Device authentication method, system, terminal and storage medium

Abstract

The present invention discloses a device authentication method and system, the method comprising: storing master key fragments on each storage device of a KGC group; obtaining corresponding master key information from each storage device of the KGC group according to a private key request sent by each device to be authenticated, and jointly recovering the master key; obtaining the private key of each device to be authenticated according to the recovered master key, and sending the corresponding private key to the corresponding device to be authenticated according to the ID of each device to be authenticated; completing authentication according to the ID and private key of each device to be authenticated. The present invention can prevent a single device from being attacked and causing the master key to be leaked, thereby improving authentication security, and can simplify the authentication process based on the IBKA authentication protocol, thereby improving the device authentication speed based on the identification password.

Description

Technical Field

[0001] The present invention relates to the field of device authentication, and in particular to a device authentication method, system, terminal and storage medium. Background Art

[0002] With the rapid development of the Internet of Things, more and more security issues have been discovered. From the perception layer, network layer, and application layer of the Internet of Things to various security risks, due to the complexity of its protocols, the diversity of devices, and especially the particularity of edge network nodes, traditional Internet security solutions cannot completely solve the security issues of the Internet of Things.

[0003] In related technologies, PIN code (Personal identification number) authentication technology is generally used to authenticate devices that need to be authenticated. PIN code authentication technology is developed based on traditional PKI (Public Key Infrastructure). In addition to retaining the technical advantages of PKI, it mainly solves the problem that PKI needs to exchange a large number of digital certificates in specific security applications, making security applications easier to deploy and use.

[0004] However, the current PIN code authentication process is relatively complicated. If the traditional PKI certificate system is used for device authentication, on the one hand, the traditional PKI certificate system requires multiple authentication processes, and the cumbersome operation process makes it unsuitable for lightweight systems. On the other hand, multiple authentication processes will also lead to low PIN code authentication efficiency of the system. Summary of the invention

[0005] The main purpose of the present invention is to provide a device authentication method, system, terminal and computer-readable storage medium, aiming to solve the problem that the solution of device authentication using the traditional PKI certificate system in the related technology is not applicable to lightweight systems and has low efficiency in device authentication.

[0006] To achieve the above object, the present invention provides a device authentication method, which comprises the following steps:

[0007] Store the master key shards on each storage device in the KGC group;

[0008] According to the private key request sent by each device to be authenticated, the corresponding master key information is obtained from each storage device of the KGC group, and the master key is jointly recovered;

[0009] Obtain the private key of each device to be authenticated according to the restored master key, and send the corresponding private key to the corresponding device to be authenticated according to the ID of each device to be authenticated;

[0010] Complete the authentication based on the ID and private key of each device to be authenticated.

[0011] Optionally, storing the master key shards on each storage device of the KGC group specifically includes:

[0012] Splitting the master key using a key splitting algorithm to obtain multiple different master key information;

[0013] Based on the encryption transmission algorithm, a plurality of different master key information are respectively stored on each storage device of the KGC group, and the access authority of each master key information is set through the key management algorithm.

[0014] Optionally, storing the master key shards on each storage device of the KGC group further includes:

[0015] The master key information stored on each storage device of the KGC group is rotated and updated according to a preset period.

[0016] Optionally, obtaining corresponding master key information from each storage device of the KGC group according to the private key request sent by each device to be authenticated specifically includes:

[0017] Obtain the private key request sent by each device to be authenticated;

[0018] Verify the identity, authority and legitimacy of the private key request sent by each device to be authenticated;

[0019] Each device to be authenticated is authorized according to the verification result, and corresponding master key information is obtained from each storage device in the KGC group.

[0020] Optionally, obtaining corresponding master key information from each storage device of the KGC group specifically includes:

[0021] When the private key request sent by each device to be authenticated is verified, the request is sent to each storage device in the KGC group through the key management protocol;

[0022] The master key information sent by each storage device is obtained, and all the master key information is reconstructed into a complete master key through a key reconstruction algorithm.

