Terminal network layer and application layer trusted access method and system

Abstract

The present application discloses a terminal network layer and application layer trusted access method and system, the method includes generating a symmetric key according to first authentication information, second authentication information and third authentication information sent by the terminal; using the symmetric key to generate a first end information, so that the terminal can generate a session key according to the first authentication information, the second authentication information and the third authentication information; using the session key to decrypt the first end information and after confirming that the decryption result is correct, send the second end information, the second end information is generated based on the session key; using the symmetric key to decrypt the second end information, after verifying that the decrypted data is correct, the terminal accesses the main station as a trusted terminal, and the symmetric key is used to decrypt the data transmitted by the terminal to obtain the data reported to the main station. It can be seen that the present application can establish a secure channel between the trusted terminal and the main station, avoiding the situation where criminals forge the interaction between the terminal and the main station, thereby maintaining the safe and stable operation of the power grid.

Description

Technical Field

[0001] The present application relates to the field of information security protection technology, and more specifically, to a terminal network layer and application layer trusted access method and a terminal network layer and application layer trusted access system. Background Art

[0002] With the acceleration of the construction of power distribution automation, the construction of the power Internet of Things has become an important direction for the development of power communications. The interaction and connection between power terminals and distribution master stations enable the perception and feedback control of power-related data, thereby forming an overall power production system. However, there are attackers who forge terminal identities to maliciously damage distribution master stations. In addition, the information uploaded by attackers to the master station can easily cause the master station to issue control instructions that do not match actual needs, so that the power grid cannot operate safely and stably. Summary of the invention

[0003] In view of this, the present application provides a terminal network layer and application layer trusted access method and a terminal network layer and application layer trusted access system for maintaining the safe and stable operation of the power grid.

[0004] In order to achieve the above objectives, the proposed solution is as follows:

[0005] A terminal network layer and application layer trusted access method, the method is applied to a gateway device, the gateway device is configured with encryption card driver hardware, including:

[0006] The first authentication information sent by the network layer of the receiving terminal;

[0007] Generate second authentication information according to the first authentication information;

[0008] sending the second authentication information to the terminal;

[0009] Receiving third authentication information sent by the application layer of the terminal;

[0010] Generate a symmetric key according to the first authentication information, the second authentication information and the third authentication information;

[0011] Generate first end information using the symmetric key;

[0012] Sending the first end information to the terminal so that the application layer of the terminal generates a session key according to the first authentication information, the second authentication information and the third authentication information; decrypting the first end information using the session key to obtain a decryption result, and after confirming that the decryption result is correct, sending second end information to the gateway device, wherein the second end information is generated based on the session key, and the session key is used to encrypt the transmitted data;

[0013] Decrypting the second end information using the symmetric key to obtain decrypted data;

[0014] Verify the correctness of the decrypted data. After verifying that the decrypted data is correct, the terminal accesses the main station corresponding to the gateway device as a trusted terminal, and the symmetric key is used to decrypt the data transmitted by the terminal to obtain the data reported by the gateway device to the main station.

[0015] Optionally, generating a symmetric key according to the first authentication information, the second authentication information, and the third authentication information includes:

[0016] The encryption card driver hardware is called to generate a symmetric key according to the first authentication information, the second authentication information and the third authentication information.

[0017] Optionally, the first authentication information includes an identifier of an encryption method supported by the terminal and an SSL protocol version number, and a first random number;

[0018] Generating second authentication information according to the first authentication information includes:

[0019] According to the identifier of the encryption method supported by the terminal and the identifier of the encryption method supported by the gateway device in the first authentication information, selecting any encryption method supported by the terminal and the gateway device as the target encryption method, and the target encryption method is used to encrypt the data exchanged between the terminal and the gateway device;

[0020] generating a second random number;

[0021] Determine a first CA root certificate that matches the SSL protocol version number;

[0022] The second authentication information is generated based on the identifier of the target encryption method, the first CA root certificate, and the second random number.

[0023] Optionally, the third authentication information includes a third random number;

[0024] The generating a symmetric key according to the first authentication information, the second authentication information and the third authentication information includes:

[0025] The target encryption method is used to encrypt the first random number in the first authentication information, the second random number in the second authentication information, and the third random number in the third authentication information to obtain an encrypted string, and the encrypted string is used as a symmetric key.

[0026] Optionally, the third authentication information also includes a second CA root certificate corresponding to the terminal;

[0027] Before using the target encryption method to encrypt the first random number in the first authentication information, the second random number in the second authentication information, and the third random number in the third authentication information to obtain an encrypted string, the method further includes:

[0028] Verifying the validity of the second CA root certificate to obtain a verification result;

[0029] After the verification result indicates that the second CA root certificate is reliable, return to the step of using the target encryption method to encrypt the first random number in the first authentication information, the second random number in the second authentication information, and the third random number in the third authentication information to obtain an encrypted string.

