Equipment authentication method and equipment authentication device

Abstract

The invention provides an equipment authentication method and an equipment authentication device, which are applied to central equipment in an equipment authentication system, the equipment authentication system further comprises edge equipment, the flexibility of equipment authentication is improved, and the problem that the equipment cannot be authenticated is avoided. The method comprises the following steps: a central device sends an encryption result to an edge device, so that the edge device decrypts the encryption result based on a private key and obtains a decryption result, and the encryption result is obtained by encrypting a target object through a public key; the central equipment receives the decryption result from the edge equipment, and judges whether the edge equipment passes the authentication of the central equipment or not based on the decryption result; wherein the public key and the private key are asymmetric keys created by the edge device.

Description

Technical Field

[0001] The present application relates to the field of terminal technology, and in particular to a device authentication method and a device authentication apparatus. Background Art

[0002] At present, in the use scenario of multiple devices, the devices can be interconnected, so that information and services can flow freely between devices, making the collaborative experience more convenient and efficient. At present, when multiple devices establish near-field or far-field connections with each other, they can authenticate the devices based on the account and password to achieve interconnection between devices.

[0003] However, the above device authentication method is not flexible, which may lead to the problem of being unable to authenticate the device, thereby affecting the interconnection and interoperability between the device and other devices. Summary of the invention

[0004] The present application provides a device authentication method and a device authentication apparatus, which improve the flexibility of the device authentication method and avoid the problem of being unable to authenticate the device.

[0005] In a first aspect, a device authentication method is provided, which is applied to a central device in a device authentication system, and the device authentication system also includes an edge device. The method includes: sending an encryption result to the edge device so that the edge device decrypts the encryption result based on a private key and obtains a decryption result, wherein the encryption result is obtained by encrypting a target object with a public key; receiving the decryption result from the edge device, and judging whether the edge device has passed the authentication of the central device based on the decryption result; wherein the public key and the private key are asymmetric keys created for the edge device.

[0006] In a second aspect, another device authentication method is provided, which is applied to an edge device in a device authentication system, and the device authentication system also includes a central device. The method includes: receiving an encryption result from the above-mentioned central device, and decrypting the above-mentioned encryption result based on a private key to obtain a decryption result, wherein the above-mentioned encryption result is obtained by the above-mentioned central device encrypting the target object based on the public key; sending the above-mentioned decryption result to the above-mentioned central device, so that the above-mentioned central device determines whether the above-mentioned edge device has passed the authentication of the above-mentioned central device based on the above-mentioned decryption result; wherein the above-mentioned public key and the above-mentioned private key are asymmetric keys created for the above-mentioned edge device.

[0007] In this application, the central device can determine whether the edge device has passed the authentication of the edge device based on the decryption result from the edge device. The decryption result is obtained by the edge device decrypting the encryption result based on the private key in the asymmetric key created by it, and the encryption result is obtained by the central device encrypting the target object with the public key in the asymmetric key created by the edge device. In other words, the central device authenticates the edge device through the asymmetric key, which improves the flexibility of the device authentication method and avoids the problem of being unable to authenticate the device.

[0008] According to a third aspect, a device authentication system is provided, comprising a central device and an edge device, comprising: the central device is used to send an encryption result to the edge device, wherein the encryption result is obtained by encrypting the target object with a public key; the edge device is used to decrypt the encryption result based on a private key to obtain a decryption result, and send the decryption result to the central device; the central device is used to receive the decryption result, and judge whether the edge device has passed the authentication of the central device based on the decryption result; wherein the public key and the private key are asymmetric keys created for the edge device.

[0009] In a fourth aspect, a central device is provided, which includes: a sending module and a processing module. The sending module is used to send the encryption result to the edge device, so that the edge device decrypts the encryption result based on the private key and obtains the decryption result, and the encryption result is obtained by encrypting the target object with the public key; the processing module is used to receive the decryption result from the edge device, and judge whether the edge device has passed the authentication of the central device based on the decryption result; wherein the public key and the private key are asymmetric keys created by the edge device.

[0010] In a fifth aspect, an edge device is provided, which includes: a receiving module and a processing module. The receiving module is used to receive the encryption result from the central device, and decrypt the encryption result based on the private key to obtain the decryption result, wherein the encryption result is obtained by the central device encrypting the target object based on the public key; the sending module is used to send the decryption result to the central device, so that the central device determines whether the edge device has passed the authentication of the central device based on the decryption result; wherein the public key and the private key are asymmetric keys created by the edge device.

[0011] In a sixth aspect, a device authentication apparatus is provided, comprising a processor, the processor being coupled to a memory and being configured to execute instructions in the memory to implement the method in any possible implementation of the first aspect, the second aspect, or the third aspect. Optionally, the device authentication apparatus further comprises a memory. Optionally, the device authentication apparatus further comprises a communication interface, the processor being coupled to the communication interface.

[0012] In a seventh aspect, a processor is provided, comprising: an input circuit, an output circuit, and a processing circuit. The processing circuit is used to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes the method in any possible implementation of the first aspect, the second aspect, or the third aspect.

[0013] In the specific implementation process, the processor can be a chip, the input circuit can be an input pin, the output circuit can be an output pin, and the processing circuit can be a transistor, a gate circuit, a trigger, and various logic circuits. The input signal received by the input circuit can be, for example, but not limited to, received and input by a receiver, and the signal output by the output circuit can be, for example, but not limited to, output to a transmitter and transmitted by the transmitter, and the input circuit and the output circuit can be the same circuit, which is used as an input circuit and an output circuit at different times. The embodiments of the present application do not limit the specific implementation methods of the processor and various circuits.

[0014] In an eighth aspect, a device authentication apparatus is provided, comprising a processor and a memory. The processor is used to read instructions stored in the memory, and can receive signals through a receiver and transmit signals through a transmitter to execute the method in any possible implementation of the first aspect, the second aspect, or the third aspect.

[0015] Optionally, there are one or more processors and one or more memories.

[0016] Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0017] In the specific implementation process, the memory can be a non-transitory memory, such as a read-only memory (ROM), which can be integrated with the processor on the same chip or can be set on different chips respectively. The embodiments of the present application do not limit the type of memory and the setting method of the memory and the processor.

