Equipment authentication method and device
By obtaining encryption seeds and encrypting symmetric keys with authentication public keys, the authentication and authentication process between client devices and server devices is simplified, and the complex and cumbersome problems of authentication and authentication in the existing technology are solved, and efficiency and security are improved. .
Patent Information
- Application Number
- CN202310804325.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-06-30
- Publication Date
- 2024-12-31
AI Technical Summary
The prior art requires different authentication methods for different systems before the information interaction between client devices and server devices, which leads to the complex and cumbersome and time-consuming process, affecting efficiency and security.
By obtaining the encryption seed and using the authentication public key to encrypt the symmetric key, a key ciphertext is generated, and then processed and sent to the server device. The ciphertext is received and compared to confirm that the authentication is passed, simplifying the authentication process and improving the Security.
The authentication and authentication process is simplified, efficiency and security are improved, and the authentication method requirements of different systems are avoided, which enhances the confidentiality of data transmission.
Smart Images
Figure CN119232361A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of information processing technology, and in particular to a device authentication method and apparatus. Background Art
[0002] In order to avoid information leakage when the client device and the server device exchange information for different services, the client device and the server device will be authenticated before the information exchange. At present, since the client device is often composed of multiple different systems, the data used by each system is different, resulting in different authentication methods. For example, before writing data to the vehicle before leaving the factory, when authenticating the information writer, since there are multiple control units in the vehicle, such as the domain control unit, smart cockpit unit, and smart driving unit, each unit needs to write its corresponding data.
[0003] Therefore, before the client device and the server device exchange information, it is necessary to adopt corresponding authentication schemes for different systems of different client devices according to actual conditions to ensure the security of information interaction. For example, vehicle A runs system 1 and system 2, so it is necessary to adopt their respective corresponding authentication methods. For example, system 1 of vehicle A adopts a pre-stored password table decryption authentication method, and system 2 adopts a hash value comparison authentication method. Therefore, when setting an authentication scheme for vehicle A, the server side also needs to consider the authentication methods adopted by different client systems.
[0004] Since the above scheme is adopted, during the authentication process, the server side will adjust the authentication scheme according to the multiple authentication methods adopted by different systems, which makes the authentication process complicated and time-consuming. Summary of the invention
[0005] In view of this, the embodiments of the present application provide a device authentication method and apparatus for simplifying the authentication process and improving the authentication efficiency and security.
[0006] In a first aspect, an embodiment of the present application provides a device authentication method, including:
[0007] In response to receiving an authentication instruction sent by the server device, obtaining an encryption seed, wherein the encryption seed includes a preset number of characters;
[0008] Use the authentication public key to encrypt the symmetric key and obtain the key ciphertext;
[0009] Processing the key ciphertext and the encryption seed to obtain a first result, and sending the first result to the server device;
[0010] Receiving a first ciphertext sent by the server device;
[0011] When the first ciphertext is identical to the second ciphertext, it is determined that the authentication is successful and data transmission is performed; the second ciphertext is obtained by encrypting the encryption seed with the symmetric key.
[0012] As an optional implementation of the embodiment of the present application, the step of obtaining the encrypted seed in response to receiving the authentication instruction sent by the server device includes:
[0013] In response to receiving an authentication instruction sent by the server device, a group of random characters is obtained as the encryption seed.
[0014] As an optional implementation of the embodiment of the present application, the step of processing the key ciphertext and the encryption seed to obtain a first result includes:
[0015] The first data of the key ciphertext and the second data of the encryption seed are concatenated to generate the first result; the first data of the key ciphertext is the data header or data tail of the key ciphertext, and the second data of the encryption seed is the data header or data tail of the encryption seed.
[0016] As an optional implementation of the embodiment of the present application, before obtaining the encrypted seed in response to receiving the authentication instruction sent by the server device, the method further includes:
[0017] Determining whether the symmetric key exists;
[0018] If not, the symmetric key is generated and saved based on the hardware security module HSM.
[0019] As an optional implementation of the embodiment of the present application, before encrypting the symmetric key with the authentication public key to obtain the key ciphertext, the following steps are included:
[0020] Receive the authentication public key sent by the server device.
[0021] In a second aspect, an embodiment of the present application provides a device authentication method, including:
[0022] Receiving a first result sent by a client device; the first result is obtained based on a key ciphertext and an encryption seed; the key ciphertext is obtained by encrypting a symmetric key using an authentication public key;
[0023] Processing the first result to obtain the key ciphertext and the encryption seed;
[0024] Decrypt the key ciphertext using the authentication private key to obtain the symmetric key;
[0025] The encryption seed is encrypted using the symmetric key to obtain a first ciphertext and the first ciphertext is sent to a client device.
