Communication authentication method and system

Abstract

The embodiments of this specification provide a communication authentication method and system, wherein the communication authentication method is applied to a communication authentication system, the communication authentication system includes a communication terminal and a programmable computing device, the communication terminal and the programmable computing device have the same key generation strategy, including: creating a first key in the programmable computing device according to the key generation strategy and the information to be authenticated embedded in the programming file, the information to be authenticated is embedded in the programming file by the communication terminal, the information to be authenticated is encrypted into an authentication report based on the first key, and sent to the communication terminal; the authentication report is decrypted by the communication terminal based on a preset second key to obtain report information, wherein the second key is created according to the key generation strategy and the information to be authenticated, and when the comparison result of the report information and the information to be authenticated is the same, a communication relationship between the communication terminal and the programmable computing device is established. It is realized that whether the programming file is securely and reliably loaded into the programmable computing device before communication is verified.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and in particular, to a communication authentication method and system. Background Art

[0002] With the development of Internet technology, the demand for computing power of various services by various enterprises has increased rapidly. In order to improve computing power, more and more services use programmable computing devices to improve computing performance. However, the existing programmable computing device usage scenarios are all in safe and reliable scenarios by default. Therefore, there is a lack of communication authentication for the programming files from the programmable computing devices, and it is impossible to determine whether the programming files of the programmable computing devices are safely and reliably loaded into the programmable computing devices. Therefore, it is urgent to provide a solution that effectively solves the above problems. Summary of the invention

[0003] In view of this, an embodiment of this specification provides a communication authentication method. One or more embodiments of this specification also involve a communication method, two communication authentication systems, a communication system, a computing device, a computer-readable storage medium and a computer program to solve the technical defects existing in the prior art.

[0004] According to a first aspect of an embodiment of this specification, a communication authentication method is provided, which is applied to a communication authentication system, wherein the communication authentication system includes a programmable computing device and a communication terminal, wherein the communication terminal has the same key generation strategy as the programmable computing device, and includes:

[0005] Creating a first key in the programmable computing device according to the key generation strategy and the information to be authenticated embedded in the programming file, wherein the information to be authenticated is embedded in the programming file by the communication terminal;

[0006] Encrypting the information to be authenticated into an authentication report based on the first key, and sending the authentication report to the communication terminal;

[0007] Decrypting the authentication report by the communication terminal based on a preset second key to obtain report information, wherein the second key is created according to the key generation strategy and the information to be authenticated;

[0008] When the comparison result between the report information and the information to be authenticated is the same, a communication relationship between the communication terminal and the programmable computing device is established.

[0009] According to a second aspect of an embodiment of this specification, a communication method is provided, which is applied to a communication system, wherein the communication system includes a communication terminal and a programmable computing device having a communication authentication relationship, and the communication terminal and the programmable computing device have the same key generation strategy, including:

[0010] Encrypting application data of the application program based on the first key in the communication terminal to generate encrypted data, and sending the encrypted data to the programmable computing device;

[0011] Receiving the encrypted data through the programmable computing device, and decrypting the encrypted data through a second key to obtain the application data, wherein the first key and the second key are created based on the key generation strategy;

[0012] The programmable computing device processes the application data and returns the processing result to the communication end.

[0013] According to a third aspect of an embodiment of this specification, a communication authentication system is provided, including:

[0014] A programmable computing device and a communication terminal, wherein the communication terminal and the programmable computing device have the same key generation strategy;

[0015] The programmable computing device creates a first key according to the key generation strategy and the information to be authenticated embedded in the programming file, wherein the information to be authenticated is embedded in the programming file by the communication terminal, encrypts the information to be authenticated into an authentication report based on the first key, and sends the authentication report to the communication terminal;

[0016] The communication terminal decrypts the authentication report based on a preset second key to obtain report information, wherein the second key is created according to the key generation strategy and the information to be authenticated, and establishes a communication relationship between the communication terminal and the programmable computing device when the comparison result between the report information and the information to be authenticated is the same.

[0017] According to a fourth aspect of the embodiments of this specification, another communication authentication system is provided, including:

[0018] Programmable computing devices and communication terminals;

[0019] The communication terminal has the same key generation strategy as the programmable computing device. The programmable computing device is used to store a provision executable instruction for communication authentication, and the communication terminal is used to store an authentication executable instruction for communication authentication. When the provision executable instruction is executed by the programmable computing device and the authentication executable instruction is executed by the communication terminal, the steps of the above-mentioned communication authentication method are implemented.

[0020] According to a fifth aspect of the embodiments of this specification, a communication system is provided, including:

[0021] A communication terminal and a programmable computing device having a communication authentication relationship;

[0022] The communication end has the same key generation strategy as the programmable computing device. The communication end is used to store the sending executable instructions of the communication, and the programmable computing device is used to store the receiving executable instructions of the communication. When the sending executable instructions are executed by the communication end and the receiving executable instructions are executed by the programmable computing device, the steps of the above-mentioned communication method are implemented.

[0023] According to a sixth aspect of an embodiment of this specification, a computing device is provided, including:

[0024] Memory and processor;

[0025] The memory is used to store computer-executable instructions, and the processor is used to implement any of the above-mentioned communication authentication methods or steps of the communication method when executing the computer-executable instructions.

[0026] According to a seventh aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the above-mentioned communication authentication method or the steps of the communication method are implemented.

[0027] According to an eighth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned communication authentication method or communication method.

[0028] The communication authentication method provided in this embodiment is applied to a communication authentication system, wherein the communication authentication system includes a programmable computing device and a communication terminal, wherein the communication terminal has the same key generation strategy as the programmable computing device, and in order to ensure that the programming file of the programmable computing device has not been replaced or tampered with before the communication terminal and the programmable computing device communicate, the communication terminal can implant the information to be authenticated in the programming file of the programmable computing device, so that the communication terminal and the programmable computing device can unify the information to be authenticated in advance. After the programming file implanting the information to be authenticated is configured in the programmable computing device, a first key is created in the programmable computing device based on the key generation strategy and the information to be authenticated implanted in the programming file, and the information to be authenticated is encrypted into an authentication report based on the first key, and sent to the communication terminal, so that the programmable computing device provides an authentication report based on the information to be authenticated. Then, a second key is created in the communication terminal according to the key generation strategy and the information to be authenticated, and the authentication report is decrypted based on the second key to obtain the report information. When the comparison result between the report information and the information to be authenticated is the same, a communication relationship is established between the communication terminal and the programmable computing device, thereby realizing the verification of the authentication report provided by the programmable computing device by the communication terminal, so that the communication terminal can verify whether the programming file is securely and reliably loaded into the programmable computing device before communication, and on this basis, provides security for subsequent data communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is an application diagram of a communication authentication method provided by an embodiment of this specification;

[0030] Figure 2 is a flow chart of a communication authentication method provided by an embodiment of this specification;

[0031] Figure 3 It is a structural block diagram of an extended FPGA logic in a communication authentication method provided in one embodiment of this specification;

[0032] Figure 4 is a flow chart of a communication method provided by an embodiment of this specification;

[0033] Figure 5 It is an interactive schematic diagram of a communication authentication method provided by an embodiment of this specification;

[0034] Figure 6 It is a structural diagram of a communication authentication system provided by an embodiment of this specification;

[0035] Figure 7 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0036] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0037] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0038] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0039] First, the terms involved in one or more embodiments of this specification are explained.