[0023] Optionally, the acquiring of the private key of each device to be authenticated according to the restored master key, and sending the corresponding private key to the corresponding device to be authenticated according to the ID of each device to be authenticated, specifically includes:

[0024] Obtain the private key of each device to be authenticated based on the restored master key, and verify the ID of the device to be authenticated based on the mapping relationship established in the key management system or the device certificate;

[0025] According to the verification result, the corresponding private key is sent to the device to be authenticated corresponding to each ID through a secure channel or encrypted transmission.

[0026] Optionally, completing the authentication according to the ID and private key of each device to be authenticated specifically includes:

[0027] According to the ID and private key of each device to be authenticated, the IBKA identity authentication protocol is used to authenticate each other with other devices, and a secure communication channel is established based on the mutual authentication results to transmit data and execute control command operations.

[0028] In addition, to achieve the above object, the present invention further provides a device authentication system, wherein the device authentication system comprises:

[0029] A master key shard storage module, used to store the master key shards on each storage device of the KGC group;

[0030] A master key recovery module, used to obtain corresponding master key information from each storage device of the KGC group according to the private key request sent by each device to be authenticated, and jointly recover the master key;

[0031] The private key acquisition and sending module is used to acquire the private key of each device to be authenticated according to the restored master key, and send the corresponding private key to the corresponding device to be authenticated according to the ID of each device to be authenticated;

[0032] The private key authentication module is used to complete the authentication based on the ID and private key of each device to be authenticated.

[0033] In addition, to achieve the above-mentioned purpose, the present invention also provides a terminal, wherein the terminal includes: a memory, a processor, and a device authentication program stored in the memory and executable on the processor, and when the device authentication program is executed by the processor, the steps of the device authentication method described above are implemented.

[0034] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a device authentication program, and when the device authentication program is executed by a processor, the steps of the device authentication method described above are implemented.

[0035] In the present invention, the master key is stored in pieces on each storage device of the KGC group; according to the private key request sent by each device to be authenticated, the corresponding master key information is obtained from each storage device of the KGC group, and the master key is jointly restored; the private key of each device to be authenticated is obtained according to the restored master key, and the corresponding private key is sent to the corresponding device to be authenticated according to the ID of each device to be authenticated; the authentication is completed according to the ID and private key of each device to be authenticated. The present invention stores the master key information by moving the KGC group, does not need the cloud to manage the master key information, can prevent a single device from being attacked and causing the master key to be leaked, improves the authentication security, and can simplify the authentication process based on the IBKA authentication protocol, and improves the device authentication speed based on the identification password. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 is a flow chart of a preferred embodiment of the device authentication method of the present invention;

[0037] Figure 2 is a structural diagram of a preferred embodiment of the device authentication system of the present invention;

[0038] Figure 3 It is a structural diagram of a preferred embodiment of the terminal of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present invention clearer and more specific, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0040] In the technology of device authentication, PIN code (Personal identification number) authentication technology is generally used to authenticate the devices that need to be authenticated. PIN code authentication technology is developed based on the traditional PKI (Public Key Infrastructure). In addition to retaining the technical advantages of PKI, it mainly solves the problem that PKI needs to exchange a large number of digital certificates in specific security applications, making security applications easier to deploy and use.

[0041] However, the current PIN code authentication process is relatively complicated. If the traditional PKI certificate system is used for device authentication, on the one hand, the traditional PKI certificate system requires multiple authentication processes, and the cumbersome operation process makes it unsuitable for lightweight systems. On the other hand, multiple authentication processes will also lead to low PIN code authentication efficiency of the system.

[0042] The device authentication method described in the preferred embodiment of the present invention is as follows: Figure 1 As shown, the device authentication method includes the following steps:

[0043] Step S10: Store the master key fragments on each storage device of the KGC group.

[0044] It should be noted that in this application, the device authentication method is a device authentication method based on an identification password, which is also called an identity authentication password, and generally refers to a password used to verify the identity of a user. This password is used to log in to the system, access applications or services, and ensure that only authorized users can perform operations.

