Security authentication method, electronic equipment and storage medium

Abstract

The invention discloses a security authentication method, electronic equipment and a storage medium, which are applied to the field of information security, and the method comprises the following steps: generating terminal authentication information according to a pre-configured physical unclonable function; the terminal authentication information is transmitted to a server side for identity authentication, and the server side at least stores authentication registration information, generated based on the physical unclonable function, of the terminal. According to the embodiment of the invention, the terminal authentication information is generated through the physical unclonable function, the verification cost of identity authentication can be reduced, and the security of the authentication information is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a security authentication method, electronic equipment and storage medium. Background Art

[0002] Internet Protocol Security (IPsec) is a set of protocols and services that provide security for the Internet. It can provide flexible security services for network layer traffic in IPv4 and IPv6 environments, ensuring the confidentiality, integrity and authenticity of data transmission in insecure network environments. The Internet Key Exchange (IKE) phase of the IPsec protocol authenticates both parties in the session. Currently, IKE authentication is implemented through a certificate system based on the Public Key Infrastructure (PKI).

[0003] However, although the PKI certificate system has high security, it has strict requirements for application scenarios. For example, the method of use requires a reliable private key protection device, and a Certificate Authority (CA) and Registration Authority (RA) need to be established in advance to perform certificate management and online authentication. The usage process is highly complex and requires a high construction cost, which leads to obstacles in the implementation of identity authentication. Summary of the invention

[0004] The present invention provides a security authentication method, an electronic device and a storage medium, which generate terminal authentication information through a physical unclonable function, can reduce the verification cost of identity authentication and improve the security of authentication information.

[0005] According to one aspect of the present invention, a security authentication method is provided, wherein the method is applied to a terminal, and the method comprises:

[0006] Generate terminal authentication information according to a pre-configured physical unclonable function;

[0007] The terminal authentication information is transmitted to a server for identity authentication, wherein the server at least stores the authentication registration information of the terminal generated based on the physical unclonable function.

[0008] According to another aspect of the present invention, a security authentication method is also provided, wherein the method is applied to a server, and the method comprises:

[0009] Get the terminal authentication information uploaded by the terminal;

[0010] Determine the authentication registration information of the terminal, and perform identity authentication on the terminal according to the authentication registration information and the terminal authentication information, wherein the authentication registration information is generated by the terminal based on a physical unclonable function.

[0011] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0012] at least one processor; and

[0013] a memory communicatively connected to the at least one processor; wherein,

[0014] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the security authentication method described in any embodiment of the present invention.

[0015] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the security authentication method described in any embodiment of the present invention when executed.

[0016] The technical solution of the embodiment of the present invention generates terminal authentication information of the corresponding terminal through a physical unclonable function, and authenticates the terminal through the terminal authentication information at the server. The server stores the authentication registration information generated by the terminal based on the physical unclonable function, and assists the terminal in identity authentication through the physical unclonable function. There is no need to rely on the PKI certificate system, and the construction of certificate issuing authorities and registration authorities is avoided. The cost of identity authentication can be reduced and the application scenarios of identity authentication can be improved.

[0017] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 is a flow chart of a security authentication method provided according to Embodiment 1 of the present invention;

[0020] Figure 2is a flowchart of another security authentication method provided according to Embodiment 2 of the present invention;

[0021] Figure 3 is a flowchart of another security authentication method provided according to Embodiment 3 of the present invention;

[0022] Figure 4 is a flow chart of a security authentication method provided according to Embodiment 4 of the present invention;

[0023] Figure 5 is a flowchart of another security authentication method provided according to Embodiment 5 of the present invention;

[0024] Figure 6 is a structural schematic diagram of a security authentication device provided according to Embodiment 7 of the present invention;

[0025] Figure 7 is a schematic diagram of the structure of another security authentication device provided according to Embodiment 8 of the present invention;

[0026] Figure 8 It is a schematic diagram of the structure of an electronic device for implementing the security authentication method of an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 11 is a flowchart of a security authentication method provided according to Embodiment 1 of the present invention. This embodiment is applicable to the case of terminal identity authentication. The method can be executed by a security authentication device, which can be implemented in the form of hardware and / or software and can be configured in a terminal. Figure 1 As shown, the method includes:

[0031] Step 110: Generate terminal authentication information according to a pre-configured physical unclonable function.

[0032] Among them, the Physical Unclonable Function (PUF) can be a function that uses the microscopic structural differences of a physical entity to generate a unique, unpredictable and difficult-to-copy digital signature. It is achieved through the random differences naturally generated by the physical entity during the manufacturing process. The random differences may include transistor characteristics in integrated circuits, refractive index distribution of optical components, dimensional changes in mechanical structures, etc. The random differences can be obtained by applying specific stimuli to the physical entity, and the physical view may be a partial physical component of the terminal. The terminal authentication information may be information used by the terminal for identity authentication, and the terminal authentication information may include the call result of the physical unclonable function and the terminal identification, etc.

