Identity recognition system and method for electronic devices

Abstract

The application provides an identity recognition system and method of an electronic device, the system comprising a server end, an electronic device end and a secure password device, the system being configured to perform the following operations: the electronic device end performs a secure verification operation through the secure password device and the server end, and generates identity data of the electronic device, the identity data of the electronic device comprising an electronic device identification serial number and a device digital certificate corresponding to the electronic device, the device digital certificate containing security level data of the electronic device; when a service program of the electronic device end starts direct communication with the server end, a device security level checking process of the electronic device is performed between the electronic device end and the server end according to the identity data of the electronic device; if the checking is passed, a data network transmission operation between the service program of the electronic device end and the server end is performed.

Description

Technical Field

[0001] This invention relates primarily to the field of information technology, and more particularly to an identity recognition system for electronic devices. Background Technology

[0002] When a business system is running, to ensure business security, when electronic devices, such as IoT devices, connect to cloud service programs on the server side, the cloud service program needs to perform user authentication first to verify whether the access user's identity is legitimate. However, under this operating mode, if the security level of the accessed electronic device cannot be correctly identified, there is a risk of unauthorized access by low-security devices to high-security-level services and data, which may lead to security incidents where attackers use low-security-level devices to abnormally obtain confidential data from cloud services. Therefore, how to identify the security level of electronic devices accessing the server side is a problem that needs to be addressed. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide an identity recognition system and method for electronic devices, thereby realizing the identification of the security level of electronic devices and thus achieving effective security protection for electronic devices accessing servers.

[0004] To address the aforementioned technical problems, this invention provides an electronic device identification system, comprising a server, an electronic device, and a secure cryptographic device. The system is configured to perform the following operations: the electronic device performs a security verification operation with the server via the secure cryptographic device to generate identification data for the electronic device. This identification data includes an electronic device serial number and a corresponding digital certificate for the electronic device. The digital certificate contains the security level data of the electronic device. When the business program on the electronic device begins direct communication with the server, a security level verification process is performed between the electronic device and the server based on the identification data. If the verification passes, data network transmission is performed between the business program on the electronic device and the server.

[0005] In one embodiment of the present invention, the server includes a terminal security management service module and an authentication management module, and the electronic device includes a security component module. The electronic device performs a security verification operation with the server through the security cryptographic device to generate the electronic device's identity data, including: the terminal security management service module creating an electronic device identifier serial number; the security component module connecting to the terminal security management service module through the security cryptographic device, obtaining and storing the electronic device identifier serial number; the security component module generating a certificate request file and sending it to the authentication management module through the security cryptographic device; the authentication management module generating a device digital certificate corresponding to the electronic device based on the certificate request file, returning it to the security component module through the security cryptographic device, and storing it; and the security cryptographic device notifying the terminal security management service module that the creation of the electronic device's identity data is complete.

[0006] In one embodiment of the present invention, the physical area of ​​the electronic device is divided into a trusted area and an untrusted area. The security component module is located in the trusted area, and the business program of the electronic device runs in the untrusted area. The process of verifying the device security level of the electronic device based on its identity data between the electronic device and the server includes: the business program running in the untrusted area initiating a connection request to the server; the security component module of the electronic device initiating a device identity authentication request; the business program running in the untrusted area sending the device identity authentication request data to the server; and the server verifying the device identity authentication request data. If the verification is successful, a cloud service identity authentication response data packet is generated and sent to the security component module on the electronic device. The security component module verifies the cloud service identity authentication response data packet. If the verification is successful, a secondary device identity authentication request is initiated. The business program running in the untrusted area sends the device secondary identity authentication request data to the server. The server verifies the device secondary identity authentication request data. If the verification is successful, the server identifies and obtains the device security level data contained in the device digital certificate and sends the secondary identity authentication response data to the security component module on the electronic device to indicate that the device security level identification operation is complete and to start the business program data transmission operation.

[0007] In one embodiment of the present invention, the identity authentication request data includes the electronic device identification serial number, the device digital certificate, a first random number, and first signature verification data generated based on the electronic device identification serial number, the device digital certificate, and the first random number.

[0008] In one embodiment of the present invention, the cloud service identity authentication response data packet includes a cloud service identity certificate, a second random number, and second signature verification data generated based on the cloud service identity certificate and the second random number.

[0009] In one embodiment of the present invention, the secondary authentication request data includes third signature verification data generated based on the first random number and the second random number.

