Terminal identity identification method, device and system

Abstract

The present invention provides a terminal identity identification method, device and system, which belongs to the field of communication technology. The method includes: generating a first random number, and sending a start identity identification instruction to the terminal; randomly generating a first public key and a first private key, signing the first random number with the first private key, and encrypting the signature result of the first random number, the first public key and the overall data formed by the first random number with a first preset key to obtain first ciphertext data; sending the first ciphertext data to the terminal, and receiving second ciphertext data sent by the terminal; decrypting the second ciphertext data with a second preset key to obtain second plaintext data; verifying the signature result of the second random number with the second public key to achieve terminal identity identification. The present invention is used to solve the defects of existing solutions that consume a lot of resources and can be captured by attackers who use forged public and private keys to impersonate the identity and capture data.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a terminal identity recognition method, a terminal identity recognition device, a terminal identity recognition system, a machine-readable storage medium, and a computer program product. Background Art

[0002] Grid equipment is deployed in a dispersed and diverse manner. Device assets have not yet fully implemented unified identity coding, making it impossible to achieve secure interconnection and management of terminal devices at the IoT perception layer. In other words, existing service platforms lack identity management for terminals.

[0003] Existing solutions typically use asymmetric key encryption to protect data. This involves the sender using the recipient's public key to encrypt data, which the recipient then decrypts using their private key. Public keys are also transmitted in plaintext over the network. Existing solutions have the following drawbacks. First, when there is a high level of concurrency, asymmetric key encryption and decryption consumes significant resources. Second, public keys transmitted in plaintext over the network can be captured by attackers, who can then use forged public and private keys to impersonate and capture data. Summary of the Invention

[0004] The purpose of the embodiments of the present invention is to provide a terminal identity identification method, a terminal identity identification device, a terminal identity identification system, a machine-readable storage medium and a computer program product to solve the defects of the existing solutions in that when the concurrency is large, asymmetric key encryption and decryption operations consume a large amount of resources; and the public key is transmitted in plain text in the network, which can be captured by attackers and used to impersonate the identity and capture data using forged public and private keys.

[0005] To achieve the above objectives, an embodiment of the present invention provides a terminal identity recognition method, which is applied to a network device. The method includes:

[0006] Generate a first random number, and send an identity recognition start instruction to the terminal;

[0007] Randomly generate a first public key and a first private key, sign the first random number using the first private key, and encrypt the entire data formed by the signature result of the first random number, the first public key, and the first random number using a first preset key to obtain first ciphertext data;

[0008] sending the first ciphertext data to the terminal, and receiving second ciphertext data sent by the terminal;

[0009] Decrypting the second ciphertext data using the second preset key to obtain second plaintext data; the second ciphertext data is generated by the terminal encrypting the second plaintext data using the second preset key; the second plaintext data includes a second random number, a second public key, and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number using a second private key corresponding to the randomly generated second public key;

[0010] The signature result of the second random number is verified using the second public key to achieve identity identification of the terminal.

[0011] Optionally, after verifying the signature result of the second random number using the second public key to identify the terminal, the method further includes:

[0012] A digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number is calculated using a first digest calculation method to obtain a first negotiated master key.

[0013] Optionally, after calculating the digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number using the first digest calculation method to obtain the first negotiated master key, the method further includes:

[0014] Encrypting the fingerprint information of the terminal using a third preset key to obtain a ciphertext of the fingerprint information;

[0015] Send the fingerprint information ciphertext to the terminal.

[0016] Optionally, after sending the encrypted fingerprint information to the terminal, the method further includes:

[0017] Calculate the digest of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number using a second digest calculation method to obtain a first dynamic dispersion factor;

[0018] Dispersing the first negotiated master key based on the first dynamic dispersion factor to obtain a first dynamic shared key; the first dynamic shared key includes multiple subkeys;

[0019] Encrypting the first random number using a first subkey to obtain a random number ciphertext, wherein the first subkey is any subkey in the first dynamic shared key;

[0020] The random number ciphertext is sent to a terminal, so that the terminal performs security verification on the random number ciphertext.

[0021] On the other hand, an embodiment of the present invention further provides a terminal identity recognition method, applied to a terminal, the method comprising:

[0022] receiving a startup identity recognition instruction sent by a network device and generating a second random number;

[0023] Randomly generate a second public key and a second private key, sign the second random number using the second private key, and encrypt the entire data consisting of the signature result of the second random number, the second public key, and the second random number using a second preset key to obtain second ciphertext data;

[0024] sending the second ciphertext data to the network device, and receiving the first ciphertext data sent by the network device;

[0025] Decrypting the first ciphertext data using a first preset key to obtain first plaintext data; the first ciphertext data is generated by the network device encrypting the first plaintext data using the first preset key; the first plaintext data includes a first random number, a first public key, and a signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number using a first private key corresponding to the randomly generated first public key;

[0026] The signature result of the first random number is verified using the first public key to achieve identity identification of the network device.

[0027] Optionally, after verifying the signature result of the first random number using the first public key to identify the network device, the method further includes:

[0028] The digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number is calculated using a third digest calculation method to obtain a second negotiated master key.

[0029] Optionally, after calculating the digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number using the third digest calculation method to obtain the second negotiated master key, the method further includes:

[0030] Receiving the fingerprint information ciphertext sent by the network device;

[0031] Decrypting the fingerprint information ciphertext using a third preset key to obtain the fingerprint information of the terminal;

[0032] The fingerprint information is stored and set to an unreadable state.

[0033] Optionally, after storing the fingerprint information and setting the fingerprint information to an unreadable state, the method further includes:

[0034] Calculating a digest of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number using a fourth digest calculation method to obtain a second dynamic dispersion factor;

[0035] Dispersing the second negotiated master key based on the second dynamic dispersion factor to obtain a second dynamic shared key; the second dynamic shared key includes multiple subkeys;

[0036] receiving a random number ciphertext sent by the network device, and decrypting the random number ciphertext using a second subkey to obtain a decryption result; wherein the random number ciphertext is obtained by encrypting the first random number by the network device using a first subkey, and the second subkey is a subkey in the second dynamic shared key that is the same as the first subkey;

[0037] When the decryption result is the first random number, the security verification between the network device and the terminal is passed.

[0038] On the other hand, an embodiment of the present invention further provides a terminal identity recognition device, the device comprising:

[0039] A first sending module, configured to generate a first random number and send an identity recognition start instruction to a terminal;

[0040] a first encryption module, configured to randomly generate a first public key and a first private key, sign the first random number using the first private key, and encrypt data consisting of the signature result of the first random number, the first public key, and the first random number using a first preset key to obtain first ciphertext data;

[0041] an interaction module, configured to send the first ciphertext data to the terminal and receive second ciphertext data sent by the terminal;

[0042] a decryption module, configured to decrypt the second ciphertext data using a second preset key to obtain second plaintext data; the second ciphertext data is generated by the terminal encrypting the second plaintext data using the second preset key; the second plaintext data includes a second random number, a second public key, and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number using a second private key corresponding to the randomly generated second public key;

[0043] The signature verification module is used to verify the signature result of the second random number using the second public key to achieve identity recognition of the terminal.