[0033] In an embodiment of the present invention, the terminal can call a pre-configured physical unclonable function, and the terminal can randomly generate an input information or agree on an input information with the server. The input information can be processed through physical differences such as the terminal's own transistor characteristics, the refractive index distribution of the optical element, the size change of the mechanical structure, etc. in the physical unclonable function, so as to generate a processing result of the physical unclonable function, and the processing result can be encapsulated as terminal authentication information.

[0034] Step 120: Transmit the terminal authentication information to the server for identity authentication, wherein the server at least stores the authentication registration information of the terminal generated based on the physical unclonable function.

[0035] Among them, the server can provide identity authentication services for the terminal. The server can pre-acquire the authentication registration information uploaded by the terminal. The authentication registration information can be generated by the terminal through its configured physical unclonable function. When the server authenticates the terminal, it can compare the authentication registration information with the terminal authentication information. The comparison method may include but is not limited to comparing part of the authentication registration information with the terminal authentication information or comparing the calculation result of part of the information with the terminal authentication information.

[0036] Specifically, the terminal can upload the generated terminal authentication information to the server, and the service can verify the terminal authentication information through its stored authentication registration information to determine whether the identity of the terminal is legal. Among them, the authentication registration information stored by the server can be generated by the terminal through its configured physical unclonable function.

[0037] In the embodiments of the present invention, terminal authentication information of the corresponding terminal is generated through a physical unclonable function, and the terminal is authenticated through the terminal authentication information at the server. The server stores the authentication registration information generated by the terminal based on the physical unclonable function, and the terminal is assisted in identity authentication through the physical unclonable function. There is no need to rely on the PKI certificate system, and the construction of a certificate issuing authority and a registration authority is avoided. Therefore, the cost of identity authentication can be reduced and the application scenarios of identity authentication can be improved.

[0038] Furthermore, based on the above-mentioned embodiments of the invention, the present invention further includes:

[0039] The authentication registration information is generated based on the physical unclonable function, and the authentication registration information is registered to the server.

[0040] In the embodiment of the present invention, the terminal can call the configured physical unclonable function to generate authentication registration information, and register the authentication registration information to the server, so as to verify the terminal authentication information during the identity authentication process.

[0041] Embodiment 2

[0042] Figure 2 is a flowchart of another security authentication method provided according to the second embodiment of the present invention. The embodiment of the present invention is a specific embodiment based on the above embodiment, and introduces the process of generating terminal authentication information. Figure 2 The method provided in the embodiment of the present invention specifically includes the following steps:

[0043] Step 210: Encapsulate the terminal identification and payload information of the terminal into an authentication information payload.

[0044] Among them, the terminal identification can be information that uniquely identifies the terminal, and the terminal identification can include the device name, network address or physical address, etc. The payload information can be used to request information for identity authentication on the server side, and the payload information can be generated by information pre-agreed between the terminal and the server side. The authentication information payload can be information that triggers the server side to authenticate the terminal, and the authentication information payload can be generated according to a preset information format. The authentication information payload specifically includes a security association payload, a VPN tunnel payload, an IPsec payload, an SSL payload, a TLS payload, etc.

[0045] In an embodiment of the present invention, the terminal identification and pre-agreed payload information of the terminal may be obtained, and the terminal identification and payload information may be encapsulated as an authentication information payload through a payload structure pre-agreed between the terminal and the server or specified by a standard.

[0046] Step 220: Upload the authentication information payload to the server, so that the server searches for matching authentication registration information according to the terminal identifier of the authentication information.

[0047] Specifically, the terminal can upload the generated authentication information payload to the server, and the server can parse the authentication information payload to extract the terminal identifier included in the authentication information payload, and search for the authentication registration information of the terminal pre-registered to the server according to the terminal identifier. It can be understood that the authentication registration information in the server includes the terminal identifier or the authentication registration information is stored in association with the terminal identifier, and the server thereby determines the authentication registration information corresponding to the terminal through the terminal identifier.

[0048] Step 230: Receive authentication feedback information fed back by the server, wherein the authentication feedback information is generated based on the authentication registration information.

[0049] The authentication feedback information may be used to generate terminal authentication information at the terminal, and the authentication feedback information may be determined by the server, and the authentication feedback information may further enhance the security of identity authentication. The authentication feedback information may include terminal identification, key verification information, authentication registration information, input information used in the physical unclonable function generation process, etc.

