Identification code management method and system based on encryption function, terminal and storage medium

Abstract

The invention relates to the technical field of industrial internet, and particularly provides an identification code management method and system based on an encryption function, a terminal and a storage medium, and the method comprises the steps: storing an identity certificate, an equipment secret key and a chip secret key in an exclusive storage region; performing dual processing on an identity certificate by using the equipment secret key, an encryption and decryption algorithm and a message authentication code algorithm, and sending obtained identity authentication data to a remote server; receiving encrypted identification management data issued by the remote server after the remote server obtains the identity authentication data, and extracting an identification code management command from the encrypted identification management data based on the equipment secret key; and obtaining a read-write permission for the exclusive storage area based on the chip secret key, and executing the identification code management command. According to the invention, accurate management of the equipment can be realized, the security of the system is improved, and unauthorized access and use are prevented.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial Internet, and specifically relates to an identification code management method, system, terminal and storage medium based on encryption function. Background Art

[0002] Industrial Internet is a new industrial ecology, key infrastructure and new application model that deeply integrates the new generation of information and communication technology with the industrial economy. With the acceleration of industrial digital transformation, more and more industrial equipment are connected to the industrial Internet platform. The emergence of identification technology can solve the problem of product traceability and multi-device management consuming a lot of resources.

[0003] At present, the management method of the identification management system is mostly that the management server generates identification for the business node based on the identity authentication information of the business node, and establishes a binding relationship between the identification and the identity authentication information. In the identification management process, the identification or identity authentication information needs to be interacted through the network, which is prone to data leakage. For fields with high data security requirements, it cannot meet their needs. Summary of the invention

[0004] In view of the above-mentioned deficiencies in the prior art, the present invention provides an identification code management method, system, terminal and storage medium based on encryption function to solve the above-mentioned technical problems.

[0005] In a first aspect, the present invention provides an identification code management method based on an encryption function, comprising: Store identity credentials, device keys, and chip keys in a dedicated storage area; The identity credentials are double processed using the device secret key, encryption and decryption algorithm and message authentication code algorithm, and the obtained identity authentication data is sent to a remote server; Receiving encrypted identification management data sent by the remote server after obtaining the identity authentication data, and extracting the identification code management command from the encrypted identification management data based on the device secret key; The read and write permissions for the exclusive storage area are obtained based on the chip key, and the identification code management command is executed.

[0006] In an optional implementation, the identity credential is double processed using the device key, encryption and decryption algorithm, and message authentication code algorithm, and the obtained identity authentication data is sent to a remote server, including: Read the identity certificate and device key from the dedicated storage area; The identity credential is encrypted once based on the device secret key and the encryption and decryption algorithm to generate the identity credential data ciphertext, wherein the encryption and decryption algorithm adopts the SM4 algorithm; The identity credential is encrypted using the device secret key and the message authentication code algorithm to obtain an identity credential authentication code of a fixed length; Generate identity authentication data based on the identity authentication data ciphertext and the identity credential authentication code; Upload the identity authentication data to the remote server through the remote secure communication protocol.

[0007] In an optional implementation, receiving encrypted identification management data sent by a remote server after obtaining identity authentication data, and extracting an identification code management command from the encrypted identification management data based on the device key, includes: Separating the original authentication code OAC and command data from the encrypted identification management data; Read the device key and the identification code encryption times N preset in the dedicated storage area, where the identification code encryption times is specified by the remote server; Decrypting the command data using the device secret key and a message authentication code algorithm to obtain an authentication code; Comparing the original authentication code with the authentication code for consistency to verify the identity and integrity of the message; After the verification is passed, the command data is decrypted N times based on the device secret key and the encryption and decryption algorithm to obtain the operation command type and the identification code plaintext data, and the operation command type includes addition and deletion.

[0008] In an optional implementation, obtaining read and write permissions to the exclusive storage area based on the chip key and executing the identification code management command includes: Read the chip key and obtain the random number generated by the encryption chip; Encrypting the random number using the chip secret key and encryption / decryption algorithm to obtain authority authentication data; Transmitting the permission authentication data to the encryption chip to obtain the read and write permissions to the exclusive storage area granted by the encryption chip; If the operation command type is increase and the dedicated storage area does not have an operation status identifier, write the identification code plaintext data into the dedicated storage area, and generate an operation status identifier for the dedicated storage area during the execution of the write operation; If the operation command type is deletion and there is no operation status identifier in the exclusive storage area, the target identification code is queried from the exclusive storage area based on the identification code plaintext data, the target identification code is deleted and an operation status identifier is generated for the exclusive storage area during the deletion execution.

[0009] In an optional embodiment, the method further comprises: Confirming that the identification code management command is executed successfully, and verifying whether the identification code management command is executed successfully by verifying the identification code update result; If the execution is successful, the updated identification code is uploaded to the remote server; If the execution is unsuccessful, the identification code management command is repeatedly executed until the execution is successful or the number of repetitions reaches a set threshold number of times.