[0010] In one embodiment of the present invention, the security component module includes a one-time programmable memory for storing the electronic device identification serial number.

[0011] In one embodiment of the present invention, the security component module further generates and stores a device private key corresponding to the electronic device, the device private key being used for generating signature verification data.

[0012] In one embodiment of the present invention, the trusted region and the untrusted region are physically isolated.

[0013] In one embodiment of the present invention, the process of generating the first signature verification data includes: using the electronic device identification serial number, the device digital certificate, and a first random number, a first data digest is generated through a hash algorithm; then, the first data digest is signed using the device private key to obtain the first signature verification data. The process of generating the second signature verification data includes: using the cloud service identity certificate and a second random number, a second data digest is generated through a hash algorithm; then, the second data digest is signed using the device private key to obtain the second signature verification data. The device private key is generated by the security component module.

[0014] In one embodiment of the present invention, the server-side verification of the device identity authentication request data includes: performing certificate chain verification on the device digital certificate; if successful, comparing the device identification serial number carried in the device digital certificate with the electronic device identification serial number; if the comparison matches, verifying the first signature verification data and confirming whether the verification process has passed.

[0015] In one embodiment of the present invention, the certificate chain verification process includes step-by-step verification of the server certificate, intermediate certificates, and root certificate.

[0016] In one embodiment of the present invention, the communication protocol message types between the electronic device and the server include: acknowledgment type messages, unacknowledgment type messages, response messages, and reset messages; the acknowledgment type messages are messages that need to be acknowledged, and the receiving end needs to reply with a response message or a reset message; the unacknowledgment type messages are messages that do not need to be acknowledged; the transmission types of the communication protocol messages between the electronic device and the server include: carry mode and separate mode.

[0017] In one embodiment of the present invention, the carrying mode is that the confirmation type message sent by the electronic device carries a command code, and the response message sent by the server carries a response code; the separation mode is that the confirmation type message sent by the electronic device carries a command code, and the response message sent by the server does not carry a response code; the confirmation type message sent by the server carries a response code; and the response message sent by the electronic device does not carry a response code; the command code corresponds to the device identity authentication request data and the secondary identity authentication request data, and the response code corresponds to the cloud service identity authentication response data packet and the secondary identity authentication response data.

[0018] This invention also provides a method for identifying an electronic device, comprising: the electronic device performing a security verification operation with a server via a secure cryptographic device to generate identification data for the electronic device, the identification data including an electronic device serial number and a device digital certificate corresponding to the electronic device, the device digital certificate containing security level data of the electronic device; when the business program on the electronic device begins communication with the server, a device security level verification process is performed between the electronic device and the server based on the identification data of the electronic device; if the verification passes, a data network transmission operation is performed between the business program on the electronic device and the server.

[0019] Compared with the prior art, the present invention has the following advantages: The technical solution of this application realizes the effective identification of the security level of electronic devices by the server side through the generation and verification process of electronic device identity data, thereby improving the security of business system operation. Attached Figure Description

[0020] The accompanying drawings are included to provide a further understanding of this application and form part of this application. The drawings illustrate embodiments of this application and, together with this specification, serve to explain the principles of this application.

[0021] In the attached image:

[0022] Figure 1 This is a schematic diagram of the composition of an electronic device identification system according to an embodiment of this application.

[0023] Figure 2 This is a schematic diagram of the operation steps of an electronic device identification system 100 according to an embodiment of this application.

[0024] Figure 3 This is a flowchart illustrating the process by which an electronic device performs a security verification operation through a secure cryptographic device and a server, according to an embodiment of this application.

[0025] Figure 4 This is a schematic diagram of the composition of an electronic device terminal according to an embodiment of this application.

[0026] Figure 5 This is a flowchart illustrating the process of device security level verification and business program data transmission between the electronic device and the server in one embodiment of this application.

[0027] Figure 6 This is a schematic diagram illustrating the process of device security level verification and business program data transmission between the electronic device and the server in an embodiment of this application. Detailed Implementation

[0028] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are merely some examples or embodiments of this application. For those skilled in the art, these drawings can be applied to other similar scenarios without creative effort. Unless obvious from the context or otherwise specified, the same reference numerals in the drawings represent the same structures or operations.

[0029] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0030] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of this application. It should also be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn to actual scale.