[0018] It should be understood that the relevant data interaction process, such as sending indication information, can be a process of outputting indication information from a processor, and receiving capability information can be a process of receiving input capability information from a processor. Specifically, the processed output data can be output to a transmitter, and the input data received by the processor can come from a receiver. Among them, the transmitter and the receiver can be collectively referred to as a transceiver.

[0019] The device authentication device in the eighth aspect mentioned above can be a chip. The processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory. The memory can be integrated in the processor or can be located outside the processor and exist independently.

[0020] In the ninth aspect, a computer program product is provided, which includes: a computer program (also referred to as code, or instruction), which, when executed, enables a computer to execute a method in any possible implementation of the first, second or third aspects.

[0021] In the tenth aspect, a computer-readable storage medium is provided, which stores a computer program (also referred to as code, or instructions). When the computer-readable storage medium is run on a computer, the computer executes a method in any possible implementation of the first aspect, the second aspect, or the third aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a schematic diagram of an application scenario provided by an embodiment of the present application;

[0023] Figure 2 is a schematic diagram of a system architecture of an electronic device provided in an embodiment of the present application;

[0024] Figure 3 is a flow chart of a device authentication method provided in an embodiment of the present application;

[0025] Figure 4 It is a schematic diagram of the interface of the central device for device authentication provided in an embodiment of the present application;

[0026] Figure 5 is a flowchart of a first specific example of a device authentication method provided in an embodiment of the present application;

[0027] Figure 6 It is a schematic diagram of the interface of a mobile phone for device authentication provided in an embodiment of the present application;

[0028] Figure 7 is a flowchart of a second specific example of the device authentication method provided in an embodiment of the present application;

[0029] Figure 8 is a flowchart of a third specific example of the device authentication method provided in an embodiment of the present application;

[0030] Fig. 9 This is a structural block diagram of an example of a device authentication apparatus provided in an embodiment of the present application;

[0031] Fig.10 is a structural block diagram of another example of a device authentication apparatus provided in an embodiment of the present application;

[0032] Fig.11 It is a structural diagram of another example of the device authentication apparatus provided in the embodiment of the present application. DETAILED DESCRIPTION

[0033] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0034] Figure 1 Schematic diagram of an application scenario 100 provided in an embodiment of the present application. Figure 1 As shown, the application scenario 100 includes a first electronic device 101 and a second electronic device 102. The first electronic device 101 can authenticate the second electronic device 102 based on the account and password of the second electronic device 102, and when it is determined that the second electronic device 102 passes the authentication, interconnection with the second electronic device 102 is achieved.

[0035] It should be understood that in the scenario where the first electronic device 101 authenticates the second electronic device 102, the first electronic device 101 can also be called the central device 101, and the second electronic device 102 can be called the edge device 102. Alternatively, in the scenario where the second electronic device 102 authenticates the first electronic device 101, the first electronic device 101 can also be called the edge device 101, and the second electronic device 102 can also be called the central device 102, and this application does not limit this.

[0036] However, the above device authentication method is not flexible, resulting in the problem of being unable to authenticate the device, which in turn causes the device to fail to achieve interconnection and interoperability with other devices.

[0037] For example, when a user uses an account and password to achieve interconnection between a first electronic device and a second electronic device, the first electronic device cannot authenticate the second electronic device because the original equipment manufacturer (OEM) accounts corresponding to the first electronic device and the second electronic device are not interoperable, thereby affecting the interconnection between the first electronic device and the second electronic user.

[0038] In view of this, the embodiments of the present application provide a device authentication method and a device authentication apparatus, wherein the central device can determine whether the edge device has passed the authentication of the edge device based on the decryption result from the edge device. The decryption result is obtained by the edge device decrypting the encryption result based on the private key in the asymmetric key created by it, and the encryption result is obtained by the central device encrypting the target object with the public key in the asymmetric key created by the edge device. In other words, the central device authenticates the edge device through an asymmetric key, which improves the flexibility of the device authentication method and avoids the problem of being unable to authenticate the device.

[0039] In addition, compared with the prior art, the device authentication method provided by this application does not require an account and password, thus avoiding the server verification operation and user operation introduced in the account and password authentication process. In other words, it reduces the interaction with the user and the server, reduces the probability of hacker theft caused by the expansion of the attack surface, and improves the efficiency of device authentication.

[0040] It should be understood that the electronic device in the embodiments of the present application may also be referred to as: user equipment (UE), mobile station (MS), mobile terminal (MT), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, etc. The electronic device involved in the embodiments of the present application may be a device that provides voice / data connectivity to a user, for example, a handheld device with wireless connection function, a vehicle-mounted device, etc. At present, some examples of terminals are: mobile phones, tablet computers, laptop computers, PDAs, mobile internet devices (MID), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminals in industrial control, wireless terminals in self driving, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handheld devices with wireless communication functions, computing devices or other processing devices connected to wireless modems, vehicle-mounted devices, wearable devices, electronic devices in 5G networks or future evolved public land mobile communication networks (public land mobile communication networks) Mobile network, PLMN) and the like, the embodiments of the present application are not limited to this.

[0041] As an example but not limitation, in the embodiments of the present application, the electronic device may also be a wearable device. Wearable devices may also be referred to as wearable smart devices, which are a general term for wearable devices that are intelligently designed and developed using wearable technology for daily wear, such as glasses, gloves, watches, clothing, and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but also powerful functions achieved through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include full-featured, large-sized, and fully or partially independent of smartphones, such as smart watches or smart glasses, as well as devices that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various types of smart bracelets and smart jewelry for vital sign monitoring.