[0040] FPGA (Field Programmable Gate Array) is a semi-customized circuit in application-specific integrated circuits. It is a programmable logic array that can effectively solve the problem of the small number of gate circuits in the original device.

[0041] Bitstream file: FPGA programming file used to describe the hardware logic to be implemented on the FPGA.

[0042] Nonce (Number used once, a non-repeating random value used once): In cryptography, Nonce is an arbitrary or non-repeating random value that is used only once.

[0043] Bitstream encryption: A symmetric key (device key) is pre-burned into the FPGA. The bitstream file can be directly written into the FPGA after being encrypted with the key. The FPGA will use the symmetric key to decrypt the ciphertext bitstream file and load it into the FPGA. The key and decryption process are transparent to the outside and cannot be interfered with.

[0044] Bitstream manipulation: A capability included in FPGA vendor open source tools that allows incremental modification of bitstream files without knowing the source code.

[0045] BRAM: FPGA on-chip storage, implemented inside the chip and cannot be read through an external interface.

[0046] TEE (trusted execution environment): protects the code and data within it from being leaked or maliciously tampered with by providing a secure execution environment isolated from the outside world.

[0047] Virtual machine: refers to a complete computer system that is simulated by software and has complete hardware system functions and runs in a completely isolated environment. It simulates its own complete set of hardware, including CPU, memory, network interface and storage. Through software called virtual machine program, users can separate the machine's resources from the hardware and make appropriate provisions for use by the virtual machine.

[0048] Host: A physical machine equipped with a virtual machine program is called a host machine, host computer, host operating system, or simply a host. The many virtual machines that use its resources are called virtual clients, virtual client computers, virtual client operating systems, or simply virtual clients. The virtual machine program treats computing resources (such as CPU, memory, and storage) as a set of resources that can be reallocated between existing virtual clients or to new virtual machines.

[0049] In this specification, a communication authentication method is provided. This specification also involves a communication method, two communication authentication systems, a communication system, a computing device, a computer-readable storage medium and a computer program, which are described in detail one by one in the following embodiments.

[0050] See also Figure 1As shown in the schematic diagram, the communication authentication method provided in this embodiment is applied to a communication authentication system, which includes a programmable computing device and a communication terminal, and the communication terminal has the same key generation strategy as the programmable computing device; on this basis, in order to ensure that the programming file of the programmable computing device has not been replaced or tampered with before the programmable computing device and the communication terminal communicate, the communication terminal can implant the information to be authenticated in the programming file of the programmable computing device, so that the programmable computing device and the communication terminal can unify the information to be authenticated in advance. After the programming file implanted with the information to be authenticated is configured to the programmable computing device, a first key is created in the programmable computing device based on the key generation strategy and the information to be authenticated implanted in the programming file, and the information to be authenticated is encrypted into an authentication report based on the first key, and sent to the communication terminal, so that the programmable computing device provides an authentication report based on the information to be authenticated. Then, a second key is created in the communication terminal according to the key generation strategy and the information to be authenticated, and the authentication report is decrypted based on the second key to obtain the report information. When the comparison result between the report information and the information to be authenticated is the same, a communication relationship is established between the communication terminal and the programmable computing device, thereby realizing the verification of the authentication report provided by the programmable computing device by the communication terminal, so that the communication terminal can verify whether the programming file is securely and reliably loaded into the programmable computing device before communication, and on this basis, provides security for subsequent data communications.

[0051] Figure 2 A flow chart of a communication authentication method provided according to an embodiment of the present specification is shown. The communication authentication method is applied to a communication authentication system, wherein the communication authentication system includes a programmable computing device and a communication terminal, wherein the communication terminal has the same key generation strategy as the programmable computing device, and specifically includes the following steps:

[0052] Step 202: Create a first key in the programmable computing device according to the key generation strategy and the information to be authenticated embedded in the programming file, wherein the information to be authenticated is embedded in the programming file by the communication terminal.

[0053] Specifically, the communication end refers to a physical device or virtual device with a communication function, for example, the communication end can be a virtual machine or a physical machine. A programmable computing device refers to a computing device with a programmable function, such as FPGA, PAL (programmable array logic), GAL (general array logic), etc. The programmable computing device has a connection relationship with the communication end. Correspondingly, a programming file refers to a programming file developed for a programmable computing device. In the case where the programmable computing device is an FPGA, the programming file can be a bitstream file. The programming file is pre-developed by the developer of the programmable computing device and can be loaded by the FPGA to implement data processing functions.

[0054] It should be noted that the communication authentication method provided in this specification can support communication authentication between a programmable computing device and any communication terminal that has a connection relationship with the programmable computing device. For the convenience of description, this embodiment uses the communication terminal as a virtual machine for illustration. The process of communication authentication between other types of communication terminals and programmable computing devices can refer to the same or corresponding description content of this embodiment, and this embodiment will not be elaborated in detail here.

[0055] Correspondingly, the key generation strategy of the communication terminal and the programmable computing device is the same, which means that the generation logic for generating keys pre-negotiated by the communication terminal and the developer of the programmable computing device is the same. In other words, although the programming languages ​​used by the communication terminal and the programmable computing device are different, based on the same key generation strategy and the same information to be authenticated, the keys generated by the two are the same. The key generation strategy can be a key generation algorithm such as the DES (Data Encryption Standard) algorithm, the AES (Advanced Encryption Standard) algorithm, and the Blowfish algorithm.

[0056] Correspondingly, the information to be authenticated refers to information used to detect the security of the two ends of the communication. The information to be authenticated can be a random value, a string, etc., which is not limited here. The first key refers to a key used to encrypt the information to be authenticated. The first key can generate a key using the information to be authenticated as a password or a random number according to the key generation strategy.

[0057] Based on this, the communication terminal implants the information to be authenticated into the programming file of the programmable computing device in advance. The communication terminal implants the information to be authenticated in the programming file, which means that the communication terminal stores the information to be authenticated generated or selected in the programming file on the basis of obtaining the programming file. In addition, due to the particularity of the programmable computing device, the communication terminal can use the operation tool provided by the device provider of the programmable computing device for the programmable device to implant. Thereafter, the programmable computing device can read the information to be authenticated in the programming file, and create a first key based on the information to be authenticated, so as to process the information to be authenticated based on the first key and send it to the communication terminal, so that the communication terminal can verify whether the information to be authenticated is correct, and judge whether the programming file has been replaced or tampered with according to the verification result.

[0058] Taking the communication system including virtual machine A and FPGA-B as an example, the communication authentication process of virtual machine A and FPGA-B is described. Virtual machine A implants the information to be authenticated C into the Bitstream file of FPGA-B. And according to the preset key generation strategy KG and the information to be authenticated C implanted in the Bitstream file, a first key k1 is created.

