A method and system for edge terminal device to verify the legitimacy of edge node

Abstract

The present invention relates to the technical field of edge verification, and provides a method and system for edge terminal devices to verify the legitimacy of edge nodes, including: constructing identity authentication information through the authentication client of the terminal device and the authentication service end of the edge node, sending the constructed identity authentication information and the corresponding signature request to the signature service module of the central cloud; the signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request, and returns the identity authentication information and the corresponding signature value to the authentication client of the terminal device; the authentication client of the terminal device verifies the signed identity authentication information, performs signature verification on the verified identity authentication information, and determines the edge node corresponding to the identity authentication information that passes the signature verification as trusted by the terminal device. The present invention can significantly improve the efficiency and security of terminal devices in verifying the legitimacy of edge nodes.

Description

Technical Field

[0001] The present invention relates to the field of edge verification technology, and in particular to a method and system for edge terminal equipment to verify the legitimacy of an edge node. Background Art

[0002] Edge computing usually includes cloud, edge and terminal resources. Terminal devices provide specific business functions such as environmental data and video data collection. Edge nodes are responsible for business access and data reporting in specific areas. The central cloud is responsible for data aggregation, data analysis and core business processes. With the widespread application of edge computing in scenarios such as the Internet of Things (IoT), a large number of edge devices and terminal devices are deployed in locations far away from the central cloud. Due to the dispersed locations, edge terminal devices and edge access nodes are vulnerable to malicious attacks such as intrusion, tampering and counterfeiting.

[0003] Traditional security protection usually only verifies the legitimacy of the access terminal at the edge access node, but the legitimacy verification of the access node by the terminal device is equally important. If the terminal device accesses a forged or hijacked insecure edge node, it will cause security risks such as data leakage.

[0004] Currently, there are two typical schemes for terminal devices to verify the legitimacy of edge nodes.

[0005] The first is to verify through the certificate trust chain, that is, the edge node service opens the https service, the https certificate uses the trusted certificate of the terminal device, and uses the certificate to perform authorization for the service domain name. When the terminal device connects to the server, the legitimacy of the server certificate is verified through the local built-in certificate public key of the terminal. In practical applications, this solution has the following shortcomings: 1. It requires that the https encrypted channel must be used between the client and the server. In a large number of IOT scenarios, the terminal and the edge service cannot use encrypted channels such as https due to insufficient resources, insufficient performance, or the need to use fixed protocols; 2. The terminal node deployment location is complex and the function is single. The terminal cannot guarantee the use of a fixed domain name to access the edge service, resulting in the failure of the certificate authorization domain name verification; 3. The edge service is vulnerable to attacks, resulting in the leakage of the certificate private key. After the attacker obtains the certificate private key, it is easy to forge an edge service to steal terminal data.

[0006] The second is to identify based on the server IP address, service ID, etc., that is, the terminal device records the IP address, service ID and other information of the edge service through configuration and other means. When the terminal connects to the edge service, it verifies the ID information provided by the edge service. If the IP and ID information are consistent, the edge service is considered legitimate. In actual applications, this solution has the following shortcomings: 1. The location of the edge service is far away from the central cloud, and the security protection capabilities are usually low. Information such as the service ID is extremely easy to be stolen, and attackers can easily construct counterfeit edge services to steal terminal data. 2. The edge service IP address is not fixed information. In complex scenarios, the edge service IP may change. The terminal needs to support legitimacy verification when the edge service IP changes.

[0007] Therefore, how to provide a more efficient and secure method for terminal devices to verify the legitimacy of edge nodes has become a technical problem that needs to be solved urgently. Summary of the invention

[0008] In view of this, in order to overcome the deficiencies of the prior art, the present invention aims to provide a method and system for edge terminal equipment to verify the legitimacy of an edge node.

[0009] According to a first aspect of the present invention, a method for edge terminal device to verify the legitimacy of edge node is provided, the method comprising:

[0010] Build identity authentication information through the authentication client of the terminal device and the authentication server of the edge node, and send the built identity authentication information and the corresponding signature request to the signature service module of the central cloud;

[0011] The signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request, and returns the identity authentication information and the corresponding signature value to the authentication client of the terminal device;

[0012] The authentication client of the terminal device verifies the signed identity authentication information, performs signature verification on the verified identity authentication information, and determines the edge node corresponding to the identity authentication information that passes the signature verification as trusted by the terminal device.

