Dynamic login method of industrial safety equipment, computer equipment and storage medium

Abstract

The invention discloses a dynamic login method for industrial safety equipment, and the method is used for the industrial safety equipment, and comprises the steps: receiving a user-defined shell program of the industrial safety equipment, which is logged in by account information inputted by first terminal equipment through an intranet; generating an original application code according to the equipment information of the industrial safety equipment, the application timestamp and the symmetric encryption key; generating a login application code according to the original application code and sending the login application code to an authorization server of an external network through the first terminal device; receiving the login authorization code through the first terminal device, and performing device side login verification according to the login authorization code; and when the login authorization code passes the equipment side login verification, authorizing the first terminal equipment to log in the industrial safety equipment. According to the invention, the isolation between the industrial safety equipment and the external network is realized through the first terminal equipment, and the safety and reliability of logging in the industrial safety equipment are ensured through two times of verification of the authorization server and the industrial safety equipment.

Description

Technical Field

[0001] The present application relates to the field of industrial security technology, and in particular to a dynamic login method for industrial security equipment, a computer device, and a storage medium. Background Art

[0002] In the digital age, my country has introduced the Cybersecurity Level Protection 2.0 (hereinafter referred to as "Level Protection 2.0") system, which provides a more comprehensive, scientific and systematic guidance framework for the security protection of critical information infrastructure.

[0003] Based on the requirements of Information Security Protection 2.0, on-site industrial security equipment (such as industrial firewalls, industrial audit systems, industrial network gateways, industrial log audit systems, etc.) must undergo regular information security audits, and it is necessary to log in to the background of the industrial security equipment to confirm data information. In addition, industrial security equipment cannot be connected to the Internet, so it is inconvenient for industrial security equipment manufacturers to remotely log in to the background of the equipment to confirm information, and they do not want to inform the password of the background login account (usually root, or other accounts that support logging in to the background for equipment maintenance) to a third party, otherwise it is easy to cause the password of the login account to be leaked; in an industrial network environment, after industrial security equipment is deployed to the on-site environment, considering security, it is generally required that industrial security equipment cannot be logged in through the background to prevent being hacked. However, industrial security equipment has certain maintenance needs on site. If the industrial security equipment works abnormally, it is necessary to enter the background of the equipment to locate the problem.

[0004] If you cannot log in to the industrial safety equipment to confirm the security information of the equipment during the Information Security Protection 2.0 assessment, you may not be able to meet the information security assessment requirements and fail the assessment. You will then receive a rectification notice from the management department and be required to rectify the problem within a time limit and re-evaluate. If the on-site industrial safety equipment does not have the function of logging in to the background, you may not be able to locate and solve the problem when you encounter a problem. Summary of the invention

[0005] The embodiment of the present application aims at the scenario where on-site industrial safety equipment may encounter the need to log in to the background to perform information analysis and positioning, while at the same time it is necessary to avoid password leakage that may be caused by the fixed password of the industrial safety equipment maintenance account. A dynamic authorization login mechanism based on the combination of asymmetric encryption and symmetric encryption is introduced, which can effectively solve the problem of one-time authorized login of on-site industrial safety equipment.

[0006] The embodiments of the present application provide a dynamic login method for industrial security equipment, a computer device and a storage medium, which are used to solve at least one of the above-mentioned technical problems.

[0007] In a first aspect, an embodiment of the present application provides a dynamic login method for an industrial security device, which is used for an industrial security device, and the method includes: A custom shell program receiving account information input by a first terminal device through an intranet to log into the industrial security device; The custom shell program of the industrial security device generates an original application code according to the device information, application timestamp and symmetric encryption key of the industrial security device; The custom shell program of the industrial security device generates a login application code according to the original application code and sends it to the authorization server of the external network through the first terminal device, so that the authorization server performs server authorization verification according to at least the login application code and generates a login authorization code if the verification is passed; The custom shell program of the industrial safety device receives the login authorization code through the first terminal device, and performs device-side login verification according to the login authorization code; When the login authorization code passes the device-side login verification, the first terminal device is authorized to log in to the industrial security device.

[0008] In some embodiments, the authorization server performs server authorization verification at least according to the login application code, and generates a login authorization code if the verification is passed, including: The authorization server performs inversion code processing on the login application code to obtain an encrypted application code; The authorization server decrypts the encrypted application code using an asymmetric encryption private key to obtain the original application code; The authorization server extracts the device information and application timestamp from the original application code to perform server authorization verification; The authorization server generates an authorization timestamp based on the current time when the verification is passed, and further generates an original authorization code in combination with the original application code; The authorization server uses the symmetric encryption key to encrypt the original authorization code to generate a symmetric encrypted authorization code; The authorization server signs the original authorization code using an asymmetric encryption private key to generate signature information; The authorization server generates a signature authorization code according to the signature information and the symmetric encryption authorization code; The authorization server transcodes the signature authorization code to obtain a login authorization code.

