Equipment access management method and device, equipment and readable storage medium

Abstract

The invention discloses an equipment access management method and device, equipment and a readable storage medium, and the method comprises the steps: searching equipment information in a response range, and carrying out the registration verification of response equipment based on the searched equipment information; for the to-be-accessed device passing the registration verification, verifying the device legality of the to-be-accessed device by using a WAPI authentication server, and generating a signature token of the to-be-accessed device based on a built-in private key of the to-be-accessed device; sending the signature token to a WAPI authentication server for equipment verification, and after the equipment verification is passed, exchanging a random number and a public key parameter with the to-be-accessed equipment by adopting a WAPI protocol algorithm to generate a shared key for data transmission of the to-be-accessed equipment; and sending the shared key to the to-be-accessed device to complete the access of the to-be-accessed device. By introducing the WAPI authentication server, safe and efficient access of the to-be-accessed device is realized, and the defects of a traditional access method in the aspects of safety and expandability are overcome.

Description

Technical Field

[0001] The present application relates to the technical field of Internet of Things, and more specifically, to a device access management method, apparatus, device and readable storage medium. Background Art

[0002] The current device access network management system in the Internet of Things (IoT) environment mainly relies on the network layer or transport layer protocols (such as IP, TCP / IP) and application layer security protocols (such as SSL / TLS) in the Open System Interconnection (OSI) model. These technologies provide basic inter-device communication and data transmission capabilities, allowing devices to access the network and exchange data, but with the surge in the number of devices to be accessed and the increase in network security threats, traditional access methods have some defects.

[0003] First, in terms of device authentication, traditional methods often rely on simple username / password or pre-shared key (PSK) for authentication, which are vulnerable to brute force or man-in-the-middle attacks and cannot provide adequate security. Secondly, in terms of key negotiation and data transmission, although protocols such as SSL / TLS provide the ability to encrypt communications, due to their high complexity, they are not applicable to resource-constrained devices to be connected (such as low-power, low-computing power devices). In addition, traditional access methods have poor scalability and flexibility when implementing security management of large-scale devices to be connected, and are difficult to adapt to the rapid growth and diversified needs of the number of devices to be connected.

[0004] Based on this, the present application provides a device access management solution, which realizes the safe and efficient access of the device to be accessed, and solves the shortcomings of the traditional access method in terms of security and scalability. Summary of the invention

[0005] In view of this, the present application provides a device access management method, apparatus, device and readable storage medium, which, by introducing a WAPI authentication server, achieves secure and efficient access to devices to be accessed, and solves the deficiencies of traditional access methods in terms of security and scalability.

[0006] A device access management method, comprising:

[0007] Searching for device information within the response range, and performing registration verification on the responding device based on the device information obtained from the search;

[0008] For the device to be connected that has passed the registration verification, the WAPI authentication server is used to verify the legitimacy of the device to be connected, and a signature token of the device to be connected is generated based on the built-in private key of the device to be connected;

[0009] Send the signature token to the WAPI authentication server for device verification, and after the device verification passes, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be connected, and generate a shared key for data transmission of the device to be connected;

[0010] The shared key is sent to the device to be accessed, thereby completing the access of the device to be accessed.

[0011] Optionally, using a WAPI authentication server to verify the legitimacy of the device to be accessed, and generating a signature token of the device to be accessed based on a built-in key of the device to be accessed, includes:

[0012] Sending a device authentication request to a WAPI authentication server, and receiving an authentication token for the device to be authenticated returned by the WAPI authentication server after legitimacy verification, wherein the device authentication request includes a device ID and device attribute information of the device to be authenticated;

[0013] The authentication token is sent to the device to be authenticated, and a signature token is returned by the device to be authenticated, which is generated by signing the authentication token with a built-in private key.

[0014] Optionally, the process of the WAPI authentication server generating an authentication token for the device to be authenticated after legitimacy verification includes:

[0015] Querying the corresponding device certificate in the device certificate database according to the device ID, and verifying the validity of the device certificate;

[0016] Using public key cryptography to verify the legitimacy of the signature of the device certificate;

[0017] If the device certificate meets the timeliness requirement and the signature is legal, an authentication token for the device to be authenticated is generated based on the device attribute information.

