Terminal identity recognition method, device and system

Abstract

The invention provides a terminal identity recognition method, device and system, and belongs to the technical field of communication. The method comprises the following steps: generating a first random number, and sending an identity recognition starting instruction to a terminal; randomly generating a first public key and a first private key, signing the first random number through the first private key, and encrypting overall data formed by a signature result of the first random number, the first public key and the first random number through a first preset key to obtain first ciphertext data; sending the first ciphertext data to the terminal, and receiving second ciphertext data sent by the terminal; decrypting the second ciphertext data through a second preset key to obtain second plaintext data; and performing signature verification on the signature result of the second random number through the second public key so as to realize identity recognition of the terminal. The method is used for overcoming the defects that a large amount of resources are consumed and data are captured by fake public and private keys after being captured by an attacker in the existing scheme.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a terminal identity recognition method, a terminal identity recognition device, a terminal identity recognition system, a machine-readable storage medium and a computer program product. Background Art

[0002] Power grid equipment is deployed in a scattered manner and of various types. The equipment assets have not yet fully implemented unified identity coding, and the interconnection and security management of terminal equipment at the IoT perception layer cannot be achieved. In other words, the existing service platform lacks identity management for terminals.

[0003] In existing solutions, asymmetric key encryption is usually used to protect data, that is, the sender uses the recipient's public key to encrypt, and then the recipient uses his own private key to decrypt the asymmetric key method for security protection. At the same time, the public key is also used to transmit in plain text on the network. The existing solution has the following disadvantages. First, when the concurrency is large, asymmetric key encryption and decryption operations will consume a lot of resources; second, the public key is transmitted in plain text on the network, and it can be captured by attackers and used to impersonate the identity and capture data using forged public and private keys. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a terminal identity identification method, a terminal identity identification device, a terminal identity identification system, a machine-readable storage medium and a computer program product, so as to solve the defects of the existing solutions that when the concurrency is large, asymmetric key encryption and decryption operations will consume a lot of resources; and the public key is transmitted in plain text in the network, and can be captured by attackers who use forged public and private keys to impersonate the identity and capture data.

[0005] In order to achieve the above object, an embodiment of the present invention provides a terminal identity recognition method, which is applied to a network device, and the method includes:

[0006] Generate a first random number, and send a start identity recognition instruction to the terminal;

[0007] Randomly generate a first public key and a first private key, sign the first random number by using the first private key, and encrypt the signature result of the first random number, the first public key and the whole data formed by the first random number by using a first preset key to obtain first ciphertext data;

[0008] Sending the first ciphertext data to the terminal, and receiving second ciphertext data sent by the terminal;

[0009] The second ciphertext data is decrypted by the second preset key to obtain second plaintext data; the second ciphertext data is formed by the terminal encrypting the second plaintext data by using the second preset key; the second plaintext data includes a second random number, a second public key and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number by using a second private key corresponding to the randomly generated second public key;

[0010] The signature result of the second random number is verified by using the second public key to achieve identity recognition of the terminal.

[0011] Optionally, after verifying the signature result of the second random number by using the second public key to identify the terminal, the method further includes:

[0012] The digest of the overall data formed by the first public key, the second public key, the first random number and the second random number is calculated by a first digest calculation method to obtain a first negotiated master key.

[0013] Optionally, after calculating the digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number by the first digest calculation method to obtain the first negotiated master key, the method further includes:

[0014] Encrypting the fingerprint information of the terminal by using a third preset key to obtain a fingerprint information ciphertext;

[0015] Send the fingerprint information ciphertext to the terminal.

[0016] Optionally, after sending the fingerprint information ciphertext to the terminal, the method further includes:

[0017] Calculate the summary of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number by a second summary calculation method to obtain a first dynamic dispersion factor;

[0018] Dispersing the first negotiated master key based on the first dynamic dispersion factor to obtain a first dynamic shared key; the first dynamic shared key includes a plurality of subkeys;

[0019] Encrypting the first random number by using a first subkey to obtain a random number ciphertext, wherein the first subkey is any subkey in the first dynamic shared key;

[0020] The random number ciphertext is sent to a terminal so that the terminal performs security verification on the random number ciphertext.

[0021] On the other hand, an embodiment of the present invention further provides a terminal identity recognition method, which is applied to a terminal, and the method includes:

[0022] Receiving a startup identity recognition instruction sent by a network device, and generating a second random number;

[0023] Randomly generate a second public key and a second private key, sign the second random number by using the second private key, and encrypt the whole data formed by the signature result of the second random number, the second public key and the second random number by using a second preset key to obtain second ciphertext data;

[0024] Sending the second ciphertext data to the network device, and receiving the first ciphertext data sent by the network device;

[0025] The first ciphertext data is decrypted by a first preset key to obtain first plaintext data; the first ciphertext data is formed by the network device encrypting the first plaintext data by using the first preset key; the first plaintext data includes a first random number, a first public key and a signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number by using a first private key corresponding to the randomly generated first public key;

[0026] The signature result of the first random number is verified by using the first public key to achieve identity identification of the network device.

[0027] Optionally, after verifying the signature result of the first random number by using the first public key to identify the network device, the method further includes:

[0028] The digest of the overall data formed by the first public key, the second public key, the first random number and the second random number is calculated by a third digest calculation method to obtain a second negotiated master key.

[0029] Optionally, after calculating the digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number by the third digest calculation method to obtain the second negotiated master key, the method further includes:

[0030] Receiving the fingerprint information ciphertext sent by the network device;

[0031] Decrypting the fingerprint information ciphertext by using a third preset key to obtain the fingerprint information of the terminal;

[0032] The fingerprint information is stored, and the fingerprint information is set to a non-readable state.

[0033] Optionally, after storing the fingerprint information and setting the fingerprint information to a non-readable state, the method further includes:

[0034] Calculate the summary of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number by a fourth summary calculation method to obtain a second dynamic dispersion factor;

[0035] Dispersing the second negotiated master key based on the second dynamic dispersion factor to obtain a second dynamic shared key; the second dynamic shared key includes a plurality of subkeys;

[0036] Receiving a random number ciphertext sent by the network device, and decrypting the random number ciphertext by using a second subkey to obtain a decryption result; wherein the random number ciphertext is obtained by the network device encrypting the first random number by using a first subkey, and the second subkey is a subkey in the second dynamic shared key that is the same as the first subkey;

[0037] When the decryption result is the first random number, the security verification between the network device and the terminal is passed.

[0038] On the other hand, an embodiment of the present invention further provides a terminal identity recognition device, the device comprising:

[0039] A first sending module, used for generating a first random number and sending a start identity recognition instruction to a terminal;

[0040] a first encryption module, configured to randomly generate a first public key and a first private key, sign the first random number by using the first private key, and encrypt the overall data formed by the signature result of the first random number, the first public key and the first random number by using a first preset key to obtain first ciphertext data;

[0041] An interaction module, configured to send the first ciphertext data to the terminal, and receive second ciphertext data sent by the terminal;

[0042] a decryption module, configured to decrypt the second ciphertext data by using a second preset key to obtain second plaintext data; the second ciphertext data is formed by the terminal encrypting the second plaintext data by using the second preset key; the second plaintext data includes a second random number, a second public key and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number by using a second private key corresponding to the randomly generated second public key;

[0043] A signature verification module is used to verify the signature result of the second random number through the second public key to achieve identity recognition of the terminal.