[0030] A terminal network layer and application layer trusted access system, including a terminal and a gateway device;

[0031] The terminal is used to send first authentication information to the gateway device by using the network layer; after verifying that the second authentication information sent by the gateway device is correct, send third authentication information to the gateway device by using the application layer; after receiving the first end information sent by the gateway device, generate a session key by using the application layer according to the first authentication information, the second authentication information and the third authentication information, verify the first end information by using the application layer based on the session key to obtain a verification result, and after the verification result shows that the first end information is correct, generate second end information by using the application layer based on the session key, send the second end information to the gateway device, and after the gateway device verifies that the second end information is correct, the terminal accesses the main station corresponding to the gateway device as a trusted terminal; the session key is used to encrypt the transmitted data;

[0032] The gateway device is used to generate second authentication information based on the first authentication information, and send the second authentication information to the terminal; and after verifying that the third authentication information is correct, generate a symmetric key based on the first authentication information, the second authentication information and the third authentication information, and generate first end information based on the symmetric key, and send the first end information to the terminal; after receiving the second end information, use the symmetric key to verify the second end information, and after verifying that the second end information is correct, determine that the terminal is a trusted terminal; the symmetric key is used to decrypt data transmitted by the terminal and send the decrypted result to the main station.

[0033] Optionally, the application layer is configured with security chip hardware;

[0034] The security chip hardware is used to generate a session key based on the first authentication information, the second authentication information and the third authentication information, verify the first end information based on the session key to obtain a verification result, and generate the second end information based on the session key after the verification result shows that the first end information is correct.

[0035] Optionally, the gateway device is configured with encryption card driver hardware;

[0036] The encryption card driver hardware is used to generate the symmetric key according to the first authentication information, the second authentication information and the third authentication information after verifying that the third authentication information is correct, and generate the first end information based on the symmetric key; and use the symmetric key to verify the second end information.

[0037] Optionally, the first authentication information includes a first random number, the second authentication information includes a second random number, and the third authentication information includes a third random number;

[0038] The encryption card driving hardware is used to generate the symmetric key according to the first random number of the first authentication information, the second random number of the second authentication information and the third random number of the third authentication information after verifying that the third authentication information is correct, and generate the first end information based on the symmetric key; and verify the second end information using the symmetric key;

[0039] The security chip hardware is used to generate a session key based on the first random number of the first authentication information, the second random number of the second authentication information and the third random number of the third authentication information, verify the first end information based on the session key to obtain a verification result, and generate the second end information based on the session key after the verification result shows that the first end information is correct.

[0040] Optionally, the first authentication information further includes the SSL protocol version number supported by the terminal; the second authentication information further includes the first CA root certificate of the gateway device matching the SSL protocol version number; the third authentication information further includes the second CA root certificate of the terminal;

[0041] The terminal is further used to verify the validity of the first CA root certificate of the second authentication information, so as to verify whether the second authentication information sent by the gateway device is correct;

[0042] The gateway device is also used to verify the validity of the second CA root certificate of the third authentication information to verify whether the third authentication information is correct.

[0043] It can be seen from the above technical solutions that the terminal network layer and application layer trusted access method provided by the present application is applied to a gateway device equipped with encryption card driver hardware. The method can generate a symmetric key using the first authentication information, the second authentication information and the third authentication information of the interaction during the interaction between the gateway device and the terminal, and determine the correctness of the symmetric key through the first end information and the second end information, and then use the second end information sent by the terminal to determine whether the session key generated by the terminal matches the symmetric key generated by the gateway device. In this way, the present application realizes the key distribution in the process of information encryption transmission. The symmetric key generated by the gateway device is used to decrypt the data transmitted by the terminal, and the decrypted result is sent to the main station. In this way, the present application can not only use the gateway device to authenticate the terminal, but also establish a secure channel between the trusted terminal and the main station to avoid the situation where criminals forge the interaction between the terminal and the main station, thereby maintaining the safe and stable operation of the power grid.

[0044] In addition, the gateway device of the present application can directly use the symmetric key agreed with the terminal for decryption, and the main station does not need to decrypt the data transmitted by the terminal, which greatly reduces the working pressure of the main station. It can be seen that the gateway device of the present application can reduce the working pressure of the main station on the basis of preventing the interactive data between the terminal and the main station from being identified, stolen or tampered. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0046] Figure 1 A flow chart of a terminal network layer and application layer trusted access method disclosed in an embodiment of the present application;

[0047] Figure 2 This is a system architecture diagram of a terminal network layer and application layer trusted access system disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] The terminal network layer and application layer trusted access method provided by the present application can be applied to various types of gateway devices. The gateway device can be configured with encryption card driver hardware, and the encryption card driver hardware is used to realize the encryption and decryption of the information interacted between the terminal and the main station. The encryption card driver hardware can be equipped with a relay protection operating system, which is a special system running in the encryption card driver hardware, used to control the information exchange between the encryption card driver hardware and the outside world.

[0050] Next, combine Figure 1 The terminal network layer and application layer trusted access method of the present application is described in detail, including the following steps:

[0051] Step S1: receiving first authentication information sent by a terminal.

[0052] Specifically, the first authentication information sent by each terminal may be directly received, and the terminal may be a power terminal, such as a fault identifier terminal.

[0053] Among them, the first authentication information sent by the network layer of the terminal can be received.

[0054] Step S2: Generate second authentication information based on the first authentication information.

[0055] Specifically, the first authentication information may be analyzed, and based on the analysis result of the first authentication information, the second authentication information may be generated. The second authentication information may be used to identify the legitimacy of the identity of the gateway device.

