Communication authentication method and device, computer device and storage medium

Abstract

The application relates to a communication authentication method and device, computer equipment and a storage medium, and relates to the technical field of device authentication. The method comprises the following steps: after initiating an authentication request, a target device acquires a root key generated by a SIM card with a PUF function and a PUF chip serial number, and acquires an internet device identifier from the SIM card; then, a key negotiation process between the target device and an authentication server is performed based on the root key to determine a first encryption key; further, the PUF chip serial number and the internet device identifier are encrypted by using the first encryption key to obtain authentication information, and the authentication information is sent to the authentication server, so that the authentication server decrypts the authentication information based on a first decryption key, thereby authenticating the target device. The method can perform a key negotiation process based on the root key, improve the security of the authentication key, and the root key and the PUF chip serial number are not easy to be leaked, thereby further improving the security of the target device accessing various Internet of Things business platforms.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of device authentication, and in particular to a communication authentication method and device, a computer device and a storage medium. BACKGROUND

[0002] With the development of new communication technologies such as 5G, various Internet of Things applications have also developed rapidly. However, the security protection problem of Internet of Things and related business data has become increasingly prominent.

[0003] In the existing authentication method for Internet of Things devices, a fixed key is generally used to encrypt the authentication data, which has the problem of low security. If the authentication data is leaked, the Internet of Things card of the Internet of Things device may be cloned by illegal users to access the business platform, thereby affecting the security of the business system and data. SUMMARY

[0004] Therefore, it is necessary to provide a communication authentication method, device, computer device and storage medium capable of improving the security of Internet of Things device access to solve the above technical problems.

[0005] In a first aspect, the present application provides a communication authentication method applied to a target device, the method comprising:

[0006] After initiating an authentication request, a root key generated by a user identification SIM card integrated with a physical unclonable function (PUF) and a PUF chip serial number set in the target device are obtained, and an Internet device identifier is obtained from the SIM card;

[0007] Performing a key agreement process with an authentication server based on the root key to determine a first encryption key for current data transmission through the key agreement process;

[0008] Encrypting the PUF chip serial number and the Internet device identifier using the first encryption key to obtain authentication information, and sending the authentication information to the authentication server, so that the authentication server decrypts the authentication information based on a first decryption key determined by the key agreement process, and authenticates the target device according to the decrypted authentication information.

[0009] In one embodiment, performing a key agreement process with an authentication server based on a root key comprises:

[0010] Generating a public key and a private key of the target device based on the root key;

[0011] Performing a key agreement process based on the public key and the private key of the target device.

[0012] In one embodiment, performing a key agreement process based on the public key and the private key of the target device comprises:

[0013] sending the public key of the target device to the authentication server, so that the authentication server generates a first decryption key based on the public key of the target device and a private key generated by the authentication server in a key agreement process;

[0014] receiving the public key generated by the authentication server in the key agreement process sent by the authentication server, and generating a first encryption key according to the public key of the authentication server and the private key of the target device.

[0015] In one embodiment, the authentication information sent to the authentication server includes:

[0016] obtaining an international mobile equipment identity (IMSI) of the SIM card;

[0017] sending the IMSI and the authentication information to the authentication server correspondingly; wherein the IMSI is used for the authentication server to find the registration information of the device corresponding to the IMSI from a pre-stored registered device list, and to judge whether the target device is a registered device based on whether the decrypted authentication information and the registration information are consistent.

[0018] In one embodiment, before initiating the authentication request, the method further includes:

[0019] After initiating the registration request, obtaining a root key generated by the SIM card and a PUF chip serial number, and obtaining an internet device identifier from the SIM card;

[0020] performing a key agreement process with the authentication server based on the root key, so as to determine a second encryption key for current data transmission through the key agreement process;

[0021] encrypting the PUF chip serial number and the internet device identifier by using the second encryption key to obtain encrypted registration information, and sending the encrypted registration information to the authentication server, so that the authentication server decrypts the encrypted registration information based on a second decryption key determined through the key agreement process to obtain the registration information, and stores the registration information on the authentication server.

[0022] In one embodiment, sending the encrypted registration information to the authentication server includes:

[0023] obtaining an IMSI of the SIM card;

[0024] sending the IMSI and the encrypted registration information to the authentication server correspondingly, so that the authentication server stores the IMSI and the registration information correspondingly.

[0025] In one embodiment, obtaining the internet device identifier from the SIM card includes:

[0026] Write the internet device identity assigned by the industrial internet platform into the SIM card.

[0027] In a second aspect, the application provides a communication authentication method applied to an authentication server, comprising:

[0028] After receiving an authentication request initiated by a target device, perform a key agreement process with the target device to determine a first decryption key for current data reception through the key agreement process; wherein the key agreement process is performed based on a root key generated by a SIM card integrated with a PUF function and set in the target device;

[0029] Receive authentication information sent by the target device, decrypt the authentication information using the first decryption key to obtain a PUF chip serial number generated by the SIM card and an internet device identity obtained from the SIM card, and authenticate the target device based on the PUF chip serial number and the internet device identity; wherein the authentication information is encrypted by the target device using a first encryption key, and the first encryption key is determined by the target device through the key agreement process.

[0030] In one of the embodiments, performing a key agreement process with the target device comprises:

[0031] Generating a public key and a private key of the authentication server;

[0032] Performing the key agreement process based on the public key and the private key of the authentication server.

[0033] In one of the embodiments, performing the key agreement process based on the public key and the private key of the authentication server comprises:

[0034] Sending the public key of the authentication server to the target device, so that the target device generates the first encryption key based on the public key of the authentication server and a private key generated by the target device in the key agreement process;

[0035] Receiving the public key generated by the target device in the key agreement process sent by the target device, and generating the first decryption key based on the public key of the target device and the private key of the authentication server.

[0036] In one of the embodiments, receiving the authentication information sent by the target device comprises:

[0037] Receiving the IMSI of the SIM card and the authentication information corresponding to the target device; wherein the IMSI is used for the authentication server to find the registration information of the device corresponding to the IMSI from the pre-stored registered device list, and determine whether the target device is a registered device based on whether the decrypted authentication information and the registration information are consistent.

[0038] In one of the embodiments, before receiving the authentication request initiated by the target device, the method further comprises:

[0039] After receiving the registration request initiated by the target device, performing a key agreement process with the target device to determine a second decryption key for current data reception through the key agreement process;

[0040] Receiving the encrypted registration information sent by the target device, decrypting the encrypted registration information by using the second decryption key to obtain the PUF chip serial number generated by the SIM card and the internet device identifier obtained from the SIM card, and storing the PUF chip serial number and the internet device identifier corresponding to each other on the authentication server; wherein the encrypted registration information is obtained by encrypting the registration information by using the second encryption key by the target device, and the second encryption key is determined by the target device through the key agreement process.

[0041] In one of the embodiments, receiving the encrypted registration information sent by the target device comprises:

[0042] Receiving the IMSI of the SIM card and the encrypted registration information corresponding to the target device sent by the target device; wherein the IMSI is used for the authentication server to store the IMSI and the registration information corresponding to each other.

