Module authentication method and device, equipment and storage medium
By using a security chip in the module for public key and signature value verification, the problem of plagiarism and imitation of the secondary development library of the module is solved, and the efficiency of module authentication and the security of the secondary development library are realized, ensuring that The intellectual property rights of the developer.
Patent Information
- Application Number
- CN202411305874.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-19
- Publication Date
- 2025-01-07
AI Technical Summary
The module secondary development library is used to copy and copy hardware without effective protection, making it difficult for developers to protect their intellectual property rights, affecting development efficiency and market competitiveness.
By introducing a security chip into the module, using the public key and signature value to verify the unique serial number, we ensure that only legal modules can call the secondary development library, thereby improving the efficiency of module authentication and enhancing the secondary development library Security.
The secondary development library is effectively protected, preventing it from being used without authorization, improving the authentication efficiency and security of the module, and ensuring the developer's intellectual property rights.
Smart Images
Figure CN119272261A_ABST
Abstract
Description
Technical Field
[0001] Embodiments of the present invention relate to the field of computer technology, and in particular to a module authentication method, device, equipment, and storage medium. Background Art
[0002] With the development and intensified competition in the software development industry, the application of secondary development libraries of modules is becoming increasingly popular. The secondary development libraries developed by module manufacturers allow users to use the functions in them without source code by simply calling library files. This has become an important way to improve development efficiency, reduce costs, ensure quality and enhance competitiveness. However, many module developers lack effective protection measures, resulting in their secondary development libraries being used in copied and imitated hardware. Therefore, how to better protect the secondary development libraries of modules has become an urgent problem that needs to be solved. Summary of the invention
[0003] The embodiments of the present invention provide a module authentication method, device, equipment and storage medium, which can improve the efficiency of module authentication, and only the modules that pass the authentication can call the secondary development library, which can effectively protect the secondary development library and improve its security.
[0004] In a first aspect, an embodiment of the present invention provides a module authentication method, wherein the module includes a security chip, and the method includes:
[0005] The secondary development library reads the unique serial number of the security chip, the public key and the signature value stored in the security chip; wherein the public key is obtained based on a preset encryption algorithm, and the signature value is obtained by signing the unique serial number;
[0006] Processing the unique sequence number according to a preset algorithm to obtain a first intermediate sequence number;
[0007] Verify the first intermediate sequence number based on the public key and the signature value to obtain a verification result;
[0008] If the signature verification result is that the signature verification is passed, a calling operation of the module on the secondary development library is received.
[0009] In a second aspect, an embodiment of the present invention further provides a module authentication device, wherein the module includes a security chip, and the device includes:
[0010] A reading module, used for the secondary development library to read the unique serial number of the security chip, the public key and the signature value stored in the security chip; wherein the public key is obtained based on a preset encryption algorithm, and the signature value is obtained by signing the unique serial number;
[0011] A first intermediate sequence number acquisition module, used to process the unique sequence number according to a preset algorithm to obtain a first intermediate sequence number;
[0012] A signature verification module, used to verify the first intermediate sequence number based on the public key and the signature value to obtain a signature verification result;
[0013] The calling operation receiving module is used to receive the calling operation of the module to the secondary development library when the signature verification result is signature verification passed.
[0014] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:
[0015] at least one processor; and
[0016] a memory communicatively connected to the at least one processor; wherein,
[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the module authentication method described in the embodiment of the present invention.
[0018] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the module authentication method described in the embodiment of the present invention when executed.
