Equipment certification methods, devices, electronic equipment and storage media

Abstract

This invention provides a device authentication method, apparatus, electronic device, and storage medium, belonging to the field of information security. The method includes: determining a trusted device for a first device and a second device; generating a challenge random number, and generating challenge parameters based on the challenge random number and the device identity identifier of the trusted device; sending the challenge parameters to the trusted device and obtaining verification parameters returned by the trusted device; when the verification parameters pass verification, negotiating a session key with the second device using a password authentication key exchange protocol based on the challenge random number; and performing a device identity identifier exchange operation based on the session key, so that the first device and the second device exchange their respective device identity identifiers. This method significantly improves the efficiency of device authentication.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a device authentication method, apparatus, electronic device, and storage medium. Background Technology

[0002] Currently, the main method for establishing mutual trust between devices based on Open Harmony is as follows: Users select a master device from among the multiple devices to be networked, with the rest acting as accessory devices. The user then enters a PIN (Personal Identification Number) provided by the accessory device on the master device. The master device and accessory devices then use the PAKE (Password-based Authenticated Key Exchange) protocol to complete device authentication. However, this method requires users to manually enter the PIN provided by the accessory device, resulting in low device authentication efficiency. Summary of the Invention

[0003] This invention provides a device authentication method, apparatus, electronic device, and storage medium, aiming to improve the efficiency of device authentication.

[0004] In a first aspect, embodiments of the present invention provide a device authentication method, applied to a first device, the method comprising:

[0005] A shared trust device is identified between the first device and the second device, where the first device and the second device are devices to be authenticated, and the shared trust device mutually trusts the first device and the second device, respectively.

[0006] Generate a challenge random number, and generate challenge parameters based on the challenge random number and the device identity identifier of the shared trust device;

[0007] The challenge parameters are sent to the shared trust device, and the verification parameters returned by the shared trust device are obtained. The shared trust device forwards the challenge parameters to the second device, so that the second device can generate verification parameters based on the device identity of the shared trust device and the random number in the received challenge parameters, and send the verification parameters to the shared trust device, so that the shared trust device forwards the verification parameters to the first device.

[0008] When the verification parameters pass verification, a session key is negotiated with the second device based on the challenge random number using a password authentication key exchange protocol;

[0009] Based on the session key, a device identity exchange operation is performed so that the first device and the second device can exchange their respective device identities.

[0010] Secondly, embodiments of the present invention also provide a device authentication method, applied to a second device, the method comprising:

[0011] When a device discovery request broadcast by the first device is detected, second device information is sent to the first device so that the first device can determine the mutually trusted devices of the first device and the second device based on its own trusted device list and the trusted device list in the second device information.

[0012] Obtain the challenge parameters sent by the shared trust device, wherein the challenge parameters are generated by the first device based on the challenge random number and the device identity identifier of the shared trust device and then sent to the shared trust device;

[0013] Based on the device identity identifier of the shared trust device and the random number in the challenge parameters, a verification parameter is generated and sent to the shared trust device so that the shared trust device can forward the verification parameter to the first device. When the verification parameter passes verification, the first device negotiates a session key with the second device using a password authentication key exchange protocol based on the challenge random number, and performs a device identity identifier exchange operation based on the session key, so that the first device and the second device can exchange their respective device identity identifiers.

[0014] Thirdly, embodiments of the present invention also provide a device authentication method applied to mutually trusted devices, wherein the mutually trusted devices mutually trust a first device and a second device, the method comprising:

[0015] Obtain the challenge parameters sent by the first device, wherein the challenge parameters are generated by the first device based on the challenge random number and the device identity identifier of the trusted device;

[0016] The challenge parameters are sent to the second device, which generates verification parameters based on the device identity of the shared trust device and the random number in the challenge parameters, and then sends the verification parameters to the shared trust device.

[0017] The verification parameters sent by the second device are obtained and sent to the first device. When the verification parameters are verified, the first device negotiates a session key with the second device using a password authentication key exchange protocol based on the challenge random number, and performs a device identity exchange operation according to the session key, so that the first device and the second device exchange their respective device identity identifiers.

[0018] Fourthly, embodiments of the present invention also provide a device authentication apparatus, the device authentication apparatus comprising:

[0019] The device determination module is configured to determine a trusted device for the first device and the second device, wherein the first device and the second device are devices to be authenticated, and the trusted device mutually trusts the first device and the second device, respectively.

[0020] The parameter generation module is configured to generate challenge random numbers and generate challenge parameters based on the challenge random numbers and the device identity identifier of the shared trust device;

[0021] The transceiver module is configured to send the challenge parameters to the shared trust device and obtain the verification parameters returned by the shared trust device. The shared trust device forwards the challenge parameters to the second device, so that the second device can generate verification parameters based on the device identity of the shared trust device and the random number in the received challenge parameters, and send the verification parameters to the shared trust device, so that the shared trust device forwards the verification parameters to the first device.