[0056] The second authentication information may be information generated by the encryption card driver hardware based on the first authentication information.

[0057] Step S3: Send the second authentication information to the terminal.

[0058] Specifically, the second authentication information may be sent to the terminal, which is the terminal that sends the first authentication information.

[0059] Step S4: Receive the third authentication information sent by the terminal.

[0060] Specifically, the third authentication information sent by the terminal may be directly received, and the third authentication information may be used to identify the legitimacy of the identity of the terminal.

[0061] Among them, the third authentication information sent by the application layer of the terminal can be received.

[0062] Step S5: Generate a symmetric key according to the first authentication information, the second authentication information and the third authentication information.

[0063] Specifically, a symmetric key may be generated based on the first authentication information and the second authentication information sent by the terminal and the second authentication information generated by the gateway device. The symmetric key is used to decrypt data encrypted by the terminal to achieve secure communication between the gateway device and the terminal.

[0064] Step S6: Generate first end information using the symmetric key.

[0065] Specifically, the end data may be encrypted using the symmetric key to obtain first end information corresponding to the gateway device. The end data may include a result of the gateway device verifying the integrity of the handshake process and may also include a negotiation end instruction.

[0066] The encryption card driver hardware may be called to encrypt the result of the gateway device verifying the integrity of the handshake process and / or the negotiation end instruction using a symmetric key to obtain the first end information.

[0067] Step S7: Send the first end information to the terminal.

[0068] Specifically, the generated first end information can be sent to the terminal so that the application layer of the terminal can generate a session key based on the first authentication information, the second authentication information and the third authentication information; the application layer of the terminal can use the session key to decrypt the first end information to obtain a decryption result, and after confirming that the decryption result is correct, send the second end information to the gateway device. The second end information can be obtained by encrypting the end string using the session key, and the end string can indicate that the terminal has generated a session key, and can also indicate that the terminal has successfully decrypted the first end information using the session key, and the session key is used to encrypt the transmitted data.

[0069] The key distribution is achieved through the first authentication information, the second authentication information and the third authentication information, wherein the generation method of the session key is consistent with that of the symmetric key. Therefore, the contents contained in the session key and the symmetric key may be consistent, but the session key corresponds to the terminal device and the symmetric key corresponds to the gateway device.

[0070] Step S8: Decrypt the second end information using the symmetric key to obtain decrypted data.

[0071] Specifically, the symmetric key may be used as a decryption key to decrypt the second end information to obtain decrypted data, which is plain text data.

[0072] The encryption card driver hardware may be called to decrypt the second end information using a symmetric key to obtain decrypted data.

[0073] Step S9: verify the correctness of the decrypted data.

[0074] Specifically, the data plaintext has a certain format, and thus the correctness of the decrypted data can be determined based on whether the format of the decrypted data is correct.

[0075] When the format of the decrypted data is correct, it can be considered that the decrypted data is correct, indicating that the session key generated by the terminal is correct, thereby confirming that the terminal is a trusted terminal so that the terminal can access the main station corresponding to the gateway device as a trusted terminal. The symmetric key is used to decrypt the data transmitted by the terminal to obtain decrypted information.

[0076] The decrypted information is data that can be reported to the main station by the gateway device. Meanwhile, the gateway device can also analyze the decrypted information to obtain the reported data to be reported to the main station.

[0077] After the terminal is a trusted terminal connected to the main station, the data it reports to the gateway device can be decrypted, and the reported data sent by the gateway device to the main station can be plain text. The reported data can be generated based on the encrypted data sent by the terminal connected to the main station, so as to reduce the working pressure of the main station while ensuring secure communication.

[0078] It can be seen from the above technical scheme that the embodiment of the present application provides a terminal network layer and application layer trusted access method, which is applied to a gateway device equipped with encryption card driver hardware. The method can generate a symmetric key using the first authentication information, the second authentication information and the third authentication information of the interaction during the interaction between the gateway device and the terminal, and determine the correctness of the symmetric key through the first end information and the second end information, and then use the second end information sent by the terminal to determine whether the session key generated by the terminal matches the symmetric key generated by the gateway device. In this way, the present application completes the two-way identity authentication between the terminal and the gateway device, and also realizes the key distribution during the information encryption transmission process. The symmetric key generated by the gateway device is used to decrypt the data transmitted by the terminal, and the result obtained after decryption is sent to the main station. In this way, the present application can not only use the gateway device to authenticate the terminal, but also establish a secure channel between the trusted terminal and the main station to avoid the situation where criminals forge the interaction between the terminal and the main station, thereby maintaining the safe and stable operation of the power grid.

[0079] In addition, the gateway device of the present application can directly use the symmetric key agreed with the terminal for decryption, and the main station does not need to decrypt the data transmitted by the terminal, which greatly reduces the working pressure of the main station. It can be seen that the gateway device of the present application can reduce the working pressure of the main station on the basis of preventing the interactive data between the terminal and the main station from being identified, stolen or tampered.

[0080] In some embodiments of the present application, the process of generating the second authentication information according to the first authentication information in step S2 is described in detail, and the steps are as follows:

[0081] S20. According to the identifier of the encryption method supported by the terminal and the identifier of the encryption method supported by the gateway device in the first authentication information, select any encryption method supported by both the terminal and the gateway device as the target encryption method, and the target encryption method is used to encrypt data exchanged between the terminal and the gateway device.