[0019] The embodiment of the present invention discloses a method, device, equipment and storage medium for authenticating a module. The module includes a security chip, and the method includes: the secondary development library reads the unique serial number of the security chip, the public key and signature value stored in the security chip; wherein the public key is obtained based on a preset encryption algorithm, and the signature value is obtained by signing the unique serial number; the unique serial number is processed according to the preset algorithm to obtain a first intermediate serial number; the first intermediate serial number is verified based on the public key and the signature value to obtain a verification result; if the verification result is that the verification is passed, the module calls the secondary development library. The authentication method of the module provided by the embodiment of the present invention verifies the intermediate serial number generated by the unique serial number of the security chip through the public key and the signature value, which can improve the efficiency of module authentication, and only the module that passes the authentication can call the secondary development library, which can effectively protect the secondary development library and improve its security. BRIEF DESCRIPTION OF THE DRAWINGS
[0020] Figure 1 is a flow chart of a module authentication method in Embodiment 1 of the present invention;
[0021] Figure 2It is a structural diagram of an authentication device of a module in Embodiment 2 of the present invention;
[0022] Figure 3 It is a structural schematic diagram of an electronic device in Embodiment 3 of the present invention. DETAILED DESCRIPTION
[0023] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.
[0024] Embodiment 1
[0025] Figure 1 A flowchart of a module authentication method provided in Embodiment 1 of the present invention. This embodiment is applicable to the case of legally authenticating a hardware module. The method can be executed by an authentication device of the module, which can be implemented in the form of software and / or hardware. Optionally, it can be implemented by an electronic device, which can be a mobile terminal, a PC or a server, etc.
[0026] Among them, a module is a device, a pre-designed set of electronic components with specific functions, which can also be called a module. In practical applications, modules can be used to assemble more complex circuits to perform more complex functions. In this embodiment, the module includes a security chip, which is deployed with a variety of encryption and decryption algorithms to protect the security of the module.
[0027] like Figure 1 As shown, the specific steps include:
[0028] S110, the secondary development library reads the unique serial number of the security chip, the public key and the signature value stored in the security chip.
[0029] Among them, the public key is obtained based on the preset encryption algorithm, and the signature value is obtained by signing the unique serial number. The secondary development library contains some library files and development suggestions and guidance. These library files are designed for modules to help developers develop applications quickly and efficiently. The secondary development library also contains an application programming interface (API) for software development, which is used by the module to call the library file through the API. The unique serial number of the security chip is configured before the module leaves the factory and is used to uniquely identify the security chip.
[0030] In this embodiment, the public key and the signature value are generated before the module leaves the factory, and can be generated by the burning baseboard performing corresponding operations. The burning baseboard can communicate with the module to flash data.
[0031] Specifically, the signature value is determined as follows: the unique serial number is processed according to a preset algorithm to obtain a second intermediate serial number; a key pair is generated based on a preset encryption algorithm; the second intermediate serial number is signed with a private key to obtain a signature value; and the signature value is stored in a preset area of the security chip according to a discrete storage method.
[0032] The key pair includes a public key and a private key. The preset encryption algorithm may be stored in a security chip. The public key is stored in the security chip, and the private key is stored in the burning board.
[0033] In this embodiment, the unique serial number is processed according to a preset algorithm, and the second intermediate serial number is obtained by: performing an XOR operation on the unique serial number and a preset string to obtain an XOR operation result; and performing a shift operation on the XOR operation result to obtain the second intermediate serial number.
[0034] Among them, the number of characters contained in the preset string is the same as or different from the number of characters contained in the unique serial number. The number of characters contained in the second intermediate serial number is the same as the number of characters contained in the unique serial number. If the number of characters contained in the preset string is the same as the number of characters contained in the unique serial number, a one-to-one correspondence between the characters in the preset string and the characters in the unique serial number is first established, and then each character in the preset string is XORed with the corresponding character in the unique serial number to obtain the XOR result. When the number of characters contained in the preset string is different from the number of characters contained in the unique serial number, it is necessary to compare the length of the preset string and the unique serial number, process the preset string according to the comparison result, and perform an XOR operation on the processed string and the unique serial number.
[0035] Optionally, if the number of characters contained in the preset string is greater than the number of characters contained in the unique serial number, a substring equal to the number of characters contained in the unique serial number is extracted from the preset string, and the unique serial number is XORed with the substring to obtain an XOR result.