[0022] The key negotiation module is configured to negotiate a session key with the second device based on the challenge random number using a password authentication key exchange protocol when the verification parameters pass verification.

[0023] The identifier exchange module is configured to perform a device identity exchange operation based on the session key, so that the first device and the second device exchange their respective device identity identifiers.

[0024] Fifthly, embodiments of the present invention also provide an electronic device, the electronic device including a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for implementing connection communication between the processor and the memory, wherein when the computer program is executed by the processor, it implements the device authentication method as described in the first, second, or third aspects.

[0025] In a sixth aspect, embodiments of the present invention also provide a storage medium for computer-readable storage, the storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement the device authentication method as described in the first, second or third aspect.

[0026] This invention provides a device authentication method, apparatus, electronic device, and storage medium. The method involves a shared trust device between a first device and two devices forwarding challenge parameters and verification parameters. When the first device receives the verification parameters and passes verification, it negotiates a session key with the second device using a password authentication key exchange protocol based on the challenge random number in the challenge parameters. According to the session key, it performs a device identity exchange operation, enabling the first and second devices to exchange their respective device identity identifiers, thereby completing the identity authentication between the first and second devices. The entire device authentication process does not require the user to enter a PIN code, greatly improving the efficiency of device authentication. Furthermore, transmitting data through a shared trust device ensures the data security of the device authentication. Attached Figure Description

[0027] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a schematic diagram of a scenario for implementing the device authentication method provided in the embodiments of the present invention;

[0029] Figure 2 This is a flowchart illustrating a device authentication method provided in an embodiment of the present invention;

[0030] Figure 3 yes Figure 2 A flowchart illustrating the sub-steps of the device authentication method in the document;

[0031] Figure 4 This is a schematic diagram of a scenario for determining a shared trust device in an embodiment of the present invention;

[0032] Figure 5 This is another scenario diagram illustrating the determination of shared trust devices in an embodiment of the present invention;

[0033] Figure 6 This is a flowchart illustrating another device authentication method provided in an embodiment of the present invention;

[0034] Figure 7 This is a flowchart illustrating another device authentication method provided in an embodiment of the present invention;

[0035] Figure 8 This is a schematic block diagram of the structure of a device authentication apparatus provided in an embodiment of the present invention;

[0036] Figure 9 This is a schematic block diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] The flowchart shown in the attached diagram is for illustrative purposes only and does not necessarily include all content and operations / steps, nor does it necessarily have to be performed in the order described. For example, some operations / steps can be broken down, combined, or partially merged, so the actual execution order may change depending on the actual situation.

[0039] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0040] Currently, the main method for establishing mutual trust between devices based on Open Harmony is as follows: Users select a master device from among the multiple devices to be networked, with the rest acting as accessory devices. The user then enters a PIN (Personal Identification Number) provided by the accessory device on the master device. The master device and accessory devices then use the PAKE (Password-based Authenticated Key Exchange) protocol to complete device authentication. However, this method requires users to manually enter the PIN provided by the accessory device, resulting in low device authentication efficiency.

[0041] To address the aforementioned problems, embodiments of the present invention provide a device authentication method, apparatus, electronic device, and storage medium. This method utilizes a shared trust device between a first device and two devices to forward challenge parameters and verification parameters. When the first device receives the verification parameters and passes verification, it negotiates a session key with the second device using a password authentication key exchange protocol based on the challenge random number in the challenge parameters. Based on this session key, it performs a device identity exchange operation, enabling the first and second devices to mutually exchange their respective device identity identifiers, thereby completing identity authentication between the first and second devices. The entire device authentication process does not require the user to input a PIN code, greatly improving the efficiency of device authentication. Furthermore, transmitting data through a shared trust device ensures the data security of the device authentication.

[0042] The device authentication method can be applied to electronic devices, such as mobile phones, cameras, tablets, smart home devices, energy storage devices, wearable devices, in-vehicle devices, augmented reality (AR) / virtual reality (VR) devices, laptops, personal computers (PCs), netbooks, or personal digital assistants (PDAs). Smart home devices can include smart air conditioners, smart refrigerators, smart TVs, smart speakers, or smart fans.

[0043] The following detailed description of some embodiments of the present invention is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0044] Please see Figure 1 , Figure 1 This is a schematic diagram of a scenario implementing the device authentication method provided in the embodiments of the present invention. For example... Figure 1 As shown, the devices to be authenticated are the first device 11 and the second device 12, and the trusted device 13 mutually trusts the first device 11 and the second device 12. Mutual trust between the first device 11 and the trusted device 13 means that the first device 11 has established a trusted relationship with the trusted device 13 through the HiChain application provided by the Open Harmony framework, and the first device 11 and the trusted device 13 have exchanged their respective device identity identifiers. Similarly, mutual trust between the second device 12 and the trusted device 13 means that the second device 11 has established a trusted relationship with the trusted device 13 through the HiChain application provided by the OpenHarmony framework, and the second device 11 and the trusted device 13 have exchanged their respective device identity identifiers.