[0026] As an optional implementation of the embodiment of the present application, the processing of the first result to obtain the key ciphertext and the encryption seed includes:
[0027] The first data of the key ciphertext and the second data of the encryption seed in the first result are split to obtain the key ciphertext and the encryption seed; the first data of the key ciphertext is the data header or data tail of the key ciphertext, and the second data of the encryption seed is the data header or data tail of the encryption seed.
[0028] As an optional implementation of the embodiment of the present application, before receiving the first result sent by the client device, the method further includes:
[0029] Generate an authentication private key and an authentication public key, and send the authentication public key to the client device.
[0030] In a third aspect, an embodiment of the present application provides a device authentication apparatus, including:
[0031] An acquiring unit, configured to acquire an encryption seed in response to receiving an authentication instruction sent by the server device, wherein the encryption seed includes a preset number of characters;
[0032] An encryption unit, used to encrypt the symmetric key using the authentication public key to obtain the key ciphertext;
[0033] a sending unit, configured to process the key ciphertext and the encryption seed to obtain a first result, and send the first result to the server device;
[0034] A receiving unit, configured to receive a first ciphertext sent by the server device;
[0035] A determination unit is used to determine that the authentication is successful and perform data transmission when the first ciphertext is the same as the second ciphertext; the second ciphertext is obtained by encrypting the encryption seed with the symmetric key.
[0036] As an optional implementation of the embodiment of the present application, the acquisition unit is specifically used to obtain a group of random characters as the encryption seed in response to receiving an authentication instruction sent by the server device.
[0037] As an optional implementation of an embodiment of the present application, the sending unit is specifically used to concatenate the first data of the key ciphertext and the second data of the encryption seed to generate the first result; the first data of the key ciphertext is the data header or data tail of the key ciphertext, and the second data of the encryption seed is the data header or data tail of the encryption seed.
[0038] As an optional implementation of the embodiment of the present application, the device authentication apparatus further includes: a determination unit, which is specifically used to determine whether the symmetric key exists; if not, generating and saving the symmetric key based on a hardware security module HSM.
[0039] As an optional implementation of the embodiment of the present application, the receiving unit is also used to receive the authentication public key sent by the server device.
[0040] In a fourth aspect, an embodiment of the present application provides a device authentication apparatus, including:
[0041] A receiving unit, configured to receive a first result sent by a client device; the first result is obtained based on a key ciphertext and an encryption seed; the key ciphertext is obtained by encrypting a symmetric key using an authentication public key;
[0042] an acquiring unit, configured to process the first result to acquire the key ciphertext and the encryption seed;
[0043] A decryption unit, used to decrypt the key ciphertext using the authentication private key to obtain a symmetric key;
[0044] The sending unit is used to encrypt the encryption seed by using the symmetric key, obtain a first ciphertext, and send the first ciphertext to the client device.
[0045] As an optional implementation of an embodiment of the present application, the acquisition unit is specifically used to split the first data of the key ciphertext and the second data of the encryption seed in the first result to obtain the key ciphertext and the encryption seed; the first data of the key ciphertext is the data header or data tail of the key ciphertext, and the second data of the encryption seed is the data header or data tail of the encryption seed.
[0046] As an optional implementation of the embodiment of the present application, the sending unit is also used to generate an authentication private key and an authentication public key, and send the authentication public key to the client device.
[0047] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a memory and a processor, wherein the memory is used to store a computer program; and the processor is used to enable the electronic device to implement the device authentication method described in any one of the above embodiments when executing the computer program.
[0048] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a computing device, the computing device implements the device authentication method described in any one of the above embodiments.
[0049] In a seventh aspect, an embodiment of the present application provides a vehicle, comprising: the client device or the electronic device described in the fifth aspect.
[0050] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages:
[0051] The authentication method provided in the embodiment of the present application is specifically as follows: in response to receiving an authentication instruction sent by a server device, an encryption seed is obtained; the symmetric key is encrypted using an authentication public key to obtain a key ciphertext; the key ciphertext and the encryption seed are processed to obtain a first result, and the first result is sent to the server device; the first ciphertext sent by the server device is received; when the first ciphertext is the same as the second ciphertext, it is determined that the authentication is successful and data is transmitted; the second ciphertext is obtained by encrypting the encryption seed with the symmetric key. In the embodiment of the present application, the client device encrypts the symmetric key through the authentication public key to generate a key ciphertext, and generates a first result based on the key ciphertext and the encryption seed, and sends the first result to the server, then receives the first ciphertext sent by the server, and compares it with the second ciphertext. If the first ciphertext is the same as the second ciphertext, the authentication is successful. The embodiment of the present application not only avoids the need to consider the authentication methods used by different systems in the client device, but also the need to perform corresponding authentication schemes on the server side, thereby simplifying the authentication process and improving the efficiency of authentication. At the same time, by using the authentication public key on the client to encrypt the symmetric key, obtaining the key ciphertext, and then sending the key ciphertext to the server device, the authentication process is made more confidential and difficult to be cracked, thereby improving the security of authentication. BRIEF DESCRIPTION OF THE DRAWINGS
[0052] The accompanying drawings herein are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the description, are used to explain the principles of the present application.