[0059] Furthermore, considering that if there is no established key generation program to generate the first key, the security and stability of the first key cannot be guaranteed, therefore, in this embodiment, the first key generation program corresponding to the key generation strategy pre-stored in the programming file can be called, and the key generation is performed by executing the first key generation program, which is specifically implemented as follows:

[0060] Invoking a first key generation program corresponding to the key generation strategy in the programmable computing device, wherein the first key generation program is stored in a programming file;

[0061] Loading the information to be authenticated into the first key generation program, and creating a first key by executing the first key generation program loaded with the information to be authenticated;

[0062] Specifically, the first key generation program refers to a program that is pre-written in a programming file and is used to generate a first key based on the information to be authenticated, that is, a program that is used to implement a key generation strategy. Since the first key generation program is stored in a programming file, the first key generation program is written in a hardware programming language, such as VHDL, VerilogHDL, System Verilog, SystemC, etc., wherein VHDL is a high-level language for circuit design; VerilogHDL is a hardware description language that describes the structure and behavior of digital system hardware in text form.

[0063] Based on this, in the process of generating the first key, the first key generation program is first called, the information to be authenticated is used as the basic element for key generation and loaded into the first key generation program, and then the first key generation program loaded with the information to be authenticated is executed to generate the first key.

[0064] For example: call the first key generation program P1 corresponding to the key generation strategy KG in the Bitstream file of FPGA-B, load the information to be authenticated C into the first key generation program P1, and then execute the first key generation program P1 loaded with the information to be authenticated C to create the first key k1.

[0065] In summary, by calling the first key generation program corresponding to the key generation strategy that is pre-written in the programming file, and by executing the first key generation program to generate a key based on the information to be authenticated, the first key is obtained, thereby ensuring the security of the generation of the first key and ensuring consistency with the second key.

[0066] Considering that the information to be authenticated embedded in the programming file needs to be kept private and authenticatable in the programmable computing device and the communication terminal, in this embodiment, the communication terminal can embed the information to be authenticated in the programming file, and the specific implementation is as follows:

[0067] implanting the information to be authenticated in the programming file through the communication terminal;

[0068] The programming file implanting the information to be authenticated is configured in the programmable computing device.

[0069] Specifically, the communication terminal embeds the information to be authenticated in the programming file, which may be based on the communication terminal obtaining the programming file, and then storing the information to be authenticated generated or selected by the communication terminal in the programming file. Furthermore, in order to enable the programmable computing device to directly read the information to be authenticated, the programming file embedding the information to be authenticated needs to be configured in the programmable computing device.

[0070] In the case where the programmable computing device is an FPGA, there are multiple configuration (loading) modes for the FPGA. In this embodiment, a passive configuration mode can be used, wherein passive configuration means that the FPGA only passively receives configuration data. The most common passive configuration mode is to download the bitstream file through JTAG (Joint Test Action Group). In this mode, the device that actively initiates the operation is the communication end, the data path is JTAG, and the FPGA passively receives data, and updates the FPGA configuration according to the required operation.

[0071] The specific implementation process of configuring the programming file to the FPGA includes: 1. The communication end actively initiates the configuration, and the FPGA passively receives the data for reconfiguration. The configuration mode at this time is the passive configuration based on JTAG mentioned above. The result of this operation is to configure the FPGA as a Flash reader / writer. 2. After the configuration is completed, the communication end starts to send / receive Flash data (programming file), and the data channel is JTAG. After the FPGA receives the data through JTAG, it initiates the read and write operation of the Flash according to the needs, writes the data to be updated to the Flash, and completes the update. This process is the process of updating the Flash. During the burning process, the Flash is only controlled by the FPGA. 3. After the Flash is updated, let the FPGA reconfigure at the appropriate time (for example, power on and off again), and the FPGA will start the active configuration process and read the configuration data from the Flash to complete the loading.

[0072] Using the above example, virtual machine A obtains the Bitstream file of FPGA-B, implants the information to be authenticated C into the Bitstream file, downloads the Bitstream file implanted with the information to be authenticated C to FPGA-B, and FPGA-B loads it.

[0073] In summary, the communication end implants the information to be authenticated in the programming file of the programmable computing device and configures it to the programmable computing device, thereby ensuring the security of the programming file and the information to be authenticated and providing a basis for secure authentication for subsequent communication between the two.

[0074] In addition, in addition to the communication end and the programmable computing device included in the above communication system, considering that in a cloud service scenario, it is usually necessary to meet the demand for improving computing power for customers, therefore, the communication authentication system further includes: a service end having a connection relationship with the communication end;

[0075] Accordingly, before creating the first key in the programmable computing device according to the key generation strategy and the information to be authenticated embedded in the programming file, the method further includes:

[0076] Obtaining a programming file associated with the programmable computing device through the server, and sending the programming file to the communication terminal;

[0077] implanting the information to be authenticated in the programming file through the communication terminal, and sending the programming file implanted with the information to be authenticated to the service terminal;

[0078] The programming file implanted with the information to be authenticated is configured to the programmable computing device through the service end.

[0079] Specifically, the server refers to a server or an intelligent device that provides cloud services. The server is connected to the communication terminal and the programmable computing device at the same time. In the case where the communication terminal is a virtual machine, the server can also be the host of the virtual machine.

[0080] Based on this, after the developer completes the development of the programmable computing device and generates the programming file, the programming file can be obtained through the server and sent to the communication terminal so that the communication terminal can implant the information to be authenticated into the programming file. The server can obtain the programming file in various ways, which can be generated by running EDA (Electronic Design Automation) tools locally, or obtained through the network or USB storage device.

[0081] After the communication terminal completes the implantation of the information to be authenticated, the server configures the programming file implanted with the information to be authenticated to the programmable computing device. Specifically, the specific implementation method of the server configuring the programming file to the programmable computing device is similar to the specific implementation of configuring the programming file to the programmable computing device through the communication terminal, and the specific implementation of configuring the programming file to the programmable computing device through the communication terminal can be referred to, and will not be repeated here.

[0082] For example: the server obtains the Bitstream file of FPGA-B in a pre-set storage location, and sends the Bitstream file to virtual machine A. Virtual machine A receives the Bitstream file, and embeds the information C to be authenticated in the Bitstream file, and sends the Bitstream file with the information C to be authenticated to the server. The server downloads the Bitstream file to FPGA-B, and FPGA-B loads it.

[0083] In summary, the programming file is obtained through the server, and the server forwards the programming file between the communication terminal and the programmable computing device, thereby realizing the forwarding of the programming file and the information to be authenticated in the programming file when the communication terminal and the programmable computing device do not have the communication capability with each other.

[0084] Since the server directly forwards the programming file, there may be a security risk that the programming file may be stolen during the forwarding process. In order to further improve the security of the programming file forwarding process and avoid man-in-the-middle attacks, in this embodiment, the programming file can be encrypted during the forwarding process, which is specifically implemented as follows:

[0085] Encrypting the programming file embedded with the information to be authenticated based on the device key in the communication terminal to generate an encrypted programming file;

[0086] Sending the encrypted programming file to the server;

[0087] downloading the encrypted programming file to the programmable computing device through the server;

[0088] The encrypted programming file is decrypted in the programmable computing device based on a local device key to generate a programming file embedded with the information to be authenticated, wherein the device key is allocated to the communication terminal according to the local device key.

[0089] Specifically, a device key refers to a key corresponding to a local device key of a programmable computing device, and the device key may be a symmetric key. Correspondingly, a local device key refers to a key pre-implanted in a programmable computing device. The local device key is pre-implanted in the programmable computing device by the device provider of the programmable computing device (which may be understood as the manufacturer or seller of the programmable computing device, etc.). In specific implementation, the device key may be distributed to the communication terminal by the device provider by implanting the device key in the programmable computing device. That is to say, the device key and the local device key are the same key, or keys with mutual encryption and decryption capabilities. An encrypted programming file refers to an encrypted file generated after encrypting the programming file based on the device key.