[0044] Optionally, the device further comprises:

[0045] The master key generation module is used to calculate the summary of the overall data formed by the first public key, the second public key, the first random number and the second random number through a first summary calculation method to obtain a first negotiated master key.

[0046] Optionally, the device further comprises:

[0047] A second encryption module, used to encrypt the fingerprint information of the terminal by using a third preset key to obtain a ciphertext of the fingerprint information;

[0048] The second sending module is used to send the fingerprint information ciphertext to the terminal.

[0049] Optionally, the device further comprises:

[0050] a dispersion factor generating module, configured to calculate a summary of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number by a second summary calculation method, and obtain a first dynamic dispersion factor;

[0051] a dispersion module, configured to disperse the first negotiated master key based on the first dynamic dispersion factor to obtain a first dynamic shared key; the first dynamic shared key includes a plurality of subkeys;

[0052] A third encryption module, configured to encrypt the first random number by using a first subkey to obtain a random number ciphertext, wherein the first subkey is any subkey in the first dynamic shared key;

[0053] The third sending module is used to send the random number ciphertext to the terminal, so that the terminal can perform security verification on the random number ciphertext.

[0054] On the other hand, an embodiment of the present invention further provides a terminal identity recognition device, the device comprising:

[0055] A first receiving module, used for receiving a startup identity recognition instruction sent by a network device, and generating a second random number;

[0056] an encryption module, configured to randomly generate a second public key and a second private key, sign the second random number by using the second private key, and encrypt the overall data formed by the signature result of the second random number, the second public key and the second random number by using a second preset key to obtain second ciphertext data;

[0057] An interaction module, used for sending the second ciphertext data to the network device, and receiving the first ciphertext data sent by the network device;

[0058] A first decryption module, configured to decrypt the first ciphertext data by using a first preset key to obtain first plaintext data; the first ciphertext data is formed by the network device encrypting the first plaintext data by using the first preset key; the first plaintext data includes a first random number, a first public key, and a signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number by using a first private key corresponding to a randomly generated first public key;

[0059] A signature verification module is used to verify the signature result of the first random number through the first public key to achieve identity recognition of the network device.

[0060] Optionally, the device further comprises:

[0061] The master key generation module is used to calculate the summary of the overall data formed by the first public key, the second public key, the first random number and the second random number through a third summary calculation method to obtain a second negotiated master key.

[0062] Optionally, the device further comprises:

[0063] A second receiving module, used to receive the fingerprint information ciphertext sent by the network device;

[0064] A second decryption module, used to decrypt the fingerprint information ciphertext by using a third preset key to obtain the fingerprint information of the terminal;

[0065] The storage module is used to store the fingerprint information and set the fingerprint information to an unreadable state.

[0066] Optionally, the device further comprises:

[0067] a dispersion factor generating module, configured to calculate a summary of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number by a fourth summary calculation method, to obtain a second dynamic dispersion factor;

[0068] a dispersing module, configured to disperse the second negotiated master key based on the second dynamic dispersing factor to obtain a second dynamic shared key; the second dynamic shared key includes a plurality of subkeys;

[0069] A third decryption module is used to receive the random number ciphertext sent by the network device, and decrypt the random number ciphertext by using the second subkey to obtain a decryption result; wherein the random number ciphertext is obtained by the network device encrypting the first random number by using the first subkey, and the second subkey is a subkey in the second dynamic shared key that is the same as the first subkey;

[0070] The verification module is used to verify that the security verification between the network device and the terminal is passed when the decryption result is the first random number.

[0071] On the other hand, an embodiment of the present invention further provides a terminal identity recognition system, comprising: a network device for executing the above terminal identity recognition method and a terminal for executing the above terminal identity recognition method.

[0072] On the other hand, the present invention further provides a computer program product, including a computer program, and when the computer program is executed by a processor, the terminal identity recognition method is implemented.

[0073] Through the above technical solution, the embodiment of the present invention performs decryption of the second ciphertext data by the second preset key at the network device end, and performs encryption of the second ciphertext data by the second preset key at the terminal, thereby reducing the resource consumption of encryption and decryption operations and increasing the security of identity identification by presetting symmetric keys in the network device and the terminal. In addition, each time the network device and the terminal identify the identity, they will each generate a pair of random public and private key pairs, and generate ciphertext data as authentication data for transmission through the random public and private key pairs, thereby avoiding the public key being transmitted in plain text in the network, and avoiding the attacker from accessing the system to capture data after impersonating the identity through forged public and private keys.

[0074] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0076] Figure 1 This is one of the flow charts of the terminal identity recognition method provided by the present invention;

[0077] Figure 2 This is the second flow chart of the terminal identity recognition method provided by the present invention;

[0078] Figure 3 This is the third flow chart of the terminal identity recognition method provided by the present invention;

[0079] Figure 4 This is the fourth flow chart of the terminal identity recognition method provided by the present invention;

[0080] Figure 5 is a schematic diagram of a key provided by the present invention;

[0081] Figure 6 This is one of the structural schematic diagrams of the terminal identity recognition device provided by the present invention;

[0082] Figure 7 This is the second structural diagram of the terminal identity recognition device provided by the present invention;

[0083] Figure 8 It is a structural schematic diagram of the terminal identity recognition system provided by the present invention. DETAILED DESCRIPTION

[0084] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0085] Method Embodiment

[0086] The embodiment of the present invention provides a terminal identity recognition method, which is applied to a network device. The network device may be a service platform, such as a server. In the embodiment of the present invention, the network device is described by taking a service platform as an example. The service platform is configured with a security encryption device, such as a cryptographic machine.

[0087] Please refer to Figure 1 The terminal identity recognition method of the embodiment of the present invention includes:

[0088] Step 101: Generate a first random number and send an identity recognition start instruction to a terminal.

[0089] When starting identity authentication, the service platform can use the random module in the Python programming language to generate a first random number. The service platform also needs to send a start identity recognition instruction to the terminal to inform the terminal to start identity authentication and generate a second random number.

[0090] Step 102: randomly generate a first public key and a first private key, sign the first random number with the first private key, and encrypt the overall data formed by the signature result of the first random number, the first public key and the first random number with a first preset key to obtain first ciphertext data.

[0091] The service platform can use a public key encryption algorithm to randomly generate a pair of public and private key pairs. For example, the service platform can use the RSA algorithm or the ECC algorithm (elliptic curve cryptography algorithm) to randomly generate a first public key and a first private key. The service platform signs the first random number with the first private key. Specifically, the service platform can use the first private key to encrypt the summary (or hash value) of the first random number to generate a digital signature. And the signature result of the first random number, the first public key and the overall data formed by the first random number are encrypted by the first preset key to obtain the first ciphertext data. The first preset key is a key preset in the service platform, which is used to encrypt the signature result of the first random number, the first public key and the overall data formed by the first random number to form the first ciphertext data as the authentication data for identity identification with the terminal.