[0013] Preferably, in the method for edge terminal device to verify the legitimacy of edge node of the present invention, identity authentication information is constructed by the authentication client of the terminal device and the authentication server of the edge node, and the constructed identity authentication information and the corresponding signature request are sent to the signature service module of the central cloud, including:

[0014] Generate a random terminal password corresponding to the authentication through the authentication client of the terminal device, and send the terminal device name and the generated random terminal password to the authentication service module of the edge node;

[0015] The authentication server of the edge node generates a server-side random password corresponding to the authentication, obtains the device ID of the corresponding terminal device from the local storage of the edge node according to the terminal device name, and constructs the identity authentication information according to the server-side random password, terminal device name, terminal device ID and terminal random password. The constructed identity authentication information and the corresponding signature request are sent to the signature service module of the central cloud.

[0016] Preferably, in the method for edge terminal devices of the present invention to verify the legitimacy of edge nodes, the signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request, and returns the identity authentication information and the corresponding signature value to the authentication client of the terminal device, including: the signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request, the hardware encryption machine returns the signature value to the signature service module after executing the signature, and the signature service module packages the identity authentication information and the corresponding signature value and sends them to the authentication client of the terminal device through the authentication server of the edge node.

[0017] Preferably, in the method for edge terminal devices of the present invention to verify the legitimacy of edge nodes, the signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request, and the hardware encryption machine returns the signature value to the signature service module after executing the signature, including: calculating the summary string corresponding to the identity authentication information through the hardware encryption machine, using the signature private key to perform encryption calculation on the summary string, and returning the signature string obtained by the encryption calculation as the signature value to the signature service module.

[0018] Preferably, in the method for an edge terminal device of the present invention to verify the legitimacy of an edge node, the authentication client of the terminal device verifies the signed identity authentication information, including: comparing the signed identity authentication information with the identity authentication information constructed by the edge node, and when the signed identity authentication information is the same as the identity authentication information constructed by the edge node, it is determined that the signed identity authentication information has passed the verification.

[0019] Preferably, in the method for an edge terminal device of the present invention to verify the legitimacy of an edge node, a signature verification is performed on the verified identity authentication information, and the edge node corresponding to the identity authentication information that passes the signature verification is determined to be trusted by the terminal device, including: using the public key certificate in the local storage of the terminal device to decrypt the signature value corresponding to the identity authentication information, recalculating the decrypted string obtained by decryption to obtain a summary string, and when the recalculated summary string is the same as the summary string calculated by the hardware encryption machine, it is determined that the identity authentication information passes the signature verification.

[0020] According to a second aspect of the present invention, a system for edge terminal equipment to verify the legitimacy of edge nodes is provided, the system being used for:

[0021] Build identity authentication information through the authentication client of the terminal device and the authentication server of the edge node, and send the built identity authentication information and the corresponding signature request to the signature service module of the central cloud;

[0022] The signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request, and returns the identity authentication information and the corresponding signature value to the authentication client of the terminal device;

[0023] The authentication client of the terminal device verifies the signed identity authentication information, performs signature verification on the verified identity authentication information, and determines the edge node corresponding to the identity authentication information that passes the signature verification as trusted by the terminal device.

[0024] Preferably, in the system for edge terminal device to verify the legitimacy of edge node of the present invention, the authentication client of the terminal device is used for:

[0025] Generate a random terminal password corresponding to the authentication, and send the terminal device name and the generated random terminal password to the authentication service module of the edge node;

[0026] Compare the signed identity authentication information with the identity authentication information constructed by the edge node, and when the signed identity authentication information is the same as the identity authentication information constructed by the edge node, determine that the signed identity authentication information passes the verification;

[0027] The signature value corresponding to the identity authentication information is decrypted using the public key certificate in the local storage of the terminal device, and the decrypted string obtained by decryption is recalculated to obtain a summary string. When the recalculated summary string is the same as the summary string calculated by the hardware encryption machine, the identity authentication information is determined to have passed the signature verification.

[0028] Preferably, in the system for edge terminal devices of the present invention to verify the legitimacy of edge nodes, the authentication server of the edge node is used to: generate a server-side random password corresponding to the authentication, obtain the device ID of the corresponding terminal device from the local storage of the edge node according to the terminal device name, construct identity authentication information according to the server-side random password, the terminal device name, the device ID of the terminal device and the terminal random password, and send the constructed identity authentication information and the corresponding signature request to the signature service module of the central cloud; send the identity authentication information packaged by the signature service module and the corresponding signature value to the authentication client of the terminal device.