[0010] In an optional implementation, uploading the updated identification code to a remote server includes: Read the chip key, device key and identification code encryption times N from the dedicated storage area; Using the chip secret key to obtain read and write permissions, and reading the identification code plaintext data from the encryption chip based on the read and write permissions; Encrypt the identification code plaintext data N times using the device secret key and the encryption and decryption algorithm to obtain identification code ciphertext data, where the preset value of N is 1 and the value range of N is 1 to 100; Calculating the identification code ciphertext data using the device secret key and the message authentication code algorithm to obtain a message authentication code of fixed length; The identification code ciphertext data and the message authentication code are spliced ​​into an identification data frame, and the identification data frame is uploaded to a remote server.

[0011] In an optional embodiment, the method further comprises: Start a timer to record the usage time of the chip key, and if the usage time reaches a set time threshold, trigger the generation of a chip key update task; Authorization authentication based on chip secret key and random number obtained from encryption chip; Confirm that the permission authentication has been passed, and store the obtained random number data as the new chip key in the cache address of the original chip key; Use the original chip key to perform a single SM4 encryption on the new chip key to obtain the ciphertext of the new chip key; The key modification command code and the new chip key ciphertext are sent to the encryption chip so that the encryption chip can synchronously update the chip key.

[0012] In a second aspect, the present invention provides an identification code management system based on encryption function, comprising: A storage management module, used to store identity credentials, device keys, and chip keys in a dedicated storage area; An identity authentication module, used to perform dual processing on the identity credentials using the device secret key, encryption and decryption algorithm and message authentication code algorithm, and send the obtained identity authentication data to a remote server; A command parsing module, used to receive the encrypted identification management data sent by the remote server after obtaining the identity authentication data, and extract the identification code management command from the encrypted identification management data based on the device secret key; A command execution module is used to obtain the read and write permissions for the exclusive storage area based on the chip key and execute the identification code management command.

[0013] In a third aspect, a terminal is provided, including: A memory, used for storing an identification code management program based on an encryption function; A processor is used to implement the steps of the encryption function-based identification code management method provided in the first aspect when executing the encryption function-based identification code management program.

[0014] In a fourth aspect, a computer-readable storage medium is provided, on which an identification code management program based on an encryption function is stored. When the identification code management program based on the encryption function is executed by a processor, the steps of the identification code management method based on the encryption function provided in the first aspect are implemented.

[0015] The beneficial effect of the present invention is that the encryption-based identification code management method, system, terminal and storage medium provided by the present invention adopt a unique and traceable management identification code, which ensures the high efficiency of the supervision and traceability process of products, assets and information, and significantly improves the accuracy and controllability of management. This innovative solution can achieve refined management of equipment, strengthen the security protection mechanism of the system, and effectively prevent unauthorized access and use. With the integration of a large number of industrial equipment into the identification system, the high encryption technology and unique equipment identification provided by the present invention build a solid line of defense, effectively prevent the risk of malicious tampering, and further consolidate the stability and reliability of the system.

[0016] In addition, the invention has a reliable design principle, a simple structure and a very broad application prospect. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 is a schematic flow chart of a method according to an embodiment of the present invention.

[0019] Figure 2 It is a hardware architecture diagram of a method according to an embodiment of the present invention.

[0020] Figure 3The figure is a schematic flow chart of updating a chip key according to a method of an embodiment of the present invention.

[0021] Figure 4 The figure is a schematic flow chart of identity authentication of a method according to an embodiment of the present invention.

[0022] Figure 5 It is a schematic flow chart of the management execution process of the method according to an embodiment of the present invention.

[0023] Figure 6 It is a schematic flow chart of the execution result verification process of the method according to an embodiment of the present invention.

[0024] Figure 7 It is a schematic flow chart of the identification code data uploading process of the method according to an embodiment of the present invention.

[0025] Figure 8 is a schematic block diagram of a system according to an embodiment of the present invention.

[0026] Fig. 9 A schematic diagram of the structure of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0029] The key terms appearing in the present invention are explained below.

[0030] SM4 (formerly known as SMS4.0) is a block cipher standard.

[0031] ‌HMAC-SM3 is a message authentication code algorithm that combines the SM3 hash function and a key. It uses SM3 as the underlying hash function, combined with the key and message content, to generate a fixed-length data digest for verifying the integrity and authenticity of the message.

[0032] The encryption-based identification code management method provided in the embodiment of the present invention is executed by a computer device. Accordingly, the encryption-based identification code management system runs in the computer device.

[0033] Figure 1 is a schematic flow chart of a method according to an embodiment of the present invention. Figure 1 The execution subject may be an identification code management system based on encryption function. According to different requirements, the order of the steps in the flow chart may be changed, and some may be omitted.

[0034] like Figure 1 As shown, the method includes: Step 110, storing the identity credentials, device key and chip key in a dedicated storage area; Step 120, using the device key, encryption and decryption algorithm and message authentication code algorithm to perform double processing on the identity credential, and sending the obtained identity authentication data to the remote server; Step 130, receiving encrypted identification management data sent by the remote server after obtaining the identity authentication data, and extracting the identification code management command from the encrypted identification management data based on the device secret key; Step 140: Obtain read and write permissions to the exclusive storage area based on the chip key, and execute the identification code management command.

[0035] To facilitate understanding of the present invention, the following further describes the identification code management method based on encryption function provided by the present invention based on the principle of the identification code management method based on encryption function of the present invention and the process of managing the identification code based on encryption function in the embodiment.

