Device identity authentication method, device and apparatus

Abstract

The application discloses a device identity authentication method and device, and relates to the technical field of device authentication. The device identity authentication method is applied to a first device and comprises the following steps: obtaining a clock drift fingerprint of a second device, wherein the clock drift fingerprint of the second device is a clock drift rate of the second device relative to a clock drift reference device; determining a clock drift fingerprint of the second device relative to the first device according to the clock drift fingerprint of the second device and a clock drift fingerprint of the first device, wherein the clock drift fingerprint of the first device is a clock drift rate of the first device relative to the clock drift reference device; obtaining an actual clock drift rate of the second device relative to the first device; and performing identity verification on the second device according to the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device. The above scheme realizes the authentication of the device by using the clock drift fingerprint, reduces the time consumption of the device authentication, and improves the device authentication efficiency.

Description

Technical Field

[0001] This application belongs to the field of equipment authentication technology, and specifically relates to a method, apparatus and equipment for equipment identity authentication. Background Technology

[0002] Clock drift can occur in devices due to manufacturing processes, inaccuracies, temperature variations, and component aging in the clock oscillator. Unlike offsets caused by uncalibrated clocks, clock drift is a difference in clock frequency caused by unique and minute variations in the hardware, and it does not change over a long period. Therefore, clock drift can serve as a unique and difficult-to-replicate identifier for device hardware, and can be used for authentication.

[0003] Since absolutely accurate clocks do not exist in reality, one existing technology uses relative clock drift as a device identifier. First, the device proves its identity to the observer through other authentication technologies. Then, the observer calculates the device's relative clock drift rate and binds it to the device's identity. However, this method is only suitable for devices with other authentication capabilities. For devices lacking authentication capabilities, it is impossible to register for the first time and bind the device's identity to the clock drift rate. Summary of the Invention

[0004] This application provides a device authentication method, apparatus, and device that can solve the problem that existing device authentication methods are only suitable for devices with other authentication capabilities. For devices lacking authentication capabilities, there is a problem that they cannot be registered for the first time and thus achieve device authentication.

[0005] To address the aforementioned technical problems, embodiments of this application provide a device authentication method, applied to a first device, comprising:

[0006] Obtain the clock drift fingerprint of the second device, where the clock drift fingerprint of the second device is the clock drift rate of the second device relative to the clock drift reference device;

[0007] Based on the clock drift fingerprint of the second device and the clock drift fingerprint of the first device, the clock drift fingerprint of the second device relative to the first device is determined, and the clock drift fingerprint of the first device is the clock drift rate of the first device relative to the clock drift reference device;

[0008] Obtain the actual clock drift rate of the second device relative to the first device;

[0009] The second device is authenticated based on its clock drift fingerprint relative to the first device and its actual clock drift rate relative to the first device.

[0010] Optionally, obtaining the clock drift fingerprint of the second device includes:

[0011] Receive a clock drift fingerprint certificate sent by the second device, wherein the clock drift fingerprint certificate includes the clock drift fingerprint of the second device;

[0012] The validity of the clock drift fingerprint certificate is verified based on the target certificate of the clock drift reference device;

[0013] If the clock drift fingerprint certificate is verified, the clock drift fingerprint of the second device in the clock drift fingerprint certificate is obtained.

[0014] Optionally, obtaining the clock drift fingerprint of the second device includes:

[0015] Receive the clock drift fingerprint of the second device sent by the second device.

[0016] Optionally, the clock drift fingerprint of the first device is obtained by means of:

[0017] Send a certificate request to the clock drift reference device;

[0018] Receive a clock drift fingerprint certificate issued by the clock drift reference device, wherein the clock drift fingerprint certificate carries the clock drift fingerprint of the first device.

[0019] Optionally, the clock drift fingerprint of the first device is obtained by means of:

[0020] Receive the clock drift fingerprint of the first device sent by the clock drift reference device.

[0021] Optionally, obtaining the actual clock drift rate of the second device relative to the first device includes:

[0022] Based on the timestamps in the data packets sent by the second device to the first device at different times, the network transmission delay measured by the second device with the first device as a reference, and the clock of the first device at different times, the actual clock drift rate of the second device relative to the first device is obtained.

[0023] Optionally, the step of authenticating the second device based on the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device includes:

[0024] If the difference between the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device is within a preset range, then the identity of the second device is determined to be legitimate.

[0025] This application also provides a device authentication method applied to a clock drift reference device, including:

[0026] Receive a certificate application request sent by a target device, wherein the target device is a first device or a second device;

[0027] Obtain the clock drift fingerprint of the target device, wherein the clock drift fingerprint of the target device is the clock drift rate of the target device relative to the clock drift reference device;

[0028] A clock drift fingerprint certificate is sent to the target device, the clock drift fingerprint certificate including the clock drift fingerprint of the target device.

[0029] Optionally, obtaining the clock drift fingerprint of the target device includes:

[0030] Based on the timestamps in the data packets sent by the target device and received by the clock drift reference device at different times, the network transmission delay measured by the target device with reference to the clock drift reference device, and the clock of the clock drift reference device at different times, the actual clock drift rate of the target device relative to the clock drift reference device is obtained.

[0031] The actual clock drift rate is determined as the clock drift fingerprint of the target device.

