Security authentication method, management and control platform, network device and storage medium

Abstract

The application discloses a security authentication method, a management and control platform, network equipment and a storage medium. The method comprises the following steps: an edge device sends a device activation request to the management and control platform; after the management and control platform verifies the edge device, the edge device state is updated to an activation state, an activation response feedback is sent to the edge device, and a first-level authentication feedback is sent to an authentication service component corresponding to the edge device; after the edge device receives the activation response feedback, a registration request is sent to the authentication service component; after the authentication service component verifies the edge device, a second-level authentication feedback is sent to the edge device; the edge device generates a media resource acquisition request carrying the second-level authentication feedback, and requests a media resource from the authentication service component through the media resource acquisition request. The application reduces the device authentication pressure of the management and control platform.

Description

Technical Field

[0001] This invention relates to the field of device authentication technology, and in particular to a security authentication method, a management platform, a network device, and a storage medium. Background Technology

[0002] To meet the security authentication requirements of live streaming terminals, point-to-point security authentication of the corresponding edge hardware devices (such as set-top boxes) is necessary. Currently, edge hardware devices are mainly authenticated centrally through a unified authentication distribution center. However, the number of edge hardware devices in real life is vast. If the unified authentication distribution center is used to authenticate all these edge hardware devices, it will increase the workload of the unified authentication distribution center and reduce the security authentication requirements of live streaming terminals. Summary of the Invention

[0003] This invention provides a security authentication method, a management platform, network devices, and storage media, aiming to solve the technical problem that authenticating numerous edge hardware devices through a unified authentication distribution center increases the workload of the unified authentication distribution center.

[0004] This invention provides a security authentication method applied to a management and control platform, the security authentication method comprising:

[0005] Receive a device activation request sent by an edge device, and determine the device code of the edge device based on the device activation request;

[0006] When the device code passes verification, the device status of the edge device is updated to active, and an activation response feedback is sent to the edge device; and,

[0007] The authentication service component corresponding to the edge device is determined, and a first-level authentication feedback is sent to the authentication service component. When the authentication service component verifies the edge device using the first-level authentication feedback, it sends a second-level authentication feedback to the edge device.

[0008] In one embodiment, the security authentication method further includes:

[0009] A key pair is generated based on the device code and a preset encryption algorithm, the key pair including a public key and a private key;

[0010] The service identifier of the authentication service component corresponding to the edge device is determined based on the device code.

[0011] The address information of the authentication service component is determined based on the service identifier;

[0012] The activation response feedback is generated based on the device code, the public key, and the address information; and...

[0013] The first-level authentication feedback is generated based on the device code, the private key, and the service identifier.

[0014] This invention also provides a security authentication method applied to an authentication service component, the security authentication method comprising:

[0015] After receiving the registration request from the edge device, determine the device code and private key contained in the first-level authentication feedback sent by the management platform;

[0016] The registration request is decrypted using the private key to obtain the device code contained in the registration request;

[0017] When the device code included in the first-level authentication feedback matches the device code included in the registration request, a second-level authentication feedback is generated.

[0018] Send the secondary authentication feedback to the edge device.

[0019] In one embodiment, the step of decrypting the registration request using the private key to obtain the public key contained in the registration request, and generating the secondary authentication feedback, includes:

[0020] Generate authentication pass information for the edge device;

[0021] The authentication pass information and the current time information are encrypted using the private key and the public key to obtain the secondary authentication feedback.

[0022] In one embodiment, after the step of sending the secondary authentication feedback to the edge device, the method further includes:

[0023] After receiving the media resource acquisition request sent by the edge device, determine the generation time of the secondary authentication feedback included in the media resource acquisition request;

[0024] When the generation duration is less than or equal to the preset valid duration, the media resource corresponding to the media resource acquisition request is sent to the edge device.

[0025] This invention also provides a security authentication method applied to edge devices, the security authentication method comprising:

[0026] A device activation request is generated based on the device code of the edge device, and the device activation request is sent to the management and control platform.

[0027] After receiving the activation response feedback from the management and control platform, a registration request is generated and sent to the authentication service component corresponding to the edge device;

[0028] After receiving the secondary authentication feedback sent by the authentication service component, a media resource acquisition request carrying the secondary authentication feedback is generated;

[0029] Send a media resource retrieval request to the authentication service component to request media resources from the authentication service component.

[0030] In one embodiment, the steps of generating a registration request and sending the registration request to the authentication service component corresponding to the edge device include:

[0031] Determine the public key and the address information of the authentication service component contained in the activation response feedback;

[0032] The device code is encrypted using the public key to generate a registration request;

[0033] The registration request is sent to the authentication service component corresponding to the address information.

[0034] Furthermore, to achieve the above objectives, the present invention also provides a control platform, the control platform comprising:

[0035] A request receiving module is used to receive a device activation request sent by an edge device and determine the device code of the edge device based on the device activation request.