[0092] Step 103: Send the first ciphertext data to the terminal, and receive second ciphertext data sent by the terminal.

[0093] The service platform sends the first ciphertext data to the terminal so that the terminal can decrypt the first ciphertext data and complete the terminal's identity recognition of the service platform. The service platform also needs to receive the second ciphertext data sent by the terminal to decrypt the second ciphertext data and complete the service platform's identity recognition of the terminal. Therefore, the authentication data for the identity authentication of both parties in communication are all ciphertext data, which avoids the public key in the authentication data from being transmitted in plain text in the network, and avoids the attacker from accessing the system and capturing data after impersonating the identity through forged public and private keys.

[0094] Step 104: Decrypt the second ciphertext data using a second preset key to obtain second plaintext data.

[0095] The service platform can decrypt the second ciphertext data by using the preset second preset key to obtain the second plaintext data. The second ciphertext data is formed by the terminal encrypting the second plaintext data using the second preset key. In the embodiment of the present invention, the second preset key is preset on the service platform and the terminal, and the second plaintext data is encrypted by the second preset key, and the second ciphertext data is decrypted by the second preset key. That is, by presetting symmetric keys on the service platform and the terminal for data encryption and decryption, the security of identity identification is increased. Compared with asymmetric keys for security protection, the embodiment of the present invention uses symmetric keys to encrypt and decrypt data, reducing the resource consumption of encryption and decryption operations.

[0096] In addition, the second plaintext data includes a second random number, a second public key, and a signature result of the second random number. The second random number is randomly generated by the terminal based on the startup identity recognition instruction. The signature result of the second random number is obtained by the terminal signing the second random number with the second private key corresponding to the randomly generated second public key. The terminal can use the second private key to encrypt the summary (or hash value) of the second random number to generate a digital signature.

[0097] Step 105: Verify the signature result of the second random number using the second public key to achieve identity recognition of the terminal.

[0098] The service platform uses the second public key randomly generated by the terminal to decrypt and verify the digital signature of the second random number to achieve the identity identification of the terminal. If an attacker captures data through a forged public-private key pair at this time, since the embodiment of the present invention generates a random number and a random public-private key pair on the service platform and the terminal for each identity authentication, it is impossible to verify the signature result of the second random number, and thus it is impossible to achieve the identity identification of the terminal. The embodiment of the present invention improves the security of the service platform and the terminal in identity identification.

[0099] In the embodiment of the present invention, the second ciphertext data is decrypted by the second preset key at the network device end, and the second ciphertext data is encrypted by the second preset key at the terminal, thereby reducing the resource consumption of encryption and decryption operations and increasing the security of identity identification by presetting symmetric keys in the network device and the terminal. In addition, each time the network device and the terminal identify an identity, they will each generate a pair of random public and private key pairs, and generate ciphertext data as authentication data for transmission through the random public and private key pairs, thereby avoiding the public key being transmitted in plain text in the network, and avoiding the attacker from accessing the system and capturing data after impersonating an identity through forged public and private keys.

[0100] For other aspects of the embodiments of the present invention, please refer to Figure 2 , after step 105, verifying the signature result of the second random number by using the second public key to realize the identity identification of the terminal, it also includes:

[0101] Step 106: Calculate the digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number using a first digest calculation method to obtain a first negotiated master key.

[0102] After the service platform and the terminal complete identity identification, the service platform can obtain the first negotiated master key through various summary calculation methods, such as using the sm3 summary algorithm to calculate the summary of the overall data formed by the first public key, the second public key, the first random number and the second random number.

[0103] In the embodiment of the present invention, a negotiated master key is generated each time after the service platform and the terminal complete identity identification. Since the negotiated master key is obtained based on the randomly generated first public key, the second public key, the first random number and the second random number, the negotiated master key generated after each successful identity identification is different, and the negotiated master key is not a fixed value, which greatly improves the security of the negotiated master key. Compared with the use of fixed keys in the existing scheme, each encryption and decryption operation uses the same key value, lacks key dynamics, and increases the risk of being stolen and tampered. In the embodiment of the present invention, the generation of a negotiated master key after identity identification is introduced, and the negotiated master key is dynamic, thereby improving the security of the negotiated master key.

[0104] For other aspects of the embodiments of the present invention, please refer to Figure 2 Step 106, after calculating the digest of the overall data formed by the first public key, the second public key, the first random number and the second random number by a first digest calculation method to obtain the first negotiated master key, the method further includes:

[0105] Step 107: Encrypt the fingerprint information of the terminal using a third preset key to obtain a fingerprint information ciphertext.

[0106] Step 108: Send the encrypted fingerprint information to the terminal.

[0107] In the embodiment of the present invention, the service platform uniformly manages the fingerprint information of the terminal, including functions such as storage, distribution, and identity uniqueness verification. That is, the fingerprint information of multiple terminals connected for communication is stored in the service platform. The fingerprint information of the terminal represents the device feature or unique terminal identification used to uniquely identify the terminal. For example, the fingerprint information of the terminal can be the terminal identity code.

[0108] In an embodiment of the present invention, the service platform encrypts the fingerprint information of the terminal by using a preset third preset key to obtain a fingerprint information ciphertext. The fingerprint information ciphertext is sent to the terminal so that the terminal decrypts the fingerprint information ciphertext by using the preset third preset key and stores the fingerprint information of the terminal. In an embodiment of the present invention, by encrypting the fingerprint information and sending the fingerprint information ciphertext to the terminal, it is convenient for the service platform and the terminal to subsequently generate a dynamic shared key based on the fingerprint information that reflects the uniqueness of the terminal identity, thereby further improving the security of identity recognition.

[0109] Furthermore, the embodiment of the present invention presets three pairs of symmetric keys (i.e., a first preset key, a second preset key, and a third preset key) in the cryptographic machine of the service platform and the terminal security chip to increase the security of identity recognition and dynamic shared key generation.

[0110] For other aspects of the embodiments of the present invention, please refer to Figure 2After step 108, sending the fingerprint information ciphertext to the terminal, the method further includes:

[0111] Step 109: Calculate the summary of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number by using a second summary calculation method to obtain a first dynamic dispersion factor.

[0112] Step 110: Disperse the first negotiated master key based on the first dynamic dispersion factor to obtain a first dynamic shared key.

[0113] The service platform can obtain the first dynamic dispersion factor through various summary calculation methods, such as the summary of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number through the sm3 summary algorithm. The service platform then disperses the first negotiated master key based on the first dynamic dispersion factor to obtain the first dynamic shared key. The first dynamic shared key includes multiple subkeys.

[0114] Step 111: Encrypt the first random number using a first subkey to obtain a random number ciphertext; wherein the first subkey is any subkey in the first dynamic shared key.

[0115] Step 112: Send the random number ciphertext to the terminal so that the terminal performs security verification on the random number ciphertext.

[0116] The service platform encrypts the first random number with the first subkey to obtain a random number ciphertext. The first subkey is any subkey in the first dynamic shared key. For example, the first subkey is the first subkey in the first dynamic shared key. The service platform sends the random number ciphertext to the terminal so that the terminal performs security verification on the random number ciphertext. Specifically, the terminal decrypts the random number ciphertext based on the subkey that is the same as the first subkey to obtain the first random number, thereby realizing security verification between the terminal and the service platform.