[0018] Optionally, using a WAPI protocol algorithm to exchange a random number and a public key parameter with the device to be connected to generate a shared key for data transmission of the device to be connected, including:

[0019] Select and determine the key negotiation algorithm based on the WAPI protocol;

[0020] Receive a first random number and a first public key parameter sent by the device to be accessed, and return a second random number and a second public key parameter to the device to be accessed, wherein the first random number is generated by a first original random number randomly generated by the device to be accessed and signed by a private key of an asymmetric encryption algorithm, and the second random number is generated by a second original random number randomly generated locally and signed by a private key of a locally built-in asymmetric encryption algorithm;

[0021] Decrypting the first random number and the second random number using the first public key parameter and the second public key parameter respectively to obtain the first original random number and the second original random number;

[0022] The key agreement algorithm is used to calculate and obtain a shared key used for data transmission of the device to be connected in combination with the first original random number and the second original random number.

[0023] Optionally, performing registration verification on the responding device based on the device information obtained through the search includes:

[0024] Query whether the device information obtained by searching has been registered in the device information database;

[0025] The devices registered in the device information base are determined as the devices to be connected that have passed the registration verification, and registration guide information is sent to the devices not registered in the device information base.

[0026] Optionally, the process of the WAPI authentication server performing device verification based on the signature token includes:

[0027] Performing information integrity and format correctness detection on the signature token, and verifying the signature on the signature token using the public key of the device to be authenticated;

[0028] Performing content matching detection between the signature token and the authentication token of the device to be authenticated generated by the WAPI authentication server;

[0029] If the signature verification of the signature token succeeds and the content matches, query the corresponding target device certificate in the device certificate database according to the device ID in the signature token;

[0030] If the target device certificate is valid and the signature verification is passed, the device verification is passed.

[0031] Optionally, after completing the access of the device to be accessed, the method further includes:

[0032] When it is detected that the amount of transmitted data exceeds a preset update value or the usage time of the shared key has reached a preset maximum time limit, the shared key is updated and the old shared key is invalidated.

[0033] A device access management device, comprising:

[0034] A device search unit, used to search for device information within a response range, and perform registration verification on the responding device based on the device information obtained by the search;

[0035] A signature token unit, configured to verify the legitimacy of the device to be accessed by using a WAPI authentication server for the device to be accessed that has passed the registration verification, and to generate a signature token of the device to be accessed based on a built-in private key of the device to be accessed;

[0036] A shared key unit, used to send the signature token to the WAPI authentication server for device verification, and after the device verification is passed, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be connected, and generate a shared key for data transmission of the device to be connected;

[0037] The access control unit is used to send the shared key to the device to be accessed, so as to complete the access of the device to be accessed.

[0038] A device access management device comprises a memory and a processor;

[0039] The memory is used to store programs;

[0040] The processor is used to execute the program to implement each step of the device access management method as described in any one of the above items.

[0041] A readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, each step of the device access management method as described in any one of the above items is implemented.

[0042] It can be seen from the above technical solutions that the device access management method, apparatus, device and readable storage medium provided in the embodiments of the present application first search for device information within the response range, and perform registration verification on the responding device based on the device information obtained by the search. Secondly, for the device to be accessed that has passed the registration verification, the WAPI authentication server is used to verify the legitimacy of the device to be accessed, and a signature token of the device to be accessed is generated based on the built-in private key of the device to be accessed. Thereafter, the signature token is sent to the WAPI authentication server for device verification, and after the device verification passes, the WAPI protocol algorithm is used to exchange random numbers and public key parameters with the device to be accessed, and a shared key is generated for data transmission of the device to be accessed. Finally, the shared key is sent to the device to be accessed to complete the access of the device to be accessed.

[0043] In this application, the device must undergo registration verification and WAPI authentication server legitimacy verification before access, generate a unique signature token, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device, and generate a shared key for data transmission. Through device verification and authentication tokens, strong identity authentication of the device to be accessed is achieved, effectively preventing counterfeit devices and illegal access, and improving the security of the system.

[0044] This application supports the access and management of multiple devices to be connected. Through a unified interface and protocol, it can easily expand new device types and access methods, can adapt to the rapid growth and diversified needs of the number of devices to be connected, and has good scalability. In addition, compared with the existing technology, this application adopts a lightweight design concept and is easy to deploy and implement. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0046] Figure 1 A flowchart of a device access management method disclosed in an embodiment of the present application;

[0047] Figure 2 A schematic diagram of a device access management apparatus disclosed in an embodiment of the present application;

[0048] Figure 3 A hardware structure block diagram of a device access management device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0050] The present application can be used in many general or special computing device environments or configurations, such as personal computers, server computers, handheld or portable devices, tablet devices, multi-processor devices, distributed computing environments including any of the above devices or equipment, etc.

[0051] An embodiment of the present application provides a device access management method, which can be applied to a network management system, and can also be applied to various computer terminals or smart terminals. The execution subject can be a processor or server of the computer terminal or smart terminal.

[0052] Next, the present application scheme is introduced. The present application proposes the following technical scheme, please see below for details.