[0009] In some embodiments, the custom shell program of the industrial security device generates a login application code according to the original application code and sends the login application code to the authorization server of the external network through the first terminal device, including: The custom shell program of the industrial security device performs asymmetrical encryption on the original application code to generate an encrypted application code; The custom shell program of the industrial security device transcodes the encrypted application code to obtain a login application code and sends the code to an authorization server on the external network through the first terminal device.

[0010] In some embodiments, the login authorization code includes the device information, the application timestamp, and the authorization timestamp; The performing device-side login verification according to the login authorization code includes: Determine the device information, application timestamp and authorization timestamp according to the login authorization code; Device-side login verification is performed based on at least one of the device information, the application timestamp, and the authorization timestamp.

[0011] In some embodiments, the device information includes a unique device ID, and performing device-side login verification based on at least one of the device information, the application timestamp, and the authorization timestamp includes: When it is determined that the device unique ID exists in the pre-stored device ID library, determining whether the authorization timestamp is greater than the application timestamp; When the authorization timestamp is greater than the application timestamp, determining whether the difference between the current timestamp and the authorization timestamp is less than a preset time threshold; If yes, it indicates that the login authorization code has passed the device-side login verification; If not, it indicates that the login authorization code has not passed the device-side login verification.

[0012] In some embodiments, determining the device information, the application timestamp, and the authorization timestamp according to the login authorization code includes: Performing reverse code processing on the login authorization code to obtain a signature authorization code; Extracting the signature information and the symmetrically encrypted authorization code contained in the signature authorization code; Using an asymmetric encryption public key to calculate the symmetric encryption authorization code to obtain data summary information; When the data summary information is consistent with the signature information, the symmetrically encrypted authorization code is decrypted to obtain the device information, the application timestamp and the authorization timestamp.

[0013] In a second aspect, an embodiment of the present application provides a dynamic login method for an industrial security device, which is used for an authorization server. The method includes: Receiving a login application code input by a second terminal device through an intranet, the login application code including device information of the industrial safety device and an application timestamp for applying for login; Decoding the login application code to obtain the device information and application timestamp for server authorization verification; If the verification is successful, a login authorization code is generated and sent to the industrial security device via the second terminal device.

[0014] In some embodiments, the device information and application timestamp obtained by decoding the login application code are subjected to server authorization verification, including: Performing inversion code processing on the login application code to obtain an encrypted application code; The authorization server decrypts the encrypted application code using the asymmetric encryption private key to obtain the original application code; The authorization server extracts the device information and application timestamp from the original application code to perform server authorization verification.

[0015] In some embodiments, if the verification is successful, a login authorization code is generated and sent to the industrial security device through the second terminal device, including: If the verification is successful, an authorization timestamp is generated according to the current time, and an original authorization code is further generated in combination with the original application code; Encrypt the original authorization code using a symmetric encryption key to generate a symmetric encrypted authorization code; Sign the original authorization code using an asymmetric encryption private key to generate signature information; Generate a signature authorization code according to the signature information and the symmetric encryption authorization code; The signature authorization code is transcoded to obtain a login authorization code, and the code is sent to the industrial security device via the second terminal device.

[0016] In a third aspect, an embodiment of the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that the processor executes the computer program to implement the steps of the dynamic login method for industrial security equipment described in any embodiment of the present application.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program / instruction is stored, characterized in that when the computer program / instruction is executed by a processor, the steps of the dynamic login method for industrial security equipment described in any embodiment of the present application are implemented.

