Equipment authentication method, system and device and nonvolatile storage medium

Abstract

The invention discloses an equipment authentication method, system and device and a nonvolatile storage medium. The method comprises the following steps: a first device issues a first message of which the message type is a border gateway protocol routing message to a second device; receiving a second message generated by the second equipment according to the first message; after receiving a second message, generating a second random number, and performing hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a first message authentication code; sending a third message carrying the first message authentication code and the second random number to the second device; and receiving a fourth message which is sent by the second equipment and carries the second message authentication code, and authenticating the second message authentication code. The technical problems of high equipment authentication cost and low security caused by low negotiation efficiency of a traditional authentication method are solved.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular, to a device authentication method, system, apparatus and non-volatile storage medium. Background Art

[0002] Authentication is a prerequisite for network security and is used to ensure the legitimacy of device identity. Common device authentication protocols include IEEE802.1X, tacacs, etc. However, this type of authentication is generally point-to-point authentication between the client and the server, and it is difficult to achieve two-way authentication between multi-point to multi-point devices, resulting in low negotiation efficiency, multiple network protocols, complex operation and maintenance, and high costs.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a device authentication method, system, apparatus and non-volatile storage medium to at least solve the technical problems of high device authentication cost and low security caused by low negotiation efficiency of traditional authentication methods.

[0005] According to one aspect of an embodiment of the present application, a device authentication method is provided, comprising: a first device publishes a first message of a border gateway protocol routing message to a second device, wherein the first device is pre-filled with a quantum key distributed to the first device by a quantum key distribution network and identification information of the quantum key, and the first message carries device identification information of the first device and identification information of the quantum key; receiving a second message generated by the second device according to the first message, wherein the message type of the second message is a border gateway protocol routing message, and the group attribute of the second message is a first random number generated by the second device; after receiving the second message, generating a second random number The first device receives a random number, performs a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a first message authentication code; sends a third message carrying the first message authentication code and the second random number to the second device, wherein the second device is used to verify the first message authentication code, and performs a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a second message authentication code, and the message type of the third message is a border gateway protocol routing message; receives a fourth message carrying the second message authentication code sent by the second device, and authenticates the second message authentication code, wherein the message type of the fourth message is a border gateway protocol routing message.

[0006] Optionally, the first device includes a communication device, the second device includes a soft-defined gateway controller of the communication device or a quantum service platform, the quantum service platform includes a quantum key service layer, a network operation control layer and a network forwarding layer, wherein the quantum key service layer is connected to the quantum key distribution network; the network operation control layer includes a soft-defined gateway controller and a routing transmitter; the network forwarding layer includes a router device, wherein the router device is used to receive border gateway protocol routing information, extract authentication information from the border gateway protocol routing information, and send authentication information of the router device.

[0007] Optionally, a neighbor relationship is established between the first device and the second device through a routing transmitter, and messages are exchanged through the routing transmitter.

[0008] Optionally, the border gateway protocol routing message includes a custom security group attribute field, and the custom security group attribute field includes a high-order field and a low-order field, wherein the high-order field includes a first character for indicating the message type, a second character for indicating the message sequence number, and a third character representing a link flag; the low-order field includes authentication information.

[0009] Optionally, performing a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain the first message authentication code includes: concatenating the first random number and the second random number to obtain a first concatenation result, wherein the first random number is located in the first half of the first concatenation result and the second random number is located in the second half of the first concatenation result; performing a hash message authentication code operation on the first concatenation result and the quantum key to obtain the first message authentication code.

[0010] Optionally, the second message authentication code is determined in the following manner: splicing the second random number and the first random number to obtain a second splicing result, wherein the second random number is located in the first half of the second splicing result, and the first random number is located in the second half of the second splicing result; performing a hash message authentication code operation on the second splicing result and the quantum key to obtain the second message authentication code.

[0011] Optionally, the first device and the second device also store an authentication status matrix for recording authentication sessions and session status, wherein the fields in the authentication status matrix include at least one of the following: an authentication session identifier, a session initiator identifier, a session receiver identifier, a session serial number, and an extended group attribute word corresponding to the session.

[0012] Optionally, the identification information of the quantum key includes the zone number of the zone where the quantum key is located, and the key number of the quantum key.

[0013] According to another aspect of an embodiment of the present application, a device authentication method is also provided, including: a second device receives a first message of a border gateway protocol routing message issued by a first device, wherein the first device is pre-filled with a quantum key distributed to the first device by a quantum key distribution network, and identification information of the quantum key, and the first message carries device identification information of the first device and identification information of the quantum key; sends a second message generated according to the first message to the first device, wherein the message type of the second message is a border gateway protocol routing message, and the group attribute of the second message is a first random number generated by the second device; receives a message sent by the first device carrying a first random number; A third message containing a message authentication code and a second random number, wherein the first device is used to generate a second random number after receiving the second message, and perform a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a first message authentication code, and the message type of the third message is a border gateway protocol routing message; verify the first message authentication code, and perform a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a second message authentication code; send a fourth message carrying the second message authentication code to the first device, wherein the first device is used to authenticate the second message authentication code, and the message type of the fourth message is a border gateway protocol routing message.

