A gateway authentication method and device for client dynamic upload process

Abstract

The present invention discloses a gateway authentication method and device for a client dynamic upload process, which includes: the client generates two pairs of temporary public keys and temporary private keys, the client encrypts an access request data packet according to one of its temporary private keys and the public key of a controller, the controller decrypts and verifies the access request data packet according to its private key and a temporary public key of the client, sends the public key of the gateway to the client, sends another temporary public key of the client to the gateway, the client encrypts the access request data packet according to another temporary private key and the public key of the gateway, and the gateway decrypts the access request data packet according to its private key and another temporary public key of the client. The present invention generates two pairs of temporary public keys and private keys for the client, one pair is used to knock on the door with the controller, and the other pair is used to knock on the door with the gateway, thereby realizing encrypted communication between the client and the gateway, and encrypting and decrypting are performed through a shared key, thereby ensuring the security and integrity of the data.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and in particular to a gateway authentication method and device for a dynamic uploading process of a client. Background Art

[0002] In computer network communications, it is crucial to protect the confidentiality and integrity of data. To achieve this goal, public key encryption technology is widely used. The public key encryption algorithm uses a pair of keys, including a public key and a private key. The public key is used to encrypt data, while the private key is used to decrypt data. However, simply using a pair of public keys and private keys to establish a connection between the client and the gateway will make the data easily intercepted during transmission, and it is difficult to ensure that the data is not tampered with during transmission, so the integrity of the data cannot be ensured. Summary of the invention

[0003] In order to solve the above technical problems, the present invention provides a gateway authentication method for a client dynamic upload process, comprising:

[0004] The controller's public key is built into the client, and the gateway's public key is built into the controller;

[0005] The client randomly generates two pairs of temporary public keys and temporary private keys when it starts up;

[0006] The client calculates a shared key based on a temporary private key of the client and the public key of the controller to encrypt the access request data packet, and sends the encrypted access request data packet to the controller;

[0007] After receiving the encrypted access request data packet, the controller calculates a shared key based on the controller's private key and a temporary public key of the client to decrypt the access request data packet;

[0008] The controller verifies the information in the decrypted access request data packet, sends the gateway's public key to the client after verification, and sends another temporary public key of the client in the access request data packet to the gateway;

[0009] The client calculates a shared key based on another temporary private key of the client and the public key of the gateway to encrypt the access request data packet, and sends the encrypted access request data packet to the gateway;

[0010] The gateway calculates a shared key based on the gateway's private key and another temporary public key of the client to decrypt the access request data packet and obtain all the information in the access request data packet.

[0011] Further, the controller verifies the information in the decrypted access request data packet, sends the public key of the gateway to the client after the verification, and sends another temporary public key of the client in the access request data packet to the gateway, including:

[0012] The controller verifies all the information in the decrypted access request data packet one by one;

[0013] After the verification is passed, a secure transmission channel is established between the client and the gateway;

[0014] The controller sends the gateway's public key to the client;

[0015] The controller extracts another temporary public key of the client in the access request packet and sends it to the gateway.

[0016] Furthermore, the controller verifies all information in the decrypted access request data packet one by one, including:

[0017] The controller verifies all the information in the decrypted access request data packet one by one;

[0018] If all the information in the access request data packet is verified, it means the verification is successful and the access request data packet is accepted;

[0019] If at least one item of information in the access request data packet fails to pass the verification, it means that the verification fails and the access request data packet is discarded.

[0020] Furthermore, a timestamp anti-replay factor is set for the secure transmission channel.

[0021] Furthermore, the information in the access request data packet includes:

[0022] Device environment information, user information, enterprise ID, and two temporary public keys of the client.

[0023] Furthermore, a shared key change cycle is set, and the shared key is periodically changed according to the change cycle.

[0024] Furthermore, the client randomly generates two pairs of temporary public keys and private keys for itself according to the ECC elliptic curve algorithm when it starts.

[0025] The present invention also provides a gateway authentication device for a client dynamic upload process, comprising:

[0026] Built-in module, used to embed the controller's public key into the client, and embed the gateway's public key into the controller;

[0027] The identity authentication module is used for the client to randomly generate two pairs of temporary public keys and temporary private keys when starting up;

[0028] The client calculates a shared key based on a temporary private key of the client and the public key of the controller to encrypt the access request data packet, and sends the encrypted access request data packet to the controller;

[0029] After receiving the encrypted access request data packet, the controller calculates a shared key based on the controller's private key and a temporary public key of the client to decrypt the access request data packet;

[0030] A verification module is used for the controller to verify the information in the decrypted access request data packet, and after the verification is passed, the public key of the gateway is sent to the client, and another temporary public key of the client in the access request data packet is sent to the gateway;

[0031] A connection module, used for the client to calculate a shared secret key based on another temporary private key of the client and the public key of the gateway to encrypt the access request data packet, and send the encrypted access request data packet to the gateway;

[0032] The gateway calculates a shared key based on the gateway's private key and another temporary public key of the client to decrypt the access request data packet and obtain all the information in the access request data packet.