[0036] Among them, a substring equal to the number of characters contained in the unique serial number can be extracted from the preset string according to the preset rules. Exemplarily, assuming that the unique serial number contains N characters, the preset rule can be to extract the first N characters from the preset string to obtain the substring, or to extract the last N characters from the preset string as the substring, or to extract the middle N characters from the preset string (for example: extracting from the mth character, m is a positive integer greater than 1) as the substring. After obtaining the substring, first establish a one-to-one correspondence between the characters in the substring and the characters in the unique serial number, and then perform an XOR operation on each character in the substring and the corresponding character in the unique serial number to obtain the XOR operation result.
[0037] Optionally, if the number of characters included in the preset string is less than the number of characters included in the unique serial number, a new string is generated based on the preset string and at least part of the characters of the preset string, and the unique serial number is XORed with the new string to obtain an XOR result.
[0038] The number of characters included in the new string is the same as the number of characters included in the unique serial number. The process of generating a new string based on a preset string and at least part of the characters of the preset string may be: first extracting part of the characters from the preset string, and then concatenating the extracted part of the characters with the preset string to generate a new string. After obtaining the new string, first establish a one-to-one correspondence between the characters in the new string and the characters in the unique serial number, and then perform an XOR operation on each character in the new string and the corresponding character in the unique serial number to obtain an XOR operation result.
[0039] Optionally, the manner of performing shift processing on the XOR operation result may be: shifting the XOR operation result to the left, shifting to the right, or circularly shifting the XOR operation result.
[0040] Optionally, the second intermediate serial number is signed with a private key, and the signature value may be obtained by: performing a hash operation on the second intermediate serial number based on a hash algorithm to obtain the first information summary; and encrypting the first information summary based on the private key to obtain the signature value.
[0041] The hash algorithm may be a secure hash algorithm.
[0042] Specifically, after the signature value is obtained, the signature value is stored in a preset area of the security chip according to a discrete storage method.
[0043] The preset area may be a storage interval that can be accessed by the secondary development library only when certain conditions are met. The process of storing the signature value in the preset area of the security chip according to the discrete storage method may be: generating multiple non-repeating addresses in the preset area, and then storing each character of the signature value in different addresses. In this embodiment, storing the signature value according to the discrete storage method can improve the security of the signature value and prevent it from being maliciously read or tampered with.
[0044] Specifically, the burning board reads the unique serial number SN1 of the security chip in the module, then performs an XOR operation on SN1 and a preset string and shifts it to obtain a second intermediate serial number SN2; the burning board calls the preset encryption algorithm in the security chip to generate a key pair, stores the public key in the security chip, and stores the private key in the burning board. The burning board uses the private key to sign SN2 to obtain a signature value, and finally stores the signature value in a preset area of the security chip according to the discrete storage method.
[0045] In this embodiment, the signature value is stored in a preset area of the encryption chip based on a discrete storage method; the secondary development library reads the signature value stored in the security chip by: modifying the read flag of the secondary development library from a first set value to a second set value; and reading the signature value from the preset area according to the discrete storage method.
[0046] The first setting value may be 0, and the second setting value may be 1. When the read flag of the secondary development library is 0, the secondary development library cannot access the preset area; when the read flag of the secondary development library is 1, the secondary development library can access the preset area. Therefore, if you want to obtain the signature value stored in the preset area, you need to change the read flag of the secondary development library from 0 to 1, and read the signature value from the preset area according to the discrete storage method.
[0047] S120, processing the unique sequence number according to a preset algorithm to obtain a first intermediate sequence number.
[0048] Optionally, the unique serial number is processed according to a preset algorithm to obtain the first intermediate serial number by: performing an XOR operation on the unique serial number and a preset character string to obtain an XOR operation result; and performing a shift operation on the XOR operation result to obtain the first intermediate serial number.
