A non-sensing distribution network two-way authentication method, system, terminal and storage medium

Abstract

This invention discloses a seamless two-way authentication method, system, terminal, and storage medium for power distribution networks. The method includes: acquiring power distribution network configuration information and authorizing and authenticating the device to be distributed; initiating a power distribution authentication request to the device to be distributed and verifying the device based on a challenge value and signature data generated by the device; signing the received challenge value using the private key of the current device based on the verification result of the device to be distributed, and sending the signature data to the device to be distributed; completing the two-way authentication with the device to be distributed based on the verification result of the device to be distributed on the signature data sent by the current device, and outputting an authentication success message. This invention improves the security of seamless two-way authentication for power distribution networks, preventing the information of screenless devices from being forged and leading to the leakage of power distribution network data, and preventing screenless devices from being illegally attacked.

Description

Technical Field

[0001] The present invention relates to the field of equipment network distribution, and in particular to a senseless network distribution bidirectional authentication method, system, terminal and storage medium. Background Art

[0002] IoT devices need to be connected to the Internet before they can report data to the cloud. For devices with screens and input capabilities, such as mobile phones and tablets, users can directly enter the SSID and password through the network configuration interface to connect these devices with screens to the WIFI network. However, for devices without screens, such as controllers and fans, users cannot enter Internet access information through the network configuration interface, so the devices cannot be connected to the WIFI network. At this time, these devices without screens need to be configured for the network.

[0003] For WIFI devices, network configuration is to pass the WIFI SSID and password of the router to the IOT device in some way, so that the IOT device can access the WIFI network. Among them, for devices without screens, the network configuration can be carried out by non-sensing network configuration, which means that the device network configuration can be quickly realized without entering the hotspot-related account information during the device networking process; however, this non-sensing network configuration operation is prone to the problem of network configuration data leakage due to forged network configuration device information, and the problem of illegal attacks on the network configuration device. Summary of the invention

[0004] The main purpose of the present invention is to provide a method, system, terminal and computer-readable storage medium for bidirectional authentication of a non-sensing network configuration, aiming to solve the problems in the prior art of network configuration data leakage caused by the forgery of network configuration equipment information and the illegal attack on network configuration equipment.

[0005] To achieve the above object, the present invention provides a method for bidirectional authentication of a non-sensing distribution network, the method comprising the following steps:

[0006] Obtain network configuration information and perform authorization authentication on network devices to be configured;

[0007] Initiate a network configuration authentication request to the network device to be configured, and verify the network device to be configured according to the challenge value and signature data generated by the network device to be configured;

[0008] According to the verification result of the network device to be configured, the received challenge value is signed using the private key of the current device, and the signature data is sent to the network device to be configured;

[0009] According to the verification result of the signature data sent by the current device by the network device to be configured, the two-way authentication between the network device to be configured and the network device to be configured is completed, and an authentication success message is output.

[0010] Optionally, obtaining the network configuration information and performing authorization authentication on the network configuration device specifically includes:

[0011] Requesting the cloud to obtain the network configuration information;

[0012] Receive the network configuration information sent by the cloud, and obtain the network authentication data in the network configuration information;

[0013] According to the network configuration authentication data, authorization authentication is performed on the device to be configured;

[0014] Establish a communication connection with the network device to be configured according to the authorization authentication result.

[0015] Optionally, initiating a network configuration authentication request to the device to be configured, and verifying the device to be configured according to the challenge value and signature data generated by the device to be configured, specifically includes:

[0016] Initiate a network configuration authentication request to the device to be configured; wherein the network configuration authentication request includes network configuration authentication information, current device public key authentication information and a first challenge value;

[0017] Receive the second challenge value, public key authentication information and signature data generated by the to-be-configured network device, and verify the to-be-configured network device according to the second challenge value, public key authentication information and signature data generated by the to-be-configured network device.

[0018] Optionally, the network configuration authentication information includes: the current device ID, the cloud preset ID to be configured, and the signature data of the current device.

[0019] Optionally, the signature data generated by the to-be-configured network device is data signed by ED25519WithSha256 based on the first challenge value.