[0045] In some embodiments, the first device 11 generates a challenge random number and generates challenge parameters based on the challenge random number and the device identity of the trusted device 12; the first device 11 sends the challenge parameters to the trusted device 13; after receiving the challenge parameters, the trusted device 13 forwards the challenge parameters to the second device 12; after receiving the challenge parameters, the second device 12 generates verification parameters based on the device identity of the trusted device 13 and the random number in the challenge parameters, and sends the verification parameters to the trusted device 13; the trusted device 13 forwards the verification parameters to the first device 11; after receiving the verification parameters sent by the trusted device 13, the first device 11 verifies the verification parameters, and then, when the verification parameters pass verification, the first device 11 negotiates a session key with the second device 12 based on the challenge random number using the Password-authenticated key agreement (PAKE) protocol, and performs a device identity exchange operation based on the session key, so that the first device 11 and the second device 12 exchange their respective device identity, thereby completing the identity authentication between the first device and the second device.

[0046] The following will combine Figure 1 The following scenario provides a detailed description of the device authentication method provided by the embodiments of the present invention. It should be noted that... Figure 1 The scenarios described are only used to explain the device authentication method provided in the embodiments of the present invention, but do not constitute a limitation on the application scenarios of the device authentication method provided in the embodiments of the present invention.

[0047] Please see Figure 2 , Figure 2 This is a schematic flowchart of a device authentication method provided in an embodiment of the present invention. This device authentication method can be applied to a first device to improve the efficiency of device authentication.

[0048] like Figure 2 As shown, the device authentication method includes steps S101 to S105.

[0049] Step S101: Determine the common trust device of the first device and the second device.

[0050] In this embodiment, the first device and the second device are devices to be authenticated, and the trusted device mutually trusts the first device and the second device. The first device can be the master control device, and the second device can be an accessory device. It is understood that in another embodiment, the first device can also be an accessory device, and the second device can be the master control device; this embodiment of the invention does not specifically limit this.

[0051] In some embodiments, such as Figure 3 As shown, step S101 includes sub-steps S1011 to S1013.

[0052] Sub-step S1011, Broadcast device discovery request.

[0053] In this embodiment, the first device broadcasts a device discovery request using the CoAP (Constrained Application Protocol). This device discovery request includes first device information, which includes a list of trusted devices. The first device mutually trusts each device in its trusted device list. The first device's trusted device list includes device information for the devices it trusts, such as their IP address, device identifier, device ID, and location information. In another embodiment, the first device information may further include the first device's device ID, IP address, and location information.

[0054] Sub-step S1012: Obtain the second device information returned by the second device based on the device discovery request.

[0055] In this embodiment, when the second device receives a device discovery request broadcast by the first device, it sends second device information to the first device, allowing the first device to obtain the device information of the second device. The second device information includes a list of trusted devices for the second device, and the second device mutually trusts each device in this list. The list of trusted devices includes device information of the devices that mutually trust the second device, such as the device's IP address, device identifier, device ID, and location information. In another embodiment, the second device information may further include the second device's device ID, IP address, and location information.

[0056] Sub-step S1013: Determine the shared trusted device of the first device and the second device based on the trusted device list of the first device and the trusted device list of the second device.

[0057] In this embodiment, any device simultaneously located in the trusted device list of the first device and the trusted device list of the second device can be determined as a shared trusted device of the first device and the second device. For example, such as Figure 4 As shown, the first trust group 21 includes the first device, device A and device B, and the trusted device list of the first device includes device A and device B. The second trust group 22 includes the second device, device B and device C, and the trusted device list of the second device includes device B and device C. Therefore, device B can be identified as a trusted device of the first device and the second device.

[0058] In some embodiments, determining a mutually trusted device between the first device and the second device based on the trusted device lists of the first device and the second device can be achieved by: determining a device that mutually trusts both the first device and the second device based on the trusted device lists of the first device and the second device; and if there is only one mutually trusted device, then that device is determined as the mutually trusted device. Figure 4 As shown, only device B has mutual trust with the first device and the second device. Therefore, device B can be identified as a mutually trusted device of the first device and the second device.

[0059] In some embodiments, when multiple devices mutually trust each other with the first device and the second device, the mutually trusting devices are identified as candidate devices. A first distance between each candidate device and the first device is determined based on the location information of the first device and the location information of each candidate device. A second distance between each candidate device and the second device is determined based on the location information of the second device and the location information of each candidate device. The first and second distances corresponding to each candidate device are summed to obtain a target distance for each candidate device. The candidate device with the smallest target distance is identified as a mutually trusted device between the first device and the second device. This embodiment improves data transmission speed, reduces latency, and further enhances the efficiency of device authentication by identifying the device closest to the first device and the second device that mutually trusts them.