[0014] According to another aspect of an embodiment of the present application, a device authentication system is also provided, including a quantum service platform and multiple communication devices, wherein the quantum service platform includes a quantum key service layer, a network operation control layer and a network forwarding layer, the quantum key service layer is connected to the quantum key distribution network, the network operation control layer includes a soft-defined gateway controller and a routing transmitter, and the network forwarding layer includes a router device, the router device is used to receive border gateway protocol routing information, extract authentication information from the border gateway protocol routing information, and send authentication information of the router device; a first device among the multiple communication devices is used to publish a first message whose message type is a border gateway protocol routing message to a second device, wherein the first device is pre-filled with a quantum key distributed to the first device by the quantum key distribution network, and identification information of the quantum key, the first message carries device identification information of the first device and identification information of the quantum key, the first device is any device among the multiple communication devices, and the second device is Any device except the first device in the communication device, or a soft-defined gateway controller; receiving a second message generated by the second device based on the first message, wherein the message type of the second message is a border gateway protocol routing message, and the group attribute of the second message is a first random number generated by the second device; after receiving the second message, generating a second random number, and performing a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a first message authentication code; sending a third message carrying the first message authentication code and the second random number to the second device, wherein the second device is used to verify the first message authentication code, and performing a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a second message authentication code, and the message type of the third message is a border gateway protocol routing message; receiving a fourth message carrying the second message authentication code sent by the second device, and authenticating the second message authentication code, wherein the message type of the fourth message is a border gateway protocol routing message.

[0015] According to another aspect of an embodiment of the present application, a device authentication apparatus is also provided, which is applicable to an authentication initiating device, and includes: a first processing module, which is used to publish a first message of a border gateway protocol routing message to a receiving device, wherein the authentication initiating device is pre-filled with a quantum key distributed to the authentication initiating device by a quantum key distribution network, and identification information of the quantum key, and the first message carries device identification information of the authentication initiating device and identification information of the quantum key; a second processing module, which is used to receive a second message generated by the receiving device according to the first message, wherein the message type of the second message is a border gateway protocol routing message, and the group attribute of the second message is a first random number generated by the receiving device; and a third processing module, which is used to receive a first message of a border gateway protocol routing message. After receiving the second message, a second random number is generated, and a hash message authentication code operation is performed on the first random number, the second random number and the quantum key to obtain a first message authentication code; a fourth processing module is used to send a third message carrying the first message authentication code and the second random number to the receiving device, wherein the receiving device is used to verify the first message authentication code, and perform a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a second message authentication code, and the message type of the third message is a border gateway protocol routing message; a fifth processing module is used to receive a fourth message carrying the second message authentication code sent by the receiving device, and authenticate the second message authentication code, wherein the message type of the fourth message is a border gateway protocol routing message.

[0016] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, in which a program is stored, wherein when the program is running, a device where the non-volatile storage medium is located is controlled to execute a device authentication method.

[0017] According to another aspect of an embodiment of the present application, there is further provided an electronic device, including: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the device authentication method is executed when the program is run.

[0018] According to another aspect of an embodiment of the present application, a computer program product is also provided, including a computer program, and when the computer program is executed by a processor, a device authentication method is implemented.

[0019] In an embodiment of the present application, a first device is used to publish a first message of a border gateway protocol routing message to a second device, wherein the first device is pre-filled with a quantum key distributed to the first device by a quantum key distribution network and identification information of the quantum key, and the first message carries device identification information of the first device and identification information of the quantum key; a second message generated by the second device according to the first message is received, wherein the message type of the second message is a border gateway protocol routing message, and the group attribute of the second message is a first random number generated by the second device; after receiving the second message, a second random number is generated, and a hash message authentication code operation is performed on the first random number, the second random number and the quantum key to obtain a first message authentication code; and a message carrying the first message authentication code and the second random number is sent to the second device. A third message, wherein the second device is used to verify the first message authentication code, and perform a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain the second message authentication code, and the message type of the third message is a border gateway protocol routing message; a fourth message carrying the second message authentication code sent by the second device is received, and the second message authentication code is authenticated, wherein the message type of the fourth message is a border gateway protocol routing message, and the authentication message is transmitted through group attributes and combined with the pre-filled quantum key for authentication, thereby achieving the purpose of simplifying the authentication protocol and improving the authentication efficiency, thereby achieving the technical effect of multi-point to multi-point two-way authentication between devices, and further solving the technical problems of high device authentication cost and low security caused by low negotiation efficiency of traditional authentication methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0021] Figure 1 is a schematic diagram of a device authentication system architecture provided according to an embodiment of the present application;

[0022] Figure 2 It is a structural schematic diagram of a computer terminal (mobile device) provided according to an embodiment of the present application;

[0023] Figure 3 It is a flowchart of a device authentication method provided according to an embodiment of the present application;

[0024] Figure 4 is a schematic diagram of a key storage data structure provided according to an embodiment of the present application;

[0025] Figure 5 is a schematic diagram of an interaction process between a first device and a second device provided according to an embodiment of the present application;

[0026] Figure 6 is a schematic diagram of a data structure of a group attribute provided according to an embodiment of the present application;

[0027] Figure 7 It is a structural diagram of a device authentication apparatus provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0031] BGP (Border Gateway Protocol) is a routing protocol between autonomous systems (ASs) that exchanges network reachability information between ASs (Autonomous Systems).

