Equipment authentication method and system based on voucher distribution

Abstract

The invention provides an equipment authentication method and system based on voucher distribution, and belongs to the technical field of equipment authentication. In the method, each terminal applies for a voucher to a voucher distribution server, the voucher distribution server distributes the voucher to each terminal, and credible authentication is established between different terminals based on the issued voucher. According to the invention, a safe and effective authentication process between different intelligent devices is realized in an unsafe complex network environment.

Description

Technical Field

[0001] The present invention belongs to the technical field of device authentication, and in particular relates to a device authentication method and system based on credential distribution. Background Art

[0002] In an insecure and complex network environment, there are technical challenges in how several smart devices can safely and effectively authenticate each other.

[0003] For existing smart devices based on a certain operating system, if they want to achieve inter-device authentication (for example, to support certain application functions, each device needs to establish trusted authentication with the other device first), they need to get the identification of the other device face to face, which is very inconvenient in ever-changing and complex scenarios. Or they can use other remote interaction methods, but in this way, they cannot judge the other party's intentions, that is, they cannot verify whether the source is reliable.

[0004] In the prior art, face-to-face verification is performed using individual identification codes (PIN codes): each device has a unique PIN code, and trusted authentication is established with the peer device by obtaining the peer's PIN code (manually input or scanned). However, remotely obtaining the peer's PIN code cannot ensure that the source is reliable; face-to-face PIN code acquisition is subject to greater constraints in complex scenarios. Summary of the invention

[0005] In view of the above technical problems, the present invention proposes a device authentication solution based on credential distribution.

[0006] The first aspect of the present invention provides a device authentication method based on credential distribution. The method comprises:

[0007] Step S1, each terminal applies for a certificate from the certificate distribution server;

[0008] Wherein, in the step S1: the terminal sends a credential application message to the credential distribution server, including the terminal's own public key and the terminal's own device information;

[0009] Step S2: the credential distribution server distributes credentials to each terminal;

[0010] Wherein, in the step S2: the credential distribution server pre-configures a server public and private key pair for digital signature; the credential distribution server generates an original text based on the terminal's own public key and the terminal's own device information in the credential application message, and generates a signature of the original text using a digest algorithm, and forms a credential in combination with the server public key, and sends the credential to the terminal;

[0011] Step S3: Establish trusted authentication between different terminals based on the issued credentials.

[0012] According to the method of the first aspect of the present invention, in step S2:

[0013] Assemble the terminal's own public key, the terminal's own device information, and the certificate distribution server's own related information into a string as the original text;

[0014] Based on the original text, the SHA digest algorithm is used to generate a hash value as the summary of the original text; the server private key is used to sign the summary of the original text through the ECC digital signature algorithm to obtain the signature of the original text;

[0015] Assemble the original text, the original text signature, and the server public key into a certificate, and send the certificate to the terminal.

[0016] According to the method of the first aspect of the present invention, in step S3, different terminals establish trusted authentication specifically including:

[0017] The first terminal extracts the original text P1 and the signature of the original text P1 from its own certificate, composes a first message, sends the first message to the second terminal, and simultaneously receives a second message from the second terminal, the second message including the original text P2 extracted from the second terminal's own certificate and the signature of the original text P2;

[0018] The first terminal retrieves the server public key PK from its own certificate, and uses the server public key PK to verify the signature of the original text P2 in the second message. After the signature verification is successful, the summary of the original text P2 is obtained; the summary of the original text P2 is decrypted using the decryption algorithm to obtain the decrypted original text P2';

[0019] The first terminal compares the decrypted original text P2' with the original text P2 extracted from the second message. If the two are consistent, the first terminal extracts the public key of the second terminal from the original text P2 to negotiate a secret key with the second terminal, thereby establishing a trusted authentication.