[0043] In a third aspect, the application further provides a communication authentication device, which comprises:

[0044] The obtaining module is configured to, after initiating the authentication request, obtain a root key and a PUF chip serial number generated by a user identification SIM card integrated with a physical unclonable function (PUF) in the target device, and obtain an internet device identifier from the SIM card;

[0045] The determining module is configured to perform a key agreement process with the authentication server based on the root key to determine a first encryption key for current data transmission through the key agreement process;

[0046] The encryption module is configured to encrypt the PUF chip serial number and the internet device identifier by using the first encryption key to obtain authentication information, and send the authentication information to the authentication server, so that the authentication server decrypts the authentication information based on a first decryption key determined through the key agreement process, and authenticates the target device according to the decrypted authentication information.

[0047] In a fourth aspect, the application further provides a communication authentication device, which comprises:

[0048] The determining module is configured to, after receiving an authentication request initiated by the target device, perform a key agreement procedure with the target device to determine a first decryption key for current data reception through the key agreement procedure, wherein the key agreement procedure is performed based on a root key generated by a SIM card integrated with a PUF function and arranged in the target device;

[0049] The decrypting module is configured to receive authentication information sent by the target device, decrypt the authentication information by using the first decryption key to obtain a PUF chip serial number generated by the SIM card and an internet device identifier obtained from the SIM card, and authenticate the target device according to the PUF chip serial number and the internet device identifier.

[0050] In a fifth aspect, the present application further provides a computer device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the method of any one of the first aspect or the second aspect when executing the computer program.

[0051] In a sixth aspect, the present application further provides a computer readable storage medium. The computer readable storage medium has a computer program stored thereon, and the computer program, when executed by a processor, implements the steps of the method of any one of the first aspect or the second aspect.

[0052] In a seventh aspect, the present application further provides a computer program product, which comprises a computer program, and the computer program, when executed by a processor, implements the steps of the method of any one of the first aspect or the second aspect.

[0053] The communication authentication method, device, computer device and storage medium, after the target device initiates an authentication request, the target device obtains a root key and a PUF chip serial number generated by the SIM card integrated with the PUF function, and obtains an Internet device identifier from the SIM card; then, the target device performs a key agreement process with an authentication server based on the root key, to determine a first encryption key for current data transmission through the key agreement process; further, the target device encrypts the PUF chip serial number and the Internet device identifier by using the first encryption key, to obtain authentication information, and sends the authentication information to the authentication server, so that the authentication server decrypts the authentication information based on a first decryption key determined through the key agreement process, and authenticates the target device according to the decrypted authentication information. In the present application, the SIM card integrated with the PUF function is used to generate a unique root key and a PUF chip serial number, since the root key and the PUF chip serial number are not saved in the SIM card, the first encryption key generated based on the root key has high security, and the PUF chip serial number is also not easy to be leaked; at the same time, the one-off first encryption key and the first decryption key are generated through the key agreement process, and then the target device is authenticated, which can further improve the security of the target device accessing various Internet of Things business platforms. BRIEF DESCRIPTION OF DRAWINGS

[0054] Figure 1 An application scenario diagram of a communication authentication method in an embodiment;

[0055] Figure 2 A flowchart of a communication authentication method in an embodiment;

[0056] Figure 3 A flowchart of generating a device-side public key and a private key in an embodiment;

[0057] Figure 4 A flowchart of performing a key agreement process in an embodiment;

[0058] Figure 5 A flowchart of sending authentication information in an embodiment;

[0059] Figure 6 A flowchart of target device registration in an embodiment;

[0060] Figure 7 A flowchart of a communication authentication method in another embodiment;

[0061] Figure 8 A flowchart of generating a server-side public key and a private key in an embodiment;

[0062] Figure 9 A flowchart of performing a key agreement process in another embodiment;

[0063] Figure 10 Flowchart of the process of registering the target device in another embodiment;

[0064] Figure 11 Flowchart of the process of the communication authentication method in yet another embodiment;

[0065] Figure 12 Structural block diagram of the communication authentication apparatus in one embodiment;

[0066] Figure 13 Structural block diagram of the communication authentication apparatus in another embodiment;

[0067] Figure 14 Structural block diagram of the communication authentication apparatus in yet another embodiment;

[0068] Figure 15 Structural block diagram of the communication authentication apparatus in still another embodiment;

[0069] Figure 16 Internal structural diagram of the computer device in one embodiment;

[0070] Figure 17 Internal structural diagram of the computer device in another embodiment. DETAILED DESCRIPTION

[0071] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not used to limit the present application.

[0072] The communication authentication method provided by the embodiments of the present application can be applied to, for example, Figure 1The application environment shown. Among them, the terminal device 102 communicates with the authentication server 104 through the network. The data storage system can store the data required by the authentication server 104 to process, such as the registration device list containing the registration information and the like. The data storage system can be integrated on the authentication server 104, or placed on the cloud or other network servers. Specifically, the terminal device 102 sends the registration data and authentication data to the authentication server 104 in the registration process and the authentication process, respectively. The authentication server 104 receives the registration data and stores it in the data storage system in the registration process, and receives the authentication data and authenticates the terminal device 102 based on the authentication data and the stored registration data in the authentication process. Among them, the registration data and the authentication data are encrypted and decrypted using the key generated in the key agreement process, and the data transmission security is ensured by one-time key. The registration data and the authentication data both include the PUF chip serial number generated by the SIM card integrated with the PUF function in the terminal device 102 and the internet device identifier obtained from the SIM card.

[0073] The terminal device 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices, and portable wearable devices. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The authentication server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0074] In one embodiment, as Figure 2 shown, a communication authentication method is provided, comprising the following steps:

[0075] S201, after initiating an authentication request, obtaining the root key generated by the user identification SIM card integrated with the physical unclonable PUF function and the PUF chip serial number set in the target device, and obtaining the internet device identifier from the SIM card.

[0076] In the case that the target device is powered on, and the Internet of Things card in the target device is powered on and attached to the network, the target device initiates an authentication request to the authentication server based on the Internet of Things card, and the authentication request is used to instruct the authentication server to authenticate the target device, that is, to identify whether the target device is a legal device. Among them, the Internet of Things card in the target device is integrated on the SIM card with PUF function.

[0077] A SIM card (Subscriber Identity Module) can access a mobile communication network, use the data stored therein to perform an authentication operation, and access the network after mutual authentication with the network platform. A SIM card with PUF function can be implemented based on a PUF security chip and has the characteristic of physical unclonability.

[0078] It can be understood that even if the SIM card with PUF function is cracked or the card data is leaked, the Internet of Things card cannot be copied and cloned, and the SIM card with PUF function can generate a unique root key and PUF chip serial number in real time. The root key and the PUF chip serial number are not actually saved in the SIM card and are not easy to be leaked. The root key can be represented as PUFKEY, and the PUF chip serial number can be represented as PUFSN.

[0079] The root key and the PUF chip serial number generated by the SIM card in the target device are obtained, and the Internet device identifier is obtained from the SIM card. The Internet device identifier is a unique digital identity assigned to the target device by the industrial Internet platform and can be used for terminal addressing, identity verification, instruction issuing, and other operations. The Internet device identifier can be represented as IIISN, and the target device obtains the Internet device identifier from the industrial Internet platform and writes it into the SIM card.

[0080] In S202, a key agreement process between the target device and the authentication server is performed based on the root key to determine a first encryption key for current data transmission through the key agreement process.

[0081] The key agreement process between the target device and the authentication server in the current authentication process is performed. Specifically, the key agreement process can be implemented based on an ECC (Elliptic Curve Cryptography) key agreement mechanism, that is, the communication parties use their own private key and the public key of the other party to generate an encryption key and a decryption key to encrypt and decrypt the transmission data.

