises.

[0040] The above description is merely an overview of the technical solution disclosed herein. In order to better understand the technical means of this disclosure and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0041] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 A schematic flowchart illustrating an authentication method for a terminal device provided in this embodiment of the disclosure;

[0043] Figure 2 A topology diagram of the authentication device for a terminal device provided in this embodiment of the disclosure;

[0044] Figure 3 An interactive schematic diagram of an authentication method for a terminal device provided in an embodiment of this disclosure;

[0045] Figure 4 This is a schematic diagram of the structure of an authentication device for a terminal device provided in an embodiment of the present disclosure;

[0046] Figure 5 This is a schematic block diagram of an electronic device provided in an embodiment of the present disclosure. Detailed Implementation

[0047] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0048] It should be understood that the following specific examples illustrate the implementation of this disclosure, and those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0049] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0050] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0051] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0052] like Figure 1 As shown, this disclosure provides an authentication method for a terminal device, which can be applied to a terminal authentication device of the terminal device. The method includes:

[0053] S101. The terminal authentication device of the terminal device responds to the authentication request triggered by the user and obtains the identifier ID of the terminal device, wherein the identifier ID is used to uniquely identify the terminal device that triggered the authentication request.

[0054] The terminal authentication device installed on the terminal device is the client software. The client software embeds security function modules, such as a password module and an authentication interaction module. For dumb terminal devices, an encryption chip and client software for device authentication are embedded during device manufacturing.

[0055] S102. The terminal authentication device sends an authentication request carrying an identifier ID to the server through the switch, so that the server returns terminal authentication data in response to the authentication request.

[0056] The switch has embedded security function modules required for device authentication, such as a cryptographic module and an authentication interaction module. This application uses the switch with embedded security function modules, server-side management platform software, and client software to implement authentication and network access based on the unique identity of the terminal device, and to achieve non-repudiation of the terminal device identity authentication.

[0057] S103. The terminal authentication device receives the authentication challenge sent by the switch. The authentication challenge is encrypted data generated by encrypting the terminal authentication data and the identifier ID into a random number.

[0058] In some embodiments, the terminal authentication data is a pre-stored encrypted master public key on the server, which is generated based on the encrypted master private key and a random number; the encrypted private key is generated based on the encrypted master private key and an identifier ID, and is built into the terminal authentication device.

[0059] S104. The terminal authentication device sends a challenge response to the authentication challenge to the switch so that the switch can authenticate the terminal device based on the challenge response. The challenge response is generated using the terminal device's encrypted private key.

[0060] This disclosed embodiment can quickly and efficiently locate and authenticate terminal devices based on their unique identifier ID. By encrypting the terminal authentication data and the identifier ID, and decrypting the encrypted data using a private key, it solves the problem of unauthorized access by terminal devices and achieves non-repudiation of terminal device authentication, thus enabling enterprises to efficiently authenticate and securely manage terminal devices.

[0061] During the terminal device authentication process, the switch needs to request relevant information (terminal authentication data, i.e., encrypted master public key) from the server-side management platform software, and after the terminal device is successfully authenticated, it reports the terminal asset information of the terminal device to the server-side management platform software.

[0062] If the terminal device is successfully authenticated, the switch opens network communication and allows the terminal device to communicate; otherwise, if the terminal device fails to authenticate, the switch refuses to allow the terminal device to communicate.

[0063] In some embodiments, the terminal authentication device sends a challenge response in response to the authentication challenge to the switch, so that the switch can authenticate the terminal device based on the challenge response, including:

[0064] The terminal authentication device decrypts the encrypted data in the authentication challenge using its built-in encryption private key and identifier ID, and obtains a decrypted random number.

[0065] The terminal authentication device sends the decrypted random number to the switch so that the switch can verify the terminal device based on the decrypted random number.

[0066] In some embodiments, the method further includes: after the terminal device is successfully authenticated, automatically binding the identifier ID and the terminal MAC address through the switch, allowing the terminal device to access the network, and normally forwarding the packets of the terminal MAC address;

[0067] When a terminal device fails to authenticate, the switch will refuse the terminal device access to the network and prohibit the forwarding of the terminal device's packets.