[0044] Optionally, the device further includes:

[0045] The master key generation module is configured to calculate a digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number using a first digest calculation method to obtain a first negotiated master key.

[0046] Optionally, the device further includes:

[0047] A second encryption module is used to encrypt the fingerprint information of the terminal using a third preset key to obtain a ciphertext of the fingerprint information;

[0048] The second sending module is used to send the fingerprint information ciphertext to the terminal.

[0049] Optionally, the device further includes:

[0050] a dispersion factor generating module, configured to calculate a digest of overall data formed by the fingerprint information of the terminal, the first random number, and the second random number using a second digest calculation method to obtain a first dynamic dispersion factor;

[0051] a dispersing module, configured to disperse the first negotiated master key based on the first dynamic dispersing factor to obtain a first dynamic shared key; the first dynamic shared key includes a plurality of subkeys;

[0052] a third encryption module, configured to encrypt the first random number using a first subkey to obtain a random number ciphertext, wherein the first subkey is any subkey in the first dynamic shared key;

[0053] The third sending module is used to send the random number ciphertext to the terminal, so that the terminal can perform security verification on the random number ciphertext.

[0054] On the other hand, an embodiment of the present invention further provides a terminal identity recognition device, the device comprising:

[0055] A first receiving module is used to receive a startup identity recognition instruction sent by a network device and generate a second random number;

[0056] an encryption module, configured to randomly generate a second public key and a second private key, sign the second random number using the second private key, and encrypt the entire data consisting of the signature result of the second random number, the second public key, and the second random number using a second preset key to obtain second ciphertext data;

[0057] An interaction module, configured to send the second ciphertext data to the network device, and receive the first ciphertext data sent by the network device;

[0058] a first decryption module, configured to decrypt the first ciphertext data using a first preset key to obtain first plaintext data; the first ciphertext data is generated by the network device encrypting the first plaintext data using the first preset key; the first plaintext data includes a first random number, a first public key, and a signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number using a first private key corresponding to the randomly generated first public key;

[0059] The signature verification module is used to verify the signature result of the first random number using the first public key to achieve identity recognition of the network device.

[0060] Optionally, the device further includes:

[0061] The master key generation module is used to calculate the digest of the overall data formed by the first public key, the second public key, the first random number and the second random number by using a third digest calculation method to obtain a second negotiated master key.

[0062] Optionally, the device further includes:

[0063] A second receiving module, configured to receive the fingerprint information ciphertext sent by the network device;

[0064] a second decryption module, configured to decrypt the fingerprint information ciphertext using a third preset key to obtain the fingerprint information of the terminal;

[0065] The storage module is used to store the fingerprint information and set the fingerprint information to an unreadable state.

[0066] Optionally, the device further includes:

[0067] a dispersion factor generating module, configured to calculate a digest of overall data formed by the fingerprint information of the terminal, the first random number, and the second random number using a fourth digest calculation method to obtain a second dynamic dispersion factor;

[0068] a dispersing module, configured to disperse the second negotiated master key based on the second dynamic dispersing factor to obtain a second dynamic shared key; the second dynamic shared key includes a plurality of subkeys;

[0069] a third decryption module, configured to receive a random number ciphertext sent by the network device, and decrypt the random number ciphertext using a second subkey to obtain a decryption result; wherein the random number ciphertext is obtained by encrypting the first random number by the network device using a first subkey, and the second subkey is a subkey in the second dynamic shared key that is the same as the first subkey;

[0070] The verification module is configured to verify that, when the decryption result is the first random number, the security verification between the network device and the terminal is passed.

[0071] On the other hand, an embodiment of the present invention further provides a terminal identity recognition system, comprising: a network device for executing the above-mentioned terminal identity recognition method and a terminal for executing the above-mentioned terminal identity recognition method.

[0072] On the other hand, the present invention further provides a computer program product, comprising a computer program, wherein the computer program implements the above-mentioned terminal identity recognition method when executed by a processor.

[0073] Through the above technical solution, the embodiment of the present invention uses a second preset key to decrypt the second ciphertext data on the network device side, and uses a second preset key to encrypt the second ciphertext data on the terminal side. This reduces resource consumption for encryption and decryption operations and increases identity security by pre-setting symmetric keys in the network device and the terminal. Furthermore, each time the network device and the terminal perform identity authentication, they each generate a random public-private key pair, and use the random public-private key pair to generate ciphertext data for transmission as authentication data. This prevents the public key from being transmitted in plaintext over the network, preventing attackers from impersonating others by forging public-private keys and then accessing the system to capture data.

[0074] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following detailed description, they are used to explain the embodiments of the present invention, but do not constitute a limitation of the embodiments of the present invention. In the accompanying drawings:

[0076] Figure 1 This is one of the flow charts of the terminal identity recognition method provided by the present invention;

[0077] Figure 2 This is the second flow chart of the terminal identity recognition method provided by the present invention;

[0078] Figure 3 This is the third flow chart of the terminal identity recognition method provided by the present invention;

[0079] Figure 4 This is the fourth flow chart of the terminal identity recognition method provided by the present invention;

[0080] Figure 5 is a schematic diagram of the key provided by the present invention;

[0081] Figure 6 This is one of the structural diagrams of the terminal identity recognition device provided by the present invention;

[0082] Figure 7 This is the second structural diagram of the terminal identity recognition device provided by the present invention;

[0083] Figure 8 It is a structural diagram of the terminal identity recognition system provided by the present invention. DETAILED DESCRIPTION

[0084] The following describes the specific implementation of the embodiment of the present invention in detail with reference to the accompanying drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the embodiment of the present invention and is not used to limit the embodiment of the present invention.

[0085] Method Example

[0086] An embodiment of the present invention provides a terminal identity recognition method applicable to a network device. The network device may be a service platform, such as a server. In the embodiments of the present invention, the network device is described using a service platform as an example. The service platform is configured with a security encryption device, such as a cryptographic machine.

[0087] Please refer to Figure 1 The terminal identity recognition method of an embodiment of the present invention includes:

[0088] Step 101: Generate a first random number and send an identity recognition start instruction to a terminal.

[0089] When starting identity authentication, the service platform can use the random module in the Python programming language to generate a first random number. The service platform also needs to send a start identity recognition instruction to the terminal to inform the terminal to start identity authentication and generate a second random number.

[0090] Step 102: Randomly generate a first public key and a first private key, sign the first random number with the first private key, and encrypt the overall data formed by the signature result of the first random number, the first public key, and the first random number with a first preset key to obtain first ciphertext data.

[0091] The service platform can use a public key encryption algorithm to randomly generate a pair of public and private key pairs. For example, the service platform can use the RSA algorithm or the ECC algorithm (elliptic curve cryptography algorithm) to randomly generate a first public key and a first private key. The service platform signs the first random number using the first private key. Specifically, the service platform can use the first private key to encrypt the summary (or hash value) of the first random number to generate a digital signature. And the signature result of the first random number, the first public key and the overall data formed by the first random number are encrypted using the first preset key to obtain the first ciphertext data. The first preset key is a key preset in the service platform, which is used to encrypt the signature result of the first random number, the first public key and the overall data formed by the first random number to form the first ciphertext data as authentication data for identity identification with the terminal.