[0045] The device authentication method mainly stores the master key in pieces on each device of the KGC group (Key Generation Center), so that when the private key is issued to the L0 device (i.e., the device to be authenticated) or the L2 device (the device that mutually authenticates with the device to be authenticated), the KGC group devices jointly restore the master key (the key is only generated by the distributed devices D1 / D2 / D3 / D4 / D5 when in use, and the key is not stored locally on the L0 device or L2 device). In this way, the master key is saved by moving the KGC group, and does not need to be managed by the cloud, but only needs to be maintained by the distributed network devices; at the same time, the master key will not be saved in the device, which can prevent the problem of the master key being leaked due to attacks on a single device, and ensure the security of the device authentication process. Devices with identity identification passwords can use the IBKA identity authentication protocol for device mutual recognition, which simplifies the authentication process and improves the authentication speed.

[0046] Furthermore, storing the master key fragments on each storage device of the KGC group specifically includes:

[0047] Splitting the master key using a key splitting algorithm to obtain multiple different master key information;

[0048] Based on the encryption transmission algorithm, a plurality of different master key information are respectively stored on each storage device of the KGC group, and the access authority of each master key information is set through the key management algorithm.

[0049] Specifically, in the present application, the master key needs to be fragmented and stored on each device of the KGC group. In this process, the master key can be fragmented by a key splitting algorithm to obtain multiple different fragments; wherein the key splitting algorithm can be Shamir's Secret Sharing algorithm; after the master key is divided into multiple fragments, each fragment usually requires a sufficient number of fragments to be restored to a complete master key. As an example, a master key can be divided into 5 fragments, but only at least 3 fragments can be combined together to restore the original master key.

[0050] The KGC group may include multiple storage devices or nodes, each of which stores a portion of the key fragment. This can disperse the risk, and even if some devices are exposed or attacked, the attacker cannot obtain the complete master key. After the key fragments are generated, they need to be securely distributed to different storage devices in the KGC group. This may involve the use of secure communication channels, such as encrypted transmission algorithms (e.g., symmetric key encryption algorithms, asymmetric key encryption algorithms) or physical security measures to ensure that the key fragments are not stolen or tampered with during transmission.

[0051] After storing the key fragments, the key fragments received by each storage device need to be stored securely. During the storage process, a secure storage method can be used for storage, for example, through a hardware security module (HSM) or a dedicated key management system (KMS) to prevent unauthorized access or leakage. At the same time, the access rights of each master key information can be set through a key management algorithm (for example, a symmetric key encryption algorithm, an asymmetric key encryption algorithm) to manage the access rights of the key fragments. Only authorized entities can access and reorganize the master key; during the process of storing key fragments in the entire KGC group, a monitoring and auditing mechanism can be implemented to detect and respond to any unauthorized access attempts or security incidents.

[0052] Furthermore, the storing of the master key shards on each storage device of the KGC group further includes:

[0053] The master key information stored on each storage device of the KGC group is rotated and updated according to a preset period.

[0054] Specifically, in the present application, in order to further enhance security, the distribution and storage of key fragments can be rotated and updated regularly, wherein the rotation and update cycle can be one week or other custom time period, and the rotation and update method can be a random rotation and update method. By rotating and updating, the risk of long-term storage on the device can be reduced, and it can be ensured that even if a leak occurs, the leaked key fragment will become invalid within a limited time. The main purpose of sharding the master key in the present application is to enhance the security of key management. Even if some devices are hacked or attacked, the attacker can only obtain partial key information, but cannot obtain the complete master key. This method also improves the availability and anti-attack capability of the system.

[0055] Step S20: According to the private key request sent by each device to be authenticated, the corresponding master key information is obtained from each storage device of the KGC group, and the master key is jointly restored.