[0042] In addition, in the embodiments of the present application, the electronic device can also be an electronic device in the Internet of Things (IoT) system. IoT is an important part of the future development of information technology. Its main technical feature is to connect objects to the network through communication technology, so as to realize the intelligent network of human-machine interconnection and object-to-object interconnection. The electronic device of the present application can also be a vehicle-mounted unit, a vehicle-mounted module, a vehicle-mounted component, a vehicle-mounted chip or a vehicle-mounted unit built into the vehicle as one or more components or units. The vehicle can implement the method of the present application through the built-in above-mentioned vehicle-mounted unit, vehicle-mounted module, vehicle-mounted component, vehicle-mounted chip or vehicle-mounted unit. Therefore, the embodiments of the present application can be applied to the Internet of Vehicles, such as vehicle to everything (V2X), long-term evolution-vehicle (LTE-V), vehicle-to-vehicle (V2V), etc.

[0043] For example, Figure 2 A schematic diagram of a system architecture of an electronic device provided in an embodiment of the present application.

[0044] like Figure 2 As shown, the electronic device includes a processor 210, a transceiver 220 and a display unit 270. The display unit 270 may include a display screen.

[0045] Optionally, the electronic device may further include a memory 230. The processor 210, the transceiver 220 and the memory 230 may communicate with each other through an internal connection path to transfer search data. The memory 230 is used to store a computer program, and the processor 210 is used to call and run the computer program from the memory 230.

[0046] The processor 210 and the memory 230 may be combined into a processing device, or more commonly, they are independent components, and the processor 210 is used to execute the program code stored in the memory 230 to implement the above functions. In specific implementation, the memory 230 may also be integrated into the processor 210, or may be independent of the processor 210.

[0047] In addition, in order to make the functions of the electronic device more complete, the electronic device may further include one or more of an input unit 260 , an audio circuit 280 , and a sensor 201 .

[0048] Optionally, the electronic device may further include a power supply 250 for providing power to various devices or circuits in the electronic device.

[0049] Understandably, Figure 2 The operations and / or functions of each module in the electronic device shown are respectively for implementing the corresponding processes in the following method embodiments. For details, please refer to the description in the following method embodiments, and the detailed description is appropriately omitted here to avoid repetition.

[0050] Understandably, Figure 2 The processor 210 in the electronic device shown may include one or more processing units, for example, the processor 210 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Among them, different processing units may be independent devices or integrated in one or more processors.

[0051] The processor 210 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 210 is a cache memory. The memory may store instructions or data that the processor 210 has just used or cyclically used. If the processor 210 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 210, and thus improves the efficiency of the system.

[0052] In some embodiments, the processor 210 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0053] It is understandable that the interface connection relationship between the modules illustrated in the embodiments of the present application is only a schematic illustration and does not constitute a structural limitation on the electronic device. In other embodiments of the present application, the electronic device may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0054] Understandably, Figure 2 The power supply 250 shown is used to supply power to the processor 210 , the memory 230 , the display unit 270 , the input unit 260 , the transceiver 220 , and the like.

[0055] The transceiver 230 can provide wireless communication solutions for electronic devices including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) network), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc. The transceiver 220 can be one or more devices integrating at least one communication processing module.

[0056] The electronic device implements the display function through a GPU, a display unit 270, and an application processor. The GPU is a microprocessor for image processing, which connects the display unit 270 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 210 may include one or more GPUs that execute program instructions to generate or change display information.

[0057] The display unit 270 is used to display images, videos, etc. (such as the search interface of the present application). The display unit 270 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light emitting diode (QLED), etc.

[0058] The memory 230 may be used to store computer executable program codes, which include instructions. The memory 230 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created during the use of the electronic device (such as search data), etc. In addition, the memory 230 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 210 executes various functional applications and data processing of the electronic device by running instructions stored in the memory 230 and / or instructions stored in a memory provided in the processor.

[0059] The electronic device can implement audio functions such as music playing and recording through the audio circuit 280 and the application processor.

[0060] It is to be understood that the structure illustrated in this embodiment does not constitute a specific limitation on the electronic device 200. In other embodiments of the present application, the electronic device 200 may include more or fewer components than those shown in the figure, or combine certain components, or separate certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0061] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0062] In order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same or similar items with substantially the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference.

[0063] It should be noted that, in this application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplarily" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplarily" or "for example" is intended to present related concepts in a specific way.

[0064] In addition, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c, where a, b, c can be single or multiple.

[0065] In order to make the purpose and technical solution of this application clearer and more intuitive, the following will be combined with the accompanying drawings and embodiments to describe in detail an authentication method and an authentication device provided by the embodiment of this application. It should be understood that the specific embodiments described here are only used to explain this application and are not used to limit this application.

[0066] Figure 3 is a schematic flow chart of a device authentication method 300 provided in an embodiment of the present application. The method 300 can be applied to the above Figure 1The application scenario 100 shown in the figure can also be applied to other scenarios, which are not limited in the present embodiment. Figure 3 As shown, the method 300 may include the following steps:

[0067] S301, the central device sends an encryption result to the edge device. Correspondingly, the edge device receives the encryption result from the central device.

[0068] In a possible implementation, the central device may encrypt the target object using a public key to obtain the above encryption result, wherein the public key may be sent to the central device when the edge device receives an authentication request from the central device.

[0069] Exemplarily, the above decryption result may be a string password, which is not limited in this application.

[0070] It should be understood that the above-mentioned central device and edge device are in a connected state to achieve interaction between the two devices.

[0071] Exemplarily, the above-mentioned connected state is used to indicate that the central device and the edge device are connected to the same network, or a Bluetooth connection is established.

[0072] It should also be understood that the central device is a device bound to a preset user account.

[0073] For example, Figure 4 A schematic diagram of an interface 400 of a central device for device authentication provided in this application. As shown in interface a, an entry for logging in to an account and a button corresponding to the entry are displayed. The user can click the button corresponding to the entry, and when the central device detects a click operation on the button corresponding to the above entry, a pop-up window displaying the login account can be generated, and the operation corresponding to the instruction can be executed.

[0074] As shown in interface b, there are ways to log in to the account, such as "one-click login with local number" and "login by other methods" shown on the interface. The user can click the area where "one-click login with local number" is located, and the central device can generate an instruction to log in to the account by "one-click login with local number" when detecting the user's click operation on the area where "one-click login with local number" is located, and execute the operation corresponding to the instruction.

[0075] As shown in interface c, the account name "User 22***99" and the account number "186****3333" are displayed. The user can know that the current account login is completed through this interface.

