Client verification method and device, electronic equipment and storage medium

Abstract

The invention provides a client verification method and device, electronic equipment and a storage medium, and the method comprises the steps: generating a server-side public key and a server-side private key, transmitting the server-side public key to a client, receiving encrypted verification information which is transmitted by the client and is used for verifying the client, and transmitting the encrypted verification information to the server-side private key; obtaining pre-stored original verification information corresponding to the client and a timestamp for receiving the encrypted verification information, taking the original verification information and the timestamp as target verification information, comparing the encrypted verification information with the target verification information, and verifying the client to obtain a verification result of the client, and sending a verification result to the client. Therefore, the client can be verified based on the encrypted verification information and the target verification information, integrity protection can be carried out on the client, the functions of tampering prevention, identity replacement prevention, double identity joining prevention and replay attack prevention are achieved, and the security of the client is ensured.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a client verification method, device, electronic device and storage medium. Background Art

[0002] In the related technology, the client is often verified only by relying on the local verification signature when installed on the client operating system, and comparing the hash value with the historical hash value, without performing network verification. When the client application is replaced, verification can even be skipped. At the same time, when the client application is running, only identity authentication is performed, resulting in lower client security. Therefore, how to verify the client more accurately and improve the security of the client has become a problem that needs to be solved urgently. Summary of the invention

[0003] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0004] To this end, the first aspect of the present application provides a client authentication method.

[0005] The second aspect of the present application also provides a client verification method.

[0006] The third aspect of the present application also provides a client verification device.

[0007] The fourth aspect of the present application also provides a client verification device.

[0008] A fifth aspect of the present application provides an electronic device.

[0009] A sixth aspect of the present application provides a computer-readable storage medium.

[0010] The first aspect of the present application provides a client verification method, the method comprising: generating a server public key and a server private key, sending the server public key to the client, wherein the server private key is used to sign the client; receiving encrypted verification information sent by the client for verifying the client, the encrypted verification information being obtained by encrypting and calculating the verification information to be verified and the timestamp corresponding to the client; obtaining pre-stored original verification information corresponding to the client and the timestamp of receiving the encrypted verification information, and using the original verification information and the timestamp as target verification information; comparing the encrypted verification information with the target verification information, verifying the client to obtain a verification result of the client, and sending the verification result to the client.

[0011] In addition, the client verification method provided in the first aspect of the present application may also have the following additional technical features:

[0012] According to one embodiment of the present application, the encrypted verification information is compared with the target verification information to verify the client to obtain a verification result of the client, and further includes: if the encrypted verification information and the target verification information are consistent, the client verification is successful, and a client startup instruction is sent to the client; or, if the encrypted verification information and the target verification information are inconsistent, the client verification fails, a client stop startup instruction is sent to the client, and a reminder message of an abnormal alarm for the client is generated.

[0013] According to an embodiment of the present application, the obtaining of the pre-stored original verification information corresponding to the client includes: obtaining the pre-stored version number, serial number, interference code and hash value corresponding to the client.

[0014] According to an embodiment of the present application, before verifying the client, it includes: in response to an update of the client version, updating the original verification information corresponding to the client and regenerating the server public key and the server private key through an asymmetric encryption algorithm.

[0015] The second aspect of the present application provides a client verification method, the method comprising: receiving a server public key sent by a server, wherein the server public key is used to verify the signature of the client; encrypting the verification information to be verified and the current timestamp corresponding to the client to obtain encrypted verification information, and sending the encrypted verification information to the server; receiving the verification result of the client sent by the server.

[0016] In addition, the client verification method provided in the first aspect of the present application may also have the following additional technical features:

[0017] According to one embodiment of the present application, the encryption calculation of the verification information to be verified includes: obtaining the verification policy of the client, wherein the verification policy is determined by the security verification level of the client; determining the verification information corresponding to the verification policy, and encrypting the verification information corresponding to the verification policy through the server public key and public key algorithm.

[0018] According to one embodiment of the present application, after receiving the verification result of the client sent by the server, it also includes: if the verification result indicates that the client verification is successful, receiving the client start instruction sent by the server, and the client interacts and communicates with the business server associated with the client; or, if the verification result indicates that the client verification fails, receiving the client stop start instruction sent by the server, and the client does not interact and communicate with the business server associated with the client.