[0082] For example, in the key agreement process, the target device generates a matching public key and private key of the device side based on the root key, and the authentication server generates a matching public key and private key of the server side in the key agreement process. The authentication server sends the public key of the server side to the target device, and the target device sends the public key of the device side to the authentication server. Further, the target device generates a first encryption key according to the public key of the server side and the private key of the device side, and the authentication server generates a first decryption key according to the public key of the device side and the private key of the server side.

[0083] Specifically, the public key and the private key of the device end can be a PUF SM2 algorithm public key and a PUF SM2 algorithm private key generated by a PUF root key, and the public key and the private key of the server end can be an SM2 algorithm public key and an SM2 algorithm private key.

[0084] It should be noted that the encryption key and the decryption key generated each time through the key agreement process are one-time keys, that is, the encryption key and the decryption key generated in the key agreement process under the authentication process each time the target device is authenticated are inconsistent, and one-time key can improve the security of the transmitted data.

[0085] In S203, the PUF chip serial number and the Internet device identifier are encrypted by using the first encryption key to obtain authentication information, and the authentication information is sent to the authentication server, so that the authentication server decrypts the authentication information based on the first decryption key determined by the key agreement process, and authenticates the target device according to the decrypted authentication information.

[0086] The target device encrypts the obtained PUF chip serial number and Internet device identifier by using the first encryption key determined in the key agreement process to obtain authentication information. Since the PUF chip serial number and the Internet device identifier are both unique and have a one-to-one binding relationship, they can be used to identify and authenticate the target device. The encrypted PUF chip serial number in the authentication information can be represented as Ci_PUFSN, and the encrypted Internet device identifier can be represented as Ci_IIISN.

[0087] The target device sends the authentication information to the authentication server. Correspondingly, after receiving the authentication information, the authentication server can decrypt the authentication information by using the first decryption key determined in the key agreement process to obtain the decrypted authentication information, that is, the PUF chip serial number and the Internet device identifier.

[0088] Further, the authentication server can authenticate the target device according to the PUF chip serial number and the Internet device identifier. For example, the PUF chip serial number and the Internet device identifier of the legal device are pre-stored on the authentication server, and the authentication server determines whether the target device is a legal device according to whether the PUF chip serial number and the Internet device identifier received in the current authentication process are consistent with the pre-stored PUF chip serial number and Internet device identifier of the legal device.

[0089] It can be understood that only when the PUF chip serial number and the Internet device identifier are consistent, the target device is determined to be a legal device, and the target device is provided with related service, otherwise the target device is determined to be an illegal device, and the target device is prohibited from accessing.

[0090] Compared with the prior art, the target device obtains the root key generated by the SIM card integrated with the PUF function and the PUF chip serial number after initiating the authentication request, and obtains the Internet device identifier from the SIM card; then, the key negotiation process between the target device and the authentication server is performed based on the root key to determine the first encryption key for current data transmission through the key negotiation process; further, the PUF chip serial number and the Internet device identifier are encrypted by using the first encryption key to obtain the authentication information, and the authentication information is sent to the authentication server for decryption by the authentication server based on the first decryption key determined through the key negotiation process, and the target device is authenticated according to the decrypted authentication information. The SIM card integrated with the PUF function generates a unique root key and a PUF chip serial number, and since the root key and the PUF chip serial number are not saved in the SIM card, the first encryption key generated based on the root key has high security, and the PUF chip serial number is also not easy to be leaked; at the same time, the one-off first encryption key and the first decryption key are generated through the key negotiation process, and then the target device is authenticated, which can further improve the security of the target device accessing various Internet of Things business platforms.

[0091] In order to improve the security of the authentication data transmission, in one embodiment, the authentication data can be encrypted and decrypted by using the key negotiated by the target device and the authentication server in the key negotiation process, to realize the refinement of S202. As shown in the following table, the specific steps can include the following steps: Figure 3

[0092] S301, generating a public key and a private key of the target device based on the root key.

[0093] The root key refers to a PUF root key, which is a unique and unclonable encryption root key of the target device generated from a PUF security chip, and can be used to protect the application key and the certificate of the target device. The target device generates a public key and a private key of the device side in the current authentication process based on the root key.

[0094] The public key of the device side can be a PUF SM2 algorithm public key, denoted as PK.PUF; and the private key of the device side can be a PUF SM2 algorithm private key, denoted as SK.PUF.

[0095] S302, performing a key negotiation process based on the public key and the private key of the target device.

[0096] The key negotiation process refers to a process of negotiating an encryption key and a decryption key of authentication data by the target device and the authentication server in the current authentication process.

[0097] ​Specifically, based on the public key and the private key of the target device and the public key and the private key of the authentication server, a key agreement process is performed. The target device, based on the server-side public key and the device-side private key, agrees to generate a first encryption key for the authentication data, and the authentication server, based on the device-side public key and the server-side private key, agrees to generate a first decryption key for the authentication data.

[0098] The server-side public key can be an SM2 algorithm public key, denoted as PK.AS, and the server-side private key can be an SM2 algorithm private key, denoted as SK.AS. Correspondingly, the first encryption key and the first decryption key can be shared data protection keys generated by using PK.AS / SK.AS and PK.PUF / SK.PUF, denoted as DK.AKA.

[0099] In an optional embodiment, as shown in FIG. 3B, S302 can include the following steps: Figure 4

[0100] S3021, sending the public key of the target device to the authentication server, so that the authentication server generates a first decryption key based on the public key of the target device and the private key generated by the authentication server in the key agreement process.

[0101] In the case where the target device generates the device-side public key and the private key based on the root key, the target device sends the device-side public key to the authentication server, so that the authentication server can agree to generate the first decryption key based on the received device-side public key and the server-side private key. The first decryption key is used to decrypt the authentication data encrypted by the first encryption key and sent by the target device.

[0102] S3022, receiving the public key of the authentication server sent by the authentication server, and generating a first encryption key according to the public key of the authentication server and the private key of the target device.

[0103] In the case where the authentication server generates the server-side public key and the private key, the authentication server sends the server-side public key to the target device, so that the target device can agree to generate the first encryption key based on the received server-side public key and the device-side private key.

[0104] It should be noted that the above S301 and S302, and S3021 and S3022 are not necessarily executed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be alternately executed with at least part of other steps or steps in other steps or stages.

[0105] ​The target device generates the public key and the private key of the device side based on the root key in the embodiment, which has high security. The target device and the authentication server only transmit the public keys in the key agreement process, and generate the first encryption key and the first decryption key based on the private key of the target device and the public key of the authentication server, which can further improve the security of the authentication data transmission, and makes the target device authentication based on the authentication data have high reliability.

[0106] In order to enable the authentication server to find the registration information matching the authentication information of the target device in the pre-stored registration device list, on the basis of the above embodiment, in an embodiment, the IMSI of the SIM card can be synchronously transmitted to the authentication server together with the authentication information, so as to realize the refinement of S203. As shown in the following table, the specific steps can include the following steps: Figure 5

[0107] S501, obtaining an international mobile equipment identity (IMSI) of a SIM card.

[0108] The IMSI (International Mobile Subscriber Identity) is obtained from the SIM card, and the IMSI is a mark for distinguishing mobile users.

[0109] S502, transmitting the IMSI and the authentication information to the authentication server.

[0110] The IMSI is used for enabling the authentication server to find the registration information of the device corresponding to the IMSI from the pre-stored registration device list, and to judge whether the target device is the registration device based on whether the decrypted authentication information and the registration information are consistent.