[0056] Specifically, in the present application, the private key request sent by each device to be authenticated means that the device to be authenticated sends a request to obtain a specific private key or the master key information required for encryption / decryption operations; after receiving this request, the KGC group performs a legitimacy authentication, and then re-merges and reconstructs the key fragments stored on different devices into a complete master key, thereby achieving joint recovery of the master key.

[0057] Further, the obtaining corresponding master key information from each storage device of the KGC group according to the private key request sent by each device to be authenticated specifically includes:

[0058] Obtain the private key request sent by each device to be authenticated;

[0059] Verify the identity, authority and legitimacy of the private key request sent by each device to be authenticated;

[0060] Each device to be authenticated is authorized according to the verification result, and corresponding master key information is obtained from each storage device in the KGC group.

[0061] Specifically, in this application, after receiving this request, the KGC group needs to determine whether the request is legal and authorized. This may involve verifying the identity of the device, the authority and the legitimacy of the request content; for example, verifying the legitimacy based on digital certificates, access tokens or role-based access control; once the request of each device to be authenticated is verified, the request of each device to be authenticated is authorized; at the same time, the KGC group begins to obtain the master key information from the storage device. Since the master key has been fragmented and stored on different devices, the KGC group needs to communicate with each device to obtain the required key fragments; when the KGC group communicates with each storage device, the KGC group must ensure that the communication is secure. This may include using encrypted channels (such as TLS or VPN) to transmit data to prevent man-in-the-middle attacks or data leaks.

[0062] Further, the obtaining corresponding master key information from each storage device of the KGC group specifically includes:

[0063] When the private key request sent by each device to be authenticated is verified, the request is sent to each storage device in the KGC group through the key management protocol;

[0064] The master key information sent by each storage device is obtained, and all the master key information is reconstructed into a complete master key through a key reconstruction algorithm.

[0065] Specifically, in the present application, after the KGC group receives the key fragments returned from each storage device, it needs to recombine these fragments into a complete master key. In the process of master key recombination, a key reconstruction algorithm (for example, Shamir's Secret Sharing algorithm) can be used to ensure that the master key can only be reconstructed after receiving a sufficient number of valid key fragments; the complete master key information is used for encryption / decryption operations or other security protocols. During use, the security and protection of the key must be guaranteed to prevent unauthorized access or disclosure. After the complete master key information is reconstructed, the KGC group can provide this information to the device to be authenticated (L0 device) to complete the requested encryption or decryption operation.

[0066] Likewise, security is extremely important during the reassembly of the master key information. All communications and processing should be subject to strict security controls and audits to prevent unauthorized access or data leakage.

[0067] Step S30: Obtain the private key of each device to be authenticated according to the restored master key, and send the corresponding private key to the corresponding device to be authenticated according to the ID of each device to be authenticated.

[0068] Specifically, in the present invention, the recovered master key can be used to generate the private key of each device to be authenticated in a secure environment. These private keys can be symmetric keys or asymmetric keys, depending on the security requirements and application scenarios; after obtaining the private key of each device to be authenticated, by verifying each device to be authenticated, the corresponding private key can be sent to the corresponding device to be authenticated according to the ID of each device to be authenticated.

[0069] Further, the obtaining of the private key of each device to be authenticated according to the restored master key, and sending the corresponding private key to the corresponding device to be authenticated according to the ID of each device to be authenticated, specifically includes:

[0070] Obtain the private key of each device to be authenticated based on the restored master key, and verify the ID of the device to be authenticated based on the mapping relationship established in the key management system or the device certificate;

[0071] According to the verification result, the corresponding private key is sent to the device to be authenticated corresponding to each ID through a secure channel or encrypted transmission.

[0072] Specifically, in the present application, in the process of securely distributing the generated private key to each device to be authenticated, the private key distribution process can be completed through a secure channel (for example, TLS connection method), encrypted transmission, digital signature or other security protocols to ensure that the private key is not tampered with or leaked during transmission; at the same time, in order to ensure that the correct private key is distributed to the corresponding device to be authenticated, it is necessary to accurately manage and match the ID of the device to be authenticated, for example, establishing a mapping relationship in the key management system or using a device certificate to verify the device identity.