[0053] Figure 1This is a flowchart of a device access management method disclosed in an embodiment of the present application.

[0054] like Figure 1 As shown, the method may include:

[0055] Step S1: Search for device information within a response range, and perform registration verification on the responding device based on the device information obtained from the search.

[0056] Specifically, after the access device is turned on, it broadcasts its device information (including device ID, device type, etc.) so that the network management system can discover the device. Device information usually includes the device's unique identifier (device ID), device type (such as temperature sensor), manufacturer information, firmware version, etc. The network management system searches for device information within the response range, and after receiving the device information, it queries the device information database to determine whether the device has been registered. If it has been registered, it enters the device authentication stage; if it has not been registered, the user is prompted to register the device.

[0057] The process of registering and verifying the responding device based on the device information obtained through searching may specifically include:

[0058] ① Check whether the device information obtained by searching has been registered in the device information database;

[0059] ② Determine the devices registered in the device information database as the devices to be connected that have passed the registration verification, and send registration guidance information to the devices not registered in the device information database.

[0060] When the network management system (NMS) listens to the broadcast messages of the wireless network, it will receive the device information sent by the device to be connected. After receiving the broadcast information, the NMS will parse out the key information such as the device ID and device type, and compare it with the records in the device information library. After receiving the broadcast information, the NMS will parse out the key information such as the device ID and device type, and compare it with the records in the device information library.

[0061] If the NMS finds a device ID that matches the broadcast information in the device information database, it means that the device has been registered. The device registered in the device information database is determined as a to-be-accessed device that has passed the registration verification, and directly enters the device authentication phase.

[0062] If the NMS does not find a matching device ID in the device information library, it means that this is a new device and needs to be registered. At this time, a registration guide message will be sent to the device that is not registered in the device information library. The registration guide message can be a pop-up window on the user interface, an email notification, or other forms of notification. The notification will contain information on how to register a new device, such as the device information that needs to be filled in, the registration steps, etc. After the administrator or user receives the registration prompt, he or she will follow the steps in the prompt to register the device. This usually includes filling in the detailed information of the device (such as device name, location, purpose, etc.), and may include uploading the device's certificate or other verification documents. After the registration is completed, the NMS will add the information of the new device to the device information library.

[0063] Step S2: For the device to be connected that has passed the registration verification, the WAPI authentication server is used to verify the legitimacy of the device to be connected, and a signature token of the device to be connected is generated based on the built-in private key of the device to be connected.

[0064] Specifically, for devices that have passed registration verification, the network management system will further verify the legitimacy of the device. First, the network management system will send a device authentication request to the WAPI authentication server. This request contains the device ID of the device to be authenticated and other necessary related information so that the authentication server can accurately identify and authenticate the device.

[0065] When the WAPI authentication server receives this authentication request, it will immediately query the device certificate database based on the device ID. The purpose of this step is to verify the legitimacy of the device and ensure that it is not an unauthorized or counterfeit device. If the device has a legitimate record in the database, the authentication server will generate an authentication token, which is a proof of the legitimacy of the device. Subsequently, the authentication server returns this token to the network management system to continue the subsequent authentication process. On the contrary, if the device has no record in the database or the record is illegal, the authentication server will reject the authentication request and prevent the device from accessing the network management system.

[0066] After receiving the authentication token returned by the WAPI authentication server, the network management system will send it to the device to be connected. After receiving the token, the device to be connected will use its built-in private key to sign the token. This signing process ensures the integrity and authenticity of the token and prevents the token from being tampered with or forged during transmission. After completing the signature, the device to be connected will return the signed token to the network management system. In this way, the network management system obtains a signed token signed by the device to be connected to prove its legitimacy, which can further ensure the secure access and communication of the device.

[0067] Step S3: Send the signature token to the WAPI authentication server for device verification, and after the device verification passes, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be connected to generate a shared key for data transmission of the device to be connected.

[0068] Specifically, the signature token is sent to the WAPI authentication server for device verification, and after the verification is passed, the WAPI protocol algorithm is used to exchange random numbers and public key parameters with the device to be connected, and finally a shared key for data transmission is generated.

[0069] The process of the WAPI authentication server performing device verification based on the signature token includes:

[0070] ① Check the information integrity and format correctness of the signature token, and verify the signature on the signature token using the public key of the device to be authenticated;

[0071] ② Perform content matching detection on the signature token and the authentication token of the device to be authenticated generated by the WAPI authentication server;

[0072] ③ If the signature verification of the signature token is successful and the content matches, the corresponding target device certificate is queried in the device certificate database according to the device ID in the signature token;

[0073] ④ If the target device certificate is valid and the signature verification is passed, the device verification is passed.