[0117] On the one hand, the service platform in the existing scheme lacks the identity code management of the terminal device, and also lacks the service platform's verification function of the uniqueness of the terminal device. In the embodiment of the present invention, the management of the device fingerprint (device identity code) of the service platform is introduced, including storage, distribution, uniqueness verification and other functions. In addition, the dynamic shared key generation process of the embodiment of the present invention uses the fingerprint information (terminal identity code) of the terminal device. Since the fingerprint information of each terminal is different, a dynamic dispersion factor is added, so that the dynamic shared key of each terminal is also different, that is, the relevance and uniqueness of the terminal fingerprint information and the dynamic shared key are increased, and the dynamic nature of the shared key is also increased. That is, the embodiment of the present invention increases the relevance, dynamicity and uniqueness of the security protection of the two communicating parties by involving the fingerprint information of the terminal in the generation of the dynamic shared key. In addition, since the dynamic shared master key is generated by the negotiated master key, a variety of classification rules can be formulated according to the type of business data between the service platform and the terminal and the fingerprint information, which increases the flexibility of the negotiated master key to derive the dynamic shared key.

[0118] On the other hand, the existing scheme uses a fixed key, and each encryption and decryption operation uses the same key value, which lacks key dynamics and increases the risk of being stolen and tampered. In the embodiment of the present invention, identity recognition is introduced to generate a negotiated master key, which is dynamic. At the same time, a rule is formulated to use the fingerprint information of the terminal to derive the negotiated master key and generate a dynamic shared key. Since the fingerprint information of each terminal is different, the generated dynamic shared key is also different, which also increases the dynamics.

[0119] Finally, in the existing scheme, the communicating parties encrypt the key value data and transmit it on the network, which is easy to be intercepted and poses a great risk. In the embodiment of the present invention, the communication between the service platform and the terminal derives a dynamic shared key by negotiating the master key, fingerprint information, and the first random number and the second random number of both parties. What is transmitted on the network is the encrypted fingerprint information, not the key value data itself. The benefit of generating a dynamic shared key in this way is to improve the security of the key data.

[0120] On the other hand, please refer to Figure 3 The embodiment of the present invention further provides a terminal identity recognition method, which is applied to a terminal, and the method includes:

[0121] Step 201: Receive a startup identity recognition instruction sent by a network device and generate a second random number.

[0122] In the embodiment of the present invention, the terminal is configured with a security encryption device, for example, the terminal is configured with a security chip. The terminal receives the start identity recognition instruction sent by the service platform, starts to perform identity authentication, and generates a second random number. The terminal can use the random module in the Python programming language to generate the second random number.

[0123] Step 202: randomly generate a second public key and a second private key, sign the second random number with the second private key, and encrypt the overall data formed by the signature result of the second random number, the second public key and the second random number with a second preset key to obtain second ciphertext data.

[0124] The terminal may use a public key encryption algorithm to randomly generate a pair of public and private key pairs. For example, the terminal may use an RSA algorithm or an ECC algorithm (elliptic curve cryptography algorithm) to randomly generate a second public key and a second private key. The terminal signs the second random number using the second private key. Specifically, the terminal may use the second private key to encrypt the summary (or hash value) of the second random number to generate a digital signature. And the second preset key is used to encrypt the signature result of the second random number, the second public key, and the overall data formed by the second random number to obtain the second ciphertext data. The second preset key is a key preset in the terminal, which is used to encrypt the signature result of the second random number, the second public key, and the overall data formed by the second random number to form the second ciphertext data as authentication data for identity identification with the service platform. It should be noted that the second preset key of the terminal is the same as the second preset key of the service platform, so that the embodiment of the present invention presets symmetric keys in the service platform and the terminal for data encryption and decryption, thereby increasing the security of identity identification.

[0125] Step 203: Send the second ciphertext data to the network device, and receive the first ciphertext data sent by the network device.

[0126] The terminal sends the second ciphertext data to the service platform so that the service platform decrypts the second ciphertext data and completes the service platform's identity recognition of the terminal. The terminal also needs to receive the first ciphertext data sent by the service platform so that the terminal decrypts the first ciphertext data and completes the terminal's identity recognition of the service platform. Therefore, the authentication data for the identity authentication of both parties in communication are all ciphertext data, which avoids the public key in the authentication data from being transmitted in plain text in the network, and avoids attackers from accessing the system and capturing data after impersonating the identity through forged public and private keys.

[0127] Step 204: Decrypt the first ciphertext data using a first preset key to obtain first plaintext data.

[0128] The terminal can decrypt the first ciphertext data by using the preset first preset key to obtain the first plaintext data. The first ciphertext data is formed by the service platform encrypting the first plaintext data using the first preset key. In the embodiment of the present invention, the first preset key is preset on the service platform and the terminal, and the first plaintext data is encrypted by the first preset key, and the first ciphertext data is decrypted by the first preset key. That is, by presetting symmetric keys on the service platform and the terminal for data encryption and decryption, the security of identity identification is increased. Compared with asymmetric keys for security protection, the embodiment of the present invention uses symmetric keys to encrypt and decrypt data, reducing the resource consumption of encryption and decryption operations.

[0129] The first ciphertext data is formed by the service platform encrypting the first plaintext data using the first preset key; the first plaintext data includes a first random number, a first public key, and a signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number using a first private key corresponding to a randomly generated first public key. The service platform can use the first private key to encrypt the summary (or hash value) of the first random number to generate a digital signature.

[0130] Step 205: Verify the signature result of the first random number using the first public key to achieve identity recognition of the network device.

[0131] The terminal decrypts and verifies the digital signature of the first random number through the first public key to realize the identity recognition of the service platform. If an attacker captures data through a forged public-private key pair at this time, since the embodiment of the present invention generates a random number and a random public-private key pair on the service platform and the terminal for each identity authentication, it is impossible to verify the signature result of the first random number, and thus it is impossible to realize the identity recognition of the service platform. The embodiment of the present invention improves the security of the identity recognition of the service platform and the terminal.

[0132] In the embodiment of the present invention, the first ciphertext data is decrypted by the first preset key at the terminal, and the first ciphertext data is encrypted by the first preset key at the network device, thereby reducing the resource consumption of encryption and decryption operations and increasing the security of identity identification by presetting symmetric keys in the network device and the terminal. In addition, each time the network device and the terminal identify an identity, they will each generate a pair of random public-private key pairs, and generate ciphertext data as authentication data for transmission through the random public-private key pairs, thereby avoiding the public key being transmitted in plain text in the network, and avoiding the attacker from accessing the system and capturing data after impersonating an identity through forged public-private keys.

[0133] For other aspects of the embodiments of the present invention, please refer to Figure 4, after step 205, verifying the signature result of the first random number by using the first public key to identify the network device, the method further includes:

[0134] Step 206: Calculate the digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number using a third digest calculation method to obtain a second negotiated master key.

[0135] After the service platform and the terminal complete identity recognition, the terminal can obtain the second negotiated master key by various digest calculation methods, such as calculating the digest of the first public key, the second public key, the first random number, and the second random number through the sm3 digest algorithm. It should be noted that the second negotiated master key generated by the terminal is the same as the first negotiated master key generated by the service platform.