[0090] Based on this, after the programming file with the information to be authenticated is encrypted by the device key, the server needs to download the encrypted programming file to the programmable computing device, and the programmable computing device can decrypt the encrypted programming file based on the local key device. In the case where the programmable computing device is an FPGA, the device provider will pre-burn a symmetric key (device key) into the FPGA, and the bitstream file can be downloaded to the FPGA by the server after being encrypted by the device key. The FPGA will use the device key to decrypt the ciphertext bitstream (encrypted programming file) and load it into the FPGA. The key and decryption process are transparent to the outside and cannot be interfered with. This process can be called Bistream encryption.

[0091] Continuing with the above example, based on the virtual machine A implanting the information C to be authenticated in the Bitstream file through bitstream manipulation, the Bitstream file after the information C to be authenticated is implanted is encrypted by the device key keyA to obtain the encrypted Bitstream file, and the encrypted Bitstream file is sent to the server. The server downloads the encrypted Bitstream file to FPGA-B, and FPGA-B decrypts the encrypted Bitstream file based on the device key keyA to obtain the Bitstream file after the information C to be authenticated is implanted, so that the FPGA-B can load the plaintext Bitstream file.

[0092] In summary, after the communication end embeds the information to be authenticated in the programming file, it encrypts the programming file embedded with the information to be authenticated based on the device key, and then transmits the encrypted programming file to the server, which downloads it to the programmable computing device. This can ensure that when the server forwards and downloads the ciphertext programming file, it cannot steal the programming file and reverse engineer the programming logic of the programmable computing device.

[0093] Furthermore, considering the hardware characteristics of the programmable computing device, in the embodiment of the present application, the communication terminal embeds the information to be authenticated in the programming file, which is specifically implemented as follows:

[0094] The initial value in the authentication storage in the programming file is modified into a random value through the communication terminal, and the random value is used as the information to be authenticated.

[0095] Specifically, the authentication storage is used to store the information to be authenticated in the programming file. In the case where the programmable computing device is an FPGA, the authentication storage can be implemented using the BRAM in the FPGA, and the content in the authentication storage cannot be read out through the external interface. The initial value is the power-on initial value stored in the programmable computing device. The random value can be a value randomly generated by the communication terminal.

[0096] For example, when the programmable computing device is an FPGA, virtual machine A uses the bitstreammanipulation tool provided by the device provider of FPGA-B to modify the initial value stored in the authentication storage in the Bitstream file, changes the initial value to a random value Nonce, and encrypts the modified bitstream with the device key of the FPGA. The modification of the authentication storage can be achieved by modifying the power-on initial value stored on the FPGA through bitstreammanipulation.

[0097] In summary, by modifying the initial value in the authentication storage in the programming file to a random value through the communication terminal, the randomness and uniqueness of the information to be authenticated are guaranteed, so that in the subsequent authentication process, it can be determined whether the programming file is correctly loaded into the programmable computing device by detecting the information to be authenticated.

[0098] Furthermore, considering that there may be a risk of device key leakage in the process of the virtual machine obtaining the device key, in this embodiment, the communication terminal can be deployed in a trusted execution environment, and the communication terminal can be used to obtain the device key in the trusted execution environment. The specific implementation is as follows:

[0099] In response to a deployment instruction from the server, deploying the communication terminal to a trusted execution environment;

[0100] The communication terminal is used to send a key acquisition request to a device provider corresponding to the programmable computing device in a trusted channel of a trusted execution environment, and the device key sent by the device provider in response to the key acquisition request is received.

[0101] Specifically, a deployment instruction refers to an instruction to deploy a virtual machine to a trusted execution environment. The trusted execution environment TEE builds a secure area in the central processor to ensure that the programs and data loaded inside are processed in an isolated and trusted environment, thereby protecting it from software attacks in the REE (Rich Execution Environment). In addition, compared with other secure execution environments, TEE can protect the integrity and confidentiality of TA (Trusted Application) end-to-end. Correspondingly, a trusted channel refers to a channel established in a trusted execution environment that can communicate securely. A key acquisition request refers to a request to obtain the device key of a programmable computing device. The acquisition request may carry the device identification of the programmable computing device, such as the device name and / or device number.

[0102] Based on this, in response to the deployment instruction of the server, the server can deploy the communication terminal to the trusted execution environment. In addition, the communication system can also call other devices to complete the deployment of the communication terminal, which is not limited here.

[0103] Continuing with the above example, in response to the deployment instruction of the server, the server deploys virtual machine A into TEE, and uses virtual machine A to send a key acquisition request Q to the device provider of FPGA-B in the trusted channel within TEE. The device provider sends the device key KeyA to virtual machine A in response to the key acquisition request Q, and virtual machine A receives the device key KeyA.

[0104] In summary, the communication terminal sends the key acquisition instruction in the trusted channel of the trusted execution environment and receives the device key, which ensures the security of the process of obtaining the device key and further ensures the secure transmission of the programming file.

[0105] Step 204: encrypt the information to be authenticated into an authentication report based on the first key, and send the report to the communication end.

[0106] Specifically, based on the creation of the first key, considering the security of authentication between the programmable computing device and the communication terminal, the information to be authenticated is encrypted by the created first key, an authentication report is generated, and the authentication report is sent to the communication terminal. The authentication report refers to an encrypted report for providing the information to be authenticated. The encrypted authentication report is sent to the communication terminal so that the communication terminal can perform communication verification based on the authentication report.

[0107] Continuing with the above example, the above-mentioned FPGA-B creates the first key k1 based on the key generation strategy KG and the information to be authenticated C embedded in the Bitstream file, encrypts the information to be authenticated C based on the first key k1, generates an authentication report AP, and sends the authentication report AP to virtual machine A.

[0108] Step 206: Decrypt the authentication report based on a preset second key through the communication terminal to obtain report information, wherein the second key is created according to the key generation strategy and the information to be authenticated.

[0109] Specifically, based on the authentication report being sent to the communication terminal, since the authentication report is generated in an encrypted manner, in order to read the information to be authenticated therein, it needs to be decrypted first. Therefore, the authentication report needs to be decrypted based on the second key to obtain the plaintext information corresponding to the authentication report, that is, the report information. The second key refers to a pre-generated key for decrypting the authentication report.

[0110] Since the creation of the second key and the creation of the first key are based on the same key generation strategy and the same information to be authenticated, the second key is the same as the first key. And the creation method of the second key is similar to the creation method of the first key, and the creation method of the first key can be referred to, and will not be repeated here.

[0111] Continuing with the above example, the authentication report AP is decrypted in virtual machine A based on the preset second key k2 to obtain report information C.

[0112] Further, similar to the creation of the first key, in order to ensure the security and stability of the second key, the creation of the second key is specifically implemented as follows:

[0113] Invoking a second key generation program corresponding to the key generation strategy in the communication terminal;

[0114] The information to be authenticated is loaded into the second key generation program, and a second key is created by executing the second key generation program loaded with the information to be authenticated.

[0115] Specifically, the second key generation program refers to a program pre-stored in the communication terminal for generating the second key based on the information to be authenticated. Since the second key generation program is stored in the communication terminal, the second key generation program is written in a software programming language, such as JAVA language, C language, etc.