[0073] During the entire private key distribution process, security controls and audit measures need to be implemented to ensure that private key distribution complies with security best practices and regulatory requirements, such as monitoring data transmission, recording all operations, and ensuring that only authorized devices can access private keys. After the private key is distributed, the device to be authenticated should use the private key in accordance with the security policy and replace it regularly to maintain the security of the system, for example, through key rotation, revoking leaked keys and other measures to maintain the private key.

[0074] Step S40: Complete authentication according to the ID and private key of each device to be authenticated.

[0075] It should be noted that the authentication of the ID and private key of each device to be authenticated refers to the mutual authentication of the device to be authenticated and other devices. For example, in the IoT scenario, the device to be authenticated can be a master device (such as a mobile phone), and other devices can be IoT devices (such as a Bluetooth speaker). During the authentication process, a secure session is established based on the PIN code, and the public keys of both parties and the network configuration information are encrypted and transmitted. After that, a handshake based on the PIN code + PAKE protocol is performed to negotiate the session key and exchange the public keys of both parties' identities. Finally, the session key is negotiated based on the identity keys of both parties, and encrypted communication is carried out between the two devices.

[0076] Furthermore, the authentication is completed according to the ID and private key of each device to be authenticated, specifically including:

[0077] According to the ID and private key of each device to be authenticated, the IBKA identity authentication protocol is used to authenticate each other with other devices, and a secure communication channel is established based on the mutual authentication results to transmit data and execute control command operations.

[0078] Specifically, in the present application, the authentication protocol (such as the IBKA protocol) to be used is first determined between the device to be authenticated and the other device, and necessary parameters and information such as the negotiated encryption algorithm are exchanged; if there is an Internet gateway, the initial connection can be established through the Internet gateway or an intermediary; the authentication process is a challenge-response authentication process, and the device to be authenticated sends an authentication request to the other device, which contains an authentication request with a challenge or a random number; after receiving the authentication request, the other device uses a pre-shared key or certificate to verify the identity of the device to be authenticated and generates a response; after receiving the response from the other device, the device to be authenticated verifies its validity, for example, the validity of operations such as signature verification, encryption and decryption; if the authentication steps are completed smoothly and both parties verify that they are correct, the device to be authenticated and the other device can confirm each other's identities and establish a secure communication channel to transmit data and execute control commands and other operations.

[0079] The present invention stores master key fragments in a mobile KGC group manner, does not require cloud management, and is jointly maintained by distributed network devices, so that the master key will not be stored in the device, which can prevent a single device from being attacked and causing the master key to be leaked; and, by generating keys based on the device's own attributes such as time or geographic location, fine-grained access control between devices can be achieved; and, based on the IBKA authentication protocol, the authentication process can be simplified and the authentication speed can be increased; compared to the existing device authentication method, the present invention sends data after device authentication, that is, encrypted communication, and can also omit the process of device authentication and negotiation of session keys.

[0080] Furthermore, if Figure 2 As shown, based on the above device authentication method, the present invention also provides a device authentication system accordingly, wherein the device authentication system includes:

[0081] A master key shard storage module 21, used to store the master key shards on each storage device of the KGC group;

[0082] A master key recovery module 22, configured to obtain corresponding master key information from each storage device of the KGC group according to a private key request sent by each device to be authenticated, and jointly recover the master key;

[0083] The private key acquisition and sending module 23 is used to acquire the private key of each device to be authenticated according to the restored master key, and send the corresponding private key to the corresponding device to be authenticated according to the ID of each device to be authenticated;

[0084] The private key authentication module 24 is used to complete the authentication according to the ID and private key of each device to be authenticated.

