A device access management method, apparatus, device, and readable storage medium

Abstract

This application discloses a device access management method, apparatus, device, and readable storage medium, comprising: searching for device information within a response range and registering and verifying the responding devices based on the searched device information; for devices that have passed registration and verification, verifying the device legitimacy of the device using a WAPI authentication server and generating a signature token for the device based on the device's built-in private key; sending the signature token to the WAPI authentication server for device verification, and after successful device verification, exchanging random numbers and public key parameters with the device using the WAPI protocol algorithm to generate a shared key for data transmission of the device; and sending the shared key to the device to complete the access of the device. This application, by introducing a WAPI authentication server, achieves secure and efficient access for devices, overcoming the shortcomings of traditional access methods in terms of security and scalability.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) technology, and more specifically, to a device access management method, apparatus, device, and readable storage medium. Background Technology

[0002] Current device access network management systems in the Internet of Things (IoT) environment mainly rely on network layer or transport layer protocols (such as IP, TCP / IP) and application layer security protocols (such as SSL / TLS) in the Open Systems Interconnection (OSI) model. These technologies provide basic inter-device communication and data transmission capabilities, enabling devices to access the network and exchange data. However, with the surge in the number of devices to be accessed and the increase in network security threats, traditional access methods have some shortcomings.

[0003] First, regarding device authentication, traditional methods often rely on simple username / password or pre-shared key (PSK) authentication, which are vulnerable to brute-force or man-in-the-middle attacks and cannot provide sufficient security. Second, regarding key negotiation and data transmission, although protocols such as SSL / TLS provide encrypted communication capabilities, their high complexity makes them unsuitable for resource-constrained devices (such as low-power, low-computing-power devices). Furthermore, traditional access methods lack scalability and flexibility when managing a large number of devices, making it difficult to adapt to the rapid growth in the number of devices and their diverse needs.

[0004] Based on this, this application provides a device access management scheme that enables secure and efficient access for devices to be accessed, and solves the shortcomings of traditional access methods in terms of security and scalability. Summary of the Invention

[0005] In view of this, this application provides a device access management method, apparatus, device, and readable storage medium. By introducing a WAPI authentication server, it enables secure and efficient access for devices to be accessed, and solves the shortcomings of traditional access methods in terms of security and scalability.

[0006] A device access management method, comprising:

[0007] Search for device information within the response range, and register and verify the responding device based on the searched device information;

[0008] For the device to be accessed that has passed the registration verification, the WAPI authentication server is used to verify the device's legitimacy and generate a signature token for the device based on the device's built-in private key.

[0009] The signature token is sent to the WAPI authentication server for device verification. After the device verification is successful, the WAPI protocol algorithm is used to exchange random numbers and public key parameters with the device to be connected, and a shared key for data transmission of the device to be connected is generated.

[0010] The shared key is sent to the device to be connected, thus completing the connection of the device to be connected.

[0011] Optionally, the WAPI authentication server is used to verify the device legitimacy of the device to be accessed, and a signature token for the device to be accessed is generated based on the built-in key of the device to be accessed, including:

[0012] Send a device authentication request to the WAPI authentication server and receive an authentication token for the device to be authenticated returned by the WAPI authentication server after verification of its legitimacy. The device authentication request includes the device ID and device attribute information of the device to be authenticated.

[0013] The authentication token is sent to the device to be authenticated, and a signature token generated by signing the authentication token using the built-in private key is received from the device to be authenticated.

[0014] Optionally, the process by which the WAPI authentication server generates an authentication token for the device to be authenticated after legitimacy verification includes:

[0015] The device certificate is queried from the device certificate database based on the device ID, and the validity of the device certificate is verified.

[0016] The signature validity of the device certificate is verified using public-key cryptography.

[0017] If the device certificate meets the timeliness requirements and the signature is valid, an authentication token for the device to be authenticated is generated based on the device attribute information.

[0018] Optionally, a shared key for data transmission to the device to be accessed is generated by exchanging random numbers and public key parameters with the device using the WAPI protocol algorithm, including:

[0019] Select and determine the key negotiation algorithm according to the WAPI protocol;

[0020] The system receives a first random number and a first public key parameter sent by the device to be accessed, and returns a second random number and a second public key parameter to the device to be accessed. The first random number is generated by the device to be accessed randomly generating a first original random number and signing it with the private key of an asymmetric encryption algorithm. The second random number is generated by the device to be accessed randomly generating a second original random number and signing it with the private key of a locally built-in asymmetric encryption algorithm.