[0020] The second aspect of the present invention provides a device authentication system based on credential distribution. The system includes a credential distribution server and several terminals; wherein:

[0021] Each terminal applies for a certificate from the certificate distribution server respectively;

[0022] The terminal sends a certificate application message to the certificate distribution server, including the terminal's own public key and the terminal's own device information;

[0023] The credential distribution server distributes credentials to each terminal;

[0024] The credential distribution server pre-configures a server public and private key pair for digital signature; the credential distribution server generates an original text based on the terminal's own public key and the terminal's own device information in the credential application message, and generates a signature of the original text using a digest algorithm, and forms a credential in combination with the server's public key, and sends the credential to the terminal;

[0025] Trusted authentication is established between different terminals based on the issued credentials.

[0026] According to the system of the second aspect of the present invention, the credential issuing server is configured to:

[0027] Assemble the terminal's own public key, the terminal's own device information, and the certificate distribution server's own related information into a string as the original text;

[0028] Based on the original text, the SHA digest algorithm is used to generate a hash value as the summary of the original text; the server private key is used to sign the summary of the original text through the ECC digital signature algorithm to obtain the signature of the original text;

[0029] Assemble the original text, the original text signature, and the server public key into a certificate, and send the certificate to the terminal.

[0030] According to the system of the second aspect of the present invention, different terminals establish trusted authentication specifically including:

[0031] The first terminal extracts the original text P1 and the signature of the original text P1 from its own certificate, composes a first message, sends the first message to the second terminal, and simultaneously receives a second message from the second terminal, the second message including the original text P2 extracted from the second terminal's own certificate and the signature of the original text P2;

[0032] The first terminal retrieves the server public key PK from its own certificate, and uses the server public key PK to verify the signature of the original text P2 in the second message. After the signature verification is successful, the summary of the original text P2 is obtained; the summary of the original text P2 is decrypted using the decryption algorithm to obtain the decrypted original text P2';

[0033] The first terminal compares the decrypted original text P2' with the original text P2 extracted from the second message. If the two are consistent, the first terminal extracts the public key of the second terminal from the original text P2 to negotiate a secret key with the second terminal, thereby establishing a trusted authentication.

[0034] The third aspect of the present invention discloses an electronic device. The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the steps in the device authentication method based on credential distribution of the present invention are implemented.

[0035] A fourth aspect of the present invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of a device authentication method based on credential distribution of the present invention are implemented.

[0036] In summary, the device authentication scheme provided by the present invention does not need to obtain the identification of the other party, thus avoiding the problems encountered in the process of obtaining the identification of the other party, such as the inability to ensure the reliability of the source of the PIN code of the other party when remotely obtaining it, and the greater constraints on face-to-face acquisition of the PIN code in complex scenarios; the credentials of each terminal are issued by a credential server, and the identity of the person applying for the credential is verified by the credential server administrator, which ensures the reliability of the credential. At the same time, the physical direct connection method ensures the security of the transmission, and there will be no problems such as man-in-the-middle attacks; the credential carries the server public key, which does not need to be obtained separately, which simplifies the public key acquisition process while ensuring the reliability of the public key; under the premise of reliable public keys, trusted authentication between devices is ultimately achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 It is a schematic diagram of terminal application credentials.

[0039] Figure 2 It is a schematic diagram of the credential generation process.

[0040] Figure 3 It is a schematic diagram of the authentication process between different terminals. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0042] The first aspect of the present invention provides a device authentication method based on credential distribution. The method comprises:

[0043] Step S1, each terminal applies for a certificate from the certificate distribution server;

[0044] Wherein, in the step S1: the terminal sends a credential application message to the credential distribution server, including the terminal's own public key and the terminal's own device information;

[0045] Step S2: the credential distribution server distributes credentials to each terminal;

[0046] Wherein, in the step S2: the credential distribution server pre-configures a server public and private key pair for digital signature; the credential distribution server generates an original text based on the terminal's own public key and the terminal's own device information in the credential application message, and generates a signature of the original text using a digest algorithm, and forms a credential in combination with the server public key, and sends the credential to the terminal;

[0047] Step S3: Establish trusted authentication between different terminals based on the issued credentials.