[0060] For example, such as Figure 5 As shown, the first trust group 21 also includes device D. In this case, the trusted device list of the first device includes devices A, B, and D. The second trust group 22 also includes device D. In this case, the trusted device list of the second device includes devices B, C, and D. Therefore, the devices that mutually trust the first and second devices include devices B and D. The distance between the first device and device B is d1, the distance between the first device and device D is d2, the distance between the second device and device B is d3, and the distance between the second device and device D is d4. The target distance for device B is d1 + d3, and the target distance for device D is d2 + d4. If d1 + d3 > d2 + d4, then device B is determined to be a mutually trusted device of the first and second devices.

[0061] Step S102: Generate a challenge random number, and generate challenge parameters based on the challenge random number and the device identity identifier of the trusted device.

[0062] In this embodiment, a preset random number generation program can be run to generate a challenge random number, and the challenge random number and the device identity identifier of the trusted device can be used together as challenge parameters. In another embodiment, the challenge random number, the device identity identifier of the trusted device, and the device ID of the second device can also be used together as challenge parameters. The preset random number generation program and the number of bits in the challenge random number can be set based on actual conditions, and this embodiment of the invention does not impose specific limitations on them.

[0063] Step S103: Send the challenge parameters to the trusted device and obtain the verification parameters returned by the trusted device.

[0064] In this embodiment, when the shared trust device receives the challenge parameters sent by the first device, it forwards the challenge parameters to the second device. Upon receiving the challenge parameters from the shared trust device, the second device generates verification parameters based on the shared trust device's device identity and the random number in the challenge parameters, and sends the verification parameters to the shared trust device, enabling the shared trust device to forward the verification parameters to the first device. The second device can use the shared trust device's device identity and the random number in the challenge parameters together as the verification parameters, or it can use the first device's device ID, the shared trust device's device identity, and the random number in the challenge parameters together as the verification parameters.

[0065] In some embodiments, the first device encrypts the challenge parameter using a first session key negotiated and determined with the shared trust device to obtain a first challenge parameter ciphertext, and sends the first challenge parameter ciphertext to the shared trust device. Upon receiving the first challenge parameter ciphertext sent by the first device, the shared trust device decrypts the first challenge parameter ciphertext using the first session key to obtain the challenge parameter; the shared trust device then encrypts the challenge parameter using a second session key negotiated and determined with the second device to obtain a second challenge parameter ciphertext, and sends the second challenge parameter ciphertext to the second device.

[0066] When the second device receives the second challenge parameter ciphertext sent by the trusted device, it decrypts the second challenge parameter ciphertext using the second session key to obtain the challenge parameter. The second device then generates a verification parameter based on the trusted device's public key, the first device's device ID, and the challenge random number in the challenge parameter. It encrypts the verification parameter using the second session key to obtain the first verification parameter ciphertext and sends it to the trusted device. When the trusted device receives the first verification parameter ciphertext, it decrypts it using the second session key to obtain the verification parameter. The trusted device then encrypts the verification parameter using the first session key to obtain the second verification parameter ciphertext and sends it to the first device. The first device obtains the second verification parameter ciphertext sent by the trusted device and decrypts it using the first session key negotiated and determined with the trusted device to obtain the verification parameter.

[0067] Step S104: When the verification parameters pass the verification, negotiate the session key with the second device based on the challenge random number using the password authentication key exchange protocol.

[0068] In this embodiment, after obtaining the verification parameters, the first device verifies the verification parameters, that is, it determines whether the device identity identifier in the verification parameters is the same as the device identity identifier of the trusted device, and determines whether the random number in the verification parameters is the same as the challenge random number; when the device identity identifier in the verification parameters is the same as the device identity identifier of the trusted device, and the random number in the verification parameters is the same as the challenge random number, it is determined that the verification parameters have passed the verification, that is, the first device and the second device have passed the identity legitimacy authentication.

[0069] Step S105: Based on the session key, perform the device identity exchange operation so that the first device and the second device can exchange their respective device identity identifiers.

[0070] In this embodiment, the first device encrypts its device identity identifier using a target session key negotiated with the second device to obtain first ciphertext, and sends the first ciphertext to the second device. Upon receiving the first ciphertext from the first device, the second device decrypts it using the target session key to obtain the first device identity identifier and adds it to its trusted device list. Similarly, the second device encrypts its device identity identifier using the target session key to obtain second ciphertext, and sends it to the first device. Upon receiving the second ciphertext from the second device, the first device decrypts it using the target session key to obtain the second device identity identifier and adds it to its trusted device list.

[0071] The device authentication method provided in the above embodiments forwards challenge parameters and verification parameters through a shared trust device between the first device and the second device. When the first device receives the verification parameters and passes verification, it negotiates a session key with the second device using a password authentication key exchange protocol based on the challenge random number in the challenge parameters. According to the session key, it performs a device identity exchange operation, so that the first device and the second device can exchange their respective device identity identifiers, thereby completing the identity authentication between the first device and the second device. The entire device authentication process does not require the user to enter a PIN code, which greatly improves the efficiency of device authentication. Furthermore, transmitting data through a shared trust device can ensure the data security of device authentication.