[0021] The first random number and the second random number are decrypted using the first public key parameter and the second public key parameter, respectively, to obtain the first original random number and the second original random number.

[0022] Using the key negotiation algorithm, combined with the first and second original random numbers, a shared key for data transmission of the device to be accessed is calculated.

[0023] Optionally, registration verification of the responding device is performed based on the device information obtained from the search, including:

[0024] Based on the device information obtained from the search, check whether it has been registered in the device information database;

[0025] Devices already registered in the device information database are identified as devices to be accessed after passing the registration verification, and registration guidance information is sent to devices not registered in the device information database.

[0026] Optionally, the process by which the WAPI authentication server performs device verification based on the signature token includes:

[0027] The signature token is checked for information integrity and format correctness, and the signature on the signature token is verified using the public key of the device to be authenticated;

[0028] The signature token is matched with the authentication token of the device to be authenticated generated by the WAPI authentication server to perform content matching detection.

[0029] If the signature token is successfully verified and the content matches, then the corresponding target device certificate is queried in the device certificate database based on the device ID in the signature token.

[0030] If the target device certificate is valid and the signature verification is successful, then the device verification is successful.

[0031] Optionally, after completing the connection of the device to be connected, the method further includes:

[0032] If the amount of transmitted data exceeds the preset update value or the shared key usage time has reached the preset maximum time limit, the shared key is updated and the old shared key is invalidated.

[0033] A device access management device, comprising:

[0034] The device search unit is used to search for device information within the response range and to register and verify the responding device based on the searched device information;

[0035] The signature token unit is used to verify the device legitimacy of the device to be accessed by the WAPI authentication server for the device to be accessed that has passed the registration verification, and to generate a signature token for the device to be accessed based on the built-in private key of the device to be accessed.

[0036] A shared key unit is used to send the signature token to the WAPI authentication server for device verification, and after the device verification is successful, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be connected to generate a shared key for data transmission of the device to be connected.

[0037] The access control unit is used to send the shared key to the device to be accessed, thereby completing the access of the device to be accessed.

[0038] A device access management device includes a memory and a processor;

[0039] The memory is used to store programs;

[0040] The processor is used to execute the program to implement the various steps of the device access management method as described in any of the preceding claims.

[0041] A readable storage medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the steps of the device access management method as described in any of the preceding claims.

[0042] As can be seen from the above technical solutions, the device access management method, apparatus, device, and readable storage medium provided in this application first search for device information within the response range and register and verify the responding device based on the searched device information. Secondly, for the device to be accessed that has passed the registration verification, the WAPI authentication server is used to verify the device's legitimacy, and a signature token for the device to be accessed is generated based on the device's built-in private key. Then, the signature token is sent to the WAPI authentication server for device verification. After successful device verification, the WAPI protocol algorithm is used to exchange random numbers and public key parameters with the device to be accessed, generating a shared key for data transmission by the device to be accessed. Finally, the shared key is sent to the device to be accessed, completing the access of the device to be accessed.

[0043] In this application, before access, the device must undergo registration verification and WAPI authentication server verification to generate a unique signature token. The WAPI protocol algorithm is then used to exchange random numbers and public key parameters with the device to generate a shared key for data transmission. Through device verification and authentication tokens, strong authentication of the device to be accessed is achieved, effectively preventing counterfeit devices and unauthorized access, and improving system security.

[0044] This application supports the access and management of various devices. Through a unified interface and protocol, it can easily expand to include new device types and access methods, adapting to the rapid growth in the number of devices and diverse needs, thus exhibiting good scalability. Furthermore, compared to existing technologies, this application adopts a lightweight design approach, making it easy to deploy and implement. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0046] Figure 1 This is a flowchart of a device access management method disclosed in an embodiment of this application;

[0047] Figure 2 This is a schematic diagram of a device access management device disclosed in an embodiment of this application;

[0048] Figure 3 This is a hardware structure block diagram of a device access management device disclosed in an embodiment of this application. Detailed Implementation

[0049] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0050] This application can be used in a wide variety of general-purpose or special-purpose computing device environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor devices, distributed computing environments including any of the above devices, etc.

[0051] This application provides a device access management method, which can be applied to a network management system or to various computer terminals or smart terminals. The executing entity can be the processor or server of the computer terminal or smart terminal.

[0052] The following section introduces the solution proposed in this application. The technical solution is as follows, and details are provided below.

[0053] Figure 1This is a flowchart of a device access management method disclosed in an embodiment of this application.