[0111] The IMSI and the authentication information have a corresponding relationship. The target device can transmit the IMSI to the authentication server at the same time of transmitting the authentication information, or can transmit the authentication information and the IMSI to the authentication server respectively, which is not limited in the embodiment.

[0112] Only when the authentication server receives the IMSI and the authentication information, the authentication server can take the IMSI as an index, find the registration device corresponding to the IMSI from the pre-stored registration device list, and find the registration information of the registration device corresponding to the IMSI.

[0113] ​Further, if the IMSI corresponding registration device cannot be found, the target device has not been registered on the authentication server, and the target device authentication fails. If the IMSI corresponding registration device can be found, the authentication server can determine whether the target device is the registration device based on whether the decrypted authentication information and the registration information are consistent. If the target device is the registration device, the authentication passes and the target device is provided with related service, and if the target device is not the registration device, the authentication fails and the target device is prohibited from accessing.

[0114] In the embodiment, the target device sends the IMSI of the SIM card to the authentication server in the authentication process, so that the authentication server can find the pre-stored registration information of the registration device by taking the IMSI as an index, and authenticate the target device based on the registration information and the decrypted authentication information, thereby improving the reliability of the target device authentication.

[0115] In order to successfully authenticate the target device in the authentication process, on the basis of the above embodiment, in one embodiment, the registration process of the target device can be performed before the authentication process is performed, so as to realize the refinement of the above communication authentication method. As shown in the following Figure 6 The specific steps can include the following steps:

[0116] S601, after initiating the registration request, the root key generated by the SIM card and the PUF chip serial number are obtained, and the internet device identifier is obtained from the SIM card.

[0117] When the target device is powered on and the Internet of Things card in the target device is powered on and attached to the network, the target device initiates a registration request to the industrial internet platform based on the Internet of Things card, and the registration request is used to instruct the industrial internet platform to allocate an internet device identifier to the target device.

[0118] Optionally, the internet device identifier allocated by the industrial internet platform is written into the SIM card.

[0119] Further, the target device initiates a registration request to the authentication server based on the Internet of Things card, and the registration request is used to instruct the authentication server to register the target device as a legal device. After initiating the registration request, the root key generated by the SIM card in the target device and the PUF chip serial number are obtained, and the internet device identifier written into the SIM card is obtained.

[0120] S602, based on the root key, a key negotiation process between the target device and the authentication server is performed to determine a second encryption key for current data transmission through the key negotiation process.

[0121] The key negotiation process between the target device and the authentication server in the current registration process is performed.

[0122] For example, the target device generates a matching device-side public key and private key based on the root key in the key agreement process, and the authentication server generates a matching server-side public key and private key in the key agreement process. The authentication server sends the server-side public key to the target device, and the target device sends the device-side public key to the authentication server. Further, the target device generates a second encryption key according to the server-side public key and the device-side private key, and the authentication server generates a second decryption key according to the device-side public key and the server-side private key.

[0123] Specifically, the device-side public key and private key can be a PUF SM2 algorithm public key and private key generated by the PUF root key, and the server-side public key and private key can be an SM2 algorithm public key and private key.

[0124] It should be noted that the encryption key and decryption key generated each time through the key agreement process are one-time keys, that is, when the target device is registered and each time the target device is authenticated, the encryption key and decryption key generated in the key agreement process are inconsistent, and one-time key can improve the security of the transmitted data.

[0125] S603, encrypt the PUF chip serial number and the internet device identifier using the second encryption key to obtain encrypted registration information, and send the encrypted registration information to the authentication server, so that the authentication server decrypts the encrypted registration information based on the second decryption key determined by the key agreement process to obtain the registration information, and stores the registration information on the authentication server.

[0126] The target device encrypts the obtained PUF chip serial number and internet device identifier using the second encryption key determined in the key agreement process to obtain encrypted registration information, and then sends the encrypted registration information to the authentication server.

[0127] Correspondingly, after receiving the encrypted registration information, the authentication server can decrypt the encrypted registration information using the second decryption key determined in the key agreement process to obtain the registration information, that is, the PUF chip serial number and the internet device identifier. Further, the authentication server can correspondingly store the PUF chip serial number and the internet device identifier in the local.

[0128] In an optional embodiment, the IMSI of the SIM card is obtained, and the IMSI and the encrypted registration information are correspondingly sent to the authentication server, so that the authentication server correspondingly stores the IMSI and the registration information.

[0129] Obtain the IMSI from the SIM card. The IMSI and the registration information have a corresponding relationship, and the IMSI is used by the authentication server to add the target device and the registration information of the target device to the registered device list as an index.

[0130] The target device can send the IMSI to the authentication server at the same time of sending the registration information, or can send the registration information and the IMSI to the authentication server respectively, and the embodiment does not limit this.

[0131] The authentication server can only update the registered device list when receiving the IMSI and the registration information.

[0132] In the embodiment, the SIM card integrated with the PUF function generates a unique root key and a PUF chip serial number. Since the root key and the PUF chip serial number are not saved in the SIM card, the second encryption key generated based on the root key has high security, and the PUF chip serial number is also not easy to be leaked. At the same time, the one-time second encryption key and the second decryption key are generated through the key agreement process, and then the target device is registered, which can further improve the security of the target device accessing various Internet of Things business platforms.

[0133] In one embodiment, as shown in Figure 7 A communication authentication method is provided, comprising the following steps:

[0134] S701, after receiving an authentication request initiated by a target device, performing a key agreement process with the target device to determine a first decryption key for current data reception through the key agreement process.

[0135] When the target device is powered on and the Internet of Things card in the target device is powered on and attached to the network, the target device initiates an authentication request to the authentication server based on the Internet of Things card, and the authentication request is used to instruct the authentication server to authenticate the target device, that is, to identify whether the target device is a legal device. The Internet of Things card in the target device is integrated on a SIM card with PUF function.

[0136] Correspondingly, the authentication server receives the authentication request, performs a key agreement process with the target device, and determines a first decryption key for current data reception through the key agreement process. The key agreement process is performed based on a root key generated by the SIM card integrated with PUF function in the target device, and the first decryption key is used to decrypt the authentication data sent by the target device.

[0137] The root key refers to a PUF root key, which is a unique and unclonable encryption root key of the target device generated from a PUF security chip, and can be used to protect the application program key and the certificate of the target device.

[0138] The key agreement process can be implemented based on an ECC key agreement mechanism, that is, the communication parties use the private key of the own party and the public key of the other party to agree to generate an encryption key and a decryption key to encrypt and decrypt the transmission data.

[0139] The SIM card can access a mobile communication network, perform an authentication operation using the data stored therein, and access the network after mutual authentication with the network platform. The SIM card with a PUF function can be implemented based on a PUF security chip and has a physically unclonable characteristic.

[0140] For example, the target device generates a matching public key and private key of the device side based on the root key in the key agreement process, and the authentication server generates a matching public key and private key of the server side in the key agreement process. The authentication server sends the public key of the server side to the target device, and the target device sends the public key of the device side to the authentication server. Further, the target device generates a first encryption key according to the public key of the server side and the private key of the device side, and the authentication server generates a first decryption key according to the public key of the device side and the private key of the server side.

[0141] Specifically, the public key and the private key of the device side can be a PUF SM2 algorithm public key and private key generated by using a PUF root key, and the public key and the private key of the server side can be an SM2 algorithm public key and private key.