[0031] Furthermore, it should be noted that the use of terms such as "first" and "second" to define components is merely for the purpose of distinguishing the corresponding components. Unless otherwise stated, these terms have no special meaning and therefore should not be construed as limiting the scope of protection of this application. In addition, although the terminology used in this application is selected from commonly known and used terms, some terms mentioned in this application's specification may have been chosen by the applicant according to his or her judgment, and their detailed meanings are explained in the relevant sections of this description. Moreover, this application should be understood not only through the actual terms used, but also through the meaning implied by each term.

[0032] Flowcharts are used in this application to illustrate the operations performed by the system according to embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more steps may be removed from these processes.

[0033] Embodiments of this application describe an identification system and method for an electronic device. Figure 1 This is a schematic diagram illustrating the composition of an electronic device identification system according to an embodiment of this application. For example... Figure 1 As shown, the electronic device identification system 100 includes a server 101, an electronic device 102, and a secure cryptographic device (SCD) 103. The server 101, electronic device 102, and secure cryptographic device 103 transmit data and instructions through a network. Figure 2 This is a schematic diagram illustrating the operation steps of an electronic device identification system 100 according to an embodiment of this application. (Reference) Figure 2 The electronic device identification system 100 is configured to perform the following operations: Step 201, the electronic device and the server perform a security verification operation to generate identification data for the electronic device. This identification data includes the electronic device's serial number and a digital certificate corresponding to the electronic device. The digital certificate contains the electronic device's security level data. Step 202, when the business program on the electronic device begins direct communication with the server, a security level verification process is performed between the electronic device and the server based on the identification data. Step 203, if the verification passes, a data network transmission operation is performed between the business program on the electronic device and the server. The electronic device 102 and the secure cryptographic device 103 communicate, for example, via an RS232 bus network.

[0034] In some embodiments, the security component module includes a one-time programmable (OTP) memory for storing the electronic device identification serial number (SN). The electronic device identification serial number is a unique number (i.e., a non-repeating number) corresponding to the electronic device. The device digital certificate is, for example, an X.509v3 certificate, or an X.509v1 certificate, an X.509v4 certificate, or other types of digital certificates.

[0035] Figure 3 This is a flowchart illustrating the process of a secure authentication operation performed by an electronic device and a server according to an embodiment of this application. (Reference) Figure 3The electronic device performs a security verification operation through the secure cryptographic device and the server to generate the electronic device's identity data, including: Step 301, the terminal security management service module creates an electronic device identification serial number; Step 302, the security component module connects to the terminal security management service module through the secure cryptographic device, obtains the electronic device identification serial number, and stores it; Step 303, the security component module generates a certificate request file and sends it to the authentication management module through the secure cryptographic device; Step 304, the authentication management module generates a device digital certificate corresponding to the electronic device based on the certificate request file, and returns it to the security component module through the secure cryptographic device for storage; Step 305, the secure cryptographic device notifies the terminal security management service module that the electronic device's identity data creation is complete.

[0036] Figure 4 This is a schematic diagram of the electronic device terminal according to an embodiment of this application. (Reference) Figure 4 The physical area of ​​the electronic device terminal 102 is divided into a trusted area 210 and an untrusted area 221. The security component module 211 is located in the trusted area 210. Figure 4 The designation '210(211)' indicates that the security component module 211 may, for example, constitute a trusted region 210. There is physical isolation between the trusted and untrusted regions, specifically including, for example, a physical isolation zone 231. The physical isolation zone 231 may be, for example, an empty area or an area filled with a specific isolation material. Figure 4 The shape of the physical isolation zone is for illustrative purposes only; in reality, it can be a three-dimensional spatial region. The electronic device's business programs run in the untrusted region 221. Physical isolation enables the separation of the program's runtime space and data storage space.

[0037] In some embodiments, server 101 includes a Terminal Security Management (TSM) module 201 and a Certificate Authority (CA) module 202, while electronic device 102 includes a Secure Element (SE) module 211. A Secure Cryptographic Device (SCD) 103 is a device that provides cryptographic services and storage for physical and logical protection of other devices. The Security Element module also generates and stores a device private key corresponding to the electronic device, which is used to generate signature verification data. The Terminal Security Management (TSM) module, for example, runs a corresponding cloud service program. The Terminal Security Management (TSM) module 201 and the Certificate Authority (CA) module 202 communicate, for example, through the server's internal network.