[0018] In this embodiment, the first terminal device inputs account information to the industrial security device through the intranet to log in to the custom shell program and obtain a login application code, and then sends the login application code to the authorization server through the external network (i.e., the public network) for the first verification, and obtains the login authorization code after passing the verification; the first terminal device then obtains the login authorization code through the external network, and transmits the login authorization code to the industrial security device through the intranet for the second verification, and only authorizes the first terminal device to log in to the industrial security device after passing the verification. On the one hand, this application realizes the isolation of the industrial security device from the external network through the first terminal device, and on the other hand, through two verifications on the authorization server and the industrial security device, it ensures the security and reliability of logging in to the industrial security device. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 This is an architectural diagram of an embodiment of the dynamic login system in this application; Figure 2 Schematic diagram of dynamic interaction flow when implementing dynamic login for industrial security equipment; Figure 3 A flowchart of an embodiment of a dynamic login method for industrial security equipment of the present application; Figure 4 A flowchart of another embodiment of the dynamic login method for industrial security equipment of the present application; Figure 5 A flowchart of another embodiment of the dynamic login method for industrial security equipment of the present application; Figure 6 A flowchart of another embodiment of the dynamic login method for industrial security equipment of the present application; Figure 7 A flowchart of another embodiment of the dynamic login method for industrial security equipment of the present application; Figure 8 A flowchart of another embodiment of the dynamic login method for industrial security equipment of the present application; Fig. 9 A flowchart of another embodiment of the dynamic login method for industrial security equipment of the present application; Fig.10 A schematic diagram of the structure of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0022] It should also be noted that, in this article, the terms "include" and "comprise" include not only those elements, but also other elements not explicitly listed, or elements inherent to such processes, methods, articles or equipment. In the absence of further restrictions, the elements defined by the sentence "include..." do not exclude the existence of other identical elements in the process, method, article or equipment that includes the elements.

[0023] In order to solve at least one technical problem in the prior art, the present application proposes a device dynamic login system based on symmetric and asymmetric encryption technology. Figure 1 The following is an architecture diagram of an embodiment of the dynamic login system in the present application. It includes an authorization server deployed in the intranet of the industrial security equipment manufacturer and industrial security equipment deployed in the industrial site intranet of Company A and Company B. The after-sales personnel of the industrial security equipment manufacturer can communicate with the authorization server through the intranet through a terminal device (e.g., a laptop computer), and connect to the outside through a public network (i.e., an extranet) (e.g., the terminal device of the industrial security equipment operation and maintenance personnel of Company A, such as a laptop computer). The terminal device of the industrial security equipment operation and maintenance personnel of Company A (e.g., a laptop computer) communicates with the internal industrial security equipment through the intranet. The internal communication connection and the external communication connection of Company B are similar to those of Company A, and will not be repeated here. Among them, industrial security equipment is, for example, an industrial firewall, an industrial audit system, an industrial network gate, an industrial log audit system, etc., which is not limited in the present application.

[0024] like Figure 2 The figure shows the dynamic interaction process diagram when the industrial security device implements dynamic login. It specifically includes the following steps: The industrial safety equipment operation and maintenance personnel connect to the industrial safety equipment through the serial port through the first terminal device (e.g., a laptop computer) and input a fixed user and password into the industrial safety equipment; After receiving the fixed user and password, the industrial security device generates a login application code and returns it to the first terminal device; The first terminal device sends the login application code to a second terminal device (e.g., a laptop) of an after-sales personnel of the industrial safety equipment manufacturer through an external network; The second terminal device sends the login application code to the authorization server via the intranet; The authorization server receives the login application code and generates a login authorization code after verification and returns it to the second terminal device; The second terminal device sends the login authorization code to the first terminal device via the external network; The first terminal device then sends the login authorization code to the industrial security device through the serial port and logs in after verification.

[0025] In the embodiment of the present application, the industrial safety equipment is in the local area network of the customer's industrial site and is not connected to the public network; the authorization server is in the internal local area network of the industrial safety equipment manufacturer and is not connected to the public network. The industrial safety equipment operation and maintenance personnel input the user name and password into the serial port of the industrial safety equipment, and after obtaining the "login application code", only the "login application code" is exported to the public network and transmitted to the after-sales personnel of the industrial safety equipment manufacturer. The after-sales personnel of the industrial safety equipment manufacturer import the "login application code" into the company's internal network, enter the "login application code" on the authorization server, and after submitting the application, the corresponding "login authorization code" can be obtained, and the "login authorization code" is exported to the public network and sent to the industrial safety equipment operation and maintenance personnel. The industrial safety equipment operation and maintenance personnel import the "login authorization code" into the company's internal network and enter the "login authorization code" into the serial port of the device to complete the login.

[0026] like Figure 3 As shown, an embodiment of the present application provides a dynamic login method for an industrial security device, which is used for an industrial security device, and the method includes: S11, receiving account information input by the first terminal device through the intranet to log in to the custom shell program of the industrial security device.

[0027] The first terminal device is, for example, a laptop computer, a tablet computer, a mobile phone, or other dedicated terminal devices, which is not specifically limited in this application. The account information includes a user name and a password.

[0028] S12. The custom shell program of the industrial safety device generates an original application code according to the device information, application timestamp and symmetric encryption key of the industrial safety device.