[0029] Preferably, in the system for edge terminal devices of the present invention to verify the legitimacy of edge nodes, the signature service module of the central cloud is used to: call the hardware encryption machine to sign the received identity authentication information according to the received signature request, and the hardware encryption machine returns the signature value to the signature service module after executing the signature. The signature service module packages the identity authentication information and the corresponding signature value and sends them to the authentication client of the terminal device through the authentication server of the edge node.

[0030] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect of the present invention when executing the program.

[0031] The method and system for edge terminal device to verify the legitimacy of edge node according to the embodiment of the present invention have the following beneficial technical effects:

[0032] 1. The data for executing the signature is a combination of the data provided by the terminal device and the data provided by the edge access device. The central cloud verifies the relevant information to ensure that the terminal name and terminal ID are consistent before executing the signature, which significantly improves the verification security;

[0033] 2. By verifying the signature of the random password dynamically generated by the terminal device, it can prevent the attacker from forging signature data after the single authentication information is stolen;

[0034] 3. By executing the signature on the hardware encryption machine in the central cloud, only the public key corresponding to the signature private key is released, and the terminal device uses the public key certificate to verify the signature, which can avoid the security risks caused by the leakage of the signature private key;

[0035] 4. Before the edge node executes the signature through the central cloud interface, the central cloud can uniformly manage the lower-level edge nodes through measures such as access control, edge node identity, and security status monitoring, which can effectively prevent counterfeit attacks from malicious edge nodes;

[0036] 5. The edge node itself records the name / ID information of the terminal identity that is expected to be accessed, and carries the complete information when signing, which can be used as a mechanism to assist in verifying the legitimacy of the edge node. When an attacker impersonates an edge node, he cannot obtain the terminal ID information and cannot forge the complete signature data. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 An exemplary diagram of a system for verifying the legitimacy of an edge node by an edge terminal device according to an embodiment of the present invention;

[0039] Figure 2 A flowchart of a method for edge terminal equipment to verify the legitimacy of an edge node according to an embodiment of the present invention;

[0040] Figure 3 A technical schematic diagram of a method for edge terminal equipment to verify the legitimacy of an edge node according to an embodiment of the present invention;

[0041] Figure 4 A schematic diagram of the structure of the device provided by the present invention. DETAILED DESCRIPTION

[0042] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0043] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0044] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0045] The present invention realizes a system for verifying the legitimacy of edge nodes by terminal devices in non-encrypted scenarios by combining random keys, client IDs and a central cloud hardware encryption machine signature mechanism.

[0046] Figure 1 FIG. 1 is an exemplary diagram of a system for verifying the legitimacy of an edge node by an edge terminal device according to an embodiment of the present invention. Figure 1 As shown, the system for edge terminal equipment to verify the legitimacy of edge nodes in this embodiment is used for:

[0047] Build identity authentication information through the authentication client of the terminal device and the authentication server of the edge node, and send the built identity authentication information and the corresponding signature request to the signature service module of the central cloud;

[0048] The signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request, and returns the identity authentication information and the corresponding signature value to the authentication client of the terminal device;

[0049] The authentication client of the terminal device verifies the signed identity authentication information, performs signature verification on the verified identity authentication information, and determines the edge node corresponding to the identity authentication information that passes the signature verification as trusted by the terminal device.

[0050] In the embodiment of the present invention, the authentication client of the terminal device is the endpoint device of edge computing, which is responsible for collecting data. The terminal device verifies the legitimacy of the edge node to which it is connected through the authentication service server. In the embodiment of the present invention, the terminal device has a fixed device ID bound to the hardware information, and a public key certificate is built into the terminal device to verify the legitimacy of the signature of the edge node identity authentication information.

[0051] As an optional example, in the system in which the edge terminal device of this embodiment verifies the legitimacy of the edge node, the authentication client of the terminal device is used to:

[0052] Generate a random terminal password corresponding to the authentication, and send the terminal device name and the generated random terminal password to the authentication service module of the edge node;

[0053] Compare the signed identity authentication information with the identity authentication information constructed by the edge node, and when the signed identity authentication information is the same as the identity authentication information constructed by the edge node, determine that the signed identity authentication information passes the verification;

[0054] The signature value corresponding to the identity authentication information is decrypted using the public key certificate in the local storage of the terminal device, and the decrypted string obtained by decryption is recalculated to obtain a summary string. When the recalculated summary string is the same as the summary string calculated by the hardware encryption machine, the identity authentication information is determined to have passed the signature verification.