[0092] Step 103: Send the first ciphertext data to the terminal, and receive the second ciphertext data sent by the terminal.

[0093] The service platform sends the first encrypted data to the terminal, enabling the terminal to decrypt the first encrypted data and complete the terminal's identity verification of the service platform. The service platform also needs to receive the second encrypted data sent by the terminal to decrypt the second encrypted data and complete the service platform's identity verification of the terminal. As a result, the authentication data used for identity verification between the communicating parties is all encrypted data, preventing the public key in the authentication data from being transmitted in plaintext over the network and preventing attackers from impersonating others by forging public and private keys to access the system and capture data.

[0094] Step 104: Decrypt the second ciphertext data using a second preset key to obtain second plaintext data.

[0095] The service platform can decrypt the second ciphertext data using a preset second preset key to obtain second plaintext data. The second ciphertext data is formed by the terminal encrypting the second plaintext data using the second preset key. In an embodiment of the present invention, a second preset key is preset on the service platform and the terminal, and the second plaintext data is encrypted using the second preset key, and the second ciphertext data is decrypted using the second preset key. That is, by presetting symmetric keys on the service platform and the terminal for data encryption and decryption, identity identification security is increased. Compared with asymmetric keys for security protection, the embodiment of the present invention uses symmetric keys for data encryption and decryption, reducing resource consumption of encryption and decryption operations.

[0096] In addition, the second plaintext data includes a second random number, a second public key, and a signature result of the second random number. The second random number is randomly generated by the terminal based on the startup identity recognition instruction. The signature result of the second random number is obtained by the terminal signing the second random number using the second private key corresponding to the randomly generated second public key. The terminal can use the second private key to encrypt the digest (or hash value) of the second random number to generate a digital signature.

[0097] Step 105: Verify the signature result of the second random number using the second public key to achieve identity recognition of the terminal.

[0098] The service platform uses the second public key randomly generated by the terminal to decrypt and verify the digital signature of the second random number, thereby identifying the terminal. If an attacker were to capture data using a forged public-private key pair, since each identity authentication in this embodiment of the present invention generates a random number and a random public-private key pair on both the service platform and the terminal, verification of the signature of the second random number would be impossible, and thus identification of the terminal would be impossible. This embodiment of the present invention improves the security of identity identification between the service platform and the terminal.

[0099] In this embodiment of the present invention, the network device uses a second preset key to decrypt the second ciphertext data, and the terminal uses a second preset key to encrypt the second ciphertext data. This reduces resource consumption for encryption and decryption operations and increases identity security by presetting symmetric keys in the network device and the terminal. Furthermore, each time the network device and the terminal perform identity authentication, they each generate a random public-private key pair. Ciphertext data generated using the random public-private key pair is then transmitted as authentication data, preventing the public key from being transmitted in plaintext over the network and preventing attackers from impersonating users by forging public-private keys and then gaining access to the system to capture data.

[0100] For other aspects of the present invention, please refer to Figure 2 After step 105, verifying the signature result of the second random number using the second public key to identify the terminal, the method further includes:

[0101] Step 106: Calculate the digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number using a first digest calculation method to obtain a first negotiated master key.

[0102] After the service platform and the terminal complete identity identification, the service platform can obtain the first negotiated master key through various summary calculation methods, such as using the sm3 summary algorithm to calculate the summary of the overall data formed by the first public key, the second public key, the first random number and the second random number.

[0103] In an embodiment of the present invention, a negotiated master key is generated each time the service platform and the terminal complete identity identification. Since the negotiated master key is obtained based on the randomly generated first public key, the second public key, the first random number, and the second random number, the negotiated master key generated after each successful identity identification is different, and the negotiated master key is not a fixed value, which greatly improves the security of the negotiated master key. Compared with the use of fixed keys in existing solutions, each encryption and decryption operation uses the same key value, which lacks key dynamics and increases the risk of theft and tampering. In the embodiment of the present invention, the generation of a negotiated master key after identity identification is introduced, and the negotiated master key is dynamic, thereby improving the security of the negotiated master key.

[0104] For other aspects of the present invention, please refer to Figure 2 In step 106, after calculating the digest of the first public key, the second public key, the first random number, and the second random number using a first digest calculation method to obtain the first negotiated master key, the method further includes:

[0105] Step 107: Encrypt the fingerprint information of the terminal using a third preset key to obtain a ciphertext of the fingerprint information.

[0106] Step 108: Send the encrypted fingerprint information to the terminal.

[0107] In the embodiments of the present invention, the service platform centrally manages terminal fingerprint information, including storage, distribution, and identity uniqueness verification. Specifically, the service platform stores fingerprint information for multiple terminals in communication. Terminal fingerprint information represents device characteristics or a unique terminal identifier that uniquely identifies the terminal. For example, terminal fingerprint information can be a terminal identity code.

[0108] In this embodiment of the present invention, the service platform encrypts the terminal's fingerprint information using a pre-set third preset key to obtain a ciphertext of the fingerprint information. The ciphertext of the fingerprint information is then sent to the terminal, where the terminal decrypts the ciphertext using the pre-set third preset key and stores the terminal's fingerprint information. By encrypting the fingerprint information and sending the ciphertext of the fingerprint information to the terminal, this embodiment of the present invention facilitates the subsequent generation of a dynamic shared key between the service platform and the terminal based on the fingerprint information that uniquely identifies the terminal, thereby further improving the security of identity recognition.

[0109] Furthermore, the embodiment of the present invention pre-sets three pairs of symmetric keys (i.e., a first preset key, a second preset key, and a third preset key) in the cryptographic machine of the service platform and the terminal security chip to increase the security of identity recognition and dynamic shared key generation.

[0110] For other aspects of the present invention, please refer to Figure 2After step 108, sending the fingerprint information encrypted text to the terminal, the method further includes:

[0111] Step 109: Calculate the digest of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number using a second digest calculation method to obtain a first dynamic dispersion factor.

[0112] Step 110: Disperse the first negotiated master key based on the first dynamic dispersion factor to obtain a first dynamic shared key.

[0113] The service platform can obtain a first dynamic dispersion factor using various digest calculation methods, such as a digest of the overall data formed by the terminal's fingerprint information, the first random number, and the second random number using the SM3 digest algorithm. The service platform then disperses the first negotiated master key based on the first dynamic dispersion factor to obtain a first dynamic shared key. The first dynamic shared key includes multiple subkeys.

[0114] Step 111: Encrypt the first random number using a first subkey to obtain a random number ciphertext; wherein the first subkey is any subkey in the first dynamic shared key.

[0115] Step 112: Send the random number ciphertext to the terminal, so that the terminal performs security verification on the random number ciphertext.