[0019] The third aspect of the present application also provides a client verification device, including: a generation module, which is used to generate a server public key and a server private key, and send the server public key to the client, wherein the server private key is used to sign the client; a receiving module, which is used to receive encrypted verification information sent by the client to verify the client, and the encrypted verification information is obtained by encrypting and calculating the verification information to be verified and the timestamp corresponding to the client; an acquisition module, which is used to obtain the pre-stored original verification information corresponding to the client and the timestamp of receiving the encrypted verification information, and use the original verification information and the timestamp as target verification information; a verification module, which is used to compare the encrypted verification information with the target verification information, verify the client, so as to obtain the verification result of the client, and send the verification result to the client.

[0020] The client verification device provided in the third aspect of the present application may also have the following additional technical features:

[0021] According to one embodiment of the present application, the verification module is also used for: if the encrypted verification information is consistent with the target verification information, the client verification is successful, and a client startup instruction is sent to the client; or, if the encrypted verification information is inconsistent with the target verification information, the client verification fails, a client stop startup instruction is sent to the client, and a reminder message of an abnormal alarm for the client is generated.

[0022] According to an embodiment of the present application, the obtaining of the pre-stored original verification information corresponding to the client includes: obtaining the pre-stored version number, serial number, interference code and hash value corresponding to the client.

[0023] According to one embodiment of the present application, before verifying the client, the device is also used to: in response to an update of the client version, update the original verification information corresponding to the client and re-generate a server public key and a server private key through an asymmetric encryption algorithm.

[0024] The fourth aspect of the present application also provides a client verification device, including: a first receiving module, used to receive a server public key sent by the server, wherein the server public key is used to verify the signature of the client; a sending module, used to encrypt and calculate the verification information to be verified and the current timestamp corresponding to the client to obtain encrypted verification information, and send the encrypted verification information to the server; a second receiving module, used to receive the verification result of the client sent by the server.

[0025] The client verification device provided in the fourth aspect of the present application may also have the following additional technical features:

[0026] According to one embodiment of the present application, before encrypting and calculating the verification information to be verified, the device is also used to: perform a local verification signature on the client, determine that the local verification signature of the client passes, and calculate the verification information to be verified on the client.

[0027] According to one embodiment of the present application, the sending module is also used to: obtain the verification policy of the client, wherein the verification policy is determined by the security verification level of the client; determine the verification information corresponding to the verification policy, and encrypt and calculate the verification information corresponding to the verification policy through the server public key and public key algorithm.

[0028] According to one embodiment of the present application, the device is also used to: if the verification result indicates that the client verification is successful, receive the client start instruction sent by the server, and the client interacts with the business server associated with the client; or, if the verification result indicates that the client verification fails, receive the client stop start instruction sent by the server, and the client does not interact with the business server associated with the client.

[0029] The fifth aspect of the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the client verification method provided in the first aspect or the second aspect above.

[0030] A sixth aspect of the present application provides a computer-readable storage medium, wherein the computer instructions are used to enable the computer to execute the client verification method provided in the first aspect or the second aspect.

[0031] The client verification method and device provided by the present application generates a server public key and a server private key, sends the server public key to the client, wherein the server private key is used to sign the client; receives the encrypted verification information sent by the client to verify the client, obtains the pre-stored original verification information corresponding to the client and the timestamp of receiving the encrypted verification information, uses the original verification information and the timestamp as the target verification information, compares the encrypted verification information with the target verification information, verifies the client to obtain the verification result of the client, and sends the verification result to the client. Therefore, the present application adds the encrypted verification information of the client, and verifies the client based on the encrypted verification information and the target verification information, can protect the integrity of the client, and has the functions of anti-tampering, anti-identity substitution, anti-double identity joining and anti-replay attack, thereby ensuring the security of the client.

[0032] It should be understood that the contents described in this application are not intended to identify the key or important features of the embodiments of this application, nor are they intended to limit the scope of this application. Other features of this application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0034] Figure 1 A schematic diagram of a flow chart of a client verification method according to an embodiment of the present application;

[0035] Figure 2 A schematic diagram of a flow chart of a client verification method according to another embodiment of the present application;

[0036] Figure 3 A schematic diagram of a flow chart of a client verification method according to another embodiment of the present application;

[0037] Figure 4 This is a schematic diagram of the structure of a verification device of a client according to an embodiment of the present application;

[0038] Figure 5 This is a schematic diagram of the structure of a verification device of a client according to another embodiment of the present application;

[0039] Figure 6 It is a structural schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0040] Embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0041] Figure 1 A schematic diagram of a client verification method according to an embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes:

[0042] S101. Generate a server public key and a server private key, and send the server public key to the client, wherein the server private key is used to sign the client.