[0036] Please refer to Figure 2 The hardware part includes an encryption chip, a communication module and a microprocessor. The encryption chip is a non-volatile memory chip with a maximum storage capacity of 512 bytes and a hardware random number generation function and the national SM4 encryption and decryption capability. The communication module has a 4G Internet access function, which is used to establish a connection with a remote server. The microprocessor and the SDK it runs perform logical operations such as encryption and decryption calculations, key and identification code management, and data parsing and uploading.

[0037] Specifically, the encryption-based identification code management method includes: S1. Store identity credentials, device keys, and chip keys in a dedicated storage area.

[0038] The encryption chip is responsible for storing the identification code data. In addition, the encryption chip also saves the chip secret key CIK.

[0039] The identity certificate CA, the device key DIK, and the chip key CIK are stored in a dedicated memory (such as a designated non-volatile memory) or a fixed area in the non-volatile memory.

[0040] The device key can be modified by the remote server. The chip key can only be modified through negotiation between the micro server and the encryption chip, and the chip key cannot be obtained by the remote server.

[0041] The chip key is a random number generated by the random generator of the encryption chip itself and is changed regularly. The specific update method is as follows: Figure 3 As shown, including: (1) A timer is started to record the usage time of the chip key. If the usage time reaches a set time threshold, a chip key update task is generated.

[0042] After power-on, the timer is started to record the running time, and the chip key change flag is set in the interrupt periodically; the system detects that the flag is to modify the chip key and executes it.

[0043] (2) Perform authority authentication based on the chip key and the random number obtained from the encryption chip.

[0044] Obtain 16 bytes of random number data through a pre-defined protocol; use the chip secret key CIK to perform SM4 encryption on the random number data to obtain random number ciphertext data; use the random number ciphertext data to pass the encryption chip identity authentication and obtain read and write permissions.

[0045] (3) Confirm that the authentication has been passed, and store the obtained random number data as the new chip key in the cache address of the original chip key. Store the obtained random number data as the new chip key CIK' in the FLASH area of ​​the original chip key CIK.

[0046] (4) Use the original chip key to perform a single SM4 encryption on the new chip key to obtain the ciphertext of the new chip key.

[0047] (5) Send the key modification command code and the new chip key ciphertext to the encryption chip so that the encryption chip can synchronously update the chip key.

[0048] Send the key modification command code and the new chip key ciphertext to the encryption chip; determine whether the key modification is successful based on the result returned by the chip.

[0049] S2. Use the device secret key, encryption and decryption algorithm and message authentication code algorithm to perform double processing on the identity certificate, and send the obtained identity authentication data to the remote server.

[0050] The identity credential and the device key are read from the exclusive storage area; the identity credential is encrypted once based on the device key and the encryption and decryption algorithm to generate the identity credential data ciphertext, and the encryption and decryption algorithm adopts the SM4 algorithm; the identity credential is encrypted using the device key and the message authentication code algorithm to obtain the identity credential authentication code of a fixed length; the identity authentication data is generated based on the identity authentication data ciphertext and the identity credential authentication code; and the identity authentication data is uploaded to the remote server through the remote secure communication protocol.

[0051] For an example, see Figure 4 First, read the identity certificate CA (Certificate Authority, i.e., the identity certificate issued by the certification body) and the preset device key DIK (Device Identification Key, i.e., the device unique identification key) preset in the fixed area of ​​FLASH. These key information are securely stored in the fixed area of ​​FLASH to prevent illegal access or tampering.

[0052] Next, the device key DIK is used to perform SM4 single encryption on the identity credential CA. SM4 is a symmetric encryption algorithm that is efficient and secure and is widely used in various secure communication scenarios. Through SM4 encryption, the identity credential CA is converted into identity credential data ciphertext, which ensures the confidentiality of the identity credential during transmission.

[0053] Then, the device key DIK and the identity certificate CA are used to perform HMAC-SM3 calculation. HMAC (Hash-basedMessage Authentication Code) is a technology that uses a specific algorithm to combine the key and message data to calculate a fixed-length authentication code. SM3 is a cryptographic hash function issued by the China National Cryptography Administration, which is collision-resistant and irreversible. Through HMAC-SM3 calculation, a fixed-length identity certificate authentication code can be obtained, which is used to verify the authenticity and integrity of the identity certificate.

[0054] Subsequently, the authentication data ciphertext and the credential authentication code are processed to generate the authentication data frame CAM (Certification Authentication Message). The authentication data frame CAM contains all the key information required for authentication, including the encrypted credential data and credential authentication code.

[0055] Finally, the communication module uploads the identity authentication data frame CAM to the remote server through the MODBUS-TCP protocol. MODBUS-TCP is a communication protocol based on the TCP / IP protocol and is widely used in the field of industrial automation. Through the MODBUS-TCP protocol, the identity authentication data frame CAM can be safely and reliably transmitted to the remote server for verification and processing by the server.

[0056] In summary, the process of identity authentication with a remote server through preset identity credentials involves multiple aspects such as identification code management, encryption technology, hash algorithm, and network communication, ensuring the security of data transmission and the legitimacy of the device.

[0057] S3. Receive encrypted identification management data sent by the remote server after obtaining the identity authentication data, and extract the identification code management command from the encrypted identification management data based on the device secret key.