[0076] Optionally, the user can also log in to the account through other methods by clicking on the "Other Login Methods" area shown on interface b. For example, the user can manually enter the login password. When the central device determines that the above login password is correct, it generates an instruction to log in to the account and executes the operation corresponding to the instruction to complete the account login.

[0077] It should be understood that the interface 400 of the central device shown above is merely exemplary and is not limited in this application.

[0078] It should also be understood that the above-mentioned user operations are merely exemplary. In addition to "clicking", the user operation may also be "sliding" and other operations, and this application does not limit this.

[0079] S302: The edge device decrypts the encryption result based on the private key to obtain a decryption result.

[0080] In a possible implementation, the edge device may decrypt the encryption result using a private key to obtain the decryption result.

[0081] It should be understood that the public key and private key involved in the present application may be the public key and private key in the asymmetric key created by the edge device.

[0082] S303, the edge device sends the decryption result to the central device. Correspondingly, the central device receives the decryption result from the edge device.

[0083] S304: The central device determines whether the edge device has passed the authentication of the central device based on the decryption result.

[0084] In a possible implementation, the central device may determine whether the edge device has passed the authentication of the central device based on the decryption result and the target object.

[0085] Exemplarily, the central device can compare the decryption result with the target object, and if the decryption result and the target object are the same, determine that the edge device has passed the authentication of the central device and achieves interconnection with the edge device. Alternatively, if the decryption result and the target object are not the same, determine that the edge device has not passed the authentication of the central device.

[0086] In this application, the central device can determine whether the edge device has passed the authentication of the edge device based on the decryption result from the edge device. The decryption result is obtained by the edge device decrypting the encryption result based on the private key in the asymmetric key created by it, and the encryption result is obtained by the central device encrypting the target object with the public key in the asymmetric key created by the edge device. In other words, the central device authenticates the edge device through the asymmetric key, which improves the flexibility of the device authentication method and avoids the problem of being unable to authenticate the device.

[0087] It should be understood that the edge device involved in this application may be one or more, and this application does not limit this.

[0088] The following describes in detail the device authentication method provided in this application by taking a central device as a mobile phone and an edge device as one, such as a tablet computer, as an example.

[0089] Figure 5 is a schematic flow chart of a device authentication method 500 provided in an embodiment of the present application. Figure 5 As shown, the method 500 may include the following steps:

[0090] S501, the mobile phone sends an authentication request to the tablet computer. Correspondingly, the tablet computer receives the authentication request from the mobile phone.

[0091] It should be understood that the mobile phone can send an authentication request to the tablet computer when it is determined that it is connected to the tablet computer. Alternatively, the mobile phone can also execute the above S501 when it is determined that it is connected to the tablet computer and detects the user's sending operation (also known as a preset user operation), which is not limited in this application.

[0092] It should also be understood that the sending operation of the user mentioned above may be an operation of a function button or interface on the mobile phone for sending an authentication request.

[0093] S502: The tablet computer creates an asymmetric key based on the authentication request. The asymmetric key includes a public key and a private key.

[0094] S503, the tablet computer sends a public key to the mobile phone. Correspondingly, the mobile phone receives the public key from the tablet computer.

[0095] S504, the mobile phone encrypts the target object using the public key to obtain an encryption result.

[0096] In a possible implementation manner, the target object is determined by the mobile phone based on a user input operation.

[0097] For example, before the above S504, the mobile phone may display an interface containing an input area of ​​the target object, and the user inputs the target content in the input area according to his / her own needs, so that the mobile phone determines the target object based on the target content.

[0098] Figure 6 Schematic diagram of a mobile phone interface 600 for device authentication provided in an embodiment of the present application. Figure 6As shown, the interface 600 displays a prompt message of "Please enter the target object" and a corresponding input area. The user can enter custom content in the input area so that the mobile phone can determine the custom content as the target object, and encrypt the custom content with the public key to obtain the encryption result, so that the edge device can be authenticated based on the encryption result later.

[0099] It should be understood that the interface 600 shown above is merely exemplary and is not limited to this application.

[0100] In another possible implementation, the target object may be automatically generated by the mobile phone.

[0101] Exemplarily, the target object may be randomly generated by the mobile phone. Alternatively, it may be generated by the mobile phone based on historical data. For example, the mobile phone may determine the target object based on a historically obtained personal identification code PIN and / or a user's biometrics, etc., which is not limited in this application.

[0102] S505, the mobile phone sends the encryption result to the tablet computer. Correspondingly, the tablet computer receives the encryption result from the mobile phone.

[0103] S506: The tablet computer decrypts the encryption result based on the private key to obtain a decryption result.

[0104] S507, the tablet computer sends the decryption result to the mobile phone. Correspondingly, the mobile phone receives the decryption result from the tablet computer.

[0105] S508, the mobile phone determines whether the decryption result is the same as the target object.

[0106] S509, when the decryption result is the same as the target object, the mobile phone determines that the tablet computer has passed the authentication of the mobile phone, and realizes interconnection and intercommunication with the tablet computer.

[0107] Optionally, following S508 , the mobile phone may also determine that the tablet computer has not passed the authentication of the mobile phone when the decryption result is different from the target object.

[0108] It should be understood that in addition to the mobile phone authenticating the tablet computer shown above, the tablet computer can also authenticate the mobile phone, and in this scenario, the tablet computer can also be called a central device, and the mobile phone can also be called an edge device, which is not limited in this application.

[0109] The device authentication method provided in this application is described in detail below, taking a central device as a mobile phone and multiple edge devices, such as a tablet computer (also referred to as a first edge device) and a smart watch (also referred to as a second edge device) as an example.

[0110] Figure 7700 is a schematic flow chart of a device authentication method 700 provided in an embodiment of the present application. Figure 7 As shown, the method 700 may include the following steps:

[0111] S701, the mobile phone sends a first authentication request to the tablet computer. Correspondingly, the tablet computer receives the first authentication request from the mobile phone.