[0020] Optionally, verifying the to-be-configured network device according to the second challenge value, public key authentication information, and signature data generated by the to-be-configured network device specifically includes:

[0021] Verify the public key authentication information of the device to be configured, and verify the signature data of the device to be configured through the public key authentication information of the device to be configured;

[0022] Determine whether the device ID in the public key authentication information of the device to be networked is in the secondary device list of the network configuration information;

[0023] If so, it is determined that the network device to be configured is a legal device.

[0024] Optionally, according to the verification result of the network device to be configured, signing the received challenge value with the private key of the current device, and sending the signature data to the network device to be configured, specifically includes:

[0025] When it is determined that the network device to be configured is a legitimate device, the received second challenge value is signed by ED25519WithSha256 using the private key of the current device to obtain the signature data of the current device;

[0026] The signature data of the current device is sent to the device to be configured, and the legal authentication result of the current device by the device to be configured is waited for.

[0027] In addition, to achieve the above-mentioned purpose, the present invention also provides a senseless distribution network two-way authentication system, wherein the senseless distribution network two-way authentication system comprises:

[0028] Configuration information acquisition module, used to obtain network configuration information and perform authorization authentication on network configuration equipment;

[0029] The network device verification module is used to initiate a network configuration authentication request to the network device to be configured, and verify the network device to be configured according to the challenge value and signature data generated by the network device to be configured;

[0030] The current device signature module is used to sign the received challenge value using the private key of the current device according to the verification result of the network device to be configured, and send the signature data to the network device to be configured;

[0031] The two-way authentication success module is used to complete the two-way authentication between the device to be configured and the current device according to the verification result of the signature data sent by the device to be configured, and output an authentication success message.

[0032] In addition, to achieve the above-mentioned purpose, the present invention also provides a terminal, wherein the terminal includes: a memory, a processor, and a seamless network configuration bidirectional authentication program stored on the memory and runnable on the processor, and when the seamless network configuration bidirectional authentication program is executed by the processor, the steps of the seamless network configuration bidirectional authentication method as described above are implemented.

[0033] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a senseless network configuration bidirectional authentication program, and when the senseless network configuration bidirectional authentication program is executed by a processor, the steps of the senseless network configuration bidirectional authentication method as described above are implemented.

[0034] In the present invention, the network configuration information is obtained, and the network device to be configured is authorized and authenticated; a network authentication request is initiated to the network device to be configured, and the network device to be configured is verified according to the challenge value and signature data generated by the network device to be configured; according to the verification result of the network device to be configured, the received challenge value is signed using the private key of the current device, and the signature data is sent to the network device to be configured; according to the verification result of the signature data sent by the current device by the network device to be configured, the two-way authentication between the network device to be configured and the network device to be configured is completed, and an authentication success message is output. The present invention improves the security of the two-way authentication of the senseless network configuration, can prevent the information of the screenless device from being forged, resulting in the leakage of network configuration data, and prevent the screenless device from being illegally attacked. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a flow chart of a preferred embodiment of the method for bidirectional authentication of a non-sensing network distribution network of the present invention;

[0036] Figure 2 It is a structural diagram of a preferred embodiment of the non-sensing distribution network bidirectional authentication system of the present invention;

[0037] Figure 3 It is a structural diagram of a preferred embodiment of the terminal of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present invention clearer and more specific, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0039] For WIFI devices, network configuration is to pass the WIFI SSID and password of the router to the IOT device in some way, so that the IOT device can access the WIFI network. Among them, for devices without screens, the network configuration can be carried out by non-sensing network configuration, which means that the device network configuration can be quickly realized without entering the hotspot-related account information during the device networking process; however, this non-sensing network configuration operation is prone to the problem of network configuration data leakage due to forged network configuration device information, and the problem of illegal attacks on the network configuration device.

[0040] In order to solve the problems of network configuration data leakage caused by forged network device information and illegal attacks on network devices in the prior art, a method for senseless network configuration bidirectional authentication is provided in an embodiment of the present invention. The method obtains network configuration information to authorize and authenticate the network device to be configured; initiates a network configuration authentication request to the network device to be configured, and verifies the network device to be configured according to the challenge value and signature data generated by the network device to be configured; based on the verification result of the network device to be configured, uses the private key of the current device to sign the received challenge value, and sends the signature data to the network device to be configured; based on the verification result of the signature data sent by the current device by the network device to be configured, completes the bidirectional authentication with the network device to be configured, and outputs an authentication success message. The present invention improves the security of senseless network configuration bidirectional authentication, can prevent the information of screenless devices from being forged to cause network configuration data leakage, and prevents screenless devices from being illegally attacked.