[0074] The network management system will first send the previously generated signature token to the WAPI authentication server for device verification. After receiving the signature token, the WAPI authentication server will first check the information integrity and format correctness of the signature token to ensure that the token has not been tampered with or damaged during transmission. Then, the server will use the public key of the device to be authenticated to verify the signature on the signature token. This step can confirm that the signature is indeed generated by the device, thereby further proving the legitimacy of the device.

[0075] After completing the signature verification, the WAPI authentication server will also perform a content match test on the signature token and the authentication token of the device to be authenticated that was previously generated. Only when the signature verification of the signature token is successful and the content matches, the server will consider the device authentication to be successful. At this time, the server will query the corresponding target device certificate in the device certificate database based on the device ID in the signature token, and verify the timeliness of the certificate and the legitimacy of the signature again. Only when the target device certificate is timely and the signature verification is successful, the entire device authentication process is considered complete.

[0076] Once the device is authenticated, the network management system and the device to be connected can start calculating the shared key. Both parties will use the other party's public key to decrypt the random numbers sent by the other party, which are generated by each party. Then, both parties will use the two random numbers as input and apply a predetermined key agreement algorithm (such as the Diffie-Hellman key exchange algorithm or its variants) to calculate the shared key. This shared key will be the basis for subsequent data transmission and communication between the two parties.

[0077] To ensure the consistency of the shared key, both parties can also use a challenge-response mechanism to verify whether the generated shared key is the same. For example, one party can use the shared key to encrypt a piece of information and then send it to the other party for decryption. If the other party can correctly decrypt and restore the original information, then it can be confirmed that the shared key generated by both parties is consistent.

[0078] After the key negotiation is successful, the network management system and the device to be connected can use the shared key for subsequent data transmission and communication. When transmitting data, the data will be encrypted by the shared key to ensure the security and privacy of the data. After receiving the encrypted data, the receiver will use the same shared key to decrypt it and restore the original data. In this way, both parties can ensure the security and reliability of the data transmission process.

[0079] Step S4: Send the shared key to the device to be accessed, and complete the access of the device to be accessed.

[0080] Specifically, the network management system will send the shared key previously negotiated with the device to be connected to the device to ensure that both parties can use the same key for subsequent data transmission and communication. The transmission of the shared key is usually carried out through a secure and reliable communication channel to ensure that the key will not be leaked or tampered with during the transmission process.

[0081] Once the device to be connected receives the shared key, it can officially access the network management system. At this point, the device to be connected has completed all authentication and key negotiation processes and has the ability to communicate securely with the network management system.

[0082] Next, the device to be connected can start using the shared key for data transmission. Before transmitting data, the device to be connected will organize the data to be transmitted in a certain data format, such as a data packet or a data stream. Then, the device will use the previously negotiated shared key and the corresponding encryption algorithm (such as AES, DES, etc.) to encrypt the organized data. After encryption is completed, the device will generate a data unit containing the encrypted data, which usually includes a data header (such as data length, data type, etc.), an encrypted data body, and possible verification information.

[0083] The encrypted data unit will be sent to the network management system through the wireless local area network (WLAN). During the transmission process, the access device may perform packetization, retransmission, etc. according to the network conditions to ensure the integrity and reliability of the data. After receiving the encrypted data unit, the network management system will first perform a data integrity check (such as CRC check, MD5 check, etc.) to ensure that the data has not been damaged or tampered with during the transmission process.

[0084] If the data verification passes, the network management system will use the shared key and corresponding decryption algorithm previously negotiated with the device to be connected to decrypt the encrypted data body. After the decryption is successful, the network management system will obtain the original data sent by the device to be connected and perform subsequent processing or storage.

[0085] In addition, after completing the access of the device to be accessed, the following may also be included:

[0086] When it is detected that the amount of transmitted data exceeds a preset update value or the usage time of the shared key has reached a preset maximum time limit, the shared key is updated and the old shared key is invalidated.

[0087] Specifically, after the access of the device to be connected is completed, in order to ensure the security of data transmission and the validity of the key, the system can also set a shared key update mechanism. Specifically, when the system detects that the amount of transmitted data exceeds the preset update value, or the usage time of the shared key has reached the preset maximum time limit, the system will automatically trigger the shared key update mechanism. This mechanism is designed to deal with the security risks that may be brought about by the surge in data volume, and the potential threat of the key being cracked after long-term use.

[0088] When updating the shared key, the system will first generate a new key and send it to the connected device through a secure communication channel. At the same time, the system will invalidate the old shared key to ensure that it can no longer be used to encrypt and decrypt data. This step is crucial because it can effectively prevent the old key from being used maliciously, thereby protecting the integrity and confidentiality of the data.