[0072] Please see Figure 6 , Figure 6This is a schematic flowchart of another device authentication method provided in an embodiment of the present invention. This device authentication method is applied to a second device to improve the efficiency of device authentication.

[0073] like Figure 6 As shown, the device authentication method includes steps S201 to S203.

[0074] Step S201: When a device discovery request broadcast by the first device is detected, send the second device information to the first device.

[0075] In this embodiment, the first device and the second device are devices to be authenticated, and the mutually trusted device trusts both the first and second devices. The first device broadcasts a device discovery request using the CoAP (Constrained Application Protocol). This device discovery request includes information about the first device, including a list of trusted devices for the first device. The second device information includes a list of trusted devices for the second device. In another embodiment, the first device information may further include the device ID, IP address, and location information of the first device, and the second device information may further include the device ID, IP address, and location information of the second device.

[0076] In some embodiments, the first device determines a shared trusted device between the first device and the second device based on its own trusted device list and the trusted device list in the second device information. For example, any device that is simultaneously located in the trusted device list of the first device and the trusted device list of the second device can be determined as a shared trusted device between the first device and the second device.

[0077] In some embodiments, determining the mutually trusted device between the first device and the second device based on the trusted device lists of the first device and the second device can be achieved by: determining devices that mutually trust the first device and the second device based on the trusted device lists of the first device and the second device; if there is only one mutually trusted device, that device is determined as the mutually trusted device; if there are multiple mutually trusted devices, those devices are determined as candidate devices; a first distance between each candidate device and the first device is determined based on the location information of the first device and the location information of each candidate device; a second distance between each candidate device and the second device is determined based on the location information of the second device and the location information of each candidate device; the first distance and the second distance corresponding to each candidate device are summed to obtain a target distance corresponding to each candidate device; and the candidate device corresponding to the smallest target distance is determined as the mutually trusted device between the first device and the second device.

[0078] Step S202: Obtain the challenge parameters sent by the trusted device.

[0079] In this embodiment, the challenge parameter is generated by the first device based on a challenge random number and the device identity identifier of the trusted device, and then sent to the trusted device. For example, after identifying the trusted device, the first device generates the challenge parameter based on the challenge random number and the device identity identifier of the trusted device, and sends the challenge parameter to the trusted device. After receiving the challenge parameter, the trusted device forwards it to the second device. The second device then obtains the challenge parameter sent by the trusted device.

[0080] Step S203: Generate verification parameters based on the device identity identifier of the trusted device and the random number in the challenge parameters, and send the verification parameters to the trusted device.

[0081] In this embodiment, after receiving the verification parameter, the shared-trust device forwards it to the first device. Upon receiving the verification parameter, the first device verifies it. If the verification parameter passes verification, it negotiates a session key with the second device using a password authentication key exchange protocol based on a challenge random number. Then, according to the session key, it performs a device identity exchange operation, enabling the first and second devices to exchange their respective device identity identifiers. It should be noted that the specific implementation process in this embodiment can refer to the corresponding process in the preceding embodiments, and will not be repeated here.

[0082] Please see Figure 7 , Figure 7 This is a schematic flowchart of another device authentication method provided in an embodiment of the present invention. This device authentication method is applied to mutually trusted devices to improve the efficiency of device authentication.

[0083] like Figure 7 As shown, the device authentication method includes steps S301 to S303.

[0084] Step S301: Obtain the challenge parameters sent by the first device.

[0085] In this embodiment, after determining the trusted device, the first device generates a challenge random number, generates challenge parameters based on the challenge random number and the device identity identifier of the trusted device, and sends the adjustment parameters to the trusted device.

[0086] Step S302: Send the challenge parameters to the second device.

[0087] In this embodiment, when the shared trust device receives the challenge parameters sent by the first device, it sends the challenge parameters to the second device. When the second device receives the challenge parameters sent by the shared trust device, it generates verification parameters based on the shared trust device's device identity and the random number in the challenge parameters, and sends the verification parameters to the shared trust device.

[0088] Step S303: Obtain the verification parameters sent by the second device and send the verification parameters to the first device.

[0089] In this embodiment, when the first device receives the verification parameter, it verifies the parameter. Upon successful verification, the first device negotiates a session key with the second device using a password authentication key exchange protocol based on a challenge random number. Then, according to the session key, it performs a device identity exchange operation, enabling the first and second devices to exchange their respective device identities. It should be noted that the specific implementation process in this embodiment can refer to the corresponding process in the preceding embodiments, and will not be repeated here.

[0090] Please see Figure 8 , Figure 8 This is a schematic block diagram of the structure of a device authentication apparatus provided in an embodiment of the present invention.

[0091] like Figure 8 As shown, the device authentication device 100 includes:

[0092] The device determination module 110 is configured to determine a trusted device for the first device and the second device, wherein the first device and the second device are devices to be authenticated, and the trusted device mutually trusts the first device and the second device respectively.