[0136] In the embodiment of the present invention, a negotiated master key is generated each time after the service platform and the terminal complete identity identification. Since the negotiated master key is obtained based on the randomly generated first public key, the second public key, the first random number and the second random number, the negotiated master key generated after each successful identity identification is different, and the negotiated master key is not a fixed value, which greatly improves the security of the negotiated master key. Compared with the use of fixed keys in the existing scheme, each encryption and decryption operation uses the same key value, lacks key dynamics, and increases the risk of being stolen and tampered. In the embodiment of the present invention, the generation of a negotiated master key after identity identification is introduced, and the negotiated master key is dynamic, thereby improving the security of the negotiated master key.

[0137] For other aspects of the embodiments of the present invention, please refer to Figure 4 Step 206, after calculating the digest of the overall data formed by the first public key, the second public key, the first random number and the second random number by a third digest calculation method to obtain the second negotiated master key, the method further includes:

[0138] Step 207: Receive the fingerprint information ciphertext sent by the network device.

[0139] Step 208: decrypt the fingerprint information ciphertext using a third preset key to obtain the fingerprint information of the terminal.

[0140] Step 209: store the fingerprint information, and set the fingerprint information to an unreadable state.

[0141] The terminal receives the fingerprint information ciphertext. Then, the fingerprint information ciphertext is decrypted by a preset third preset key, the fingerprint information of the terminal is stored, and the fingerprint information is set to a non-readable state. Thus, the fingerprint information of the terminal is protected from being stolen. The embodiment of the present invention stores the fingerprint information and sets the fingerprint information to a non-readable state, so as to facilitate the subsequent generation of a dynamic shared key based on the fingerprint information that reflects the uniqueness of the terminal identity on the service platform and the terminal, thereby further improving the security of identity recognition.

[0142] Also, please refer to Figure 5 In the embodiment of the present invention, three pairs of symmetric keys (i.e., a first preset key, a second preset key, and a third preset key) are preset in the cryptographic machine of the service platform and the terminal security chip to increase the security of identity recognition and dynamic shared key generation.

[0143] For other aspects of the embodiments of the present invention, please refer to Figure 4 , after step 209, storing the fingerprint information and setting the fingerprint information to a non-readable state, the method further includes:

[0144] Step 210: Calculate the summary of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number by using a fourth summary calculation method to obtain a second dynamic dispersion factor.

[0145] Step 211: Disperse the second negotiated master key based on the second dynamic dispersion factor to obtain a second dynamic shared key; the second dynamic shared key includes multiple subkeys.

[0146] The terminal can obtain the second dynamic dispersion factor through various summary calculation methods, such as the summary of the overall data formed by the terminal's fingerprint information, the first random number, and the second random number through the sm3 summary algorithm. The terminal then disperses the second negotiated master key based on the second dynamic dispersion factor to obtain a second dynamic shared key. The second dynamic shared key includes multiple subkeys. It should be noted that the second dynamic dispersion factor of the terminal is the same as the first dynamic dispersion factor of the service platform. The second dynamic shared key of the terminal is the same as the first dynamic shared key of the service platform.

[0147] Step 212: Receive the random number ciphertext sent by the network device, and decrypt the random number ciphertext using the second subkey to obtain a decryption result.

[0148] Step 213: When the decryption result is the first random number, the security verification between the network device and the terminal is passed.

[0149] The terminal decrypts the random number ciphertext by using the second subkey to obtain a first random number. The random number ciphertext is obtained by the network device encrypting the first random number by using the first subkey, and the second subkey is a subkey in the second dynamic shared key that is the same as the first subkey. The terminal decrypts the random number ciphertext based on the subkey that is the same as the first subkey to obtain the first random number, thereby realizing security verification between the terminal and the service platform.

[0150] On the one hand, the service platform in the existing scheme lacks the identity code management of the terminal device, and also lacks the service platform's verification function of the uniqueness of the terminal device. In the embodiment of the present invention, the management of the device fingerprint (device identity code) of the service platform is introduced, including storage, distribution, uniqueness verification and other functions. In addition, the dynamic shared key generation process of the embodiment of the present invention uses the fingerprint information (terminal identity code) of the terminal device. Since the fingerprint information of each terminal is different, a dynamic dispersion factor is added, so that the dynamic shared key of each terminal is also different, that is, the relevance and uniqueness of the terminal fingerprint information and the dynamic shared key are increased, and the dynamic nature of the shared key is also increased. That is, the embodiment of the present invention increases the relevance, dynamicity and uniqueness of the security protection of the two communicating parties by involving the fingerprint information of the terminal in the generation of the dynamic shared key. In addition, since the dynamic shared master key is generated by the negotiated master key, a variety of classification rules can be formulated according to the type of business data between the service platform and the terminal and the fingerprint information, which increases the flexibility of the negotiated master key to derive the dynamic shared key.

[0151] On the other hand, the existing scheme uses a fixed key, and each encryption and decryption operation uses the same key value, which lacks key dynamics and increases the risk of being stolen and tampered. In the embodiment of the present invention, identity recognition is introduced to generate a negotiated master key, which is dynamic. At the same time, a rule is formulated to use the fingerprint information of the terminal to derive the negotiated master key and generate a dynamic shared key. Since the fingerprint information of each terminal is different, the generated dynamic shared key is also different, which also increases the dynamics.

[0152] Finally, in the existing scheme, the communicating parties encrypt the key value data and transmit it on the network, which is easy to be intercepted and poses a great risk. In the embodiment of the present invention, the communication between the service platform and the terminal derives a dynamic shared key by negotiating the master key, fingerprint information, and the first random number and the second random number of both parties. What is transmitted on the network is the encrypted fingerprint information, not the key value data itself. The benefit of generating a dynamic shared key in this way is to improve the security of the key data.

[0153] Device Embodiment

[0154] On the other hand, please refer to Figure 6 The embodiment of the present invention further provides a terminal identity recognition device, the device comprising:

[0155] The sending module 601 is used to generate a first random number and send an identity recognition start instruction to the terminal;

[0156] An encryption module 602 is used to randomly generate a first public key and a first private key, sign the first random number by using the first private key, and encrypt the entire data formed by the signature result of the first random number, the first public key and the first random number by using a first preset key to obtain first ciphertext data;

[0157] An interaction module 603 is used to send the first ciphertext data to the terminal and receive the second ciphertext data sent by the terminal;

[0158] The decryption module 604 is configured to decrypt the second ciphertext data by using a second preset key to obtain second plaintext data; the second ciphertext data is formed by the terminal encrypting the second plaintext data by using the second preset key; the second plaintext data includes a second random number, a second public key, and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number by using a second private key corresponding to the randomly generated second public key;

[0159] The signature verification module 605 is used to verify the signature result of the second random number through the second public key to realize the identity recognition of the terminal.

[0160] The terminal identity recognition device includes a processor and a memory. The sending module 601, encryption module 602, interaction module 603, decryption module 604, signature verification module 605, etc. are all stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions.