[0116] Based on this, the specific implementation of calling the second key generation program to generate the second key is similar to the specific implementation of calling the first key generation program to generate the first key. You can refer to the specific implementation of calling the first key generation program to generate the first key, which will not be repeated here.

[0117] For example, the second key generation program P2 corresponding to the key generation strategy KG is called in the virtual machine A, and the information to be authenticated C is loaded into the second key generation program P2, and then the second key generation program P2 loaded with the information to be authenticated C is executed to create the second key k2.

[0118] In summary, by calling the second key generation program corresponding to the key generation strategy pre-stored on the communication end, and by executing the second key generation program, the key is generated based on the information to be authenticated, and the second key is obtained, thereby ensuring the security of the second key generation and its consistency with the first key.

[0119] Step 208: When the comparison result between the report information and the information to be authenticated is the same, establish a communication relationship between the communication terminal and the programmable computing device.

[0120] Specifically, based on the above-mentioned report information, considering that the programming files in the programmable computing device may be replaced or tampered with, the authentication report received by the communication terminal may not contain the information to be authenticated. In order to avoid this situation, it is necessary to compare the report information and the information to be authenticated; if the comparison result is the same, it indicates that the communication authentication result is passed, that is, the programming file configured in the programmable computing device has not been replaced or tampered with, and a communication relationship between the communication terminal and the programmable computing device is established; if the comparison result is different, it indicates that the communication authentication result is not passed, and the programming file configured in the programmable computing device has been replaced or tampered with, and no processing is required. Among them, the communication relationship can be understood as a trusted channel established between the communication terminal and the programmable computing device.

[0121] Continuing with the above example, based on the report information C obtained above, the report information C and the information to be authenticated C are compared. The comparison result is the same, indicating that the Bitstream file loaded in FPGA-B has not been replaced or modified, and a trusted PCIe channel is established between virtual machine A and FPGA-B.

[0122] Based on this, establishing a communication relationship between the communication terminal and the programmable computing device means that when the communication authentication is passed, the communication terminal can confirm that the correct programming file is loaded into the programmable computing device, and can subsequently communicate with the programmable computing device.

[0123] On the basis of establishing a communication relationship between the communication terminal and the programmable computing device, considering that if the communication data is not processed in any way during the communication process, there is still a risk that the communication data may be stolen or tampered with, in order to ensure the security of the communication, in this embodiment, the communication data may be encrypted by the first key and the second key, which is specifically implemented as follows:

[0124] Encrypting application data of the application program based on the second key in the communication terminal to generate encrypted data, and sending the encrypted data to the programmable computing device;

[0125] receiving the encrypted data through the programmable computing device, and decrypting the encrypted data based on the first key to obtain the application data;

[0126] The programmable computing device processes the application data and returns the processing result to the communication end.

[0127] Specifically, an application program refers to a program installed on the communication terminal, and the application program contains data (i.e., application data) that needs to be communicated with a programmable communication device. Among them, application data can be understood as data that requires a programmable computing device to process or improve computing power. Correspondingly, encrypted data refers to ciphertext data generated by encrypting application data. Data processing may include: encoding, decoding, and other processing of data, digital signal processing, and / or video image processing, etc., without limitation here.

[0128] Based on this, since the application data is encrypted by the second key at the communication end and the encrypted data is sent to the programmable computing device. Therefore, after the programmable computing device receives the encrypted data, the programmable computing device needs to decrypt the encrypted data by the first key generated by the same key generation strategy as the second key, so as to restore the application data. On the basis of restoring the application data, the application data can be processed to obtain the processed data, and the processed data is returned to the communication end as the processing result. In specific implementation, in order to ensure the security of communication, the processed data can be encrypted based on the first key to obtain the encrypted processed data, and the encrypted processed data can be returned to the communication end as the processing result.

[0129] Using the above example, on the basis of establishing the communication relationship between virtual machine A and FPGA-B, the data d1 to be calculated of application P is obtained in virtual machine A, and the data d1 to be calculated is encrypted by the second key k2 to generate encrypted data d2, and the encrypted data d2 is sent to FPGA-B, and FPGA-B decrypts the encrypted data d2 based on the first key k1 to obtain the data d1 to be calculated. The data d1 to be calculated is calculated to obtain a calculation result, and the calculation result is encrypted based on the first key k1 to obtain an encrypted result, and the encrypted result is returned to virtual machine A.

[0130] In summary, on the basis of establishing a communication relationship, the communication end and the programmable computing device perform encrypted communication based on the keys (i.e., the first key and the second key) generated by both parties, thereby ensuring the security of communication. There is no need to perform key negotiation on the PCIe data link controlled by the server, which is immune to man-in-the-middle attacks.

[0131] See also Figure 3As shown in the schematic diagram, the programmable computing device is an FPGA. During the FPGA logic development phase, it is necessary to expand the existing logic (UserLogic), that is, to expand the FPGA logic. Add an Extension module without changing UserLogic. The Extension module mainly includes three modules: a Controller module, a KeyGeneration module, and a NonceStorage module. The Controller module is mainly used to receive and process remote authentication requests from the virtual machine side, the NonceStorage module is used to store written Nonce, and the KeyGeneration module is used to generate keys based on the stored Nonce. The NonceStorage module is completely implemented with FPGA on-chip storage BRAM and cannot be read through an external interface. The Extension module is only used for key implantation and remote authentication, and is completely independent of UserLogic.

[0132] On this basis, the communication authentication method provided in this embodiment is applied to a communication authentication system, wherein the communication authentication system includes a programmable computing device and a communication terminal, wherein the communication terminal has the same key generation strategy as the programmable computing device, and in order to ensure that the programming file of the programmable computing device has not been replaced or tampered with before the communication terminal and the programmable computing device communicate, the communication terminal can implant the information to be authenticated in the programming file of the programmable computing device, so that the communication terminal and the programmable computing device can unify the information to be authenticated in advance. After the programming file implanting the information to be authenticated is configured in the programmable computing device, a first key is created in the programmable computing device based on the key generation strategy and the information to be authenticated implanted in the programming file, and the information to be authenticated is encrypted into an authentication report based on the first key, and sent to the communication terminal, so that the programmable computing device provides an authentication report based on the information to be authenticated. Then, a second key is created in the communication terminal according to the key generation strategy and the information to be authenticated, and the authentication report is decrypted based on the second key to obtain the report information. When the comparison result between the report information and the information to be authenticated is the same, a communication relationship is established between the communication terminal and the programmable computing device, thereby realizing the verification of the authentication report provided by the programmable computing device by the communication terminal, so that the communication terminal can verify whether the programming file is securely and reliably loaded into the programmable computing device before communication, and on this basis, provides security for subsequent data communications.

[0133] Corresponding to the above method embodiment, this specification also provides a communication method embodiment, Figure 4 FIG. 1 is a flow chart of a communication method provided by an embodiment of the present specification. Figure 4As shown, the communication method is applied to a communication system, wherein the communication system includes a communication terminal and a programmable computing device having a communication authentication relationship, and the key generation strategy of the communication terminal and the programmable computing device is the same, and includes the following steps:

[0134] Step 402, encrypting application data of the application program based on the first key in the communication terminal to generate encrypted data, and sending the encrypted data to the programmable computing device;

[0135] Step 404, receiving the encrypted data through the programmable computing device, and decrypting the encrypted data through a second key to obtain the application data, wherein the first key and the second key are created based on the key generation strategy;

[0136] Step 406: Process the application data through the programmable computing device and return the processing result to the communication end.