[0085] Furthermore, if Figure 3As shown, based on the above-mentioned device authentication method and system, the present invention also provides a terminal accordingly, and the terminal includes a processor 10, a memory 20 and a display 30. Figure 3 Only some components of the terminal are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0086] In some embodiments, the memory 20 may be an internal storage unit of the terminal, such as a hard disk or memory of the terminal. In other embodiments, the memory 20 may also be an external storage device of the terminal, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the terminal. Further, the memory 20 may also include both an internal storage unit of the terminal and an external storage device. The memory 20 is used to store application software and various types of data installed on the terminal, such as the program code of the installation terminal. The memory 20 may also be used to temporarily store data that has been output or is to be output. In one embodiment, a device authentication program 40 is stored on the memory 20, and the device authentication program 40 can be executed by the processor 10, thereby implementing the device authentication method in the present application.

[0087] In some embodiments, the processor 10 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run the program code or process data stored in the memory 20, such as executing the device authentication method.

[0088] In some embodiments, the display 30 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 30 is used to display information on the terminal and to display a visual user interface. The components 10-30 of the terminal communicate with each other via a system bus.

[0089] In one embodiment, when the processor 10 executes the device authentication program 40 in the memory 20, the following steps are implemented:

[0090] Store the master key shards on each storage device in the KGC group;

[0091] According to the private key request sent by each device to be authenticated, the corresponding master key information is obtained from each storage device of the KGC group, and the master key is jointly recovered;

[0092] Obtain the private key of each device to be authenticated according to the restored master key, and send the corresponding private key to the corresponding device to be authenticated according to the ID of each device to be authenticated;

[0093] Complete the authentication based on the ID and private key of each device to be authenticated.

[0094] Optionally, storing the master key shards on each storage device of the KGC group specifically includes:

[0095] Splitting the master key using a key splitting algorithm to obtain multiple different master key information;

[0096] Based on the encryption transmission algorithm, a plurality of different master key information are respectively stored on each storage device of the KGC group, and the access authority of each master key information is set through the key management algorithm.

[0097] Optionally, storing the master key shards on each storage device of the KGC group further includes:

[0098] The master key information stored on each storage device of the KGC group is rotated and updated according to a preset period.

[0099] Optionally, obtaining corresponding master key information from each storage device of the KGC group according to the private key request sent by each device to be authenticated specifically includes:

[0100] Obtain the private key request sent by each device to be authenticated;

[0101] Verify the identity, authority and legitimacy of the private key request sent by each device to be authenticated;

[0102] Each device to be authenticated is authorized according to the verification result, and corresponding master key information is obtained from each storage device in the KGC group.

[0103] Optionally, obtaining corresponding master key information from each storage device of the KGC group specifically includes:

[0104] When the private key request sent by each device to be authenticated is verified, the request is sent to each storage device in the KGC group through the key management protocol;

[0105] The master key information sent by each storage device is obtained, and all the master key information is reconstructed into a complete master key through a key reconstruction algorithm.

[0106] Optionally, the acquiring of the private key of each device to be authenticated according to the restored master key, and sending the corresponding private key to the corresponding device to be authenticated according to the ID of each device to be authenticated, specifically includes:

[0107] Obtain the private key of each device to be authenticated based on the restored master key, and verify the ID of the device to be authenticated based on the mapping relationship established in the key management system or the device certificate;

[0108] According to the verification result, the corresponding private key is sent to the device to be authenticated corresponding to each ID through a secure channel or encrypted transmission.

[0109] Optionally, completing the authentication according to the ID and private key of each device to be authenticated specifically includes:

[0110] According to the ID and private key of each device to be authenticated, the IBKA identity authentication protocol is used to authenticate each other with other devices, and a secure communication channel is established based on the mutual authentication results to transmit data and execute control command operations.

[0111] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a device authentication program, and when the device authentication program is executed by a processor, the steps of the device authentication method described above are implemented.

[0112] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or terminal including the element.

[0113] Of course, those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the program can be stored in a computer-readable storage medium that can be read by a computer, and the program can include the processes of the above-mentioned method embodiments when executed. The computer-readable storage medium can be a memory, a disk, an optical disk, etc.