[0112] Similarly, the mobile phone can send the first authentication request to the tablet computer when it is determined that it is connected to the tablet computer. Alternatively, the mobile phone can also execute S701 when it is determined that it is connected to the tablet computer and detects the user's sending operation, which is not limited in this application.

[0113] S702: The tablet computer creates a first asymmetric key based on the first authentication request, where the first asymmetric key includes a first public key and a first private key.

[0114] S703, the mobile phone sends a second authentication request to the smart watch. Correspondingly, the smart watch receives the second authentication request from the mobile phone.

[0115] Similarly, the mobile phone can send a second authentication request to the smart watch when it is determined that it is connected to the smart watch. Alternatively, the mobile phone can also execute the above S703 when it is determined that it is connected to the smart watch and detects the user's sending operation, which is not limited in this application.

[0116] S704: The smart watch creates a second asymmetric key based on the second authentication request, where the second asymmetric key includes a second public key and a second private key.

[0117] S705, the tablet computer sends the first public key to the mobile phone. Correspondingly, the mobile phone receives the first public key from the tablet computer.

[0118] S706, the smart device sends the second public key to the mobile phone. Correspondingly, the mobile phone receives the second public key from the smart watch.

[0119] S707, the mobile phone encrypts the target object using the first public key to obtain a third encryption result.

[0120] S708, the mobile phone encrypts the target object using the second public key to obtain a fourth encryption result.

[0121] It should be understood that the target object may be determined by the mobile phone based on the user's input operation (see Figure 6 ), or automatically generated, which is not limited in this application.

[0122] It should also be understood that the target objects in the above S707 and S708 may be the same or different, and this application does not limit this.

[0123] S709, the mobile phone sends the third encryption result to the tablet computer. Correspondingly, the tablet computer receives the third encryption result from the mobile phone.

[0124] S710, the mobile phone sends the fourth encryption result to the smart watch. Correspondingly, the smart watch receives the fourth encryption result from the mobile phone.

[0125] S711. The tablet computer decrypts the third encryption result based on the first private key to obtain a third decryption result.

[0126] S712: The smart watch decrypts the fourth encryption result based on the second private key to obtain a fourth decryption result.

[0127] S713, the tablet computer sends the third decryption result to the mobile phone. Correspondingly, the mobile phone receives the third decryption result from the tablet computer.

[0128] S714, the smart watch sends the fourth decryption result to the mobile phone. Correspondingly, the mobile phone receives the fourth decryption result from the smart watch.

[0129] S715, when the third decryption result is the same as the target object, the mobile phone determines that the tablet computer has passed the authentication of the mobile phone, and realizes interconnection and intercommunication with the tablet computer.

[0130] S716, when the fourth decryption result is the same as the target object, the mobile phone determines that the smart watch has passed the authentication of the mobile phone and realizes interconnection with the smart watch.

[0131] Optionally, following S713, the mobile phone may determine that the tablet computer has not passed the authentication of the mobile phone when the third decryption result is different from the target object. Following S714, the mobile phone may determine that the smart watch has not passed the authentication of the mobile phone when the fourth decryption result is different from the target object.

[0132] It should be understood that in the case of multiple edge devices, the present application can also implement mutual authentication between edge devices through the central device. That is, following the above S715 and S716, the present application can also implement authentication between edge devices (such as the above tablet computer and smart watch).

[0133] As above, taking the central device as a mobile phone, the first edge device as a tablet computer, and the second edge device as a smart watch as an example, the device authentication method provided in this application is described in detail.

[0134] Figure 8 FIG. 8 is a schematic flow chart of a device authentication method 800 provided in an embodiment of the present application. Figure 8 As shown, the method 800 may include the following steps:

[0135] S801, the mobile phone sends the second public key of the smart watch to the tablet computer. Correspondingly, the tablet computer receives the second public key of the smart watch.

[0136] It should be understood that the mobile phone can send the second public key to the tablet computer when it is determined that the above edge devices, such as the tablet computer and the smart watch, have passed the authentication of the mobile phone (there are multiple devices that have passed the authentication of the mobile phone). Alternatively, the mobile phone can also execute the above S801 when it is determined that the above edge devices, such as the tablet computer and the smart watch, have passed the authentication of the mobile phone and detected the sending operation of the user, which is not limited in this application.

[0137] It should also be understood that the sending operation of the user mentioned above may be an operation of a function button or interface on the mobile phone for sending the second public key.

[0138] S802, the mobile phone sends the first public key of the tablet computer to the smart watch. Correspondingly, the smart watch receives the first public key of the tablet computer.

[0139] Similarly, the mobile phone can send the first public key to the smart watch when it is determined that the above edge devices, such as the tablet computer and the smart watch, have passed the authentication of the mobile phone. Alternatively, the mobile phone can also execute the above S801 when it is determined that the above edge devices, such as the tablet computer and the smart watch, have passed the authentication of the mobile phone and detected the sending operation of the user, which is not limited in this application.

[0140] It should also be understood that the sending operation of the user mentioned above may be an operation on a function button or interface on the mobile phone for sending the first public key.

[0141] It should be understood that the embodiment of the present application mainly takes two edge devices as an example to describe the device authentication method provided by the present application. In addition, the above edge devices may also include devices other than the tablet computer and smart watch shown above, and the present application does not limit this.

[0142] S803: The tablet computer encrypts the first target object based on the second public key to obtain a second encryption result.

[0143] S804, the tablet computer sends the second encryption result to the smart watch. Correspondingly, the smart watch receives the second encryption result from the tablet computer.

[0144] S805: The smart watch encrypts the second target object based on the first public key to obtain a first encryption result.

[0145] S806: The smart watch sends the first encryption result to the tablet computer. Correspondingly, the tablet computer receives the first encryption result from the smart watch.

[0146] S807: The tablet computer decrypts the first encryption result based on the first private key to obtain a first decryption result.

[0147] S808, when the tablet computer determines that the first decryption result is the same as the first target object, the tablet computer determines that the smart watch has passed the authentication of the tablet computer and achieves interconnection with the smart watch.

[0148] S809: The smart watch decrypts the second encryption result based on the second private key to obtain a second decryption result.