[0036] The first sending module is used to update the device status of the edge device to an active state and send an activation response feedback to the edge device when the device code passes verification.

[0037] The second sending module is used to determine the authentication service component corresponding to the edge device and send a first-level authentication feedback to the authentication service component. When the authentication service component verifies the edge device using the first-level authentication feedback, it sends a second-level authentication feedback to the edge device.

[0038] In addition, to achieve the above objectives, the present invention also provides a network device, the edge device comprising: a memory, a processor, and a security authentication program stored in the memory and executable on the processor, wherein the security authentication program, when executed by the processor, implements the steps of the security authentication method described above.

[0039] In addition, to achieve the above objectives, the present invention also provides a storage medium storing a security authentication program thereon, which, when executed by a processor, implements the steps of the security authentication method described above.

[0040] The technical solution of the security authentication method, management platform, network device and storage medium provided in the embodiments of the present invention has at least the following technical effects or advantages:

[0041] This invention authenticates edge devices through collaboration between a management platform and an authentication service component. The edge device sends a device activation request containing a device code to the management platform. After verifying the device code in the activation request, the management platform updates the edge device's status to active and sends an activation response feedback, as well as a first-level authentication feedback, to the corresponding authentication service component. Upon receiving the activation response feedback, the edge device obtains the public key and the address information of the authentication service component contained within it. It then uses the public key to encrypt its own device code, generates a registration request, and sends it to the authentication service component corresponding to the address information. The authentication service component obtains the device code and private key from the received first-level authentication feedback, decrypts the registration request using the private key, and obtains the device code in the registration request. If the device code in the first-level authentication feedback matches the device code in the registration request, it generates a second-level authentication feedback and sends it to the edge device. The edge device then generates a media resource acquisition request carrying the second-level authentication feedback and requests media resources from the authentication service component based on this request. This invention solves the technical problem that authenticating numerous edge hardware devices through a unified authentication and distribution center increases the workload of the unified authentication and distribution center. It realizes multi-level (hierarchical) authentication of edge devices, which not only reduces the device authentication pressure on the management and control platform, but also protects the identity information of edge devices and improves the security of media resource sharing by edge devices. Attached Figure Description

[0042] Figure 1 This is a schematic diagram of the hardware operating environment involved in the embodiments of the present invention;

[0043] Figure 2 This is a flowchart illustrating the first embodiment of the security authentication method of the present invention;

[0044] Figure 3 This is a flowchart illustrating the second embodiment of the security authentication method of the present invention;

[0045] Figure 4 This is a flowchart illustrating the third embodiment of the security authentication method of the present invention;

[0046] Figure 5 This is a schematic diagram illustrating the multi-level authentication of the edge device of the present invention;

[0047] Figure 6 This is a functional block diagram of the control platform of the present invention;

[0048] Figure 7 This is a functional module diagram of the authentication service component of the present invention;

[0049] Figure 8 This is a functional module diagram of the edge device. Detailed Implementation

[0050] To better understand the above technical solutions, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the invention to those skilled in the art.

[0051] like Figure 1 As shown, Figure 1 This is a schematic diagram of the hardware operating environment involved in the embodiments of the present invention.

[0052] It should be noted that, Figure 1 This can be a schematic diagram of the hardware operating environment of network devices.

[0053] As one implementation method, it can be as follows Figure 1 As shown, the embodiment of the present invention relates to a network device. The network device includes: a processor 1001, such as a CPU, a memory 1002, and a communication bus 1003. The communication bus 1003 is used to implement communication between these components.

[0054] Memory 1002 can be high-speed RAX memory or stable memory (non-volatile XeXory), such as disk storage. Figure 1 As shown, the memory 1002, which serves as a storage medium, may include a security authentication program; and the processor 1001 may be used to invoke the security authentication program stored in the memory 1002 and perform the following operations:

[0055] Receive a device activation request sent by an edge device, and determine the device code of the edge device based on the device activation request;

[0056] When the device code passes verification, the device status of the edge device is updated to active, and an activation response feedback is sent to the edge device; and,

[0057] The authentication service component corresponding to the edge device is determined, and a first-level authentication feedback is sent to the authentication service component. When the authentication service component verifies the edge device using the first-level authentication feedback, it sends a second-level authentication feedback to the edge device.

[0058] Furthermore, the processor 1001 can be used to invoke the security authentication program stored in the memory 1002 and perform the following operations:

[0059] A key pair is generated based on the device code and a preset encryption algorithm, the key pair including a public key and a private key;

[0060] The service identifier of the authentication service component corresponding to the edge device is determined based on the device code.

[0061] The address information of the authentication service component is determined based on the service identifier;

[0062] The activation response feedback is generated based on the device code, the public key, and the address information; and...

[0063] The first-level authentication feedback is generated based on the device code, the private key, and the service identifier.