[0043] It should be noted that the present disclosure does not limit the specific method of generating the server public key and the server private key, which can be selected according to actual conditions.

[0044] Optionally, a server public key and a server private key may be generated by an asymmetric encryption algorithm.

[0045] For example, the server public key and the server private key can be generated by any asymmetric encryption algorithm such as RSA asymmetric encryption algorithm, Diffie-Hellman key exchange-based asymmetric encryption algorithm (Elgamal), and Elliptic Curve Cryptography (ECC).

[0046] In an embodiment of the present application, in response to an update of the client version, the server public key and the server private key are regenerated through an asymmetric encryption algorithm, that is, the client version is matched with the server public key and the server private key.

[0047] It should be noted that this application does not limit the carrier form of the server public key and the server private key, and can be set according to actual conditions.

[0048] Optionally, the carrier of the server public key and the server private key may be text or a certificate.

[0049] For example, when the carriers of the server public key and the server private key are certificates, they are server public key certificates and server private key certificates.

[0050] It should be noted that after generating the server public key and the server private key, the server public key can be sent to the client.

[0051] It should be noted that the specific method of using the server private key to sign the client is not limited in this application and can be selected according to actual conditions.

[0052] Optionally, the client can be signed using signature algorithms such as ED25519, RSA_SHA256, ECDSA_SHA256, RSA_SHA1, ECDSA_SHA1, RSA_MD5, ECDSA_MD5, etc.

[0053] S102, receiving encrypted verification information sent by the client to verify the client, and encrypting the verification information through

[0054] The verification information of the row verification and the current timestamp of the client are encrypted and calculated.

[0055] It should be noted that after receiving the encrypted verification information sent by the client for verifying the client, the encrypted verification information can be decrypted using the server's private key to obtain the original text of the verification information.

[0056] It should be noted that the encrypted verification information may be a version number, a serial number, a jamming code, a hash value corresponding to the client, and a timestamp corresponding to the client at present.

[0057] S103: Obtain the pre-stored original verification information corresponding to the client and the timestamp of receiving the encrypted verification information, and use the original verification information and the timestamp as target verification information.

[0058] In an embodiment of the present application, obtaining the pre-stored original verification information corresponding to the client includes: obtaining the pre-stored version number, serial number, interference code and hash value corresponding to the client.

[0059] Optionally, in response to the client version being updated, the original verification information corresponding to the client is updated.

[0060] S104: Compare the encrypted verification information with the target verification information, verify the client to obtain a verification result of the client, and send the verification result to the client.

[0061] Optionally, if the encrypted verification information is consistent with the target verification information, the client verification succeeds; if the encrypted verification information is inconsistent with the target verification information, the client verification fails.

[0062] Furthermore, after obtaining the verification result of the client, the verification result may be sent to the client.

[0063] The client verification method provided by the present application generates a server public key and a server private key, sends the server public key to the client, wherein the server private key is used to sign the client; receives encrypted verification information sent by the client to verify the client; verifies the client based on the encrypted verification information and the target verification information corresponding to the client obtained by the server, so as to obtain the verification result of the client, and sends the verification result to the client. Therefore, the present application adds the encrypted verification information of the client as a whole, and verifies the client based on the encrypted verification information and the target verification information, which can protect the integrity of the client, and has the functions of anti-tampering, anti-identity substitution, anti-double identity joining and anti-replay attack, thus ensuring the security of the client.

[0064] The following explains the specific process of verifying the client based on the encrypted verification information and the target verification information corresponding to the client obtained by the server to obtain the verification result of the client.

[0065] In an embodiment of the present application, the encrypted verification information can be compared with the target verification information to verify the client to obtain the verification result of the client, and the verification result can be sent to the client.

[0066] It should be noted that after receiving the encrypted verification information sent by the client for verifying the client, the encrypted verification information can be decrypted using the server's private key to obtain the original text of the verification information.

[0067] Optionally, if the original verification information corresponding to the encrypted verification information is consistent with the target verification information, the client verification succeeds; if the encrypted verification information is inconsistent with the target verification information, the client verification fails.