[0161] Optionally, the device further comprises:

[0162] The master key generation module is used to calculate the summary of the overall data formed by the first public key, the second public key, the first random number and the second random number through a first summary calculation method to obtain a first negotiated master key.

[0163] Optionally, the device further comprises:

[0164] A second encryption module, used to encrypt the fingerprint information of the terminal by using a third preset key to obtain a ciphertext of the fingerprint information;

[0165] The second sending module is used to send the fingerprint information ciphertext to the terminal.

[0166] Optionally, the device further comprises:

[0167] a dispersion factor generating module, configured to calculate a summary of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number by a second summary calculation method, and obtain a first dynamic dispersion factor;

[0168] a dispersion module, configured to disperse the first negotiated master key based on the first dynamic dispersion factor to obtain a first dynamic shared key; the first dynamic shared key includes a plurality of subkeys;

[0169] A third encryption module, configured to encrypt the first random number by using a first subkey to obtain a random number ciphertext, wherein the first subkey is any subkey in the first dynamic shared key;

[0170] The third sending module is used to send the random number ciphertext to the terminal, so that the terminal can perform security verification on the random number ciphertext.

[0171] The processor includes a kernel, which calls the corresponding program unit from the memory. There can be one or more kernels.

[0172] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0173] On the other hand, please refer to Figure 7 The embodiment of the present invention further provides a terminal identity recognition device, the device comprising:

[0174] The receiving module 701 is used to receive a startup identity recognition instruction sent by a network device and generate a second random number;

[0175] The encryption module 702 is used to randomly generate a second public key and a second private key, sign the second random number by using the second private key, and encrypt the whole data formed by the signature result of the second random number, the second public key and the second random number by using a second preset key to obtain second ciphertext data;

[0176] An interaction module 703 is used to send the second ciphertext data to the network device, and receive the first ciphertext data sent by the network device;

[0177] The decryption module 704 is configured to decrypt the first ciphertext data by using a first preset key to obtain first plaintext data; the first ciphertext data is formed by the network device encrypting the first plaintext data by using the first preset key; the first plaintext data includes a first random number, a first public key, and a signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number by using a first private key corresponding to a randomly generated first public key;

[0178] The signature verification module 705 is used to verify the signature result of the first random number through the first public key to realize the identity identification of the network device.

[0179] Optionally, the device further comprises:

[0180] The master key generation module is used to calculate the summary of the overall data formed by the first public key, the second public key, the first random number and the second random number through a third summary calculation method to obtain a second negotiated master key.

[0181] Optionally, the device further comprises:

[0182] A second receiving module, used to receive the fingerprint information ciphertext sent by the network device;

[0183] A second decryption module, used to decrypt the fingerprint information ciphertext by using a third preset key to obtain the fingerprint information of the terminal;

[0184] The storage module is used to store the fingerprint information and set the fingerprint information to an unreadable state.

[0185] Optionally, the device further comprises:

[0186] a dispersion factor generating module, configured to calculate a summary of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number by a fourth summary calculation method, to obtain a second dynamic dispersion factor;

[0187] a dispersing module, configured to disperse the second negotiated master key based on the second dynamic dispersing factor to obtain a second dynamic shared key; the second dynamic shared key includes a plurality of subkeys;

[0188] A third decryption module is used to receive the random number ciphertext sent by the network device, and decrypt the random number ciphertext by using the second subkey to obtain a decryption result; wherein the random number ciphertext is obtained by the network device encrypting the first random number by using the first subkey, and the second subkey is a subkey in the second dynamic shared key that is the same as the first subkey;

[0189] The verification module is used to verify that the security verification between the network device and the terminal is passed when the decryption result is the first random number.

[0190] The terminal identity recognition device includes a processor and a memory. The above-mentioned receiving module, encryption module, interaction module, decryption module and signature verification module are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0191] The processor includes a kernel, which calls the corresponding program unit from the memory. There can be one or more kernels.

[0192] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0193] On the other hand, please refer to Figure 8 An embodiment of the present invention further provides a terminal identity recognition system, comprising: a network device that executes the above-mentioned terminal identity recognition method and a terminal that executes the above-mentioned terminal identity recognition method.

[0194] A network device (i.e., a service platform) is used to generate a first random number and send a start identity recognition instruction to a terminal; randomly generate a first public key and a first private key, sign the first random number with the first private key, and encrypt the signature result of the first random number, the first public key, and the overall data formed by the first random number with a first preset key to obtain first ciphertext data; send the first ciphertext data to the terminal, and receive second ciphertext data sent by the terminal; decrypt the second ciphertext data with a second preset key to obtain second plaintext data; the second ciphertext data is formed by the terminal encrypting the second plaintext data with the second preset key; the second plaintext data includes a second random number, a second public key, and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number with a second private key corresponding to the randomly generated second public key; the signature result of the second random number is verified with the second public key to achieve identity recognition of the terminal;

[0195] A terminal is used to receive a startup identity identification instruction sent by a network device and generate a second random number; randomly generate a second public key and a second private key, sign the second random number with the second private key, and encrypt the signature result of the second random number, the second public key and the overall data formed by the second random number with a second preset key to obtain second ciphertext data; send the second ciphertext data to the network device, and receive the first ciphertext data sent by the network device; decrypt the first ciphertext data with a first preset key to obtain first plaintext data; the first ciphertext data is formed by the network device encrypting the first plaintext data with the first preset key; the first plaintext data includes a first random number, a first public key and a signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number with the first private key corresponding to the randomly generated first public key; the signature result of the first random number is verified with the first public key to achieve identity identification of the network device.

[0196] The service platform and a terminal of the embodiment of the present invention firstly generate a pair of public-private key pairs randomly through the ECC algorithm. The two parties exchange their respective public keys and complete the two-way identity recognition function in combination with the signature verification technology. At the same time, after the identity recognition is completed, the asymmetric key negotiation generates a negotiation master key, which is a symmetric key and is also dynamically generated asymmetrically. Then the service platform has the function of uniformly distributing and managing the fingerprint information of the terminal device (the identity code of the terminal) one by one. Each terminal device obtains its own fingerprint information through the service platform as one of the derived factors for generating a dynamic shared key, and the fingerprint information is stored on the terminal side and the status is set to non-readable. After both parties use the fingerprint information to participate and formulate certain rules, the scattered factors generated by the sm3 operation are used to derive the negotiation master key and generate a sub-key group, which is called a dynamic shared key. The terminal's business data can use the dynamic shared key to perform data encryption and decryption security protection.

[0197] The terminal identity recognition system of the embodiment of the present invention has four functions: 1. The communicating parties use the ECC algorithm to randomly generate a public-private key pair for two-way device authentication; 2. The communicating parties use the asymmetric key to negotiate and generate a negotiated master key through sm3 operation, and the negotiated master key is a symmetric key; 3. The service platform has the management of fingerprint information (terminal identity code), that is, it can distribute the fingerprint information of the terminal (the identity code mark of the terminal) one by one, verify the uniqueness of the terminal, store the device fingerprint, etc. At the same time, the terminal obtains the fingerprint information to participate in the generation of dynamic shared keys; 4. The communicating parties negotiate the master key to use fingerprint information and formulate rules as a dispersion factor to derive a sub-key group, which is called a dynamic shared key.