[0082] Specifically, the first authentication information may include an identifier of an encryption method supported by the terminal, a version number of an SSL protocol supported by the terminal, and a first random number.

[0083] The encryption methods supported by the gateway device can be determined, and any encryption method can be selected as the target encryption method from the encryption methods supported by both the gateway device and the terminal.

[0084] The target encryption method can be national encryption algorithm SM1, national encryption algorithm SM2, national encryption algorithm SM3 or national encryption algorithm SM4.

[0085] S21. Generate a second random number.

[0086] Specifically, the encryption card driver hardware may be used to randomly generate a 32-bit random number, and the 32-bit random number may be used as the second random number.

[0087] S22. Determine a first CA root certificate that matches the SSL protocol version number.

[0088] Specifically, according to the SSL protocol version number supported by the terminal, the CA root certificate corresponding to the SSL protocol version number is called in the gateway device.

[0089] There may be multiple SSL protocol version numbers supported by the terminal, and the selected first CA root certificate may correspond to any SSL protocol version number.

[0090] S23. Generate the second authentication information based on the identifier of the target encryption method, the first CA root certificate, and the second random number.

[0091] Specifically, second authentication information may be generated, the second authentication information including an identifier of a target encryption method, a first CA root certificate, and a second random number.

[0092] It can be seen from the above technical solution that this embodiment provides an optional method for generating second authentication information. It can be seen from the above process that the second authentication information in this embodiment may include the first CA root certificate corresponding to the gateway device, and the first CA root certificate can be used to identify the legitimacy of the identity of the gateway device so that the terminal and the gateway device can perform identity authentication. The second authentication information may also include a second random number, which can be used to generate a symmetric key. The second authentication information may also include an identifier of the target encryption method, which can help the terminal and the gateway device agree on the encryption method during the interaction process to achieve secure transmission of information.

[0093] In some embodiments of the present application, step S5, a process of generating a symmetric key according to the first authentication information, the second authentication information and the third authentication information is described in detail, and the steps are as follows:

[0094] S50: Call the encryption card driver hardware to generate a symmetric key according to the first authentication information, the second authentication information and the third authentication information.

[0095] Specifically, the symmetric key may be a character string generated by the encryption card driver hardware based on the first authentication information, the second authentication information, and the third authentication information.

[0096] It can be seen from the above technical solution that the hardware in the gateway device can be used to generate a symmetric key in this application, and the cos system of the encryption card driver hardware can protect the symmetric key in the encryption card driver hardware from being read by the outside world, thereby preventing the leakage of the symmetric key. Therefore, the encryption card driver hardware is used to implement hardware encryption and decryption, which improves the security of the gateway device.

[0097] In some embodiments of the present application, step S5, a process of generating a symmetric key according to the first authentication information, the second authentication information and the third authentication information is described in detail, and the steps are as follows:

[0098] S50. Use the target encryption method to encrypt the first random number in the first authentication information, the second random number in the second authentication information, and the third random number in the third authentication information to obtain an encrypted string, and use the encrypted string as a symmetric key.

[0099] Specifically, the third authentication information may include a third random number generated by the terminal. Further, the third authentication information may include an encrypted third random number, and the gateway device may decrypt the encrypted third random number using a target encryption method to obtain the third random number.

[0100] Therefore, the first random number can be encrypted using the target encryption method to obtain a first encrypted string;

[0101] Encrypt the second random number using the target encryption method to obtain a second encrypted string;

[0102] Encrypt the third random number using the target encryption method to obtain a third encrypted string;

[0103] The first encrypted string, the second encrypted string and the third encrypted string are combined to obtain a total encrypted string, which may be a symmetric key.

[0104] It should be noted that the first random number, the second random number and the third random number are three random numbers involved in the negotiation process between the terminal and the gateway device, but there is no size relationship between the first random number, the second random number and the third random number. Similarly, the first authentication information is the information first sent by the terminal to the gateway device, the second authentication information is the information sent to the terminal after the gateway device receives the first authentication information, and the third authentication information is the information sent to the gateway device after the terminal receives the second authentication information, but there is no size relationship between the first authentication information, the second authentication information and the third authentication information.

[0105] It can be seen from the above technical solution that this embodiment provides an optional way to generate a symmetric key, which can be generated by using the target encryption method, the first random number, the second random number, and the third random number agreed upon in the negotiation process between the gateway device and the terminal, thereby improving the randomness of the symmetric key. The encryption of multiple random numbers by the target encryption method improves the confidentiality of the symmetric key, and the symmetric key is not directly issued, but directly generated by the gateway device, further reducing the risk of the key being stolen and leaked.

[0106] In some embodiments of the present application, considering that after the terminal verifies the legitimacy of the identity of the gateway device, the gateway device may also verify the legitimacy of the identity of the terminal device. Therefore, before generating the symmetric key in step S50, the legitimacy verification process of the identity of the terminal device may be added. Next, the process will be described in detail. The steps are as follows:

[0107] S51. Verify the validity of the second CA root certificate to obtain a verification result. If the verification result indicates that the second CA root certificate is reliable, return to step S50.

[0108] Specifically, the third authentication information may include, in addition to the third random number, a second CA root certificate corresponding to the terminal.