[0038] Figure 5This is a flowchart illustrating the process of device security level verification and business program data transmission between the electronic device and the server in one embodiment of this application. Figure 6 This is a schematic diagram illustrating the process of device security level verification and business program data transmission between the electronic device and the server according to an embodiment of this application. In some embodiments, refer to Figure 5 and Figure 6 The process of verifying the device security level of the electronic device based on its identity data between the electronic device and the server includes: Step 501, a business program running in the untrusted area initiates a connection request to the server, and the security component module of the electronic device initiates a device identity authentication request; Step 502, the business program running in the untrusted area sends the device identity authentication request data to the server; Step 503, the server verifies the device identity authentication request data, and if the verification passes, generates a cloud service identity authentication response data packet and sends it to the security component module of the electronic device. The security component module performs the following steps: Step 504: The security component module verifies the cloud service identity authentication response data packet. If the verification passes, a secondary device identity authentication request is initiated. Step 505: The business program running in the untrusted area sends the device secondary identity authentication request data to the server. Step 506: The server verifies the device secondary identity authentication request data. If the verification passes, it identifies and obtains the device security level data contained in the device digital certificate and sends the secondary identity authentication response data to the security component module on the electronic device to indicate that the device security level identification operation is complete and to start the business program data transmission operation. The business program may be, for example, a business program related to a cashier function or payment function. The device security level data may include, for example, no security protection level (Security Level-0, SL0) and Level 1 security protection level (Security Level-1, SL1), with Level 1 security protection level having a higher security level than no security protection level.

[0039] In some embodiments, the identity authentication request data involved in step 501 includes the electronic device identifier serial number, the device digital certificate, a first random number, and first signature verification data generated based on the electronic device identifier serial number, the device digital certificate, and the first random number. The cloud service identity authentication response data packet involved in step 503 includes the cloud service identity certificate, a second random number, and second signature verification data generated based on the cloud service identity certificate and the second random number.

[0040] In some embodiments, the secondary authentication request data involved in step 504 includes third signature verification data generated based on the first random number and the second random number. The process of generating the first signature verification data includes: using the electronic device identifier serial number, the device digital certificate, and the first random number, generating a first data digest through a hash algorithm, and then performing a signature operation on the first data digest using the device private key to obtain the first signature verification data. The process of generating the second signature verification data includes: using the cloud service identity certificate and the second random number, generating a second data digest through a hash algorithm, and then performing a signature operation on the second data digest using the device private key to obtain the second signature verification data. The device private key is generated by the security component module. The hash algorithm type is, for example, the SHA256 algorithm.

[0041] In some embodiments, the server-side verification of the device authentication request data includes: step 701, performing certificate chain verification on the device digital certificate; if successful, comparing the device identifier serial number carried in the device digital certificate with the electronic device identifier serial number; step 702, if the comparison matches, verifying the first signature verification data and confirming whether the verification process has passed. In one embodiment, the certificate chain verification process includes step-by-step verification of the server certificate, intermediate certificates, and root certificate.

[0042] In some embodiments, the communication protocol message types between the electronic device and the server include: acknowledgment messages, unacknowledgment messages, response messages, and reset messages; the acknowledgment messages are messages that require acknowledgment (referred to as CON messages), and the receiving end needs to reply with an response message (referred to as ACK messages) or a reset message (referred to as RST messages); the unacknowledgment messages are messages that do not require acknowledgment (referred to as NON messages). The transmission types of the communication protocol messages between the electronic device and the server include: carried mode and separated mode.

[0043] The carrying mode is that the confirmation type message sent by the electronic device carries a command code, and the response message sent by the server carries a response code; the separation mode is that the confirmation type message sent by the electronic device carries a command code, and the response message sent by the server does not carry a response code; the confirmation type message sent by the server carries a response code; the response message sent by the electronic device does not carry a response code; the command code corresponds to the device identity authentication request data and the secondary identity authentication request data, and the response code corresponds to the cloud service identity authentication response data packet and the secondary identity authentication response data.

[0044] This application also provides a method for identifying an electronic device, the specific process of which is as follows: Figure 2 Steps 201 to 203 are shown in the diagram. The specific implementation process of steps 201 to 203 is described above.

[0045] The electronic device identification system and method of this application establish a unique, tamper-proof, and leak-proof security protection scheme for the electronic device by creating a trusted area in the electronic device; and by utilizing the generation and verification of digital certificates, the server can effectively identify the security level of the electronic device, prevent unauthorized access, and improve the security of business system operation.