[0137] Specifically, having a communication authentication relationship means that the communication authentication result of the communication terminal and the programmable computing device using the above-mentioned communication authentication method is passed. An application program refers to a program installed on the communication terminal, and the application program contains data (i.e., application data) that needs to be communicated with the programmable communication device. Among them, application data can be understood as data that requires a programmable computing device to process or improve computing power. Correspondingly, encrypted data refers to ciphertext data generated by encrypting application data. Data processing may include: encoding, decoding and other processing of data, digital signal processing, and / or video image processing and other processing, which are not limited here.

[0138] Based on this, since the application data is encrypted by the first key at the communication end and the encrypted data is sent to the programmable computing device. Therefore, after the programmable computing device receives the encrypted data, the programmable computing device needs to decrypt the encrypted data by the second key generated by the same key generation strategy as the first key, so as to restore the application data. On the basis of restoring the application data, the application data can be processed to obtain the processed data, and the processed data is returned to the communication end as the processing result. In specific implementation, in order to ensure the security of communication, the processed data can be encrypted based on the second key to obtain the encrypted processed data, and the encrypted processed data can be returned to the communication end as the processing result.

[0139] It should be noted that the first key in this embodiment can be understood as the second key in the above method embodiment, and the second key can be understood as the first key in the above method embodiment.

[0140] For example, on the basis of establishing the communication relationship between virtual machine A and FPGA-B, the data d1 to be calculated of application program P is obtained in virtual machine A, the data d1 to be calculated is encrypted by the first key k1, the encrypted data d2 is generated, and the encrypted data d2 is sent to FPGA-B, and FPGA-B decrypts the encrypted data d2 based on the second key k2 to obtain the data d1 to be calculated. The data d1 to be calculated is calculated to obtain the calculation result, and the calculation result is encrypted based on the second key k2 to obtain the encrypted result, and the encrypted result is returned to virtual machine A.

[0141] The communication method provided in this embodiment is applied to a communication system, wherein the communication system includes a programmable computing device and a communication terminal, wherein the communication terminal has the same key generation strategy as the programmable computing device, and the communication authentication result between the communication terminal and the programmable computing device is passed. In order to ensure secure communication between the communication terminal and the programmable computing device, the application data of the application is encrypted in the communication terminal based on the first key to generate encrypted data, and the encrypted data is sent to the programmable computing device; the encrypted data is received by the programmable computing device, and the encrypted data is decrypted by the second key to obtain the application data, wherein the first key and the second key are created based on the key generation strategy; the application data is processed by the programmable computing device, and the processing result is returned to the communication terminal. The encryption or decryption of data in communication is realized by using a pre-negotiated key, and there is no need to perform key negotiation on a data link controlled by a third party, which is immune to man-in-the-middle attacks.

[0142] The above is a schematic scheme of a communication method of this embodiment. It should be noted that the technical scheme of the communication method and the technical scheme of the communication authentication method described above are of the same concept, and the details not described in detail in the technical scheme of the communication method can be referred to the description of the technical scheme of the communication authentication method described above.

[0143] Corresponding to the above-mentioned method embodiment, this specification also provides a communication system embodiment, which includes: a communication terminal and a programmable computing device having a communication authentication relationship, the communication terminal and the programmable computing device have the same key generation strategy, the communication terminal is used to store a sending executable instruction for communication, and the programmable computing device is used to store a receiving executable instruction for communication, and when the sending executable instruction is executed by the communication terminal and the receiving executable instruction is executed by the programmable computing device, the steps of the above-mentioned communication method are implemented.

[0144] The above is a schematic scheme of a communication system of this embodiment. It should be noted that the technical scheme of the communication system and the technical scheme of the communication method described above are of the same concept, and the details not described in detail in the technical scheme of the communication system can be referred to the description of the technical scheme of the communication method described above.

[0145] The following combination Figure 5 , taking the application of the communication authentication method provided in this specification in an interactive scenario as an example, the communication authentication method is further described. Figure 5 An interactive schematic diagram of a communication authentication method provided by an embodiment of the present specification is shown. The communication authentication method is applied to a communication authentication system, which includes: a virtual machine, a cloud service end, an FPGA, and a device provider of the FPGA, wherein the key generation strategy of the virtual machine and the FPGA is the same, and on this basis, the communication authentication process includes the following steps.

[0146] Step 502: The device provider of the FPGA device pre-implants a device key DK on the FPGA.

[0147] Step 504: The cloud server deploys the virtual machine to the trusted execution environment.

[0148] Specifically, the trusted execution environment may be a trusted execution environment of a remote host, and the virtual machine runs in the trusted execution environment and creates an enclave. After the virtual machine is deployed in the trusted execution environment, the virtual machine communicates with the outside through the trusted execution environment.

[0149] Step 506: The virtual machine sends a key acquisition request to the device provider in the trusted channel of the trusted execution environment, and receives a device key DK returned by the key provider in response to the key acquisition request.

[0150] Step 508: The cloud server sends the Bitstream file associated with the FPGA to the virtual machine.

[0151] Step 510: The virtual machine embeds a random value Nonce in the Bitstream file, and encrypts the Bitstream file embedded with the random value Nonce based on the device key DK to obtain an encrypted Bitstream file.

[0152] Specifically, the virtual machine uses the bitstreammanipulation tool provided by the FPGA device provider to modify the initial value of the storage module in the Bitstream file, changes the initial value to a random value Nonce, and encrypts the modified bitstream with the FPGA device key. The initial value is the power-on initial value stored in the FPGA. The random value can be a value randomly generated by the virtual machine. In addition, the BRAM in the FPGA can be used to store the random value Nonce in the Bitstream file, so the content in the storage cannot be read out through the external interface.

[0153] Step 512: The virtual machine sends the encrypted Bitstream file to the cloud server.

[0154] Step 514: The cloud server downloads the encrypted Bitstream file to the FPGA.

[0155] Step 516, the FPGA decrypts the encrypted Bitstream file based on the device key DK to obtain the Bitstream file, and creates a first key K according to the random value Nonce embedded in the Bitstream file.

[0156] Specifically, the FPGA reads the random value Nonce of the storage module through the control module in the Bitstream file, and generates a symmetric key, namely the first key K, according to the random value Nonce through the key generation module in the Bitstream file. At the same time, the virtual machine also generates a symmetric key, namely the second key K, according to the random value Nonce using the same key generation logic. Therefore, the first key K is the same as the second key K.

[0157] Step 518: The FPGA encrypts the random value Nonce based on the first key K and obtains the authentication report P, which is sent to the virtual machine.

[0158] Step 520, the virtual machine decrypts the authentication report P based on the pre-created second key K, obtains the report information Nonce, and verifies the authentication report by comparing the report information Nonce with the random value Nonce. When the comparison results are the same, a trusted PCIe channel is established between the virtual machine and the FPGA.

[0159] Specifically, if the comparison result is different, it means that the communication authentication result is failed and no processing is required.

[0160] Step 522: The virtual machine encrypts the application data D of the application program based on the second key K, generates encrypted data ED, and sends the encrypted data ED to the FPGA.