[0050] Specifically, the server can process the authentication registration information of the terminal to generate authentication feedback information. The processing process may include hash processing or encryption processing. The information generated by the processing can be used as authentication feedback information. The server can send the authentication feedback information to the terminal, and the terminal can receive the authentication feedback information.

[0051] Step 240: Generate terminal authentication information according to the authentication feedback information and the physical unclonable function.

[0052] Specifically, the terminal can call a pre-configured physical unclonable function to process the authentication feedback information, and can use the output result of the physical unclonable function as the terminal authentication information. It can be understood that the physical unclonable function includes physical differences of the terminal, and the physical differences can be determined by information such as the transistor characteristics in the integrated circuit of the terminal, the refractive index distribution of the optical element, and the size of the mechanical structure. The authentication feedback information can be processed through the IoT difference, and the processing result can be used as the terminal authentication information.

[0053] Step 250: Send the terminal authentication information to the server, so that the server performs identity authentication through the authentication registration information and the terminal authentication information.

[0054] According to an embodiment of the present invention, a terminal identifier and payload information are encapsulated into an authentication information payload, authentication feedback information is obtained at a server through the authentication information payload, the authentication feedback information is generated by an authentication registration corresponding to the terminal identifier, a physical unclonable function is called to process the authentication feedback information into terminal authentication information, and the terminal authentication information is sent to a server, so that the server performs identity authentication on the terminal through the authentication registration information and the terminal authentication information, thereby realizing rapid authentication of the terminal, preventing the identity authentication information from being forged through the authentication feedback information, improving the security of the terminal identity authentication, reducing the identity authentication requirements based on the physical unclonable function, eliminating the need to construct a complex identity authentication mechanism, reducing the identity authentication cost, and expanding the application scenarios of identity authentication.

[0055] Further, based on the above-mentioned embodiment of the invention, the terminal authentication information is generated according to the authentication feedback information and the physical unclonable function, including:

[0056] Extract the authentication input parameters included in the authentication feedback information; call the physical unclonable function to process the authentication output parameters to obtain the function output result and data verification information; encapsulate the terminal identifier, the function output result and the data verification information into the terminal authentication information.

[0057] Among them, the authentication input parameter can be part of the authentication feedback information. For example, the authentication feedback information fed back by the server includes the terminal identification, encryption key verification information, random number, authentication registration information based on the input information used in the physical unclonable function generation process, etc. The authentication input parameter can include one or more of the terminal identification, encryption key verification information, random number, authentication registration information based on the input information used in the physical unclonable function generation process. Further, the authentication input parameter can also be the operation result of one or more of the terminal identification, encryption key verification information, random number, authentication registration information based on the input information used in the physical unclonable function generation process. The operation can include logical operation or hash operation, etc. The function output result can be the processing result of the physical unclonable function on the authentication input parameter, and the data verification information can generate integrity verification information for the function output result. The data verification information can be obtained by performing hash processing or SM3 hash processing on the function output result.

[0058] In an embodiment of the present invention, the terminal can extract the received authentication feedback information, and can extract one or more parameters from the authentication feedback information as authentication input parameters. Further, the authentication input parameters can also be obtained by calculating the one or more parameters extracted from the authentication feedback information. A physical unclonable function can be called to process the authentication input parameters to obtain a function output result, and the function output result can be processed to obtain data verification information for identifying the integrity of the function output result. The data verification information and the function output result can be encapsulated as terminal authentication information.

[0059] Embodiment 3

[0060] Figure 3 is a flowchart of another security authentication method provided according to Embodiment 3 of the present invention. The embodiment of the present invention is a specific embodiment based on the above embodiment, and the authentication registration process of the terminal is described in detail. Figure 3 The method provided in the embodiment of the present invention specifically includes the following steps:

[0061] Step 310: Perform signature certificate authentication with the server, obtain the authentication key assigned by the server and save it.

[0062] Among them, the signature certificate authentication can be a process of authenticating the signature certificate of the server. The signature certificate can be a digital certificate used for identity authentication. The signature certificate can be used to prove the identity of the holder of the signature certificate. The signature certificate authentication process can include the server's signature certificate authentication of the terminal and the terminal's signature certificate authentication of the server. The authentication key can be key information used to generate authentication registration information. The authentication key can be determined by the server for the terminal. The authentication key can be used to encrypt information transmitted between the server and the terminal during the identity authentication process. For example, the authentication key can be determined by the server through the terminal identification, or the authentication key can be randomly generated by the server.

[0063] In an embodiment of the present invention, the terminal can perform signature certificate authentication with the server, and the terminal and the server can transmit their respective signature certificates to each other. After passing the signature certificate authentication, the terminal can obtain the authentication key distributed by the server, and the terminal can save the received authentication key.

[0064] Step 320: Call the physical unclonable function to generate authentication registration information, and register the authentication registration information to the server.