[0032] BGP community attribute: Community attribute is a mechanism used in BGP to classify and mark routes. It is an optional, transparent attribute of any length. It implements specific processing of routes by attaching one or more labels to routes. Community attributes are divided into custom community attributes and recognized community attributes.

[0033] IEEE802.1X: A user authentication technology used in LAN switches and wireless LAN access points.

[0034] QKD (quantum key distribution): In recent years, quantum technology has developed by leaps and bounds and has attracted widespread attention from all walks of life. Quantum security technology is applied to finance, government affairs, transportation and other fields, and has broad application prospects. Quantum security cryptography is based on quantum physics principles to achieve the goals of classical cryptography. The most representative and practical one is quantum key distribution (QKD) technology, which uses the characteristics of quantum mechanics to ensure communication security. It enables both parties in communication to generate and share a random, secure key to encrypt and decrypt messages.

[0035] QKD Quantum Key Distribution Network: A network composed of multiple quantum key distribution nodes connected by quantum key distribution links. The communicating parties can generate and share a random, secure key for encrypting and decrypting messages.

[0036] RR (Route Reflector): A special router that can serve as the central point for storing and forwarding routing entries for the entire network and redistribute routing information to other routers.

[0037] SDN (Software Defined Networking): A network management method that supports dynamic programmable network configuration, improves network performance and management efficiency, and enables network services to provide flexible customization capabilities like cloud computing. SDN decouples the forwarding plane from the control plane of network devices, and uses the controller to manage network devices, orchestrate network services, and schedule service traffic. It has the advantages of low cost, centralized management, and flexible scheduling.

[0038] HMAC (Hash-based Message Authentication Code) is a security mechanism that uses a key and a hash function (such as MD5, SHA-1, SHA-256, etc.) to generate a fixed-length summary for verifying data integrity and data origin. HMAC combines the characteristics of hash functions with the advantages of symmetric encryption and can provide stronger security guarantees than simple hash functions because it requires a key to participate in the calculation, which enables HMAC to prevent message tampering and forgery.

[0039] Authentication is a prerequisite for network security and the foundation before quantum key distribution. It is a necessary condition for devices to obtain keys and ensures the legitimacy of the device identity.

[0040] In related technologies, common device authentication protocols include IEEE802.1X, tacacs, etc. The main problems of this type of authentication are as follows:

[0041] 1. Use special protocols such as IEEE802.1X and TACACS for authentication, which requires new protocols or configurations for the router network and has poor security.

[0042] 2. Traditional authentication methods are generally point-to-point authentication between the client and the server, which makes it difficult to achieve two-way authentication between multi-point to multi-point devices.

[0043] In order to solve the above problems, relevant solutions are provided in the embodiments of the present application, which are described in detail below.

[0044] According to an embodiment of the present application, a method embodiment of device authentication is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0045] The present application embodiment provides a device authentication system, the architecture of which is as follows: Figure 1As shown, it includes a quantum service platform and multiple communication devices, wherein the quantum service platform includes a quantum key service layer, a network operation control layer and a network forwarding layer, the quantum key service layer is connected to the quantum key distribution network, the network operation control layer includes a soft-defined gateway controller and a routing transmitter, and the network forwarding layer includes a router device, the router device is used to receive border gateway protocol routing information, extract authentication information from the border gateway protocol routing information, and send authentication information of the router device; a first device among the multiple communication devices is used to publish a first message whose message type is a border gateway protocol routing message to a second device, wherein the first device is pre-filled with a quantum key distributed to the first device by the quantum key distribution network, and identification information of the quantum key, the first message carries device identification information of the first device and identification information of the quantum key, the first device is any device among the multiple communication devices, and the second device is a communication device other than the first device. Any device, or a soft-defined gateway controller; receiving a second message generated by a second device based on the first message, wherein the message type of the second message is a border gateway protocol routing message, and the group attribute of the second message is a first random number generated by the second device; after receiving the second message, generating a second random number, and performing a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a first message authentication code; sending a third message carrying the first message authentication code and the second random number to the second device, wherein the second device is used to verify the first message authentication code, and performing a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a second message authentication code, and the message type of the third message is a border gateway protocol routing message; receiving a fourth message carrying the second message authentication code sent by the second device, and authenticating the second message authentication code, wherein the message type of the fourth message is a border gateway protocol routing message.