[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0054] Figure 1 A scenario architecture diagram of a device authentication method provided in an embodiment of the present application;
[0055] Figure 2 One of the step flow charts of the device authentication method provided in the embodiment of the present application;
[0056] Figure 3 The second step flow chart of the device authentication method provided in the embodiment of the present application;
[0057] Figure 4 The third step flow chart of the device authentication method provided in the embodiment of the present application;
[0058] Figure 5 A flowchart of the interactive steps of the device authentication method provided in the embodiment of the present application;
[0059] Figure 6 One of the structural schematic diagrams of the data transmission device provided in the embodiment of the present application;
[0060] Figure 7 The second structural diagram of the device authentication device provided in the embodiment of the present application;
[0061] Figure 8 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0062] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.
[0063] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.
[0064] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete way. In addition, in the description of the embodiments of the present application, unless otherwise specified, the meaning of "multiple" refers to two or more.
[0065] It should be noted that, in this article, the term "comprises" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.
[0066] The following first describes the scenario architecture of the instance scheduling method provided in the embodiment of the present application.
[0067] The use scenario of a device authentication method provided in an embodiment of the present application may be: before different factories inject information into various client devices, or when diagnosing, testing, or transmitting information to various client devices, in order to ensure that important information is not leaked, the device authentication method provided in an embodiment of the present application may be used to perform device authentication;
[0068] Reference Figure 1 As shown, the scenario architecture of the example scheduling method provided in the embodiment of the present application includes: a client device 100 and a server device 200; the client device 100 can be various client devices such as vehicles, computers, and home appliances; the server device 200 can be a server cluster or multiple server clusters, which can include one or more types of servers. When the client device 100 receives the authentication instruction, it can communicate data with the server device 200. The client device 100 can be allowed to communicate with the server device 200 through a local area network (LAN) or a wireless local area network (WLAN).
[0069] Based on the above content, the present application embodiment provides a device authentication method, referring to Figure 2 As shown, the device authentication method includes the following steps S201 to S205:
[0070] S201. In response to receiving an authentication instruction sent by a server device, an encryption seed is obtained, where the encryption seed includes a preset number of characters.
[0071] In some embodiments, the encryption seed is also called a random seed; specifically, the encryption seed may be an encryption seed generated by a hardware security module (HSM) on a client device. The encryption seed may be a 32-byte encryption seed, which may be a string of 32-byte random characters. For example, the encryption seed may be: "37k955798XS47e531 / 24503=7236nk88!".
[0072] Among them, the hardware security module is a computer device used to protect and manage the keys and sensitive data used by the strong authentication system, and at the same time provide related cryptographic operations. The hardware security module is a hardware device used for security operations such as encryption, decryption, signing and verification, and is usually used to protect sensitive information and digital assets. Ensure that only authorized recipients or applications can get the data. At the same time, HSM will also provide a secure data decryption method to ensure the confidentiality and authenticity of the message.
[0073] S202: Encrypt the symmetric key using the authentication public key to obtain the key ciphertext.
[0074] In some embodiments, the authentication public key can be a public key in a pair of asymmetric authentication public-private keys generated based on the asymmetric encryption algorithm RSA (Ron Rivest, AdiShamir, Leonard Adleman), consisting of 617 decimal digits, a total of 2048 bits; it is currently the most influential public key encryption algorithm, using an asymmetric cryptographic system, and has been recommended by the International Organization for Standardization (ISO) as a public key data encryption standard.
[0075] In an embodiment of the present application, the use of the authentication public key to encrypt the symmetric key is based on the PKCS1 mode under the RSA algorithm, which uses the Padding filling mode to encrypt the symmetric key; when the RSA_PKCS1_Padding filling mode is used, the encrypted information plaintext must be 128 bytes. If the plaintext size does not meet 128 bytes, some data will be randomly filled in the plaintext during encryption, so the result of each encryption of the same plaintext will be different. The encrypted ciphertext can be decrypted as long as the same filling method is used. The decrypted plaintext is the plaintext encrypted before. Therefore, in an embodiment of the present application, the symmetric key is directly set to a 128-byte key, that is, the symmetric key is 128 bits (Bit). When encrypting the symmetric key, there is no need to randomly fill in data, and encryption can be performed directly.