[0032] This application embodiment also provides a device identity authentication apparatus, applied to a first device, comprising:

[0033] The first acquisition module is used to acquire the clock drift fingerprint of the second device, wherein the clock drift fingerprint of the second device is the clock drift rate of the second device relative to the clock drift reference device;

[0034] The determining module is configured to determine the clock drift fingerprint of the second device relative to the first device based on the clock drift fingerprint of the second device and the clock drift fingerprint of the first device, wherein the clock drift fingerprint of the first device is the clock drift rate of the first device relative to the clock drift reference device;

[0035] The second acquisition module is used to acquire the actual clock drift rate of the second device relative to the first device;

[0036] The verification module is used to authenticate the second device based on the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device.

[0037] This application embodiment also provides a device identity authentication device, wherein the device identity authentication device is a first device, including a transceiver and a processor;

[0038] The processor is configured to: acquire the clock drift fingerprint of the second device, wherein the clock drift fingerprint of the second device is the clock drift rate of the second device relative to the clock drift reference device;

[0039] Based on the clock drift fingerprint of the second device and the clock drift fingerprint of the first device, the clock drift fingerprint of the second device relative to the first device is determined, and the clock drift fingerprint of the first device is the clock drift rate of the first device relative to the clock drift reference device;

[0040] Obtain the actual clock drift rate of the second device relative to the first device;

[0041] The second device is authenticated based on its clock drift fingerprint relative to the first device and its actual clock drift rate relative to the first device.

[0042] This application also provides a device authentication apparatus for a clock drift reference device, comprising:

[0043] A receiving module is used to receive a certificate application request sent by a target device, wherein the target device is a first device or a second device;

[0044] The third acquisition module is used to acquire the clock drift fingerprint of the target device, wherein the clock drift fingerprint of the target device is the clock drift rate of the target device relative to the clock drift reference device;

[0045] The sending module is used to send a clock drift fingerprint certificate to the target device, wherein the clock drift fingerprint certificate includes the clock drift fingerprint of the target device.

[0046] This application embodiment also provides a device authentication device, which is a clock drift reference device, including a transceiver and a processor;

[0047] The transceiver is configured to: receive a certificate application request sent by a target device, wherein the target device is a first device or a second device;

[0048] The processor is configured to: acquire the clock drift fingerprint of the target device, wherein the clock drift fingerprint of the target device is the clock drift rate of the target device relative to the clock drift reference device;

[0049] The transceiver is configured to: send a clock drift fingerprint certificate to the target device, wherein the clock drift fingerprint certificate includes the clock drift fingerprint of the target device.

[0050] This application also provides a device authentication device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of the device authentication method described above.

[0051] This application also provides a readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps in the above-described method.

[0052] The beneficial effects of this application are:

[0053] The above scheme obtains the clock drift fingerprint of the second device, determines the clock drift fingerprint of the second device relative to the first device based on the clock drift fingerprint of the second device and the clock drift fingerprint of the first device, then obtains the actual clock drift rate of the second device relative to the first device, and finally authenticates the second device based on the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device. By using the clock drift fingerprint to achieve device authentication, it ensures that devices lacking authentication capabilities can also register and authenticate. Attached Figure Description

[0054] Figure 1 This is one of the flowcharts illustrating the device authentication method according to an embodiment of this application;

[0055] Figure 2 This is a framework diagram of a device authentication mechanism based on clock drift, according to an embodiment of this application.

[0056] Figure 3 This is a second schematic flowchart of the device identity authentication method according to an embodiment of this application;

[0057] Figure 4 This is one of the module schematic diagrams of the device identity authentication device according to an embodiment of this application;

[0058] Figure 5 A structural diagram illustrating the device authentication device according to an embodiment of this application;

[0059] Figure 6 This is a second schematic diagram of the device identity authentication device in an embodiment of this application. Detailed Implementation

[0060] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0061] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0062] It is worth noting that the technologies described in this application are not limited to Long Term Evolution (LTE) / LTE-Advanced (LTE-A) systems, but can also be used in other wireless communication systems, such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single-carrier Frequency-Division Multiple Access (SC-FDMA), and other systems. The terms "system" and "network" in this application are often used interchangeably, and the described technologies can be used not only in the systems and radio technologies mentioned above, but also in other systems and radio technologies. The following description describes New Radio (NR) systems for illustrative purposes, and NR terminology is used in most of the following description; however, these technologies can also be applied to applications beyond NR systems, such as 6th Generation (6G) communication systems.

[0063] The device authentication method, apparatus, and device provided in this application will be described in detail below with reference to the accompanying drawings and through specific embodiments and application scenarios.

[0064] like Figure 1 As shown, at least one embodiment of this application provides a device authentication method, applied to a first device, including:

[0065] Step 101: Obtain the clock drift fingerprint of the second device;

[0066] It should be noted that the clock drift fingerprint of the second device is the clock drift rate of the second device relative to the clock drift reference device;

[0067] Step 102: Determine the clock drift fingerprint of the second device relative to the first device based on the clock drift fingerprint of the second device and the clock drift fingerprint of the first device;

[0068] It should be noted that the clock drift fingerprint of the first device is the clock drift rate of the first device relative to the clock drift reference device;

[0069] Step 103: Obtain the actual clock drift rate of the second device relative to the first device;

[0070] Step 104: Authenticate the second device based on the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device.

[0071] It should be noted that the clock drift fingerprint mentioned in this application refers to the relative clock drift rate obtained by an authenticated device or a trusted communication device. In this way, the device can perform registration and authentication without adding other authentication capabilities.