[0046] Optionally, the quantum key service layer generates physical true random numbers through the quantum key distribution network QKD, and the quantum key service platform provides authentication and key services for the operation network. The network operation control layer consists of SDN controllers, RR routing transmitters, etc. RR acts as a routing transmitter and reflects authentication information at the same time. The SDN controller acts as an authentication agent for the key service platform. Network forwarding layer: It consists of router devices. The router receives BGP routing information, extracts authentication information, authenticates the platform and other devices, and sends its own authentication information.

[0047] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 2 FIG. 1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing a device authentication method. Figure 2As shown, the computer terminal 20 (or mobile device 20) may include one or more (202a, 202b, ..., 202n are used to illustrate) processors 202 (the processor 202 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 204 for storing data, and a transmission module 206 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 2 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 2 More or fewer components as shown, or with Figure 2 Different configurations are shown.

[0048] It should be noted that the one or more processors 202 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 20 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0049] The memory 204 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the device authentication method in the embodiment of the present application. The processor 202 executes various functional applications and data processing by running the software programs and modules stored in the memory 204, that is, the device authentication method of the above-mentioned application is realized. The memory 204 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 204 may further include a memory remotely arranged relative to the processor 202, and these remote memories may be connected to the computer terminal 20 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0050] The transmission device 206 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 20. In one example, the transmission device 206 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 206 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0051] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 20 (or mobile device).

[0052] In the above operating environment, the present application embodiment provides a device authentication method, such as Figure 3 As shown, the method comprises the following steps:

[0053] Step S302: The first device publishes a first message of a border gateway protocol routing message to the second device, wherein the first device is pre-filled with a quantum key distributed to the first device by a quantum key distribution network and identification information of the quantum key, and the first message carries device identification information of the first device and identification information of the quantum key;

[0054] In some embodiments of the present application, the R1 device (i.e., the first device) initiates an authentication request and publishes a routing update message through BGP (Border Gateway Protocol). This message contains specific extended attributes, which are additional information outside the BGP standard and are used for specific purposes, including the R1 device SN number (i.e., the device identification information of the first device), the pre-filled quantum key area ID (i.e., the identification information of the quantum key), the type of the sent message (i.e., the first message) is registration authentication, the message subtype is 1, and the pre-filled quantum key area ID is the identifier of the key storage area pre-allocated to the device in the quantum key distribution network. The key storage data structure is as follows: Figure 4 As shown, it includes the pre-filled key ID and the pre-filled key.

[0055] Optionally, in the key, the pre-filled key area ID is used to identify the unique identifier of the key storage area. In a quantum key distribution network, there may be multiple key areas, each of which contains several pre-filled quantum keys. The key area ID helps devices and systems locate the correct key area for use in authentication or key distribution. The pre-filled key ID is used to number the quantum keys in a certain order or rule in each key area. The pre-filled key ID is a unique number used to identify a specific quantum key. During the authentication process, the pre-filled key ID is used to index and select the correct key for HMAC calculation to ensure the security and accuracy of the authentication process. The pre-filled key is a true random key generated by the quantum key distribution network, which is pre-stored in the key storage area of ​​the device or system. The pre-filled key is used to calculate the HMAC value for authentication when communicating between devices or when the device communicates with the secret service platform.

[0056] Step S304, receiving a second message generated by the second device according to the first message, wherein the message type of the second message is a border gateway protocol routing message, and the community attribute of the second message is a first random number generated by the second device;

[0057] In some embodiments of the present application, the second device is another network device that interacts with the device that initiates the authentication request (e.g., R1 device) during the device authentication process. The second device may be an SDN controller, other router devices, etc. Figure 5 An interaction process between a first device and a second device is shown, such as Figure 5 As shown, the first device R1 can interact with other devices (such as another communication device R2) through a route reflector, and can also interact with an SDN controller through a route reflector. The second device is used to receive the authentication request of the R1 device, parse the information carried therein, extract the pre-filled key area ID, take out the corresponding filled key sequence ID, generate a random number a or c as a group attribute, and publish the BGP route, the message type is registration authentication, and the message subtype is 1.

[0058] Specifically, the BGP community attribute (Community) is a mechanism for classifying and marking routes. It is an optional, transparent attribute of arbitrary length. By attaching one or more labels to the route, specific processing of the route is achieved. Community attributes are divided into custom community attributes and recognized community attributes. Each autonomous system (AS) can freely define and use community attributes to meet its specific needs. The format of the community attribute is represented by a 32-bit number, usually composed of two 16-bit numbers, called the high bit and the low bit. Among them, the high bit usually represents the autonomous system number (ASN), and the low bit is the custom community value. ASN: Value represents a specific Community value. A route can carry multiple Community attributes at the same time, which can be represented by comma separation. Each Community attribute can have different meanings and functions. When processing and matching Community attributes, logical operators can be used for combination. Common logical operators are AND, OR, and NOT. By flexibly combining and matching Community attributes, more complex routing policies and controls can be implemented. Up to 32 community attributes can be configured in one command. RFC1997 stipulates that the community attribute is composed of two 16-bit numbers, called the high bit and the low bit. The high bit represents the AS number, and the low bit represents the community attribute value. The format is AA:NN. This method is not mandatory and can be defined by each organization.