[0049] Among them, the number of characters contained in the preset string is the same as or different from the number of characters contained in the unique serial number. The number of characters contained in the first intermediate serial number is the same as the number of characters contained in the unique serial number. If the number of characters contained in the preset string is the same as the number of characters contained in the unique serial number, a one-to-one correspondence between the characters in the preset string and the characters in the unique serial number is first established, and then each character in the preset string is XORed with the corresponding character in the unique serial number to obtain the XOR result. When the number of characters contained in the preset string is different from the number of characters contained in the unique serial number, it is necessary to compare the length of the preset string and the unique serial number, process the preset string according to the comparison result, and perform an XOR operation on the processed string and the unique serial number.
[0050] Optionally, if the number of characters contained in the preset string is greater than the number of characters contained in the unique serial number, a substring equal to the number of characters contained in the unique serial number is extracted from the preset string, and the unique serial number is XORed with the substring to obtain an XOR result.
[0051] Among them, a substring equal to the number of characters contained in the unique serial number can be extracted from the preset string according to the preset rules. Exemplarily, assuming that the unique serial number contains N characters, the preset rule can be to extract the first N characters from the preset string to obtain the substring, or to extract the last N characters from the preset string as the substring, or to extract the middle N characters from the preset string (for example: extracting from the mth character, m is a positive integer greater than 1) as the substring. After obtaining the substring, first establish a one-to-one correspondence between the characters in the substring and the characters in the unique serial number, and then perform an XOR operation on each character in the substring and the corresponding character in the unique serial number to obtain the XOR operation result.
[0052] Optionally, if the number of characters included in the preset string is less than the number of characters included in the unique serial number, a new string is generated based on the preset string and at least part of the characters of the preset string, and the unique serial number is XORed with the new string to obtain an XOR result.
[0053] The number of characters included in the new string is the same as the number of characters included in the unique serial number. The process of generating a new string based on a preset string and at least part of the characters of the preset string may be: first extracting part of the characters from the preset string, and then concatenating the extracted part of the characters with the preset string to generate a new string. After obtaining the new string, first establish a one-to-one correspondence between the characters in the new string and the characters in the unique serial number, and then perform an XOR operation on each character in the new string and the corresponding character in the unique serial number to obtain an XOR operation result.
[0054] Optionally, the manner of performing shift processing on the XOR operation result may be: shifting the XOR operation result to the left, shifting to the right, or circularly shifting the XOR operation result.
[0055] S130, verify the first intermediate sequence number based on the public key and the signature value to obtain a verification result.
[0056] The signature verification result includes passed and failed. If the signature verification is passed, it indicates that the module is legal. If the signature verification is failed, it indicates that the module is illegal.
[0057] In this embodiment, the first intermediate serial number is verified based on the public key and the signature value, and the verification result can be obtained by: decrypting the signature value based on the public key to obtain a first information summary; performing a hash operation on the first intermediate serial number based on a hash algorithm to obtain a second information summary; comparing the first information summary and the second information summary; and determining the verification result based on the comparison result.
[0058] Specifically, the signature verification result may be determined based on the comparison result: if the first information digest and the second information digest are the same, the signature verification result is that the extension is passed; if the first information digest and the second information digest are different, the signature verification result is that the extension is not passed.
[0059] S140: If the signature verification result is passed, the receiving module calls the secondary development library.
[0060] If the signature verification is passed, it indicates that the module is legal, and the module's call operation on the secondary development library is accepted; if the signature verification fails, it indicates that the module is illegal, and the module's call operation on the secondary development library is rejected.
[0061] In this application scenario, there are two situations for illegal modules: 1. The module is a counterfeit module, and the module does not store the public key and signature value generated before leaving the factory, so the signature verification fails; 2. The module is a prevention module, and the module plagiarizes and copies the public key and signature value in the legitimate module. Since the unique serial number of the module is different from that of the legitimate module, the signature verification will still fail.