[0041] The non-sensing network configuration bidirectional authentication method described in the preferred embodiment of the present invention is as follows: Figure 1 As shown, the method for bidirectional authentication of the non-sensing network configuration includes the following steps:

[0042] Step S10: Obtain network configuration information and perform authorization authentication on the network equipment to be configured.

[0043] It should be noted that in the present application, the method for bidirectional authentication of seamless network configuration is mainly used to realize the function of bidirectional authentication of seamless network configuration between screenless devices (for example, controllers, fans, other IOT screenless devices) and other devices with screens, or to realize the function of bidirectional authentication of seamless network configuration between screenless devices and other screenless devices.

[0044] For ease of understanding, in the present application, the screenless device as described above is set as the device to be networked, and the other screen devices or other screenless devices as described above are set as network configuration devices; accordingly, in the present application, the device to be networked is used as a secondary authentication device, and the network configuration device is used as a primary authentication device; it can be understood that in the present application, the device types of the network configuration device and the device to be networked (screenless device or screen device) are not limited to the device types set as above, and the two can be devices of the same type or different types of devices.

[0045] In this application, the network configuration device serves as the main authentication device. It first needs to connect to the cloud, request the configuration information pre-set in the cloud, and authorize and authenticate the network configuration device. Among them, these configuration information in the cloud are network configuration authentication data configured by the cloud administrator or user through the APP. The network configuration authentication data includes which network configuration devices to be configured that the cloud has authorized the network configuration device to configure. Based on the network configuration authentication data, seamless network configuration two-way authentication can be achieved between the network configuration device and the network configuration device.

[0046] Furthermore, the obtaining of the network configuration information and the authorization authentication of the network equipment to be configured specifically include:

[0047] Requesting the cloud to obtain the network configuration information;

[0048] Receive the network configuration information sent by the cloud, and obtain the network authentication data in the network configuration information;

[0049] According to the network configuration authentication data, authorization authentication is performed on the device to be configured;

[0050] Establish a communication connection with the network device to be configured according to the authorization authentication result.

[0051] Specifically, in the present application, after the cloud sends configuration information to the network configuration device, the network configuration device analyzes the configuration information sent from the cloud to determine which devices in the network configuration authentication data carried by the configuration information are authorized network configuration devices, that is, to analyze and determine which network configuration devices the cloud has authorized the network configuration device to configure; after the network configuration device analyzes, it performs authorization authentication on the network configuration device according to the network configuration authentication data to determine whether the network configuration device is a legitimate device configured by the cloud and can perform seamless network configuration bidirectional authentication with the network configuration device; after determining that the network configuration device is a legitimate device, the network configuration device can establish a communication connection with the network configuration device through a protocol to initiate a network configuration authentication request to the network configuration device.

[0052] Step S20: Initiate a network configuration authentication request to the device to be configured, and verify the device to be configured according to the challenge value and signature data generated by the device to be configured.

[0053] Specifically, in this application, the network configuration device initiates a network configuration authentication request to the network configuration device through a communication protocol between devices (for example, Wi-Fi Direct, Bluetooth, etc.) or through a specific port of a local area network, wherein the network configuration authentication request contains a random challenge value (i.e., the first challenge value) initiated by the network configuration device; after receiving the authentication request, the network configuration device will generate a random challenge value (i.e., the second challenge value), which is usually a random number or an encrypted hash value, as part of the authentication process; at the same time, the network configuration device will also use its own private key to sign the generated challenge value. This signature data contains the encrypted proof of the second challenge value generated by the network configuration device, which is used to prove that the network configuration device has a private key; after the network configuration device receives the second challenge value and signature data generated by the network configuration device, the network configuration device can verify the network configuration device according to the second challenge value and signature data generated by the network configuration device.

[0054] Further, initiating a network configuration authentication request to the network device to be configured, and verifying the network device to be configured according to the challenge value and signature data generated by the network device to be configured, specifically includes:

[0055] Initiate a network configuration authentication request to the device to be configured; wherein the network configuration authentication request includes network configuration authentication information, current device public key authentication information and a first challenge value;

[0056] Receive the second challenge value, public key authentication information and signature data generated by the to-be-configured network device, and verify the to-be-configured network device according to the second challenge value, public key authentication information and signature data generated by the to-be-configured network device.