[0058] Separate the original authentication code OAC and command data from the encrypted identification management data; read the device key and the identification code encryption times N preset in the exclusive storage area, and the identification code encryption times are specified by the remote server; use the device key and the message authentication code algorithm to decrypt the command data to obtain the authentication code; compare the original authentication code with the authentication code for consistency to verify the identity and the integrity of the message; after the verification is passed, decrypt the command data N times based on the device key and the encryption and decryption algorithm to obtain the operation command type and the identification code plaintext data, and the operation command type includes addition and deletion.

[0059] For an example, see Figure 5 Separating the original authentication code (OAC) and command data from the encrypted identification management data is a key step in the device communication security verification process. This step ensures the accuracy and security of the data in subsequent processing. The following is a detailed expanded description of the process: First, the encrypted identification management data is received and parsed to separate the original authentication code OAC and command data. The original authentication code OAC is previously generated by some encryption method and is used to verify the authenticity and integrity of the message; while the command data contains the specific operation instructions that the device needs to perform.

[0060] Next, it starts to read the device key DIK (Device Identification Key) preset in the fixed area of ​​FLASH and the number of times the identification code is encrypted N. The device key DIK is a unique encryption key of the device, which is used to encrypt and decrypt sensitive data; and the number of times the identification code is encrypted N indicates the number of times the identification code data is encrypted, which is crucial for subsequent decryption operations.

[0061] Then, the device key DIK is used to perform HMAC-SM3 calculation with the command data. HMAC (Hash-basedMessage Authentication Code) is a message authentication code based on a hash function, and SM3 is a cryptographic hash function issued by the China National Cryptography Administration. Through HMAC-SM3 calculation, an authentication code IAC (Intermediate Authentication Code) can be obtained, which is used to verify the authenticity and integrity of the command data.

[0062] Next, the calculated authentication code IAC is compared with the original authentication code OAC. If the two are consistent, it means that the identity has been verified and the message has not been tampered with during transmission, thus ensuring the integrity of the message. If the two are inconsistent, it may indicate a security threat and corresponding security measures need to be taken.

[0063] After verification, the device key DIK will be used to perform N SM4 decryption on the identification code data. SM4 is a symmetric encryption algorithm that is efficient and secure. Through N decryption operations, the operation command type and the identification code plaintext data IPM (Identification Plaintext Message) can be obtained. The operation command type indicates the specific operation that the device needs to perform, and the identification code plaintext data IPM contains detailed information related to the operation.

[0064] In summary, the original authentication code OAC and command data are separated from the encrypted identification management data, and through a series of security verification and decryption operations, the operation command type and identification code plaintext data IPM are finally obtained. This process ensures the security of device communication and the integrity of data.

[0065] S4. Obtain read and write permissions for the exclusive storage area based on the chip key, and execute the identification code management command.

[0066] Read the chip key and obtain the random number generated by the encryption chip; use the chip key and encryption and decryption algorithm to encrypt the random number to obtain permission authentication data; transmit the permission authentication data to the encryption chip to obtain the read and write permissions of the exclusive storage area granted by the encryption chip; if the operation command type is increase and there is no operation status identifier in the exclusive storage area, write the identification code plaintext data into the exclusive storage area, and generate an operation status identifier for the exclusive storage area during the execution of the write operation; if the operation command type is deletion and there is no operation status identifier in the exclusive storage area, query the target identification code from the exclusive storage area based on the identification code plaintext data, delete the target identification code and generate an operation status identifier for the exclusive storage area during the execution of the deletion.

[0067] In one example, the command frame of the remote server is parsed to obtain the command type and identification code plain text data IPM; the chip secret key CIK preset in the fixed area of ​​FLASH is read; the encryption chip read and write permissions are obtained through the predetermined protocol and chip secret key CIK; the identification code data stored in the encryption chip is added, deleted, and modified according to the operation command type; the execution result is verified and uploaded to the remote server.

[0068] The methods for obtaining read and write permissions include: First, the microprocessor communicates with the encryption chip or server through a pre-defined protocol (such as TLS handshake protocol, SSL / TLS protocol, etc.) to obtain a 16-byte random number data. This random number data is usually called a "session random number" or "challenge value", which is used to generate keys, verify identity, and ensure the unpredictability of communication.

[0069] Next, the microprocessor uses the chip secret key CIK (Chip Identification Key) stored in a secure location (such as inside the encryption chip) to perform SM4 encryption on the acquired random number data. SM4 is a symmetric encryption algorithm that is efficient and secure and is widely used in various secure communication scenarios. Through SM4 encryption, random number data is converted into random number ciphertext data, which ensures the confidentiality of random numbers during transmission.

[0070] Then, the microprocessor sends the random number ciphertext data as part of the encryption chip identity authentication to the encryption chip or server for verification. After receiving the random number ciphertext data, the encryption chip or server will use the same chip secret key CIK stored internally to perform SM4 decryption on the random number ciphertext data to restore the original random number data.

[0071] If the decrypted random number data is consistent with the random number data previously generated by the encryption chip or server, the encryption chip or server will consider that the microprocessor has successfully passed the identity authentication and grant it the corresponding read and write permissions. Read and write permissions are the ability of the microprocessor to perform read, write and other operations when communicating with the encryption chip or server.