[0064] Furthermore, the processor 1001 can be used to invoke the security authentication program stored in the memory 1002 and perform the following operations:

[0065] After receiving the registration request from the edge device, determine the device code and private key contained in the first-level authentication feedback sent by the management platform;

[0066] The registration request is decrypted using the private key to obtain the device code contained in the registration request;

[0067] When the device code included in the first-level authentication feedback matches the device code included in the registration request, a second-level authentication feedback is generated.

[0068] Send the secondary authentication feedback to the edge device.

[0069] Furthermore, the processor 1001 can be used to invoke the security authentication program stored in the memory 1002 and perform the following operations:

[0070] Generate authentication pass information for the edge device;

[0071] The authentication pass information and the current time information are encrypted using the private key and the public key to obtain the secondary authentication feedback.

[0072] Furthermore, the processor 1001 can be used to invoke the security authentication program stored in the memory 1002 and perform the following operations:

[0073] After receiving the media resource acquisition request sent by the edge device, determine the generation time of the secondary authentication feedback included in the media resource acquisition request;

[0074] When the generation duration is less than or equal to the preset valid duration, the media resource corresponding to the media resource acquisition request is sent to the edge device.

[0075] Furthermore, the processor 1001 can be used to invoke the security authentication program stored in the memory 1002 and perform the following operations:

[0076] A device activation request is generated based on the device code of the edge device, and the device activation request is sent to the management and control platform.

[0077] After receiving the activation response feedback from the management and control platform, a registration request is generated and sent to the authentication service component corresponding to the edge device;

[0078] After receiving the secondary authentication feedback sent by the authentication service component, a media resource acquisition request carrying the secondary authentication feedback is generated;

[0079] Send a media resource retrieval request to the authentication service component to request media resources from the authentication service component.

[0080] Furthermore, the processor 1001 can be used to invoke the security authentication program stored in the memory 1002 and perform the following operations:

[0081] Determine the public key and the address information of the authentication service component contained in the activation response feedback;

[0082] The device code is encrypted using the public key to generate a registration request;

[0083] The registration request is sent to the authentication service component corresponding to the address information.

[0084] This invention provides embodiments of a security authentication method. It should be noted that although the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order. This security authentication method is applied to the security authentication of edge devices. Specifically, this application performs hierarchical authentication of edge devices through a management platform and authentication service components. Multiple authentication service components are used. The management platform can be a server, and the authentication service components can also be servers. The management platform is at a higher level than the authentication service components; that is, the management platform can be understood as a first-level server, and the authentication service components as second-level servers. The management platform, multiple authentication service components, and edge devices communicate with each other. The edge device can be a set-top box or other devices requiring security authentication. The following embodiments of this application use a set-top box as an example of an edge device.

[0085] In this application, each set-top box has a device code, which refers to the STB (Set Top Box) code. The management platform is responsible for the initial authentication of set-top boxes within its service range, i.e., performing Level 1 authentication. The authentication service component is responsible for the secondary authentication of set-top boxes within its service range. That is, after the management platform performs Level 1 authentication on the set-top box, the authentication service component performs Level 2 authentication on the same set-top box. The set-top box actively initiates an authentication request to both the management platform and the authentication service component.

[0086] The management platform pre-stores the device codes of all set-top boxes within its service range. These device codes form the device code set MEC, which is:

[0087] MEC = {A1,A2,...,Ax,An,B1,B2,...,Bx,Bn,C1,C2,...,Cx,Cn}, where A, B, C, etc. represent the region to which the set-top box belongs. For example, Cx represents the device code of the xth set-top box in region C.

[0088] For each set-top box, the management platform records the device status of each set-top box. The device status indicates whether the set-top box is activated. The device status of each set-top box is represented by an activation code, which is denoted as ActCode, ActCode = {Ax, KeyPub-Ax, KeyPri-Ax, Status-Ax}, where Ax represents the set-top box code of region A, KeyPub-Ax represents the public key of the set-top box, KeyPri-Ax represents the private key of the set-top box, and Status-Ax represents the device status of the set-top box, which is usually not activated by default. The public and private keys are a key pair, generated by the device code and a preset algorithm, such as the RSA algorithm.

[0089] For multiple authentication service components, the management platform pre-stores the service identifiers of each authentication service component. Each service identifier is associated with the address information of the corresponding authentication service component, such as an IP address. The service identifiers of all authentication service components form the authentication service component identifier set S, that is:

[0090] S = {S1, S2, ..., Sx, Sn}, where Sx represents the service identifier of the x-th authentication service component. Each authentication service component corresponds to a set-top box, that is, there is a corresponding relationship Mec2S between each authentication service component and a set-top box. Mec2S = {Ax: {S1, Sx}}, representing the Ax-th set-top box, which can initiate authentication and request services from authentication service components S1 and Sx. The request for services refers to the authentication service component under the set-top box requesting media resources, including live data and broadcast information.