[0055] In the embodiment of the present invention, the authentication server of the edge node provides access functions for the terminal device. At the same time, the authentication server of the edge node uses the signature service of the backend to sign the verification information provided by the client of the terminal device, and transmits the signed information back to the client of the terminal device as its own identity proof. In this embodiment, the authentication server of the edge node enters the names and IDs of all terminal devices that need to access this edge node in advance as auxiliary verification parameters for subsequent authentication.

[0056] As an optional example, in the system in which the edge terminal device of this embodiment verifies the legitimacy of the edge node, the authentication server of the edge node is used to: generate a server-side random password corresponding to the authentication, obtain the device ID of the corresponding terminal device from the local storage of the edge node according to the terminal device name, and construct identity authentication information according to the server-side random password, the terminal device name, the device ID of the terminal device and the terminal random password, and send the constructed identity authentication information and the corresponding signature request to the signature service module of the central cloud; send the identity authentication information packaged by the signature service module and the corresponding signature value to the authentication client of the terminal device.

[0057] In the method of this embodiment, the signature service module of the central cloud uses the encryption private key of the central cloud itself to execute signature for the data provided by the authentication service module of the edge node.

[0058] As an optional example, in the system where the edge terminal device of this embodiment verifies the legitimacy of the edge node, the signature service module of the central cloud is used to: call the hardware encryption machine to sign the received identity authentication information according to the received signature request, and the hardware encryption machine returns the signature value to the signature service module after executing the signature. The signature service module packages the identity authentication information and the corresponding signature value and sends them to the authentication client of the terminal device through the authentication server of the edge node.

[0059] Based on the above system, an embodiment of the present application provides a method for an edge terminal device to verify the legitimacy of an edge node, which is illustrated by the following embodiments.

[0060] Figure 2 This is a flowchart of a method for edge terminal equipment to verify the legitimacy of an edge node according to an embodiment of the present invention. Figure 3 A technical schematic diagram of a method for edge terminal device to verify the legitimacy of an edge node according to an embodiment of the present invention.

[0061] like Figure 2 and Figure 3 As shown, the method for edge terminal device of this embodiment to verify the legitimacy of edge node includes the following steps:

[0062] Step S101: construct identity authentication information through the authentication client of the terminal device and the authentication server of the edge node, and send the constructed identity authentication information and the corresponding signature request to the signature service module of the central cloud.

[0063] As an optional example, in the method of this embodiment, a terminal random password corresponding to the authentication is generated by the authentication client of the terminal device, and the terminal device name and the generated terminal random password are sent to the authentication service module of the edge node; a server random password corresponding to the authentication is generated by the authentication server of the edge node, and the device ID of the corresponding terminal device is obtained from the local storage of the edge node according to the terminal device name, and the identity authentication information is constructed according to the server random password, the terminal device name, the device ID of the terminal device and the terminal random password, and the constructed identity authentication information and the corresponding signature request are sent to the signature service module of the central cloud. In this embodiment, the identity authentication information includes the data provided by the terminal device and the data provided by the edge node, that is, the data for executing the signature, which is a combination of the data provided by the terminal device and the data provided by the edge access device. The central cloud verifies the relevant information to ensure that the terminal name and the terminal ID are consistent before executing the signature, which significantly improves the verification security.

[0064] Step S102: The signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request, and returns the identity authentication information and the corresponding signature value to the authentication client of the terminal device.

[0065] As an optional example, the signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request. After executing the signature, the hardware encryption machine returns the signature value to the signature service module. The signature service module packages the identity authentication information and the corresponding signature value and sends them to the authentication client of the terminal device through the authentication service end of the edge node. In this embodiment, the summary string corresponding to the identity authentication information is calculated by the hardware encryption machine, and the signature private key is used to perform encryption calculation on the summary string, and the signature string obtained by the encryption calculation is returned to the signature service module as the signature value.