[0072] In summary, the process of obtaining 16 bytes of random number data through a predetermined protocol, SM4 encrypting the random number data using the chip secret key CIK, and then using the encrypted random number ciphertext data for encryption chip identity authentication to obtain read and write permissions ensures the security of communication between the microprocessor and the encryption chip or server and the integrity of the data.

[0073] When processing operation commands, the system needs to adopt different processing strategies to ensure data consistency and security for different types of operations (such as adding or deleting) and the status of the dedicated storage area (whether there is an operation status identifier). The following is a detailed expansion of the process: For the add operation: First, check whether the received operation command type is "increase".

[0074] If the operation command type is "add", the system then checks whether there is an operation status mark in the dedicated storage area. The operation status mark is a mark used to indicate whether the current storage area is undergoing a write operation or a delete operation to prevent data conflicts and ensure data consistency.

[0075] If there is no operation status identifier in the exclusive storage area, that is, the current storage area is idle or has completed the previous operation, the system writes the received identification code plaintext data (IPM, Identification PlaintextMessage) into the exclusive storage area.

[0076] During the execution of a write operation, the system generates an operation status flag for the dedicated storage area and stores it in an appropriate location (such as the metadata section of the storage area). This flag indicates that the current storage area is undergoing a write operation. When other processes or threads detect this flag, they will avoid concurrent operations on the storage area.

[0077] For delete operations: The system checks whether the received operation command type is "delete".

[0078] If the operation command type is "delete", the system then checks whether there is an operation status identifier in the dedicated storage area.

[0079] If the dedicated storage area does not have an operation status identifier, the system queries the target identifier from the dedicated storage area based on the received identifier plaintext data (IPM). This query process may involve traversing and matching all data in the storage area.

[0080] Once the target identification code is found, the system deletes it from the dedicated storage area.

[0081] During the deletion operation, the system also generates an operation status flag for the dedicated storage area and stores it in the appropriate location. This flag indicates that the current storage area is undergoing a deletion operation, preventing other processes or threads from performing concurrent operations on the storage area.

[0082] S5. Execution result verification and feedback.

[0083] Confirm that the execution of the identification code management command is completed, and verify whether the identification code management command is executed successfully by checking the identification code update result; if the execution is successful, upload the updated identification code to the remote server; if the execution is unsuccessful, repeat the identification code management command until the execution is successful or the number of repetitions reaches the set threshold.

[0084] The identification code uploading method includes: reading the chip key, the device key and the number of identification code encryption times N from the exclusive storage area; using the chip key to obtain read and write permissions, and reading the identification code plaintext data from the encryption chip based on the read and write permissions; using the device key and the encryption and decryption algorithm to encrypt the identification code plaintext data N times to obtain the identification code ciphertext data, wherein the preset value of N is 1, and the value range of N is 1~100; using the device key and the message authentication code algorithm to calculate the identification code ciphertext data to obtain a message authentication code of a fixed length; splicing the identification code ciphertext data and the message authentication code into an identification data frame, and uploading the identification data frame to a remote server.

[0085] For an example, see Figure 6 , re-read the newly stored identification code plaintext data of the encryption chip through the chip secret key CIK; compare the re-read identification code plaintext data with the identification code plaintext data obtained by parsing; if the comparison is the same, execute method 2 to upload the identification code data frame to the remote server. Otherwise, re-execute the operation, and if the operation fails more than three times, upload the operation failure data frame to the remote server. If the re-read identification code plaintext data is the same as the identification code plaintext data obtained by parsing, the identification data frame is uploaded to the remote server.

[0086] Please refer to Figure 7First, it communicates with the encryption chip or related server through a pre-defined protocol (such as TLS handshake protocol or other security protocols) to obtain a 16-byte random number data. This random number data serves as the basis for subsequent encryption and identity authentication, ensuring the security of the communication process and the unpredictability of the data.

[0087] Next, the random number data is encrypted using the chip identification key CIK (Chip Identification Key) stored in a secure location. SM4 is a symmetric encryption algorithm that is efficient and secure and is widely used in various secure communication scenarios. Through SM4 encryption, the random number data is converted into random number ciphertext data, which ensures the confidentiality of the random number during transmission.

[0088] Then, the random number ciphertext data is sent to the encryption chip or server for verification as part of the encryption chip identity authentication. After receiving the random number ciphertext data, the encryption chip or server will use the same chip secret key CIK stored internally to perform SM4 decryption on the random number ciphertext data to restore the original random number data. If the decrypted random number data is consistent with the random number data previously generated by the encryption chip or server, the encryption chip or server will consider that the identity authentication has been successfully passed and grant it the corresponding read and write permissions.

[0089] After obtaining read and write permissions, the identification code data plaintext (IPM, Identification Plaintext Message) in the encryption chip can be read. In order to safely process this data, the identification code management device will read the chip secret key CIK, the device secret key DIK (Device Identification Key) and the number of identification code encryptions N preset in the fixed area of ​​FLASH. Among them, N is a preset value, and its value range is 1 to 100, which is used to indicate the number of times the identification code data is encrypted. The remote server may manage N according to a certain method (such as method 4, which is not described in detail here) to ensure the security and manageability of the data.