[0029] Among them, the device information is the unique device ID of the industrial security device, the application timestamp is the time when the first terminal device applies to log in to the industrial security device, and the symmetric encryption key is used for encryption operations when generating the original application code.

[0030] S13. The custom shell program of the industrial safety device generates a login application code according to the original application code and sends it to the authorization server of the external network through the first terminal device, so that the authorization server performs server authorization verification at least according to the login application code and generates a login authorization code if the verification passes.

[0031] S14. The custom shell program of the industrial safety device receives the login authorization code through the first terminal device, and performs device-side login verification according to the login authorization code.

[0032] S15. When the login authorization code passes the device-side login verification, authorize the first terminal device to log in to the industrial security device.

[0033] In this embodiment, the first terminal device inputs account information to the industrial security device through the intranet to log in to the custom shell program and obtain a login application code, and then sends the login application code to the authorization server through the external network (i.e., the public network) for the first verification, and obtains the login authorization code after passing the verification; the first terminal device then obtains the login authorization code through the external network, and transmits the login authorization code to the industrial security device through the intranet for the second verification, and only authorizes the first terminal device to log in to the industrial security device after passing the verification. On the one hand, this application realizes the isolation of the industrial security device from the external network through the first terminal device, and on the other hand, through two verifications on the authorization server and the industrial security device, it ensures the security and reliability of logging in to the industrial security device.

[0034] like Figure 4 FIG. 1 is a flowchart of another embodiment of the dynamic login method for industrial security equipment of the present application. In these embodiments, the custom shell program of the industrial security equipment generates a login application code according to the original application code and sends it to the authorization server of the external network through the first terminal device, including: S131, the custom shell program of the industrial security device asymmetrically encrypts the original application code to generate an encrypted application code. Exemplarily, the custom shell program of the industrial security device asymmetrically encrypts the original application code using a built-in asymmetrical encryption public key to generate an encrypted application code.

[0035] S132. The custom shell program of the industrial security device transcodes the encrypted application code to obtain a login application code and sends the code to an authorization server on the external network through the first terminal device.

[0036] Exemplarily, the custom shell program of the industrial security device performs Base64 transcoding on the encrypted application code to generate a printable string, and supports printing the login authorization application code to the serial port.

[0037] In this embodiment, on the one hand, a symmetric encryption key is used to generate the original application code, and on the other hand, the original application code is asymmetrically encrypted by a built-in asymmetric encryption public key to generate an encrypted application code. A device dynamic login method based on symmetric and asymmetric encryption technology is implemented, which improves the security of the login application code finally generated, thereby ensuring the security of logging in to industrial security equipment.

[0038] like Figure 5 As shown, it is a flow chart of another embodiment of the dynamic login method of industrial security equipment of the present application. In these embodiments, the login authorization code includes the device information, the application timestamp and the authorization timestamp; the device-side login verification is performed according to the login authorization code, including: S141. Determine the device information, application timestamp and authorization timestamp according to the login authorization code, wherein the device information includes a unique device ID.

[0039] Exemplarily, determining the device information, application timestamp and authorization timestamp based on the login authorization code includes: performing inverse code processing on the login authorization code to obtain a signature authorization code; extracting the signature information and the symmetric encryption authorization code contained in the signature authorization code; using an asymmetric encryption public key to calculate the symmetric encryption authorization code to obtain data summary information; when the data summary information is consistent with the signature information, decrypting the symmetric encryption authorization code to obtain the device information, application timestamp and authorization timestamp.

[0040] S142, perform device-side login verification based on at least one of the device information, application timestamp, and authorization timestamp. Exemplarily, it specifically includes: when it is determined that the device unique ID exists in the pre-stored device ID library, determine whether the authorization timestamp is greater than the application timestamp; when the authorization timestamp is greater than the application timestamp, determine whether the difference between the current timestamp and the authorization timestamp is less than the preset time threshold; if the difference between the current timestamp and the authorization timestamp is less than the preset time threshold, it indicates that the login authorization code has passed the device-side login verification; if the difference between the current timestamp and the authorization timestamp is not less than the preset time threshold, it indicates that the login authorization code has not passed the device-side login verification.

[0041] Exemplarily, the authorization server extracts the current timestamp, subtracts the application timestamp to obtain the difference in seconds, and verifies whether the difference in seconds is greater than the seconds corresponding to the default timeout period. If so, it is considered a timeout, and the original application code is invalid due to the timeout, and an alarm message is generated. By controlling the time timeout, it is ensured that the special code is used for special purposes and in a timely manner, to prevent illegal personnel from taking advantage of their positions to obtain the application code, and after a considerable period of time, obtaining the authorization application, which may cause destructive intrusions to the device.