[0033] Compared with the prior art, the gateway authentication method and device for dynamic client uploading in the embodiment of the present invention have the following beneficial effects:

[0034] The present invention generates two temporary public keys and private keys for the client, one pair is used to knock on the controller, and the other pair is used to knock on the gateway, thereby realizing encrypted communication between the client and the gateway. The mechanism of public key encryption and decryption is used to ensure the confidentiality of communication, the integrity of data and the authentication of identity. The encryption and decryption are performed through the shared key, thereby ensuring the security and integrity of data, effectively preventing man-in-the-middle attacks, and providing certain security guarantees for the communication system.

[0035] By using the public key encryption algorithm, the client can use the controller's public key to encrypt the access request data packet and send it to the controller. Only the controller holding the corresponding private key can decrypt the data packet. This ensures that only the controller can read and understand the content in the data packet, ensuring the confidentiality of the communication content.

[0036] The client uses a shared key to encrypt the access request data packet, and the controller uses the same shared key to decrypt the data packet. In this way, if the data packet is tampered with during transmission, the decryption process will fail, thus ensuring the integrity of the data;

[0037] During the key exchange process, two-way authentication is performed between the client and the controller. The client uses the temporary private key and the controller's public key to calculate the shared key and sends the encrypted data packet to the controller. The controller uses its own private key and the client's temporary public key to calculate the same shared key and decrypt the data packet. This two-way authentication ensures the identity authentication of both parties in communication and the security of data.

[0038] By using public key encryption and decryption during the communication process, this method can prevent man-in-the-middle attacks. Even if attackers intercept encrypted data packets, they cannot obtain sensitive information in them because they cannot decrypt the data packets. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a flow chart of a gateway authentication method for a dynamic upload process of a client in an embodiment of the present invention;

[0040] Figure 2 It is a schematic diagram of the composition of a gateway authentication device in a dynamic upload process of a client in an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The specific implementation methods of the present application are further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0042] In the description of the present application, it should be understood that the terms "center", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present application.

[0043] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0044] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0045] like Figure 1 As shown, in an embodiment of the present application, a gateway authentication method for a client dynamic upload process is provided, comprising: step S100: embedding the public key of the controller into the client, and embedding the public key of the gateway into the controller; step S200: the client randomly generates two pairs of temporary public keys and temporary private keys of the client at startup; step S300: the client calculates a shared key based on a temporary private key of the client and the public key of the controller to encrypt an access request data packet, and sends the encrypted access request data packet to the controller; step S400: after receiving the encrypted access request data packet, the controller calculates a shared key based on the private key of the controller and a temporary public key of the client. The shared key is used to decrypt the access request data packet; step S500: the controller verifies the information in the decrypted access request data packet, and sends the public key of the gateway to the client after the verification, and sends another temporary public key of the client in the access request data packet to the gateway; step S600: the client calculates the shared key based on another temporary private key of the client and the public key of the gateway to encrypt the access request data packet, and sends the encrypted access request data packet to the gateway; step S700: the gateway calculates the shared key based on the private key of the gateway and another temporary public key of the client to decrypt the access request data packet to obtain all the information in the access request data packet.

[0046] Furthermore, the present invention generates two pairs of temporary public keys and private keys for itself through the client, one pair is used to knock on the controller, and the other pair is used to knock on the gateway, thereby realizing encrypted communication between it and the gateway, and utilizing the public key encryption and decryption mechanism to ensure the confidentiality of communication, the integrity of data and the authentication of identity, and encrypts and decrypts through shared keys to ensure the security and integrity of data, effectively preventing man-in-the-middle attacks and providing a certain security guarantee for the communication system.

[0047] In an embodiment of the present application, a gateway authentication method for a client dynamic upload process is provided, wherein the controller verifies the information in the decrypted access request data packet, sends the gateway's public key to the client after the verification is successful, and sends another temporary public key of the client in the access request data packet to the gateway, including: the controller verifies all the information in the decrypted access request data packet one by one; after the verification is successful, establishes a secure transmission channel between the client and the gateway; the controller sends the gateway's public key to the client; the controller extracts another temporary public key of the client in the access request data packet and sends it to the gateway.