[0076] In some embodiments, the method for obtaining the authentication public key may be as follows:
[0077] Receive the authentication public key sent by the server device.
[0078] In an embodiment of the present application, before receiving the authentication instruction sent by the server device, the hardware security module HSM of the server device can generate a pair of asymmetric keys, including an authentication public key and an authentication private key, and then the server device sends the authentication public key to the client device, and the server device retains the authentication private key; specifically, the process of encrypting and decrypting corresponding information using asymmetric keys can be: when the client device and the server device perform authentication and certification, the client device can use the authentication public key to encrypt the corresponding information to obtain a ciphertext, and send the ciphertext to the server device. The server device can use the authentication private key to decrypt the ciphertext and obtain the corresponding information, thereby realizing encrypted transmission of data and avoiding data leakage.
[0079] In some embodiments, the symmetric key can be a symmetric key generated based on the Advanced Encryption Standard (AES) algorithm; specifically, the Advanced Encryption Standard AES algorithm is mainly divided into three implementation methods according to the different lengths of the AES symmetric key: AES-128, AES-192, and AES-256; 128, 192, and 256 respectively indicate that the length of the symmetric key is 128 bits (Bit), 192 bits (Bit), and 256 bits (Bit); among them, AES-128 is the most common implementation method of the symmetric encryption algorithm. In the embodiment of the present application, the AES-128 algorithm is used to generate the symmetric key, that is, the symmetric key is a 128-bit symmetric key.
[0080] The symmetric key is randomly generated by the hardware security module and is used in the subsequent authentication process.
[0081] In some embodiments, after the symmetric key is encrypted with the authentication public key, the key ciphertext is obtained, and the key ciphertext may be a ciphertext of 256 bytes. Specifically, the key ciphertext can only be decrypted by the authentication private key that is a pair of asymmetric keys with the authentication public key. Exemplarily, the authentication private key A that is a pair of asymmetric keys with the authentication public key A is sent to the corresponding client device. After the client device receives the ciphertext B generated by encrypting the symmetric key with the authentication public key A, the authentication private key A can be used to decrypt the ciphertext B and obtain the symmetric key to complete the encrypted transmission of data once, thereby improving the confidentiality of device authentication.
[0082] S203: Process the key ciphertext and the encryption seed to obtain a first result, and send the first result to the server device.
[0083] In some embodiments, the processing of the key ciphertext and the encryption seed to obtain the first result may be the first result obtained based on 256 bytes of key ciphertext and 32 bytes of encryption seed; the first result is composed of the 256 bytes of key ciphertext and the 32 bytes of encryption seed.
[0084] S204: Receive a first ciphertext sent by the server device.
[0085] In some embodiments, after the client device sends the first result to the server device in the above step S204, the server device analyzes and processes the first result, obtains a first ciphertext, and sends the first ciphertext to the client device.
[0086] S205: When the first ciphertext is identical to the second ciphertext, determine that the authentication is successful and perform data transmission.
[0087] The second ciphertext is obtained by encrypting the encryption seed with the symmetric key.
[0088] In some embodiments, the second ciphertext may be obtained by encrypting the encryption seed with the symmetric key and the client device encrypting the encryption seed in the above step S202 with the symmetric key.
[0089] Specifically, the method for encrypting the encryption seed with the symmetric key to obtain the second ciphertext may be based on the Electronic Code Book (ECB) mode under the AES algorithm, and the padding method may be No Padding, wherein the ECB mode divides the encrypted data into several groups, the size of each group is the same as the encryption key length, and then each group is encrypted with the same key. The No Padding means that if the data to be encrypted cannot be completely grouped, an error will be reported or an exception will be thrown, resulting in encryption failure.
[0090] Based on the AES algorithm, the same key needs to be used when encrypting and decrypting information; the sender of the ciphertext uses a symmetric key to encrypt the information and obtain the ciphertext, and the receiver of the ciphertext then uses the same symmetric key to decrypt the ciphertext and obtain the information; thereby achieving the purpose of keeping the information confidential.
[0091] It should be noted that in the embodiment of the present application, the implementation method of AES-128 based on the AES algorithm is adopted, and the 32-byte encryption seed is encrypted with a 128-bit symmetric key.