[0091] like Figure 2As shown, in the first embodiment of the present invention, the security authentication method of the present invention is applied to a management and control platform, and includes the following steps:

[0092] Step S210: Receive a device activation request sent by the edge device, and determine the device code of the edge device based on the device activation request.

[0093] In this embodiment, the set-top box requests media resources from the authentication service component, provided that both the management platform and the authentication service component have successfully authenticated the set-top box. When authentication is required, the set-top box sends a device activation request to the management platform. Sending this request indicates that the set-top box needs authentication from the management platform. After receiving the device activation request, the management platform parses it to obtain the device code of the set-top box that sent the request.

[0094] Step S220: When the device code passes verification, update the device status of the edge device to active status and send an activation response feedback to the edge device.

[0095] The management platform verifies the obtained device code by comparing it with each device code in the Device Code Set (MEC). If the obtained device code matches a device code in the MEC, it means the device code exists in the MEC, indicating successful verification of the device code and the set-top box. The platform then updates the set-top box's device status to active and generates an activation response, which is sent to the set-top box. Sending the activation response to the set-top box signifies that the management platform has completed Level 1 authentication, meaning Level 1 authentication is successful. If the obtained device code does not exist in the MEC, it means the set-top box verification failed, and the authentication process terminates.

[0096] The methods for generating activation response feedback include:

[0097] Generate a key pair based on the device code and a preset encryption algorithm;

[0098] The service identifier of the authentication service component corresponding to the edge device is determined based on the device code;

[0099] The address information of the authentication service component is determined based on the service identifier;

[0100] An activation response is generated based on the device code, public key, and address information.

[0101] The device code is used as an input parameter and fed into a preset encryption algorithm. The output of the preset encryption algorithm is a key pair, which includes a public key and a private key. The public and private keys are matched. The mapping between the authentication service component and the set-top box is queried based on the device code. This yields the service identifier of the authentication service component corresponding to the set-top box. The address information of the authentication service component can be obtained through the service identifier. Then, based on the device code, public key, and address information, an activation response is generated. In other words, the activation response contains the set-top box's device code, public key, and the address information of the authentication service component corresponding to the set-top box.

[0102] Step S230: Determine the authentication service component corresponding to the edge device, and send a first-level authentication feedback to the authentication service component. When the authentication service component verifies the edge device using the first-level authentication feedback, it sends a second-level authentication feedback to the edge device.

[0103] While sending the activation response feedback to the set-top box, the management platform also sends a first-level authentication feedback to the authentication service component. Since the device code, private key, and service identifier were already obtained when generating the activation response feedback, the first-level authentication feedback is generated based on the device code, private key, and service identifier; that is, the first-level authentication feedback contains the device code, private key, and service identifier. After generating the first-level authentication feedback, it is sent to the authentication service component corresponding to the service identifier. For example, the first-level authentication feedback might be {Ax, KeyPri-Ax, Sx}, where Ax represents the device code of set-top box Ax, KeyPri-Ax represents the private key corresponding to set-top box Ax, and Sx represents the service identifier of authentication service component Sx. The management platform then sends the first-level authentication feedback to authentication service component Sx.

[0104] After receiving the activation response feedback from the management platform, the set-top box indicates that its device status in the management platform is active, meaning the set-top box knows it has been activated and then sends a registration request to the authentication service component. Upon receiving the registration request, the authentication service component verifies the set-top box using first-level authentication feedback. If the set-top box passes verification, the authentication service component sends second-level authentication feedback to the set-top box. Sending the second-level authentication feedback to the set-top box signifies that the authentication service component has completed second-level authentication, meaning second-level authentication is successful. Then, based on the received second-level authentication feedback, the set-top box requests media resources from the authentication service component.

[0105] According to the above technical solution, this embodiment achieves first-level authentication of edge devices through the management and control platform, thereby reducing the device authentication pressure on the management and control platform.

[0106] like Figure 3As shown, in the second embodiment of the present invention, the security authentication method of the present invention is applied to an authentication service component and includes the following steps:

[0107] Step S310: After receiving the registration request sent by the edge device, determine the device code and private key contained in the first-level authentication feedback sent by the management platform.

[0108] In this embodiment, after receiving the activation response feedback from the management and control platform, the set-top box determines that it has been activated, generates a registration request, and sends the registration request to the authentication service component. The set-top box sending the registration request to the authentication service component indicates that the authentication service component needs to perform secondary authentication on the set-top box. After receiving the registration request from the set-top box, the authentication service component parses the primary authentication feedback sent by the management and control platform to obtain the device code and private key contained in the primary authentication feedback.

[0109] Step S320: Decrypt the registration request using the private key to obtain the device code contained in the registration request.

[0110] Since the registration request is generated by the set-top box using public key encryption, the public key and the private key contained in the first-level authentication feedback are a key pair. The two are matched, and the authentication service component uses the private key contained in the first-level authentication feedback to decrypt the registration request to obtain the device code contained in the registration request.