[0090] Next, the chip secret key CIK is used to read the identification code plaintext data IPM from the encryption chip. Then, the device key DIK is used to perform N SM4 encryption on the identification code plaintext data to generate the identification code ciphertext data ICM (Identification Ciphertext Message). This step ensures the confidentiality and security of the identification code data during transmission.

[0091] In order to verify the integrity and authenticity of the identification code ciphertext data, the device key DIK and the identification code ciphertext data ICM are also used to perform HMAC-SM3 calculations. HMAC (Hash-based Message Authentication Code) is a message authentication code based on a hash function, and SM3 is a cryptographic hash function issued by the China National Cryptography Administration. Through HMAC-SM3 calculations, a fixed-length message authentication code IAC (Intermediate Authentication Code) can be obtained. This authentication code is used to verify the authenticity and integrity of the identification code ciphertext data.

[0092] Finally, the identification code ciphertext data ICM and the message authentication code IAC are spliced ​​together to obtain the identification data frame IAM (Identification Authentication Message) that carries the identification information when communicating with the remote server. Then, the identification data frame IAM is uploaded to the remote server through the communication module and the MODBUS-TCP protocol. MODBUS-TCP is a communication protocol based on the TCP / IP protocol and is widely used in industrial automation and remote monitoring systems. Through the MODBUS-TCP protocol, the identification data frame IAM can be safely and reliably transmitted to the remote server, and verified and processed by the server.

[0093] To sum up, the entire process from obtaining random number data to uploading the identification data frame to the remote server involves multiple links such as random number generation, encryption, identity authentication, data reading, encryption processing, message authentication and data transmission, ensuring the security of communication with the remote server and the integrity of the data.

[0094] In some embodiments, the encryption-based identification code management system may include multiple functional modules composed of computer program segments. The computer programs of each program segment in the encryption-based identification code management system may be stored in a memory of a computer device and executed by at least one processor to perform (see Figure 1 Description) The function of managing identification codes based on encryption functions.

[0095] In this embodiment, the encryption-based identification code management system can be divided into multiple functional modules according to the functions it performs, such as Figure 8As shown. The functional modules of the system 800 may include: a storage management module 810, an identity authentication module 820, a command parsing module 830, and a command execution module 840. The module referred to in the present invention refers to a series of computer program segments that can be executed by at least one processor and can complete fixed functions, which are stored in the memory. In this embodiment, the functions of each module will be described in detail in subsequent embodiments.

[0096] A storage management module, used to store identity credentials, device keys, and chip keys in a dedicated storage area; An identity authentication module, used to perform dual processing on the identity credentials using the device secret key, encryption and decryption algorithm and message authentication code algorithm, and send the obtained identity authentication data to a remote server; A command parsing module, used to receive the encrypted identification management data sent by the remote server after obtaining the identity authentication data, and extract the identification code management command from the encrypted identification management data based on the device secret key; A command execution module is used to obtain the read and write permissions for the exclusive storage area based on the chip key and execute the identification code management command.

[0097] Optionally, as an embodiment of the present invention, the identity credential is double-processed using the device key, encryption and decryption algorithm, and message authentication code algorithm, and the obtained identity authentication data is sent to a remote server, including: Read the identity certificate and device key from the dedicated storage area; The identity credential is encrypted once based on the device secret key and the encryption and decryption algorithm to generate the identity credential data ciphertext, wherein the encryption and decryption algorithm adopts the SM4 algorithm; The identity credential is encrypted using the device secret key and the message authentication code algorithm to obtain an identity credential authentication code of a fixed length; Generate identity authentication data based on the identity authentication data ciphertext and the identity credential authentication code; Upload the identity authentication data to the remote server through the remote secure communication protocol.

[0098] Optionally, as an embodiment of the present invention, receiving encrypted identification management data sent by the remote server after obtaining the identity authentication data, and extracting the identification code management command from the encrypted identification management data based on the device key, includes: Separating the original authentication code OAC and command data from the encrypted identification management data; Read the device key and the identification code encryption times N preset in the dedicated storage area, where the identification code encryption times is specified by the remote server; Decrypting the command data using the device secret key and a message authentication code algorithm to obtain an authentication code; Comparing the original authentication code with the authentication code for consistency to verify the identity and integrity of the message; After the verification is passed, the command data is decrypted N times based on the device secret key and the encryption and decryption algorithm to obtain the operation command type and the identification code plaintext data, and the operation command type includes addition and deletion.

[0099] Optionally, as an embodiment of the present invention, obtaining read and write permissions to the exclusive storage area based on the chip key and executing the identification code management command includes: Read the chip key and obtain the random number generated by the encryption chip; Encrypting the random number using the chip secret key and encryption / decryption algorithm to obtain authority authentication data; Transmitting the permission authentication data to the encryption chip to obtain the read and write permissions to the exclusive storage area granted by the encryption chip; If the operation command type is increase and the dedicated storage area does not have an operation status identifier, write the identification code plaintext data into the dedicated storage area, and generate an operation status identifier for the dedicated storage area during the execution of the write operation; If the operation command type is deletion and there is no operation status identifier in the exclusive storage area, the target identification code is queried from the exclusive storage area based on the identification code plaintext data, the target identification code is deleted and an operation status identifier is generated for the exclusive storage area during the deletion execution.