[0072] The clock drift measurement principle involved in the embodiments of this application will be explained below.

[0073] Taking Transmission Control Protocol / Internet Protocol (TCP / IP) as an example, TCP communication messages utilize RFC1323 to obtain clock drift fingerprints. That is, the header of the message sent by device A to device B carries the timestamp of device A at the moment the message was sent. A1 When device B receives this message, the header of the message it sends to device A includes a timestamp from device B at the moment of transmission. B1 And the timestamp of the message previously sent by device A. A1 Similarly, when device A receives this message, the header of the message it sends to device B includes a timestamp of device A at the moment the message was sent. A2 Device B sends a timestamp at the instant. B2 The current communication delay between device A and device B is approximately equal to (stamp). A2 –stamp A1 ) / 2.

[0074] It should be noted that the above example only uses the TCP / IP communication protocol to calculate the current communication delay between device A and device B. Optionally, the embodiments of this application can also be applied to communication methods such as bus and wireless LAN. That is to say, the embodiments of this application can also be applied to the authentication process based on clock drift fingerprint under communication methods such as TCP / IP communication protocol, bus, and wireless LAN.

[0075] The following uses the TCP / IP communication protocol as an example to explain the specific process by which observer A obtains the clock drift rate of device B relative to observer A.

[0076] Observer A captures data packets sent by device B. Using the timestamp in the TCP or Internet Control Message Protocol (ICMP) header, and based on a linear model of the relative clock drift of the host, the clock drift rate of device B relative to observer A can be calculated. The specific process is as follows:

[0077] Let the real time be T1, and the clock of observer A be T. A1 At that time, observer A captures a data packet from device B with a timestamp of T. B1 Time difference (T) A1 -T B1 The relative clock offset between observer A and device B at time t1 is defined as the network transmission delay measured by device B with observer A as the reference point. d1 Similarly, let the real time be t2, and the clock of observer A be T. A2 Observer A captures a data packet from device B with a timestamp of T. B2 Device B measures the network transmission delay as T with observer A as the reference point. d2 The formula for calculating the clock drift rate of observer A and device B relative to the standard real time is: Absolute drift rate of device B = ((T) / ... B1 +T d1 )-(T B2 +T d2 The absolute drift rate of observer A is (t1-t2) / (t1-t2). A1 -T A2 ) / (t1-t2).

[0078] Among them, T d1 and T d2 Communication delays can be approximated using the timestamp specified in RFC1323, i.e., (stamp... A2 –stamp A1() / 2. By establishing a least-squares linear model for time pairs of multiple hosts A and B, and using methods such as successive differences and multiple averaging, network latency fluctuations can be eliminated.

[0079] After calculating the delay, the clock drift rate of device B relative to observer A is: Drift BA = Absolute drift rate of B / Absolute drift rate of A = ((T) B1 +T d1 )-(T B2 +T d2 )) / (T A1 -T A2 ), i.e., Drift BA This is the clock drift fingerprint for device B.

[0080] Assuming device C communicates remotely with observer A, calculate the clock drift rate (Drift) of device C relative to observer A in the same manner. CA =((T) C1 +T' d1 )-(T C2 +T' d2 )) / (T' A1 -T' A2 ), i.e., Drift CA The clock drift fingerprint of device C is given; based on the clock drift fingerprints of device B and device C, the clock drift fingerprint of device B relative to device C can be calculated as: Drift BC =Drift BA / Drift CA .

[0081] It should be noted that the first device in the embodiments of this application can be understood as an observer; the clock drift reference device is also regarded as an observer, and for the first device and the clock drift reference device, the clock drift reference device is the observer of the first device.

[0082] It should be noted that the clock drift reference device mentioned in the embodiments of this application can be a Trusted Third Party Observer (TTPO) that can issue certificates, or any device that has the ability to communicate trustedly with other devices.

[0083] Based on the above principles, the embodiments of this application will be described in detail below from the perspective of different clock drift reference devices.

[0084] 1. The clock drift reference device is TTPO.

[0085] It should be noted that TTPO issues a clock drift fingerprint certificate for each device. This clock drift fingerprint certificate contains the clock drift rate of the device relative to TTPO, that is, the clock drift fingerprint certificate contains the clock drift fingerprint of the device.

[0086] It should be noted that the TTPO node mentioned in this application embodiment includes any trusted third party capable of binding the entity identity to its clock drift fingerprint (including but not limited to public-private key pairs, shared secrets, physically unclonable functions, etc.) and possessing an accurate clock. The binding mode includes but is not limited to modes based on Public Key Infrastructure (PKI), identifier-based signatures, etc.

[0087] A framework diagram of a device authentication mechanism based on clock drift is shown below. Figure 2 As shown, the device (which can be regarded as the second device in this application) and the observer (which can be regarded as the first device in this application) apply to TTPO for a clock drift fingerprint certificate; the device carries the clock drift fingerprint certificate to prove its identity to the corresponding observer; the observer verifies the device's clock drift fingerprint certificate, thereby authenticating the device's identity.

[0088] Optionally, the clock drift fingerprint of the first device is obtained by means of:

[0089] Send a certificate request to the clock drift reference device;

[0090] Receive a clock drift fingerprint certificate issued by the clock drift reference device, wherein the clock drift fingerprint certificate carries the clock drift fingerprint of the first device.