[0054] like Figure 1 As shown, the method may include:

[0055] Step S1: Search for device information within the response range, and perform registration verification on the response device based on the searched device information.

[0056] Specifically, after a connected device powers on, it broadcasts its device information (including device ID, device type, etc.) so that the network management system can discover the device. Device information typically includes the device's unique identifier (device ID), device type (e.g., temperature sensor), manufacturer information, firmware version, etc. The network management system searches for device information within its response range. Upon receiving device information, it queries the device information database to determine if the device is already registered. If registered, it proceeds to the device authentication stage; otherwise, it prompts the user to register the device.

[0057] The process of registering and verifying the responding device based on the device information obtained through the search may specifically include:

[0058] ① Check whether the device information obtained from the search has been registered in the device information database;

[0059] ② Identify devices that have already registered in the device information database as devices to be accessed after passing the registration verification, and send registration guidance information to devices that have not registered in the device information database.

[0060] When the Network Management System (NMS) listens for broadcast messages on the wireless network, it receives device information sent by devices seeking to connect. Upon receiving the broadcast information, the NMS parses out key information such as the device ID and device type, and compares it with records in the device information database.

[0061] If the NMS finds a device ID in the device information database that matches the broadcast information, it means that the device has already been registered. Devices already registered in the device information database are identified as devices to be accessed after passing the registration verification, and the process directly proceeds to the device authentication stage.

[0062] If NMS does not find a matching device ID in the device database, it indicates a new device that needs to be registered. In this case, a registration guide will be sent to the device not yet registered in the database. This guide can be a pop-up window on the user interface, an email notification, or other form of notification. The notification will contain information on how to register the new device, such as the required device information and registration steps. After receiving the registration prompts, the administrator or user will follow the steps to register the device. This typically involves filling in detailed device information (such as device name, location, purpose, etc.) and may include uploading the device's certificate or other verification documents. Once registration is complete, NMS will add the new device's information to the device database.

[0063] Step S2: For the device to be accessed that has passed the registration verification, the WAPI authentication server is used to verify the device legitimacy of the device to be accessed, and a signature token for the device to be accessed is generated based on the built-in private key of the device to be accessed.

[0064] Specifically, for devices that have already passed registration and verification, the network management system will further verify their legitimacy. First, the network management system will send a device authentication request to the WAPI authentication server. This request includes the device ID of the device to be authenticated and other necessary relevant information so that the authentication server can accurately identify and verify the device.

[0065] When the WAPI authentication server receives this authentication request, it immediately queries the device certificate database based on the device ID. This step verifies the device's legitimacy, ensuring it is not an unauthorized or counterfeit device. If the device has a valid record in the database, the authentication server generates an authentication token, which serves as proof of the device's legitimacy. The authentication server then returns this token to the network management system to continue the subsequent authentication process. Conversely, if the device has no record in the database or the record is invalid, the authentication server rejects the authentication request, preventing the device from accessing the network management system.

[0066] After receiving the authentication token from the WAPI authentication server, the network management system sends it to the device to be connected. Upon receiving the token, the device signs it using its built-in private key. This signing process ensures the integrity and authenticity of the token, preventing tampering or forgery during transmission. After signing, the device returns the signed token to the network management system. The network management system then obtains a signed token from the device to prove its legitimacy, further ensuring secure access and communication for the device.

[0067] Step S3: Send the signature token to the WAPI authentication server for device verification. After successful device verification, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be connected, and generate a shared key for data transmission of the device to be connected.

[0068] Specifically, the signature token is sent to the WAPI authentication server for device verification. After successful verification, the WAPI protocol algorithm is used to exchange random numbers and public key parameters with the device to be connected, and finally a shared key for data transmission is generated.

[0069] The process by which the WAPI authentication server verifies the device based on the signature token includes:

[0070] ① Perform information integrity and format correctness checks on the signature token, and verify the signature on the signature token using the public key of the device to be authenticated;

[0071] ② Perform content matching detection between the signature token and the authentication token of the device to be authenticated generated by the WAPI authentication server;

[0072] ③ If the signature token is successfully verified and the content matches, then the corresponding target device certificate is queried in the device certificate database based on the device ID in the signature token;

[0073] ④ If the target device certificate is valid and the signature verification is successful, then the device verification is successful.

[0074] The network management system first sends the previously generated signature token to the WAPI authentication server for device verification. Upon receiving the signature token, the WAPI authentication server first checks the integrity and format of the token's information to ensure it hasn't been tampered with or damaged during transmission. Next, the server uses the public key of the device to be authenticated to verify the signature on the token. This step confirms that the signature was indeed generated by the device, further proving its legitimacy.