[0109] The encryption card driver hardware can be used to read the signature of the private key in the second CA root certificate, and the public key in the second CA root certificate can be used to verify the signature to obtain a verification result.

[0110] The verification result is signature verification passed or signature verification failed.

[0111] When the verification result is that the signature verification is passed, it indicates that the second CA root certificate is reliable, and the identity of the terminal can be considered to be legal and reliable. At this time, the process can return to step S50.

[0112] If the verification result is that the signature verification fails, indicating that the second CA root certificate is unreliable, the gateway device can generate a request instruction, which indicates the request for the CA root certificate of the terminal. When the CA root certificate returned by the terminal is still unreliable, the interaction process with the terminal is stopped.

[0113] It can be seen from the above technical solution that this embodiment adds an optional method to verify whether the terminal is reliable. Through the above method, the legitimacy of the terminal's identity can be further verified to ensure the reliability of the terminal, further improve the reliability of this application, and ensure the safe and stable operation of the power grid.

[0114] The above-mentioned gateway device may be one of the components of the terminal network layer and application layer trusted access system described below. In addition, the terminal network layer and application layer trusted access system described below may also include the terminal mentioned above.

[0115] Next, we will combine Figure 2 The terminal network layer and application layer trusted access system provided in this application is described in detail.

[0116] See also Figure 2 The terminal network layer and application layer trusted access system of the present application may be composed of a terminal 10 and a gateway device 20.

[0117] Among them, one gateway device 20 can correspond to multiple terminals 10, and the gateway device 20 can correspond to the main station, collect the information transmitted by the terminal 10 to the main station, and realize the information interaction between the terminal 10 and the main station.

[0118] The master station and the gateway device 20 generally exchange information through a wireless network, which may be a third-generation mobile communication network or a general packet radio service technology network. The gateway device 20 and the terminal 10 generally transmit data through a local home area network, which may be a power carrier communication or a radio frequency network.

[0119] Next, the functions of the terminal 10 and the gateway device 20 will be described in detail.

[0120] The terminal 10 can be used to use the network layer to send the first authentication information to the gateway device 20; after verifying that the second authentication information sent by the gateway device 20 is correct, use the application layer to send the third authentication information to the gateway device 20; after receiving the first end information sent by the gateway device 20, use the application layer to generate a session key according to the first authentication information, the second authentication information and the third authentication information, use the application layer to verify the first end information based on the session key to obtain a verification result, and after the verification result shows that the first end information is correct, use the application layer to generate second end information based on the session key, send the second end information to the gateway device 20, and after the gateway device 20 verifies that the second end information is correct, access the main station corresponding to the gateway device 20 as a trusted terminal; the session key is used to encrypt the transmitted data.

[0121] The gateway device 20 can be used to generate second authentication information based on the first authentication information, and send the second authentication information to the terminal 10; and after verifying that the third authentication information is correct, generate the symmetric key based on the first authentication information, the second authentication information and the third authentication information, and generate first end information based on the symmetric key, and send the first end information to the terminal 10; after receiving the second end information, use the symmetric key to verify the second end information, and after verifying that the second end information is correct, determine that the terminal 10 is a trusted terminal; the symmetric key is used to decrypt data transmitted by the terminal 10.

[0122] When the terminal 10 is not connected to the main station, it can send the first authentication information, the third authentication information and the second end information to the gateway device 20 for identity authentication and key negotiation. The gateway device 20 can send the second authentication information and the first end information to the terminal 10 that is not connected to the main station to complete the identity authentication and key negotiation of the terminal 10.

[0123] After the terminal 10 accesses the main station, the terminal 10 can send information encrypted using the session key to the gateway device 20. The gateway device 20 can decrypt the information using the symmetric key corresponding to the terminal 10 to generate information to be reported to the main station so that the main station can issue instructions to maintain the safe and stable operation of the power grid.

[0124] Through the above-mentioned technical scheme, the terminal 10 and the gateway device 20 provided in the present application can complete the identity authentication and negotiation process through information interaction to ensure that after the subsequent terminal 10 accesses the main station, it can use the session key and the symmetric key to communicate securely with the main station, avoid information leakage and tampering, and avoid illegal devices from forging the interaction between the terminal and the main station.

[0125] In addition, the gateway device 20 of the present application can negotiate a symmetric key, and the terminal 10 can agree on a session key with the gateway device 20. After that, the gateway device 20 of the present application can directly use the symmetric key to decrypt the data transmitted by the terminal 10, and the main station does not need to decrypt the data transmitted by the terminal, which greatly reduces the working pressure of the main station.

[0126] In some embodiments of the present application, the application layer in the terminal 10 may be configured with security chip hardware.

[0127] The security chip hardware can be used to generate a session key based on the first authentication information, the second authentication information and the third authentication information, verify the first end information based on the session key to obtain a verification result, and generate the second end information based on the session key after the verification result shows that the first end information is correct.

[0128] Specifically, the security chip hardware can generate a session key, decrypt the first end information using the session key, and encrypt the second end information using the session key. Therefore, when the terminal 10 accesses the main station, the security chip hardware can be used to encrypt and decrypt the transmitted data.