[0093] The parameter generation module 120 is configured to generate challenge random numbers and generate challenge parameters based on the challenge random numbers and the device identity identifier of the shared trust device.

[0094] The transceiver module 130 is configured to send the challenge parameters to the shared trust device and obtain the verification parameters returned by the shared trust device. The shared trust device forwards the challenge parameters to the second device, so that the second device can generate verification parameters based on the device identity of the shared trust device and the random number in the received challenge parameters, and send the verification parameters to the shared trust device, so that the shared trust device forwards the verification parameters to the first device.

[0095] The key negotiation module 140 is configured to negotiate a session key with the second device based on the challenge random number using a password authentication key exchange protocol when the verification parameters pass verification.

[0096] The identifier exchange module 150 is configured to perform a device identity exchange operation based on the session key, so that the first device and the second device exchange their respective device identity identifiers.

[0097] In some embodiments, the device determination module 110 includes:

[0098] The broadcast submodule is configured to broadcast a device discovery request, which includes first device information, including a list of trusted devices for the first device.

[0099] The acquisition submodule is configured to acquire second device information returned by the second device based on the device discovery request, the second device information including the trusted device list of the second device;

[0100] The device determination submodule is configured to determine the shared trusted device of the first device and the second device based on the trusted device list of the first device and the trusted device list of the second device.

[0101] In some embodiments, the device determining submodule is further configured to:

[0102] Based on the trusted device list of the first device and the trusted device list of the second device, determine the devices that mutually trust the first device and the second device.

[0103] If there is only one device that is mutually trusted by both the first device and the second device, the device that is mutually trusted by both the first device and the second device is identified as the mutually trusted device.

[0104] In some embodiments, the first device information further includes the location information of the first device, the second device information further includes the location information of the second device, and the device determination submodule is further configured to:

[0105] If there are multiple devices that mutually trust the first device and the second device, the devices that mutually trust the first device and the second device are identified as candidate devices;

[0106] Based on the location information of the first device and the location information of each candidate device, a first distance between each candidate device and the first device is determined;

[0107] Based on the location information of the second device and the location information of each candidate device, a second distance between each candidate device and the second device is determined;

[0108] The first distance and the second distance corresponding to each candidate device are summed to obtain the target distance corresponding to each candidate device.

[0109] The candidate device corresponding to the smallest target distance is determined as the shared trust device of the first device and the second device.

[0110] It should be noted that those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the device authentication device described above can be referred to the corresponding process in the aforementioned device authentication method embodiments, and will not be repeated here.

[0111] Please see Figure 9 , Figure 9 This is a schematic block diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0112] like Figure 9 As shown, the electronic device 200 includes a processor 201 and a memory 202, which are connected by a bus 203, such as an I2C (Inter-integrated Circuit) bus.

[0113] Specifically, processor 201 provides computing and control capabilities to support the operation of the entire electronic device. Processor 201 can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among these, the general-purpose processor can be a microprocessor or any conventional processor.

[0114] Specifically, the memory 202 can be a Flash chip, a read-only memory (ROM) disk, an optical disk, a USB flash drive, or a portable hard drive, etc.

[0115] Those skilled in the art will understand that Figure 9 The structures shown are merely block diagrams of some structures related to the embodiments of the present invention, and do not constitute a limitation on the electronic devices to which the embodiments of the present invention are applied. Specific electronic devices may include more or fewer components than those shown in the figures, or combine certain components, or have different component arrangements.

[0116] The processor 201 is used to run a computer program stored in the memory 202, and implements any of the device authentication methods provided in the embodiments of the present invention when executing the computer program.

[0117] In one embodiment, when the electronic device 200 is a first device, the processor 201 is configured to run a computer program stored in the memory 202, and to perform the following steps when executing the computer program:

[0118] A shared trust device is identified between the first device and the second device, where the first device and the second device are devices to be authenticated, and the shared trust device mutually trusts the first device and the second device, respectively.

[0119] Generate a challenge random number, and generate challenge parameters based on the challenge random number and the device identity identifier of the shared trust device;

[0120] The challenge parameters are sent to the shared trust device, and the verification parameters returned by the shared trust device are obtained. The shared trust device forwards the challenge parameters to the second device, so that the second device can generate verification parameters based on the device identity of the shared trust device and the random number in the received challenge parameters, and send the verification parameters to the shared trust device, so that the shared trust device forwards the verification parameters to the first device.

[0121] When the verification parameters pass verification, a session key is negotiated with the second device based on the challenge random number using a password authentication key exchange protocol;

[0122] Based on the session key, a device identity exchange operation is performed so that the first device and the second device can exchange their respective device identities.

[0123] In some embodiments, when the processor 201 determines the mutual trust device of the first device and the second device, it is configured to:

[0124] A broadcast device discovery request, the device discovery request including first device information, the first device information including a list of trusted devices of the first device;

[0125] Obtain the second device information returned by the second device based on the device discovery request, the second device information including the trusted device list of the second device;

[0126] Based on the trusted device list of the first device and the trusted device list of the second device, a shared trusted device for the first device and the second device is determined.