[0075] After signature verification, the WAPI authentication server will also perform a content matching check between the signed token and the previously generated authentication token of the device to be authenticated. Only when the signature token successfully verifies the signature and the content matches will the server consider the device verification successful. At this point, the server will query the corresponding target device certificate in the device certificate database based on the device ID in the signed token and verify the validity and signature validity of the certificate again. Only when the target device certificate is valid and the signature verification passes is the entire device verification process considered complete.

[0076] Once the device is successfully verified, the network management system and the device to be connected can begin calculating the shared key. Each party will use the other's public key to decrypt the random numbers sent by the other; these random numbers are generated by each party independently. Then, using these two random numbers as input, both parties will apply a pre-determined key exchange algorithm (such as the Diffie-Hellman key exchange algorithm or a variant therein) to calculate the shared key. This shared key will form the basis for subsequent data transmission and communication between the two parties.

[0077] To ensure the consistency of the shared key, both parties can also use a challenge-response mechanism to verify whether the generated shared keys are the same. For example, one party can use the shared key to encrypt a message and then send it to the other party for decryption. If the other party can correctly decrypt and recover the original message, then it can be confirmed that the shared keys generated by both parties are consistent.

[0078] After successful key negotiation, the network management system and the connected devices can use the shared key for subsequent data transmission and communication. During data transmission, the data is encrypted using the shared key to ensure its security and privacy. Upon receiving the encrypted data, the receiving party uses the same shared key to decrypt it, thus recovering the original data. In this way, both parties can ensure the security and reliability of data transmission.

[0079] Step S4: Send the shared key to the device to be accessed to complete the access of the device to be accessed.

[0080] Specifically, the network management system sends the shared key, previously negotiated with the device to be connected, to the device to ensure that both parties can use the same key for subsequent data transmission and communication. The shared key is typically sent through a secure and reliable communication channel to ensure that the key is not leaked or tampered with during transmission.

[0081] Once the device to be connected receives the shared key, it can officially connect to the network management system. At this point, the device has completed all authentication and key negotiation processes and has the ability to communicate securely with the network management system.

[0082] Next, the device to be connected can begin data transmission using the shared key. Before transmitting data, the device will organize the data to be transmitted according to a certain data format, such as data packets or data streams. Then, the device will encrypt the organized data using the previously negotiated shared key and the corresponding encryption algorithm (such as AES, DES, etc.). After encryption, the device will generate a data unit containing the encrypted data. This data unit typically includes a data header (such as data length, data type, etc.), the encrypted data body, and possible verification information.

[0083] The encrypted data unit is transmitted to the network management system via a wireless local area network (WLAN). During transmission, the device to be connected may perform packet segmentation, retransmission, or other processing based on network conditions to ensure data integrity and reliability. Upon receiving the encrypted data unit, the network management system first performs data integrity verification (such as CRC checksum, MD5 checksum, etc.) to ensure that the data has not been damaged or tampered with during transmission.

[0084] If the data verification passes, the network management system will use the shared key and corresponding decryption algorithm previously negotiated with the device to be connected to decrypt the encrypted data. After successful decryption, the network management system will obtain the original data sent by the device to be connected and perform subsequent processing or storage.

[0085] In addition, after completing the connection of the device to be connected, it may also include:

[0086] If the amount of transmitted data exceeds the preset update value or the shared key usage time has reached the preset maximum time limit, the shared key is updated and the old shared key is invalidated.

[0087] Specifically, after the devices to be connected are connected, the system can also set up a shared key update mechanism to ensure the security of data transmission and the validity of the key. Specifically, when the system detects that the amount of transmitted data exceeds a preset update value, or that the shared key has reached its preset maximum usage time, the system will automatically trigger the shared key update mechanism. This mechanism aims to address the security risks that may arise from a surge in data volume, as well as the potential threat of the key being cracked after prolonged use.

[0088] During the shared key update process, the system first generates a new key and sends it to connected devices via a secure communication channel. Simultaneously, the system invalidates the old shared key, ensuring it can no longer be used for data encryption and decryption. This step is crucial because it effectively prevents the old key from being maliciously exploited, thereby protecting data integrity and confidentiality.

[0089] Through this key update mechanism, the system can continuously provide security for data transmission, ensuring secure data transmission and stable device access even in complex and ever-changing network environments.