[0161] Step 524: FPGA receives the encrypted data ED, and decrypts the encrypted data ED using the first key K to obtain application data D.

[0162] Step 526: FPGA processes the application data D and returns the processing result to the virtual machine.

[0163] It should be noted that the communication authentication method can be directly applied to conventional FPGA products and is not limited to special FPGA forms containing ARM (Advanced RISC microprocessors) and the like.

[0164] In summary, in order to ensure that the programming file of the FPGA has not been replaced or tampered with before the virtual machine and the FPGA communicate, the communication end can implant the information to be authenticated in the programming file of the FPGA so that the virtual machine and the FPGA can unify the information to be authenticated in advance. After configuring the programming file with the information to be authenticated to the FPGA, a first key is created in the FPGA based on the key generation strategy and the information to be authenticated implanted in the programming file, and the information to be authenticated is encrypted into an authentication report based on the first key, and sent to the virtual machine, so that the FPGA provides an authentication report based on the information to be authenticated. Then, a second key is created in the virtual machine based on the key generation strategy and the information to be authenticated, and the authentication report is decrypted based on the second key to obtain the report information. When the comparison result of the report information and the information to be authenticated is the same, a communication relationship between the virtual machine and the FPGA is established, and the virtual machine verifies the authentication report provided by the FPGA, so that the virtual machine can verify whether the programming file is securely and reliably loaded into the FPGA before communication, and on this basis, security is provided for subsequent data communication.

[0165] Corresponding to the above method embodiment, this specification also provides a communication authentication system embodiment, Figure 6 FIG. 1 shows a schematic diagram of the structure of a communication authentication system provided by an embodiment of the present specification; Figure 6 As shown, the communication authentication system 600 includes: a programmable computing device 602 and a communication terminal 604; wherein the key generation strategy of the communication terminal 604 is the same as that of the programmable computing device 602;

[0166] The programmable computing device 602 creates a first key according to the key generation strategy and the information to be authenticated embedded in the programming file, wherein the information to be authenticated is embedded in the programming file by the communication terminal 604, encrypts the information to be authenticated into an authentication report based on the first key, and sends the authentication report to the communication terminal 604;

[0167] The communication terminal 604 decrypts the authentication report based on a preset second key to obtain report information, wherein the second key is created according to the key generation strategy and the information to be authenticated, and when the comparison result between the report information and the information to be authenticated is the same, a communication relationship is established between the communication terminal 604 and the programmable computing device 602.

[0168] Optionally, the communication authentication system further includes:

[0169] The communication terminal 604 embeds the information to be authenticated into a programming file, and configures the programming file embedded with the information to be authenticated to the programmable computing device 602 .

[0170] Optionally, the communication authentication system further includes: a service end connected to the communication end 604;

[0171] Accordingly, the communication authentication system further includes:

[0172] The server obtains the programming file associated with the programmable computing device 602 and sends the programming file to the communication terminal 604;

[0173] The communication end 604 embeds the information to be authenticated in the programming file, and sends the programming file embedded with the information to be authenticated to the service end;

[0174] The server configures the programming file implanted with the information to be authenticated to the programmable computing device 602 .

[0175] Optionally, the communication authentication system further includes:

[0176] The communication end 604 encrypts the programming file embedded with the information to be authenticated based on the device key to generate an encrypted programming file, and sends the encrypted programming file to the server;

[0177] The server downloads the encrypted programming file to the programmable computing device 602;

[0178] The programmable computing device 602 decrypts the encrypted programming file based on a local device key to generate a programming file embedded with the information to be authenticated, wherein the device key is allocated to the communication terminal 604 according to the local device key.

[0179] Optionally, the step of implanting the information to be authenticated into the programming file through the communication terminal includes:

[0180] The initial value in the authentication storage in the programming file is modified into a random value, and the random value is used as the information to be authenticated.

[0181] Optionally, the communication authentication system further includes:

[0182] In response to the deployment instruction of the server, deploy the communication terminal 604 to the trusted execution environment;

[0183] The communication terminal 604 is used to send a key acquisition request to a device provider corresponding to the programmable computing device 602 in a trusted channel of the trusted execution environment, and the device key sent by the device provider in response to the key acquisition request is received.

[0184] Optionally, the communication authentication system further includes:

[0185] Encrypting application data of the application program based on the second key in the communication terminal 604 to generate encrypted data, and sending the encrypted data to the programmable computing device 602;

[0186] receiving the encrypted data through the programmable computing device 602, and decrypting the encrypted data based on the first key to obtain the application data;

[0187] The programmable computing device 602 processes the application data and returns the processing result to the communication terminal 604 .

[0188] Optionally, the step of implanting the information to be authenticated into the programming file through the communication terminal includes:

[0189] Calling a first key generation program corresponding to the key generation strategy, wherein the first key generation program is stored in a programming file, loading the information to be authenticated into the first key generation program, and creating a first key by executing the first key generation program loaded with the information to be authenticated;

[0190] Accordingly, the communication authentication system further includes:

[0191] The communication terminal 604 calls the second key generation program corresponding to the key generation strategy, loads the information to be authenticated into the second key generation program, and creates a second key by executing the second key generation program loaded with the information to be authenticated.

[0192] The communication authentication system provided in this embodiment includes: a programmable computing device and a communication terminal, wherein the communication terminal has the same key generation strategy as the programmable computing device. In order to ensure that the programming file of the programmable computing device has not been replaced or tampered with before the communication terminal and the programmable computing device communicate, the communication terminal can implant the information to be authenticated in the programming file of the programmable computing device, so that the communication terminal and the programmable computing device can unify the information to be authenticated in advance. After the programming file implanted with the information to be authenticated is configured to the programmable computing device, a first key is created in the programmable computing device based on the key generation strategy and the information to be authenticated implanted in the programming file, and the information to be authenticated is encrypted into an authentication report based on the first key, and sent to the communication terminal, so that the programmable computing device provides an authentication report based on the information to be authenticated. Then, a second key is created in the communication terminal according to the key generation strategy and the information to be authenticated, and the authentication report is decrypted based on the second key to obtain the report information. When the comparison result between the report information and the information to be authenticated is the same, a communication relationship is established between the communication terminal and the programmable computing device, thereby realizing the verification of the authentication report provided by the programmable computing device by the communication terminal, so that the communication terminal can verify whether the programming file is securely and reliably loaded into the programmable computing device before communication, and on this basis, provides security for subsequent data communications.

[0193] The above is a schematic scheme of a communication authentication system of this embodiment. It should be noted that the technical scheme of the communication authentication system and the technical scheme of the communication authentication method described above are of the same concept, and the details not described in detail in the technical scheme of the communication authentication system can be referred to the description of the technical scheme of the communication authentication method described above.

[0194] Corresponding to the above-mentioned method embodiment, this specification also provides a communication authentication system embodiment, which includes: a communication terminal and a programmable computing device, the communication terminal has the same key generation strategy as the programmable computing device, the programmable computing device is used to store a provision executable instruction for communication authentication, and the communication terminal is used to store an authentication executable instruction for communication authentication, and when the provision executable instruction is executed by the programmable computing device and the authentication executable instruction is executed by the communication terminal, the steps of the above-mentioned communication authentication method are implemented.