[0127] In some embodiments, when the processor 201 determines the shared trusted device of the first device and the second device based on the trusted device list of the first device and the trusted device list of the second device, it is configured to:

[0128] Based on the trusted device list of the first device and the trusted device list of the second device, determine the devices that mutually trust the first device and the second device.

[0129] If there is only one device that is mutually trusted by both the first device and the second device, the device that is mutually trusted by both the first device and the second device is identified as the mutually trusted device.

[0130] In some embodiments, the first device information further includes location information of the first device, the second device information further includes location information of the second device, and the processor 201 is further configured to implement:

[0131] If there are multiple devices that mutually trust the first device and the second device, the devices that mutually trust the first device and the second device are identified as candidate devices;

[0132] Based on the location information of the first device and the location information of each candidate device, a first distance between each candidate device and the first device is determined;

[0133] Based on the location information of the second device and the location information of each candidate device, a second distance between each candidate device and the second device is determined;

[0134] The first distance and the second distance corresponding to each candidate device are summed to obtain the target distance corresponding to each candidate device.

[0135] The candidate device corresponding to the smallest target distance is determined as the shared trust device of the first device and the second device.

[0136] In some embodiments, when the electronic device 200 is a second device, the processor 201 is further configured to implement:

[0137] When a device discovery request broadcast by the first device is detected, second device information is sent to the first device so that the first device can determine the mutually trusted devices of the first device and the second device based on its own trusted device list and the trusted device list in the second device information.

[0138] Obtain the challenge parameters sent by the shared trust device, wherein the challenge parameters are generated by the first device based on the challenge random number and the device identity identifier of the shared trust device and then sent to the shared trust device;

[0139] Based on the device identity identifier of the shared trust device and the random number in the challenge parameters, a verification parameter is generated and sent to the shared trust device so that the shared trust device can forward the verification parameter to the first device. When the verification parameter passes verification, the first device negotiates a session key with the second device using a password authentication key exchange protocol based on the challenge random number, and performs a device identity identifier exchange operation based on the session key, so that the first device and the second device can exchange their respective device identity identifiers.

[0140] In some embodiments, when the electronic device 200 is a shared device, the processor 201 is further configured to implement:

[0141] Obtain the challenge parameters sent by the first device, wherein the challenge parameters are generated by the first device based on the challenge random number and the device identity identifier of the trusted device;

[0142] The challenge parameters are sent to the second device, which generates verification parameters based on the device identity of the shared trust device and the random number in the challenge parameters, and then sends the verification parameters to the shared trust device.

[0143] The verification parameters sent by the second device are obtained and sent to the first device. When the verification parameters are verified, the first device negotiates a session key with the second device using a password authentication key exchange protocol based on the challenge random number, and performs a device identity exchange operation according to the session key, so that the first device and the second device exchange their respective device identity identifiers.

[0144] It should be noted that those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the electronic device described above can be referred to the corresponding process in the aforementioned device authentication method embodiments, and will not be repeated here.

[0145] This invention also provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs that can be executed by one or more processors to implement any of the device authentication methods provided in the specification of this invention.

[0146] The storage medium can be an internal storage unit of the electronic device described in the foregoing embodiments, such as a hard drive or memory of the electronic device. Alternatively, the storage medium can be an external storage device of the electronic device, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card.

[0147] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware embodiments, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0148] It should be understood that the term "and / or" as used in this specification and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations. It should be noted that, herein, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0149] The sequence numbers of the above embodiments of the present invention are merely for descriptive purposes and do not represent the superiority or inferiority of the embodiments. The above descriptions are only specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A device authentication method, characterized in that, Applied to a first device, the method includes: A shared trust device is identified between the first device and the second device, where the first device and the second device are devices to be authenticated, and the shared trust device mutually trusts the first device and the second device, respectively. Generate a challenge random number, and generate challenge parameters based on the challenge random number and the device identity identifier of the shared trust device; The challenge parameters are sent to the shared trust device, and the verification parameters returned by the shared trust device are obtained. The shared trust device forwards the challenge parameters to the second device, so that the second device can generate verification parameters based on the device identity of the shared trust device and the random number in the received challenge parameters, and send the verification parameters to the shared trust device, so that the shared trust device forwards the verification parameters to the first device. When the device identity identifier in the verification parameters is the same as the device identity identifier of the trusted device, and the random number in the verification parameters is the same as the challenge random number, a session key is negotiated with the second device using the password authentication key exchange protocol based on the challenge random number; Based on the session key, a device identity exchange operation is performed so that the first device and the second device can exchange their respective device identities.

2. The device authentication method according to claim 1, characterized in that, The method for determining the shared trust device between the first device and the second device includes: The first device broadcasts a device discovery request, the device discovery request including first device information, the first device information including a list of trusted devices of the first device; Obtain the second device information returned by the second device based on the device discovery request, the second device information including the trusted device list of the second device; Based on the trusted device list of the first device and the trusted device list of the second device, a shared trusted device for the first device and the second device is determined.