[0090] As can be seen from the above technical solutions, the device access management method, apparatus, device, and readable storage medium provided in this application first search for device information within the response range and register and verify the responding device based on the searched device information. Secondly, for the device to be accessed that has passed the registration verification, the WAPI authentication server is used to verify the device's legitimacy, and a signature token for the device to be accessed is generated based on the device's built-in private key. Then, the signature token is sent to the WAPI authentication server for device verification. After successful device verification, the WAPI protocol algorithm is used to exchange random numbers and public key parameters with the device to be accessed, generating a shared key for data transmission by the device to be accessed. Finally, the shared key is sent to the device to be accessed, completing the access of the device to be accessed.

[0091] In this application, before access, the device must undergo registration verification and WAPI authentication server verification to generate a unique signature token. The WAPI protocol algorithm is then used to exchange random numbers and public key parameters with the device to generate a shared key for data transmission. Through device verification and authentication tokens, strong authentication of the device to be accessed is achieved, effectively preventing counterfeit devices and unauthorized access, and improving system security.

[0092] This application supports the access and management of various devices. Through a unified interface and protocol, it can easily expand to include new device types and access methods, adapting to the rapid growth in the number of devices and diverse needs, thus exhibiting good scalability. Furthermore, compared to existing technologies, this application adopts a lightweight design approach, making it easy to deploy and implement.

[0093] In some embodiments of this application, the process of verifying the device legitimacy of the device to be accessed using a WAPI authentication server in step S2, and generating a signature token for the device to be accessed based on the built-in key of the device to be accessed, is described, and may specifically include:

[0094] Step S21: Send a device authentication request to the WAPI authentication server and receive the authentication token for the device to be authenticated returned by the WAPI authentication server after legality verification. The device authentication request includes the device ID and device attribute information of the device to be authenticated.

[0095] Specifically, the process by which the WAPI authentication server generates an authentication token for the device to be authenticated after verifying its legitimacy includes:

[0096] ① Query the corresponding device certificate in the device certificate database based on the device ID, and verify the validity of the device certificate;

[0097] ② Use public-key cryptography to verify the signature validity of the device certificate;

[0098] ③ If the device certificate meets the timeliness requirements and the signature is valid, then an authentication token for the device to be authenticated is generated based on the device attribute information.

[0099] First, a device authentication request is sent to the WAPI Authentication Server (AS). This request includes the device ID of the device to be authenticated and related device attribute information. Once the WAPI Authentication Server receives this request, it immediately begins verifying the device's legitimacy. Specifically, the server queries the device certificate database for the corresponding device certificate based on the device ID and carefully verifies the certificate's validity, including the issuance date, expiration date, and issuing authority, ensuring the certificate has not been revoked or expired. Simultaneously, the server uses public-key cryptography to verify the signature validity of the device certificate, ensuring the certificate has not been tampered with during transmission. Only when the device certificate meets the validity requirements and the signature is valid will the WAPI Authentication Server generate a unique authentication token based on the device attribute information and return this token to the network management system.

[0100] Step S22: Send the authentication token to the device to be authenticated, and receive the signature token generated by signing the authentication token using the built-in private key returned by the device to be authenticated.

[0101] Specifically, the network management system sends the authentication token received from the WAPI authentication server to the device to be authenticated. Upon receiving the token, the device signs it using its built-in private key. This signing process ensures the token's integrity and authenticity, and also proves that the device indeed possesses the private key corresponding to its public key, further verifying the device's legitimacy. After signing, the device returns this signed token to the network management system. This signed token not only contains the authentication token information but also includes the device's private key signature.

[0102] In the above process, the WAPI Authentication Server (AS) can effectively verify the legitimacy of the device to be connected, ensuring that only authenticated devices can access the network management system. This mechanism not only improves the security of the entire system, but also enhances the traceability and trustworthiness of device identity through signed tokens.

[0103] In some embodiments of this application, the process of exchanging random numbers and public key parameters with the device to be accessed using the WAPI protocol algorithm in step S3 to generate a shared key for data transmission to the device to be accessed is described, which may specifically include:

[0104] Step S31: Select and determine the key negotiation algorithm according to the WAPI protocol.

[0105] Specifically, both parties first need to select and determine a suitable key exchange algorithm from a variety of available algorithms, according to the WAPI protocol. This algorithm will serve as the basis for subsequent calculations of the shared key. This selection process typically considers factors such as the security needs of both parties, their computing power, and the characteristics of the algorithm. Key exchange algorithms include algorithms such as the Diffie-Hellman key exchange algorithm or its variants.