[0091] It should be noted that in order to obtain the clock drift fingerprint of the first device, the first device needs to send a certificate request to TTPO. Before this, TTPO has already obtained the clock drift fingerprint of the first device. After receiving the certificate request from the first device, TTPO needs to send the clock drift fingerprint of the first device to the first device. Specifically, TTPO writes the clock drift fingerprint of the first device into the certificate to obtain the clock drift fingerprint certificate. Optionally, TTPO needs to perform legalization processing on the clock drift fingerprint certificate to ensure its legitimacy. For example, TTPO can use the root key to sign the clock drift fingerprint certificate to achieve legalization processing of the clock drift fingerprint certificate, and then issue the signed clock drift fingerprint certificate to the first device. Of course, TTPO can also use other methods to legalize the clock drift fingerprint certificate. This application does not impose too many restrictions. Any method that can achieve legalization processing of the clock drift fingerprint certificate is within the protection scope of this application.

[0092] It should be noted that the first device should also store the TTPO target certificate, which is used to verify the legitimacy of the clock drift fingerprint certificate issued by TTPO. For example, this target certificate can be the TTPO root certificate. TTPO ).

[0093] Optionally, TTPO obtains the clock drift fingerprint of the first device in the following way:

[0094] Based on the timestamps in the data packets sent by the first device at different times of TTPO, the network transmission delay measured by the first device with reference to TTPO, and the clock of TTPO at different times, the actual clock drift rate of the first device relative to TTPO is obtained.

[0095] The actual clock drift rate is determined as the clock drift fingerprint of the target device.

[0096] Optionally, the actual clock drift rate of the first device relative to the TTPO = ((T D1 +T d1 )-(T D2 +T d2 )) / (T TTPO1 -T TTPO2 );

[0097] Among them, T TTPO1 T is the clock of TTPO at time t1; TTPO2 T is the clock of TTPO at time t2; D1 Let T be the clock of the first device at time t1. D2 Let T be the clock of the first device at time t2. d1 Let T be the network transmission delay measured by the first device at time t1 with TTPO as a reference. d2 The network transmission delay measured by the first device at time t2, with TTPO as the reference.

[0098] Optionally, TTPO obtains the clock drift fingerprint of the second device in the same way as it obtains the clock drift fingerprint of the first device, and will not be described again here.

[0099] Optionally, the specific implementation of obtaining the clock drift fingerprint of the second device is as follows:

[0100] Receive a clock drift fingerprint certificate sent by the second device, wherein the clock drift fingerprint certificate includes the clock drift fingerprint of the second device;

[0101] The validity of the clock drift fingerprint certificate is verified based on the target certificate of the clock drift reference device;

[0102] If the clock drift fingerprint certificate is verified, the clock drift fingerprint of the second device in the clock drift fingerprint certificate is obtained.

[0103] It should be noted that verifying the legitimacy of the clock drift fingerprint certificate against the target certificate of the clock drift reference device is primarily to verify whether the clock drift fingerprint certificate sent by the second device was issued by the clock drift reference device. Only if the clock drift fingerprint certificate sent by the second device was issued by the clock drift reference device is the verification considered successful, and only then can the first device obtain the clock drift fingerprint of the second device. This ensures the validity of the clock drift fingerprint.

[0104] For example, in this embodiment of the application, the first device is observer B. During the authentication process between the second device and the first device (e.g., device A), device A carries its clock drift fingerprint certificate (TimeCertificate). A Connect to observer B. Observer B uses the root certificate (RootCertificate). TTPO ) Validate TimeCert A If the validity of the verification is successful, then the clock drift fingerprint (DriftID) of device A is read. A ), calculate the clock drift fingerprint DriftID of A relative to B. AB .

[0105] Optionally, after obtaining the clock drift fingerprint of the second device relative to the first device, it is necessary to further obtain the actual clock drift rate of the second device relative to the first device. Specifically, in at least one embodiment of this application, the specific method for obtaining the actual clock drift rate of the second device relative to the first device is as follows:

[0106] Based on the timestamps in the data packets sent by the second device to the first device at different times, the network transmission delay measured by the second device with the first device as a reference, and the clock of the first device at different times, the actual clock drift rate of the second device relative to the first device is obtained.

[0107] It should be noted that the method for obtaining the actual clock drift rate of the second device relative to the first device can be found in the above-mentioned implementation of obtaining the clock drift fingerprint of the first device using TTPO, and will not be repeated here.

[0108] Optionally, in at least one embodiment of this application, the specific implementation of authenticating the second device based on the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device is as follows:

[0109] If the difference between the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device is within a preset range, then the identity of the second device is determined to be legitimate.

[0110] For example, in this embodiment of the application, the first device is observer B. During the authentication process between the second device and the first device (e.g., device A), observer B compares the DriftID. AB The actual clock drift rate of device A relative to observer B (Drift rate) AB Whether it is within a certain threshold, thereby verifying the identity of device A.

[0111] Alternatively, observer B can use TimeCert A The MAC / IP / device ID / IMEI number of device A is bound to the database for future verification. When the device's MAC / IP / device ID / IMEI number matches the TimeCert... A The correspondence may deviate (i.e., the TimeCert sent by A during the next verification process). A With stored TimeCert A If the clock drift fingerprint is inconsistent with the actual clock drift rate, then device A's identity is considered problematic. Of course, device A and device B can continue to use the clock drift fingerprint comparison method for authentication during the next authentication process.