[0065] In an embodiment of the present invention, the terminal can randomly generate one or more input information, input the input information into a physical unclonable function for processing, obtain authentication registration information, and send the authentication registration information to the server, thereby registering the terminal at the server. In some embodiments of the invention, the authentication registration information can be encrypted by an authentication key distributed by the server, further improving the security of the authentication registration information transmission.

[0066] Step 330: Generate terminal authentication information according to a pre-configured physical unclonable function.

[0067] Step 340: Transmit the terminal authentication information to the server for identity authentication, wherein the server at least stores the authentication registration information of the terminal generated based on the physical unclonable function.

[0068] The embodiment of the present invention performs signature certificate authentication with the server, obtains and saves the authentication key assigned by the server, generates authentication registration information through a physical unclonable function, sends the authentication registration information to the server to complete the registration, generates terminal authentication information based on the physical unclonable function, and uploads the terminal authentication information to the server for identity authentication. The embodiment of the present invention implements identity authentication of the terminal through the physical unclonable function, ensures the authenticity of the authentication registration information based on the security of the IoT unclonable function, performs identity authentication on the terminal based on the authentication registration information and the terminal authentication information, and can realize rapid authentication of the terminal. The authentication feedback information prevents the authentication information from being forged, which can improve the security of the terminal identity authentication. The identity authentication requirements are reduced based on the physical unclonable function, and there is no need to build a complex identity authentication mechanism, which can reduce the identity authentication cost and expand the application scenarios of identity authentication.

[0069] Further, based on the above-mentioned embodiment of the invention, the signature certificate authentication is performed with the server, and the authentication key assigned by the server is obtained and saved, including:

[0070] Obtain the pre-configured terminal identification and terminal signature certificate, encapsulate the terminal identification as an authentication request; transmit the terminal identification and terminal signature certificate to the server; receive the authentication key and server signature certificate fed back by the server, and verify the server signature certificate, wherein the authentication key is generated by the server according to the terminal identification after verifying the terminal signature certificate.

[0071] The terminal signature certificate can be a certificate obtained by the terminal from a certificate authority to identify the terminal. The terminal signature certificate can be issued to the terminal by a public certificate authority (CA) or a private certificate authority, and can be used to further improve the reliability of terminal identity authentication. Correspondingly, the server can pre-acquire a server signature certificate that proves its identity.

[0072] In the embodiment of the present invention, the terminal identification and terminal signature certificate of the terminal can be extracted, the terminal identification can be encapsulated into an authentication request, the encapsulation method of the authentication request can be pre-configured or negotiated and determined with the server, the authentication request and the terminal signature certificate can be transmitted to the server, so that the server can verify the terminal signature certificate, and after the verification is passed, the server can generate an authentication key based on the terminal identification of the terminal, for example, the authentication key can be directly generated by the terminal identification through a cryptographic hash function, or the authentication key can be generated by processing the terminal identification through a key derivation function. The server can feed back the generated authentication key and the server signature certificate to the terminal, the terminal can receive the above-mentioned authentication key and the server signature certificate, the terminal can verify the server signature certificate, and after passing the verification, the authentication key can be saved.

[0073] Further, based on the above-mentioned embodiment of the invention, the authentication registration information is generated based on calling the physical unclonable function, including:

[0074] At least three groups of registration input information are randomly generated; a physical unclonable function is called to generate a function processing result of each group of registration input information and registration verification information; and a terminal identifier of the terminal, each group of registration input information, a function processing result of each group of registration input information, and registration verification information of each group of registration input information are encapsulated as authentication registration information.

[0075] The registration input information may be information used to generate authentication registration information, and the registration input information may be randomly generated.

[0076] Specifically, the terminal can randomly generate multiple sets of registration input information, and process the registration input information into function processing results and registration verification information through a physically unclonable function, wherein the registration verification information can be integrity verification information of the function processing result, and the registration verification information can be generated by hashing the function processing result. The function processing result, registration verification information, terminal identification and registration input information can be packaged together as authentication registration information.

[0077] Embodiment 4

[0078] Figure 4 1 is a flowchart of a security authentication method provided according to Embodiment 4 of the present invention. This embodiment is applicable to the case of terminal identity authentication. The method can be executed by a security authentication device. The device can be implemented in the form of hardware and / or software. The device can be configured in a server. The server can be composed of one or more server clusters. Figure 4 As shown, the method includes:

[0079] Step 410: Acquire terminal authentication information uploaded by the terminal.