[0111] Step S330: When the device code contained in the first-level authentication feedback is consistent with the device code contained in the registration request, generate the second-level authentication feedback.

[0112] The authentication service component uses Level 1 authentication to authenticate the set-top box. This means that Level 1 authentication verifies the device code contained in the registration request. Specifically, it compares the device code in the registration request with the device code in the Level 1 authentication feedback. If the device code in the Level 1 authentication feedback matches the device code in the registration request, it means that the device code in the registration request has passed the verification, and then Level 2 authentication feedback is generated.

[0113] The process involves decrypting the registration request using a private key to obtain the public key contained in the registration request. Further generation of secondary authentication feedback includes: generating authentication pass information for the edge device; encrypting the authentication pass information and the current time information using the private and public keys to obtain the secondary authentication feedback. If the device code in the primary authentication feedback matches the device code in the registration request, it indicates that the device code in the registration request has passed verification, and authentication pass information for the set-top box is generated. This authentication pass information indicates that the set-top box has been authenticated by the authentication service component. The authentication service component then obtains the current time information and encrypts the authentication pass information and the current time information together using the private and public keys to obtain the secondary authentication feedback. The secondary authentication feedback carries time information, which can be understood as a timestamp. The timestamp can be used to determine whether the secondary authentication feedback carried in the media resource acquisition request sent by the set-top box to the authentication service component has expired, and whether the set-top box can request the media resource.

[0114] Step S340: Send the secondary authentication feedback to the edge device.

[0115] After generating the secondary authentication feedback, the authentication service component sends the feedback to the set-top box. This indicates that the authentication service component has completed secondary authentication for the set-top box; that is, the secondary authentication is successful. Upon receiving the secondary authentication feedback, the set-top box can then request media resources from the authentication service component based on the feedback.

[0116] According to the above technical solution, this embodiment realizes secondary authentication of edge devices through the authentication service component, which relieves the management platform of the device authentication work and reduces the device authentication pressure on the management platform.

[0117] Furthermore, the following steps are included after step S340:

[0118] After receiving the media resource acquisition request sent by the edge device, determine the generation time of the secondary authentication feedback included in the media resource acquisition request;

[0119] When the generation duration is less than or equal to the preset valid duration, the media resource corresponding to the media resource acquisition request is sent to the edge device.

[0120] The set-top box is pre-set to need to authenticate once at certain preset validity periods. In other words, each successful authentication of a set-top box is not permanent. If the time after the set-top box is authenticated exceeds the preset validity period, the set-top box will be unable to request media resources from the authentication service component, which means that the set-top box authentication has expired and the set-top box needs to re-initiate authentication.

[0121] The authentication service component determines whether the set-top box's authentication has expired by identifying whether the secondary authentication feedback carried when the set-top box requests media resources has expired. Since the secondary authentication feedback generated by the authentication service component includes time information, this time information can be understood as a timestamp. The set-top box sends a media resource acquisition request to the authentication service component. The authentication service component retrieves the secondary authentication feedback from the media resource acquisition request, then decrypts the secondary authentication feedback using its public and private keys to obtain the timestamp. It then calculates the generation duration of the secondary authentication feedback based on the current time and the timestamp in the secondary authentication feedback. If the generation duration is less than or equal to the preset valid duration, it indicates that the secondary authentication feedback has not expired, and the media resources corresponding to the media resource acquisition request are sent to the set-top box, thus helping to protect the set-top box's security. If the generation duration is greater than the preset valid duration, it indicates that the secondary authentication feedback has expired and is invalid, also indicating that the set-top box authentication has expired. The set-top box's request for media resources from the authentication service component fails, and the set-top box needs to re-request authentication from the management platform and the authentication service component.

[0122] like Figure 4 As shown, in the third embodiment of the present invention, the security authentication method of the present invention is applied to an edge device and includes the following steps:

[0123] Step S410: Generate a device activation request based on the device code of the edge device, and send the device activation request to the management platform.

[0124] In this embodiment, when the set-top box needs to request authentication from the management platform and the authentication service component, the set-top box obtains its own device code, then generates a device activation request based on the device code, and sends the device activation request to the management platform. The management platform performs first-level authentication on the set-top box based on the device activation request.

[0125] Step S420: After receiving the activation response feedback sent by the management and control platform, generate a registration request and send the registration request to the authentication service component corresponding to the edge device.

[0126] After the management platform authenticates the set-top box, it updates the set-top box's device status to active and then sends the generated activation response feedback to the set-top box. This notification signifies that the management platform has completed the first-level authentication of the set-top box. Upon receiving the activation response feedback, the set-top box recognizes its active status within the management platform, indicating that it has been activated and authenticated. It then requests second-level authentication from the authentication service component.