[0059] Optionally, a customized extended group attribute (security group attribute) is used to record data. The data structure of the group attribute is as follows: Figure 6 As shown, the security community attribute uses TLV format to identify information, with 12 bits in the upper part and 20 bits in the lower part. The first 8 bits of the upper 12 bits represent the message type: the registration and authentication type is 6, 7, and 8 bits, the 6th bit represents the registration and authentication type, and the 7th and 8th bits represent the message sequence number (subtype). 1 bit represents the link flag bit, 1 represents the next community attribute, and 3 bits represent the message length. The lower 20 bits are the payload. The payload is the authentication information. In the registration and authentication type message, the message types are divided into four types: 00000100, 00000101, 00000110, and 00000111. They represent four session sequence number IDs respectively. Multiple Community values ​​are separated by commas to form a list to transmit a group of information. The community attribute is a transferable attribute that can be transmitted to any neighbor (i.e., the second device). After obtaining the attribute, the router identifies the message type and extracts the payload. For messages used for registration and authentication, the corresponding community attribute can carry authentication information for authentication.

[0060] Optionally, when the second device is an SDN controller, a random number a is generated; and when the second device is other communication devices, a random number c is generated.

[0061] Step S306: after receiving the second message, generate a second random number, and perform a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a first message authentication code;

[0062] In some embodiments of the present application, after the first device receives a message with a message subtype of 1, it generates a random number b by itself, uses the injection key corresponding to the injection sequence ID to calculate HMAC(a+b, injection key corresponding to the injection ID), concatenates the random numbers a and b, and performs a hash message authentication code operation together with the injection key corresponding to the injection ID, and synchronously sends the calculated message to the BGP route. The community word in the message carries the calculated MAC value and the random number b. The message type is registration authentication, and the message subtype is 2.

[0063] Step S308, sending a third message carrying the first message authentication code and the second random number to the second device, wherein the second device is used to verify the first message authentication code, and perform a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain the second message authentication code, and the message type of the third message is a border gateway protocol routing message;

[0064] In some embodiments of the present application, after receiving the third message, the SDN controller or other device parses the message content, verifies the HMAC (a+b or c+b, the charging ID corresponds to the charging key) value, and uses the charging key corresponding to the charging sequence ID to perform the HMAC (b+a or b+c, the charging ID corresponds to the charging key) value operation, and synchronously sends the calculated HMAC value to R1 for synchronous verification calculation. The message type is registration authentication, and the message subtype is 3.

[0065] Step S310: receiving a fourth message carrying a second message authentication code sent by a second device, and authenticating the second message authentication code, wherein the message type of the fourth message is a border gateway protocol routing message.

[0066] In some embodiments of the present application, after receiving the fourth message, R1 calculates HMAC to verify whether the authentication is successful.

[0067] In some optional embodiments of the present application, each device records authentication sessions and session states with other devices. The authentication state matrix at least includes fields such as authentication session ID, initiator router-ID, receiver router-ID, session sequence number ID, extended community attribute word, etc.

[0068] Optionally, assuming that a total of N devices need to be authenticated, the R1 device needs to record (N-1) authentication sessions, with four messages in each session. If there are N devices in the network, there are a total of N*(N-1) session connections. BGP authentication routing can use a dedicated routing prefix (for example, the routing end between devices is agreed to be 10.0.0.0 / 8 through data configuration), or a certain service route can be used as the authentication route by default to speed up authentication.

[0069] Optionally, the device authentication process can be triggered when the device is restarted, newly connected to the network, the authentication counter is reset to zero, the route is revoked, etc.

[0070] Through the above steps, device authentication based on pre-charged quantum keys can be achieved, and registration and authentication of network devices on the quantum cryptographic service platform can be completed, which can ensure the legitimacy of the device, prevent counterfeit devices from entering the network, and prepare for key distribution and encrypted transmission. This application uses the BGP protocol to extend group attributes to transmit authentication messages, combined with pre-charged quantum keys and SDN controllers, to achieve simultaneous two-way authentication between devices and cryptographic service platforms, and between devices, solving the problem of low authentication efficiency of multi-point to multi-point networking services.

[0071] Specifically, this application has the following advantages:

[0072] 1. Simplified protocol: Use the extensibility of the BGP protocol to implement device authentication. The BGP Update message carries routing update (deletion, addition) information. At the same time, use the BGP extended community word to carry authentication information. Authentication information is obtained while implementing routing updates. Routing control and key negotiation control use the same protocol to simplify the control plane. The authentication and routing release control architectures are unified, which simplifies the protocol, facilitates the operation and maintenance of operators and Internet companies, reduces costs, and improves network management efficiency.