[0092] The authentication method provided in the embodiment of the present application is specifically as follows: in response to receiving an authentication instruction sent by a server device, an encryption seed is obtained; the symmetric key is encrypted using an authentication public key to obtain a key ciphertext; the key ciphertext and the encryption seed are processed to obtain a first result, and the first result is sent to the server device; the first ciphertext sent by the server device is received; when the first ciphertext is the same as the second ciphertext, it is determined that the authentication is successful and data is transmitted; the second ciphertext is obtained by encrypting the encryption seed with the symmetric key. In the embodiment of the present application, the client device encrypts the symmetric key through the authentication public key to generate a key ciphertext, and generates a first result based on the key ciphertext and the encryption seed, and sends the first result to the server, then receives the first ciphertext sent by the server, and compares it with the second ciphertext. If the first ciphertext is the same as the second ciphertext, the authentication is successful. The embodiment of the present application not only avoids the need to consider the authentication methods used by different systems in the client device, but also the need to perform corresponding authentication schemes on the server side, thereby simplifying the authentication process and improving the efficiency of authentication. At the same time, by using the authentication public key on the client to encrypt the symmetric key, obtaining the key ciphertext, and then sending the key ciphertext to the server device, the authentication process is made more confidential and difficult to be cracked, thereby improving the security of authentication.
[0093] As an extension and refinement of the above embodiment, refer to Figure 3 As shown, a device authentication method provided in an embodiment of the present application also includes the following steps S301 to S305:
[0094] S301. In response to receiving an authentication instruction sent by a server device, a group of random characters is obtained as the encryption seed.
[0095] In some embodiments, after responding to receiving the authentication instruction sent by the server device, the hardware security module of the client device will generate a set of random strings, which can be composed of uppercase and lowercase letters, symbols, and numbers to generate a 32-byte encryption seed; exemplarily, the encryption seed can also be: "d54efev7FD9K09=U5731 / DKl7Gb0mka5".
[0096] In some embodiments, before the above step S301 is performed, the device authentication method further includes the following steps 1 and 2:
[0097] Step 1: Determine whether the symmetric key exists.
[0098] In some embodiments, when a client device needs to be authenticated, it is first necessary to determine whether the symmetric key exists in the client device. If so, the symmetric key is used in subsequent processes; if not, the symmetric key is generated for subsequent use.
[0099] In the above step 1, if the symmetric key does not exist, execute the following step 2:
[0100] Step 2: Generate and save the symmetric key based on the hardware security module HSM.
[0101] In some embodiments, when the symmetric key does not exist in the client device, the hardware security module HSM will generate a 128-bit symmetric key based on the AES algorithm and save it in the client device for subsequent use.
[0102] S302: Encrypt the symmetric key using the authentication public key to obtain the key ciphertext.
[0103] In some embodiments, the encrypting of the symmetric key using the authentication public key may be: encrypting a 256-byte symmetric key (AES-128_key) with a 2048-bit authentication public key (RSA-2048_public_key) to obtain the key ciphertext.
[0104] S303: Concatenate the first data of the key ciphertext and the second data of the encryption seed to generate the first result.
[0105] The first data of the key ciphertext is a data header or a data tail of the key ciphertext, and the second data of the encryption seed is a data header or a data tail of the encryption seed.
[0106] In some embodiments, the first result can be generated by concatenating a 256-byte key ciphertext and a 32-byte encryption seed; the data header of the key ciphertext is the starting position of the key ciphertext, and the data header of the key ciphertext is the ending position of the key ciphertext; the data header of the encryption seed is the starting position of the encryption seed, and the data header of the encryption seed is the ending position of the encryption seed.
[0107] Specifically, the implementation method for concatenating the first data of the key ciphertext and the second data of the encryption seed to generate the first result may be: concatenating the data tail of the key ciphertext with the data header of the encryption seed, and obtaining the first result as: 256 bytes of key ciphertext + 32 bytes of encryption seed; the implementation method for generating the first result may also be: concatenating the data tail of the encryption seed with the data header of the key ciphertext, and obtaining the first result as: 32 bytes of encryption seed + 256 bytes of key ciphertext.
[0108] Exemplarily, when the key ciphertext is: “EWG1sdfa23F……JhertXV564CJ” and the encryption seed is “37k955798XS47e531 / 24503=7236nk88!”, the first result may be: “EWG1sdfa23F……JhertXV564CJ37k955798XS47e531 / 24503=7236nk88!”; the first result may also be “37k955798XS47e531 / 24503=7236nk88!EWG1sdfa23F……JhertXV564CJ”.