[0068] It should be noted that when any one of the encrypted verification information and the target verification information is inconsistent, the client fails the verification; when the encrypted verification information and the target verification information are completely consistent, the client succeeds the verification.

[0069] It should be noted that the present application does not limit the order of comparing the encrypted verification information and the target verification information, and the order can be selected according to the actual situation.

[0070] For example, first, for the version number, compare the version number in the encrypted verification information with the version number in the target verification information. If the version numbers are inconsistent, the client verification fails; second, for the hash value, compare the hash value in the encrypted verification information with the hash value in the target verification information. If the version numbers are inconsistent, the client verification fails; third, for the serial number, compare the serial number in the encrypted verification information with the serial number in the target verification information. If the serial numbers are inconsistent, the client verification fails (indicating that duplicate clients have joined); fourth, for the timestamp, compare the timestamp in the encrypted verification information with the timestamp of receiving the encrypted verification information in the target verification information. If the timestamps are inconsistent or the difference is large, the client verification fails (indicating the risk of replay attack). When the above encrypted verification information and the target verification information are completely consistent, the client verification is successful.

[0071] Furthermore, after obtaining the verification result of the client, an instruction may be sent to the client according to the verification result.

[0072] Optionally, if the client verification succeeds, a client startup instruction is sent to the client; if the client verification fails, a client stop startup instruction is sent to the client, and a reminder message of an abnormal alarm of the client is generated.

[0073] The client verification method provided by the present application compares the encrypted verification information with the target verification information. If the encrypted verification information and the target verification information are consistent, the client verification succeeds. If the encrypted verification information and the target verification information are inconsistent, the client verification fails. Therefore, the present application can verify the client based on the encrypted verification information and the target verification information, protect the integrity of the client, and has the functions of anti-tampering, anti-identity substitution, anti-double identity joining, and anti-replay attack, thereby ensuring the security of the client.

[0074] Figure 2 A schematic diagram of a client verification method according to an embodiment of the present application is shown in FIG. Figure 2 As shown, the method includes:

[0075] S201. Receive a server public key sent by a server, where the server public key is used to verify the signature of the client.

[0076] The signature algorithm used by the server's private key to sign the client should be consistent with the algorithm used by the server's public key to verify the signature on the client.

[0077] Optionally, after determining the signature algorithm used by the server private key to sign the client, the signature algorithm can be determined and verified based on the signature algorithm used by the server private key to sign the client.

[0078] For example, after determining the signature algorithm used by the server private key to sign the client, you can use ED25519, RSA_SHA256, ECDSA_SHA256, RSA_SHA1, ECDSA_SHA1, RSA_MD5, ECDSA_MD5 and other verification signature algorithms that are consistent with the signature algorithm to verify the signature of the client.

[0079] S202: encrypt and calculate the verification information to be verified and the timestamp currently corresponding to the client to obtain encrypted verification information, and send the encrypted verification information to the server.

[0080] Optionally, the verification information may be a version number, a serial number, an interference code, and a hash value corresponding to the client.

[0081] In an embodiment of the present application, the verification policy of the client can be obtained, and the verification information corresponding to the verification policy can be determined, and the verification information corresponding to the verification policy can be encrypted and calculated using the server public key and public key algorithm.

[0082] Optionally, a verification policy corresponding to the client may be obtained according to the security verification level of the client.

[0083] S203: Receive the verification result of the client sent by the server.

[0084] In an embodiment of the present application, after obtaining the verification result of the client, the server can send the verification result to the client, and correspondingly, the client can receive the verification result of the client sent by the server.

[0085] Optionally, if the verification result indicates that the client verification is successful, the client starts the command sent by the receiving server, and the client interacts with the business server associated with the client; if the verification result indicates that the client verification fails, the client stops the command sent by the receiving server, and the client does not interact with the business server associated with the client.

[0086] The client verification method provided by the present application receives the server public key sent by the server, wherein the server public key is used to verify the signature of the client, encrypts and calculates the verification information of the client to obtain the encrypted verification information, sends the encrypted verification information to the server, and receives the verification result of the client sent by the server. The present application encrypts and calculates the verification information and the timestamp corresponding to the client to obtain the encrypted verification information, and sends the encrypted verification information to the server, so as to protect the integrity of the client, and has the functions of anti-tampering, anti-identity substitution, anti-double identity joining and anti-replay attack, thereby ensuring the security of the client. At the same time, the verification process of the client has good compatibility and can be applied to vehicle-mounted and other embedded systems.