[0048] Furthermore, by using a public key encryption algorithm, the client can use the controller's public key to encrypt an access request data packet and send it to the controller. Only the controller holding the corresponding private key can decrypt the data packet, which ensures that only the controller can read and understand the content in the data packet and ensures the confidentiality of the communication content; the client uses a shared key to encrypt the access request data packet, and the controller uses the same shared key to decrypt the data packet. In this way, if the data packet is tampered with during transmission, the decryption process will fail, thereby ensuring the integrity of the data; during the key exchange process, a two-way verification is performed between the client and the controller. The client uses a temporary private key and the controller's public key to calculate the shared key and sends the encrypted data packet to the controller. The controller uses its own private key and the client's temporary public key to calculate the same shared key and decrypt the data packet. This two-way verification ensures the identity authentication of the communicating parties and the security of the data; by using public key encryption and decryption during the communication process, this method can prevent man-in-the-middle attacks. Even if the attacker intercepts the encrypted data packet, they cannot obtain the sensitive information in it because they cannot decrypt the data packet.

[0049] In an embodiment of the present application, a gateway authentication method for a client dynamic upload process is provided, wherein the controller verifies all information in the decrypted access request data packet one by one, including: the controller verifies all information in the decrypted access request data packet one by one; if all information in the access request data packet is verified, it indicates that the verification is passed, and the access request data packet is accepted; if at least one item of information in the access request data packet is not verified, it indicates that the verification is not passed, and the access request data packet is discarded.

[0050] Specifically, the user identity, access rights, and other relevant information in the access request data packet are checked, and by comparing with the user rights database stored in the controller, it can be determined whether the request has sufficient rights to perform the requested operation.

[0051] Furthermore, by verifying all the information in the decrypted access request data packet one by one, the controller can accurately determine the legitimacy of the request. If all the information passes the verification, it means that the verification is successful, and the controller can accept and process the request. If at least one item of information fails the verification, it means that the verification fails, and the controller will discard the request, thereby preventing unauthorized access. The effect is to ensure the legitimacy and security of the access request data packet, thereby improving the security and credibility of the system.

[0052] In an embodiment of the present application, a gateway authentication method for a dynamic upload process of a client is provided, and a timestamp anti-replay factor is set for a secure transmission channel to prevent replay attacks.

[0053] In an embodiment of the present application, a gateway authentication method for a client dynamic upload process is provided, and the information in the access request data packet includes:

[0054] Device environment information, user information, enterprise ID, and two temporary public keys of the client.

[0055] In an embodiment of the present application, a gateway authentication method for a dynamic upload process of a client is provided, a shared key change cycle is set, and the shared key is periodically changed according to the change cycle, which can prevent man-in-the-middle attacks.

[0056] In an embodiment of the present application, a gateway authentication method for a dynamic upload process of a client is provided, and the client randomly generates two pairs of its own temporary public keys and private keys according to the ECC elliptic curve algorithm when it starts.

[0057] like Figure 2As shown, in an embodiment of the present application, a gateway authentication device for a client dynamic upload process is provided, including: a built-in module, used to build the public key of the controller into the client, and build the public key of the gateway into the controller; an identity authentication module, used for the client to randomly generate two pairs of temporary public keys and temporary private keys of the client when starting; the client calculates a shared key according to a temporary private key of the client and the public key of the controller to encrypt the access request data packet, and sends the encrypted access request data packet to the controller; after receiving the encrypted access request data packet, the controller calculates a shared key according to the private key of the controller and a temporary public key of the client to decrypt the access request data packet; a verification module, used for the controller to verify the information in the decrypted access request data packet, send the public key of the gateway to the client after the verification is passed, and send another temporary public key of the client in the access request data packet to the gateway; a connection module, used for the client to calculate a shared key according to another temporary private key of the client and the public key of the gateway to encrypt the access request data packet, and send the encrypted access request data packet to the gateway; the gateway calculates a shared key according to the private key of the gateway and another temporary public key of the client to decrypt the access request data packet to obtain all the information in the access request data packet.

[0058] In summary, the embodiment of the present invention provides a gateway authentication method and device for the dynamic upload process of the client, which includes: the public key of the controller is built into the client, the public key of the gateway is built into the controller, the client randomly generates two pairs of temporary public keys and temporary private keys, the client calculates a shared key based on one of its temporary private keys and the public key of the controller to encrypt the access request data packet, the controller calculates a shared key based on its private key and a temporary public key of the client to decrypt the access request data packet, and after verifying the information in the decrypted access request data packet, the gateway's public key is sent to the client, and another temporary public key of the client is sent to the gateway, the client calculates a shared key based on another temporary private key and the public key of the gateway to encrypt the access request data packet, and the gateway calculates a shared key based on its private key and another temporary public key of the client to decrypt the access request data packet. The present invention generates two pairs of temporary public keys and private keys for itself through the client, one pair is used to knock on the door with the controller, and the other pair is used to knock on the door with the gateway, thereby realizing encrypted communication between it and the gateway, and encrypting and decrypting through the shared key, ensuring the security and integrity of the data.