[0149] S810, when the smart watch determines that the second decryption result is the same as the second target object, it determines that the tablet computer has passed the authentication of the smart watch and realizes interconnection and intercommunication with the tablet computer.

[0150] It should be understood that the mobile phones, tablet computers and smart watches shown in the above embodiments are merely exemplary. In addition, the central devices and edge devices involved in this application may also be other specific devices, which is not limited in this application.

[0151] It should also be understood that the above embodiments may be coupled to each other, and this application does not limit this. Moreover, the size of the sequence number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0152] Combined with the above Figures 1 to 8 , describes in detail the device authentication method of the embodiment of the present application, and will now be combined with Figures 9 to 11 , describe in detail the device authentication device of the embodiment of the present application.

[0153] Figure 7 The device authentication apparatus 900 provided in the embodiment of the present application is shown. The device authentication apparatus 900 includes: a sending module 901 and a processing module 902 .

[0154] Among them, the sending module 901 is used to: send the encryption result to the above-mentioned edge device, so that the above-mentioned edge device decrypts the above-mentioned encryption result based on the private key and obtains the decryption result, and the above-mentioned encryption result is obtained by encrypting the target object with the public key; the processing module 902 is used to: receive the above-mentioned decryption result from the above-mentioned edge device, and judge whether the above-mentioned edge device has passed the authentication of the above-mentioned central device based on the above-mentioned decryption result; wherein the above-mentioned public key and the above-mentioned private key are asymmetric keys created by the above-mentioned edge device.

[0155] Optionally, the processing module 902 is used to: determine whether the edge device has passed the authentication of the central device based on the decryption result and the target object; wherein, whether the edge device has passed the authentication of the central device is determined by the central device when the decryption result is the same as the target object; whether the edge device has not passed the authentication of the central device is determined by the central device when the decryption result is different from the target object.

[0156] Optionally, the target object includes a personal identification number PIN and / or a user's biometric features.

[0157] Optionally, the sending module 901 is used to: when it is determined that the edge device has passed the authentication of the central device, send the second public key of the second edge device to the first edge device, so that the first edge device can judge whether the second edge device has passed the authentication of the first edge device based on the second decryption result, the second decryption result is obtained by the second edge device decrypting the second encryption result based on the second private key, and the second encryption result is obtained by the first edge device encrypting the first target object based on the second public key; and send the first public key of the first edge device to the second edge device, so that the second edge device can judge whether the first edge device has passed the authentication of the second edge device based on the first decryption result, the first decryption result is obtained by the first edge device decrypting the first encryption result based on the first private key, and the first encryption result is obtained by the second edge device encrypting the second target object based on the first public key; wherein the first public key and the first private key are the first asymmetric keys created by the first edge device, and the second public key and the second private key are the second asymmetric keys created by the second edge device.

[0158] Optionally, the sending module 901 is used to: send the authentication request of the above-mentioned central device to the above-mentioned edge device, so that the above-mentioned edge device creates the above-mentioned asymmetric key; the processing module 902 is used to: receive the above-mentioned public key from the above-mentioned edge device; encrypt the above-mentioned target object based on the above-mentioned public key to obtain the above-mentioned encryption result.

[0159] Optionally, the sending module 901 is used to: when it is determined that a preset user operation is detected, send an authentication request of the above-mentioned central device to the above-mentioned edge device; or when it is determined that the above-mentioned central device and the above-mentioned edge device are in a connected state, send an authentication request of the above-mentioned central device to the above-mentioned edge device.

[0160] Optionally, the central device and the edge device are in a connected state to indicate that the central device and the edge device are connected to the same network, or a Bluetooth connection is established.

[0161] Optionally, the central device is a device bound to a preset user account.

[0162] It should be understood that the device authentication device 900 here is embodied in the form of a functional module. The term "module" here may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a proprietary processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merged logic circuit and / or other suitable components that support the described functions. In an optional example, those skilled in the art may understand that the device authentication device 900 may be specifically a central device in the above-mentioned embodiment, or the functions of the central device in the above-mentioned embodiment may be integrated in the device authentication device 900, and the device authentication device 900 may be used to execute the various processes and / or steps corresponding to the central device in the above-mentioned method embodiment. To avoid repetition, it will not be repeated here.

[0163] The device authentication apparatus 900 has the function of implementing the corresponding steps performed by the central device in the above method; the above functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. In the embodiment of the present application, Fig. 9 The device authentication apparatus 900 in the embodiment may also be a chip or a chip system, for example, a system on chip (SoC).

[0164] Fig.10 Another device authentication apparatus 1000 provided in an embodiment of the present application is shown. The device authentication apparatus 1000 includes: a processing module 1001 and a sending module 1002 .

[0165] Among them, the processing module 1001 is used to: receive the encryption result from the above-mentioned central device, and decrypt the above-mentioned encryption result based on the private key to obtain the decryption result, and the above-mentioned encryption result is obtained by the above-mentioned central device encrypting the target object based on the public key; the sending module 1002 is used to: send the above-mentioned decryption result to the above-mentioned central device, so that the above-mentioned central device determines whether the above-mentioned edge device has passed the authentication of the above-mentioned central device based on the above-mentioned decryption result; wherein the above-mentioned public key and the above-mentioned private key are asymmetric keys created by the above-mentioned edge device.

[0166] Optionally, the processing module 1001 is used to: receive the authentication request from the above-mentioned central device, and create the above-mentioned asymmetric key based on the authentication request of the above-mentioned central device; the sending module 1002 is used to: send the above-mentioned public key to the above-mentioned central device, so that the above-mentioned central device encrypts the above-mentioned target object based on the above-mentioned public key to obtain the above-mentioned encryption result.

[0167] Optionally, the authentication request of the central device is sent by the central device to the edge device when it is determined that a preset user operation is detected; or, the central device sends the authentication request to the edge device when it is determined that the central device and the edge device are in a connected state.

[0168] Optionally, the central device and the edge device are in a connected state to indicate that the central device and the edge device are connected to the same network, or a Bluetooth connection is established.

[0169] Optionally, the target object includes a personal identification number PIN and / or a user's biometric features.