[0087] It should be noted that before calculating the verification information for verifying the client, it is necessary to perform a local verification signature on the client, confirm that the local verification signature of the client passes, and then calculate the verification information for verifying the client.

[0088] As a possible implementation, Figure 3 As shown, based on the above embodiment, the specific process of encrypting and calculating the verification information to be verified includes the following steps:

[0089] S301. Obtain a verification policy of a client, wherein the verification policy is determined by a security verification level of the client.

[0090] Optionally, before authenticating the client, an authentication policy for the client may be pre-set.

[0091] For example, the authentication policy of the client may be preset according to the security authentication level of the client.

[0092] S302: According to the verification policy, encrypt and calculate the verification information for verifying the client.

[0093] Optionally, when the security verification level of the client is level one, in this case, the verification strategy is to verify whether the client is damaged. The hash value of the client can be calculated, and the version number, serial number, timestamp and hash value can be used as verification information for verifying the client.

[0094] For example, the hash value of the client may be calculated using a preset hash method (MD5, SHA1, SHA256, etc.).

[0095] Optionally, when the security verification level of the client is level 2, in this case, the verification strategy is to verify whether the client is replaced. The interference code of the client can be calculated, and the version number, serial number, interference code, and timestamp are used as verification information for verifying the client.

[0096] The interference code is a random number of any bit length, and the random number can be generated by a variety of methods such as a random function, a pseudo-random number generation algorithm (linear congruential method, Mersenne twister algorithm, etc.), and a true random number generator.

[0097] Optionally, when the security verification level of the client is level three, in this case, the verification strategy is to verify whether any form of tampering has occurred to the client. The client's interference code and hash value can be calculated, and the version number, serial number, hash value, interference code, and timestamp can be used as verification information for verifying the client.

[0098] The client verification method provided in the present application can obtain the verification strategy of the client and, according to the verification strategy, encrypt and calculate the verification information for verifying the client. The present application can calculate the encrypted verification information through different verification strategies, laying the foundation for the subsequent verification of the client. The client can be protected for integrity and has anti-tampering, anti-identity substitution, anti-dual identity joining and anti-replay attack functions, thereby ensuring the security of the client.

[0099] Corresponding to the client verification methods provided in the above-mentioned embodiments, an embodiment of the present application also provides a client verification device. Since the client verification device provided in the embodiment of the present application corresponds to the client verification methods provided in the above-mentioned embodiments, the implementation methods of the above-mentioned client verification methods are also applicable to the client verification device provided in the embodiment of the present application, and will not be described in detail in the following embodiments.

[0100] Figure 4 This is a schematic diagram of the structure of a verification device of a client according to an embodiment of the present application. Figure 4 As shown, the verification device 100 of the client includes a generation module 11, a receiving module 12, an acquisition module 13 and a verification module 14. Among them:

[0101] A generating module 11 is used to generate a server public key and a server private key, and send the server public key to the client, wherein the server private key is used to sign the client;

[0102] The receiving module 12 is used to receive the encrypted verification information sent by the client for verifying the client, wherein the encrypted verification information is obtained by encrypting and calculating the verification information to be verified and the timestamp currently corresponding to the client;

[0103] The acquisition module 13 is used to acquire the pre-stored original verification information corresponding to the client and the timestamp of receiving the encrypted verification information, and use the original verification information and the timestamp as the target verification information;

[0104] The verification module 14 is used to compare the encrypted verification information with the target verification information, verify the client to obtain a verification result of the client, and send the verification result to the client.

[0105] According to one embodiment of the present application, the verification module 14 is also used for: if the encrypted verification information is consistent with the target verification information, the client verification is successful, and a client startup instruction is sent to the client; or, if the encrypted verification information is inconsistent with the target verification information, the client verification fails, a client stop startup instruction is sent to the client, and a reminder message of an abnormal alarm for the client is generated.

[0106] According to an embodiment of the present application, the obtaining of the pre-stored original verification information corresponding to the client includes: obtaining the pre-stored version number, serial number, interference code and hash value corresponding to the client.

[0107] According to one embodiment of the present application, before verifying the client, the device 100 is also used to: in response to an update of the version of the client, update the original verification information corresponding to the client and re-generate a server public key and a server private key through an asymmetric encryption algorithm.