[0080] In an embodiment of the present invention, the terminal can call a pre-configured physical unclonable function, and the terminal can randomly generate an input information or agree on an input information with the server. The input information can be processed through physical differences such as the terminal's own transistor characteristics, the refractive index distribution of the optical element, the size change of the mechanical structure, etc. in the physical unclonable function, so as to generate a processing result of the physical unclonable function. The processing result can be encapsulated as terminal authentication information, and the server can receive the terminal authentication information uploaded by the terminal.

[0081] Step 420: Determine the authentication registration information of the terminal, and perform identity authentication on the terminal according to the authentication registration information and the terminal authentication information, wherein the authentication registration information is generated by the terminal based on a physical unclonable function.

[0082] Specifically, the server can pre-acquire the authentication registration information uploaded by the terminal. The authentication registration information can be generated by the terminal through a physically unclonable function configured by the terminal. When the terminal authentication information of the terminal is acquired, the authentication registration information pre-registered by the terminal can be determined. The terminal authentication information can be compared with the authentication registration information to determine whether the identity of the terminal is legitimate. The comparison can include comparing part of the authentication registration information with the terminal authentication information or comparing the calculation result of part of the information with the terminal authentication information, etc.

[0083] In an embodiment of the present invention, terminal authentication information generated by a terminal based on a physical unclonable function is obtained, and the terminal authentication information is verified through authentication registration information of the corresponding terminal to determine the terminal identity. The authentication registration information is generated by the terminal based on a physical unclonable function, and the physical unclonable function is used to assist the terminal in identity authentication. There is no need to rely on a PKI certificate system, and the construction of a certificate issuing authority and a registration authority is avoided. This can reduce the cost of identity authentication and improve the application scenarios of identity authentication.

[0084] Embodiment 5

[0085] Figure 5 is a flowchart of another security authentication method provided according to Embodiment 5 of the present invention. The embodiment of the present invention concretizes the above embodiment and describes the identity authentication process. Figure 5 The method provided in the embodiment of the present invention specifically includes the following steps:

[0086] Step 510: perform signature certificate authentication with the terminal and send an authentication key to the terminal so that the terminal generates authentication registration information according to a physical unclonable function, wherein the authentication key is generated by a terminal identifier of the terminal.

[0087] In an embodiment of the present invention, the terminal can perform signature certificate authentication with the server, and the server and the terminal can transmit their respective signature certificates to each other. After passing the signature certificate authentication, the server can generate an authentication key based on the identification information of the terminal. The authentication key can be key information used to generate authentication registration information. The authentication key can be determined by the server. The authentication key can be used to encrypt information transmitted between the server and the terminal during the identity authentication process. The server can send the generated authentication key to the terminal. It can be understood that the terminal can randomly generate one or more input information, and the input information can be input into a physical unclonable function for processing to obtain authentication registration information.

[0088] Step 520: Obtain the authentication registration information uploaded by the terminal, and save the authentication registration information.

[0089] Specifically, the server can receive the authentication registration information uploaded by the terminal, and save the authentication registration information to authenticate the terminal. It can be understood that the authentication registration information can be saved on the server in an encrypted or unencrypted manner. For example, the authentication registration information can be encrypted using an authentication key or other keys associated with the authentication key. The other key and the authentication key can be components of a key. For example, a key can be randomly generated and the key can be derived into two key components. One of the two key components can be used as the authentication key issued by the server, and the other key component can be used to encrypt and save the authentication registration information.

[0090] Step 530: Acquire terminal authentication information uploaded by the terminal.

[0091] Specifically, the terminal may generate terminal authentication information through a physical unclonable function, and the server may receive the terminal authentication information uploaded by the terminal.

[0092] Step 540: extract the terminal identification, function output result and data verification information from the terminal authentication information.

[0093] Specifically, the terminal authentication information may include parameters such as terminal identification, function output results and data verification information. After receiving the terminal authentication information, the terminal identification, function output results and data verification information included in the terminal authentication information can be extracted, wherein the terminal identification may be unique identification information indicating the terminal, the function output result may be the processing result generated by the terminal through its configured physical unclonable function, and the data verification information may be verification information generated by the terminal for determining the integrity of the function output result.

[0094] Step 550: Search for authentication registration information that matches the terminal identifier, and extract the function processing result of the authentication registration information and the registration verification information.

[0095] In an embodiment of the present invention, the authentication registration information may be composed of a terminal identifier, a function processing result, and a registration verification letter. The server may search for the corresponding authentication registration information according to the terminal identifier of the terminal verification information, and may extract the function processing result and registration verification information included in the authentication registration information.

[0096] Step 560: After verifying the registration verification information and the data verification information, compare the function output result with the function processing result to obtain the authentication result of the identity authentication.