[0170] Optionally, the processing module 1001 is used to: receive a second public key of a second edge device from the above-mentioned central device; the sending module 1002 is used to: send a first encryption result to the above-mentioned second edge device, so that the above-mentioned second edge device decrypts the above-mentioned first encryption result based on the second private key, and obtains a first decryption result, and the above-mentioned first encryption result is obtained by the above-mentioned first edge device encrypting the first target object based on the above-mentioned second public key; the processing module 1001 is used to: receive the first decryption result from the above-mentioned second edge device, and based on the above-mentioned first decryption result, determine whether the above-mentioned second edge device has passed the authentication of the first edge device; wherein the above-mentioned second public key is sent to the above-mentioned first edge device by the above-mentioned central device when it is determined that the above-mentioned edge device has passed the authentication of the above-mentioned central device, and the above-mentioned second public key and the above-mentioned second private key are second asymmetric keys created for the above-mentioned second edge device; the above-mentioned second edge device is a device other than the above-mentioned first edge device in the above-mentioned device authentication system that has passed the authentication of the central device.

[0171] Optionally, the processing module 1001 is used to: receive a second encryption result from the second edge device, where the second encryption result is obtained by the second edge device encrypting the second target object based on the first public key; decrypt the second encryption result based on the first private key to obtain a second decryption result; the sending module 1002 is used to: send the second decryption result to the second edge device, so that the second edge device determines whether the first edge device has passed the authentication of the second edge device based on the second decryption result; wherein the first public key is sent to the second edge device by the central device when it is determined that the edge device has passed the authentication of the central device; the first public key and the first private key are the first asymmetric keys created for the first edge device.

[0172] Optionally, the central device is a device bound to a preset user account.

[0173] It should be understood that the device authentication device 1000 here is embodied in the form of a functional module. The term "module" here may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (such as a shared processor, a proprietary processor or a group processor, etc.) and a memory for executing one or more software or firmware programs, a merged logic circuit and / or other suitable components that support the described functions. In an optional example, those skilled in the art may understand that the device authentication device 1000 may be specifically an edge device in the above-mentioned embodiment, or the functions of the edge device in the above-mentioned embodiment may be integrated in the device authentication device 1000, and the device authentication device 1000 may be used to execute the various processes and / or steps corresponding to the edge device in the above-mentioned method embodiment. To avoid repetition, it will not be repeated here.

[0174] The device authentication apparatus 1000 has the function of implementing the corresponding steps performed by the edge device in the above method; the above functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions. In the embodiment of the present application, Fig.10 The device authentication apparatus 1000 in the embodiment may also be a chip or a chip system, for example, a system on chip (SoC).

[0175] Fig.11 Another device authentication device 1100 provided in an embodiment of the present application is shown. The device authentication device 1100 includes: a processor 1101 and a memory 1102, a communication interface 1103 and a bus 1104. Among them, the memory 1102 is used to store instructions, and the processor 1101 is used to execute the instructions stored in the memory 1102. The processor 1101, the memory 1102 and the communication interface 1103 are connected to each other through the bus 1104.

[0176] In the first implementation, the device authentication apparatus 1100 may be specifically the central device in the above embodiment. The processor 1101 is used to: send the encryption result to the edge device, so that the edge device decrypts the encryption result based on the private key and obtains the decryption result, and the encryption result is obtained by encrypting the target object with the public key; and receive the decryption result from the edge device, and determine whether the edge device has passed the authentication of the central device based on the decryption result; wherein the public key and the private key are asymmetric keys created by the edge device.

[0177] In a second implementation, the device authentication device 1100 may be specifically an edge device in the above embodiment. The processor 1101 is used to: receive the encryption result from the central device, and decrypt the encryption result based on the private key to obtain the decryption result, wherein the encryption result is obtained by the central device encrypting the target object based on the public key; and send the decryption result to the central device, so that the central device determines whether the edge device has passed the authentication of the central device based on the decryption result; wherein the public key and the private key are asymmetric keys created by the edge device.

[0178] It should be understood that the device authentication device 1100 can specifically be a central device or an edge device in the above-mentioned embodiments, and the functions of the central device or the edge device in the above-mentioned embodiments can be integrated in the device authentication device 1100. The device authentication device 1100 can be used to execute the various steps and / or processes corresponding to the central device or the edge device in the above-mentioned method embodiments.

[0179] Optionally, the memory 1102 may include a read-only memory and a random access memory, and provide instructions and data to the processor 1101. A portion of the memory 1102 may also include a non-volatile random access memory. For example, the memory 1102 may also store information about the device type. The processor 1101 may be used to execute instructions stored in the memory, and when the processor executes the instruction, the processor 1101 may execute the various steps and / or processes corresponding to the central device or the edge device in the above method embodiment.

[0180] It should be understood that in the embodiments of the present application, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0181] In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software. The steps of the method disclosed in conjunction with the embodiment of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in a processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor executes the instructions in the memory, and completes the steps of the above method in conjunction with its hardware. To avoid repetition, it is not described in detail here.

[0182] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0183] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0184] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0185] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0186] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0187] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or terminal device, etc.) to perform all or part of the steps of the above methods in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0188] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the above claims.

Claims

1. A device authentication method, characterized in that: A central device applied to a device authentication system, wherein the device authentication system further includes an edge device, and the method includes: Sending the encryption result to the edge device, so that the edge device decrypts the encryption result based on the private key and obtains the decryption result, wherein the encryption result is obtained by encrypting the target object with the public key; receiving the decryption result from the edge device, and judging whether the edge device has passed the authentication of the central device based on the decryption result; The public key and the private key are asymmetric keys created by the edge device.

2. The method according to claim 1, characterized in that: The determining, based on the decryption result, whether the edge device has passed the authentication of the central device includes: Based on the decryption result and the target object, determining whether the edge device has passed the authentication of the central device; Among them, the edge device passes the authentication of the central device when the central device determines that the decryption result is the same as the target object; the edge device fails to pass the authentication of the central device when the central device determines that the decryption result is different from the target object.

3. The method according to claim 1 or 2, characterized in that: The target object includes a personal identification number PIN and / or a user's biometric characteristics.