[0068] In some embodiments, after successful or failed authentication of the terminal device, the switch performs periodic authentication of the terminal device according to a preset cycle. For example, after a failed authentication, the terminal device can be re-authenticated every 30 seconds; after successful authentication, the terminal device can be re-authenticated every 30 seconds to ensure the legitimacy of the terminal device throughout its lifecycle. The cycle time can be set according to actual needs, and this embodiment does not limit it.

[0069] In some embodiments, the encrypted master public key on the switch and the ID representation of the terminal device can be imported through the switch's web interface and stored locally on the switch.

[0070] In some embodiments, the switch performs encryption operations on terminal authentication data based on the SM9 asymmetric encryption and decryption algorithm, and the terminal authentication device performs decryption operations on the encrypted data based on the SM9 asymmetric encryption and decryption algorithm. The embodiments of this disclosure, performing encryption and decryption operations based on the SM9 asymmetric encryption and decryption algorithm, can achieve identity authentication and non-repudiation of the terminal device.

[0071] This disclosure also provides an authentication method for a terminal device, which is applied to a server, and the method includes:

[0072] The server responds to the authentication request sent by the terminal authentication device on the terminal device to obtain the identifier ID carried in the authentication request, which is used to uniquely identify the terminal device that triggered the authentication request.

[0073] The server sends terminal authentication data corresponding to the identifier ID to the switch. The switch then sends encrypted data, generated by encrypting a random number using the terminal authentication data and the identifier ID, as an authentication challenge to the terminal device. The terminal device sends a challenge response to the authentication challenge to the switch, so that the switch can authenticate the terminal device based on the challenge response. The challenge response is generated using the terminal device's encrypted private key.

[0074] like Figure 2The diagram shows the topology of the authentication device for a terminal device provided in this embodiment. Multiple switches can be configured, each capable of communicating with multiple groups of terminal devices. The switches communicate with the management platform software of the terminal devices. The unique identifier (ID) and public key of each terminal device are stored in the management platform software and client software, respectively; the private key of each terminal device is stored in the client software. During the authentication process, the switch requests the private key of the terminal device from the management platform software, encrypts the authentication message using the public key and the identifier (ID), and the client software installed on the terminal device decrypts the message using the private key. The decrypted message is then sent back to the switch for verification, ultimately completing the authentication and network access for the terminal device.

[0075] According to the unified requirements of the enterprise, the unique identifier (ID) of each terminal device joining the network can be stored in the management platform software. For each terminal device joining the network, the key generation center generates a private encryption key using the master private key and the terminal device's identifier. The master public key is generated by combining the master private key with a random number (system parameter). The master public key is publicly available and stored in the management platform software. The terminal device's identifier and its master public key or private key are entered into the client software during the terminal device's manufacturing process. The SM9 asymmetric encryption / decryption algorithm is used for authentication and network access control of terminal devices in the network. Before a terminal device receives access control from the switch, it cannot access the network through the switch. Before a terminal device is authenticated, the switch does not forward any packets from that terminal device.

[0076] In some embodiments, all network ports of the switch have access control to ensure that unauthorized terminal devices cannot access the network by switching physical ports.

[0077] like Figure 3 The diagram shown is an interactive schematic of the authentication method for a terminal device provided in this embodiment of the present disclosure:

[0078] 1. The terminal authentication device (client software) sends a message carrying the identifier ID of the terminal device to the switch;

[0079] 2. The switch determines whether the terminal device's identifier ID is cached locally. If not, the switch requests the terminal authentication data (i.e., the encrypted master public key) from the management platform software.

[0080] 3. The management platform software verifies whether the terminal device's identifier ID is valid. If the identifier ID is valid, it sends the encrypted master public key to the switch.

[0081] 4. The switch encrypts a random number using the encryption master public key and the terminal device's identifier ID, and sends it to the terminal device;

[0082] 5. The terminal device uses its decryption private key and identifier ID to decrypt the data and sends the decrypted random number to the switch;

[0083] 6. The switch verifies the decrypted random number to confirm whether the terminal device has been successfully authenticated;

[0084] 7. After successful authentication of the terminal device, the switch will automatically bind the terminal device's identifier ID and terminal MAC address, and allow the normal forwarding of packets from the corresponding source MAC address.

[0085] 8. If the terminal device fails to authenticate, it can wait for the HoldTime (default 30 seconds, which can be adjusted and set according to the actual situation) before trying to authenticate the terminal device again.