[0114] It should be understood that the application of the present invention is not limited to the above examples. For ordinary technicians in this field, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A device authentication method, characterized in that: The device authentication method comprises: Store the master key shards on each storage device in the KGC group; According to the private key request sent by each device to be authenticated, the corresponding master key information is obtained from each storage device of the KGC group, and the master key is jointly recovered; The obtaining corresponding master key information from each storage device of the KGC group according to the private key request sent by each device to be authenticated specifically includes: Obtain the private key request sent by each device to be authenticated; Verify the identity, authority and legitimacy of the private key request sent by each device to be authenticated; Authorize each device to be authenticated according to the verification result, and obtain corresponding master key information from each storage device of the KGC group; The obtaining corresponding master key information from each storage device of the KGC group specifically includes: When the private key request sent by each device to be authenticated is verified, the request is sent to each storage device in the KGC group through the key management protocol; Obtain the master key information sent by each storage device, and reconstruct all the master key information into a complete master key through a key reconstruction algorithm; Obtain the private key of each device to be authenticated according to the restored master key, and send the corresponding private key to the corresponding device to be authenticated according to the ID of each device to be authenticated; Authentication is completed based on the ID and private key of each device to be authenticated. During the authentication process, a secure session is established based on the PIN code, and the public keys of both parties and the network configuration information are encrypted and transmitted. Based on the PIN code and PAKE protocol handshake, the session key is negotiated and the public keys of the identity identification of both parties are exchanged. The session key is negotiated based on the identity identification keys of both parties, and encrypted communication is carried out between the two devices.

2. The device authentication method according to claim 1, characterized in that: The storing of the master key fragments on each storage device of the KGC group specifically includes: Splitting the master key using a key splitting algorithm to obtain multiple different master key information; Based on the encryption transmission algorithm, a plurality of different master key information are respectively stored on each storage device of the KGC group, and the access authority of each master key information is set through the key management algorithm.

3. The device authentication method according to claim 1, characterized in that: The storing of the master key fragments on each storage device of the KGC group further includes: The master key information stored on each storage device of the KGC group is rotated and updated according to a preset period.

4. The device authentication method according to claim 1, characterized in that: The method of obtaining the private key of each device to be authenticated according to the restored master key, and sending the corresponding private key to the corresponding device to be authenticated according to the ID of each device to be authenticated, specifically includes: Obtain the private key of each device to be authenticated based on the restored master key, and verify the ID of the device to be authenticated based on the mapping relationship established in the key management system or the device certificate; According to the verification result, the corresponding private key is sent to the device to be authenticated corresponding to each ID through a secure channel or encrypted transmission.

5. The device authentication method according to claim 1, characterized in that: The authentication is completed according to the ID and private key of each device to be authenticated, specifically including: According to the ID and private key of each device to be authenticated, the IBKA identity authentication protocol is used to authenticate each other with other devices, and a secure communication channel is established based on the mutual authentication results to transmit data and execute control command operations.

6. A device authentication system, used to implement the device authentication method according to any one of claims 1 to 5, characterized in that: The device authentication system comprises: A master key shard storage module, used to store the master key shards on each storage device of the KGC group; A master key recovery module, used to obtain corresponding master key information from each storage device of the KGC group according to the private key request sent by each device to be authenticated, and jointly recover the master key; The private key acquisition and sending module is used to acquire the private key of each device to be authenticated according to the restored master key, and send the corresponding private key to the corresponding device to be authenticated according to the ID of each device to be authenticated; The private key authentication module is used to complete the authentication based on the ID and private key of each device to be authenticated.

7. A terminal, characterized in that: The terminal includes: a memory, a processor, and a device authentication program stored in the memory and executable on the processor, wherein the device authentication program implements the steps of the device authentication method according to any one of claims 1 to 5 when executed by the processor.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a device authentication program, and when the device authentication program is executed by a processor, the steps of the device authentication method according to any one of claims 1 to 5 are implemented.

Images