[0109] S304: Receive a first ciphertext sent by the server device.
[0110] In some embodiments, a communication link is established between the server device and the client device. After the server device sends the first ciphertext to the client device, the client device can receive the first ciphertext sent from the server device if the signal is normal.
[0111] S305: When the first ciphertext is identical to the second ciphertext, determine that the authentication is successful and perform data transmission.
[0112] The second ciphertext is obtained by encrypting the encryption seed with the symmetric key.
[0113] In some embodiments, after authentication is passed, data transmission can be performed. During the data transmission process, the data to be transmitted also needs to be encrypted to ensure information security.
[0114] The present application also provides another device authentication method, referring to Figure 4 As shown, the device authentication method includes the following steps S401 to S404:
[0115] S401: Receive a first result sent by a client device.
[0116] The first result is obtained based on the key ciphertext and the encryption seed; the key ciphertext is obtained by encrypting the symmetric key using the authentication public key.
[0117] In some embodiments, after the client device generates the first result, the client device sends the first result to the server device. After receiving the first result, the server device performs the following steps S402 to S404:
[0118] S402: Process the first result to obtain the key ciphertext and the encryption seed.
[0119] In some embodiments, the method of processing the first result in step S402 to obtain the key ciphertext and the encryption seed may include:
[0120] The first data of the key ciphertext and the second data of the encryption seed in the first result are split to obtain the key ciphertext and the encryption seed.
[0121] The first data of the key ciphertext is a data header or a data tail of the key ciphertext, and the second data of the encryption seed is a data header or a data tail of the encryption seed.
[0122] In the above embodiment, referring to the above step S304, in the client device, the first result is obtained by concatenating the key ciphertext and the encryption seed. Correspondingly, the first result can be split on the server to obtain the key ciphertext and the encryption seed.
[0123] Specifically, when the first result is: "key ciphertext + encryption seed", the first data of the key ciphertext is the data tail of the key ciphertext, and the second data of the encryption seed is the data header of the encryption seed; when the first result is: "encryption seed + key ciphertext", the first data of the key ciphertext is the data header of the key ciphertext, and the second data of the encryption seed is the data tail of the encryption seed; after splitting the first data of the key ciphertext and the second data of the encryption seed in the first result, the key ciphertext and the encryption seed can be obtained.
[0124] Exemplarily, when the first result formed by concatenating a 256-byte key ciphertext and a 32-byte encryption seed is "EWG1sdfa23F...JhertXV564CJ37k955798XS47e531 / 24503=7236nk88!", the first result is split to obtain the 256-byte key ciphertext "EWG1sdfa23F...JhertXV564CJ" and the 32-byte encryption seed "37k955798XS47e531 / 24503=7236nk88!".
[0125] S403: Decrypt the key ciphertext using the authentication private key to obtain the symmetric key.
[0126] In some embodiments, the key ciphertext is obtained by encrypting the symmetric key with the authentication public key of the client device, and can only be decrypted by the authentication private key that is a pair of asymmetric keys with the authentication public key of the client device. Therefore, at the initialization, the server device generates a pair of asymmetric keys: the authentication public key and the authentication private key, sends the authentication private key to the client device, and the authentication public key is retained in the server device. In this way, the server uses the authentication public key to encrypt the information to generate the ciphertext, and the client device uses the authentication private key to decrypt the ciphertext to obtain the information.
[0127] S404: Encrypt the encryption seed using the symmetric key to obtain a first ciphertext and send the first ciphertext to the client device.
[0128] In some embodiments, the server device uses the symmetric key obtained by decryption to encrypt the encrypted seed obtained by splitting the first result, obtain the first ciphertext, and send the first ciphertext to the client device. The client device can then use the symmetric key on the client device to encrypt the encrypted seed, obtain the second ciphertext, and then compare the first ciphertext with the second ciphertext. Based on whether the two ciphertexts are the same, it can be determined whether the server device can pass the authentication of the client device.
[0129] It should be noted that in the embodiments of the present application, if any step in the above embodiments fails, it means that the authentication process has failed, and the authentication process is immediately terminated, and data interaction is stopped to ensure that data is not leaked.
[0130] As an extension and refinement of the above embodiment, refer to Figure 5 As shown, it is a flow chart of a device authentication method provided in an embodiment of the present application, including the following steps S501 to S509:
[0131] S501. In response to receiving an authentication instruction sent by a server device, the client device obtains an encryption seed, where the encryption seed includes a preset number of characters.
[0132] S502: The client device encrypts the symmetric key using the authentication public key to obtain the key ciphertext.