[0042] like Figure 6 FIG. 1 is a flowchart of another embodiment of the dynamic login method for industrial security equipment of the present application. The method of this embodiment is used for an authorization server, and the method includes: S21, receiving a login application code input by a second terminal device through an intranet, wherein the login application code includes device information of the industrial safety device and an application timestamp for applying for login; S22, decoding the login application code to obtain the device information and application timestamp for server authorization verification; S23: If the verification is successful, generate a login authorization code and send it to the industrial security device through the second terminal device.

[0043] In this embodiment, the second terminal device transmits a login application code to the authorization server through the intranet, which is used for the authorization server to perform the first verification, and obtains the login authorization code after passing the verification; then the second terminal device obtains the login authorization code from the authorization server through the intranet, and further sends the login authorization code to the industrial security device through the external network for the second verification for dynamic login. On the one hand, this application realizes the isolation of the authorization server from the external network through the second terminal device, and on the other hand, through the two verifications on the authorization server and the industrial security device, it ensures the security and reliability of logging into the industrial security device.

[0044] like Figure 7 FIG. 1 is a flowchart of another embodiment of the dynamic login method for industrial security equipment of the present application. In this embodiment, the device information and application timestamp obtained by decoding the login application code are subjected to server authorization verification, including: S221, performing inversion code processing on the login application code to obtain an encrypted application code.

[0045] Exemplarily, after receiving the input login application code, the authorization server decodes it through Base64 to restore the encrypted application code.

[0046] S222. The authorization server decrypts the encrypted application code using an asymmetric encryption private key to obtain the original application code.

[0047] Exemplarily, the authorization server decrypts the encrypted application code using an asymmetric encrypted private key to obtain the original application code.

[0048] S223, the authorization server extracts the device information and application timestamp from the original application code to perform server authorization verification. Exemplarily, the authorization server extracts the device unique ID of the application authorization code, the application timestamp, and the 10-bit random symmetric encryption key from the original application code.

[0049] Exemplarily, the steps of performing server authorization verification include: The authorization server verifies whether the unique ID of the device is within the range of products that have been sold. If not, an alarm message is generated and the authorization code generation process ends. If the device ID is in the device ID library of products that have been sold, the next step is to make a judgment. The authorization server extracts the current timestamp, subtracts the application timestamp to get the difference in seconds, and verifies whether the difference in seconds is greater than the default timeout duration. If so, it is considered to be timed out, and the original application code is invalid after the timeout, and an alarm message is generated. Through timeout control, the special code is guaranteed to be used for a special purpose and in a timely manner, to prevent illegal personnel from taking advantage of their positions to obtain the application code, and after a long process of obtaining the authorization application, they may cause destructive intrusions on the device; By limiting the validity period of the original application code, security and reliability are increased. The default timeout period is 10 minutes and can be set according to actual needs. For example, when the crystal oscillator accuracy of the device is low, the timeout period can be appropriately extended to prevent the application code generated by the industrial control security device from being used to apply for the authorization code because the time difference between the two systems exceeds the timeout period and is considered invalid; if the original application code is valid, the process of generating the authorization code is carried out.

[0050] like Figure 8 FIG. 1 is a flowchart of another embodiment of the dynamic login method for industrial security equipment of the present application. In this embodiment, if the verification is passed, a login authorization code is generated and sent to the industrial security equipment through the second terminal device, including: S231. If the verification is successful, generate an authorization timestamp according to the current time, and further generate an original authorization code in combination with the original application code.

[0051] Exemplarily, the authorization server generates an authorization timestamp according to the current time, adds the authorization timestamp after the original application code, and generates an original authorization code.

[0052] S232: Encrypt the original authorization code using the symmetric encryption key to generate a symmetric encryption authorization code. Exemplarily, the authorization server parses the original application code, obtains a 10-digit random symmetric encryption key, and uses the extracted symmetric encryption key to encrypt the original authorization code to generate a symmetric encryption authorization code.

[0053] S233: Use the asymmetric encryption private key to sign the original authorization code to generate signature information, and generate a signature authorization code according to the signature information and the symmetric encryption authorization code.

[0054] Exemplarily, the authorization server uses an asymmetric encryption private key to sign the original authorization code to generate a data digest, commonly known as signature information, and combines the signature information and the original authorization code to generate a signed authorization code.