[0116] The service platform encrypts the first random number using the first subkey to obtain a random number ciphertext. The first subkey is any subkey in the first dynamic shared key. For example, the first subkey is the first subkey in the first dynamic shared key. The service platform sends the random number ciphertext to the terminal, so that the terminal performs security verification on the random number ciphertext. Specifically, the terminal decrypts the random number ciphertext using the same subkey as the first subkey to obtain the first random number, thereby achieving security verification between the terminal and the service platform.

[0117] On the one hand, existing solutions lack service platform management of terminal device identity codes, and thus lack the service platform's uniqueness verification function for terminal devices. The present invention introduces device fingerprint (device identity code) management on the service platform, including storage, distribution, and uniqueness verification functions. Furthermore, the dynamic shared key generation process of the present invention utilizes the terminal device's fingerprint information (terminal identity code). Since each terminal's fingerprint information is different, a dynamic dispersion factor is added, resulting in a different dynamic shared key for each terminal. This increases the relevance and uniqueness of the terminal's fingerprint information and the dynamic shared key, and also increases the dynamic nature of the shared key. Specifically, by incorporating the terminal's fingerprint information into the generation of the dynamic shared key, the present invention increases the relevance, dynamism, and uniqueness of the security protection for both communicating parties. Furthermore, since the dynamic shared master key is generated from the negotiated master key, multiple classification rules can be formulated based on the type of service data between the service platform and the terminal and the fingerprint information, increasing the flexibility of deriving the dynamic shared key from the negotiated master key.

[0118] On the other hand, existing solutions use fixed keys, and the same key value is used for every encryption and decryption operation. This lacks key dynamics and increases the risk of key theft and tampering. In the embodiments of the present invention, identity recognition is used to generate a negotiated master key, which is dynamic. Simultaneously, rules are formulated to derive the negotiated master key from the terminal's fingerprint information and generate a dynamic shared key. Because each terminal's fingerprint information is different, the generated dynamic shared key is also different, further increasing dynamism.

[0119] Finally, in existing solutions, the communicating parties encrypt the key value data before transmitting it over the network, making it vulnerable to interception and posing a significant risk. In the embodiments of the present invention, the communication between the service platform and the terminal derives a dynamic shared key by negotiating a master key, fingerprint information, and the first and second random numbers of both parties. What is transmitted over the network is the encrypted fingerprint information, not the key value data itself. This generation of a dynamic shared key improves the security of the key data.

[0120] On the other hand, please refer to Figure 3 , an embodiment of the present invention further provides a terminal identity recognition method, applied to a terminal, the method comprising:

[0121] Step 201: Receive a startup identity recognition instruction sent by a network device and generate a second random number.

[0122] In an embodiment of the present invention, the terminal is configured with a security encryption device, such as a security chip. The terminal receives a start-identification instruction from the service platform, begins identity authentication, and generates a second random number. The terminal can use the random module in the Python programming language to generate the second random number.

[0123] Step 202: Randomly generate a second public key and a second private key, sign the second random number with the second private key, and encrypt the overall data formed by the signature result of the second random number, the second public key and the second random number with a second preset key to obtain second ciphertext data.

[0124] The terminal can use a public key encryption algorithm to randomly generate a public-private key pair. For example, the terminal can use the RSA algorithm or the ECC algorithm (elliptic curve cryptography algorithm) to randomly generate a second public key and a second private key. The terminal uses the second private key to sign the second random number. Specifically, the terminal can use the second private key to encrypt the digest (or hash value) of the second random number to generate a digital signature. The second preset key is used to encrypt the signature result of the second random number, the second public key, and the entire data formed by the second random number to obtain second ciphertext data. The second preset key is a key pre-installed in the terminal and is used to encrypt the signature result of the second random number, the second public key, and the entire data formed by the second random number to form the second ciphertext data as authentication data for identity identification with the service platform. It should be noted that the second preset key of the terminal is the same as the second preset key of the service platform. Therefore, in this embodiment of the present invention, symmetric keys are pre-installed on the service platform and the terminal for data encryption and decryption, thereby increasing identity identification security.

[0125] Step 203: Send the second ciphertext data to the network device, and receive the first ciphertext data sent by the network device.

[0126] The terminal sends the second ciphertext data to the service platform, which decrypts it and authenticates the terminal. The terminal also needs to receive the first ciphertext data from the service platform, decrypting it and authenticating the terminal. This ensures that the authentication data used by both communicating parties is encrypted, preventing the public key in the authentication data from being transmitted in plaintext over the network and preventing attackers from impersonating others by forging public and private keys and then gaining access to the system to capture data.

[0127] Step 204: Decrypt the first ciphertext data using a first preset key to obtain first plaintext data.

[0128] The terminal can decrypt the first ciphertext data using a preset first preset key to obtain the first plaintext data. The first ciphertext data is formed by the service platform encrypting the first plaintext data using the first preset key. In an embodiment of the present invention, a first preset key is preset on the service platform and the terminal, and the first plaintext data is encrypted using the first preset key, and the first ciphertext data is decrypted using the first preset key. That is, by presetting symmetric keys on the service platform and the terminal for data encryption and decryption, identity identification security is increased. Compared with asymmetric keys for security protection, the embodiment of the present invention uses symmetric keys for data encryption and decryption, reducing resource consumption of encryption and decryption operations.

[0129] The first ciphertext data is generated by the service platform encrypting the first plaintext data using the first preset key. The first plaintext data includes a first random number, a first public key, and a signature result of the first random number. The signature result of the first random number is obtained by the network device signing the first random number using a first private key corresponding to the randomly generated first public key. The service platform can use the first private key to encrypt the digest (or hash value) of the first random number to generate a digital signature.

[0130] Step 205: Verify the signature result of the first random number using the first public key to achieve identity identification of the network device.

[0131] The terminal decrypts and verifies the digital signature of the first random number using the first public key to authenticate the service platform. If an attacker were to capture data using a forged public-private key pair, the signature of the first random number would be impossible to verify, as both the service platform and the terminal generate a random number and a random public-private key pair for each authentication. Consequently, authentication of the service platform would be impossible. This improves the security of authentication between the service platform and the terminal.

[0132] In this embodiment of the present invention, the terminal decrypts the first ciphertext data using a first preset key, and the network device encrypts the first ciphertext data using the first preset key. This reduces resource consumption for encryption and decryption operations and increases identity security by pre-setting symmetric keys in the network device and the terminal. Furthermore, each time the network device and the terminal perform identity authentication, they each generate a random public-private key pair. Ciphertext data generated using the random public-private key pair is then transmitted as authentication data, preventing the public key from being transmitted in plaintext over the network and preventing attackers from impersonating users by forging public-private keys and then gaining access to the system to capture data.

[0133] For other aspects of the present invention, please refer to Figure 4After step 205, verifying the signature result of the first random number using the first public key to identify the network device, the method further includes:

[0134] Step 206: Calculate the digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number using a third digest calculation method to obtain a second negotiated master key.

[0135] After the service platform and the terminal complete identity authentication, the terminal can calculate a digest of the first public key, the second public key, the first random number, and the second random number using various digest calculation methods, such as the SM3 digest algorithm, to obtain the second negotiated master key. It should be noted that the second negotiated master key generated by the terminal is the same as the first negotiated master key generated by the service platform.