[0066] In actual applications, before the edge node of the method of this embodiment executes the signature through the interface of the central cloud, the central cloud can uniformly manage the lower-level edge nodes through measures such as access control, edge node identity, and security status monitoring, which can effectively prevent counterfeit attacks by malicious edge nodes; the edge node itself records the name / ID information of the terminal identity that is expected to access, and carries complete information when signing, which can be used as a mechanism to assist in verifying the legitimacy of the edge node. When an attacker counterfeit an edge node, he cannot forge complete signature data without obtaining the terminal ID information.

[0067] Step S103: the authentication client of the terminal device verifies the signed identity authentication information, performs signature verification on the verified identity authentication information, and determines the edge node corresponding to the identity authentication information that passes the signature verification as trusted by the terminal device.

[0068] As an optional example, in the method of this embodiment, the authentication client of the terminal device compares the signed identity authentication information with the identity authentication information constructed by the edge node. When the signed identity authentication information is the same as the identity authentication information constructed by the edge node, it is determined that the signed identity authentication information passes the verification. In the method of this embodiment, by verifying the signature of the random password dynamically generated by the terminal device, it is possible to prevent the attacker from using the stolen single authentication information to forge signature data.

[0069] After the signed identity verification information passes the verification, the signature value corresponding to the identity verification information is decrypted using the public key certificate in the local storage of the terminal device, and the decrypted string obtained by decryption is recalculated to obtain a summary string. When the recalculated summary string is the same as the summary string calculated by the hardware encryption machine, the identity verification information is determined to have passed the signature verification. In the method of this embodiment, by executing the signature on the hardware encryption machine in the central cloud, only the public key corresponding to the signature private key is published, and the terminal device uses the public key certificate to verify the signature, which can avoid security risks caused by the leakage of the signature private key.

[0070] The method and system for edge terminal device to verify the legitimacy of edge node according to the embodiment of the present invention have the following beneficial technical effects:

[0071] 1. The data for executing the signature is a combination of the data provided by the terminal device and the data provided by the edge access device. The central cloud verifies the relevant information to ensure that the terminal name and terminal ID are consistent before executing the signature, which significantly improves the verification security;

[0072] 2. By verifying the signature of the random password dynamically generated by the terminal device, it can prevent the attacker from forging signature data after the single authentication information is stolen;

[0073] 3. By executing the signature on the hardware encryption machine in the central cloud, only the public key corresponding to the signature private key is released, and the terminal device uses the public key certificate to verify the signature, which can avoid the security risks caused by the leakage of the signature private key;

[0074] 4. Before the edge node executes the signature through the central cloud interface, the central cloud can uniformly manage the lower-level edge nodes through measures such as access control, edge node identity, and security status monitoring, which can effectively prevent counterfeit attacks from malicious edge nodes;

[0075] 5. The edge node itself records the name / ID information of the terminal identity that is expected to be accessed, and carries the complete information when signing, which can be used as a mechanism to assist in verifying the legitimacy of the edge node. When an attacker impersonates an edge node, he cannot obtain the terminal ID information and cannot forge the complete signature data.

[0076] like Figure 4As shown, the present invention also provides a device, including a processor 310, a communication interface 320, a memory 330 for storing a processor executable computer program, and a communication bus 340. The processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 implements the above-mentioned method for edge terminal device to verify the legitimacy of edge node by running the executable computer program.

[0077] Among them, the computer program in the memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0078] The system embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected based on actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0079] Through the description of the above implementation modes, those skilled in the art can clearly understand that each implementation mode can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0080] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for edge terminal equipment to verify the legitimacy of edge nodes, characterized in that: The method comprises: Build identity authentication information through the authentication client of the terminal device and the authentication server of the edge node, and send the built identity authentication information and the corresponding signature request to the signature service module of the central cloud; The signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request, and returns the identity authentication information and the corresponding signature value to the authentication client of the terminal device; The authentication client of the terminal device verifies the signed identity authentication information, performs signature verification on the identity authentication information that passes the verification, and determines the edge node corresponding to the identity authentication information that passes the signature verification as trusted by the terminal device; The authentication client of the terminal device and the authentication server of the edge node construct the authentication information, and send the constructed authentication information and the corresponding signature request to the signature service module of the central cloud, including: Generate a random terminal password corresponding to the authentication through the authentication client of the terminal device, and send the terminal device name and the generated random terminal password to the authentication service module of the edge node; The authentication server of the edge node generates a server-side random password corresponding to the authentication, obtains the device ID of the corresponding terminal device from the local storage of the edge node according to the terminal device name, and constructs the identity authentication information according to the server-side random password, terminal device name, terminal device ID and terminal random password. The constructed identity authentication information and the corresponding signature request are sent to the signature service module of the central cloud.