[0198] On the one hand, the service platform in the existing scheme lacks the identity code management of the terminal device, and also lacks the service platform's verification function of the uniqueness of the terminal device. In the embodiment of the present invention, the management of the device fingerprint (device identity code) of the service platform is introduced, including storage, distribution, uniqueness verification and other functions. In addition, the dynamic shared key generation process of the embodiment of the present invention uses the fingerprint information (terminal identity code) of the terminal device. Since the fingerprint information of each terminal is different, a dynamic dispersion factor is added, so that the dynamic shared key of each terminal is also different, that is, the relevance and uniqueness of the terminal fingerprint information and the dynamic shared key are increased, and the dynamic nature of the shared key is also increased. That is, the embodiment of the present invention increases the relevance, dynamicity and uniqueness of the security protection of the two communicating parties by involving the fingerprint information of the terminal in the generation of the dynamic shared key. In addition, since the dynamic shared master key is generated by the negotiated master key, a variety of classification rules can be formulated according to the type of business data between the service platform and the terminal and the fingerprint information, which increases the flexibility of the negotiated master key to derive the dynamic shared key.

[0199] On the other hand, the existing scheme uses a fixed key, and each encryption and decryption operation uses the same key value, which lacks key dynamics and increases the risk of being stolen and tampered. In the embodiment of the present invention, identity recognition is introduced to generate a negotiated master key, which is dynamic. At the same time, a rule is formulated to use the fingerprint information of the terminal to derive the negotiated master key and generate a dynamic shared key. Since the fingerprint information of each terminal is different, the generated dynamic shared key is also different, which also increases the dynamics.

[0200] Finally, in the existing scheme, the communicating parties encrypt the key value data and transmit it on the network, which is easy to be intercepted and poses a great risk. In the embodiment of the present invention, the communication between the service platform and the terminal derives a dynamic shared key by negotiating the master key, fingerprint information, and the first random number and the second random number of both parties. What is transmitted on the network is the encrypted fingerprint information, not the key value data itself. The benefit of generating a dynamic shared key in this way is to improve the security of the key data.

[0201] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a machine-readable storage medium. When the computer program is executed by a processor, the computer can execute a terminal identity identification method, which includes: generating a first random number, and sending an identity identification start instruction to the terminal; randomly generating a first public key and a first private key, signing the first random number with the first private key, and encrypting the signature result of the first random number, the first public key and the first random number with a first preset key to obtain first ciphertext data; sending the first ciphertext data to the terminal, and receiving second ciphertext data sent by the terminal; decrypting the second ciphertext data with a second preset key to obtain second plaintext data; the second ciphertext data is formed by the terminal encrypting the second plaintext data with the second preset key; the second plaintext data includes a second random number, a second public key and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number with a second private key corresponding to the randomly generated second public key; verifying the signature result of the second random number with the second public key to achieve identity identification of the terminal; or,

[0202] Receive a startup identity identification instruction sent by a network device and generate a second random number; randomly generate a second public key and a second private key, sign the second random number with the second private key, and encrypt the signature result of the second random number, the second public key and the overall data formed by the second random number with a second preset key to obtain second ciphertext data; send the second ciphertext data to the network device, and receive the first ciphertext data sent by the network device; decrypt the first ciphertext data with a first preset key to obtain first plaintext data; the first ciphertext data is formed by the network device encrypting the first plaintext data with the first preset key; the first plaintext data includes a first random number, a first public key and a signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number with the first private key corresponding to the randomly generated first public key; the signature result of the first random number is verified with the first public key to achieve identity identification of the network device.

[0203] On the other hand, the present invention also provides a machine-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it is implemented to execute a terminal identity identification method, the method comprising: generating a first random number, and sending an instruction to start identity identification to a terminal; randomly generating a first public key and a first private key, signing the first random number by using the first private key, and encrypting the signature result of the first random number, the first public key and the overall data formed by the first random number by using a first preset key to obtain first ciphertext data; sending the first ciphertext data to the terminal, and receiving second ciphertext data sent by the terminal; decrypting the second ciphertext data by using a second preset key to obtain second plaintext data; the second ciphertext data is formed by the terminal encrypting the second plaintext data using the second preset key; the second plaintext data includes a second random number, a second public key and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number by using the second private key corresponding to the randomly generated second public key; verifying the signature result of the second random number by using the second public key to implement identity identification of the terminal; or,

[0204] Receive a startup identity identification instruction sent by a network device and generate a second random number; randomly generate a second public key and a second private key, sign the second random number with the second private key, and encrypt the signature result of the second random number, the second public key and the overall data formed by the second random number with a second preset key to obtain second ciphertext data; send the second ciphertext data to the network device, and receive the first ciphertext data sent by the network device; decrypt the first ciphertext data with a first preset key to obtain first plaintext data; the first ciphertext data is formed by the network device encrypting the first plaintext data with the first preset key; the first plaintext data includes a first random number, a first public key and a signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number with the first private key corresponding to the randomly generated first public key; the signature result of the first random number is verified with the first public key to achieve identity identification of the network device.

[0205] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0206] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0207] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A terminal identity recognition method, characterized in that: Applied to a network device, the method comprises: Generate a first random number, and send a start identity recognition instruction to the terminal; Randomly generate a first public key and a first private key, sign the first random number by using the first private key, and encrypt the signature result of the first random number, the first public key and the whole data formed by the first random number by using a first preset key to obtain first ciphertext data; Sending the first ciphertext data to the terminal, and receiving second ciphertext data sent by the terminal; The second ciphertext data is decrypted by the second preset key to obtain second plaintext data; the second ciphertext data is formed by the terminal encrypting the second plaintext data by using the second preset key; the second plaintext data includes a second random number, a second public key and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number by using a second private key corresponding to the randomly generated second public key; The signature result of the second random number is verified by using the second public key to achieve identity recognition of the terminal.

2. The terminal identity recognition method according to claim 1, characterized in that: After verifying the signature result of the second random number by the second public key to identify the terminal, the method further includes: The digest of the overall data formed by the first public key, the second public key, the first random number and the second random number is calculated by a first digest calculation method to obtain a first negotiated master key.

3. The terminal identity recognition method according to claim 2, characterized in that: After calculating the digest of the overall data formed by the first public key, the second public key, the first random number and the second random number by the first digest calculation method to obtain the first negotiated master key, the method further includes: Encrypting the fingerprint information of the terminal by using a third preset key to obtain a fingerprint information ciphertext; Send the fingerprint information ciphertext to the terminal.

4. The terminal identity recognition method according to claim 3, characterized in that: After sending the fingerprint information ciphertext to the terminal, the method further includes: Calculate the summary of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number by a second summary calculation method to obtain a first dynamic dispersion factor; Dispersing the first negotiated master key based on the first dynamic dispersion factor to obtain a first dynamic shared key; the first dynamic shared key includes a plurality of subkeys; Encrypting the first random number by using a first subkey to obtain a random number ciphertext, wherein the first subkey is any subkey in the first dynamic shared key; The random number ciphertext is sent to a terminal so that the terminal performs security verification on the random number ciphertext.