[0136] In an embodiment of the present invention, a negotiated master key is generated each time the service platform and the terminal complete identity identification. Since the negotiated master key is obtained based on the randomly generated first public key, the second public key, the first random number, and the second random number, the negotiated master key generated after each successful identity identification is different, and the negotiated master key is not a fixed value, which greatly improves the security of the negotiated master key. Compared with the use of fixed keys in existing solutions, each encryption and decryption operation uses the same key value, which lacks key dynamics and increases the risk of theft and tampering. In the embodiment of the present invention, the generation of a negotiated master key after identity identification is introduced, and the negotiated master key is dynamic, thereby improving the security of the negotiated master key.

[0137] For other aspects of the present invention, please refer to Figure 4 In step 206, after calculating the digest of the entire data formed by the first public key, the second public key, the first random number, and the second random number using a third digest calculation method to obtain the second negotiated master key, the method further includes:

[0138] Step 207: Receive the fingerprint information ciphertext sent by the network device.

[0139] Step 208: Decrypt the fingerprint information ciphertext using a third preset key to obtain the fingerprint information of the terminal.

[0140] Step 209: Store the fingerprint information and set the fingerprint information to an unreadable state.

[0141] The terminal receives the encrypted fingerprint information. It then decrypts the encrypted fingerprint information using a pre-set third key, stores the terminal's fingerprint information, and sets it to an unreadable state. This protects the terminal's fingerprint information from being stolen. By storing the fingerprint information and setting it to an unreadable state, the embodiments of the present invention facilitate the subsequent generation of a dynamic shared key between the service platform and the terminal based on the fingerprint information that uniquely represents the terminal's identity, thereby further improving the security of identity recognition.

[0142] Also, please refer to Figure 5 In an embodiment of the present invention, three pairs of symmetric keys (i.e., a first preset key, a second preset key, and a third preset key) are preset in the cryptographic machine of the service platform and the terminal security chip to increase the security of identity identification and dynamic shared key generation.

[0143] For other aspects of the present invention, please refer to Figure 4 After step 209, storing the fingerprint information and setting the fingerprint information to an unreadable state, the method further includes:

[0144] Step 210: Calculate the digest of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number using a fourth digest calculation method to obtain a second dynamic dispersion factor.

[0145] Step 211: Disperse the second negotiated master key based on the second dynamic dispersion factor to obtain a second dynamic shared key; the second dynamic shared key includes multiple subkeys.

[0146] The terminal can obtain a second dynamic dispersion factor using various digest calculation methods, such as a digest of the overall data formed by the terminal's fingerprint information, the first random number, and the second random number using the SM3 digest algorithm. The terminal then disperses the second negotiated master key based on the second dynamic dispersion factor to obtain a second dynamic shared key. The second dynamic shared key includes multiple subkeys. It should be noted that the second dynamic dispersion factor of the terminal is the same as the first dynamic dispersion factor of the service platform. The second dynamic shared key of the terminal is the same as the first dynamic shared key of the service platform.

[0147] Step 212: Receive the random number ciphertext sent by the network device, decrypt the random number ciphertext using the second subkey, and obtain a decryption result.

[0148] Step 213: If the decryption result is the first random number, the security verification between the network device and the terminal is passed.

[0149] The terminal decrypts the random number ciphertext using the second subkey to obtain a first random number. The random number ciphertext is obtained by encrypting the first random number using the first subkey by the network device, and the second subkey is a subkey in the second dynamic shared key that is identical to the first subkey. The terminal decrypts the random number ciphertext using the subkey that is identical to the first subkey to obtain the first random number, thereby implementing security authentication between the terminal and the service platform.

[0150] On the one hand, existing solutions lack service platform management of terminal device identity codes, and thus lack the service platform's uniqueness verification function for terminal devices. The present invention introduces device fingerprint (device identity code) management on the service platform, including storage, distribution, and uniqueness verification functions. Furthermore, the dynamic shared key generation process of the present invention utilizes the terminal device's fingerprint information (terminal identity code). Since each terminal's fingerprint information is different, a dynamic dispersion factor is added, resulting in a different dynamic shared key for each terminal. This increases the relevance and uniqueness of the terminal's fingerprint information and the dynamic shared key, and also increases the dynamic nature of the shared key. Specifically, by incorporating the terminal's fingerprint information into the generation of the dynamic shared key, the present invention increases the relevance, dynamism, and uniqueness of the security protection for both communicating parties. Furthermore, since the dynamic shared master key is generated from the negotiated master key, multiple classification rules can be formulated based on the type of service data between the service platform and the terminal and the fingerprint information, increasing the flexibility of deriving the dynamic shared key from the negotiated master key.

[0151] On the other hand, existing solutions use fixed keys, and the same key value is used for every encryption and decryption operation. This lacks key dynamics and increases the risk of key theft and tampering. In the embodiments of the present invention, identity recognition is used to generate a negotiated master key, which is dynamic. Simultaneously, rules are formulated to derive the negotiated master key from the terminal's fingerprint information and generate a dynamic shared key. Because each terminal's fingerprint information is different, the generated dynamic shared key is also different, further increasing dynamism.

[0152] Finally, in existing solutions, the communicating parties encrypt the key value data before transmitting it over the network, making it vulnerable to interception and posing a significant risk. In the embodiments of the present invention, the communication between the service platform and the terminal derives a dynamic shared key by negotiating a master key, fingerprint information, and the first and second random numbers of both parties. What is transmitted over the network is the encrypted fingerprint information, not the key value data itself. This generation of a dynamic shared key improves the security of the key data.

[0153] Device embodiment

[0154] On the other hand, please refer to Figure 6 , an embodiment of the present invention further provides a terminal identity recognition device, the device comprising:

[0155] The sending module 601 is used to generate a first random number and send an identity recognition start instruction to the terminal;

[0156] An encryption module 602 is configured to randomly generate a first public key and a first private key, sign the first random number using the first private key, and encrypt the entire data consisting of the signature result of the first random number, the first public key, and the first random number using a first preset key to obtain first ciphertext data;

[0157] Interaction module 603, configured to send the first ciphertext data to the terminal, and receive second ciphertext data sent by the terminal;

[0158] Decryption module 604 is configured to decrypt the second ciphertext data using a second preset key to obtain second plaintext data; the second ciphertext data is generated by the terminal encrypting the second plaintext data using the second preset key; the second plaintext data includes a second random number, a second public key, and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number using a second private key corresponding to the randomly generated second public key;

[0159] The signature verification module 605 is configured to verify the signature result of the second random number using the second public key to achieve identity recognition of the terminal.

[0160] The terminal identity recognition device includes a processor and a memory. The above-mentioned sending module 601, encryption module 602, interaction module 603, decryption module 604, signature verification module 605, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0161] Optionally, the device further includes:

[0162] The master key generation module is configured to calculate a digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number using a first digest calculation method to obtain a first negotiated master key.

[0163] Optionally, the device further includes:

[0164] A second encryption module is used to encrypt the fingerprint information of the terminal using a third preset key to obtain a ciphertext of the fingerprint information;

[0165] The second sending module is used to send the fingerprint information ciphertext to the terminal.