[0112] It should be noted that in this case, the TTPO clock is used as the root observer to sign clock drift fingerprint certificates for both the device and the observer. This solves the problem that the device must prove its identity through other authentication methods in order to complete the binding of the clock drift fingerprint and the device identity. On the other hand, this implementation method can solve the clock drift fingerprint authentication problem in scenarios where the device dynamically connects to multiple observers through the clock drift certificate issued by TTPO.

[0113] II. The clock drift reference device is any device.

[0114] In this case, no certificate is required; only the clock drift fingerprint needs to be verified through a trusted communication device.

[0115] Optionally, obtaining the clock drift fingerprint of the second device includes:

[0116] Receive the clock drift fingerprint of the second device sent by the second device.

[0117] Optionally, the clock drift fingerprint of the first device is obtained by means of:

[0118] Receive the clock drift fingerprint of the first device sent by the clock drift reference device.

[0119] Optionally, the method by which the clock drift reference device obtains the clock drift fingerprint of the second device and the clock drift fingerprint of the first device in this case can be found in the above description, and will not be repeated here.

[0120] Optionally, obtaining the actual clock drift rate of the second device relative to the first device includes:

[0121] Based on the timestamps in the data packets sent by the second device to the first device at different times, the network transmission delay measured by the second device with the first device as a reference, and the clock of the first device at different times, the actual clock drift rate of the second device relative to the first device is obtained.

[0122] It should be noted that the method for obtaining the actual clock drift rate of the second device relative to the first device can be found in the above-mentioned implementation of obtaining the clock drift fingerprint of the first device using TTPO, and will not be repeated here.

[0123] Optionally, in at least one embodiment of this application, the specific implementation of authenticating the second device based on the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device is as follows:

[0124] If the difference between the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device is within a preset range, then the identity of the second device is determined to be legitimate.

[0125] In other words, the second device is considered legitimate only if the difference between the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device is within a preset range. Otherwise, the second device is illegitimate, and in the subsequent registration process, the second device will still be authenticated in the same way as described above.

[0126] It should be noted that this approach can resolve the clock drift fingerprint authentication issue in scenarios where the device dynamically connects to multiple observers.

[0127] It should be noted that the embodiments of this application are able to solve the following problems:

[0128] (1) Solve the problem that when a device cannot actively prove its identity to an observer in other ways, the observer cannot bind the device identity and clock drift fingerprint;

[0129] (2) Solve the clock drift fingerprint authentication problem in scenarios where the device dynamically connects to multiple observers.

[0130] like Figure 3 As shown, at least one embodiment of this application provides a device authentication method applied to a clock drift reference device, including:

[0131] Step 301: Receive a certificate application request sent by the target device, wherein the target device is a first device or a second device;

[0132] Step 302: Obtain the clock drift fingerprint of the target device, wherein the clock drift fingerprint of the target device is the clock drift rate of the target device relative to the clock drift reference device;

[0133] Step 303: Send a clock drift fingerprint certificate to the target device, wherein the clock drift fingerprint certificate includes the clock drift fingerprint of the target device.

[0134] Optionally, obtaining the clock drift fingerprint of the target device includes:

[0135] Based on the timestamps in the data packets sent by the target device and received by the clock drift reference device at different times, the network transmission delay measured by the target device with reference to the clock drift reference device, and the clock of the clock drift reference device at different times, the actual clock drift rate of the target device relative to the clock drift reference device is obtained.

[0136] The actual clock drift rate is determined as the clock drift fingerprint of the target device.

[0137] It should be noted that all descriptions of the clock drift reference device in the above embodiments are applicable to the device identity authentication method embodiment applied to the clock drift reference device and can achieve the same technical effect, so they will not be repeated here.

[0138] like Figure 4 As shown, at least one embodiment of this application also provides a device authentication device 400, applied to a first device, comprising:

[0139] The first acquisition module 401 is used to acquire the clock drift fingerprint of the second device, wherein the clock drift fingerprint of the second device is the clock drift rate of the second device relative to the clock drift reference device.

[0140] The determining module 402 is used to determine the clock drift fingerprint of the second device relative to the first device based on the clock drift fingerprint of the second device and the clock drift fingerprint of the first device, wherein the clock drift fingerprint of the first device is the clock drift rate of the first device relative to the clock drift reference device;

[0141] The second acquisition module 403 is used to acquire the actual clock drift rate of the second device relative to the first device;

[0142] The verification module 404 is used to authenticate the second device based on the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device.

[0143] Optionally, the first acquisition module 401 includes:

[0144] The first receiving unit is configured to receive a clock drift fingerprint certificate sent by the second device, wherein the clock drift fingerprint certificate includes the clock drift fingerprint of the second device;

[0145] The verification unit is used to verify the legitimacy of the clock drift fingerprint certificate based on the target certificate of the clock drift reference device.

[0146] The first acquisition unit is used to acquire the clock drift fingerprint of the second device in the clock drift fingerprint certificate if the clock drift fingerprint certificate verification is successful.

[0147] Optionally, the first acquisition module 401 includes:

[0148] The second receiving unit is used to receive the clock drift fingerprint of the second device sent by the second device.

[0149] Optionally, the clock drift fingerprint of the first device is obtained by means of:

[0150] Send a certificate request to the clock drift reference device;

[0151] Receive a clock drift fingerprint certificate issued by the clock drift reference device, wherein the clock drift fingerprint certificate carries the clock drift fingerprint of the first device.