[0046] The basic concepts have been described above. Obviously, for those skilled in the art, the above disclosure is merely illustrative and does not constitute a limitation of this application. Although not explicitly stated herein, those skilled in the art may make various modifications, improvements, and corrections to this application. Such modifications, improvements, and corrections are suggested in this application, and therefore remain within the spirit and scope of the exemplary embodiments of this application.

[0047] Furthermore, this application uses specific terms to describe embodiments of the application. For example, "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic related to at least one embodiment of the application. Therefore, it should be emphasized and noted that "an embodiment," "one embodiment," or "an alternative embodiment" mentioned twice or more in different locations in this specification do not necessarily refer to the same embodiment. In addition, certain features, structures, or characteristics in one or more embodiments of the application can be appropriately combined.

[0048] Some aspects of this application may be executed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The aforementioned hardware or software may be referred to as a "data block," "module," "engine," "unit," "component," or "system." The processor may be one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. Furthermore, aspects of this application may be manifested as a computer product located on one or more computer-readable media, including computer-readable program code.

[0049] Although this application has been described with reference to specific embodiments, those skilled in the art should recognize that the above embodiments are only used to illustrate this application, and various equivalent changes or substitutions can be made without departing from the spirit of this application. Therefore, any changes or modifications to the above embodiments within the essential spirit of this application will fall within the scope of the claims of this application.

Claims

1. An identification system for an electronic device, comprising a server, an electronic device, and a secure cryptographic device, the system being configured to perform the following operations: The electronic device performs a security verification operation through the security cryptographic device and the server to generate the electronic device's identity data. The electronic device's identity data includes the electronic device's serial number and the device's digital certificate corresponding to the electronic device. The device's digital certificate contains the electronic device's security level data. When the business program on the electronic device starts communicating directly with the server, a device security level verification process is performed between the electronic device and the server based on the electronic device's identity data. If the verification passes, then data network transmission between the business program on the electronic device and the server is performed. The electronic device includes a security component module. The physical area of ​​the electronic device is divided into a trusted area and an untrusted area. The security component module is located in the trusted area, and the business program runs in the untrusted area. The process of verifying the device security level of the electronic device based on its identity data, between the electronic device and the server, includes: The business program running in the untrusted area initiates a connection request with the server, and the security component module of the electronic device initiates a device identity authentication request. The business program running in the untrusted area sends device authentication request data to the server. The server verifies the device authentication request data. If the verification is successful, it generates a cloud service authentication response data packet and sends it to the security component module. The security component module verifies the cloud service identity authentication response data packet. If the verification passes, it initiates a secondary device identity authentication request data packet. The business program running in the untrusted area sends the secondary device authentication request data to the server. The server verifies the secondary device authentication request data. If the verification is successful, it identifies and obtains the device security level data contained in the device digital certificate, and sends the secondary authentication response data to the security component module to indicate that the device security level identification operation is complete and to start the business program data transmission operation.

2. The electronic device identification system according to claim 1, characterized in that, The server-side includes a terminal security management service module and an authentication management module; The electronic device performs a security verification operation through the secure cryptographic device and the server, generating the electronic device's identity data, including: The terminal security management service module creates an electronic device identification serial number; The security component module connects to the terminal security management service module through the security cryptographic device to obtain and store the electronic device's identification serial number. The security component module generates a certificate request file and sends it to the authentication management module through the security cryptographic device. The authentication management module generates a device digital certificate corresponding to the electronic device based on the certificate request file, and returns it to the security component module through the security cryptographic device and stores it. The secure cryptographic device notifies the terminal security management service module that the identity data of the electronic device has been created.

3. The electronic device identification system according to claim 1, characterized in that, The identity authentication request data includes the electronic device identification serial number, the device digital certificate, a first random number, and first signature verification data generated based on the electronic device identification serial number, the device digital certificate, and the first random number.

4. The electronic device identification system according to claim 3, characterized in that, The cloud service identity authentication response data packet includes a cloud service identity certificate, a second random number, and second signature verification data generated based on the cloud service identity certificate and the second random number.

5. The electronic device identification system according to claim 4, characterized in that, The secondary device authentication request data includes third signature verification data generated based on the first random number and the second random number.

6. The electronic device identification system according to claim 2, characterized in that, The security component module includes a one-time programmable memory for storing the electronic device's identification serial number.