[0166] Optionally, the device further includes:

[0167] a dispersion factor generating module, configured to calculate a digest of overall data formed by the fingerprint information of the terminal, the first random number, and the second random number using a second digest calculation method to obtain a first dynamic dispersion factor;

[0168] a dispersing module, configured to disperse the first negotiated master key based on the first dynamic dispersing factor to obtain a first dynamic shared key; the first dynamic shared key includes a plurality of subkeys;

[0169] a third encryption module, configured to encrypt the first random number using a first subkey to obtain a random number ciphertext, wherein the first subkey is any subkey in the first dynamic shared key;

[0170] The third sending module is used to send the random number ciphertext to the terminal, so that the terminal can perform security verification on the random number ciphertext.

[0171] The processor includes a kernel, which calls the corresponding program unit from the memory. There can be one or more kernels.

[0172] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0173] On the other hand, please refer to Figure 7 , an embodiment of the present invention further provides a terminal identity recognition device, the device comprising:

[0174] The receiving module 701 is configured to receive a startup identity recognition instruction sent by a network device and generate a second random number;

[0175] An encryption module 702 is configured to randomly generate a second public key and a second private key, sign the second random number using the second private key, and encrypt the entire data consisting of the signature result of the second random number, the second public key, and the second random number using a second preset key to obtain second ciphertext data;

[0176] Interaction module 703, configured to send the second ciphertext data to the network device, and receive the first ciphertext data sent by the network device;

[0177] Decryption module 704 is configured to decrypt the first ciphertext data using a first preset key to obtain first plaintext data; the first ciphertext data is generated by the network device encrypting the first plaintext data using the first preset key; the first plaintext data includes a first random number, a first public key, and a signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number using a first private key corresponding to the randomly generated first public key;

[0178] The signature verification module 705 is used to verify the signature result of the first random number using the first public key to achieve identity recognition of the network device.

[0179] Optionally, the device further includes:

[0180] The master key generation module is used to calculate the digest of the overall data formed by the first public key, the second public key, the first random number and the second random number by using a third digest calculation method to obtain a second negotiated master key.

[0181] Optionally, the device further includes:

[0182] A second receiving module, configured to receive the fingerprint information ciphertext sent by the network device;

[0183] a second decryption module, configured to decrypt the fingerprint information ciphertext using a third preset key to obtain the fingerprint information of the terminal;

[0184] The storage module is used to store the fingerprint information and set the fingerprint information to an unreadable state.

[0185] Optionally, the device further includes:

[0186] a dispersion factor generating module, configured to calculate a digest of overall data formed by the fingerprint information of the terminal, the first random number, and the second random number using a fourth digest calculation method to obtain a second dynamic dispersion factor;

[0187] a dispersing module, configured to disperse the second negotiated master key based on the second dynamic dispersing factor to obtain a second dynamic shared key; the second dynamic shared key includes a plurality of subkeys;

[0188] a third decryption module, configured to receive a random number ciphertext sent by the network device, and decrypt the random number ciphertext using a second subkey to obtain a decryption result; wherein the random number ciphertext is obtained by encrypting the first random number by the network device using a first subkey, and the second subkey is a subkey in the second dynamic shared key that is the same as the first subkey;

[0189] The verification module is configured to verify that, when the decryption result is the first random number, the security verification between the network device and the terminal is passed.

[0190] The terminal identity recognition device includes a processor and a memory. The above-mentioned receiving module, encryption module, interaction module, decryption module and signature verification module are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0191] The processor includes a kernel, which calls the corresponding program unit from the memory. There can be one or more kernels.

[0192] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0193] On the other hand, please refer to Figure 8 An embodiment of the present invention further provides a terminal identity recognition system, comprising: a network device that executes the above-mentioned terminal identity recognition method and a terminal that executes the above-mentioned terminal identity recognition method.

[0194] A network device (i.e., a service platform) is configured to generate a first random number and send a start identity identification instruction to a terminal; randomly generate a first public key and a first private key, sign the first random number using the first private key, and encrypt the overall data formed by the signature result of the first random number, the first public key, and the first random number using a first preset key to obtain first ciphertext data; send the first ciphertext data to the terminal, and receive second ciphertext data sent by the terminal; decrypt the second ciphertext data using a second preset key to obtain second plaintext data; the second ciphertext data is formed by the terminal encrypting the second plaintext data using the second preset key; the second plaintext data includes a second random number, a second public key, and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number using a second private key corresponding to the randomly generated second public key; the signature result of the second random number is verified using the second public key to achieve identity identification of the terminal;

[0195] A terminal is used to receive a startup identity identification instruction sent by a network device and generate a second random number; randomly generate a second public key and a second private key, sign the second random number with the second private key, and encrypt the signature result of the second random number, the second public key and the overall data formed by the second preset key to obtain second ciphertext data; send the second ciphertext data to the network device, and receive the first ciphertext data sent by the network device; decrypt the first ciphertext data with the first preset key to obtain first plaintext data; the first ciphertext data is formed by the network device encrypting the first plaintext data using the first preset key; the first plaintext data includes a first random number, a first public key and a signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number with the first private key corresponding to the randomly generated first public key; the signature result of the first random number is verified by the first public key to realize identity identification of the network device.

[0196] The service platform and a terminal of the embodiment of the present invention first each randomly generate a pair of public and private key pairs through the ECC algorithm. The two parties complete the two-way identity recognition function by exchanging their respective public keys and combining the signature verification technology. At the same time, after the identity recognition is completed, the asymmetric key negotiation generates a negotiation master key. The negotiation master key is a symmetric key and is also dynamically generated asymmetrically. Then the service platform has the function of uniformly distributing and managing the fingerprint information of the terminal device (the identity code of the terminal) one by one. Each terminal device obtains its own fingerprint information through the service platform as one of the derivation factors for generating a dynamic shared key, and the fingerprint information is stored on the terminal side and set to a non-readable state. After both parties use the fingerprint information to participate and formulate certain rules, the sm3 operation generates a dispersion factor to derive the negotiation master key and generate a sub-key group. The sub-key group is called a dynamic shared key. The terminal's business data can use the dynamic shared key for data encryption and decryption security protection.

[0197] The terminal identity recognition system of the embodiment of the present invention has four functions: 1. The communicating parties use the ECC algorithm to randomly generate a public-private key pair for two-way device authentication; 2. The communicating parties use the asymmetric key to negotiate and generate a negotiated master key through sm3 operation. The negotiated master key is a symmetric key; 3. The service platform has the management of fingerprint information (terminal identity code), that is, it can distribute the fingerprint information of the terminal (the identity code mark of the terminal) one by one, verify the uniqueness of the terminal, store the device fingerprint, etc. At the same time, the terminal obtains the fingerprint information to participate in the generation of dynamic shared keys; 4. The communicating parties negotiate the use of fingerprint information for the master key and formulate rules as a dispersion factor to derive a sub-key group. The sub-key group is called a dynamic shared key.