[0127] After receiving the activation response, the set-top box generates a registration request and sends the registration request to the authentication service component corresponding to the set-top box. Generating the registration request and sending the registration request to the authentication service component corresponding to the edge device includes:

[0128] Determine the public key and the address information of the authentication service component contained in the activation response feedback;

[0129] The device code is encrypted using the public key to generate a registration request;

[0130] The registration request is sent to the authentication service component corresponding to the address information.

[0131] The set-top box parses the activation response feedback to obtain the public key and the address information of the authentication service component contained in the activation response feedback. Then, it uses the public key to encrypt its own device code and current time information to generate a registration request. Finally, it sends the registration request to the authentication service component corresponding to the address information according to the address information of the authentication service component.

[0132] For example, the activation response is {Ax, KeyPub-Ax, SAddrx}, where Ax represents the device code of set-top box Ax, KeyPub-Ax represents the public key corresponding to set-top box Ax, and SAddrx represents the address information of authentication service component Sx. Set-top box Ax sends the registration request to authentication service component Sx according to SAddrx.

[0133] Step S430: After receiving the secondary authentication feedback sent by the authentication service component, generate a media resource acquisition request carrying the secondary authentication feedback.

[0134] Step S440: Send a media resource acquisition request to the authentication service component to request media resources from the authentication service component.

[0135] After receiving a registration request, the authentication service component authenticates the set-top box that sent the registration request. Once the set-top box is successfully authenticated, a secondary authentication feedback is generated and sent to the set-top box. The authentication service component sending the secondary authentication feedback to the set-top box indicates that the authentication service component has completed the secondary authentication of the set-top box, i.e., the secondary authentication is successful.

[0136] After receiving the secondary authentication feedback from the authentication service component, the set-top box confirms that it has been successfully authenticated by the management platform and the authentication service component, and can then request media resources from the authentication service component. It then generates a media resource acquisition request carrying the secondary authentication feedback and sends the request to the authentication service component. The authentication service component verifies that the secondary authentication feedback in the media resource acquisition request is valid and sends the corresponding media resources to the set-top box, which then receives the media resources from the authentication service component.

[0137] Based on the above technical solution, this embodiment achieves multi-level (hierarchical) authentication of edge devices through the collaboration of the management platform and authentication service components, and also protects the security of information transmission.

[0138] like Figure 5 As shown, taking the set-top box Ax as an example, the specific implementation process of the interaction between the management platform, the authentication service group, and the edge device of this invention is as follows:

[0139] When set-top box Ax needs to request authentication from the management platform and authentication service component Sx, set-top box Ax obtains its own device code, then generates a device activation request based on the device code, and sends the device activation request to the management platform.

[0140] After receiving the device activation request from set-top box Ax, the management platform parses the request to obtain the device code of set-top box Ax. The platform compares the obtained device code with each device code in the device code set MEC. Once it confirms that the obtained device code exists in the MEC, it updates the device status of set-top box Ax to active. Then, based on the device code and a preset encryption algorithm, it generates a public key KeyPub-Ax and a private key KeyPri-Ax. It then queries the correspondence between the authentication service component and the set-top box based on the device code to obtain the service identifier Sx of the authentication service component corresponding to set-top box Ax. Through the service identifier Sx, it obtains the address information SAddrx of the authentication service component Sx. Finally, based on the device code, public key KeyPub-Ax, and address information SAddrx, it generates an activation response feedback and sends it to set-top box Ax. The platform's sending of the activation response feedback to set-top box Ax signifies that the platform has completed Level 1 authentication for set-top box Ax, i.e., Level 1 authentication is successful.

[0141] While generating activation response feedback, the management platform also generates first-level authentication feedback based on the device code, private key KeyPri-Ax, and service identifier Sx, and sends the first-level authentication feedback to the authentication service component Sx according to the service identifier Sx.

[0142] After receiving the activation response feedback sent by the management platform, the set-top box Ax parses the activation response feedback to obtain the public key KeyPub-Ax and address information SAddrx contained in the activation response feedback. Then, it uses the public key KeyPub-Ax to encrypt its own device code and current time information to generate a registration request, and then sends the registration request to the authentication service component Sx according to the address information SAddrx.

[0143] After receiving the registration request from set-top box Ax, the authentication service component Sx parses the first-level authentication feedback sent by the management platform to obtain the device code and private key KeyPri-Ax contained in the first-level authentication feedback. Then, it decrypts the registration request using the private key KeyPri-Ax to obtain the device code and public key KeyPub-Ax contained in the registration request. Next, it compares the device code in the registration request with the device code in the first-level authentication feedback. If the device code in the first-level authentication feedback matches the device code in the registration request, it generates authentication pass information for the edge device. This authentication pass information, along with the current time information, is encrypted using the private key KeyPri-Ax and the public key KeyPub-Ax to obtain the second-level authentication feedback, which is then sent to set-top box Ax. The authentication service component Sx sending the second-level authentication feedback to set-top box Ax indicates that the authentication service component Sx has completed the second-level authentication for set-top box Ax, i.e., the second-level authentication is successful.