2. The method for edge terminal device to verify the legitimacy of edge node according to claim 1, characterized in that: The signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request, and returns the identity authentication information and the corresponding signature value to the authentication client of the terminal device, including: the signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request, the hardware encryption machine returns the signature value to the signature service module after executing the signature, the signature service module packages the identity authentication information and the corresponding signature value and sends them to the authentication client of the terminal device through the authentication server of the edge node.

3. The method for edge terminal device to verify the legitimacy of edge node according to claim 2, characterized in that: The signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request. The hardware encryption machine returns the signature value to the signature service module after executing the signature, including: calculating the summary string corresponding to the identity authentication information through the hardware encryption machine, using the signature private key to perform encryption calculation on the summary string, and returning the signature string obtained by the encryption calculation as the signature value to the signature service module.

4. The method for edge terminal device to verify the legitimacy of edge node according to claim 1, characterized in that: The authentication client of the terminal device verifies the signed identity authentication information, including: comparing the signed identity authentication information with the identity authentication information constructed by the edge node, and when the signed identity authentication information is the same as the identity authentication information constructed by the edge node, determining that the signed identity authentication information passes the verification.

5. The method for edge terminal device to verify the legitimacy of edge node according to claim 1, characterized in that: Perform signature verification on the verified identity authentication information, and determine the edge node corresponding to the identity authentication information that passes the signature verification as trusted by the terminal device, including: using the public key certificate in the local storage of the terminal device to decrypt the signature value corresponding to the identity authentication information, recalculating the decrypted string obtained by decryption to obtain a summary string, and when the recalculated summary string is the same as the summary string calculated by the hardware encryption machine, it is determined that the identity authentication information has passed the signature verification.

6. A system for edge terminal equipment to verify the legitimacy of edge nodes, characterized in that: The system is used to: Build identity authentication information through the authentication client of the terminal device and the authentication server of the edge node, and send the built identity authentication information and the corresponding signature request to the signature service module of the central cloud; The signature service module of the central cloud calls the hardware encryption machine to sign the received identity authentication information according to the received signature request, and returns the identity authentication information and the corresponding signature value to the authentication client of the terminal device; The authentication client of the terminal device verifies the signed identity authentication information, performs signature verification on the identity authentication information that passes the verification, and determines the edge node corresponding to the identity authentication information that passes the signature verification as trusted by the terminal device; The authentication client of the terminal device is also used to: Generate a random terminal password corresponding to the authentication, and send the terminal device name and the generated random terminal password to the authentication service module of the edge node; The authentication server of the edge node is also used for: Generate a random server password corresponding to the authentication, obtain the device ID of the corresponding terminal device from the local storage of the edge node according to the terminal device name, build the identity authentication information according to the random server password, terminal device name, terminal device ID and terminal random password, and send the constructed identity authentication information and the corresponding signature request to the signature service module of the central cloud.

7. The system for edge terminal device to verify the legitimacy of edge node according to claim 6, characterized in that: The authentication client of the terminal device is also used to: Compare the signed identity authentication information with the identity authentication information constructed by the edge node, and when the signed identity authentication information is the same as the identity authentication information constructed by the edge node, determine that the signed identity authentication information passes the verification; The signature value corresponding to the identity authentication information is decrypted using the public key certificate in the local storage of the terminal device, and the decrypted string obtained by decryption is recalculated to obtain a summary string. When the recalculated summary string is the same as the summary string calculated by the hardware encryption machine, the identity authentication information is determined to have passed the signature verification.

8. The system for edge terminal device to verify the legitimacy of edge node according to claim 6, characterized in that: The authentication server of the edge node is also used to send the identity authentication information packaged by the signature service module and the corresponding signature value to the authentication client of the terminal device.

9. The system for edge terminal device to verify the legitimacy of edge node according to claim 6, characterized in that: The signature service module of the central cloud is used to call the hardware encryption machine to sign the received identity authentication information according to the received signature request. After executing the signature, the hardware encryption machine returns the signature value to the signature service module. The signature service module packages the identity authentication information and the corresponding signature value and sends it to the authentication client of the terminal device through the authentication server of the edge node.

Images