[0055] S234: Transcode the signature authorization code to obtain a login authorization code and send it to the industrial security device through the second terminal device. Exemplarily, the authorization server performs Base64 transcoding on the signature authorization code to generate a printable string login authorization code.

[0056] like Fig. 9 FIG. 1 is a flowchart of another embodiment of the dynamic login method for industrial security equipment of the present application. In this embodiment, the dynamic login method for industrial security equipment includes the following steps: Step 1: At the operation site of the industrial equipment, because the equipment needs operation and maintenance, the operation and maintenance personnel at the industrial site enter the user name and fixed password of the industrial safety equipment at the serial port of the industrial safety equipment and log in to the custom shell program; Step 2: The custom shell program of the industrial security device collects the device unique ID, application timestamp, and 10-digit random symmetric encryption key to form the original application code; Step 3: The custom shell program of the industrial security device asymmetrically encrypts the original application code using the built-in asymmetric encryption public key to generate an encrypted application code; Step 4: The custom shell program of the industrial security device performs Base64 transcoding on the encrypted application code to generate a printable string, and supports printing the login application code to the serial port; Step 5: After receiving the input login application code, the authorization server decodes it through Base64 to restore the encrypted application code; Step 6: The authorization server decrypts the encrypted application code using the asymmetric encryption private key to obtain the original application code; Step 7: The authorization server extracts the unique ID of the device that applied for the authorization code, the application timestamp, and the 10-digit random symmetric encryption key from the original application code; Step 8: The authorization server verifies whether the unique ID of the device is within the range of the sold products. If not, an alarm message is generated and the authorization code generation process ends. If the device ID is in the device ID library of the sold products, the next step is to be determined. Step 9: The authorization server extracts the current timestamp, subtracts the application timestamp to get the difference in seconds, and verifies whether the difference in seconds is greater than the seconds corresponding to the default timeout period. If so, it is considered to be timed out, and the original application code is invalid after the timeout, and an alarm message is generated. Through the timeout control, the special code is guaranteed to be used for a special purpose and in a timely manner, to avoid illegal personnel taking advantage of their positions to obtain the application code, and after a long process of obtaining the authorization application, possible destructive intrusions on the device; Step 10: By limiting the validity period of the original application code, security and reliability are increased. The default timeout period is 10 minutes, which can be set according to actual needs. For example, when the crystal oscillator accuracy of the device is low, the timeout period can be appropriately extended to prevent the application code generated by the industrial control security device from being considered invalid when applying for the authorization code because the time difference between the two systems exceeds the timeout period; if the original application code is valid, the process of generating the authorization code is carried out; Step 11: The authorization server generates an authorization timestamp based on the current time, adds the authorization timestamp after the original application code, and generates an original authorization code; Step 12: The authorization server parses the original application code, obtains a 10-digit random symmetric encryption key (generated in step 2), and uses the extracted symmetric encryption key to encrypt the original authorization code to generate a symmetric encrypted authorization code; Step 13: The authorization server uses the asymmetric encryption private key to sign the original authorization code to generate a data digest, commonly known as signature information, and combines the signature information with the symmetric encryption authorization code to generate a signed authorization code; Step 14: The authorization server performs Base64 transcoding on the signature authorization code to generate a printable string login authorization code; Step 15: After receiving the login authorization code, the industrial security device uses Base64 decoding to obtain the signature authorization code; Step 16: Extract the signature and symmetric encryption authorization code from the signature authorization code, calculate the symmetric encryption authorization code using the asymmetric encryption public key, obtain the summary information of the data, and compare it with the extracted signature information (the summary information obtained by calculating the symmetric encryption authorization code data using the private key). If the two are equal, the signature verification is successful. This verification ensures the reliability of the source of the symmetric encryption authorization code, that is, it ensures that the symmetric encryption authorization code must be data calculated using the private key. Step 17, the industrial security device uses the random symmetric encryption key of this login to decrypt the symmetric encryption authorization code to obtain the original authorization code; Step 18, the industrial security device extracts the device unique ID, application timestamp, and authorization timestamp in the original authorization code; Step 19, the industrial safety device determines whether the unique ID of the device is in the sold device ID library. If not, an alarm message is generated and the login is logged out. If it is, the next step is to determine; Step 20: The industrial safety device determines whether the application timestamp extracted from the original authorization code is consistent with the timestamp of the current application operation. If they are inconsistent, an alarm message is generated and the login is logged out. If they are consistent, the next step is to be determined. Step 21, the industrial security device determines whether the authorization timestamp is greater than the application timestamp (the timestamp is a positive number, and the timestamp increases by 1 every second, so according to the steps of applying first and then authorizing, the authorization timestamp should be greater than the application timestamp). If it is less, the authorization code is invalid; Step 22: The industrial security device extracts the current timestamp and subtracts the authorization timestamp, and checks whether the difference exceeds the timeout period. If so (by default, a timeout is considered when the time is more than 10 minutes from the current time, and the difference should be less than 600 seconds), log out. Otherwise, the authorization code is valid and the system jumps to the standard background shell to perform related maintenance operations.