[0048] According to the method of the first aspect of the present invention, in step S2:

[0049] Assemble the terminal's own public key, the terminal's own device information, and the certificate distribution server's own related information into a string as the original text;

[0050] Based on the original text, the SHA digest algorithm is used to generate a hash value as the summary of the original text; the server private key is used to sign the summary of the original text through the ECC digital signature algorithm to obtain the signature of the original text;

[0051] Assemble the original text, the original text signature, and the server public key into a certificate, and send the certificate to the terminal.

[0052] According to the method of the first aspect of the present invention, in step S3, different terminals establish trusted authentication specifically including:

[0053] The first terminal extracts the original text P1 and the signature of the original text P1 from its own certificate, composes a first message, sends the first message to the second terminal, and simultaneously receives a second message from the second terminal, the second message including the original text P2 extracted from the second terminal's own certificate and the signature of the original text P2;

[0054] The first terminal retrieves the server public key PK from its own certificate, and uses the server public key PK to verify the signature of the original text P2 in the second message. After the signature verification is successful, the summary of the original text P2 is obtained; the summary of the original text P2 is decrypted using the decryption algorithm to obtain the decrypted original text P2';

[0055] The first terminal compares the decrypted original text P2' with the original text P2 extracted from the second message. If the two are consistent, the first terminal extracts the public key of the second terminal from the original text P2 to negotiate a secret key with the second terminal, thereby establishing a trusted authentication.

[0056] Example 1: Terminal application certificate process

[0057] ① Each terminal sends a certificate to the credential distribution server (i.e. Figure 1 Credential distribution server 1, credential distribution server 2) apply for credentials.

[0058] like Figure 1 As shown: the credential distribution server 1 receives applications from smart terminals A, B and other smart terminals and issues corresponding credentials, and the credential distribution server 2 receives applications from smart terminals E, F and other smart terminals and issues corresponding credentials.

[0059] ②The terminal installs the credential application app, which can use protocols such as https to apply for credentials from the credential distribution server.

[0060] ③ Use a USB cable or network cable to establish a short-distance wired connection with the credential distribution server.

[0061] ④ Click the button in the credential application application to apply for the credential and save the obtained credential locally.

[0062] Example 2: The credential distribution server issues a credential

[0063] ① The server pre-configures a public and private key pair for digital signature;

[0064] ②Run credential generation and credential distribution services, such as Figure 2 As shown, terminal A applies for a certificate, and A sends its own public key and device information to the certificate server; after receiving the certificate server, it first assembles A's public key, A's device information and the server's own related information into a string as the original text; then the obtained original text is used to generate a hash value as a digest through the SHA digest algorithm, and the server private key is used to sign the digest through the ECC digital signature algorithm to obtain the signature of the original text; finally, the original text, the signature of the original text, and the server public key are assembled into a certificate; the certificate is sent to terminal A.

[0065] Example 3: Device establishes trusted authentication

[0066] ① Such as Figure 3 As shown, two devices, P1 and P2, enter the complex scene and need to be authenticated;

[0067] ②P1 and P2 take out the original text and the signature of the original text from their own certificates respectively to form a message;

[0068] ③P1 and P2 exchange messages with each other;

[0069] ④P1 and P2 take out the server public key from their own certificates respectively;

[0070] ⑤P1 and P2 use the server public key to decrypt the signature in the peer message respectively;

[0071] ⑥P1 and P2 compare the decrypted original text with the original text in the message respectively;

[0072] ⑦ After the original text is compared and confirmed to be correct, P1 and P2 respectively obtain the public key information of the other party from the message of the other party and negotiate the key.

[0073] In some embodiments, setting up a credential distribution server and installing a credential application application in a terminal need to be completed in advance, and the terminal can apply for credentials in advance or temporarily. When applying temporarily, it is necessary to find the nearest credential distribution server and connect to it using a connecting cable.