[0057] Specifically, in this application, the network configuration authentication request initiated by the network configuration device to the network configuration device includes: network configuration authentication information, public key authentication information and the first challenge value; wherein, the network configuration authentication information includes: the current device ID (i.e., the network configuration device ID), the cloud preset ID to be configured and the signature data of the current device. After receiving the request from the network configuration device, the network configuration device first verifies the network configuration device ID, and then verifies the public key authentication information, and compares whether the device ID in the public key information is the network configuration device ID, so as to determine whether the information of the network configuration device is illegal information; finally, the network configuration device uses the local private key to sign the received first challenge value, that is, the signature data generated by the network configuration device is the data signed by ED25519WithSha256 based on the first challenge value.

[0058] After the device to be configured signs the received first challenge value, the device to be configured generates a second challenge value, and sends it to the configuration device together with the public key authentication information of the device to be configured and the signature data of the first challenge value; at this time, the configuration device can verify the device to be configured according to the second challenge value, public key authentication information and signature data generated by the device to be configured, so as to verify whether the device to be configured is a legal device for configuration.

[0059] As an example, in the present application, in the network configuration authentication request initiated by the network configuration device to the device to be configured, the data of the network configuration authentication request includes the network configuration authentication information: major_device_id + minor_device_id + sign_data, that is, it includes the main authentication device ID (that is, the network configuration device ID) + the secondary authentication device ID (that is, the cloud preset ID to be configured) + signature data (that is, the signature data of the network configuration device); the public key authentication information is: device_id + device_pubkey + sign_data, that is, the device ID (that is, the network configuration device ID) + the device public key (that is, the network configuration device public key); the challenge value is: a 16-byte random number, that is, the first challenge value is a 16-byte random number.

[0060] In the process of verifying the network configuration authentication information, the device to be configured obtains the major_device_id of the network configuration device and the minor_device_id of the device to be configured (i.e. the ID to be configured preset in the cloud), and records the major_device_id (i.e. the ID of the network configuration device). If the minor_device_id (i.e. the ID to be configured preset in the cloud) and the local ID (i.e. the ID of the device to be configured) do not match, the network configuration information is considered to be wrong and the authentication is terminated. Then, the public key authentication information is verified, the public key information of the network configuration device is obtained, and the device_id (i.e. the device ID in the public key) is compared to see if it is the major_device_id (i.e. the ID of the network configuration device). If not, the network configuration information is considered to be illegal and the authentication is terminated.

[0061] After the network configuration authentication information is successfully verified, the network configuration device uses the local private key to perform ED25519WithSha256 signature on the received first challenge value; then, the network configuration device generates a second challenge value and sends it together with the public key authentication information of the network configuration device and the signature data of the first challenge value to the network configuration device; at this point, the network configuration device enters the authentication stage.

[0062] Further, the verifying the network device to be configured according to the second challenge value, public key authentication information and signature data generated by the network device to be configured specifically includes:

[0063] Verify the public key authentication information of the device to be configured, and verify the signature data of the device to be configured through the public key authentication information of the device to be configured;

[0064] Determine whether the device ID in the public key authentication information of the device to be networked is in the secondary device list of the network configuration information;

[0065] If so, it is determined that the network device to be configured is a legal device.

[0066] Specifically, in the present application, after the network configuration device receives the second challenge value, public key authentication information and signature data generated by the network device to be configured, the network configuration device can verify the network device to be configured according to the second challenge value, public key authentication information and signature data generated by the network device to be configured, so as to verify whether the network device to be configured is a legal network configuration device.

[0067] In the process of the network configuration device verifying whether the device to be configured is a legal device for network configuration, first, verify the public key authentication information sent by the device to be configured to verify the public key of the device to be configured, and use the public key of the device to be configured to verify the signature data sent by the device to be configured (that is, verify the data signed by the device to be configured using ED25519WithSha256). After the verification is passed, confirm whether the device_id (device ID) of the public key authentication information is in the minor_device list (minor device list) of the configuration information. If it exists, the device to be configured is determined to be a legal device; at this time, the network configuration device can send its own signature data to the device to be configured for verification.

[0068] Step S30: According to the verification result of the network device to be configured, the received challenge value is signed using the private key of the current device, and the signature data is sent to the network device to be configured.