[0097] Specifically, the registration verification information and the data verification information can be verified respectively to determine the integrity of the function output result and the function processing result. After determining that the integrity of the function output result and the function processing result are verified respectively through the registration verification information and the data verification information, the function output result in the terminal verification information can be compared with the function processing result in the authentication registration information. When it is determined that the function output result and the function processing result are the same, it can be determined that the authentication result is that the terminal has passed the verification; otherwise, it can be determined that the authentication result is that the terminal has failed the verification.

[0098] According to the embodiment of the present invention, after the server and the terminal perform signature certificate authentication, an authentication key is allocated to the terminal, the authentication registration information uploaded by the terminal is received and saved, and when the terminal authentication information of the terminal is obtained, the authentication registration information corresponding to the terminal identification included in the terminal authentication information is extracted, and the registration verification information in the authentication registration information and the data verification information of the terminal authentication information are verified respectively to ensure the integrity of the function output result and the function processing result, and the authentication result of the identity authentication is generated by comparing the function output result and the function processing result. The embodiment of the present invention implements the identity authentication of the terminal through a physical unclonable function, ensures the authenticity of the authentication registration information based on the security of the IoT unclonable function, authenticates the terminal based on the authentication registration information and the terminal authentication information, prevents the identity authentication information from being forged, improves the security of the terminal identity authentication, reduces the identity authentication requirements based on the physical unclonable function, does not need to build a complex identity authentication mechanism, reduces the identity authentication cost, and expands the application scenarios of identity authentication.

[0099] Further, based on the above-mentioned embodiment of the invention, before obtaining the terminal authentication information uploaded by the terminal, it also includes:

[0100] Obtain the authentication information payload uploaded by the terminal, wherein the authentication information payload includes at least the terminal identifier and the payload information; search for the authentication registration information corresponding to the terminal identifier, encrypt the authentication registration information, and obtain the authentication feedback information; and feed back the authentication feedback information to the terminal.

[0101] In an embodiment of the present invention, the process of generating terminal authentication information by the terminal can be participated by the server, which can further improve the security of terminal identity authentication. The terminal can upload the authentication information payload to the server, and the server can parse the authentication information payload to extract the terminal identifier included in the authentication information payload, and search for the authentication registration information of the terminal pre-registered with the server according to the terminal identifier. The server can process the authentication registration information of the terminal to generate authentication feedback information. The processing process may include hash processing or encryption processing, and the information generated by the processing can be used as authentication feedback information. The server can send the authentication feedback information to the terminal, and the terminal can receive the authentication feedback information.

[0102] In some embodiments of the invention, saving authentication registration information includes:

[0103] Extract the terminal identification, registration input information, function processing result and registration verification information of the authentication registration information; obtain the authentication key corresponding to the terminal identification, encrypt the authentication key using the function processing result as the encryption key, and save the generated ciphertext as the authentication registration information.

[0104] Specifically, the authentication registration information may be composed of a terminal identifier, registration input information, function processing results, and registration verification information. When receiving the authentication registration information, the server may extract the terminal identifier, registration input information, function processing results, and registration verification information, and determine the authentication key distributed to the terminal according to the terminal identifier. The authentication key may be encrypted according to the function processing result as an encryption key, and the generated ciphertext may be saved as the authentication registration information. By encrypting and saving the authentication registration information, the security of the authentication registration information storage may be improved, and the terminal sensitive information may be prevented from being leaked. Furthermore, the authentication key obtained by the server may be an authentication key distributed to the terminal, or a key associated with the authentication key distributed to the terminal. The authentication key may be derived from the same key as the authentication key distributed to the terminal.

[0105] Embodiment 6

[0106] In an exemplary implementation, the identity authentication and key negotiation process of the IPsec security system can be completed through PUF technology. The process can ensure the security of the identity authentication process through PUF technology, improve the usability of the identity authentication process, and reduce the cost of using the technical solution. Specifically, the identity authentication process provided by the embodiment of the present invention may include an initial registration phase and an authentication phase, wherein the initial registration phase may include the message exchange process shown in Table 1 below:

[0107] Table 1 Example of message interaction in the initial registration phase

[0108] Message Sequence Terminal i direction Server R 1 HDR,SA,CERT_sig_i > 2 < HDR,SA,CERT_sig_r 3 HDR,XCHi,SIGi >

[0109] The HDR identifies the IPsec header, which contains key information for implementing security services such as data encryption, authentication, and integrity protection. It ensures the confidentiality, authenticity, and integrity of data transmitted on the IP network.

[0110] SA identifies a logical connection established by two communicating parties for secure communication. It contains various security parameters used to protect IP data packets, such as encryption algorithms, authentication algorithms, keys, etc.

[0111] CERT_sig_i can identify the signature certificate of the terminal; CERT_sig_r can identify the signature certificate of the server.

[0112] XCHi and SIGi can identify the registration information and verification information fed back by the terminal.