[0086] Optionally, periodic authentication of terminal devices can also be performed. After a terminal device is granted access, the switch can periodically (default 30 seconds, which can be adjusted and set according to actual conditions) launch authentication challenges against the terminal device to ensure the legitimacy of the terminal device throughout its life cycle.

[0087] This disclosure addresses the issue of unique identification of terminal devices, whereby an enterprise uniquely identifies each terminal device with its ID; it also addresses the issue of authentication based on a unique identity, using the unique ID during the authentication process; the public key encryption, private key decryption, and asymmetric key of the terminal device resolve the issue of authentication repudiation; and it addresses the issue of unauthorized access by terminal devices. After a terminal device connects, the switch enables authentication, using the SM9 algorithm for authentication interaction. Legitimate terminal devices successfully authenticate and are allowed network communication, while unauthorized terminal devices without an identity or with a forged identity fail to complete authentication and are prohibited from network communication.

[0088] like Figure 4 As shown, an authentication device for a terminal device is provided in an embodiment of this disclosure. This device is integrated into the terminal authentication device of the terminal device. The system includes:

[0089] The first acquisition module 41 is configured to acquire the identifier ID of the terminal device in response to an authentication request triggered by the user, wherein the identifier ID is used to uniquely identify the terminal device that triggered the authentication request;

[0090] Sending module 42 is configured to send an authentication request carrying an identifier ID to the server via a switch, so that the server returns terminal authentication data in response to the authentication request;

[0091] The receiving module 43 is configured to receive the authentication challenge sent by the switch, wherein the authentication challenge is encrypted data generated by encrypting a random number using terminal authentication data and identifier ID;

[0092] The first authentication module 44 is configured to send a challenge response in response to the authentication challenge to the switch, so that the switch can authenticate the terminal device based on the challenge response, wherein the challenge response is generated using the encrypted private key of the terminal device.

[0093] This disclosure also provides an authentication device for a terminal device, which is integrated into a server. The system includes:

[0094] The second acquisition module is configured to respond to an authentication request sent by a terminal authentication device on a terminal device to acquire the identifier ID carried in the authentication request to uniquely identify the terminal device that triggered the authentication request.

[0095] The second authentication module is configured to send terminal authentication data corresponding to the identifier ID to the switch. The switch then sends encrypted data generated by encrypting a random number using the terminal authentication data and the identifier ID as an authentication challenge to the terminal device. The terminal device sends a challenge response to the authentication challenge to the switch, so that the switch can authenticate the terminal device based on the challenge response. The challenge response is generated using the terminal device's encrypted private key.

[0096] An electronic device according to embodiments of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory. The non-volatile memory may, for example, include read-only memory (ROM), a hard disk, flash memory, etc.

[0097] The processor may be a central processing unit (CPU) or other processing unit with data processing and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions. In one embodiment of this disclosure, the processor is used to execute computer-readable instructions stored in the memory, causing the electronic device to perform all or part of the steps of the authentication methods of the terminal devices described in the foregoing embodiments of this disclosure.

[0098] Those skilled in the art will understand that, in order to solve the technical problem of how to achieve a good user experience, this embodiment may also include well-known structures such as communication buses and interfaces, and these well-known structures should also be included within the protection scope of this disclosure.

[0099] like Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. It illustrates a structural schematic diagram suitable for implementing the electronic device in the embodiment of the present disclosure. Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0100] like Figure 5 As shown, an electronic device may include a processing unit (such as a central processing unit, graphics processing unit, etc.) that can perform various appropriate actions and processes based on a program stored in read-only memory (ROM) or a program loaded from a storage device into random access memory (RAM). The RAM also stores various programs and data required for the operation of the electronic device. The processing unit, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0101] Typically, the following devices can be connected to the I / O interface: input devices, such as sensors or visual information acquisition devices; output devices, such as displays; storage devices, such as magnetic tapes or hard drives; and communication devices. Communication devices allow electronic devices to communicate wirelessly or wiredly with other devices (such as edge computing devices) to exchange data. Although Figure 5 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0102] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, all or part of the steps of the authentication method for a terminal device according to embodiments of this disclosure are performed.

[0103] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0104] A computer-readable storage medium according to embodiments of the present disclosure stores non-transitory computer-readable instructions. When the non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the authentication methods of the terminal devices described in the foregoing embodiments of the present disclosure are performed.