[0069] Specifically, in the present invention, after the network configuration device verifies that the public key authentication information and signature data sent by the device to be configured are legal information, the device to be configured is determined to be a legal device. At this time, the network configuration device uses the local private key to sign the received second challenge value, and sends the signature data to the device to be configured again, thereby entering the stage of authentication of the device to be configured.

[0070] Further, according to the verification result of the network device to be configured, the received challenge value is signed by using the private key of the current device, and the signature data is sent to the network device to be configured, which specifically includes:

[0071] When it is determined that the network device to be configured is a legitimate device, the received second challenge value is signed by ED25519WithSha256 using the private key of the current device to obtain the signature data of the current device;

[0072] The signature data of the current device is sent to the device to be configured, and the legal authentication result of the current device by the device to be configured is waited for.

[0073] Specifically, in the present invention, when the network configuration device determines that the device to be configured is a legal device, the network configuration device uses the local private key to sign the received second challenge value with ED25519WithSha256, and the network configuration device sends the signature data to the device to be configured; at this point, the device to be configured needs to reconfirm the signature data sent by the network configuration device to determine whether the network configuration device is a legal device.

[0074] Step S40: According to the verification result of the signature data sent by the current device to the network device to be configured, the two-way authentication between the network device to be configured and the current device and the network device to be configured are completed, and an authentication success message is output.

[0075] It should be noted that in the present application, after the network configuration device sends the signature data to the network configuration device to be configured, the network configuration device to be configured uses the acquired network configuration device public key to verify the signature data, that is, uses the public key authentication information in the network configuration authentication request data: device_id (i.e., network configuration device ID) + device_pubkey (i.e., network configuration device public key) + sign_data (i.e., the signature data of the network configuration device) to verify the signature data (i.e., the network configuration device performs ED25519WithSha256 signature data on the received second challenge value); if the verification is successful, the network configuration device is considered to be a legal device, and at this time, a message indicating that the seamless network configuration two-way authentication between the network configuration device and the network configuration device to be configured is successful is displayed and / or voice prompted.

[0076] In this application, the identity of the device can be confirmed based on the public and private key information of the device itself, and due to the participation of the cloud, the network configuration equipment can be trusted, and the network configuration process can be controlled, so that the network configuration process is truly trustworthy and controllable.

[0077] In the present application, authorization authentication is performed on the network device to be configured by obtaining network configuration information; a network configuration authentication request is initiated to the network device to be configured, and the network device to be configured is verified according to the challenge value and signature data generated by the network device to be configured; according to the verification result of the network device to be configured, the received challenge value is signed using the private key of the current device, and the signature data is sent to the network device to be configured; according to the verification result of the signature data sent by the current device by the network device to be configured, the two-way authentication between the network device to be configured and the network device to be configured is completed, and an authentication success message is output. The present invention improves the security of the two-way authentication of the non-sensing network configuration, can prevent the information of the screenless device from being forged, resulting in the leakage of network configuration data, and prevent the screenless device from being illegally attacked.

[0078] Furthermore, if Figure 2 As shown, based on the above-mentioned senseless distribution network bidirectional authentication method, the present invention also provides a senseless distribution network bidirectional authentication system, wherein the senseless distribution network bidirectional authentication system includes:

[0079] Configuration information acquisition module 21, used to obtain network configuration information and perform authorization authentication on network equipment to be configured;

[0080] The network device verification module 22 is used to initiate a network configuration authentication request to the network device to be configured, and verify the network device to be configured according to the challenge value and signature data generated by the network device to be configured;

[0081] The current device signature module 23 is used to sign the received challenge value using the private key of the current device according to the verification result of the network device to be configured, and send the signature data to the network device to be configured;

[0082] The two-way authentication success module 24 is used to complete the two-way authentication between the device to be configured and the current device according to the verification result of the signature data sent by the current device to the device to be configured, and output an authentication success message.