5. A terminal identity recognition method, characterized in that: Applied to a terminal, the method comprises: Receiving a startup identity recognition instruction sent by a network device, and generating a second random number; Randomly generate a second public key and a second private key, sign the second random number by using the second private key, and encrypt the whole data formed by the signature result of the second random number, the second public key and the second random number by using a second preset key to obtain second ciphertext data; Sending the second ciphertext data to the network device, and receiving the first ciphertext data sent by the network device; The first ciphertext data is decrypted by a first preset key to obtain first plaintext data; the first ciphertext data is formed by the network device encrypting the first plaintext data by using the first preset key; the first plaintext data includes a first random number, a first public key and a signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number by using a first private key corresponding to the randomly generated first public key; The signature result of the first random number is verified by using the first public key to achieve identity identification of the network device.

6. The terminal identity recognition method according to claim 5, characterized in that: After verifying the signature result of the first random number by using the first public key to identify the network device, the method further includes: The digest of the overall data formed by the first public key, the second public key, the first random number and the second random number is calculated by a third digest calculation method to obtain a second negotiated master key.

7. The terminal identity recognition method according to claim 6, characterized in that: After calculating the digest of the overall data formed by the first public key, the second public key, the first random number and the second random number by the third digest calculation method to obtain the second negotiated master key, the method further includes: Receiving the fingerprint information ciphertext sent by the network device; Decrypting the fingerprint information ciphertext by using a third preset key to obtain the fingerprint information of the terminal; The fingerprint information is stored, and the fingerprint information is set to a non-readable state.

8. The terminal identity recognition method according to claim 7, characterized in that: After storing the fingerprint information and setting the fingerprint information to a non-readable state, the method further includes: Calculate the summary of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number by a fourth summary calculation method to obtain a second dynamic dispersion factor; Dispersing the second negotiated master key based on the second dynamic dispersion factor to obtain a second dynamic shared key; the second dynamic shared key includes a plurality of subkeys; Receiving a random number ciphertext sent by the network device, and decrypting the random number ciphertext by using a second subkey to obtain a decryption result; wherein the random number ciphertext is obtained by the network device encrypting the first random number by using a first subkey, and the second subkey is a subkey in the second dynamic shared key that is the same as the first subkey; When the decryption result is the first random number, the security verification between the network device and the terminal is passed.

9. A terminal identity recognition device, characterized in that: include: A first sending module, used for generating a first random number and sending a start identity recognition instruction to a terminal; a first encryption module, configured to randomly generate a first public key and a first private key, sign the first random number by using the first private key, and encrypt the overall data formed by the signature result of the first random number, the first public key and the first random number by using a first preset key to obtain first ciphertext data; An interaction module, configured to send the first ciphertext data to the terminal, and receive second ciphertext data sent by the terminal; A decryption module, used to decrypt the second ciphertext data using a second preset key to obtain second plaintext data; The second ciphertext data is formed by the terminal encrypting the second plaintext data using the second preset key; The second plaintext data includes a second random number, a second public key, and a signature result of the second random number; The signature result of the second random number is obtained by the terminal signing the second random number using a second private key corresponding to a randomly generated second public key; A signature verification module is used to verify the signature result of the second random number through the second public key to achieve identity recognition of the terminal.

10. The terminal identity recognition device according to claim 9, characterized in that: The device also includes: The master key generation module is used to calculate the summary of the overall data formed by the first public key, the second public key, the first random number and the second random number through a first summary calculation method to obtain a first negotiated master key.

11. The terminal identity recognition device according to claim 10, characterized in that: The device also includes: A second encryption module, used to encrypt the fingerprint information of the terminal by using a third preset key to obtain a ciphertext of the fingerprint information; The second sending module is used to send the fingerprint information ciphertext to the terminal.

12. The terminal identity recognition device according to claim 11, characterized in that: The device also includes: a dispersion factor generating module, configured to calculate a summary of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number by a second summary calculation method, and obtain a first dynamic dispersion factor; a dispersion module, configured to disperse the first negotiated master key based on the first dynamic dispersion factor to obtain a first dynamic shared key; the first dynamic shared key includes a plurality of subkeys; A third encryption module, configured to encrypt the first random number by using a first subkey to obtain a random number ciphertext, wherein the first subkey is any subkey in the first dynamic shared key; The third sending module is used to send the random number ciphertext to the terminal, so that the terminal can perform security verification on the random number ciphertext.

13. A terminal identity recognition device, characterized in that: include: A first receiving module, used to receive a startup identity recognition instruction sent by a network device and generate a second random number; an encryption module, configured to randomly generate a second public key and a second private key, sign the second random number by using the second private key, and encrypt the overall data formed by the signature result of the second random number, the second public key and the second random number by using a second preset key to obtain second ciphertext data; An interaction module, used for sending the second ciphertext data to the network device, and receiving the first ciphertext data sent by the network device; A first decryption module, used to decrypt the first ciphertext data using a first preset key to obtain first plaintext data; The first ciphertext data is formed by the network device encrypting the first plaintext data using the first preset key; The first plaintext data includes a first random number, a first public key, and a signature result of the first random number; The signature result of the first random number is obtained by the network device signing the first random number with a first private key corresponding to a randomly generated first public key; A signature verification module is used to verify the signature result of the first random number through the first public key to achieve identity recognition of the network device.

14. The terminal identity recognition device according to claim 13, characterized in that: The device also includes: The master key generation module is used to calculate the summary of the overall data formed by the first public key, the second public key, the first random number and the second random number through a third summary calculation method to obtain a second negotiated master key.

15. The terminal identity recognition device according to claim 14, characterized in that: The device also includes: A second receiving module, used to receive the fingerprint information ciphertext sent by the network device; A second decryption module, used to decrypt the fingerprint information ciphertext by using a third preset key to obtain the fingerprint information of the terminal; The storage module is used to store the fingerprint information and set the fingerprint information to an unreadable state.

16. The terminal identity recognition device according to claim 15, characterized in that: The device also includes: a dispersion factor generating module, configured to calculate a summary of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number by a fourth summary calculation method, to obtain a second dynamic dispersion factor; a dispersing module, configured to disperse the second negotiated master key based on the second dynamic dispersing factor to obtain a second dynamic shared key; the second dynamic shared key includes a plurality of subkeys; A third decryption module is used to receive the random number ciphertext sent by the network device, and decrypt the random number ciphertext by using the second subkey to obtain a decryption result; wherein the random number ciphertext is obtained by the network device encrypting the first random number by using the first subkey, and the second subkey is a subkey in the second dynamic shared key that is the same as the first subkey; The verification module is used to verify that the security verification between the network device and the terminal is passed when the decryption result is the first random number.

17. A terminal identity recognition system, characterized in that: include: A network device for executing the terminal identity recognition method according to any one of claims 1 to 4, and a terminal for executing the terminal identity recognition method according to any one of claims 5 to 8.

18. A machine-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the terminal identity recognition method described in any one of claims 1 to 4 is implemented, or the terminal identity recognition method described in any one of claims 5 to 8 is implemented.

19. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the terminal identity recognition method described in any one of claims 1 to 4 is implemented, or the terminal identity recognition method described in any one of claims 5 to 8 is implemented.

Images