[0105] The aforementioned computer-readable storage media include, but are not limited to: optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or portable hard drive), media with built-in rewritable non-volatile memory (e.g., memory card), and media with built-in ROM (e.g., ROM cartridge).

[0106] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0107] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0108] In this disclosure, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of devices, apparatuses, devices, and systems involved in this disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as "comprising," "including," "having," etc., are open-ended terms meaning "including but not limited to," and are used interchangeably with them. The terms "or" and "and" as used herein refer to the terms "and / or," and are used interchangeably with them unless the context clearly indicates otherwise. The term "such as" as used herein refers to the phrase "such as but not limited to," and is used interchangeably with it.

[0109] Additionally, as used herein, the “or” used in a list of items beginning with “at least one” indicates a separate list, such that a list of, for example, “at least one of A, B, or C” means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word “exemplary” does not imply that the described example is preferred or better than other examples.

[0110] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0111] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0112] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0113] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. An authentication method for a terminal device, characterized in that, The method includes: In response to an authentication request triggered by a user, the identifier ID of the terminal device is obtained, wherein the identifier ID is used to uniquely identify the terminal device that triggered the authentication request; An authentication request carrying the identifier ID is sent to the server via a switch, so that the server returns terminal authentication data in response to the authentication request. Receive the authentication challenge sent by the switch, wherein the authentication challenge is encrypted data generated by encrypting a random number using the terminal authentication data and the identifier ID; A challenge response to the authentication challenge is sent to a switch so that the switch can authenticate the terminal device based on the challenge response, wherein the challenge response is generated using the terminal device's encrypted private key; Sending a challenge response to the authentication challenge to the switch, so that the switch can authenticate the terminal device based on the challenge response, includes: The encrypted data in the authentication challenge is decrypted using the built-in encryption private key and the identifier ID to obtain a decrypted random number; The decrypted random number is sent to the switch so that the switch can verify the terminal device based on the decrypted random number; The terminal authentication data is a pre-stored encrypted master public key on the server, which is generated based on the encrypted master private key and a random number; the encrypted private key is generated based on the encrypted master private key and an identifier ID, and is built into the terminal authentication device.

2. The authentication method for terminal devices according to claim 1, characterized in that, The method further includes: Once the terminal device is successfully authenticated, the switch automatically binds the identifier ID and the terminal MAC address, allowing the terminal device to access the network and forwarding packets with the terminal MAC address normally. When the terminal device fails to authenticate, the switch will refuse the terminal device access to the network and prohibit the forwarding of the terminal device's packets.

3. The authentication method for terminal devices according to claim 2, characterized in that, When the terminal device is successfully or unsuccessfully authenticated, the switch performs periodic authentication on the terminal device according to a preset cycle.

4. The authentication method for a terminal device according to any one of claims 1 to 3, characterized in that, The terminal authentication data is encrypted using the SM9 asymmetric encryption and decryption algorithm, and the encrypted data is decrypted.

5. An authentication device for a terminal device, characterized in that, The device includes: The first acquisition module is configured to acquire the identifier ID of the terminal device in response to an authentication request triggered by a user, wherein the identifier ID is used to uniquely identify the terminal device that triggered the authentication request; The sending module is configured to send an authentication request carrying the identifier ID to the server via a switch, so that the server returns terminal authentication data in response to the authentication request. The receiving module is configured to receive the authentication challenge sent by the switch, wherein the authentication challenge is encrypted data generated by encrypting a random number using the terminal authentication data and the identifier ID; The first authentication module is configured to send a challenge response in response to the authentication challenge to a switch, so that the switch can authenticate the terminal device based on the challenge response, wherein the challenge response is generated using the encrypted private key of the terminal device; Sending a challenge response to the authentication challenge to the switch, so that the switch can authenticate the terminal device based on the challenge response, includes: The encrypted data in the authentication challenge is decrypted using the built-in encryption private key and the identifier ID to obtain a decrypted random number; The decrypted random number is sent to the switch so that the switch can verify the terminal device based on the decrypted random number; The terminal authentication data is a pre-stored encrypted master public key on the server, which is generated based on the encrypted master private key and a random number; the encrypted private key is generated based on the encrypted master private key and an identifier ID, and is built into the terminal authentication device.

Images