[0073] 2. High efficiency: BGP RR routing transmitter can realize two-way authentication between platform and equipment, between equipment, and between different customer sites at the same time. Each route or each VPN can be authenticated separately, which can meet the mutual authentication between different users. It has wide adaptability, high authentication efficiency and improved security.

[0074] The embodiment of the present application provides a device authentication method, comprising: a second device receives a first message of a border gateway protocol routing message issued by a first device, wherein the first device is pre-filled with a quantum key distributed to the first device by a quantum key distribution network, and identification information of the quantum key, and the first message carries device identification information of the first device and identification information of the quantum key; sends a second message generated according to the first message to the first device, wherein the message type of the second message is a border gateway protocol routing message, and the group attribute of the second message is a first random number generated by the second device; receives a message sent by the first device carrying a first message authentication The first device is configured to generate a third message carrying a code and a second random number, wherein the first device is configured to generate a second random number after receiving the second message, and perform a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a first message authentication code, and the message type of the third message is a border gateway protocol routing message; verify the first message authentication code, and perform a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a second message authentication code; and send a fourth message carrying the second message authentication code to the first device, wherein the first device is configured to authenticate the second message authentication code, and the message type of the fourth message is a border gateway protocol routing message.

[0075] The present application provides a data storage device. Figure 7 is a schematic diagram of the structure of the device, such as Figure 7 As shown, the device includes: a first processing module 70, which is used to publish a first message of a border gateway protocol routing message to a receiving device, wherein the authentication initiating device is pre-filled with a quantum key distributed to the authentication initiating device by a quantum key distribution network, and identification information of the quantum key, and the first message carries device identification information of the authentication initiating device and identification information of the quantum key; a second processing module 72, which is used to receive a second message generated by the receiving device according to the first message, wherein the message type of the second message is a border gateway protocol routing message, and the group attribute of the second message is a first random number generated by the receiving device; a third processing module 74, which is used to generate a second random number after receiving the second message, A hash message authentication code operation is performed on the first random number, the second random number and the quantum key to obtain a first message authentication code; a fourth processing module 76 is used to send a third message carrying the first message authentication code and the second random number to the receiving device, wherein the receiving device is used to verify the first message authentication code, and perform a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a second message authentication code, and the message type of the third message is a border gateway protocol routing message; a fifth processing module 78 is used to receive a fourth message carrying the second message authentication code sent by the receiving device, and authenticate the second message authentication code, wherein the message type of the fourth message is a border gateway protocol routing message.

[0076] In some embodiments of the present application, the first device includes a communication device, the second device includes a soft-defined gateway controller of the communication device or a quantum service platform, the quantum service platform includes a quantum key service layer, a network operation control layer and a network forwarding layer, wherein the quantum key service layer is connected to the quantum key distribution network; the network operation control layer includes a soft-defined gateway controller and a routing transmitter; the network forwarding layer includes a router device, wherein the router device is used to receive border gateway protocol routing information, extract authentication information from the border gateway protocol routing information, and send authentication information of the router device.

[0077] In some embodiments of the present application, a neighbor relationship is established between the first device and the second device through a routing transmitter, and messages are exchanged through the routing transmitter.

[0078] In some embodiments of the present application, a border gateway protocol routing message includes a custom security group attribute field, and the custom security group attribute field includes a high-order field and a low-order field, wherein the high-order field includes a first character for indicating the message type, a second character for indicating the message sequence number, and a third character representing a link flag; the low-order field includes authentication information.

[0079] In some embodiments of the present application, performing a hash message authentication code operation on a first random number, a second random number, and a quantum key to obtain a first message authentication code includes: concatenating the first random number and the second random number to obtain a first concatenation result, wherein the first random number is located in the first half of the first concatenation result, and the second random number is located in the second half of the first concatenation result; performing a hash message authentication code operation on the first concatenation result and the quantum key to obtain the first message authentication code.

[0080] In some embodiments of the present application, the second message authentication code is determined by: splicing the second random number and the first random number to obtain a second splicing result, wherein the second random number is located in the first half of the second splicing result, and the first random number is located in the second half of the second splicing result; performing a hash message authentication code operation on the second splicing result and the quantum key to obtain the second message authentication code.

[0081] In some embodiments of the present application, the first device and the second device also store an authentication status matrix for recording authentication sessions and session status, wherein the fields in the authentication status matrix include at least one of the following: an authentication session identifier, a session initiator identifier, a session receiver identifier, a session sequence number, and an extended group attribute word corresponding to the session.

[0082] In some embodiments of the present application, the identification information of the quantum key includes the zone number of the zone where the quantum key is located, and the key number of the quantum key.