3. The device authentication method according to claim 2, characterized in that, The step of determining the shared trusted device between the first device and the second device based on the trusted device list of the first device and the trusted device list of the second device includes: Based on the trusted device list of the first device and the trusted device list of the second device, determine the devices that mutually trust the first device and the second device. If there is only one device that is mutually trusted by both the first device and the second device, the device that is mutually trusted by both the first device and the second device is identified as the mutually trusted device.

4. The device authentication method according to claim 3, characterized in that, The first device information also includes the location information of the first device, and the second device information also includes the location information of the second device. The method further includes: If there are multiple devices that mutually trust the first device and the second device, the devices that mutually trust the first device and the second device are identified as candidate devices; Based on the location information of the first device and the location information of each candidate device, a first distance between each candidate device and the first device is determined; Based on the location information of the second device and the location information of each candidate device, a second distance between each candidate device and the second device is determined; The first distance and the second distance corresponding to each candidate device are summed to obtain the target distance corresponding to each candidate device. The candidate device corresponding to the smallest target distance is determined as the shared trust device of the first device and the second device.

5. A device authentication method, characterized in that, Applied to a second device, the method includes: When a device discovery request broadcast by the first device is detected, second device information is sent to the first device so that the first device can determine the mutually trusted devices of the first device and the second device based on its own trusted device list and the trusted device list in the second device information. Obtain the challenge parameters sent by the shared trust device, wherein the challenge parameters are generated by the first device based on the challenge random number and the device identity identifier of the shared trust device and then sent to the shared trust device; Based on the device identity identifier of the shared trust device and the random number in the challenge parameters, a verification parameter is generated and sent to the shared trust device so that the shared trust device can forward the verification parameter to the first device. Wherein, if the device identity identifier in the verification parameter is the same as the device identity identifier of the shared trust device, and the random number in the verification parameter is the same as the challenge random number, the first device negotiates a session key with the second device using a password authentication key exchange protocol based on the challenge random number, and performs a device identity identifier exchange operation based on the session key, so that the first device and the second device can exchange their respective device identity identifiers.

6. A device authentication method, characterized in that, Applied to a mutual trust device, wherein the mutual trust device mutually trusts with a first device and a second device respectively, the method includes: Obtain the challenge parameters sent by the first device, wherein the challenge parameters are generated by the first device based on the challenge random number and the device identity identifier of the trusted device; The challenge parameters are sent to the second device, which generates verification parameters based on the device identity of the shared trust device and the random number in the challenge parameters, and then sends the verification parameters to the shared trust device. The verification parameters sent by the second device are obtained and sent to the first device. The device identity identifier in the verification parameters is the same as the device identity identifier of the trusted device, and the random number in the verification parameters is the same as the challenge random number. Based on the challenge random number, the first device negotiates a session key with the second device using a password authentication key exchange protocol, and performs a device identity identifier exchange operation according to the session key, so that the first device and the second device exchange their respective device identity identifiers.

7. A device authentication apparatus, characterized in that, The device authentication apparatus includes: The device determination module is configured to determine a trusted device for a first device and a second device, wherein the first device and the second device are devices to be authenticated, and the trusted device mutually trusts the first device and the second device, respectively. The parameter generation module is configured to generate challenge random numbers and generate challenge parameters based on the challenge random numbers and the device identity identifier of the shared trust device; The transceiver module is configured to send the challenge parameters to the shared trust device and obtain the verification parameters returned by the shared trust device. The shared trust device forwards the challenge parameters to the second device, so that the second device can generate verification parameters based on the device identity of the shared trust device and the random number in the received challenge parameters, and send the verification parameters to the shared trust device, so that the shared trust device forwards the verification parameters to the first device. The key negotiation module is configured to negotiate a session key with the second device based on the challenge random number when the device identity identifier in the verification parameters is the same as the device identity identifier of the trusted device and the random number in the verification parameters is the same as the challenge random number. The identifier exchange module is configured to perform a device identity exchange operation based on the session key, so that the first device and the second device exchange their respective device identity identifiers.

8. The device authentication apparatus according to claim 7, characterized in that, The device determination module includes: The broadcast submodule is configured to broadcast a device discovery request, which includes first device information, including a list of trusted devices for the first device. The acquisition submodule is configured to acquire second device information returned by the second device based on the device discovery request, the second device information including the trusted device list of the second device; The device determination submodule is configured to determine the shared trusted device of the first device and the second device based on the trusted device list of the first device and the trusted device list of the second device.

9. An electronic device, characterized in that, The electronic device includes a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for enabling communication between the processor and the memory, wherein the computer program, when executed by the processor, implements the device authentication method as described in any one of claims 1 to 6.

10. A storage medium for computer-readable storage, characterized in that, The storage medium stores one or more programs, which can be executed by one or more processors to implement the device authentication method according to any one of claims 1 to 6.

Images