[0108] The client verification device provided by the present application generates a server public key and a server private key, and sends the server public key to the client, wherein the server private key is used to sign the client, and receives the encrypted verification information sent by the client to verify the client; based on the encrypted verification information and the target verification information corresponding to the client obtained by the server, the client is verified to obtain the verification result of the client, and the verification result is sent to the client. Therefore, the present application adds the overall hash value and interference code of the client, adds a timestamp, and verifies the client based on the encrypted verification information and the target verification information, which can protect the integrity of the client, and has the functions of anti-tampering, anti-identity substitution, anti-double identity joining, and anti-replay attack, ensuring the security of the client.

[0109] Figure 5 This is a schematic diagram of the structure of a verification device of a client according to an embodiment of the present application. Figure 5 As shown, the client verification device 200 includes a first receiving module 21, a sending module 22, and a second receiving module 23. Among them:

[0110] A first receiving module 21 is used to receive a server public key sent by a server, wherein the server public key is used to verify the signature of the client;

[0111] The sending module 22 is used to perform encryption calculation on the verification information to be verified and the timestamp currently corresponding to the client to obtain encrypted verification information, and send the encrypted verification information to the server;

[0112] The second receiving module 23 is used to receive the verification result of the client sent by the server.

[0113] According to one embodiment of the present application, before encrypting and calculating the verification information to be verified, the device 200 is also used to: perform a local verification signature on the client, determine that the local verification signature of the client passes, and calculate the verification information to be verified on the client.

[0114] According to one embodiment of the present application, the sending module 22 is also used to: obtain the verification policy of the client, wherein the verification policy is determined by the security verification level of the client; determine the verification information corresponding to the verification policy, and encrypt and calculate the verification information corresponding to the verification policy through the server public key and public key algorithm.

[0115] According to one embodiment of the present application, the device 200 is also used for: if the verification result indicates that the client verification is successful, receiving the client start instruction sent by the server, and the client interacts with the business server associated with the client; or, if the verification result indicates that the client verification fails, receiving the client stop start instruction sent by the server, and the client does not interact with the business server associated with the client.

[0116] The client verification device provided by the present application receives the server public key sent by the server, wherein the server public key is used to verify the signature of the client, encrypts and calculates the verification information of the client to obtain the encrypted verification information, sends the encrypted verification information to the server, and receives the verification result of the client sent by the server. The present application encrypts and calculates the verification information and the timestamp corresponding to the client to obtain the encrypted verification information, and sends the encrypted verification information to the server, so as to protect the integrity of the client, and has the functions of anti-tampering, anti-identity substitution, anti-double identity joining and anti-replay attack, thereby ensuring the security of the client. At the same time, the verification process of the client has good compatibility and can be applied to vehicle-mounted and other embedded systems.

[0117] To achieve the above embodiments, the present application also provides an electronic device and a computer-readable storage medium.

[0118] Figure 6A schematic block diagram of an example electronic device 1200 that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0119] like Figure 6 As shown, the device 1200 includes a memory 121, a processor 122, and a computer program stored in the memory 121 and executable on the processor 122. When the processor 122 executes the program instructions, the client verification method provided in the above embodiment is implemented.

[0120] By generating a server public key and a server private key, sending the server public key to the client, wherein the server private key is used to sign the client; receiving the encrypted verification information sent by the client to verify the client; verifying the client based on the encrypted verification information and the target verification information corresponding to the client obtained by the server, to obtain the verification result of the client, and sending the verification result to the client. Therefore, this application adds the overall hash value and interference code of the client, adds a timestamp, and verifies the client based on the encrypted verification information and the target verification information, which can protect the integrity of the client, and has the functions of anti-tampering, anti-identity substitution, anti-double identity joining, and anti-replay attack, ensuring the security of the client.

[0121] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by the processor 122, the client verification method provided by the above embodiment is implemented.

[0122] By generating a server public key and a server private key, the server public key is sent to the client, wherein the server private key is used to sign the client, and receive the encrypted verification information sent by the client to verify the client; based on the encrypted verification information and the target verification information corresponding to the client obtained by the server, the client is verified to obtain the verification result of the client, and the verification result is sent to the client. Therefore, this application adds the overall hash value and interference code of the client, adds a timestamp, and verifies the client based on the encrypted verification information and the target verification information, which can protect the integrity of the client, and has the functions of anti-tampering, anti-identity substitution, anti-double identity joining, and anti-replay attack, ensuring the security of the client.