[0059] Finally, it should be noted that it is obvious that those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

[0060] The above is only an example of implementation of the present invention, but it cannot be used to limit the scope of the present invention. Any structural changes made according to the present invention, as long as they do not lose the essence of the present invention, should be regarded as falling within the scope of protection of the present invention and being restricted. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process and related instructions of the system described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0061] The term "comprise" or any other similar term is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus / device that includes a list of elements includes not only those elements but also other elements not expressly listed, or also includes elements inherent to such process, method, article, or apparatus / device.

[0062] So far, the technical solutions of the present invention have been described in conjunction with the further embodiments shown in the accompanying drawings, but it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0063] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention.

Claims

1. A gateway authentication method for a client dynamic upload process, characterized in that: include: The controller's public key is built into the client, and the gateway's public key is built into the controller; The client randomly generates two pairs of temporary public keys and temporary private keys when it starts up; The client calculates a shared key based on a temporary private key of the client and the public key of the controller to encrypt the access request data packet, and sends the encrypted access request data packet to the controller; After receiving the encrypted access request data packet, the controller calculates a shared key based on the controller's private key and a temporary public key of the client to decrypt the access request data packet; The controller verifies the information in the decrypted access request data packet, sends the gateway's public key to the client after verification, and sends another temporary public key of the client in the access request data packet to the gateway; The client calculates a shared key based on another temporary private key of the client and the public key of the gateway to encrypt the access request data packet, and sends the encrypted access request data packet to the gateway; The gateway calculates a shared secret key based on the gateway's private key and another temporary public key of the client to decrypt the access request data packet and obtain all the information in the access request data packet; The controller verifies the information in the decrypted access request data packet, sends the public key of the gateway to the client after the verification, and sends another temporary public key of the client in the access request data packet to the gateway, including: The controller verifies all the information in the decrypted access request data packet one by one; After the verification is passed, a secure transmission channel is established between the client and the gateway; The controller sends the gateway's public key to the client; The controller extracts another temporary public key of the client in the access request packet and sends it to the gateway; The controller verifies all information in the decrypted access request data packet one by one, including: The controller verifies all the information in the decrypted access request data packet one by one; If all the information in the access request data packet is verified, it means the verification is successful and the access request data packet is accepted; If at least one item of information in the access request data packet fails to pass the verification, it means that the verification fails and the access request data packet is discarded.

2. According to claim 1, a gateway authentication method for a client dynamic upload process is characterized in that: Set a timestamp anti-replay factor for the secure transmission channel.

3. According to claim 1, a gateway authentication method for a client dynamic upload process is characterized in that: The information in the access request data packet includes: Device environment information, user information, enterprise ID, and two temporary public keys of the client.

4. According to claim 1, a gateway authentication method for a client dynamic upload process is characterized in that: Set the shared key change cycle and periodically change the shared key according to the change cycle.

5. The gateway authentication method for a client dynamic upload process according to claim 1, characterized in that: include: When the client starts, it randomly generates two pairs of temporary public and private keys based on the ECC elliptic curve algorithm.

6. A gateway authentication device for a client dynamic upload process, characterized in that: Built-in module, used to embed the controller's public key into the client, and embed the gateway's public key into the controller; The identity authentication module is used for the client to randomly generate two pairs of temporary public keys and temporary private keys when starting up; The client calculates a shared key based on a temporary private key of the client and the public key of the controller to encrypt the access request data packet, and sends the encrypted access request data packet to the controller; After receiving the encrypted access request data packet, the controller calculates a shared key based on the controller's private key and a temporary public key of the client to decrypt the access request data packet; A verification module is used for the controller to verify the information in the decrypted access request data packet, and after the verification is passed, the public key of the gateway is sent to the client, and another temporary public key of the client in the access request data packet is sent to the gateway; A connection module, used for the client to calculate a shared secret key based on another temporary private key of the client and the public key of the gateway to encrypt the access request data packet, and send the encrypted access request data packet to the gateway; The gateway calculates a shared secret key based on the gateway's private key and another temporary public key of the client to decrypt the access request data packet and obtain all the information in the access request data packet; The controller verifies the information in the decrypted access request data packet, sends the public key of the gateway to the client after the verification, and sends another temporary public key of the client in the access request data packet to the gateway, including: The controller verifies all the information in the decrypted access request data packet one by one; After the verification is passed, a secure transmission channel is established between the client and the gateway; The controller sends the gateway's public key to the client; The controller extracts another temporary public key of the client in the access request packet and sends it to the gateway; The controller verifies all information in the decrypted access request data packet one by one, including: The controller verifies all the information in the decrypted access request data packet one by one; If all the information in the access request data packet is verified, it means the verification is successful and the access request data packet is accepted; If at least one item of information in the access request data packet fails to pass the verification, it means that the verification fails and the access request data packet is discarded.

Images