[0152] Optionally, the clock drift fingerprint of the first device is obtained by means of:

[0153] Receive the clock drift fingerprint of the first device sent by the clock drift reference device.

[0154] Optionally, the second acquisition module 403 is used for:

[0155] Based on the timestamps in the data packets sent by the second device to the first device at different times, the network transmission delay measured by the second device with the first device as a reference, and the clock of the first device at different times, the actual clock drift rate of the second device relative to the first device is obtained.

[0156] Optionally, the verification module 404 is used for:

[0157] If the difference between the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device is within a preset range, then the identity of the second device is determined to be legitimate.

[0158] It should be noted that if the apparatus provided in at least one embodiment of this application is an apparatus capable of executing the above-described device authentication method, then all embodiments of the above-described device authentication method are applicable to the apparatus and can achieve the same or similar beneficial effects.

[0159] At least one embodiment of this application also provides a device authentication device, wherein the device authentication device is a first device, including a transceiver and a processor;

[0160] The processor is configured to: acquire the clock drift fingerprint of the second device, wherein the clock drift fingerprint of the second device is the clock drift rate of the second device relative to the clock drift reference device;

[0161] Based on the clock drift fingerprint of the second device and the clock drift fingerprint of the first device, the clock drift fingerprint of the second device relative to the first device is determined, and the clock drift fingerprint of the first device is the clock drift rate of the first device relative to the clock drift reference device;

[0162] Obtain the actual clock drift rate of the second device relative to the first device;

[0163] The second device is authenticated based on its clock drift fingerprint relative to the first device and its actual clock drift rate relative to the first device.

[0164] Optionally, the transceiver is used for:

[0165] Receive a clock drift fingerprint certificate sent by the second device, wherein the clock drift fingerprint certificate includes the clock drift fingerprint of the second device;

[0166] The processor is configured to: verify the legality of the clock drift fingerprint certificate based on the target certificate of the clock drift reference device;

[0167] If the clock drift fingerprint certificate is verified, the clock drift fingerprint of the second device in the clock drift fingerprint certificate is obtained.

[0168] Optionally, the transceiver is configured to: receive the clock drift fingerprint of the second device sent by the second device.

[0169] Optionally, the transceiver is used for:

[0170] Send a certificate request to the clock drift reference device;

[0171] Receive a clock drift fingerprint certificate issued by the clock drift reference device, wherein the clock drift fingerprint certificate carries the clock drift fingerprint of the first device.

[0172] Optionally, the transceiver is configured to: receive the clock drift fingerprint of the first device sent by the clock drift reference device.

[0173] Optionally, the processor is configured to:

[0174] Based on the timestamps in the data packets sent by the second device to the first device at different times, the network transmission delay measured by the second device with the first device as a reference, and the clock of the first device at different times, the actual clock drift rate of the second device relative to the first device is obtained.

[0175] Optionally, the processor is configured to:

[0176] If the difference between the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device is within a preset range, then the identity of the second device is determined to be legitimate.

[0177] like Figure 5 As shown, this embodiment of the invention also provides a device authentication device, which is a first device, including a processor 500, a transceiver 510, a memory 520, and a program stored in the memory 520 and executable on the processor 500; wherein, the transceiver 510 is connected to the processor 500 and the memory 520 via a bus interface, and the processor 500 is used to read the program in the memory and execute the following processes:

[0178] Obtain the clock drift fingerprint of the second device, where the clock drift fingerprint of the second device is the clock drift rate of the second device relative to the clock drift reference device;

[0179] Based on the clock drift fingerprint of the second device and the clock drift fingerprint of the first device, the clock drift fingerprint of the second device relative to the first device is determined, and the clock drift fingerprint of the first device is the clock drift rate of the first device relative to the clock drift reference device;

[0180] Obtain the actual clock drift rate of the second device relative to the first device;

[0181] The second device is authenticated based on its clock drift fingerprint relative to the first device and its actual clock drift rate relative to the first device.

[0182] Transceiver 510 is used to receive and send data under the control of processor 500.

[0183] Among them, Figure 5 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 500 and memory represented by memory 520 together. The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 510 can be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium, including wireless channels, wired channels, optical fibers, and other transmission media.

[0184] The processor 500 is responsible for managing the bus architecture and general processing, while the memory 520 can store the data used by the processor 500 when performing operations.

[0185] Optionally, the processor 500 can be a CPU (Central Processing Unit), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array), or CPLD (Complex Programmable Logic Device), and the processor can also adopt a multi-core architecture.

[0186] The processor executes any of the methods described in the embodiments of this application according to the obtained executable instructions by calling a computer program stored in memory. The processor and memory may also be physically separated.

[0187] Furthermore, when the processor 500 executes the program, it performs the following steps:

[0188] The transceiver receives a clock drift fingerprint certificate sent by the second device, the clock drift fingerprint certificate including the clock drift fingerprint of the second device;

[0189] The validity of the clock drift fingerprint certificate is verified based on the target certificate of the clock drift reference device;

[0190] If the clock drift fingerprint certificate is verified, the clock drift fingerprint of the second device in the clock drift fingerprint certificate is obtained.

[0191] Furthermore, when the processor 500 executes the program, it performs the following steps:

[0192] The transceiver receives the clock drift fingerprint of the second device sent by the second device.