[0123] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] The program code for implementing the method itself can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0125] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0126] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0127] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a grid browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication grid). Examples of communication grids include: a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain grid.

[0128] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication grid. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server for a distributed system, or a server combined with a blockchain.

[0129] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0130] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0131] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0132] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0133] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0134] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0135] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0136] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

[0137] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution disclosed in this application can be achieved, and this document is not limited here.

[0138] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A client verification method, characterized in that: The method comprises: Generate a server public key and a server private key, and send the server public key to the client, wherein the server private key is used to sign the client; Receiving encrypted verification information sent by the client for verifying the client, the encrypted verification information being obtained by encrypting and calculating the verification information to be verified and a timestamp currently corresponding to the client; Obtaining pre-stored original verification information corresponding to the client and a timestamp of receiving the encrypted verification information, and using the original verification information and the timestamp as target verification information; The encrypted verification information is compared with the target verification information, the client is verified to obtain a verification result of the client, and the verification result is sent to the client.

2. The method according to claim 1, characterized in that The step of comparing the encrypted verification information with the target verification information and verifying the client to obtain a verification result of the client further includes: If the encrypted verification information is consistent with the target verification information, the client verification is successful, and a client startup instruction is sent to the client; or, If the encrypted verification information is inconsistent with the target verification information, the client verification fails, a client stop start instruction is sent to the client, and reminder information of an abnormal alarm of the client is generated.

3. The method according to claim 1, characterized in that The obtaining of the pre-stored original verification information corresponding to the client includes: obtaining the pre-stored version number, serial number, interference code and hash value corresponding to the client.

4. The method according to any one of claims 1 to 3, characterized in that: Before verifying the client, the method includes: In response to the client version being updated, the original verification information corresponding to the client is updated and a server public key and a server private key are regenerated through an asymmetric encryption algorithm.

5. A client verification method, characterized in that: The method comprises: Receive a server public key sent by the server, wherein the server public key is used to verify the signature of the client; Performing encryption calculation on the verification information to be verified and the timestamp currently corresponding to the client to obtain encrypted verification information, and sending the encrypted verification information to the server; Receive the verification result of the client sent by the server.

6. The method according to claim 5, characterized in that Before the encryption calculation of the verification information to be verified is performed, the method further includes: Perform a local verification signature on the verification information, determine that the local verification signature passes, and calculate the verification information to be verified.

7. The method according to claim 6, characterized in that The encrypting and calculating the verification information to be verified includes: Acquire the authentication policy of the client, wherein the authentication policy is determined by the security authentication level of the client; Determine the verification information corresponding to the verification policy, and encrypt and calculate the verification information corresponding to the verification policy using the server public key and public key algorithm.

8. The method according to claim 5, characterized in that After receiving the verification result of the client sent by the server, the method further includes: If the verification result indicates that the client verification is successful, a client startup instruction sent by the server is received, and the client interacts and communicates with a service server associated with the client; or If the verification result indicates that the client verification fails, a client stop start instruction sent by the receiving server is received, and the client and the service server associated with the client do not perform interactive communication.

9. A client verification device, characterized in that: The device comprises: A generation module, used to generate a server public key and a server private key, and send the server public key to the client, wherein the server private key is used to sign the client; A receiving module, used for receiving encrypted verification information sent by the client for verifying the client, wherein the encrypted verification information is obtained by encrypting and calculating the verification information to be verified and a timestamp currently corresponding to the client; An acquisition module, used to acquire the pre-stored original verification information corresponding to the client and the timestamp of receiving the encrypted verification information, and use the original verification information and the timestamp as target verification information; The verification module is used to compare the encrypted verification information with the target verification information, verify the client to obtain a verification result of the client, and send the verification result to the client.

10. A client verification device, characterized in that: The device comprises: A first receiving module is used to receive a server public key sent by a server, wherein the server public key is used to verify the signature of the client; A sending module, used for performing encryption calculation on the verification information to be verified and the timestamp currently corresponding to the client to obtain encrypted verification information, and sending the encrypted verification information to the server; The second receiving module is used to receive the verification result of the client sent by the server.

11. An electronic device, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-4 or claims 5-8.

12. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-4 or claims 5-8.

Images