[0057] During the dynamic authorization login process, the application timestamp in the device application code is unique and the asymmetric encryption key is randomly generated. Combined with the security of asymmetric encryption and signature, this ensures that this dynamic login technology is one-time and one-key, that is, the application code and authorization code are only valid for this login, avoiding the possibility of repeated use; during the login process, even if the username and password of the background maintenance account are leaked, you cannot log in to the system directly. You need to log in to the industrial security device through the serial port to obtain the login application code, and obtain the login authorization code from the company's internal authorization server before you can log in.

[0058] By flexibly setting the timeout time, you can avoid authorization failures caused by inaccurate time drift due to low precision of the device clock crystal. You can also enable the clock synchronization function for both industrial security devices and authorization servers to ensure time consistency and avoid authorization failures. This dynamic authorization login solution only obtains a random login authorization code once when connecting to the industrial security device through the serial port, verifies the validity of the industrial security device through the authorization server, and generates a unique login authorization code for the login application code, ensuring the security of device login while taking into account the needs of background login. It can effectively solve the problem that industrial security equipment is inconvenient to maintain remotely over the network on site; it can also solve the risk of leakage of permanent keys when logging into the device to view device information during the security review process.

[0059] On the basis of this solution, a user detection and recovery program is added to detect and recover the default user information of industrial safety equipment in real time. If a user logs in to the industrial safety equipment through a one-time password, the newly created user can log in to the industrial safety equipment, avoiding the restriction that authorization is required to log in to the equipment. The user detection and recovery program can delete the new user and restore the user information to only support login through the serial port, and login requires a dynamic login mechanism such as a login application code and a login authorization code. This user detection and recovery program further ensures the effectiveness of the equipment.

[0060] From a security perspective, this solution proposes logging into industrial security equipment through a one-time password on a serial port. However, it is also technically compatible with logging into the equipment through a network. The dynamic login technology described in this solution can also support logging into the equipment through a network.

[0061] This solution supports the solution of dynamic login with one password for industrial security equipment. This technology can also be applied to other devices with login requirements. It is used to solve scenarios with login requirements. Dynamic login is achieved through one-time password, which meets the user's login needs and avoids the risk of device intrusion and manipulation due to user password leakage.

[0062] In some embodiments, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory, characterized in that the processor executes the computer program to implement the steps of the dynamic login method for industrial security equipment described in any embodiment of the present application.

[0063] In some embodiments, an embodiment of the present application provides a computer-readable storage medium on which a computer program / instruction is stored, characterized in that when the computer program / instruction is executed by a processor, the steps of the dynamic login method for industrial security equipment described in any embodiment of the present application are implemented.

[0064] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of actions combined, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application. In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0065] Fig.10 FIG. 1 is a schematic diagram of the hardware structure of a computer device for executing a dynamic login method for an industrial security device provided by another embodiment of the present application. Fig.10 As shown, the device includes: One or more processors 1010 and memory 1020, Fig.10 A processor 1010 is taken as an example.

[0066] The device for executing the dynamic login method of the industrial security device may further include: an input device 1030 and an output device 1040 .

[0067] The processor 1010, the memory 1020, the input device 1030 and the output device 1040 may be connected via a bus or other means. Fig.10 The example of connecting through bus is taken in the following.

[0068] The memory 1020, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions / modules corresponding to the dynamic login method for industrial security equipment in the embodiment of the present application. The processor 1010 executes various functional applications and data processing of the server by running the non-volatile software programs, instructions and modules stored in the memory 1020, that is, the dynamic login method for industrial security equipment in the above method embodiment is implemented.

[0069] The memory 1020 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required by at least one function; the data storage area may store data created according to the use of the dynamic login device of the industrial security device, etc. In addition, the memory 1020 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 1020 may optionally include a memory remotely arranged relative to the processor 1010, and these remote memories may be connected to the dynamic login device of the industrial security device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0070] The input device 1030 can receive input digital or character information and generate signals related to user settings and function control of the dynamic login device of the industrial security device. The output device 1040 can include a display device such as a display screen.