[0129] It can be seen from the above technical solution that the embodiment of the present application provides an optional method for generating a session key, through which the COS system of the security chip hardware can be used to protect the session key from being read by the outside world, thereby preventing the session key from being leaked. Therefore, the use of security chip hardware to implement hardware encryption and decryption improves the security of the terminal 10.

[0130] In some embodiments of the present application, the gateway device 20 is configured with encryption card driver hardware.

[0131] The encryption card driver hardware can be used to generate the symmetric key according to the first authentication information, the second authentication information and the third authentication information after verifying that the third authentication information is correct, and generate the first end information based on the symmetric key; and use the symmetric key to verify the second end information.

[0132] Specifically, the encryption card driver hardware can generate a symmetric key, and use the symmetric key to encrypt and generate the first end information, and can also use the symmetric key to decrypt the second end information. Therefore, when the terminal 10 is connected to the main station, the encryption card driver hardware can be used to encrypt and decrypt the received data corresponding to the terminal 10.

[0133] It can be seen from the above technical solution that this embodiment provides an optional way to generate a symmetric key, through which the symmetric key can be protected from leaving the encryption card driver hardware and cannot be read and leaked by the outside world. Therefore, the encryption and decryption of the encryption card driver hardware is adopted to improve the security of the gateway device 20.

[0134] In some embodiments of the present application, the first authentication information may include a first random number, the second authentication information may include a second random number, and the third authentication information may include a third random number.

[0135] The encryption card driver hardware can be used to generate the symmetric key according to the first random number of the first authentication information, the second random number of the second authentication information and the third random number of the third authentication information after verifying that the third authentication information is correct, and generate the first end information based on the symmetric key; and use the symmetric key to verify the second end information.

[0136] The security chip hardware can be used to generate a session key based on the first random number of the first authentication information, the second random number of the second authentication information, and the third random number of the third authentication information, verify the first end information based on the session key to obtain a verification result, and generate the second end information based on the session key after the verification result indicates that the first end information is correct.

[0137] The encryption card driver hardware and the security chip hardware need to generate a key using the first random number, the second random number and the third random number generated during the negotiation process between the gateway device 20 and the terminal 10 .

[0138] It can be seen from the above technical solution that this embodiment provides an optional method for generating a symmetric key and a session key. Through the above method, the random number generated in the negotiation process can be used to generate the key, further ensuring the confidentiality of the key.

[0139] In some embodiments of the present application, the first authentication information also includes the SSL protocol version number supported by the terminal 10; the second authentication information also includes the first CA root certificate of the gateway device 20 that matches the SSL protocol version number; and the third authentication information also includes the second CA root certificate of the terminal 10.

[0140] The terminal 10 may also be used to verify the validity of the first CA root certificate of the second authentication information to verify whether the second authentication information sent by the gateway device is correct.

[0141] The correctness of the signature in the first CA root certificate can be verified by the public key in the first CA root certificate to verify the validity of the first CA root certificate of the second authentication information. When the signature is correct, it is confirmed that the second authentication information sent by the gateway device 20 is correct.

[0142] The gateway device 20 may also be used to verify the validity of the second CA root certificate of the third authentication information to verify whether the third authentication information is correct.

[0143] The correctness of the signature in the second CA root certificate can be verified by the public key in the second CA root certificate to verify the validity of the second CA root certificate of the third authentication information. When the signature is correct, it is confirmed that the third authentication information sent by the terminal 10 is correct.

[0144] It can be seen from the above technical solution that this embodiment provides an optional method for verifying the second authentication information and the third authentication information. Through the above method, the first CA root certificate in the second authentication information and the second CA root certificate in the third authentication information can be used to complete the verification, further improving the reliability of the present application.

[0145] Next, the negotiation process between the terminal 10 and the gateway device 20 will be described in detail. The steps are as follows:

[0146] S1. The terminal 10 sends first authentication information to the gateway device.

[0147] Specifically, when the terminal 10 wants to participate in the negotiation, it can send the first authentication information to the gateway device 20 .

[0148] Among them, the security chip hardware of the terminal 10 can generate a first random number and determine the supported encryption method;

[0149] The terminal 10 can determine the supported SSL protocol version number;

[0150] The terminal 10 may generate the first authentication information according to the first random number, the supported encryption method and the SSL protocol version number.

[0151] The first authentication information may include an identifier of an encryption method supported by the terminal 10, a version number of the SSL protocol supported by the terminal 10, and a first random number.

[0152] S2. The gateway device 20 generates second authentication information according to the first authentication information, and sends the second authentication information to the terminal 10.

[0153] Specifically, the gateway device 20 can determine the encryption methods supported by the encryption card driver hardware, and determine one or more encryption methods supported by both the security chip hardware and the encryption card driver hardware based on the encryption methods supported by the encryption card driver hardware and the identifier of the encryption method in the first authentication information. The encryption card driver hardware can randomly select an encryption method from the encryption methods as the target encryption method.

[0154] The encryption card driver hardware can generate a second random number;

[0155] The gateway device 20 calls the first CA root certificate that matches the SSL protocol version number;

[0156] The gateway device 20 generates second authentication information according to the target encryption method, the second random number and the first CA root certificate, and sends the second authentication information to the terminal 10 .

[0157] S3. The terminal 10 verifies whether the second authentication information is correct, and after determining that the second authentication information is correct, sends the third authentication information to the gateway device 20.