[0133] S503: The client device processes the key ciphertext and the encryption seed to obtain a first result, and sends the first result to the server device.
[0134] S504: The server device receives the first result sent by the client device.
[0135] The first result is obtained based on the key ciphertext and the encryption seed; the key ciphertext is obtained by encrypting the symmetric key using the authentication public key.
[0136] S505: The server device processes the first result to obtain the key ciphertext and the encryption seed.
[0137] S506: The server device decrypts the key ciphertext using the authentication private key to obtain the symmetric key.
[0138] S507: The server device encrypts the encryption seed using the symmetric key, obtains a first ciphertext, and sends the first ciphertext to the client device.
[0139] S508: The client device receives the first ciphertext sent by the server device.
[0140] S509: When the first ciphertext is identical to the second ciphertext, the client device determines that the authentication is successful and performs data transmission.
[0141] The second ciphertext is obtained by encrypting the encryption seed with the symmetric key.
[0142] Based on the same inventive concept, as an implementation of the above method, an embodiment of the present invention further provides a device authentication apparatus, which corresponds to the above method embodiment. For ease of reading, this embodiment will no longer repeat the details of the above method embodiment one by one, but it should be clear that the device authentication apparatus in this embodiment can correspond to all the contents in the above method embodiment.
[0143] The present application embodiment provides a device authentication apparatus, Figure 6 The schematic diagram of the device authentication device is as follows: Figure 6 As shown, the device authentication apparatus 600 includes:
[0144] The acquisition unit 601 is used to acquire an encryption seed in response to receiving an authentication instruction sent by the server device, where the encryption seed includes a preset number of characters;
[0145] The encryption unit 602 is used to encrypt the symmetric key using the authentication public key to obtain the key ciphertext;
[0146] A sending unit 603 is used to process the key ciphertext and the encryption seed to obtain a first result, and send the first result to the server device;
[0147] A receiving unit 604 is used to receive a first ciphertext sent by the server device;
[0148] The determination unit 605 is used to determine that the authentication is successful and perform data transmission when the first ciphertext is the same as the second ciphertext; the second ciphertext is obtained by encrypting the encryption seed with the symmetric key.
[0149] As an optional implementation of the embodiment of the present application, the acquisition unit 601 is specifically used to obtain a group of random characters as the encryption seed in response to receiving an authentication instruction sent by the server device.
[0150] As an optional implementation of an embodiment of the present application, the sending unit 603 is specifically used to concatenate the first data of the key ciphertext and the second data of the encryption seed to generate the first result; the first data of the key ciphertext is the data header or data tail of the key ciphertext, and the second data of the encryption seed is the data header or data tail of the encryption seed.
[0151] As an optional implementation of the embodiment of the present application, the determination unit 605 is further used to determine whether the symmetric key exists; if not, generate and save the symmetric key based on the hardware security module HSM.
[0152] As an optional implementation of the embodiment of the present application, the receiving unit 604 is further used to receive the authentication public key sent by the server device.
[0153] The present application also provides another device authentication device. Figure 7 The schematic diagram of the device authentication device is as follows: Figure 7 As shown, the device authentication apparatus 700 includes:
[0154] The receiving unit 701 is used to receive a first result sent by a client device; the first result is obtained based on a key ciphertext and an encryption seed; the key ciphertext is obtained by encrypting a symmetric key using an authentication public key;
[0155] An acquiring unit 702 is configured to process the first result to acquire the key ciphertext and the encryption seed;
[0156] A decryption unit 703, configured to decrypt the key ciphertext using the authentication private key to obtain a symmetric key;
[0157] The sending unit 704 is configured to encrypt the encryption seed by using the symmetric key, obtain a first ciphertext, and send the first ciphertext to the client device.
[0158] As an optional implementation of an embodiment of the present application, the acquisition unit 702 is specifically used to split the first data of the key ciphertext and the second data of the encryption seed in the first result to obtain the key ciphertext and the encryption seed; the first data of the key ciphertext is the data header or data tail of the key ciphertext, and the second data of the encryption seed is the data header or data tail of the encryption seed.
[0159] As an optional implementation of the embodiment of the present application, the sending unit 704 is further used to generate an authentication private key and an authentication public key, and send the authentication public key to the client device.
[0160] Based on the same inventive concept, an embodiment of the present application also provides an electronic device. Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Figure 8 As shown, the electronic device provided in this embodiment includes: a memory 801 and a processor 802, wherein the memory 801 is used to store a computer program; and the processor 802 is used to execute the device authentication method provided in the above embodiment when executing the computer program.
[0161] Based on the same inventive concept, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the computing device implements the device authentication method provided in the above embodiment.