[0083] It should be noted that the various modules in the above-mentioned device authentication device can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0084] An embodiment of the present application provides a non-volatile storage medium, in which a program is stored, wherein when the program is running, a device where the non-volatile storage medium is located is controlled to perform the following device authentication method: a first device sends a first message of a border gateway protocol routing message type to a second device, wherein the first device is pre-filled with a quantum key distributed to the first device by a quantum key distribution network, and identification information of the quantum key, and the first message carries device identification information of the first device and identification information of the quantum key; and a second message generated by the second device according to the first message is received, wherein the message type of the second message is a border gateway protocol routing message, and the group attribute of the second message is generated by the second device. a first random number; after receiving the second message, generating a second random number, and performing a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a first message authentication code; sending a third message carrying the first message authentication code and the second random number to the second device, wherein the second device is used to verify the first message authentication code, and performing a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a second message authentication code, and the message type of the third message is a border gateway protocol routing message; receiving a fourth message carrying the second message authentication code sent by the second device, and authenticating the second message authentication code, wherein the message type of the fourth message is a border gateway protocol routing message.

[0085] An embodiment of the present application provides an electronic device, comprising: a memory and a processor, the processor being used to run a program stored in the memory, wherein the following device authentication method is performed when the program is run: a first device publishes a first message of a border gateway protocol routing message type to a second device, wherein the first device is pre-filled with a quantum key distributed to the first device by a quantum key distribution network, and identification information of the quantum key, and the first message carries device identification information of the first device and identification information of the quantum key; a second device generates a second message based on the first message, wherein the message type of the second message is a border gateway protocol routing message, and the group attribute of the second message is a first message generated by the second device. a random number; after receiving the second message, generating a second random number, and performing a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a first message authentication code; sending a third message carrying the first message authentication code and the second random number to the second device, wherein the second device is used to verify the first message authentication code, and performing a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a second message authentication code, and the message type of the third message is a border gateway protocol routing message; receiving a fourth message carrying the second message authentication code sent by the second device, and authenticating the second message authentication code, wherein the message type of the fourth message is a border gateway protocol routing message.

[0086] The embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, the computer program implements the following device authentication method: a first device sends a first message of a border gateway protocol routing message to a second device, wherein the first device is pre-filled with a quantum key distributed to the first device by a quantum key distribution network, and identification information of the quantum key, and the first message carries device identification information of the first device and identification information of the quantum key; a second message generated by the second device according to the first message is received, wherein the message type of the second message is a border gateway protocol routing message, and the group attribute of the second message is a first random number generated by the second device; and the receiving After receiving the second message, a second random number is generated, and a hash message authentication code operation is performed on the first random number, the second random number and the quantum key to obtain a first message authentication code; a third message carrying the first message authentication code and the second random number is sent to the second device, wherein the second device is used to verify the first message authentication code, and a hash message authentication code operation is performed on the first random number, the second random number and the quantum key to obtain a second message authentication code, and the message type of the third message is a border gateway protocol routing message; a fourth message carrying the second message authentication code sent by the second device is received, and the second message authentication code is authenticated, wherein the message type of the fourth message is a border gateway protocol routing message.

[0087] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0088] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0089] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0090] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0091] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0092] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0093] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A device authentication method, characterized in that: include: The first device publishes a first message of a border gateway protocol routing message to the second device, wherein the first device is pre-filled with a quantum key distributed to the first device by a quantum key distribution network and identification information of the quantum key, and the first message carries device identification information of the first device and identification information of the quantum key; Receive a second message generated by the second device based on the first message, wherein the message type of the second message is the border gateway protocol routing message, and the group attribute of the second message is a first random number generated by the second device; After receiving the second message, generating a second random number, and performing a hash message authentication code operation on the first random number, the second random number, and the quantum key to obtain a first message authentication code; Sending a third message carrying the first message authentication code and the second random number to the second device, wherein the second device is used to verify the first message authentication code, and perform a hash message authentication code operation on the first random number, the second random number, and the quantum key to obtain a second message authentication code, and the message type of the third message is the border gateway protocol routing message; Receive a fourth message carrying the second message authentication code sent by the second device, and authenticate the second message authentication code, wherein the message type of the fourth message is the Border Gateway Protocol routing message.

2. The device authentication method according to claim 1, characterized in that: The first device includes a communication device, the second device includes a communication device or a soft-defined gateway controller of a quantum service platform, and the quantum service platform includes a quantum key service layer, a network operation control layer, and a network forwarding layer, wherein: The quantum key service layer is connected to the quantum key distribution network; The network operation control layer includes a soft-defined gateway controller and a routing transmitter; The network forwarding layer includes a router device, wherein the router device is used to receive border gateway protocol routing information, extract authentication information from the border gateway protocol routing information, and send the authentication information of the router device.

3. The device authentication method according to claim 2, characterized in that: A neighbor relationship is established between the first device and the second device through the routing transmitter, and messages are exchanged through the routing transmitter.

4. The device authentication method according to claim 1, characterized in that: The border gateway protocol routing message includes a custom security group attribute field, and the custom security group attribute field includes a high-order field and a low-order field, wherein: The high-order field includes a first character for indicating a message type, a second character for indicating a message sequence number, and a third character representing a link flag bit; The lower field includes authentication information.