[0142] It should be noted that the encryption key and the decryption key generated each time through the key agreement process are one-time keys, that is, the encryption key and the decryption key generated in the key agreement process under the authentication process of the target device each time are inconsistent, and one-time key can improve the security of the transmission data.

[0143] S702, receiving authentication information sent by the target device, decrypting the authentication information by using the first decryption key to obtain a PUF chip serial number generated by the SIM card and an internet device identifier obtained from the SIM card, and authenticating the target device according to the PUF chip serial number and the internet device identifier.

[0144] The authentication information is obtained by encrypting the PUF chip serial number generated by the SIM card and the internet device identifier obtained from the SIM card by the target device using the first encryption key. The first encryption key is determined by the target device through the key agreement process. The internet device identifier is a unique digital identity assigned to the target device by the industrial internet platform, which can be used for terminal addressing, identity verification, instruction issuing, etc. The internet device identifier can be represented as IIISN, and the target device obtains the internet device identifier from the industrial internet platform and writes it into the SIM card.

[0145] Since the PUF chip serial number and the internet device identifier are both unique, there is a one-to-one binding relationship between the two, which can be used to identify and authenticate the target device. The encrypted PUF chip serial number in the authentication information can be represented as Ci_PUFSN, and the encrypted internet device identifier can be represented as Ci_IIISN.

[0146] After the authentication server receives the authentication information, it can use the first decryption key determined in the key negotiation process to decrypt the authentication information to obtain the decrypted authentication information, i.e., the PUF chip serial number and the internet device identifier. Further, the authentication server can authenticate the target device according to the PUF chip serial number and the internet device identifier.

[0147] For example, the authentication server pre-stores the PUF chip serial number and the internet device identifier of the legal device, and the authentication server determines whether the target device is a legal device according to whether the PUF chip serial number and the internet device identifier received in the current authentication process are consistent with the pre-stored PUF chip serial number and the internet device identifier of the legal device.

[0148] It can be understood that only when the PUF chip serial number and the internet device identifier are consistent, the target device is determined to be a legal device, and the target device is provided with related service, otherwise the target device is determined to be an illegal device, and the target device is prohibited from accessing.

[0149] Compared with the prior art, the above scheme, after the authentication server receives the authentication request initiated by the target device, performs a key negotiation process with the target device to determine the first decryption key for the current data reception through the key negotiation process; wherein the key negotiation process is performed based on the root key generated by the SIM card integrated with the PUF function in the target device; the authentication server receives the authentication information sent by the target device, and decrypts the authentication information using the first decryption key to obtain the PUF chip serial number generated by the SIM card and the internet device identifier obtained from the SIM card, and authenticates the target device according to the PUF chip serial number and the internet device identifier; wherein the authentication information is encrypted by the target device using the first encryption key, and the first encryption key is determined by the target device through the key negotiation process. The SIM card integrated with the PUF function generates a unique root key and a PUF chip serial number. Since the root key and the PUF chip serial number are not saved in the SIM card, the first encryption key generated based on the root key has high security, and the PUF chip serial number is also not easy to be leaked. At the same time, the one-time first encryption key and the first decryption key are generated through the key negotiation process, and then the target device is authenticated, which can further improve the security of the target device accessing various Internet of Things business platforms.

[0150] As an optional implementation of the embodiment, the authentication server can receive the IMSI and the authentication information of the SIM card sent by the target device.

[0151] The IMSI is used for the authentication server to find the registration information of the device corresponding to the IMSI from the pre-stored registration device list, and to determine whether the target device is a registered device based on whether the decrypted authentication information and the registration information are consistent.

[0152] The IMSI is obtained from the SIM card, and the IMSI is a mark for distinguishing mobile users. The IMSI and the authentication information have a corresponding relationship.

[0153] The target device can send the IMSI to the authentication server at the same time of sending the authentication information, or can send the authentication information and the IMSI to the authentication server respectively, and the embodiment does not limit this.

[0154] Only when the authentication server receives the IMSI and the authentication information, the authentication server can use the IMSI as an index to find the registration device corresponding to the IMSI and the registration information of the registration device corresponding to the IMSI from the pre-stored registration device list.

[0155] Further, if the registration device corresponding to the IMSI cannot be found, the target device has not been registered on the authentication server, and the target device authentication fails. If the registration device corresponding to the IMSI can be found, the authentication server can determine whether the target device is a registered device based on whether the decrypted authentication information and the registration information are consistent. If the target device is a registered device, the authentication passes and the target device is provided with related service, and if the target device is not a registered device, the authentication fails and the target device is prohibited from accessing.

[0156] In the embodiment, the authentication server receives the IMSI of the SIM card sent by the target device in the authentication process, and then uses the IMSI as an index to find the registration information of the pre-stored registration device, and authenticates the target device based on the registration information and the decrypted authentication information, which can improve the reliability of the target device authentication.

[0157] In order to improve the security of the authentication data transmission, on the basis of the above embodiment, in one embodiment, the authentication data can be encrypted and decrypted by using the key generated by the target device and the authentication server in the key negotiation process, so as to realize the refinement of S701. As shown in the following figure, the specific steps can include the following steps: Figure 8

[0158] S801, generate the public key and the private key of the authentication server.

[0159] ​The public key of the server side can be an SM2 algorithm public key, denoted as PK.AS; and the private key of the server side can be an SM2 algorithm private key, denoted as SK.AS.

[0160] S802, performing a key agreement process based on the public key and the private key of the authentication server.

[0161] The key agreement process refers to a process in which the target device and the authentication server agree to generate an encryption key and a decryption key of the authentication data in the current authentication process.

[0162] Specifically, the key agreement process is performed based on the public key and the private key of the target device, and the public key and the private key of the authentication server. The target device agrees to generate a first encryption key of the authentication data based on the public key of the server side and the private key of the device side, and the authentication server agrees to generate a first decryption key of the authentication data based on the public key of the device side and the private key of the server side.

[0163] In an optional embodiment, as shown in FIG. 8B, S802 can include the following steps: Figure 9

[0164] S8021, sending the public key of the authentication server to the target device, so that the target device generates a first encryption key based on the public key of the authentication server and the private key of the target device generated in the key agreement process.

[0165] The authentication server sends the public key of the server side to the target device in the case of generating the public key and the private key of the server side, so that the target device can agree to generate a first encryption key based on the received public key of the server side and the private key of the device side.

[0166] S8022, receiving the public key of the target device generated in the key agreement process sent by the target device, and generating a first decryption key according to the public key of the target device and the private key of the authentication server.

[0167] The target device sends the public key of the device side to the authentication server in the case of generating the public key and the private key of the device side based on the root key, so that the authentication server can agree to generate a first decryption key based on the received public key of the device side and the private key of the server side. The first decryption key is used to decrypt the authentication data encrypted by the first encryption key sent by the target device.

[0168] It should be noted that the above S801 and S802, and S8021 and S8022 are not necessarily executed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be alternately executed with at least part of other steps or steps in other steps or stages.

[0169] ​In the key negotiation process, the target device and the authentication server only transmit public keys of both parties, generate a first encryption key and a first decryption key based on the private key of the party and the public key of the other party, which can further improve the security of the authentication data transmission, and make the authentication of the target device based on the authentication data have high reliability.