[0062] The technical solution of this embodiment is that the secondary development library reads the unique serial number of the security chip, the public key and signature value stored in the security chip; wherein the public key is obtained based on a preset encryption algorithm, and the signature value is obtained by signing the unique serial number; the unique serial number is processed according to the preset algorithm to obtain a first intermediate serial number; the first intermediate serial number is verified based on the public key and the signature value to obtain a verification result; if the verification result is that the verification is passed, the module calls the secondary development library. The authentication method of the module provided in the embodiment of the present invention verifies the intermediate serial number generated by the unique serial number of the security chip through the public key and the signature value, which can improve the efficiency of module authentication, and only the module that passes the authentication can call the secondary development library, which can effectively protect the secondary development library and improve its security.
[0063] Embodiment 2
[0064] Figure 2 : is a schematic diagram of the structure of a module authentication device provided in Embodiment 2 of the present invention, wherein the module includes a security chip, and the device includes:
[0065] The reading module 210 is used for the secondary development library to read the unique serial number of the security chip, the public key and the signature value stored in the security chip; wherein the public key is obtained based on a preset encryption algorithm, and the signature value is obtained by signing the unique serial number;
[0066] A first intermediate sequence number acquisition module 220, configured to process the unique sequence number according to a preset algorithm to obtain a first intermediate sequence number;
[0067] A signature verification module 230, configured to verify the first intermediate sequence number based on the public key and the signature value to obtain a signature verification result;
[0068] The calling operation receiving module 240 is used to receive the calling operation of the module to the secondary development library when the signature verification result is signature verification passed.
[0069] Optionally, the signature value is stored in a preset area of the encryption chip based on a discrete storage method;
[0070] The reading module 210 is further used for:
[0071] Modify the read flag of the secondary development library from a first set value to a second set value;
[0072] The signature value is read from the preset area according to the discrete storage method.
[0073] Optionally, the first intermediate sequence number obtaining module 220 is further configured to:
[0074] Performing an XOR operation on the unique serial number and a preset character string to obtain an XOR operation result; wherein the number of characters included in the preset character string is the same as or different from the number of characters included in the unique serial number;
[0075] The XOR operation result is shifted to obtain a first intermediate sequence number.
[0076] Optionally, when the number of characters included in the preset character string is different from the number of characters included in the unique serial number, the first intermediate serial number acquisition module 220 is further used to:
[0077] If the number of characters included in the preset character string is greater than the number of characters included in the unique serial number, a substring equal to the number of characters included in the unique serial number is extracted from the preset character string, and the unique serial number is XOR-ed with the substring to obtain an XOR-ed result;
[0078] If the number of characters included in the preset string is less than the number of characters included in the unique serial number, a new string is generated based on the preset string and at least part of the characters of the preset string, and the unique serial number and the new string are XORed to obtain an XOR result.
[0079] Optionally, the signature verification module 230 is further configured to:
[0080] Decrypting the signature value based on the public key to obtain a first information summary;
[0081] Performing a hash operation on the first intermediate sequence number based on a hash algorithm to obtain a second information digest;
[0082] comparing the first information digest and the second information digest;
[0083] The signature verification result is determined based on the comparison result.
[0084] Optionally, the signature value is determined as follows:
[0085] Processing the unique sequence number according to a preset algorithm to obtain a second intermediate sequence number;
[0086] Generate a key pair based on a preset encryption algorithm; wherein the key pair includes a public key and a private key;
[0087] Signing the second intermediate sequence number using the private key to obtain the signature value;
[0088] The signature value is stored in a preset area of the security chip according to a discrete storage method.
[0089] Optionally, using the private key to sign the second intermediate sequence number to obtain the signature value includes:
[0090] Performing a hash operation on the second intermediate sequence number based on a hash algorithm to obtain the first information digest;
[0091] The first information digest is encrypted based on the private key to obtain the signature value.
[0092] The above device can execute the methods provided by all the above embodiments of the present invention, and has the corresponding functional modules and beneficial effects of executing the above methods. For technical details not described in detail in this embodiment, please refer to the methods provided by all the above embodiments of the present invention.
[0093] Embodiment 3
[0094] Figure 3 A schematic diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, the connections and relationships between the components, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.