[0106] Step S32: Receive the first random number and the first public key parameter sent by the device to be accessed, and return the second random number and the second public key parameter to the device to be accessed.

[0107] Specifically, the first random number is generated by signing a first original random number randomly generated by the device to be accessed with the private key of an asymmetric encryption algorithm, and the second random number is generated by signing a second original random number randomly generated locally with the private key of a locally built-in asymmetric encryption algorithm.

[0108] Next, the device to be connected and the network management system will exchange random numbers and public keys. The device to be connected will generate a random number and sign it using its private key for an asymmetric encryption algorithm (such as elliptic curve cryptography) to ensure its integrity and authenticity. Then, the device will send the signed random number and public key to the network management system. Upon receiving this information, the network management system will also perform a similar operation, generating a random number, signing it using its own private key for an asymmetric encryption algorithm, and then sending the signed random number and public key to the device to be connected.

[0109] Step S33: Decrypt the first random number and the second random number using the first public key parameter and the second public key parameter respectively to obtain the first original random number and the second original random number.

[0110] Step S34: Using the key negotiation algorithm, combined with the first original random number and the second original random number, calculate the shared key for data transmission of the device to be accessed.

[0111] Specifically, after both parties successfully exchange random numbers and public keys, the device seeking access uses the network management system's public key to decrypt the random number sent by the network management system. Simultaneously, the network management system uses the device seeking access's public key to decrypt the random number sent by the device seeking access. In this way, both parties obtain each other's random numbers. Then, they use these random numbers as input and apply the previously determined key negotiation algorithm to calculate a shared key.

[0112] The following describes a device access management apparatus provided in an embodiment of this application. The device access management apparatus described below can be referred to in correspondence with the device access management method described above.

[0113] See Figure 2 , Figure 2 This is a schematic diagram of a device access management device disclosed in an embodiment of this application.

[0114] like Figure 2 As shown, the device access management device may include:

[0115] The device search unit 110 is used to search for device information within the response range and to perform registration verification on the responding device based on the searched device information;

[0116] The signature token unit 120 is used to verify the device legitimacy of the device to be accessed by using the WAPI authentication server for the device to be accessed that has passed the registration verification, and to generate a signature token for the device to be accessed based on the built-in private key of the device to be accessed.

[0117] The shared key unit 130 is used to send the signature token to the WAPI authentication server for device verification, and after the device verification is successful, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be accessed to generate a shared key for data transmission of the device to be accessed.

[0118] The access control unit 140 is used to send the shared key to the device to be accessed, thereby completing the access of the device to be accessed.

[0119] As can be seen from the above technical solutions, the device access management method, apparatus, device, and readable storage medium provided in this application first search for device information within the response range and register and verify the responding device based on the searched device information. Secondly, for the device to be accessed that has passed the registration verification, the WAPI authentication server is used to verify the device's legitimacy, and a signature token for the device to be accessed is generated based on the device's built-in private key. Then, the signature token is sent to the WAPI authentication server for device verification. After successful device verification, the WAPI protocol algorithm is used to exchange random numbers and public key parameters with the device to be accessed, generating a shared key for data transmission by the device to be accessed. Finally, the shared key is sent to the device to be accessed, completing the access of the device to be accessed.

[0120] In this application, before access, the device must undergo registration verification and WAPI authentication server verification to generate a unique signature token. The WAPI protocol algorithm is then used to exchange random numbers and public key parameters with the device to generate a shared key for data transmission. Through device verification and authentication tokens, strong authentication of the device to be accessed is achieved, effectively preventing counterfeit devices and unauthorized access, and improving system security.

[0121] This application supports the access and management of various devices. Through a unified interface and protocol, it can easily expand to include new device types and access methods, adapting to the rapid growth in the number of devices and diverse needs, thus exhibiting good scalability. Furthermore, compared to existing technologies, this application adopts a lightweight design approach, making it easy to deploy and implement.

[0122] Optionally, the signing token unit performs the process of verifying the device legitimacy of the device to be accessed using a WAPI authentication server and generating a signing token for the device to be accessed based on the device's built-in key, which may include:

[0123] Send a device authentication request to the WAPI authentication server and receive an authentication token for the device to be authenticated returned by the WAPI authentication server after verification of its legitimacy. The device authentication request includes the device ID and device attribute information of the device to be authenticated.

[0124] The authentication token is sent to the device to be authenticated, and a signature token generated by signing the authentication token using the built-in private key is received from the device to be authenticated.