[0193] Furthermore, when the processor 500 executes the program, it performs the following steps:

[0194] Send a certificate request to the clock drift reference device via transceiver;

[0195] The transceiver receives a clock drift fingerprint certificate issued by the clock drift reference device, the clock drift fingerprint certificate carrying the clock drift fingerprint of the first device.

[0196] Furthermore, when the processor 500 executes the program, it performs the following steps:

[0197] The transceiver receives the clock drift fingerprint of the first device sent by the clock drift reference device.

[0198] Furthermore, when the processor 500 executes the program, it performs the following steps:

[0199] Based on the timestamps in the data packets sent by the second device to the first device at different times, the network transmission delay measured by the second device with the first device as a reference, and the clock of the first device at different times, the actual clock drift rate of the second device relative to the first device is obtained.

[0200] Furthermore, when the processor 500 executes the program, it performs the following steps:

[0201] If the difference between the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device is within a preset range, then the identity of the second device is determined to be legitimate.

[0202] At least one embodiment of this application also provides a device authentication device, which is a first device including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the various processes in the device authentication method embodiment and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0203] At least one embodiment of this application also provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the program implements the various processes in the device authentication method embodiments described above and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0204] like Figure 6 As shown, at least one embodiment of this application also provides a device authentication apparatus 600, applied to a clock drift reference device, comprising:

[0205] The receiving module 601 is used to receive a certificate application request sent by a target device, wherein the target device is a first device or a second device;

[0206] The third acquisition module 602 is used to acquire the clock drift fingerprint of the target device, wherein the clock drift fingerprint of the target device is the clock drift rate of the target device relative to the clock drift reference device;

[0207] The sending module 603 is used to send a clock drift fingerprint certificate to the target device, wherein the clock drift fingerprint certificate includes the clock drift fingerprint of the target device.

[0208] Optionally, the third acquisition module 602 includes:

[0209] The second acquisition unit is used to acquire the actual clock drift rate of the target device relative to the clock drift reference device based on the timestamp in the data packet sent by the target device received by the clock drift reference device at different times, the network transmission delay measured by the target device with the clock drift reference device as a reference, and the clock of the clock drift reference device at different times.

[0210] The second determining unit is used to determine the actual clock drift rate as the clock drift fingerprint of the target device.

[0211] It should be noted that if the apparatus provided in at least one embodiment of this application is an apparatus capable of executing the above-described device authentication method, then all embodiments of the above-described device authentication method are applicable to the apparatus and can achieve the same or similar beneficial effects.

[0212] At least one embodiment of this application also provides a device authentication device, which is a clock drift reference device, including a transceiver and a processor;

[0213] The transceiver is configured to: receive a certificate application request sent by a target device, wherein the target device is a first device or a second device;

[0214] The processor is configured to: acquire the clock drift fingerprint of the target device, wherein the clock drift fingerprint of the target device is the clock drift rate of the target device relative to the clock drift reference device;

[0215] The transceiver is configured to: send a clock drift fingerprint certificate to the target device, wherein the clock drift fingerprint certificate includes the clock drift fingerprint of the target device.

[0216] Optionally, the processor is configured to:

[0217] Based on the timestamps in the data packets sent by the target device and received by the clock drift reference device at different times, the network transmission delay measured by the target device with reference to the clock drift reference device, and the clock of the clock drift reference device at different times, the actual clock drift rate of the target device relative to the clock drift reference device is obtained.

[0218] The actual clock drift rate is determined as the clock drift fingerprint of the target device.

[0219] This application embodiment also provides a device authentication device, which is a clock drift reference device. Specifically, its structure is similar to that of... Figure 5 The structure of the first device is similar, so it will not be described in detail here.

[0220] The processor is used to read the program from the memory and execute the following processes:

[0221] Receive a certificate application request sent by a target device, wherein the target device is a first device or a second device;

[0222] Obtain the clock drift fingerprint of the target device, wherein the clock drift fingerprint of the target device is the clock drift rate of the target device relative to the clock drift reference device;

[0223] A clock drift fingerprint certificate is sent to the target device, the clock drift fingerprint certificate including the clock drift fingerprint of the target device.

[0224] Furthermore, when the processor executes the program, it performs the following steps:

[0225] Based on the timestamps in the data packets sent by the target device and received by the clock drift reference device at different times, the network transmission delay measured by the target device with reference to the clock drift reference device, and the clock of the clock drift reference device at different times, the actual clock drift rate of the target device relative to the clock drift reference device is obtained.

[0226] The actual clock drift rate is determined as the clock drift fingerprint of the target device.

[0227] At least one embodiment of this application also provides a device authentication device, which is a clock drift reference device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the various processes in the device authentication method embodiment and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0228] At least one embodiment of this application also provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the program implements the various processes in the device authentication method embodiments described above and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0229] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0230] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0231] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A device authentication method, applied to a first device, characterized in that, include: Obtain the clock drift fingerprint of the second device, where the clock drift fingerprint of the second device is the clock drift rate of the second device relative to the clock drift reference device; Based on the clock drift fingerprint of the second device and the clock drift fingerprint of the first device, the clock drift fingerprint of the second device relative to the first device is determined, and the clock drift fingerprint of the first device is the clock drift rate of the first device relative to the clock drift reference device; Obtain the actual clock drift rate of the second device relative to the first device; The second device is authenticated based on its clock drift fingerprint relative to the first device and its actual clock drift rate relative to the first device.