[0198] On the one hand, existing solutions lack service platform management of terminal device identity codes, and thus lack the service platform's uniqueness verification function for terminal devices. The present invention introduces device fingerprint (device identity code) management on the service platform, including storage, distribution, and uniqueness verification functions. Furthermore, the dynamic shared key generation process of the present invention utilizes the terminal device's fingerprint information (terminal identity code). Since each terminal's fingerprint information is different, a dynamic dispersion factor is added, resulting in a different dynamic shared key for each terminal. This increases the relevance and uniqueness of the terminal's fingerprint information and the dynamic shared key, and also increases the dynamic nature of the shared key. Specifically, by incorporating the terminal's fingerprint information into the generation of the dynamic shared key, the present invention increases the relevance, dynamism, and uniqueness of the security protection for both communicating parties. Furthermore, since the dynamic shared master key is generated from the negotiated master key, multiple classification rules can be formulated based on the type of service data between the service platform and the terminal and the fingerprint information, increasing the flexibility of deriving the dynamic shared key from the negotiated master key.

[0199] On the other hand, existing solutions use fixed keys, and the same key value is used for every encryption and decryption operation. This lacks key dynamics and increases the risk of key theft and tampering. In the embodiments of the present invention, identity recognition is used to generate a negotiated master key, which is dynamic. Simultaneously, rules are formulated to derive the negotiated master key from the terminal's fingerprint information and generate a dynamic shared key. Because each terminal's fingerprint information is different, the generated dynamic shared key is also different, further increasing dynamism.

[0200] Finally, in existing solutions, the communicating parties encrypt the key value data before transmitting it over the network, making it vulnerable to interception and posing a significant risk. In the embodiments of the present invention, the communication between the service platform and the terminal derives a dynamic shared key by negotiating a master key, fingerprint information, and the first and second random numbers of both parties. What is transmitted over the network is the encrypted fingerprint information, not the key value data itself. This generation of a dynamic shared key improves the security of the key data.

[0201] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a machine-readable storage medium. When the computer program is executed by a processor, the computer can execute a terminal identity identification method, which includes: generating a first random number and sending an identity identification start instruction to the terminal; randomly generating a first public key and a first private key, signing the first random number with the first private key, and encrypting the overall data formed by the signature result of the first random number, the first public key and the first random number with a first preset key to obtain first ciphertext data; sending the first ciphertext data to the terminal, and receiving second ciphertext data sent by the terminal; decrypting the second ciphertext data with a second preset key to obtain second plaintext data; the second ciphertext data is formed by the terminal encrypting the second plaintext data using the second preset key; the second plaintext data includes a second random number, a second public key and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number with the second private key corresponding to the randomly generated second public key; and verifying the signature result of the second random number with the second public key to achieve identity identification of the terminal; or,

[0202] Receive a startup identity identification instruction sent by a network device and generate a second random number; randomly generate a second public key and a second private key, sign the second random number with the second private key, and encrypt the signature result of the second random number, the second public key and the overall data formed by the second preset key to obtain second ciphertext data; send the second ciphertext data to the network device, and receive the first ciphertext data sent by the network device; decrypt the first ciphertext data with the first preset key to obtain first plaintext data; the first ciphertext data is formed by the network device encrypting the first plaintext data using the first preset key; the first plaintext data includes a first random number, a first public key and the signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number with the first private key corresponding to the randomly generated first public key; the signature result of the first random number is verified by the first public key to realize identity identification of the network device.

[0203] On the other hand, the present invention also provides a machine-readable storage medium having a computer program stored thereon, which is implemented to execute a terminal identity identification method when executed by a processor, the method comprising: generating a first random number, and sending an instruction to start identity identification to a terminal; randomly generating a first public key and a first private key, signing the first random number with the first private key, and encrypting the overall data formed by the signature result of the first random number, the first public key and the first random number with a first preset key to obtain first ciphertext data; sending the first ciphertext data to the terminal, and receiving second ciphertext data sent by the terminal; decrypting the second ciphertext data with a second preset key to obtain second plaintext data; the second ciphertext data is formed by the terminal encrypting the second plaintext data with the second preset key; the second plaintext data includes a second random number, a second public key and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number with the second private key corresponding to the randomly generated second public key; verifying the signature result of the second random number with the second public key to achieve identity identification of the terminal; or,

[0204] Receive a startup identity identification instruction sent by a network device and generate a second random number; randomly generate a second public key and a second private key, sign the second random number with the second private key, and encrypt the signature result of the second random number, the second public key and the overall data formed by the second preset key to obtain second ciphertext data; send the second ciphertext data to the network device, and receive the first ciphertext data sent by the network device; decrypt the first ciphertext data with the first preset key to obtain first plaintext data; the first ciphertext data is formed by the network device encrypting the first plaintext data using the first preset key; the first plaintext data includes a first random number, a first public key and the signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number with the first private key corresponding to the randomly generated first public key; the signature result of the first random number is verified by the first public key to realize identity identification of the network device.

[0205] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0206] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0207] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A terminal identity recognition method, characterized in that: Applied to a network device, the method includes: Generate a first random number, and send an identity recognition start instruction to the terminal; Randomly generate a first public key and a first private key, sign the first random number using the first private key, and encrypt the entire data formed by the signature result of the first random number, the first public key, and the first random number using a first preset key to obtain first ciphertext data; sending the first ciphertext data to the terminal, and receiving second ciphertext data sent by the terminal; Decrypting the second ciphertext data using the second preset key to obtain second plaintext data; the second ciphertext data is generated by the terminal encrypting the second plaintext data using the second preset key; the second plaintext data includes a second random number, a second public key, and a signature result of the second random number; the signature result of the second random number is obtained by the terminal signing the second random number using a second private key corresponding to the randomly generated second public key; The signature result of the second random number is verified using the second public key to achieve identity identification of the terminal.

2. The terminal identity recognition method according to claim 1, characterized in that: After verifying the signature result of the second random number by using the second public key to identify the terminal, the method further includes: A digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number is calculated using a first digest calculation method to obtain a first negotiated master key.

3. The terminal identity recognition method according to claim 2, characterized in that: After calculating the digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number using the first digest calculation method to obtain the first negotiated master key, the method further includes: Encrypting the fingerprint information of the terminal using a third preset key to obtain a ciphertext of the fingerprint information; Send the encrypted fingerprint information to the terminal.

4. The terminal identity recognition method according to claim 3, characterized in that: After sending the fingerprint information ciphertext to the terminal, the method further includes: Calculate the digest of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number using a second digest calculation method to obtain a first dynamic dispersion factor; Dispersing the first negotiated master key based on the first dynamic dispersion factor to obtain a first dynamic shared key; the first dynamic shared key includes multiple subkeys; Encrypting the first random number using a first subkey to obtain a random number ciphertext, wherein the first subkey is any subkey in the first dynamic shared key; The random number ciphertext is sent to a terminal, so that the terminal performs security verification on the random number ciphertext.