[0083] Furthermore, if Figure 3 As shown, based on the above-mentioned non-sensing network configuration bidirectional authentication method and system, the present invention also provides a terminal accordingly, and the terminal includes a processor 10, a memory 20 and a display 30. Figure 3 Only some components of the terminal are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0084] In some embodiments, the memory 20 may be an internal storage unit of the terminal, such as a hard disk or memory of the terminal. In other embodiments, the memory 20 may also be an external storage device of the terminal, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the terminal. Furthermore, the memory 20 may also include both an internal storage unit of the terminal and an external storage device. The memory 20 is used to store application software and various types of data installed on the terminal, such as the program code of the installation terminal. The memory 20 can also be used to temporarily store data that has been output or is to be output. In one embodiment, a senseless network configuration bidirectional authentication program 40 is stored on the memory 20, and the senseless network configuration bidirectional authentication program 40 can be executed by the processor 10, thereby realizing the senseless network configuration bidirectional authentication method in the present application.

[0085] In some embodiments, the processor 10 may be a central processing unit (CPU), a microprocessor or other data processing chip, used to run the program code or process data stored in the memory 20, such as executing the sensorless network configuration bidirectional authentication method.

[0086] In some embodiments, the display 30 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch device, etc. The display 30 is used to display information on the terminal and to display a visual user interface. The components 10-30 of the terminal communicate with each other via a system bus.

[0087] In one embodiment, when the processor 10 executes the senseless network pairing bidirectional authentication program 40 in the memory 20, the following steps are implemented:

[0088] Obtain network configuration information and perform authorization authentication on network devices to be configured;

[0089] Initiate a network configuration authentication request to the network device to be configured, and verify the network device to be configured according to the challenge value and signature data generated by the network device to be configured;

[0090] According to the verification result of the network device to be configured, the received challenge value is signed using the private key of the current device, and the signature data is sent to the network device to be configured;

[0091] According to the verification result of the signature data sent by the current device by the network device to be configured, the two-way authentication between the network device to be configured and the current device is completed, and an authentication success message is output.

[0092] Optionally, obtaining the network configuration information and performing authorization authentication on the network configuration device specifically includes:

[0093] Requesting the cloud to obtain the network configuration information;

[0094] Receive the network configuration information sent by the cloud, and obtain the network authentication data in the network configuration information;

[0095] According to the network configuration authentication data, authorization authentication is performed on the device to be configured;

[0096] Establish a communication connection with the network device to be configured according to the authorization authentication result.

[0097] Optionally, initiating a network configuration authentication request to the device to be configured, and verifying the device to be configured according to the challenge value and signature data generated by the device to be configured, specifically includes:

[0098] Initiate a network configuration authentication request to the device to be configured; wherein the network configuration authentication request includes network configuration authentication information, current device public key authentication information and a first challenge value;

[0099] Receive the second challenge value, public key authentication information and signature data generated by the to-be-configured network device, and verify the to-be-configured network device according to the second challenge value, public key authentication information and signature data generated by the to-be-configured network device.

[0100] Optionally, the network configuration authentication information includes: the current device ID, the cloud preset ID to be configured, and the signature data of the current device.

[0101] Optionally, the signature data generated by the to-be-configured network device is data signed by ED25519WithSha256 based on the first challenge value.

[0102] Optionally, verifying the to-be-configured network device according to the second challenge value, public key authentication information, and signature data generated by the to-be-configured network device specifically includes:

[0103] Verify the public key authentication information of the device to be configured, and verify the signature data of the device to be configured through the public key authentication information of the device to be configured;

[0104] Determine whether the device ID in the public key authentication information of the device to be networked is in the secondary device list of the network configuration information;

[0105] If so, it is determined that the network device to be configured is a legal device.

[0106] Optionally, according to the verification result of the network device to be configured, signing the received challenge value with the private key of the current device, and sending the signature data to the network device to be configured, specifically includes:

[0107] When it is determined that the network device to be configured is a legitimate device, the received second challenge value is signed by ED25519WithSha256 using the private key of the current device to obtain the signature data of the current device;

[0108] The signature data of the current device is sent to the device to be configured, and the legal authentication result of the current device by the device to be configured is waited for.

[0109] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a senseless network configuration bidirectional authentication program, and when the senseless network configuration bidirectional authentication program is executed by a processor, the steps of the senseless network configuration bidirectional authentication method as described above are implemented.

[0110] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, method, article or terminal including the element.

[0111] Of course, those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the program can be stored in a computer-readable storage medium that can be read by a computer, and the program can include the processes of the above-mentioned method embodiments when executed. The computer-readable storage medium can be a memory, a disk, an optical disk, etc.