2. The method according to claim 1, characterized in that, The acquisition of the clock drift fingerprint of the second device includes: Receive a clock drift fingerprint certificate sent by the second device, wherein the clock drift fingerprint certificate includes the clock drift fingerprint of the second device; The validity of the clock drift fingerprint certificate is verified based on the target certificate of the clock drift reference device; If the clock drift fingerprint certificate is verified, the clock drift fingerprint of the second device in the clock drift fingerprint certificate is obtained.

3. The method according to claim 1, characterized in that, The acquisition of the clock drift fingerprint of the second device includes: Receive the clock drift fingerprint of the second device sent by the second device.

4. The method according to claim 1, characterized in that, The method for obtaining the clock drift fingerprint of the first device includes: Send a certificate request to the clock drift reference device; Receive a clock drift fingerprint certificate issued by the clock drift reference device, wherein the clock drift fingerprint certificate carries the clock drift fingerprint of the first device.

5. The method according to claim 1, characterized in that, The method for obtaining the clock drift fingerprint of the first device includes: Receive the clock drift fingerprint of the first device sent by the clock drift reference device.

6. The method according to claim 1, characterized in that, The step of obtaining the actual clock drift rate of the second device relative to the first device includes: Based on the timestamps in the data packets sent by the second device to the first device at different times, the network transmission delay measured by the second device with the first device as a reference, and the clock of the first device at different times, the actual clock drift rate of the second device relative to the first device is obtained.

7. The method according to claim 1, characterized in that, The step of authenticating the second device based on the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device includes: If the difference between the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device is within a preset range, then the identity of the second device is determined to be legitimate.

8. A device authentication method applied to a clock drift reference device, characterized in that, include: Receive a certificate application request sent by a target device, wherein the target device is a first device and / or a second device; Obtain the clock drift fingerprint of the target device, wherein the clock drift fingerprint of the target device is the clock drift rate of the target device relative to the clock drift reference device; A clock drift fingerprint certificate is sent to the first device. The clock drift fingerprint certificate includes the clock drift fingerprint of the target device. The first device determines the clock drift fingerprint of the second device relative to the first device based on the clock drift fingerprint of the target device. The second device is then authenticated based on the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device.

9. The method according to claim 8, characterized in that, The step of obtaining the clock drift fingerprint of the target device includes: Based on the timestamps in the data packets sent by the target device and received by the clock drift reference device at different times, the network transmission delay measured by the target device with reference to the clock drift reference device, and the clock of the clock drift reference device at different times, the actual clock drift rate of the target device relative to the clock drift reference device is obtained. The actual clock drift rate is determined as the clock drift fingerprint of the target device.

10. A device authentication apparatus, applied to a first device, characterized in that, include: The first acquisition module is used to acquire the clock drift fingerprint of the second device, wherein the clock drift fingerprint of the second device is the clock drift rate of the second device relative to the clock drift reference device; The determining module is configured to determine the clock drift fingerprint of the second device relative to the first device based on the clock drift fingerprint of the second device and the clock drift fingerprint of the first device, wherein the clock drift fingerprint of the first device is the clock drift rate of the first device relative to the clock drift reference device; The second acquisition module is used to acquire the actual clock drift rate of the second device relative to the first device; The verification module is used to authenticate the second device based on the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device.

11. A device authentication device, wherein the device authentication device is a first device, characterized in that, Includes transceivers and processors; The processor is configured to: acquire the clock drift fingerprint of the second device, wherein the clock drift fingerprint of the second device is the clock drift rate of the second device relative to the clock drift reference device; Based on the clock drift fingerprint of the second device and the clock drift fingerprint of the first device, the clock drift fingerprint of the second device relative to the first device is determined, and the clock drift fingerprint of the first device is the clock drift rate of the first device relative to the clock drift reference device; Obtain the actual clock drift rate of the second device relative to the first device; The second device is authenticated based on its clock drift fingerprint relative to the first device and its actual clock drift rate relative to the first device.

12. A device authentication apparatus, applied to a clock drift reference device, characterized in that, include: A receiving module is used to receive a certificate application request sent by a target device, wherein the target device is a first device and / or a second device; The third acquisition module is used to acquire the clock drift fingerprint of the target device, wherein the clock drift fingerprint of the target device is the clock drift rate of the target device relative to the clock drift reference device; The sending module is used to send a clock drift fingerprint certificate to the first device. The clock drift fingerprint certificate includes the clock drift fingerprint of the target device. The first device determines the clock drift fingerprint of the second device relative to the first device based on the clock drift fingerprint of the target device, and authenticates the second device based on the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device.

13. A device authentication device, wherein the device authentication device is a clock drift reference device, characterized in that, Includes transceivers and processors; The transceiver is configured to: receive a certificate application request sent by a target device, wherein the target device is a first device and / or a second device; The processor is configured to: acquire the clock drift fingerprint of the target device, wherein the clock drift fingerprint of the target device is the clock drift rate of the target device relative to the clock drift reference device; The transceiver is configured to: send a clock drift fingerprint certificate to the first device, wherein the clock drift fingerprint certificate includes the clock drift fingerprint of the target device; the first device determines the clock drift fingerprint of the second device relative to the first device based on the clock drift fingerprint of the target device; and authenticate the second device based on the clock drift fingerprint of the second device relative to the first device and the actual clock drift rate of the second device relative to the first device.

14. A device authentication device, characterized in that, The device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the steps of the device authentication method as described in any one of claims 1-9.

15. A readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method as described in any one of claims 1-9.

Images