[0089] Through such a key update mechanism, the system can continuously provide security for data transmission, and ensure the secure transmission of data and stable access of devices even in complex and changing network environments.

[0090] It can be seen from the above technical solutions that the device access management method, apparatus, device and readable storage medium provided in the embodiments of the present application first search for device information within the response range, and perform registration verification on the responding device based on the device information obtained by the search. Secondly, for the device to be accessed that has passed the registration verification, the WAPI authentication server is used to verify the legitimacy of the device to be accessed, and a signature token of the device to be accessed is generated based on the built-in private key of the device to be accessed. Thereafter, the signature token is sent to the WAPI authentication server for device verification, and after the device verification passes, the WAPI protocol algorithm is used to exchange random numbers and public key parameters with the device to be accessed, and a shared key is generated for data transmission of the device to be accessed. Finally, the shared key is sent to the device to be accessed to complete the access of the device to be accessed.

[0091] In this application, the device must undergo registration verification and WAPI authentication server legitimacy verification before access, generate a unique signature token, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device, and generate a shared key for data transmission. Through device verification and authentication tokens, strong identity authentication of the device to be accessed is achieved, effectively preventing counterfeit devices and illegal access, and improving the security of the system.

[0092] This application supports the access and management of multiple devices to be connected. Through a unified interface and protocol, it can easily expand new device types and access methods, can adapt to the rapid growth and diversified needs of the number of devices to be connected, and has good scalability. In addition, compared with the existing technology, this application adopts a lightweight design concept and is easy to deploy and implement.

[0093] In some embodiments of the present application, the process of using the WAPI authentication server to verify the legitimacy of the device to be accessed in step S2, and generating a signature token of the device to be accessed based on the built-in key of the device to be accessed is introduced, which may specifically include:

[0094] Step S21: Send a device authentication request to a WAPI authentication server, and receive an authentication token for the device to be authenticated returned by the WAPI authentication server after legitimacy verification. The device authentication request includes a device ID and device attribute information of the device to be authenticated.

[0095] Specifically, the process of the WAPI authentication server generating an authentication token for the device to be authenticated after legitimacy verification includes:

[0096] ① Query the corresponding device certificate in the device certificate database according to the device ID, and verify the validity of the device certificate;

[0097] ② Use public key cryptography technology to verify the legitimacy of the signature of the device certificate;

[0098] ③ If the device certificate meets the timeliness requirements and the signature is legal, an authentication token for the device to be authenticated is generated based on the device attribute information.

[0099] First, a device authentication request is sent to the WAPI authentication server (AS). This request contains the device ID of the device to be authenticated and related device attribute information. Once the WAPI authentication server receives this request, it will immediately begin to verify the legitimacy of the device. Specifically, the server will query the corresponding device certificate in the device certificate database based on the device ID, and carefully verify the timeliness of the certificate, including the issuance time, validity period, issuing agency and other information of the certificate, to ensure that the certificate has not been revoked or expired. At the same time, the server will also use public key cryptography technology to verify the legitimacy of the signature of the device certificate. This step can ensure that the certificate has not been tampered with during transmission. Only when the device certificate meets the timeliness requirements and the signature is legal, the WAPI authentication server will generate a unique authentication token based on the device attribute information and return this token to the network management system.

[0100] Step S22: Send the authentication token to the device to be authenticated, and receive a signature token returned by the device to be authenticated, which is generated by signing the authentication token with a built-in private key.

[0101] Specifically, the network management system will send the authentication token received from the WAPI authentication server to the device to be authenticated. After receiving the token, the device to be authenticated will use its built-in private key to sign the token. This signing process ensures the integrity and authenticity of the token, and also proves that the device does have the private key corresponding to its public key, thereby further verifying the legitimacy of the device. After completing the signature, the device will return the signed token to the network management system. This signed token not only contains the information of the authentication token, but also has the device's private key signature attached.

[0102] In the above process, the WAPI authentication server (AS) can effectively verify the legitimacy of the device to be connected, ensuring that only authenticated devices can access the network management system. This mechanism not only improves the security of the entire system, but also enhances the traceability and credibility of the device identity through the signature token.

[0103] In some embodiments of the present application, the process of using the WAPI protocol algorithm in step S3 to exchange random numbers and public key parameters with the device to be connected to generate a shared key for data transmission of the device to be connected is introduced, which may specifically include:

[0104] Step S31: Select and determine a key negotiation algorithm according to the WAPI protocol.