[0125] Optionally, the process by which the WAPI authentication server generates an authentication token for the device to be authenticated after legitimacy verification may include:

[0126] The device certificate is queried from the device certificate database based on the device ID, and the validity of the device certificate is verified.

[0127] The signature validity of the device certificate is verified using public-key cryptography.

[0128] If the device certificate meets the timeliness requirements and the signature is valid, an authentication token for the device to be authenticated is generated based on the device attribute information.

[0129] Optionally, the process by which the shared key unit exchanges random numbers and public key parameters with the device to be accessed using the WAPI protocol algorithm to generate a shared key for data transmission to the device to be accessed may include:

[0130] Select and determine the key negotiation algorithm according to the WAPI protocol;

[0131] The system receives a first random number and a first public key parameter sent by the device to be accessed, and returns a second random number and a second public key parameter to the device to be accessed. The first random number is generated by the device to be accessed randomly generating a first original random number and signing it with the private key of an asymmetric encryption algorithm. The second random number is generated by the device to be accessed randomly generating a second original random number and signing it with the private key of a locally built-in asymmetric encryption algorithm.

[0132] The first random number and the second random number are decrypted using the first public key parameter and the second public key parameter, respectively, to obtain the first original random number and the second original random number.

[0133] Using the key negotiation algorithm, combined with the first and second original random numbers, a shared key for data transmission of the device to be accessed is calculated.

[0134] Optionally, the device search unit may perform a registration verification process for the responding device based on the device information obtained from the search, which may include:

[0135] Based on the device information obtained from the search, check whether it has been registered in the device information database;

[0136] Devices already registered in the device information database are identified as devices to be accessed after passing the registration verification, and registration guidance information is sent to devices not registered in the device information database.

[0137] Optionally, the process by which the WAPI authentication server performs device verification based on the signature token includes:

[0138] The signature token is checked for information integrity and format correctness, and the signature on the signature token is verified using the public key of the device to be authenticated;

[0139] The signature token is matched with the authentication token of the device to be authenticated generated by the WAPI authentication server to perform content matching detection.

[0140] If the signature token is successfully verified and the content matches, then the corresponding target device certificate is queried in the device certificate database based on the device ID in the signature token.

[0141] If the target device certificate is valid and the signature verification is successful, then the device verification is successful.

[0142] Optionally, this application also includes a key update unit, which, after the access of the device to be accessed is completed, updates the shared key and invalidates the old shared key when it is detected that the amount of transmitted data exceeds a preset update value or the usage time of the shared key has reached a preset maximum time limit.

[0143] The device access management device provided in this application embodiment can be applied to device access management devices. Figure 3 The hardware structure block diagram of the device access management device is shown below. Figure 3 The hardware structure of the device access management device may include: at least one processor 1, at least one communication interface 2, at least one memory 3, and at least one communication bus 4;

[0144] In this embodiment of the application, the number of processor 1, communication interface 2, memory 3, and communication bus 4 is at least one, and processor 1, communication interface 2, and memory 3 communicate with each other through communication bus 4;

[0145] Processor 1 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention.

[0146] Memory 3 may include high-speed RAM, and may also include non-volatile memory, such as at least one disk storage device;

[0147] The memory stores a program, which the processor can call. The program is used for:

[0148] Search for device information within the response range, and register and verify the responding device based on the searched device information;

[0149] For the device to be accessed that has passed the registration verification, the WAPI authentication server is used to verify the device's legitimacy and generate a signature token for the device based on the device's built-in private key.

[0150] The signature token is sent to the WAPI authentication server for device verification. After the device verification is successful, the WAPI protocol algorithm is used to exchange random numbers and public key parameters with the device to be connected, and a shared key for data transmission of the device to be connected is generated.

[0151] The shared key is sent to the device to be connected, thus completing the connection of the device to be connected.

[0152] Optionally, the refined and extended functions of the program can be referred to the above description.

[0153] This application embodiment also provides a readable storage medium that can store a program suitable for execution by a processor, the program being used for:

[0154] Search for device information within the response range, and register and verify the responding device based on the searched device information;

[0155] For the device to be accessed that has passed the registration verification, the WAPI authentication server is used to verify the device's legitimacy and generate a signature token for the device based on the device's built-in private key.

[0156] The signature token is sent to the WAPI authentication server for device verification. After the device verification is successful, the WAPI protocol algorithm is used to exchange random numbers and public key parameters with the device to be connected, and a shared key for data transmission of the device to be connected is generated.

[0157] The shared key is sent to the device to be connected, thus completing the connection of the device to be connected.