4. The method according to claim 2, characterized in that: The edge device includes a first edge device and a second edge device, and the method further includes: In the case where it is determined that the edge device has passed the authentication of the central device, sending the second public key of the second edge device to the first edge device, so that the first edge device determines whether the second edge device has passed the authentication of the first edge device based on a second decryption result, where the second decryption result is obtained by the second edge device decrypting the second encryption result based on the second private key, and the second encryption result is obtained by the first edge device encrypting the first target object based on the second public key; Sending the first public key of the first edge device to the second edge device, so that the second edge device determines whether the first edge device is authenticated by the second edge device based on a first decryption result, wherein the first decryption result is obtained by the first edge device decrypting the first encryption result based on the first private key, and the first encryption result is obtained by the second edge device encrypting the second target object based on the first public key; The first public key and the first private key are first asymmetric keys created by the first edge device, and the second public key and the second private key are second asymmetric keys created by the second edge device.

5. The method according to claim 1, characterized in that: Before sending the encryption result to the edge device, the method further includes: Sending an authentication request of the central device to the edge device so that the edge device creates the asymmetric key; receiving the public key from the edge device; The target object is encrypted based on the public key to obtain the encryption result.

6. The method according to claim 5, characterized in that The sending the authentication request of the central device to the edge device includes: In the case where it is determined that a preset user operation is detected, sending an authentication request of the central device to the edge device; or, When it is determined that the central device and the edge device are in a connected state, an authentication request of the central device is sent to the edge device.

7. The method according to claim 6, characterized in that The central device and the edge device are in a connected state, which indicates that the central device and the edge device are connected to the same network, or a Bluetooth connection is established.

8. The method according to any one of claims 1 to 7, characterized in that The central device is a device bound to a preset user account.

9. A device authentication method, characterized in that: An edge device applied to a device authentication system, the device authentication system further comprising a central device, the method comprising: Receiving an encryption result from the central device, and decrypting the encryption result based on a private key to obtain a decryption result, wherein the encryption result is obtained by the central device encrypting the target object based on a public key; Sending the decryption result to the central device, so that the central device determines whether the edge device has passed the authentication of the central device based on the decryption result; The public key and the private key are asymmetric keys created by the edge device.

10. The method according to claim 9, characterized in that Before receiving the encryption result from the central device, the method further includes: receiving an authentication request from the central device, and creating the asymmetric key based on the authentication request from the central device; The public key is sent to the central device, so that the central device encrypts the target object based on the public key to obtain the encryption result.

11. The method according to claim 10, characterized in that The authentication request of the central device is sent by the central device to the edge device when it determines that a preset user operation is detected; or, the central device sends the authentication request to the edge device when it determines that the central device and the edge device are in a connected state.

12. The method according to claim 11, characterized in that The central device and the edge device are in a connected state, which indicates that the central device and the edge device are connected to the same network, or a Bluetooth connection is established.

13. The method according to claim 9, characterized in that The target object includes a personal identification number PIN and / or a user's biometric characteristics.

14. The method according to claim 9, characterized in that The edge device is a first edge device, and the method further includes: receiving a second public key of a second edge device from the central device; Sending a first encryption result to the second edge device, so that the second edge device decrypts the first encryption result based on the second private key and obtains a first decryption result, where the first encryption result is obtained by the first edge device encrypting the first target object based on the second public key; receiving a first decryption result from the second edge device, and determining whether the second edge device has passed the authentication of the first edge device based on the first decryption result; Among them, the second public key is sent by the central device to the first edge device when it is determined that the edge device has passed the authentication of the central device, and the second public key and the second private key are second asymmetric keys created for the second edge device; the second edge device is an edge device in the device authentication system that has passed the authentication of the central device except the first edge device.

15. The method according to claim 14, characterized in that The method further comprises: Receive a second encryption result from the second edge device, where the second encryption result is obtained by the second edge device encrypting the second target object based on the first public key; decrypting the second encryption result based on the first private key to obtain a second decryption result; Sending the second decryption result to the second edge device, so that the second edge device determines whether the first edge device is authenticated by the second edge device based on the second decryption result; The first public key is sent by the central device to the second edge device when it is determined that the edge device has passed the authentication of the central device; the first public key and the first private key are first asymmetric keys created for the first edge device.

16. The method according to any one of claims 9 to 14, characterized in that The central device is a device bound to a preset user account.

17. A device authentication system, characterized in that: Includes central equipment and edge equipment, including: The central device is used to send an encryption result to the edge device, where the encryption result is obtained by encrypting the target object with a public key; The edge device is used to decrypt the encryption result based on the private key to obtain a decryption result, and send the decryption result to the central device; The central device is used to receive the decryption result and determine whether the edge device has passed the authentication of the central device based on the decryption result; wherein the public key and the private key are asymmetric keys created by the edge device.

18. A central device, characterized in that: include: A sending module, used to send the encryption result to the edge device, so that the edge device decrypts the encryption result based on the private key and obtains the decryption result, wherein the encryption result is obtained by encrypting the target object with the public key; A processing module is used to receive the decryption result from the edge device and determine whether the edge device has passed the authentication of the central device based on the decryption result; wherein the public key and the private key are asymmetric keys created by the edge device.

19. An edge device, characterized in that: include: A processing module, used for receiving the encryption result from the central device, and decrypting the encryption result based on a private key to obtain a decryption result, wherein the encryption result is obtained by the central device encrypting the target object based on a public key; A sending module is used to send the decryption result to the central device, so that the central device determines whether the edge device has passed the authentication of the central device based on the decryption result; wherein the public key and the private key are asymmetric keys created by the edge device.

20. A device authentication apparatus, characterized in that: The system comprises a processor and a memory, wherein the memory is used to store code instructions, and the processor is used to run the code instructions to execute the method according to any one of claims 1 to 17.

21. A computer-readable storage medium, characterized in that: Used to store a computer program, the computer program comprising instructions for implementing the method according to any one of claims 1 to 17.

22. A computer program product, comprising computer program code, characterized in that: When the computer program code is executed on a computer, the computer is caused to implement the method according to any one of claims 1 to 17.

Images