[0195] The above is a schematic scheme of a communication authentication system of this embodiment. It should be noted that the technical scheme of the communication authentication system and the technical scheme of the communication authentication method described above are of the same concept, and the details not described in detail in the technical scheme of the communication authentication system can be referred to the description of the technical scheme of the communication authentication method described above.

[0196] Figure 7The block diagram of a computing device 700 according to an embodiment of the present specification is shown. The components of the computing device 700 include but are not limited to a memory 710 and a processor 720. The processor 720 is connected to the memory 710 via a bus 730, and the database 750 is used to store data.

[0197] The computing device 700 also includes an access device 740, which enables the computing device 700 to communicate via one or more networks 760. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 740 may include one or more of any type of network interface (e.g., a network interface card (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a global microwave interconnection access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0198] In one embodiment of the present application, the above components of the computing device 700 and Figure 7 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 7 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of the present application. Those skilled in the art may add or replace other components as needed.

[0199] The computing device 700 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 700 may also be a mobile or stationary server.

[0200] The processor 720 is used to execute the following computer executable instructions, which, when executed by the processor, implement the above-mentioned communication authentication method or steps of the communication method.

[0201] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the communication authentication method or the communication method mentioned above are of the same concept, and the details not described in detail in the technical scheme of the computing device can be referred to the description of the technical scheme of the communication authentication method or the communication method mentioned above.

[0202] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, can implement the above-mentioned communication authentication method or steps of the communication method.

[0203] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the communication authentication method or the communication method mentioned above belong to the same concept, and the details not described in detail in the technical scheme of the storage medium can be referred to the description of the technical scheme of the communication authentication method or the communication method mentioned above.

[0204] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the above-mentioned communication authentication method or steps of the communication method.

[0205] The above is an illustrative solution of a computer program of this embodiment. It should be noted that the technical solution of the computer program and the technical solution of the communication authentication method or the communication method mentioned above are of the same concept, and the details not described in detail in the technical solution of the computer program can be referred to the description of the technical solution of the communication authentication method or the communication method mentioned above.

[0206] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0207] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0208] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0209] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0210] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A communication authentication method, applied to a communication authentication system, the communication authentication system comprising a programmable computing device and a communication terminal, the communication terminal and the programmable computing device have the same key generation strategy, and the communication authentication system further comprises: include: A service end connected to the communication end; including: Creating a first key in the programmable computing device according to the key generation strategy and the information to be authenticated embedded in the programming file, wherein the information to be authenticated is embedded in the programming file by the communication terminal; Encrypting the information to be authenticated into an authentication report based on the first key, and sending the authentication report to the communication terminal; Decrypting the authentication report by the communication terminal based on a preset second key to obtain report information, wherein the second key is created according to the key generation strategy and the information to be authenticated; When the comparison result between the report information and the information to be authenticated is the same, establishing a communication relationship between the communication terminal and the programmable computing device; After the information to be authenticated is implanted in the programming file, it also includes: Encrypting the programming file embedded with the information to be authenticated based on the device key in the communication terminal to generate an encrypted programming file; Sending the encrypted programming file to the server; downloading the encrypted programming file to the programmable computing device through the server; The encrypted programming file is decrypted in the programmable computing device based on a local device key to generate a programming file embedded with the information to be authenticated, wherein the device key is allocated to the communication terminal according to the local device key.

2. The method according to claim 1, wherein before creating the first key in the programmable computing device according to the key generation strategy and the information to be authenticated embedded in the programming file, include: implanting the information to be authenticated in the programming file through the communication terminal; The programming file implanting the information to be authenticated is configured in the programmable computing device.

3. The method according to claim 1, Accordingly, before creating the first key in the programmable computing device according to the key generation strategy and the information to be authenticated embedded in the programming file, include: Obtaining a programming file associated with the programmable computing device through the server, and sending the programming file to the communication terminal; implanting the information to be authenticated in the programming file through the communication terminal, and sending the programming file implanted with the information to be authenticated to the service terminal; The programming file implanted with the information to be authenticated is configured to the programmable computing device through the service end.

4. The method according to claim 3, wherein the communication terminal is used to implant the information to be authenticated into the programming file. include: The initial value in the authentication storage in the programming file is modified into a random value through the communication terminal, and the random value is used as the information to be authenticated.

5. The method according to claim 1, further comprising: include: In response to a deployment instruction from the server, deploying the communication terminal to a trusted execution environment; The communication terminal is used to send a key acquisition request to a device provider corresponding to the programmable computing device in a trusted channel of a trusted execution environment, and the device key sent by the device provider in response to the key acquisition request is received.

6. The method according to claim 1, after establishing the communication relationship between the communication terminal and the programmable computing device, further comprising: include: Encrypting application data of the application program based on the second key in the communication terminal to generate encrypted data, and sending the encrypted data to the programmable computing device; receiving the encrypted data through the programmable computing device, and decrypting the encrypted data based on the first key to obtain the application data; The programmable computing device processes the application data and returns the processing result to the communication end.

7. The method according to claim 1, wherein the first key is created in the programmable computing device according to the key generation strategy and the information to be authenticated embedded in the programming file, include: Invoking a first key generation program corresponding to the key generation strategy in the programmable computing device, wherein the first key generation program is stored in a programming file; Loading the information to be authenticated into the first key generation program, and creating a first key by executing the first key generation program loaded with the information to be authenticated; Correspondingly, before decrypting the authentication report by the communication terminal based on a preset second key to obtain the report information, the method further includes: Invoking a second key generation program corresponding to the key generation strategy in the communication terminal; The information to be authenticated is loaded into the second key generation program, and a second key is created by executing the second key generation program loaded with the information to be authenticated.

8. A communication authentication system, include: A programmable computing device and a communication terminal, wherein the communication terminal and the programmable computing device have the same key generation strategy; The programmable computing device creates a first key according to the key generation strategy and the information to be authenticated embedded in the programming file, wherein the information to be authenticated is embedded in the programming file by the communication terminal, encrypts the information to be authenticated into an authentication report based on the first key, and sends the authentication report to the communication terminal; The communication end, decrypting the authentication report based on a preset second key to obtain report information, wherein the second key is created according to the key generation strategy and the information to be authenticated, and establishing a communication relationship between the communication end and the programmable computing device when a comparison result between the report information and the information to be authenticated is the same; The communication authentication system further includes: a service end connected to the communication end; After the information to be authenticated is implanted in the programming file, it also includes: Encrypting the programming file embedded with the information to be authenticated based on the device key in the communication terminal to generate an encrypted programming file; Sending the encrypted programming file to the server; downloading the encrypted programming file to the programmable computing device through the server; The encrypted programming file is decrypted in the programmable computing device based on a local device key to generate a programming file embedded with the information to be authenticated, wherein the device key is allocated to the communication terminal according to the local device key.

9. A communication authentication system, include: Programmable computing devices and communication terminals; The communication terminal has the same key generation strategy as the programmable computing device. The programmable computing device is used to store a provision executable instruction for communication authentication, and the communication terminal is used to store an authentication executable instruction for communication authentication. When the provision executable instruction is executed by the programmable computing device and the authentication executable instruction is executed by the communication terminal, the steps of the method described in any one of claims 1 to 7 are implemented.

10. A computing device comprising a memory, a processor, and computer instructions stored in the memory and executable on the processor, It is characterized in that When the processor executes the computer instructions, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer-readable storage medium storing computer instructions, It is characterized in that When the computer instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images