[0162] Based on the same inventive concept, an embodiment of the present application further provides a vehicle, which includes the vehicle communication device provided by the above embodiment or the electronic device provided by the above embodiment.
[0163] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media that include computer-usable program code.
[0164] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.
[0165] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.
[0166] Computer readable media include permanent and non-permanent, removable and non-removable storage media. Storage media can be implemented by any method or technology to store information, and the information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.
[0167] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.
Claims
1. A device authentication method, characterized in that: include: In response to receiving an authentication instruction sent by the server device, obtaining an encryption seed, wherein the encryption seed includes a preset number of characters; Use the authentication public key to encrypt the symmetric key and obtain the key ciphertext; Processing the key ciphertext and the encryption seed to obtain a first result, and sending the first result to the server device; Receiving a first ciphertext sent by the server device; When the first ciphertext is identical to the second ciphertext, determining that the authentication is successful and performing data transmission; The second ciphertext is obtained by encrypting the encryption seed with the symmetric key.
2. The method according to claim 1, characterized in that The step of obtaining the encrypted seed in response to receiving the authentication instruction sent by the server device includes: In response to receiving an authentication instruction sent by the server device, a group of random characters is obtained as the encryption seed.
3. The method according to claim 1, characterized in that The processing of the key ciphertext and the encryption seed to obtain a first result includes: The first data of the key ciphertext and the second data of the encryption seed are concatenated to generate the first result; the first data of the key ciphertext is the data header or data tail of the key ciphertext, and the second data of the encryption seed is the data header or data tail of the encryption seed.
4. The method according to claim 1, characterized in that: Before obtaining the encrypted seed in response to receiving the authentication instruction sent by the server device, the method further includes: Determining whether the symmetric key exists; If not, the symmetric key is generated and saved based on the hardware security module HSM.
5. The method according to claim 1, characterized in that Before using the authentication public key to encrypt the symmetric key and obtain the key ciphertext, the following steps are performed: Receive the authentication public key sent by the server device.
6. A device authentication method, characterized in that: include: receiving a first result sent by a client device; The first result is obtained based on the key ciphertext and the encryption seed; the key ciphertext is obtained by encrypting the symmetric key using the authentication public key; Processing the first result to obtain the key ciphertext and the encryption seed; Decrypt the key ciphertext using the authentication private key to obtain the symmetric key; The encryption seed is encrypted using the symmetric key to obtain a first ciphertext and the first ciphertext is sent to a client device.
7. The method according to claim 6, characterized in that The step of processing the first result to obtain the key ciphertext and the encryption seed includes: The first data of the key ciphertext and the second data of the encryption seed in the first result are split to obtain the key ciphertext and the encryption seed; the first data of the key ciphertext is the data header or data tail of the key ciphertext, and the second data of the encryption seed is the data header or data tail of the encryption seed.
8. The method according to claim 6, characterized in that Before receiving the first result sent by the client device, the method further includes: An authentication private key and an authentication public key are generated, and the client device sends the authentication public key.
9. A device authentication apparatus, characterized in that: include: An acquiring unit, configured to acquire an encryption seed in response to receiving an authentication instruction sent by the server device, wherein the encryption seed includes a preset number of characters; An encryption unit, used to encrypt the symmetric key using the authentication public key to obtain the key ciphertext; a sending unit, configured to process the key ciphertext and the encryption seed to obtain a first result, and send the first result to the server device; A receiving unit, configured to receive a first ciphertext sent by the server device; A determination unit is used to determine that the authentication is successful and perform data transmission when the first ciphertext is the same as the second ciphertext; the second ciphertext is obtained by encrypting the encryption seed with the symmetric key.
10. A device authentication apparatus, characterized in that: include: A receiving unit, configured to receive a first result sent by a client device; The first result is obtained based on the key ciphertext and the encryption seed; the key ciphertext is obtained by encrypting the symmetric key using the authentication public key; an acquiring unit, configured to process the first result to acquire the key ciphertext and the encryption seed; A decryption unit, used to decrypt the key ciphertext using the authentication private key to obtain a symmetric key; The sending unit is used to encrypt the encryption seed by using the symmetric key, obtain a first ciphertext, and send the first ciphertext to the client device.
11. An electronic device, characterized in that: include: A memory and a processor, wherein the memory is used to store a computer program; and the processor is used to enable the electronic device to implement the device authentication method described in any one of claims 1 to 8 when executing the computer program.
12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a computing device, the computing device implements the device authentication method according to any one of claims 1 to 8.
13. A vehicle, characterized in that: include: The client device or the electronic device according to claim 11.