[0144] After receiving the secondary authentication feedback sent by the authentication service component Sx, the set-top box Ax determines that it can request media resources from the authentication service component Sx, generates a media resource acquisition request carrying the secondary authentication feedback, and sends the media resource acquisition request to the authentication service component Sx.

[0145] After receiving a media resource acquisition request, the authentication service component Sx retrieves the secondary authentication feedback from the request. It then decrypts the secondary authentication feedback using the public key KeyPub-Ax and the private key KeyPri-Ax to obtain a timestamp. Based on the current time and the timestamp, it calculates the generation duration of the secondary authentication feedback. If the generation duration is less than or equal to the preset valid duration, it sends the media resource corresponding to the media resource acquisition request to the set-top box Ax. The set-top box Ax then receives the media resource sent by the authentication service component Sx.

[0146] This invention solves the technical problem that authenticating numerous edge hardware devices through a unified authentication and distribution center increases the workload of the unified authentication and distribution center. It realizes multi-level (hierarchical) authentication of edge devices, which not only reduces the device authentication pressure on the management and control platform, but also protects the identity information of edge devices and improves the security of media resource sharing by edge devices.

[0147] like Figure 6 As shown, the present invention provides a control platform, the control platform comprising:

[0148] The request receiving module 210 is used to receive a device activation request sent by the edge device and determine the device code of the edge device based on the device activation request.

[0149] The first sending module 220 is used to update the device status of the edge device to an active state and send an activation response feedback to the edge device when the device code passes verification.

[0150] The second sending module 230 is used to determine the authentication service component corresponding to the edge device and send a first-level authentication feedback to the authentication service component. When the authentication service component verifies the edge device using the first-level authentication feedback, it sends a second-level authentication feedback to the edge device.

[0151] Furthermore, the control platform also includes:

[0152] The first processing unit is configured to generate a key pair based on the device code and a preset encryption algorithm, wherein the key pair includes a public key and a private key.

[0153] The second processing unit is used to determine the service identifier of the authentication service component corresponding to the edge device based on the device code.

[0154] The third processing unit is used to determine the address information of the authentication service component based on the service identifier;

[0155] The feedback generation unit is configured to generate the activation response feedback based on the device code, the public key, and the address information; and to generate the first-level authentication feedback based on the device code, the private key, and the service identifier.

[0156] The specific implementation of the control platform of the present invention is basically the same as the implementation of the security authentication method in the first embodiment above, and will not be described again here.

[0157] like Figure 7 As shown, the present invention provides an authentication service component, the authentication service component comprising:

[0158] The information determination module 310 is used to determine the device code and private key contained in the first-level authentication feedback sent by the management and control platform after receiving the registration request sent by the edge device.

[0159] The request decryption module 320 is used to decrypt the registration request using the private key to obtain the device code contained in the registration request;

[0160] Information verification module 330 is used to generate secondary authentication feedback when the device code contained in the primary authentication feedback is consistent with the device code contained in the registration request;

[0161] The third sending module 340 is used to send the secondary authentication feedback to the edge device.

[0162] Furthermore, in generating secondary authentication feedback, the information verification module 330 is specifically used to generate authentication pass information for the edge device; and to encrypt the authentication pass information and the current time information using the private key and the public key to obtain the secondary authentication feedback.

[0163] Furthermore, the authentication service component also includes:

[0164] The duration determination unit is used to determine the generation duration of the secondary authentication feedback included in the media resource acquisition request after receiving the media resource acquisition request sent by the edge device.

[0165] The resource providing unit is used to send the media resource corresponding to the media resource acquisition request to the edge device when the generation duration is less than or equal to the preset valid duration.

[0166] The specific implementation of the authentication service component of this invention is basically the same as the implementation of the security authentication method in the second embodiment above, and will not be repeated here.

[0167] like Figure 8 As shown, the present invention provides an edge device, the edge device comprising:

[0168] The fourth sending module 410 is used to generate a device activation request based on the device code of the edge device and send the device activation request to the management and control platform.

[0169] The first receiving module 420 is used to generate a registration request and send the registration request to the authentication service component corresponding to the edge device after receiving the activation response feedback sent by the management and control platform.

[0170] The fifth sending module 430 is used to generate a media resource acquisition request carrying the secondary authentication feedback after receiving the secondary authentication feedback sent by the authentication service component;

[0171] The second receiving module 440 is used to send a media resource acquisition request to the authentication service component in order to request media resources from the authentication service component.

[0172] Furthermore, the first receiving module 420 specifically includes the following aspects in generating the registration request and sending the registration request to the authentication service component corresponding to the edge device:

[0173] The fourth processing unit is used to determine the public key and the address information of the authentication service component contained in the activation response feedback;

[0174] The fifth processing unit is used to encrypt the device code using the public key to generate a registration request;

[0175] The sixth processing unit is used to send the registration request to the authentication service component corresponding to the address information.