[0074] The second aspect of the present invention provides a device authentication system based on credential distribution. The system includes a credential distribution server and several terminals; wherein:

[0075] Each terminal applies for a certificate from the certificate distribution server respectively;

[0076] The terminal sends a certificate application message to the certificate distribution server, including the terminal's own public key and the terminal's own device information;

[0077] The credential distribution server distributes credentials to each terminal;

[0078] The credential distribution server pre-configures a server public and private key pair for digital signature; the credential distribution server generates an original text based on the terminal's own public key and the terminal's own device information in the credential application message, and generates a signature of the original text using a digest algorithm, and forms a credential in combination with the server's public key, and sends the credential to the terminal;

[0079] Trusted authentication is established between different terminals based on the issued credentials.

[0080] According to the system of the second aspect of the present invention, the credential issuing server is configured to:

[0081] Assemble the terminal's own public key, the terminal's own device information, and the certificate distribution server's own related information into a string as the original text;

[0082] Based on the original text, the SHA digest algorithm is used to generate a hash value as the summary of the original text; the server private key is used to sign the summary of the original text through the ECC digital signature algorithm to obtain the signature of the original text;

[0083] Assemble the original text, the original text signature, and the server public key into a certificate, and send the certificate to the terminal.

[0084] According to the system of the second aspect of the present invention, different terminals establish trusted authentication specifically including:

[0085] The first terminal extracts the original text P1 and the signature of the original text P1 from its own certificate, composes a first message, sends the first message to the second terminal, and simultaneously receives a second message from the second terminal, the second message including the original text P2 extracted from the second terminal's own certificate and the signature of the original text P2;

[0086] The first terminal retrieves the server public key PK from its own certificate, and uses the server public key PK to verify the signature of the original text P2 in the second message. After the signature verification is successful, the summary of the original text P2 is obtained; the summary of the original text P2 is decrypted using the decryption algorithm to obtain the decrypted original text P2';

[0087] The first terminal compares the decrypted original text P2' with the original text P2 extracted from the second message. If the two are consistent, the first terminal extracts the public key of the second terminal from the original text P2 to negotiate a secret key with the second terminal, thereby establishing a trusted authentication.

[0088] The third aspect of the present invention discloses an electronic device. The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the steps in the device authentication method based on credential distribution of the present invention are implemented.

[0089] A fourth aspect of the present invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of a device authentication method based on credential distribution of the present invention are implemented.

[0090] In summary, the device authentication scheme provided by the present invention does not need to obtain the identification of the other party, thus avoiding the problems encountered in the process of obtaining the identification of the other party, such as the inability to ensure the reliability of the source of the PIN code of the other party when remotely obtaining it, and the greater constraints on face-to-face acquisition of the PIN code in complex scenarios; the credentials of each terminal are issued by a credential server, and the identity of the person applying for the credential is verified by the credential server administrator, which ensures the reliability of the credential. At the same time, the physical direct connection method ensures the security of the transmission, and there will be no problems such as man-in-the-middle attacks; the credential carries the server public key, which does not need to be obtained separately, which simplifies the public key acquisition process while ensuring the reliability of the public key; under the premise of reliable public keys, trusted authentication between devices is ultimately achieved.

[0091] Please note that the technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. The above embodiments only express several implementation methods of the present application, and their descriptions are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, without departing from the concept of the present application, several variations and improvements can be made, which all belong to the scope of protection of the present application. Therefore, the scope of protection of the patent in this application shall be based on the attached claims.

Claims

1. A device authentication method based on credential distribution, characterized in that: The method comprises: Step S1, each terminal applies for a certificate from the certificate distribution server; Wherein, in the step S1: the terminal sends a credential application message to the credential distribution server, including the terminal's own public key and the terminal's own device information; Step S2: the credential distribution server distributes credentials to each terminal; Wherein, in the step S2: the credential distribution server pre-configures a server public and private key pair for digital signature; the credential distribution server generates an original text based on the terminal's own public key and the terminal's own device information in the credential application message, and generates a signature of the original text using a digest algorithm, and forms a credential in combination with the server public key, and sends the credential to the terminal; Step S3: Establish trusted authentication between different terminals based on the issued credentials.