[0100] Optionally, as an embodiment of the present invention, it further includes: Confirming that the identification code management command is executed successfully, and verifying whether the identification code management command is executed successfully by verifying the identification code update result; If the execution is successful, the updated identification code is uploaded to the remote server; If the execution is unsuccessful, the identification code management command is repeatedly executed until the execution is successful or the number of repetitions reaches a set threshold number of times.

[0101] Optionally, as an embodiment of the present invention, uploading the updated identification code to a remote server includes: Read the chip key, device key and identification code encryption times N from the dedicated storage area; Using the chip secret key to obtain read and write permissions, and reading the identification code plaintext data from the encryption chip based on the read and write permissions; Encrypt the identification code plaintext data N times using the device secret key and the encryption and decryption algorithm to obtain identification code ciphertext data, where the preset value of N is 1 and the value range of N is 1 to 100; Calculating the identification code ciphertext data using the device secret key and the message authentication code algorithm to obtain a message authentication code of fixed length; The identification code ciphertext data and the message authentication code are spliced ​​into an identification data frame, and the identification data frame is uploaded to a remote server.

[0102] Optionally, as an embodiment of the present invention, it further includes: Start a timer to record the usage time of the chip key, and if the usage time reaches a set time threshold, trigger the generation of a chip key update task; Authorization authentication based on chip secret key and random number obtained from encryption chip; Confirm that the permission authentication has been passed, and store the obtained random number data as the new chip key in the cache address of the original chip key; Use the original chip key to perform a single SM4 encryption on the new chip key to obtain the ciphertext of the new chip key; The key modification command code and the new chip key ciphertext are sent to the encryption chip so that the encryption chip can synchronously update the chip key.

[0103] Fig. 9 The present invention provides a schematic diagram of the structure of a terminal 900 provided in an embodiment of the present invention. The terminal 900 can be used to execute the encryption function-based identification code management method provided in an embodiment of the present invention.

[0104] The terminal 900 may include: a processor 910, a memory 920 and a communication unit 930. These components communicate via one or more buses. Those skilled in the art will appreciate that the server structure shown in the figure does not limit the present invention, and it may be a bus structure or a star structure, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0105] The memory 920 can be used to store the execution instructions of the processor 910. The memory 920 can be implemented by any type of volatile or non-volatile storage terminal or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. When the execution instructions in the memory 920 are executed by the processor 910, the terminal 900 can execute some or all of the steps in the following method embodiments.

[0106] The processor 910 is the control center of the storage terminal, and uses various interfaces and lines to connect various parts of the entire electronic terminal. It runs or executes software programs and / or modules stored in the memory 920, and calls data stored in the memory to perform various functions of the electronic terminal and / or process data. The processor can be composed of an integrated circuit (IC), for example, it can be composed of a single packaged IC, or it can be composed of multiple packaged ICs with the same or different functions. For example, the processor 910 can include only a central processing unit (CPU). In an embodiment of the present invention, the CPU can be a single computing core or multiple computing cores.

[0107] The communication unit 930 is used to establish a communication channel so that the storage terminal can communicate with other terminals, receive user data sent by other terminals or send user data to other terminals.

[0108] The present invention also provides a computer storage medium, wherein the computer storage medium may store a program, and when the program is executed, the program may include some or all of the steps in each embodiment provided by the present invention. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM).

[0109] Therefore, the present invention adopts a unique and traceable management identification code to ensure the efficiency of the supervision and traceability process of products, assets and information, and significantly improves the accuracy and controllability of management. This innovative solution can achieve refined management of equipment, strengthen the security protection mechanism of the system, and effectively prevent unauthorized access and use. With the integration of a large number of industrial equipment into the identification system, the high encryption technology and unique equipment identification provided by the present invention build a solid line of defense, effectively prevent the risk of malicious tampering, and further consolidate the stability and reliability of the system. The technical effects that can be achieved by this embodiment can be found in the description above, and will not be repeated here.

[0110] Those skilled in the art can clearly understand that the technology in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solution in the embodiments of the present invention, in essence or in other words, the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program codes, including several instructions for enabling a computer terminal (which can be a personal computer, a server, or a second terminal, a network terminal, etc.) to execute all or part of the steps of the methods described in each embodiment of the present invention.

[0111] In this specification, the same or similar parts between the various embodiments can be referred to each other. In particular, for the terminal embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description in the method embodiment.

[0112] In the several embodiments provided by the present invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or modules, which can be electrical, mechanical or other forms.

[0113] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0114] In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0115] Although the present invention has been described in detail with reference to the accompanying drawings and in combination with the preferred embodiments, the present invention is not limited thereto. Without departing from the spirit and essence of the present invention, a person of ordinary skill in the art may make various equivalent modifications or substitutions to the embodiments of the present invention, and these modifications or substitutions shall be within the scope of the present invention. Any person of ordinary skill in the art may easily think of changes or substitutions within the technical scope disclosed by the present invention, and these shall be within the scope of protection of the present invention.

Claims

1. A method for managing identification codes based on encryption function, characterized in that: include: Store identity credentials, device keys, and chip keys in a dedicated storage area; The identity credentials are double processed using the device secret key, encryption and decryption algorithm and message authentication code algorithm, and the obtained identity authentication data is sent to a remote server; Receiving encrypted identification management data sent by the remote server after obtaining the identity authentication data, and extracting the identification code management command from the encrypted identification management data based on the device secret key; The read and write permissions for the exclusive storage area are obtained based on the chip key, and the identification code management command is executed.