[0176] The specific implementation of the edge device of the present invention is basically the same as the implementation of the security authentication method in the third embodiment above, and will not be described again here.

[0177] Furthermore, the present invention also provides a network device, the network device comprising: a memory, a processor, and a security authentication program stored in the memory and executable on the processor, wherein the security authentication program, when executed by the processor, implements the steps of the security authentication method described above.

[0178] Furthermore, the present invention also provides a storage medium storing a security authentication program thereon, which, when executed by a processor, implements the steps of the security authentication method described above.

[0179] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0180] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0181] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0182] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0183] It should be noted that any reference signs placed between parentheses in the claims should not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention can be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0184] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0185] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A security authentication method, characterized in that, The security authentication method, applied to a management and control platform, includes: Receive a device activation request sent by an edge device, and determine the device code of the edge device based on the device activation request; When the device code is verified, the device status of the edge device is updated to active, and an activation response is sent to the edge device. The activation response includes the device code, a public key generated based on the device code, and the address information of the corresponding authentication service component; and... The authentication service component corresponding to the edge device is determined, and a first-level authentication feedback is sent to the authentication service component. When the authentication service component verifies the edge device using the first-level authentication feedback, it sends a second-level authentication feedback to the edge device. The first-level authentication feedback includes the device code, a private key generated based on the device code, and a corresponding service identifier.

2. The method as described in claim 1, characterized in that, The security authentication method further includes: A key pair is generated based on the device code and a preset encryption algorithm, the key pair including a public key and a private key; The service identifier of the authentication service component corresponding to the edge device is determined based on the device code. The address information of the authentication service component is determined based on the service identifier; The activation response feedback is generated based on the device code, the public key, and the address information; and... The first-level authentication feedback is generated based on the device code, the private key, and the service identifier.

3. A security authentication method, characterized in that, The security authentication method, applied to the authentication service component, includes: After receiving the registration request from the edge device, determine the device code and private key contained in the first-level authentication feedback sent by the management platform; The registration request is decrypted using the private key to obtain the device code contained in the registration request; When the device code included in the first-level authentication feedback matches the device code included in the registration request, a second-level authentication feedback is generated. The second-level authentication feedback includes authentication success information and current time information. Send the secondary authentication feedback to the edge device.

4. The method as described in claim 3, characterized in that, The step of decrypting the registration request using the private key and obtaining the public key contained in the registration request, and generating the secondary authentication feedback, includes: Generate authentication pass information for the edge device; The authentication pass information and the current time information are encrypted using the private key and the public key to obtain the secondary authentication feedback.

5. The method as described in claim 3, characterized in that, After the step of sending the secondary authentication feedback to the edge device, the method further includes: After receiving the media resource acquisition request sent by the edge device, determine the generation time of the secondary authentication feedback included in the media resource acquisition request; When the generation duration is less than or equal to the preset valid duration, the media resource corresponding to the media resource acquisition request is sent to the edge device.

6. A security authentication method, characterized in that, The security authentication method, applied to edge devices, includes: A device activation request is generated based on the device code of the edge device, and the device activation request is sent to the management and control platform. After receiving the activation response feedback from the management and control platform, a registration request is generated and sent to the authentication service component corresponding to the edge device; After receiving the secondary authentication feedback sent by the authentication service component, a media resource acquisition request carrying the secondary authentication feedback is generated. The secondary authentication feedback includes authentication success information and current time information. Send a media resource retrieval request to the authentication service component to request media resources from the authentication service component.

7. The method as described in claim 6, characterized in that, The steps of generating a registration request and sending the registration request to the authentication service component corresponding to the edge device include: Determine the public key and the address information of the authentication service component contained in the activation response feedback; The device code is encrypted using the public key to generate a registration request; The registration request is sent to the authentication service component corresponding to the address information.

8. A management and control platform, characterized in that, The control platform includes: A request receiving module is used to receive a device activation request sent by an edge device and determine the device code of the edge device based on the device activation request. The first sending module is used to update the device status of the edge device to an active state when the device code passes verification, and send an activation response feedback to the edge device. The activation response feedback includes the device code, a public key generated based on the device code, and the address information of the corresponding authentication service component. The second sending module is used to determine the authentication service component corresponding to the edge device and send a first-level authentication feedback to the authentication service component. When the authentication service component verifies the edge device using the first-level authentication feedback, it sends a second-level authentication feedback to the edge device. The first-level authentication feedback includes the device code, a private key generated based on the device code, and a corresponding service identifier. The second-level authentication feedback includes authentication success information and current time information.

9. A network device, characterized in that, The network device includes: a memory, a processor, and a security authentication program stored in the memory and executable on the processor, wherein the security authentication program, when executed by the processor, implements the steps of the security authentication method as described in any one of claims 1-7.

10. A storage medium, characterized in that, It stores a security authentication program, which, when executed by a processor, implements the steps of the security authentication method according to any one of claims 1-7.

Images