2. A device authentication method based on credential distribution according to claim 1, characterized in that: In step S2: Assemble the terminal's own public key, the terminal's own device information, and the certificate distribution server's own related information into a string as the original text; Based on the original text, the SHA digest algorithm is used to generate a hash value as the summary of the original text; the server private key is used to sign the summary of the original text through the ECC digital signature algorithm to obtain the signature of the original text; Assemble the original text, the original text signature, and the server public key into a certificate, and send the certificate to the terminal.

3. A device authentication method based on credential distribution according to claim 2, characterized in that: In step S3, establishing trusted authentication between different terminals specifically includes: The first terminal extracts the original text P1 and the signature of the original text P1 from its own certificate, composes a first message, sends the first message to the second terminal, and simultaneously receives a second message from the second terminal, the second message including the original text P2 extracted from the second terminal's own certificate and the signature of the original text P2; The first terminal retrieves the server public key PK from its own certificate, and uses the server public key PK to verify the signature of the original text P2 in the second message. After the signature verification is successful, the summary of the original text P2 is obtained; the summary of the original text P2 is decrypted using the decryption algorithm to obtain the decrypted original text P2'; The first terminal compares the decrypted original text P2' with the original text P2 extracted from the second message. If the two are consistent, the first terminal extracts the public key of the second terminal from the original text P2 to negotiate a secret key with the second terminal, thereby establishing a trusted authentication.

4. A device authentication system based on credential distribution, characterized in that: The system includes a credential distribution server and several terminals; wherein: Each terminal applies for a certificate from the certificate distribution server; The terminal sends a certificate application message to the certificate distribution server, including the terminal's own public key and the terminal's own device information; The credential distribution server distributes credentials to each terminal; The credential distribution server pre-configures a server public and private key pair for digital signature; the credential distribution server generates an original text based on the terminal's own public key and the terminal's own device information in the credential application message, and generates a signature of the original text using a digest algorithm, and forms a credential in combination with the server's public key, and sends the credential to the terminal; Trusted authentication is established between different terminals based on the issued credentials.

5. A device authentication system based on credential distribution according to claim 4, characterized in that: The credential distribution server is configured as: Assemble the terminal's own public key, the terminal's own device information, and the certificate distribution server's own related information into a string as the original text; Based on the original text, the SHA digest algorithm is used to generate a hash value as the summary of the original text; the server private key is used to sign the summary of the original text through the ECC digital signature algorithm to obtain the signature of the original text; Assemble the original text, the original text signature, and the server public key into a certificate, and send the certificate to the terminal.

6. A device authentication system based on credential distribution according to claim 5, characterized in that: The specific methods for establishing trusted authentication for different terminals include: The first terminal extracts the original text P1 and the signature of the original text P1 from its own certificate, composes a first message, sends the first message to the second terminal, and simultaneously receives a second message from the second terminal, the second message including the original text P2 extracted from the second terminal's own certificate and the signature of the original text P2; The first terminal retrieves the server public key PK from its own certificate, and uses the server public key PK to verify the signature of the original text P2 in the second message. After the signature verification is successful, the summary of the original text P2 is obtained; the summary of the original text P2 is decrypted using the decryption algorithm to obtain the decrypted original text P2'; The first terminal compares the decrypted original text P2' with the original text P2 extracted from the second message. If the two are consistent, the first terminal extracts the public key of the second terminal from the original text P2 to negotiate a secret key with the second terminal, thereby establishing a trusted authentication.

7. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, the steps in the device authentication method based on credential distribution described in any one of claims 1 to 3 are implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the device authentication method based on credential distribution according to any one of claims 1 to 3 are implemented.

Images