2. The method according to claim 1, characterized in that The identity credentials are double processed using the device secret key, encryption and decryption algorithm and message authentication code algorithm, and the obtained identity authentication data is sent to a remote server, including: Read the identity certificate and device key from the dedicated storage area; The identity credential is encrypted once based on the device secret key and the encryption and decryption algorithm to generate the identity credential data ciphertext, wherein the encryption and decryption algorithm adopts the SM4 algorithm; The identity credential is encrypted using the device secret key and the message authentication code algorithm to obtain an identity credential authentication code of a fixed length; Generate identity authentication data based on the identity authentication data ciphertext and the identity credential authentication code; Upload the identity authentication data to the remote server through the remote secure communication protocol.

3. The method according to claim 1, characterized in that Receiving encrypted identification management data sent by the remote server after obtaining the identity authentication data, and extracting the identification code management command from the encrypted identification management data based on the device secret key, including: Separating the original authentication code OAC and command data from the encrypted identification management data; Read the device key and the identification code encryption times N preset in the dedicated storage area, where the identification code encryption times is specified by the remote server; Decrypting the command data using the device secret key and a message authentication code algorithm to obtain an authentication code; Comparing the original authentication code with the authentication code for consistency to verify the identity and integrity of the message; After the verification is passed, the command data is decrypted N times based on the device secret key and the encryption and decryption algorithm to obtain the operation command type and the identification code plaintext data, and the operation command type includes addition and deletion.

4. The method according to claim 3, characterized in that Acquiring the read and write permissions to the exclusive storage area based on the chip key and executing the identification code management command includes: Read the chip key and obtain the random number generated by the encryption chip; Encrypting the random number using the chip secret key and encryption / decryption algorithm to obtain authority authentication data; Transmitting the permission authentication data to the encryption chip to obtain the read and write permissions to the exclusive storage area granted by the encryption chip; If the operation command type is increase and the dedicated storage area does not have an operation status identifier, write the identification code plaintext data into the dedicated storage area, and generate an operation status identifier for the dedicated storage area during the execution of the write operation; If the operation command type is deletion and there is no operation status identifier in the exclusive storage area, the target identification code is queried from the exclusive storage area based on the identification code plaintext data, the target identification code is deleted and an operation status identifier is generated for the exclusive storage area during the deletion execution.

5. The method according to claim 1, characterized in that The method further comprises: Confirming that the identification code management command is executed successfully, and verifying whether the identification code management command is executed successfully by verifying the identification code update result; If the execution is successful, the updated identification code is uploaded to the remote server; If the execution is unsuccessful, the identification code management command is repeatedly executed until the execution is successful or the number of repetitions reaches a set threshold number of times.

6. The method according to claim 1, characterized in that Upload the updated identification code to the remote server, including: Read the chip key, device key and identification code encryption times N from the dedicated storage area; Using the chip secret key to obtain read and write permissions, and reading the identification code plaintext data from the encryption chip based on the read and write permissions; Encrypt the identification code plaintext data N times using the device secret key and the encryption and decryption algorithm to obtain identification code ciphertext data, where the preset value of N is 1 and the value range of N is 1 to 100; Calculating the identification code ciphertext data using the device secret key and the message authentication code algorithm to obtain a message authentication code of fixed length; The identification code ciphertext data and the message authentication code are spliced ​​into an identification data frame, and the identification data frame is uploaded to a remote server.

7. The method according to claim 1, characterized in that The method further comprises: Start a timer to record the usage time of the chip key, and if the usage time reaches a set time threshold, trigger the generation of a chip key update task; Authorization authentication based on chip secret key and random number obtained from encryption chip; Confirm that the permission authentication has been passed, and store the obtained random number data as the new chip key in the cache address of the original chip key; Use the original chip key to perform a single SM4 encryption on the new chip key to obtain the ciphertext of the new chip key; The key modification command code and the new chip key ciphertext are sent to the encryption chip so that the encryption chip can synchronously update the chip key.

8. An identification code management system based on encryption function, characterized in that: include: A storage management module, used to store identity credentials, device keys, and chip keys in a dedicated storage area; An identity authentication module, used to perform dual processing on the identity credentials using the device secret key, encryption and decryption algorithm and message authentication code algorithm, and send the obtained identity authentication data to a remote server; A command parsing module, used to receive the encrypted identification management data sent by the remote server after obtaining the identity authentication data, and extract the identification code management command from the encrypted identification management data based on the device secret key; A command execution module is used to obtain the read and write permissions for the exclusive storage area based on the chip key and execute the identification code management command.

9. A terminal, characterized in that: include: A memory, used for storing an identification code management program based on an encryption function; A processor, used to implement the steps of the encryption-function-based identification code management method as described in any one of claims 1 to 7 when executing the encryption-function-based identification code management program.

10. A computer-readable storage medium storing a computer program, characterized in that: The readable storage medium stores an identification code management program based on an encryption function, and when the identification code management program based on an encryption function is executed by a processor, the steps of the identification code management method based on an encryption function as described in any one of claims 1 to 7 are implemented.

Images