[0170] In order to successfully authenticate the target device in the authentication process, on the basis of the above embodiment, in an embodiment, a registration process of the target device can be performed before the authentication process is performed, so as to realize the refinement of the above communication authentication method. As shown in the figure, the specific steps can include the following steps: Figure 10

[0171] S1001, after receiving the registration request initiated by the target device, performing a key negotiation process with the target device to determine a second decryption key for current data reception through the key negotiation process.

[0172] The authentication server receives the registration request initiated by the target device based on the Internet of Things card, and performs a key negotiation process between the target device and the authentication server in the current registration process. The registration request is used to instruct the authentication server to register the target device, that is, to register the target device as a legal device.

[0173] For example, in the key negotiation process, the target device generates a matching device-side public key and private key based on the root key, and the authentication server generates a matching server-side public key and private key in the key negotiation process. The authentication server sends the server-side public key to the target device, and the target device sends the device-side public key to the authentication server. Further, the target device generates a second encryption key according to the server-side public key and the device-side private key, and the authentication server generates a second decryption key according to the device-side public key and the server-side private key.

[0174] Specifically, the device-side public key and private key can be a PUF SM2 algorithm public key and private key generated by a PUF root key, and the server-side public key and private key can be an SM2 algorithm public key and private key.

[0175] It should be noted that the encryption key and the decryption key generated each time through the key negotiation process are one-time keys, that is, the target device is registered, and the encryption key and the decryption key generated in the key negotiation process are different each time the target device is authenticated, and one-time key can improve the security of the data transmission.

[0176] ​S1002, receiving the encrypted registration information sent by the target device, decrypting the encrypted registration information by using the second decryption key to obtain the PUF chip serial number generated by the SIM card and the internet device identifier obtained from the SIM card, and storing the PUF chip serial number and the internet device identifier in correspondence on the authentication server.

[0177] The encrypted registration information is encrypted by the target device by using the second encryption key, and the second encryption key is determined by the target device through the key negotiation process.

[0178] After the authentication server receives the encrypted registration information, the second decryption key determined in the key negotiation process can be used to decrypt the encrypted registration information to obtain the registration information, i.e. the PUF chip serial number and the internet device identifier. Further, the authentication server can store the PUF chip serial number and the internet device identifier in correspondence in the local.

[0179] In an optional embodiment, the target device corresponding to the received SIM card sends the IMSI and the encrypted registration information. The IMSI is used for the authentication server to store the IMSI and the registration information in correspondence.

[0180] The IMSI is obtained from the SIM card, and the IMSI and the registration information exist in correspondence. The IMSI is used for the authentication server to take the IMSI as an index to add the target device and the registration information of the target device to the registered device list.

[0181] The target device can send the IMSI to the authentication server at the same time of sending the registration information, or can send the registration information and the IMSI to the authentication server respectively. The present embodiment does not limit this.

[0182] The authentication server can only update the registered device list when receiving the IMSI and the registration information.

[0183] In the present embodiment, the SIM card integrated with the PUF function generates a unique root key and a PUF chip serial number. Since the root key and the PUF chip serial number are not saved in the SIM card, the second encryption key generated based on the root key has high security, and the PUF chip serial number is also not easy to be leaked. At the same time, the key negotiation process generates the one-time second encryption key and the second decryption key in real time, and then registers the target device, which can further improve the security of the target device accessing various Internet of Things business platforms.

[0184] In an embodiment, an optional example of a communication authentication method is provided, as shown in Figure 11 The specific process is as follows:

[0185] Registration process:

[0186] The target device integrates an Internet of Things card with a SIM card with PUF function, and sends a registration request to the industrial Internet platform to obtain an Internet device identifier IIISN assigned by the industrial Internet platform and write the Internet device identifier IIISN.

[0187] The target device sends a registration request to the authentication server to instruct the authentication server to generate a server-side public key and private key, i.e., a key pair PK.AS / SK.AS, and receive the public key PK.AS sent by the authentication server.

[0188] The target device sends an indication message of receiving the public key PK.AS to the authentication server to inform the authentication server to send an indication message to the target device to trigger the PUF chip to generate a device-side public key and private key.

[0189] The target device generates a device-side public key and private key, i.e., a key pair PK.PUF / SK.PUF, and sends the public key PK.PUF and the IMSI of the SIM card to the authentication server to enable the authentication server to send an indication message to the target device to request reading of the registration information.

[0190] The target device uses the public key PK.AS and the private key SK.PUF to negotiate a second encryption key DK.AKA, and uses the second encryption key DK.AKA to encrypt the PUF chip serial number PUFSN and the Internet device identifier IIISN to obtain Ci_PUFSN and Ci_IIISN.

[0191] The target device sends Ci_PUFSN and Ci_IIISN to the authentication server for the authentication server to use the public key PK.PUF and the private key SK.AS to negotiate a second decryption key DK.AKA to decrypt Ci_PUFSN and Ci_IIISN to obtain PUFSN and IIISN. Further, the authentication server stores the PUFSN and IIISN of the target device in the local device as an index using the IMSI of the SIM card to achieve registration of the target device.

[0192] Authentication process:

[0193] The target device integrates an Internet of Things card with a SIM card with PUF function, and sends an authentication request to the authentication server to instruct the authentication server to generate a server-side public key and private key, i.e., a key pair PK.AS / SK.AS, and receive the public key PK.AS sent by the authentication server when the target device is powered on and the Internet of Things card is attached to the network.

[0194] The target device sends an indication message of receiving the public key PK.AS to the authentication server, to inform the authentication server to send an indication message of triggering the PUF chip to generate the public key and the private key of the device side to the target device.

[0195] The target device generates the public key and the private key of the device side, i.e. the key pair PK.PUF / SK.PUF, and sends the public key PK.PUF and the IMSI of the SIM card to the authentication server, to make the authentication server send an indication message of requesting to read the authentication information to the target device.

[0196] The target device uses the public key PK.AS and the private key SK.PUF to negotiate to generate a first encryption key DK.AKA, and uses the first encryption key DK.AKA to encrypt the PUF chip serial number PUFSN and the internet device identification IIISN, to obtain Ci_PUFSN and Ci_IIISN.

[0197] The target device sends Ci_PUFSN and Ci_IIISN to the authentication server, for the authentication server to use the public key PK.PUF and the private key SK.AS to negotiate to generate a first decryption key DK.AKA, to decrypt Ci_PUFSN and Ci_IIISN, to obtain PUFSN and IIISN. Further, the authentication server queries the PUFSN and IIISN of the registered device stored locally in the registration process according to the IMSI of the SIM card, and checks whether the PUFSN and IIISN of the registered device are consistent with the PUFSN and IIISN of the target device decrypted, to realize the authentication of the target device.

[0198] The specific process of the above steps can be referred to the description of the method embodiments, and the implementation principles and technical effects are similar, which will not be described here.

[0199] It should be understood that, although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless explicitly stated herein, the execution of these steps has no strict sequence limitation, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0200] Based on the same inventive concept, the embodiments of the present application also provide a communication authentication device for implementing the communication authentication method described above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more communication authentication device embodiments provided below can refer to the limitations of the communication authentication method described above, which will not be repeated here.

[0201] In one embodiment, as shown in Figure 12 , a communication authentication device 1 is provided, comprising an acquisition module 10, a determination module 20 and an encryption module 30, wherein:

[0202] The acquisition module 10 is configured to, after initiating an authentication request, acquire a root key generated by a user identification SIM card integrated with a physical unclonable PUF function and a PUF chip serial number set in a target device, and acquire an internet device identifier from the SIM card.