[0071] The one or more modules are stored in the memory 1020 , and when executed by the one or more processors 1010 , perform the dynamic login method for industrial security equipment in any of the above method embodiments.

[0072] The above-mentioned product can execute the method provided in the embodiment of the present application, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in this embodiment, please refer to the method provided in the embodiment of the present application.

[0073] The computer device of the embodiment of the present application exists in various forms, including but not limited to: (1) Mobile communication equipment: This type of equipment is characterized by having mobile communication functions and its main goal is to provide voice and data communications.

[0074] (2) Ultra-mobile personal computer devices: These devices fall into the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access features.

[0075] (3) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0076] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0077] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution, in essence, or the part that contributes to the relevant technology, can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiment.

[0078] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A dynamic login method for an industrial security device, used for an industrial security device, the method comprising: A custom shell program receiving account information input by a first terminal device through an intranet to log into the industrial security device; The custom shell program of the industrial security device generates an original application code according to the device information, application timestamp and symmetric encryption key of the industrial security device; The custom shell program of the industrial security device generates a login application code according to the original application code and sends it to the authorization server of the external network through the first terminal device, so that the authorization server performs server authorization verification according to at least the login application code and generates a login authorization code if the verification is passed; The custom shell program of the industrial safety device receives the login authorization code through the first terminal device, and performs device-side login verification according to the login authorization code; When the login authorization code passes the device-side login verification, the first terminal device is authorized to log in to the industrial security device.

2. The method according to claim 1, characterized in that The custom shell program of the industrial security device generates a login application code according to the original application code and sends the login application code to the authorization server of the external network through the first terminal device, including: The custom shell program of the industrial security device performs asymmetrical encryption on the original application code to generate an encrypted application code; The custom shell program of the industrial security device transcodes the encrypted application code to obtain a login application code and sends the code to an authorization server on the external network through the first terminal device.

3. The method according to claim 1, characterized in that The login authorization code includes the device information, application timestamp and authorization timestamp; The performing device-side login verification according to the login authorization code includes: Determine the device information, application timestamp and authorization timestamp according to the login authorization code; Device-side login verification is performed based on at least one of the device information, the application timestamp, and the authorization timestamp.

4. The method according to claim 3, characterized in that: The device information includes a unique device ID, and performing device-side login verification based on at least one of the device information, an application timestamp, and an authorization timestamp includes: When it is determined that the device unique ID exists in the pre-stored device ID library, determining whether the authorization timestamp is greater than the application timestamp; When the authorization timestamp is greater than the application timestamp, determining whether the difference between the current timestamp and the authorization timestamp is less than a preset time threshold; If yes, it indicates that the login authorization code has passed the device-side login verification; If not, it indicates that the login authorization code has not passed the device-side login verification.

5. The method according to claim 3, characterized in that: The determining the device information, the application timestamp and the authorization timestamp according to the login authorization code includes: Performing reverse code processing on the login authorization code to obtain a signature authorization code; Extracting the signature information and the symmetrically encrypted authorization code contained in the signature authorization code; Using an asymmetric encryption public key to calculate the symmetric encryption authorization code to obtain data summary information; When the data summary information is consistent with the signature information, the symmetrically encrypted authorization code is decrypted to obtain the device information, the application timestamp and the authorization timestamp.

6. A dynamic login method for an industrial security device, used for an authorization server, the method comprising: Receiving a login application code input by a second terminal device through an intranet, the login application code including device information of the industrial safety device and an application timestamp for applying for login; Decoding the login application code to obtain the device information and application timestamp for server authorization verification; If the verification is successful, a login authorization code is generated and sent to the industrial security device via the second terminal device.

7. The method according to claim 6, characterized in that Decoding the login application code to obtain the device information and application timestamp for server authorization verification, including: Performing inversion code processing on the login application code to obtain an encrypted application code; The authorization server decrypts the encrypted application code using the asymmetric encryption private key to obtain the original application code; The authorization server extracts the device information and application timestamp from the original application code to perform server authorization verification.

8. The method according to claim 7, characterized in that If the verification is successful, a login authorization code is generated and sent to the industrial security device through the second terminal device, including: If the verification is successful, an authorization timestamp is generated according to the current time, and an original authorization code is further generated in combination with the original application code; Encrypt the original authorization code using a symmetric encryption key to generate a symmetric encrypted authorization code; Sign the original authorization code using an asymmetric encryption private key to generate signature information; Generate a signature authorization code according to the signature information and the symmetric encryption authorization code; The signature authorization code is transcoded to obtain a login authorization code, and the code is sent to the industrial security device via the second terminal device.

9. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images