[0095] like Figure 3 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.
[0096] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.
[0097] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the authentication method of the module.
[0098] In some embodiments, the authentication method of the module may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the authentication method of the module described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the authentication method of the module in any other appropriate manner (e.g., by means of firmware).
[0099] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
[0100] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.
[0101] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0102] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).
[0103] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.
[0104] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.
[0105] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.
[0106] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims
1. A module authentication method, characterized in that: The module includes a security chip, and the method includes: The secondary development library reads the unique serial number of the security chip, the public key and the signature value stored in the security chip; wherein the public key is obtained based on a preset encryption algorithm, and the signature value is obtained by signing the unique serial number; Processing the unique sequence number according to a preset algorithm to obtain a first intermediate sequence number; Verify the first intermediate sequence number based on the public key and the signature value to obtain a verification result; If the signature verification result is that the signature verification is passed, a calling operation of the module on the secondary development library is received.
2. The method according to claim 1, characterized in that The signature value is stored in a preset area of the encryption chip based on a discrete storage method; The secondary development library reads the signature value stored in the security chip, including: Modify the read flag of the secondary development library from a first set value to a second set value; The signature value is read from the preset area according to the discrete storage method.
3. The method according to claim 1, characterized in that: Processing the unique sequence number according to a preset algorithm to obtain a first intermediate sequence number includes: Performing an XOR operation on the unique serial number and a preset character string to obtain an XOR operation result; wherein the number of characters included in the preset character string is the same as or different from the number of characters included in the unique serial number; The XOR operation result is shifted to obtain a first intermediate sequence number.
4. The method according to claim 3, characterized in that When the number of characters included in the preset character string is different from the number of characters included in the unique serial number, the unique serial number and the preset character string are subjected to an XOR operation to obtain an XOR operation result, including: If the number of characters included in the preset character string is greater than the number of characters included in the unique serial number, a substring equal to the number of characters included in the unique serial number is extracted from the preset character string, and the unique serial number is XOR-ed with the substring to obtain an XOR-ed result; If the number of characters included in the preset string is less than the number of characters included in the unique serial number, a new string is generated based on the preset string and at least part of the characters of the preset string, and the unique serial number and the new string are XORed to obtain an XOR result.
5. The method according to claim 1, characterized in that Verifying the first intermediate sequence number based on the public key and the signature value to obtain a verification result includes: Decrypting the signature value based on the public key to obtain a first information summary; Performing a hash operation on the first intermediate sequence number based on a hash algorithm to obtain a second information digest; comparing the first information digest and the second information digest; The signature verification result is determined based on the comparison result.
6. The method according to claim 5, characterized in that The signature value is determined as follows: Processing the unique sequence number according to a preset algorithm to obtain a second intermediate sequence number; Generate a key pair based on a preset encryption algorithm; wherein the key pair includes a public key and a private key; Signing the second intermediate sequence number using the private key to obtain the signature value; The signature value is stored in a preset area of the security chip according to a discrete storage method.
7. The method according to claim 6, characterized in that Signing the second intermediate sequence number using the private key to obtain the signature value includes: Performing a hash operation on the second intermediate sequence number based on a hash algorithm to obtain the first information digest; The first information digest is encrypted based on the private key to obtain the signature value.
8. A module authentication device, characterized in that: The module includes a security chip, and the device includes: A reading module, used for the secondary development library to read the unique serial number of the security chip, the public key and the signature value stored in the security chip; wherein the public key is obtained based on a preset encryption algorithm, and the signature value is obtained by signing the unique serial number; A first intermediate sequence number acquisition module, used to process the unique sequence number according to a preset algorithm to obtain a first intermediate sequence number; A signature verification module, used to verify the first intermediate sequence number based on the public key and the signature value to obtain a signature verification result; The calling operation receiving module is used to receive the calling operation of the module to the secondary development library when the signature verification result is signature verification passed.
9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the module authentication method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the module authentication method according to any one of claims 1 to 7 when executed.