[0203] The determination module 20 is configured to perform a key agreement process with an authentication server based on the root key, so as to determine a first encryption key for current data transmission through the key agreement process.

[0204] The encryption module 30 is configured to encrypt the PUF chip serial number and the internet device identifier by using the first encryption key to obtain authentication information, and transmit the authentication information to the authentication server, so that the authentication server decrypts the authentication information based on a first decryption key determined by the key agreement process, and authenticates the target device according to the decrypted authentication information.

[0205] In one embodiment, based on Figure 12 , as shown in Figure 13 , the determination module 20 can further include:

[0206] The generation unit 21 is configured to generate a public key and a private key of the target device based on the root key.

[0207] The execution unit 22 is configured to perform the key agreement process based on the public key and the private key of the target device.

[0208] In one embodiment, the execution unit 22 can further include:

[0209] The sending sub-unit is configured to send the public key of the target device to the authentication server, so that the authentication server generates the first decryption key based on the public key of the target device and a private key generated by the authentication server in the key agreement process.

[0210] The receiving sub-unit is configured to receive the public key generated by the authentication server in the key agreement process sent by the authentication server, and generate the first encryption key according to the public key of the authentication server and the private key of the target device.

[0211] In one embodiment, the encryption module 30 described above can further include:

[0212] An identification code obtaining unit is configured to obtain an international mobile equipment identity (IMSI) of the SIM card.

[0213] An identification code sending unit is configured to send the IMSI and the authentication information to the authentication server.

[0214] The IMSI is used by the authentication server to find the registration information of the device corresponding to the IMSI from a pre-stored registration device list, and to determine whether the target device is a registered device based on whether the decrypted authentication information and the registration information are consistent.

[0215] In one embodiment, the communication authentication apparatus 1 described above can further include:

[0216] A second obtaining module is configured to obtain a root key generated by the SIM card and a PUF chip serial number after the registration request is initiated, and to obtain an internet device identifier from the SIM card.

[0217] A second determining module is configured to perform a key agreement process with the authentication server based on the root key, to determine a second encryption key for current data transmission through the key agreement process.

[0218] A second encryption module is configured to encrypt the PUF chip serial number and the internet device identifier using the second encryption key, to obtain encrypted registration information, and to send the encrypted registration information to the authentication server, so that the authentication server decrypts the encrypted registration information based on a second decryption key determined through the key agreement process, to obtain the registration information and store the registration information on the authentication server.

[0219] In one embodiment, the second encryption module described above can further include:

[0220] A second identification code obtaining unit is configured to obtain the IMSI of the SIM card.

[0221] A second identification code sending unit is configured to send the IMSI and the encrypted registration information to the authentication server, so that the authentication server stores the IMSI and the registration information correspondingly.

[0222] In one embodiment, the second obtaining module can be specifically configured to write the internet device identifier allocated by the industrial internet platform into the SIM card.

[0223] In one embodiment, as shown in Figure 14 A communication authentication apparatus 2 is provided, which includes a determining module 10 and a decryption module 20, wherein:

[0224] The determining module 10 is configured to perform a key agreement process with the target device after receiving an authentication request initiated by the target device, so as to determine a first decryption key for current data reception through the key agreement process.

[0225] The key agreement process is performed based on a root key generated by a SIM card integrated with a PUF function and arranged in the target device.

[0226] The decryption module 20 is configured to receive authentication information sent by the target device, decrypt the authentication information by using the first decryption key, so as to obtain a PUF chip serial number generated by the SIM card and an Internet device identifier obtained from the SIM card, and authenticate the target device according to the PUF chip serial number and the Internet device identifier.

[0227] The authentication information is encrypted by the target device by using a first encryption key, and the first encryption key is determined by the target device through the key agreement process.

[0228] In an embodiment, based on the above, Figure 14 as shown in Figure 15 The determining module 10 can further include:

[0229] The generating unit 11 is configured to generate a public key and a private key of the authentication server.

[0230] The execution unit 12 is configured to perform the key agreement process based on the public key and the private key of the authentication server.

[0231] In an embodiment, the execution unit 12 can further include:

[0232] The sending sub-unit is configured to send the public key of the authentication server to the target device, so that the target device generates the first encryption key based on the public key of the authentication server and a private key generated by the target device in the key agreement process.

[0233] The receiving sub-unit is configured to receive the public key generated by the target device in the key agreement process, and generate the first decryption key according to the public key of the target device and the private key of the authentication server.

[0234] In an embodiment, the decryption module 20 can be specifically configured to receive the IMSI of the SIM card and the authentication information sent by the target device.

[0235] The IMSI is used for the authentication server to find the registration information of the device corresponding to the IMSI from a pre-stored registration device list, and to determine whether the target device is a registered device based on whether the decrypted authentication information and the registration information are consistent.

[0236] In an embodiment, the communication authentication apparatus 2 can further include:

[0237] The second determining module is configured to perform a key agreement procedure with the target device after receiving the registration request initiated by the target device, so as to determine a second decryption key for current data reception through the key agreement procedure.

[0238] The second decryption module is configured to receive the encrypted registration information sent by the target device, decrypt the encrypted registration information by using the second decryption key, so as to obtain the PUF chip serial number generated by the SIM card and the internet device identifier obtained from the SIM card, and store the PUF chip serial number and the internet device identifier in the authentication server correspondingly.

[0239] The encrypted registration information is encrypted by the target device by using a second encryption key, and the second encryption key is determined by the target device through the key agreement procedure.

[0240] In an embodiment, the second decryption module can be specifically configured to receive the IMSI of the SIM card and the encrypted registration information sent by the target device correspondingly, and the IMSI is used for the authentication server to store the IMSI and the registration information correspondingly.

[0241] The modules in the communication authentication apparatus can be implemented by software, hardware, or a combination thereof. The modules can be embedded in or independent of a processor in a computer device in a hardware form, or stored in a memory in a computer device in a software form, so as to be called and executed by a processor to perform operations corresponding to the modules.

[0242] In an embodiment, a computer device is provided, which includes a transmitter, a receiver, a processor, and a memory. The memory stores a computer program. The processor of the computer device is configured to provide computing and control capabilities. The processor executes the computer program to implement the steps in the above method embodiments. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is configured to communicate with a terminal through a network connection.

[0243] In an embodiment, a computer device is provided, which can be a terminal. An internal structure diagram of the computer device can be as shown in Figure 16The computer device includes a processor, a memory, and a communication interface connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is configured to perform wired or wireless communication with an external terminal. The wireless communication can be achieved through WIFI, mobile cellular network, NFC (Near Field Communication), or other technologies. When the processor executes the computer program, the processor is configured to obtain a root key generated by a user identification SIM card integrated with a physical unclonable function (PUF) and a PUF chip serial number set in a target device after initiating an authentication request, and obtain an internet device identifier from the SIM card; perform a key agreement process with an authentication server based on the root key to determine a first encryption key for current data transmission through the key agreement process; and encrypt the PUF chip serial number and the internet device identifier using the first encryption key to obtain authentication information. The transmitter is configured to send the authentication information to the authentication server, so that the authentication server decrypts the authentication information based on a first decryption key determined through the key agreement process, and authenticates the target device according to the decrypted authentication information.