5. The device authentication method according to claim 1, characterized in that: Performing a hash message authentication code operation on the first random number, the second random number, and the quantum key to obtain a first message authentication code includes: Splicing the first random number and the second random number to obtain a first splicing result, wherein the first random number is located in the first half of the first splicing result, and the second random number is located in the second half of the first splicing result; A hash message authentication code operation is performed on the first concatenation result and the quantum key to obtain the first message authentication code.

6. The device authentication method according to claim 1, characterized in that: The second message authentication code is determined by: Splicing the second random number and the first random number to obtain a second splicing result, wherein the second random number is located in the first half of the second splicing result, and the first random number is located in the second half of the second splicing result; Perform a hash message authentication code operation on the second splicing result and the quantum key to obtain the second message authentication code.

7. The device authentication method according to claim 1, characterized in that: The first device and the second device also store an authentication status matrix for recording authentication sessions and session status, wherein the fields in the authentication status matrix include at least one of the following: an authentication session identifier, a session initiator identifier, a session receiver identifier, a session sequence number, and an extended group attribute word corresponding to the session.

8. The device authentication method according to claim 1, characterized in that: The identification information of the quantum key includes the zone number of the zone where the quantum key is located and the key number of the quantum key.

9. A device authentication method, characterized in that: include: The second device receives a first message of a border gateway protocol routing message published by the first device, wherein the first device is pre-filled with a quantum key distributed to the first device by a quantum key distribution network and identification information of the quantum key, and the first message carries device identification information of the first device and identification information of the quantum key; Sending a second message generated according to the first message to the first device, wherein the message type of the second message is the border gateway protocol routing message, and the group attribute of the second message is a first random number generated by the second device; receiving a third message sent by the first device and carrying a first message authentication code and a second random number, wherein the first device is used to generate the second random number after receiving the second message, and perform a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain the first message authentication code, and the message type of the third message is the border gateway protocol routing message; Verifying the first message authentication code, and performing a hash message authentication code operation on the first random number, the second random number, and the quantum key to obtain a second message authentication code; A fourth message carrying the second message authentication code is sent to the first device, wherein the first device is used to authenticate the second message authentication code, and the message type of the fourth message is the Border Gateway Protocol routing message.

10. A device authentication system, characterized in that: Including quantum service platform, multiple communication equipment, among which, The quantum service platform includes a quantum key service layer, a network operation control layer and a network forwarding layer, wherein the quantum key service layer is connected to the quantum key distribution network, the network operation control layer includes a soft-defined gateway controller and a routing transmitter, and the network forwarding layer includes a router device, wherein the router device is used to receive border gateway protocol routing information, extract authentication information from the border gateway protocol routing information, and send authentication information of the router device; The first device among the multiple communication devices is used to publish a first message of a border gateway protocol routing message to a second device, wherein the first device is pre-filled with a quantum key distributed to the first device by a quantum key distribution network and identification information of the quantum key, the first message carries device identification information of the first device and identification information of the quantum key, the first device is any device among the multiple communication devices, and the second device is any device among the communication devices except the first device, or the soft-defined gateway controller; receiving a second message generated by the second device according to the first message, wherein the message type of the second message is the border gateway protocol routing message, and the group attribute of the second message is the first message generated by the second device. random number; after receiving the second message, generate a second random number, and perform a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a first message authentication code; send a third message carrying the first message authentication code and the second random number to the second device, wherein the second device is used to verify the first message authentication code, and perform a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a second message authentication code, and the message type of the third message is the border gateway protocol routing message; receive a fourth message carrying the second message authentication code sent by the second device, and authenticate the second message authentication code, wherein the message type of the fourth message is the border gateway protocol routing message.

11. A device authentication apparatus, suitable for use in an authentication initiating device, characterized in that: include: A first processing module is used to publish a first message of a border gateway protocol routing message to a receiving device, wherein the authentication initiating device is pre-filled with a quantum key distributed to the authentication initiating device by a quantum key distribution network and identification information of the quantum key, and the first message carries device identification information of the authentication initiating device and identification information of the quantum key; A second processing module is used to receive a second message generated by the receiving device according to the first message, wherein the message type of the second message is the border gateway protocol routing message, and the group attribute of the second message is a first random number generated by the receiving device; a third processing module, configured to generate a second random number after receiving the second message, and perform a hash message authentication code operation on the first random number, the second random number and the quantum key to obtain a first message authentication code; a fourth processing module, configured to send a third message carrying the first message authentication code and the second random number to the receiving device, wherein the receiving device is configured to verify the first message authentication code, and perform a hash message authentication code operation on the first random number, the second random number, and the quantum key to obtain a second message authentication code, and the message type of the third message is the border gateway protocol routing message; The fifth processing module is used to receive a fourth message carrying the second message authentication code sent by the receiving device, and authenticate the second message authentication code, wherein the message type of the fourth message is the Border Gateway Protocol routing message.

12. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the device authentication method described in any one of claims 1 to 8 or claim 9.

13. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the device authentication method described in any one of claims 1 to 8 or claim 9 when running.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the device authentication method described in any one of claims 1 to 8 or claim 9 are implemented.

Images