[0158] Specifically, the terminal 10 determines whether the second authentication information is correct by verifying whether the first CA root certificate in the second authentication information is correct, that is, after the first CA root certificate is correct, the second authentication information is determined to be correct, and the identity legitimacy of the gateway device 20 is determined.

[0159] The security chip hardware may generate a third random number and encrypt the third random number using a target encryption method.

[0160] The terminal 10 may call the second CA root certificate corresponding to the terminal 10 .

[0161] The third authentication information is generated according to the encrypted third random number and the second CA root certificate, and the third authentication information is sent to the gateway device 20 .

[0162] S4. The gateway device 20 verifies whether the third authentication information is correct, and after confirming that the third authentication information is correct, generates a symmetric key according to the first authentication information, the second authentication information and the third authentication information, generates a first end information based on the symmetric key, and sends the first end information to the terminal.

[0163] Specifically, the gateway device 20 can determine whether the third authentication information is correct by verifying whether the second CA root certificate in the third authentication information is correct, that is, after the second CA root certificate is correct, determine that the third authentication information is correct and determine the legitimacy of the identity of the terminal 10.

[0164] After determining that the identity of the terminal 10 is legitimate, a symmetric key may be generated according to the target encryption method, the first random number, the second random number, and the third random number.

[0165] The symmetric key and the target encryption method may be used to encrypt the result of the gateway device 20 verifying the integrity of the handshake process and / or the negotiation end instruction to obtain the first end information, and send the first end information to the terminal 10.

[0166] S5. The terminal 10 generates a session key according to the first authentication information, the second authentication information and the third authentication information, verifies the first end information based on the session key to obtain a verification result, and after the verification result shows that the first end information is correct, generates second end information based on the session key, and sends the second end information to the gateway device.

[0167] Specifically, the security chip hardware of the terminal 10 generates a session key according to the target encryption method, the first random number, the second random number, and the third random number.

[0168] The security chip hardware decrypts the first end information using the target encryption method and the session key to obtain a decryption result, verifies whether the format of the decryption result is correct, and obtains a verification result.

[0169] When the verification result is that the format is correct, it indicates that the first end information is correct. At this time, the security chip hardware can encrypt the end string based on the target encryption method and the session key to obtain the second end information. The end string can indicate that the terminal has generated a session key and can also indicate that the terminal has successfully decrypted the first end information using the session key.

[0170] The terminal 10 may send second end information to the gateway device 20 .

[0171] S6. The gateway device 20 verifies the second end information by using the symmetric key, and after verifying that the second end information is correct, determines that the terminal 10 is a trusted terminal.

[0172] Specifically, the gateway device 20 may use the symmetric key and the target encryption method to decrypt the second end information to obtain decrypted data.

[0173] After determining that the format of the decrypted data is correct, it can be determined that the second end information is correct. At this time, it can be confirmed that the terminal 10 is a trusted terminal.

[0174] S7. The terminal 10 accesses the main station corresponding to the gateway device 20 as a trusted terminal.

[0175] Specifically, after the negotiation is successful, the terminal 10 accesses the main station corresponding to the gateway device 20 as a trusted terminal.

[0176] After accessing the main station, the terminal 10 can use the target encryption method and the session key to encrypt the transmitted data and decrypt the instructions issued by the gateway device 20.

[0177] The gateway device 20 can use the target encryption method and the symmetric key to decrypt the data uploaded by the terminal 10 and report it to the main station, and use the target encryption method and the symmetric key to encrypt the instructions issued by the main station and send them to the terminal 10.

[0178] It can be seen from the above technical solution that the present embodiment provides a negotiation process between the terminal 10 and the gateway device 20, through which the key distribution, the identity authentication of the terminal 10 to the gateway device 20 and the identity authentication of the gateway device 20 to the terminal 10 can be further completed, thereby realizing secure communication between the terminal 10 and the master station. In addition, by sending and decrypting the first end information and the second end information, the correctness of the symmetric key and the session key can be verified, further improving the security and reliability of communication.

[0179] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0180] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0181] The above description of the disclosed embodiments enables professionals and technicians in the field to implement or use the present application. Various modifications to these embodiments will be apparent to professionals and technicians in the field, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. The various embodiments of the present application can be combined with each other. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A terminal network layer and application layer trusted access method, characterized in that: The method is applied to a gateway device, wherein the gateway device is configured with encryption card driver hardware, and includes: The first authentication information sent by the network layer of the receiving terminal; Generate second authentication information according to the first authentication information; sending the second authentication information to the terminal; Receiving third authentication information sent by the application layer of the terminal; Generate a symmetric key according to the first authentication information, the second authentication information and the third authentication information; Generate first end information using the symmetric key; Sending the first end information to the terminal so that the application layer of the terminal generates a session key according to the first authentication information, the second authentication information and the third authentication information; decrypting the first end information using the session key to obtain a decryption result, and after confirming that the decryption result is correct, sending second end information to the gateway device, wherein the second end information is generated based on the session key, and the session key is used to encrypt the transmitted data; Decrypting the second end information using the symmetric key to obtain decrypted data; Verify the correctness of the decrypted data. After verifying that the decrypted data is correct, the terminal accesses the main station corresponding to the gateway device as a trusted terminal, and the symmetric key is used to decrypt the data transmitted by the terminal to obtain the data reported by the gateway device to the main station.