[0158] Optionally, the refined and extended functions of the program can be referred to the above description.

[0159] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0160] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0161] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A device access management method, characterized in that, include: Search for device information within the response range, and register and verify the responding device based on the searched device information; For the device to be accessed that has passed the registration verification, the WAPI authentication server is used to verify the device's legitimacy and generate a signature token for the device based on the device's built-in private key. The signature token is sent to the WAPI authentication server for device verification. After the device verification is successful, the WAPI protocol algorithm is used to exchange random numbers and public key parameters with the device to be connected, and a shared key for data transmission of the device to be connected is generated. The shared key is sent to the device to be connected, thus completing the connection of the device to be connected.

2. The method according to claim 1, characterized in that, The WAPI authentication server is used to verify the device legitimacy of the device to be accessed, and a signature token for the device to be accessed is generated based on the built-in private key of the device to be accessed, including: Send a device authentication request to the WAPI authentication server and receive the authentication token of the device to be authenticated returned by the WAPI authentication server after the authentication is verified. The device authentication request includes the device ID and device attribute information of the device to be authenticated. The authentication token is sent to the device to be authenticated, and a signature token generated by signing the authentication token using the built-in private key is received from the device to be authenticated.

3. The method according to claim 2, characterized in that, The process by which the WAPI authentication server generates an authentication token for the device to be authenticated after verifying its legitimacy includes: The device certificate is queried from the device certificate database based on the device ID, and the validity of the device certificate is verified. The signature validity of the device certificate is verified using public-key cryptography. If the device certificate meets the timeliness requirements and the signature is valid, an authentication token for the device to be authenticated is generated based on the device attribute information.

4. The method according to claim 1, characterized in that, The WAPI protocol algorithm is used to exchange random numbers and public key parameters with the device to be connected, generating a shared key for data transmission with the device to be connected, including: Select and determine the key negotiation algorithm according to the WAPI protocol; The system receives a first random number and a first public key parameter sent by the device to be accessed, and returns a second random number and a second public key parameter to the device to be accessed. The first random number is generated by the device to be accessed randomly generating a first original random number and signing it with the private key of an asymmetric encryption algorithm. The second random number is generated by the device to be accessed randomly generating a second original random number and signing it with the private key of a locally built-in asymmetric encryption algorithm. The first random number and the second random number are decrypted using the first public key parameter and the second public key parameter, respectively, to obtain the first original random number and the second original random number. Using the key negotiation algorithm, combined with the first and second original random numbers, a shared key for data transmission of the device to be accessed is calculated.

5. The method according to claim 1, characterized in that, Based on the device information obtained from the search, the registration and verification of the responding device includes: Based on the device information obtained from the search, check whether it has been registered in the device information database; Devices already registered in the device information database are identified as devices to be accessed after passing the registration verification, and registration guidance information is sent to devices not registered in the device information database.

6. The method according to claim 1, characterized in that, The process by which the WAPI authentication server verifies the device based on the signature token includes: The signature token is checked for information integrity and format correctness, and the signature on the signature token is verified using the public key of the device to be authenticated; The signature token is matched with the authentication token of the device to be authenticated generated by the WAPI authentication server to perform content matching detection. If the signature token is successfully verified and the content matches, then the corresponding target device certificate is queried in the device certificate database based on the device ID in the signature token. If the target device certificate is valid and the signature verification is successful, then the device verification is successful.

7. The method according to claim 1, characterized in that, After completing the connection of the device to be connected, the following steps are also included: If the amount of transmitted data exceeds the preset update value or the shared key usage time has reached the preset maximum time limit, the shared key is updated and the old shared key is invalidated.

8. A device access management device, characterized in that, include: The device search unit is used to search for device information within the response range and to register and verify the responding device based on the searched device information; The signature token unit is used to verify the device legitimacy of the device to be accessed by the WAPI authentication server for the device to be accessed that has passed the registration verification, and to generate a signature token for the device to be accessed based on the built-in private key of the device to be accessed. The shared key unit is used to send the signature token to the WAPI authentication server for device verification, and after the device verification is successful, use the WAPI protocol algorithm to exchange random numbers and public key parameters with the device to be connected to generate a shared key for data transmission of the device to be connected. The access control unit is used to send the shared key to the device to be accessed, thereby completing the access of the device to be accessed.

9. A device access management device, characterized in that, Including memory and processor; The memory is used to store programs; The processor is used to execute the program to implement each step of the device access management method as described in any one of claims 1-7.

10. A readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements each step of the device access management method as described in any one of claims 1-7.

Images