[0105] Specifically, first, both parties need to select and determine a suitable algorithm from a variety of available key negotiation algorithms according to the provisions of the WAPI protocol. The algorithm will serve as the basis for the subsequent calculation of the shared key. This selection process is usually based on comprehensive considerations of factors such as the security requirements, computing power, and algorithm characteristics of both parties. Key negotiation algorithms include, for example, the Diffie-Hellman key exchange algorithm or its variants.

[0106] Step S32: Receive a first random number and a first public key parameter sent by the device to be connected, and return a second random number and a second public key parameter to the device to be connected.

[0107] Specifically, the first random number is generated by a first original random number randomly generated by the access device and signed by a private key of an asymmetric encryption algorithm, and the second random number is generated by a second original random number randomly generated locally and signed by a private key of a locally built-in asymmetric encryption algorithm.

[0108] Next, the device to be connected and the network management system will exchange random numbers and public keys. The device to be connected will generate a random number and sign the random number with the private key of its asymmetric encryption algorithm (such as elliptic curve encryption algorithm) to ensure its integrity and authenticity. Then, the device will send the signed random number and public key to the network management system. After receiving this information, the network management system will also perform similar operations, generate a random number, sign the random number with its own asymmetric encryption algorithm private key, and then send the signed random number and public key to the device to be connected.

[0109] Step S33: Decrypt the first random number and the second random number using the first public key parameter and the second public key parameter respectively to obtain the first original random number and the second original random number.

[0110] Step S34: Utilize the key agreement algorithm, combine the first original random number and the second original random number, and calculate a shared key for data transmission of the device to be connected.

[0111] Specifically, after the two parties successfully exchange random numbers and public keys, the device to be connected will use the public key of the network management system to decrypt the random number sent by the network management system, and the network management system will also use the public key of the device to be connected to decrypt the random number sent by the device to be connected. In this way, both parties will obtain the random number of the other party. Then, the two parties will use these random numbers as input, apply the previously determined key negotiation algorithm, and finally calculate a common shared key.

[0112] A device access management apparatus provided in an embodiment of the present application is described below. The device access management apparatus described below and the device access management method described above can refer to each other.

[0113] See also Figure 2 , Figure 2 A schematic diagram of a device access management apparatus disclosed in an embodiment of the present application.

[0114] like Figure 2 As shown, the device access management apparatus may include:

[0115] The device search unit 110 is used to search for device information within the response range, and perform registration verification on the responding device based on the device information obtained by the search;

[0116] The signature token unit 120 is used to verify the legitimacy of the device to be connected by using the WAPI authentication server for the device to be connected that has passed the registration verification, and generate a signature token of the device to be connected based on the built-in private key of the device to be connected;

[0117] The shared key unit 130 is used to send the signature token to the WAPI authentication server for device verification, and after the device verification is passed, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be connected, and generate a shared key for data transmission of the device to be connected;

[0118] The access control unit 140 is used to send the shared key to the device to be accessed, so as to complete the access of the device to be accessed.

[0119] It can be seen from the above technical solutions that the device access management method, apparatus, device and readable storage medium provided in the embodiments of the present application first search for device information within the response range, and perform registration verification on the responding device based on the device information obtained by the search. Secondly, for the device to be accessed that has passed the registration verification, the WAPI authentication server is used to verify the legitimacy of the device to be accessed, and a signature token of the device to be accessed is generated based on the built-in private key of the device to be accessed. Thereafter, the signature token is sent to the WAPI authentication server for device verification, and after the device verification passes, the WAPI protocol algorithm is used to exchange random numbers and public key parameters with the device to be accessed, and a shared key is generated for data transmission of the device to be accessed. Finally, the shared key is sent to the device to be accessed to complete the access of the device to be accessed.

[0120] In this application, the device must undergo registration verification and WAPI authentication server legitimacy verification before access, generate a unique signature token, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device, and generate a shared key for data transmission. Through device verification and authentication tokens, strong identity authentication of the device to be accessed is achieved, effectively preventing counterfeit devices and illegal access, and improving the security of the system.

[0121] This application supports the access and management of multiple devices to be connected. Through a unified interface and protocol, it can easily expand new device types and access methods, can adapt to the rapid growth and diversified needs of the number of devices to be connected, and has good scalability. In addition, compared with the existing technology, this application adopts a lightweight design concept and is easy to deploy and implement.

[0122] Optionally, the process in which the signature token unit verifies the legitimacy of the device to be accessed by using a WAPI authentication server and generates a signature token of the device to be accessed based on a built-in key of the device to be accessed may include:

[0123] Sending a device authentication request to a WAPI authentication server, and receiving an authentication token for the device to be authenticated returned by the WAPI authentication server after legitimacy verification, wherein the device authentication request includes a device ID and device attribute information of the device to be authenticated;

[0124] The authentication token is sent to the device to be authenticated, and a signature token is returned by the device to be authenticated, which is generated by signing the authentication token with a built-in private key.