[0112] It should be understood that the application of the present invention is not limited to the above examples. For ordinary technicians in this field, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A non-sensing network bidirectional authentication method, characterized in that: It is used to realize the senseless network configuration bidirectional authentication between the screenless device and other devices with screens / devices without screens. The senseless network configuration bidirectional authentication method includes: Obtain network configuration information and perform authorization authentication on network devices to be configured; Initiate a network configuration authentication request to the network device to be configured, and verify the network device to be configured according to the challenge value and signature data generated by the network device to be configured; the network configuration authentication request data contains the network configuration authentication information: network configuration device ID, cloud preset network configuration ID and signature data of the network configuration device; According to the verification result of the network device to be configured, the received challenge value is signed using the private key of the current device, and the signature data is sent to the network device to be configured; According to the verification result of the signature data sent by the current device by the network device to be configured, the two-way authentication between the network device to be configured and the current device is completed, and an authentication success message is output; The initiating a network configuration authentication request to the network device to be configured, and verifying the network device to be configured according to the challenge value and signature data generated by the network device to be configured, specifically includes: Initiate a network configuration authentication request to the network configuration device; wherein the network configuration authentication request includes network configuration authentication information, current device public key authentication information and a first challenge value; the public key authentication information includes: the network configuration device ID and the network configuration device public key; Receiving a second challenge value, public key authentication information, and signature data generated by the network device to be configured, and verifying the network device to be configured according to the second challenge value, public key authentication information, and signature data generated by the network device to be configured; The network configuration authentication information includes: the current device ID, the cloud preset ID to be configured, and the signature data of the current device; The signature data generated by the network device to be configured is the data signed by ED25519WithSha256 based on the first challenge value; The verifying the network device to be configured according to the second challenge value, public key authentication information and signature data generated by the network device to be configured specifically includes: Verify the public key authentication information of the device to be configured, and verify the signature data of the device to be configured through the public key authentication information of the device to be configured; Determine whether the device ID in the public key authentication information of the device to be networked is in the secondary device list of the network configuration information; If so, it is determined that the network device to be configured is a legal device.

2. The method for bidirectional authentication of a non-sensing network distribution network according to claim 1, characterized in that: The obtaining of network configuration information and authorization authentication of the network equipment to be configured specifically include: Requesting the cloud to obtain the network configuration information; Receive the network configuration information sent by the cloud, and obtain the network authentication data in the network configuration information; According to the network configuration authentication data, authorization authentication is performed on the device to be configured; Establish a communication connection with the network device to be configured according to the authorization authentication result.

3. The method for bidirectional authentication of a non-sensing network distribution network according to claim 1, characterized in that: The step of signing the received challenge value using the private key of the current device according to the verification result of the device to be configured, and sending the signature data to the device to be configured, specifically includes: When it is determined that the network device to be configured is a legitimate device, the received second challenge value is signed by ED25519WithSha256 using the private key of the current device to obtain the signature data of the current device; The signature data of the current device is sent to the device to be configured, and the legal authentication result of the current device by the device to be configured is waited for.

4. A senseless distribution network bidirectional authentication system, used to implement the senseless distribution network bidirectional authentication method as described in any one of claims 1 to 3, characterized in that: The non-sensing distribution network two-way authentication system comprises: Configuration information acquisition module, used to obtain network configuration information and perform authorization authentication on network configuration equipment; The network device verification module is used to initiate a network configuration authentication request to the network device to be configured, and verify the network device to be configured according to the challenge value and signature data generated by the network device to be configured; The current device signature module is used to sign the received challenge value using the private key of the current device according to the verification result of the network device to be configured, and send the signature data to the network device to be configured; The two-way authentication success module is used to complete the two-way authentication between the device to be configured and the current device according to the verification result of the signature data sent by the device to be configured, and output an authentication success message.

5. A terminal, characterized in that: The terminal includes: a memory, a processor, and a seamless network configuration bidirectional authentication program stored in the memory and executable on the processor. When the seamless network configuration bidirectional authentication program is executed by the processor, the steps of the seamless network configuration bidirectional authentication method as described in any one of claims 1 to 3 are implemented.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a senseless network configuration bidirectional authentication program, and when the senseless network configuration bidirectional authentication program is executed by a processor, the steps of the senseless network configuration bidirectional authentication method according to any one of claims 1 to 3 are implemented.

Images