[0113] Message 1: The terminal sends a security association payload encapsulating the terminal ID and the recommended payload, as well as the terminal signature certificate to the server.

[0114] Message 2: After the server verifies the terminal certificate, it generates the master key MK and MK_CRC corresponding to the terminal ID, and derives two check components MK_CRC1 and MK_CRC2 from MK_CRC. Then it generates the random number key component MK1, and the other half component MK2=MK⊕MK1, and sends MK1, MK_CRC1 and the server signature certificate to the terminal.

[0115] Message 3: After the terminal completes the verification of the digital certificate of the server, it stores MK1 and MK_CRC1. The terminal can select the first group of PUF functions, which can be used to input C1 to generate R1 and H1, where R1 is the calculation result of C1 and H1 is the verification information of R1; the terminal can randomly select three groups of Ci and generate their corresponding ri and hi through the PUF function respectively. The terminal sends ID, H1, Ci1, ri1, hi1; Ci2, ri2, hi2; Ci3, ri3, hi3 to the server as registration information and verification information.

[0116] After receiving message 3, the server will use ri1, ri2, ri3 as the keys of SM4 to encrypt MK2 respectively, generate MKi1', MKi2', MKi3', and add new record ID to the database, H1, MK_CRC2, Ci1, hi1, MK2i1', Ci2, hi2, MK2i2', Ci3, hi3, MK2i3'.

[0117] 2. Certification Stage

[0118] The authentication phase mainly completes the two-way authentication process between the terminal and the server. The message exchange process in this phase can be shown in Table 2:

[0119] Table 2 Example of message interaction in the authentication phase

[0120] Message Sequence Initiator direction Responder R 1 HDR,SA > 2 < HDR,XCHr,CERT_sig_r 3 HDR,XCHi,SIGi > 4 < HDR,XCHr,SIGr 5 HDR*,HASHi > 6 < HDR*,HASHr

[0121] Among them, HDR identifies the IPsec header.

[0122] XCHr can identify the authentication feedback information fed back by the responder.

[0123] XCH can identify the identity authentication information uploaded by the initiator, and SIG can identify the verification information of the identity authentication information.

[0124] HASH can identify hash processing.

[0125] Message 1: The terminal sends a security association payload encapsulated with the terminal ID and the recommended payload to the server.

[0126] Message 2: The server retrieves the ID and randomly draws a set of Ci and MK2i', generates a random number N, packages the random number N and the lottery results Ci and MK2i': ID|MK_CRC2|N|Ci|MK2i', encrypts it with the authentication key H1, and sends it to the terminal.

[0127] Message 3: The terminal uses the received Ci as the input value of the PUF transformation function, calculates ri=PUF(Ci), hi=Has / SM3(ri), A=Hash / SM3(ID,N,hi) in the PUFF chip, and sends A to the server.

[0128] Message 4: The server calculates A'=Hash / SM3(ID,N,hi) through the information saved in the initial installation phase, and checks whether A' is the same as A. If they are the same, the server completes the terminal authentication. Then execute B=Hash / SM3(A,N,hi) and send the result to the terminal.

[0129] Message 5: The terminal executes B'=Hash / SM3(A,N,hi) to check whether B' is the same as B. If it is correct, the terminal completes the authentication of the server. The terminal uses ri as the derived decryption key in the chip, decrypts MK2i', obtains MK2, MK=MK1⊕MK2, and verifies MK_CRC=MK_CRC1⊕MK_CRC2. If the verification is successful, the master key is generated.

[0130] Message 5 and Message 6: The terminal and the server authenticate the previous exchange process. The information transmitted in these two messages is encrypted using a symmetric encryption algorithm. The symmetric encryption algorithm is determined by the HDR of Message 1 and Message 2, and the key is MK. The symmetric encryption operation uses the CBC mode, and the initialization vector is the concatenation of N in Message 3 and B in Message 4, obtained by HASH / SM3 operation.

[0131] Embodiment 7

[0132] Figure 6 Schematic diagram of a security authentication device according to Embodiment 7 of the present invention. Figure 6 As shown, the device comprises:

[0133] The authentication information module 610 is used to generate terminal authentication information according to a pre-configured physical unclonable function.

[0134] The identity authentication module 620 is used to transmit the terminal authentication information to the server for identity authentication, wherein the server at least stores the authentication registration information of the terminal generated based on the physical unclonable function.

[0135] In some inventive embodiments, the authentication information module 610 in the device includes:

[0136] The information encapsulation unit is used to encapsulate the terminal identification and payload information of the terminal into an authentication information payload.

[0137] The authentication request unit is used to upload the authentication information payload to the server so that the server can search for matching authentication registration information according to the terminal identifier of the authentication information;.