[0125] Optionally, the process of the WAPI authentication server generating an authentication token for the device to be authenticated after legitimacy verification may include:

[0126] Querying the corresponding device certificate in the device certificate database according to the device ID, and verifying the validity of the device certificate;

[0127] Using public key cryptography to verify the legitimacy of the signature of the device certificate;

[0128] If the device certificate meets the timeliness requirement and the signature is legal, an authentication token for the device to be authenticated is generated based on the device attribute information.

[0129] Optionally, the process in which the shared key unit uses a WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be connected to generate a shared key for data transmission of the device to be connected may include:

[0130] Select and determine the key negotiation algorithm based on the WAPI protocol;

[0131] Receive a first random number and a first public key parameter sent by the device to be accessed, and return a second random number and a second public key parameter to the device to be accessed, wherein the first random number is generated by a first original random number randomly generated by the device to be accessed and signed by a private key of an asymmetric encryption algorithm, and the second random number is generated by a second original random number randomly generated locally and signed by a private key of a locally built-in asymmetric encryption algorithm;

[0132] Decrypting the first random number and the second random number using the first public key parameter and the second public key parameter respectively to obtain the first original random number and the second original random number;

[0133] The key agreement algorithm is used to calculate and obtain a shared key used for data transmission of the device to be connected in combination with the first original random number and the second original random number.

[0134] Optionally, the device search unit performs a process of registering and verifying the responding device based on the device information obtained through the search, which may include:

[0135] Query whether the device information obtained by searching has been registered in the device information database;

[0136] The devices registered in the device information base are determined as the devices to be connected that have passed the registration verification, and registration guide information is sent to the devices not registered in the device information base.

[0137] Optionally, the process of the WAPI authentication server performing device verification based on the signature token includes:

[0138] Performing information integrity and format correctness detection on the signature token, and verifying the signature on the signature token using the public key of the device to be authenticated;

[0139] Performing content matching detection between the signature token and the authentication token of the device to be authenticated generated by the WAPI authentication server;

[0140] If the signature verification of the signature token succeeds and the content matches, query the corresponding target device certificate in the device certificate database according to the device ID in the signature token;

[0141] If the target device certificate is valid and the signature verification is passed, the device verification is passed.

[0142] Optionally, the present application also includes a key update unit, which is used to update the shared key and invalidate the old shared key after completing the access of the device to be accessed, when it is detected that the amount of transmitted data exceeds the preset update value or the shared key usage time has reached the preset maximum time limit.

[0143] The device access management apparatus provided in the embodiment of the present application can be applied to a device access management device. Figure 3 The hardware structure diagram of the device access management device is shown in FIG. Figure 3 , the hardware structure of the device access management device may include: at least one processor 1, at least one communication interface 2, at least one memory 3 and at least one communication bus 4;

[0144] In the embodiment of the present application, the number of the processor 1, the communication interface 2, the memory 3, and the communication bus 4 is at least one, and the processor 1, the communication interface 2, and the memory 3 communicate with each other through the communication bus 4;

[0145] The processor 1 may be a central processing unit CPU, or an application-specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present invention, etc.;

[0146] The memory 3 may include a high-speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory;

[0147] The memory stores a program, and the processor can call the program stored in the memory, and the program is used to:

[0148] Searching for device information within the response range, and performing registration verification on the responding device based on the device information obtained from the search;

[0149] For the device to be connected that has passed the registration verification, the WAPI authentication server is used to verify the legitimacy of the device to be connected, and a signature token of the device to be connected is generated based on the built-in private key of the device to be connected;

[0150] Send the signature token to the WAPI authentication server for device verification, and after the device verification passes, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be connected, and generate a shared key for data transmission of the device to be connected;

[0151] The shared key is sent to the device to be accessed, thereby completing the access of the device to be accessed.

[0152] Optionally, the detailed functions and extended functions of the program may refer to the above description.

[0153] The embodiment of the present application further provides a readable storage medium, which may store a program suitable for execution by a processor, wherein the program is used to:

[0154] Searching for device information within the response range, and performing registration verification on the responding device based on the device information obtained from the search;

[0155] For the device to be connected that has passed the registration verification, the WAPI authentication server is used to verify the legitimacy of the device to be connected, and a signature token of the device to be connected is generated based on the built-in private key of the device to be connected;

[0156] Send the signature token to the WAPI authentication server for device verification, and after the device verification passes, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be connected, and generate a shared key for data transmission of the device to be connected;

[0157] The shared key is sent to the device to be accessed, thereby completing the access of the device to be accessed.