7. The electronic device identification system according to claim 2, characterized in that, The security component module also generates and stores a device private key corresponding to the electronic device, which is used to generate signature verification data.

8. The electronic device identification system according to claim 1, characterized in that, There is physical isolation between the trusted and untrusted regions.

9. The electronic device identification system according to claim 3, characterized in that, The process of generating the first signature verification data includes: the electronic device identification serial number, the device digital certificate, and the first random number are used to generate a first data digest through a hash algorithm, and then the first data digest is signed using the device private key to obtain the first signature verification data; The process of generating the second signature verification data includes: the cloud service identity certificate and the second random number are used to generate a second data digest through a hash algorithm, and then the second data digest is signed using the device private key to obtain the second signature verification data; the device private key is generated by the security component module.

10. The electronic device identification system according to claim 3, characterized in that, The server-side verification of the device authentication request data includes: The device digital certificate is verified using a certificate chain. If the verification is successful, the device identification serial number carried in the device digital certificate is compared with the electronic device identification serial number. If the comparison matches, the first signature verification data is verified, and it is confirmed whether the verification process has passed.

11. The electronic device identification system according to claim 10, characterized in that, The certificate chain verification process involves verifying the server certificate, intermediate certificates, and root certificate at each level.

12. The electronic device identification system according to claim 1, characterized in that, The communication protocol message types between the electronic device and the server include: acknowledgment messages, non-acknowledgment messages, response messages, and reset messages; the acknowledgment messages are messages that need to be acknowledged, and the receiving end needs to reply with a response message or a reset message. The unacknowledged message type is a message that does not require acknowledgment; the transmission types of communication protocol messages between the electronic device and the server include: carried mode and separated mode.

13. The electronic device identification system according to claim 12, characterized in that, The carrying mode is that the confirmation type message sent by the electronic device carries the command code, and the response message sent by the server carries the response code. The separation mode is that the acknowledgment type message sent by the electronic device carries a command code, while the response message sent by the server does not carry a response code; the acknowledgment type message sent by the server carries a response code, while the response message sent by the electronic device does not carry a response code. The command code corresponds to the device authentication request data and the secondary device authentication request data, and the response code corresponds to the cloud service authentication response data packet and the secondary authentication response data.

14. A method for identifying an electronic device, comprising: The electronic device performs a security verification operation with a secure cryptographic device and a server to generate the electronic device's identity data. The electronic device's identity data includes the electronic device's serial number and a device digital certificate corresponding to the electronic device. The device digital certificate contains the electronic device's security level data. When the business program on the electronic device starts communicating directly with the server, a device security level verification process is performed between the electronic device and the server based on the electronic device's identity data. If the verification passes, then data network transmission between the business program on the electronic device and the server is performed. The electronic device includes a security component module. The physical area of ​​the electronic device is divided into a trusted area and an untrusted area. The security component module is located in the trusted area, and the business program runs in the untrusted area. The process of verifying the device security level of the electronic device based on its identity data, between the electronic device and the server, includes: The business program running in the untrusted area initiates a connection request with the server, and the security component module of the electronic device initiates a device identity authentication request. The business program running in the untrusted area sends device authentication request data to the server. The server verifies the device authentication request data. If the verification is successful, it generates a cloud service authentication response data packet and sends it to the security component module. The security component module verifies the cloud service identity authentication response data packet. If the verification passes, it initiates a secondary device identity authentication request data packet. The business program running in the untrusted area sends the secondary device authentication request data to the server. The server verifies the secondary device authentication request data. If the verification is successful, it identifies and obtains the device security level data contained in the device digital certificate, and sends the secondary authentication response data to the security component module to indicate that the device security level identification operation is complete and to start the business program data transmission operation.

15. The method for identifying an electronic device according to claim 14, characterized in that, The server-side includes a terminal security management service module and an authentication management module; The electronic device performs a security verification operation through the secure cryptographic device and the server, generating the electronic device's identity data, including: The terminal security management service module creates an electronic device identification serial number; The security component module connects to the terminal security management service module through the security cryptographic device to obtain and store the electronic device's identification serial number. The security component module generates a certificate request file and sends it to the authentication management module through the security cryptographic device. The authentication management module generates a device digital certificate corresponding to the electronic device based on the certificate request file, and returns it to the security component module through the security cryptographic device and stores it. The secure cryptographic device notifies the terminal security management service module that the identity data of the electronic device has been created.

Images