2. The terminal network layer and application layer trusted access method according to claim 1, characterized in that: Generating a symmetric key according to the first authentication information, the second authentication information, and the third authentication information, including: The encryption card driver hardware is called to generate a symmetric key according to the first authentication information, the second authentication information and the third authentication information.

3. The terminal network layer and application layer trusted access method according to claim 1, characterized in that: The first authentication information includes an identifier of an encryption method supported by the terminal and an SSL protocol version number, and a first random number; Generating second authentication information according to the first authentication information includes: According to the identifier of the encryption method supported by the terminal and the identifier of the encryption method supported by the gateway device in the first authentication information, selecting any encryption method supported by the terminal and the gateway device as the target encryption method, and the target encryption method is used to encrypt the data exchanged between the terminal and the gateway device; generating a second random number; Determine a first CA root certificate that matches the SSL protocol version number; The second authentication information is generated based on the identifier of the target encryption method, the first CA root certificate, and the second random number.

4. The terminal network layer and application layer trusted access method according to claim 3, characterized in that: The third authentication information includes a third random number; The generating a symmetric key according to the first authentication information, the second authentication information and the third authentication information includes: The target encryption method is used to encrypt the first random number in the first authentication information, the second random number in the second authentication information, and the third random number in the third authentication information to obtain an encrypted string, and the encrypted string is used as a symmetric key.

5. The terminal network layer and application layer trusted access method according to claim 4, characterized in that: The third authentication information also includes a second CA root certificate corresponding to the terminal; Before using the target encryption method to encrypt the first random number in the first authentication information, the second random number in the second authentication information, and the third random number in the third authentication information to obtain an encrypted string, the method further includes: Verifying the validity of the second CA root certificate to obtain a verification result; After the verification result indicates that the second CA root certificate is reliable, return to the step of using the target encryption method to encrypt the first random number in the first authentication information, the second random number in the second authentication information, and the third random number in the third authentication information to obtain an encrypted string.

6. A terminal network layer and application layer trusted access system, characterized in that: Including terminal and gateway equipment; The terminal is used to send first authentication information to the gateway device by using the network layer; after verifying that the second authentication information sent by the gateway device is correct, send third authentication information to the gateway device by using the application layer; after receiving the first end information sent by the gateway device, generate a session key by using the application layer according to the first authentication information, the second authentication information and the third authentication information, verify the first end information by using the application layer based on the session key to obtain a verification result, and after the verification result shows that the first end information is correct, generate second end information by using the application layer based on the session key, send the second end information to the gateway device, and after the gateway device verifies that the second end information is correct, access the main station corresponding to the gateway device as a trusted terminal; the session key is used to encrypt the transmitted data; The gateway device is used to generate second authentication information according to the first authentication information, and send the second authentication information to the terminal; After verifying that the third authentication information is correct, a symmetric key is generated according to the first authentication information, the second authentication information and the third authentication information, and first end information is generated based on the symmetric key, and the first end information is sent to the terminal; after receiving the second end information, the second end information is verified using the symmetric key, and after verifying that the second end information is correct, the terminal is determined to be a trusted terminal; the symmetric key is used to decrypt data transmitted by the terminal.

7. The terminal network layer and application layer trusted access system according to claim 6, characterized in that: The application layer is configured with security chip hardware; The security chip hardware is used to generate a session key based on the first authentication information, the second authentication information and the third authentication information, verify the first end information based on the session key to obtain a verification result, and generate the second end information based on the session key after the verification result shows that the first end information is correct.

8. The terminal network layer and application layer trusted access system according to claim 7, characterized in that: The gateway device is configured with encryption card driver hardware; The encryption card driving hardware is used to generate the symmetric key according to the first authentication information, the second authentication information and the third authentication information after verifying that the third authentication information is correct, and generate the first end information based on the symmetric key; The second end information is verified using the symmetric key.

9. The terminal network layer and application layer trusted access system according to claim 8, characterized in that: The first authentication information includes a first random number, the second authentication information includes a second random number, and the third authentication information includes a third random number; The encryption card driving hardware is used to generate the symmetric key according to the first random number of the first authentication information, the second random number of the second authentication information and the third random number of the third authentication information after verifying that the third authentication information is correct, and generate the first end information based on the symmetric key; Verifying the second end information using a symmetric key; The security chip hardware is used to generate a session key based on the first random number of the first authentication information, the second random number of the second authentication information and the third random number of the third authentication information, verify the first end information based on the session key to obtain a verification result, and generate the second end information based on the session key after the verification result shows that the first end information is correct.

10. The terminal network layer and application layer trusted access system according to claim 9, characterized in that: The first authentication information also includes the SSL protocol version number supported by the terminal; the second authentication information also includes the first CA root certificate of the gateway device matching the SSL protocol version number; the third authentication information also includes the second CA root certificate of the terminal; The terminal is further used to verify the validity of the first CA root certificate of the second authentication information, so as to verify whether the second authentication information sent by the gateway device is correct; The gateway device is also used to verify the validity of the second CA root certificate of the third authentication information to verify whether the third authentication information is correct.

Images