[0158] Optionally, the detailed functions and extended functions of the program may refer to the above description.

[0159] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0160] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0161] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A device access management method, characterized in that: include: Searching for device information within the response range, and performing registration verification on the responding device based on the device information obtained from the search; For the device to be connected that has passed the registration verification, the WAPI authentication server is used to verify the legitimacy of the device to be connected, and a signature token of the device to be connected is generated based on the built-in private key of the device to be connected; Send the signature token to the WAPI authentication server for device verification, and after the device verification passes, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be connected, and generate a shared key for data transmission of the device to be connected; The shared key is sent to the device to be accessed, thereby completing the access of the device to be accessed.

2. The method according to claim 1, characterized in that Verifying the legitimacy of the device to be accessed by using the WAPI authentication server, and generating a signature token of the device to be accessed based on the built-in key of the device to be accessed, including: Sending a device authentication request to a WAPI authentication server, and receiving an authentication token for the device to be authenticated returned by the WAPI authentication server after legitimacy verification, wherein the device authentication request includes a device ID and device attribute information of the device to be authenticated; The authentication token is sent to the device to be authenticated, and a signature token is returned by the device to be authenticated, which is generated by signing the authentication token with a built-in private key.

3. The method according to claim 2, characterized in that The process of the WAPI authentication server generating an authentication token for the device to be authenticated after legitimacy verification includes: Querying the corresponding device certificate in the device certificate database according to the device ID, and verifying the validity of the device certificate; Using public key cryptography to verify the legitimacy of the signature of the device certificate; If the device certificate meets the timeliness requirement and the signature is legal, an authentication token for the device to be authenticated is generated based on the device attribute information.

4. The method according to claim 1, characterized in that: Using the WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be connected, and generating a shared key for data transmission of the device to be connected, including: Select and determine the key negotiation algorithm based on the WAPI protocol; Receive a first random number and a first public key parameter sent by the device to be accessed, and return a second random number and a second public key parameter to the device to be accessed, wherein the first random number is generated by a first original random number randomly generated by the device to be accessed and signed by a private key of an asymmetric encryption algorithm, and the second random number is generated by a second original random number randomly generated locally and signed by a private key of a locally built-in asymmetric encryption algorithm; Decrypting the first random number and the second random number using the first public key parameter and the second public key parameter respectively to obtain the first original random number and the second original random number; The key agreement algorithm is used to calculate and obtain a shared key used for data transmission of the device to be connected in combination with the first original random number and the second original random number.

5. The method according to claim 1, characterized in that Performing registration verification on the responding device based on the device information obtained through searching includes: Query whether the device information obtained by searching has been registered in the device information database; The devices registered in the device information base are determined as the devices to be connected that have passed the registration verification, and registration guide information is sent to the devices not registered in the device information base.

6. The method according to claim 1, characterized in that The process of the WAPI authentication server performing device verification based on the signature token includes: Performing information integrity and format correctness detection on the signature token, and verifying the signature on the signature token using the public key of the device to be authenticated; Performing content matching detection between the signature token and the authentication token of the device to be authenticated generated by the WAPI authentication server; If the signature verification of the signature token succeeds and the content matches, query the corresponding target device certificate in the device certificate database according to the device ID in the signature token; If the target device certificate is valid and the signature verification is passed, the device verification is passed.

7. The method according to claim 1, characterized in that After completing the access of the device to be accessed, the method further includes: When it is detected that the amount of transmitted data exceeds a preset update value or the usage time of the shared key has reached a preset maximum time limit, the shared key is updated and the old shared key is invalidated.

8. A device access management device, characterized in that: include: A device search unit, used to search for device information within a response range, and perform registration verification on the responding device based on the device information obtained by the search; A signature token unit, configured to verify the legitimacy of the device to be accessed by using a WAPI authentication server for the device to be accessed that has passed the registration verification, and to generate a signature token of the device to be accessed based on a built-in private key of the device to be accessed; A shared key unit, used to send the signature token to the WAPI authentication server for device verification, and after the device verification is passed, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be connected, and generate a shared key for data transmission of the device to be connected; The access control unit is used to send the shared key to the device to be accessed, so as to complete the access of the device to be accessed.

9. A device access management device, characterized in that: including memory and processor; The memory is used to store programs; The processor is used to execute the program to implement each step of the device access management method according to any one of claims 1 to 7.

10. A readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, each step of the device access management method according to any one of claims 1 to 7 is implemented.

Images