5. A terminal identity recognition method, characterized in that: Applied to a terminal, the method includes: receiving a startup identity recognition instruction sent by a network device and generating a second random number; Randomly generate a second public key and a second private key, sign the second random number using the second private key, and encrypt the entire data consisting of the signature result of the second random number, the second public key, and the second random number using a second preset key to obtain second ciphertext data; sending the second ciphertext data to the network device, and receiving the first ciphertext data sent by the network device; Decrypting the first ciphertext data using a first preset key to obtain first plaintext data; the first ciphertext data is generated by the network device encrypting the first plaintext data using the first preset key; the first plaintext data includes a first random number, a first public key, and a signature result of the first random number; the signature result of the first random number is obtained by the network device signing the first random number using a first private key corresponding to the randomly generated first public key; The signature result of the first random number is verified using the first public key to achieve identity identification of the network device.

6. The terminal identity recognition method according to claim 5, characterized in that: After verifying the signature result of the first random number by using the first public key to identify the network device, the method further includes: The digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number is calculated using a third digest calculation method to obtain a second negotiated master key.

7. The terminal identity recognition method according to claim 6, characterized in that: After calculating the digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number using the third digest calculation method to obtain the second negotiated master key, the method further includes: Receiving the fingerprint information ciphertext sent by the network device; Decrypting the fingerprint information ciphertext using a third preset key to obtain the fingerprint information of the terminal; The fingerprint information is stored and set to an unreadable state.

8. The terminal identity recognition method according to claim 7, characterized in that: After storing the fingerprint information and setting the fingerprint information to an unreadable state, the method further includes: Calculating a digest of the overall data formed by the fingerprint information of the terminal, the first random number, and the second random number using a fourth digest calculation method to obtain a second dynamic dispersion factor; Dispersing the second negotiated master key based on the second dynamic dispersion factor to obtain a second dynamic shared key; the second dynamic shared key includes multiple subkeys; receiving a random number ciphertext sent by the network device, and decrypting the random number ciphertext using a second subkey to obtain a decryption result; wherein the random number ciphertext is obtained by encrypting the first random number by the network device using a first subkey, and the second subkey is a subkey in the second dynamic shared key that is the same as the first subkey; When the decryption result is the first random number, the security verification between the network device and the terminal is passed.

9. A terminal identity recognition device, characterized in that: include: A first sending module, configured to generate a first random number and send an identity recognition start instruction to a terminal; a first encryption module, configured to randomly generate a first public key and a first private key, sign the first random number using the first private key, and encrypt data consisting of the signature result of the first random number, the first public key, and the first random number using a first preset key to obtain first ciphertext data; an interaction module, configured to send the first ciphertext data to the terminal and receive second ciphertext data sent by the terminal; a decryption module, configured to decrypt the second ciphertext data using a second preset key to obtain second plaintext data; The second ciphertext data is formed by the terminal encrypting the second plaintext data using the second preset key; The second plaintext data includes a second random number, a second public key, and a signature result of the second random number; The signature result of the second random number is obtained by the terminal signing the second random number using a second private key corresponding to a randomly generated second public key; The signature verification module is used to verify the signature result of the second random number using the second public key to achieve identity recognition of the terminal.

10. The terminal identity recognition device according to claim 9, characterized in that: The device further comprises: The master key generation module is configured to calculate a digest of the overall data formed by the first public key, the second public key, the first random number, and the second random number using a first digest calculation method to obtain a first negotiated master key.

11. The terminal identity recognition device according to claim 10, characterized in that: The device further comprises: A second encryption module is used to encrypt the fingerprint information of the terminal using a third preset key to obtain a ciphertext of the fingerprint information; The second sending module is used to send the fingerprint information ciphertext to the terminal.

12. The terminal identity recognition device according to claim 11, characterized in that: The device further comprises: a dispersion factor generating module, configured to calculate a digest of overall data formed by the fingerprint information of the terminal, the first random number, and the second random number using a second digest calculation method to obtain a first dynamic dispersion factor; a dispersing module, configured to disperse the first negotiated master key based on the first dynamic dispersing factor to obtain a first dynamic shared key; the first dynamic shared key includes a plurality of subkeys; a third encryption module, configured to encrypt the first random number using a first subkey to obtain a random number ciphertext, wherein the first subkey is any subkey in the first dynamic shared key; The third sending module is used to send the random number ciphertext to the terminal, so that the terminal can perform security verification on the random number ciphertext.

13. A terminal identity recognition device, characterized in that: include: A first receiving module is used to receive a startup identity recognition instruction sent by a network device and generate a second random number; an encryption module, configured to randomly generate a second public key and a second private key, sign the second random number using the second private key, and encrypt the entire data consisting of the signature result of the second random number, the second public key, and the second random number using a second preset key to obtain second ciphertext data; An interaction module, configured to send the second ciphertext data to the network device, and receive the first ciphertext data sent by the network device; A first decryption module, configured to decrypt the first ciphertext data using a first preset key to obtain first plaintext data; The first ciphertext data is formed by the network device encrypting the first plaintext data using the first preset key; The first plaintext data includes a first random number, a first public key, and a signature result of the first random number; The signature result of the first random number is obtained by the network device signing the first random number using a first private key corresponding to a randomly generated first public key; The signature verification module is used to verify the signature result of the first random number using the first public key to achieve identity recognition of the network device.

14. The terminal identity recognition device according to claim 13, characterized in that: The device further comprises: The master key generation module is used to calculate the digest of the overall data formed by the first public key, the second public key, the first random number and the second random number by using a third digest calculation method to obtain a second negotiated master key.

15. The terminal identity recognition device according to claim 14, characterized in that: The device further comprises: A second receiving module, configured to receive the fingerprint information ciphertext sent by the network device; a second decryption module, configured to decrypt the fingerprint information ciphertext using a third preset key to obtain the fingerprint information of the terminal; The storage module is used to store the fingerprint information and set the fingerprint information to an unreadable state.

16. The terminal identity recognition device according to claim 15, characterized in that: The device further comprises: a dispersion factor generating module, configured to calculate a digest of overall data formed by the fingerprint information of the terminal, the first random number, and the second random number using a fourth digest calculation method to obtain a second dynamic dispersion factor; a dispersing module, configured to disperse the second negotiated master key based on the second dynamic dispersing factor to obtain a second dynamic shared key; the second dynamic shared key includes a plurality of subkeys; a third decryption module, configured to receive a random number ciphertext sent by the network device, and decrypt the random number ciphertext using a second subkey to obtain a decryption result; wherein the random number ciphertext is obtained by encrypting the first random number by the network device using a first subkey, and the second subkey is a subkey in the second dynamic shared key that is the same as the first subkey; The verification module is configured to verify that, when the decryption result is the first random number, the security verification between the network device and the terminal is passed.

17. A terminal identity recognition system, characterized in that: include: A network device that executes the terminal identity recognition method according to any one of claims 1 to 4, and a terminal that executes the terminal identity recognition method according to any one of claims 5 to 8.

18. A machine-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the terminal identity recognition method according to any one of claims 1 to 4 is implemented, or the terminal identity recognition method according to any one of claims 5 to 8 is implemented.

19. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the terminal identity recognition method according to any one of claims 1 to 4 is implemented, or the terminal identity recognition method according to any one of claims 5 to 8 is implemented.

Images