[0244] In one embodiment, a computer device, which can be a server, has an internal structure diagram as shown in Figure 17The computer device includes a processor, a memory and a network interface connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store registration data. The network interface of the computer device is configured to communicate with an external terminal through a network connection. When the processor executes the computer program, the processor is configured to perform a key agreement process with a target device after receiving an authentication request initiated by the target device, to determine a first decryption key for current data reception through the key agreement process. The key agreement process is based on a root key generated by a SIM card integrated with a PUF function in the target device. The receiver is configured to receive authentication information sent by the target device. The processor executing the computer program is further configured to decrypt the authentication information using the first decryption key to obtain a PUF chip serial number generated by the SIM card and an internet device identifier obtained from the SIM card, and to authenticate the target device based on the PUF chip serial number and the internet device identifier. The authentication information is encrypted by the target device using a first encryption key, and the first encryption key is determined by the target device through the key agreement process.

[0245] In one embodiment, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. The computer program is executed by a processor to implement the steps of the communication authentication method.

[0246] In one embodiment, a computer program product is provided, and the computer program product includes a computer program. The computer program is executed by a processor to implement the steps of the communication authentication method.

[0247] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric memory (Ferroelectric Random Access Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0248] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0249] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A communication authentication method characterized by, Applied to a target device, the method comprises: After initiating an authentication request, obtaining a root key generated by a user identification SIM card integrated with a physical unclonable function (PUF) and a PUF chip serial number set in the target device, and obtaining an internet device identifier from the SIM card; Generating a public key and a private key of the target device based on the root key; Sending the public key of the target device to an authentication server, so that the authentication server generates a first decryption key based on the public key of the target device and a private key generated by the authentication server in a key agreement process; Receiving the public key generated by the authentication server in the key agreement process sent by the authentication server, and generating a first encryption key according to the public key of the authentication server and the private key of the target device; Encrypting the PUF chip serial number and the internet device identifier by using the first encryption key to obtain authentication information, and sending the authentication information to the authentication server, so that the authentication server decrypts the authentication information based on the first decryption key, and authenticates the target device according to the decrypted authentication information.

2. The method of claim 1, wherein, The sending of the authentication information to the authentication server comprises: Obtaining an international mobile equipment identity (IMSI) of the SIM card; Correspondingly sending the IMSI and the authentication information to the authentication server; wherein the IMSI is used for the authentication server to find the registration information of the device corresponding to the IMSI from a pre-stored registered device list, and to judge whether the target device is a registered device based on whether the decrypted authentication information and the registration information are consistent.

3. The method of claim 2, wherein, Before initiating the authentication request, the method further comprises: After initiating a registration request, obtaining the root key and the PUF chip serial number generated by the SIM card, and obtaining the internet device identifier from the SIM card; Performing a key agreement process with the authentication server based on the root key to determine a second encryption key for current data transmission through the key agreement process; Encrypting the PUF chip serial number and the internet device identifier by using the second encryption key to obtain encrypted registration information, and sending the encrypted registration information to the authentication server, so that the authentication server decrypts the encrypted registration information based on a second decryption key determined by the key agreement process to obtain the registration information, and stores the registration information on the authentication server.

4. The method of claim 3, wherein, The sending of the encrypted registration information to the authentication server comprises: Obtaining an international mobile equipment identity (IMSI) of the SIM card; Correspondingly sending the IMSI and the encrypted registration information to the authentication server, so that the authentication server stores the IMSI and the registration information correspondingly.

5. The method of claim 3, wherein, Before obtaining the internet device identifier from the SIM card, the method further comprises: Writing the internet device identifier allocated by an industrial internet platform into the SIM card.

6. A communication authentication method characterized by, Applied to an authentication server, the method comprises: After receiving an authentication request initiated by a target device, a public key and a private key of an authentication server are generated; The target device is sent the public key of the authentication server, so that the target device generates a first encryption key based on the public key of the authentication server and a private key generated by the target device in a key agreement process; The target device is sent the public key generated by the target device in the key agreement process, and a first decryption key is generated according to the public key of the target device and the private key of the authentication server; wherein the key agreement process is performed based on a root key generated by a SIM card integrated with a PUF function set in the target device; The authentication information sent by the target device is received, the authentication information is decrypted using the first decryption key to obtain a PUF chip serial number generated by the SIM card and an internet device identifier obtained from the SIM card, and the target device is authenticated according to the PUF chip serial number and the internet device identifier; wherein the authentication information is encrypted by the target device using the first encryption key.

7. The method of claim 6, wherein, The receiving of the authentication information sent by the target device includes: The IMSI of the SIM card and the authentication information corresponding to the target device are received; wherein the IMSI is used for the authentication server to find the registration information of the device corresponding to the IMSI from a pre-stored registered device list, and to determine whether the target device is a registered device based on whether the decrypted authentication information and the registration information are consistent.

8. The method of claim 7, wherein, Before receiving an authentication request initiated by a target device, the method further includes: After receiving a registration request initiated by a target device, a key agreement process is performed between the target device, so as to determine a second decryption key for current data reception through the key agreement process; Encrypted registration information sent by the target device is received, the encrypted registration information is decrypted using the second decryption key to obtain the PUF chip serial number generated by the SIM card and the internet device identifier obtained from the SIM card, and the PUF chip serial number and the internet device identifier are stored on the authentication server; wherein the encrypted registration information is encrypted by the target device using a second encryption key, and the second encryption key is determined by the target device through the key agreement process.

9. The method of claim 8, wherein, The receiving of the encrypted registration information sent by the target device includes: The IMSI of the SIM card and the encrypted registration information corresponding to the target device are received; wherein the IMSI is used for the authentication server to store the IMSI and the registration information correspondingly.

10. A communication authentication apparatus characterized by comprising: It includes: The acquisition module is configured to, after initiating an authentication request, acquire a root key and a PUF chip serial number generated by a user identification SIM card integrated with a physical unclonable PUF function set in a target device, and acquire an internet device identifier from the SIM card; The determination module is configured to generate a public key and a private key of the target device based on the root key; sending the public key of the target device to the authentication server, so that the authentication server generates a first decryption key based on the public key of the target device and a private key generated by the authentication server in a key agreement process; receiving the public key generated by the authentication server in the key agreement process sent by the authentication server, and generating a first encryption key based on the public key of the authentication server and the private key of the target device; an encryption module configured to encrypt the PUF chip serial number and the internet device identifier using the first encryption key to obtain authentication information, and send the authentication information to the authentication server, so that the authentication server decrypts the authentication information based on the first decryption key determined by the authentication server in the key agreement process, and authenticates the target device based on the decrypted authentication information.

11. A communication authentication apparatus characterized by comprising: comprising: a determination module configured to generate a public key and a private key of an authentication server after receiving an authentication request initiated by a target device; sending the public key of the authentication server to the target device, so that the target device generates a first encryption key based on the public key of the authentication server and a private key generated by the target device in a key agreement process; receiving the public key generated by the target device in the key agreement process sent by the target device, and generating a first decryption key based on the public key of the target device and the private key of the authentication server; wherein the key agreement process is performed based on a root key generated by a SIM card integrated with a PUF function provided in the target device; a decryption module configured to receive authentication information sent by the target device, decrypt the authentication information using the first decryption key to obtain a PUF chip serial number generated by the SIM card and an internet device identifier obtained from the SIM card, and authenticate the target device based on the PUF chip serial number and the internet device identifier; wherein the authentication information is obtained by encrypting the target device using the first encryption key.

12. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the steps of the method of any one of claims 1 to 9.

13. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 9.

14. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 9.

Images