[0138] The information feedback unit is used to receive authentication feedback information fed back by the server, wherein the authentication feedback information is generated based on the authentication registration information.

[0139] The information generation unit is used to generate terminal authentication information according to the authentication feedback information and the physical unclonable function.

[0140] Based on some embodiments of the invention, the information generation unit in the device is specifically used to: extract the authentication input parameters included in the authentication feedback information; call a physical unclonable function to process the authentication output parameters to obtain the function output result and data verification information; and encapsulate the terminal identification, function output result and data verification information into terminal authentication information.

[0141] In some embodiments of the invention, the identity authentication module 620 is specifically used to: send the terminal authentication information to the server, so that the server performs identity authentication through the authentication registration information and the terminal authentication information.

[0142] In some embodiments of the invention, the device also includes: an authentication registration module, which is used to generate authentication registration information based on a physical unclonable function and register the authentication registration information to a server.

[0143] Based on the above-mentioned embodiment of the invention, the authentication registration module includes:

[0144] The signature authentication unit is used to authenticate the signature certificate with the server, obtain the authentication key assigned by the server and save it.

[0145] The registration information unit is used to call a physical unclonable function to generate authentication registration information.

[0146] In some inventive embodiments, the signature authentication unit is specifically used to: obtain a pre-configured terminal identification and a terminal signature certificate, and encapsulate the terminal identification into an authentication request;

[0147] Transmit the terminal identification and terminal signature certificate to the server;

[0148] Receive the authentication key and server signature certificate fed back by the server, and verify the server signature certificate. The authentication key is generated by the server according to the terminal identifier after verifying the terminal signature certificate.

[0149] In some inventive embodiments, the registration information unit is specifically used to: randomly generate at least three sets of registration input information;

[0150] Call the physical unclonable function to generate the function processing results of each group of registration input information and registration verification information;

[0151] The terminal identification of the terminal, each group of registration input information, the function processing result of each group of registration input information, and the registration verification information of each group of registration input information are encapsulated as authentication registration information.

[0152] The security authentication device provided in the embodiment of the present invention can execute the security authentication method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0153] Embodiment 8

[0154] Figure 7 is a schematic diagram of the structure of another security authentication device provided according to Embodiment 8 of the present invention. Figure 7 As shown, the device comprises:

[0155] The authentication receiving module 710 is used to obtain the terminal authentication information uploaded by the terminal.

[0156] The identity authentication module 720 is used to determine the authentication registration information of the terminal and perform identity authentication on the terminal according to the authentication registration information and the terminal authentication information, wherein the authentication registration information is generated by the terminal based on a physical unclonable function.

[0157] In some embodiments of the invention, the identity authentication module 720 specifically includes:

[0158] The information parsing unit is used to extract the terminal identification, function output result and data verification information from the terminal authentication information.

[0159] The registration extraction unit is used to find the authentication registration information matching the terminal identification and extract the function processing result of the authentication registration information and the registration verification information.

[0160] The authentication execution unit is used to compare the function output result with the function processing result after verifying the registration verification information and the data verification information to obtain the authentication result of the identity authentication.

[0161] In some embodiments of the invention, the device also includes: a terminal request module, used to obtain the authentication information payload uploaded by the terminal, wherein the authentication information payload includes at least a terminal identifier and payload information; search for the authentication registration information corresponding to the terminal identifier, and encrypt the authentication registration information to obtain authentication feedback information; and feed back the authentication feedback information to the terminal.

[0162] In some embodiments of the invention, the device also includes: a certificate verification module, which is used to perform signature certificate authentication with the terminal and send an authentication key to the terminal so that the terminal generates authentication registration information based on a physical unclonable function, wherein the authentication key is generated by a terminal identifier of the terminal; obtain the authentication registration information uploaded by the terminal, and save the authentication registration information.

[0163] In some other embodiments of the invention, the authentication registration information is stored in the certificate verification module, including:

[0164] Extract the terminal identification, registration input information, function processing results and registration verification information of the authentication registration information;

[0165] Obtain the authentication key corresponding to the terminal identifier, use the function processing result as the encryption key to encrypt the authentication key, and save the generated ciphertext as the authentication registration information.

[0166] The security authentication device provided in the embodiment of the present invention can execute the security authentication method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0167] Embodiment 9

[0168] Figure 8It is a structural diagram of an electronic device that implements the security authentication method of an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0169] like Figure 8 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0170] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0171] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a security authentication method.

[0172] In some embodiments, the security authentication method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the security authentication method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the security authentication method in any other appropriate manner (e.g., by means of firmware).

[0173] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0174] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0175] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0176] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0177] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0178] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0179] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0180] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A security authentication method, characterized in that: Applied to a terminal, the method comprises: Generate terminal authentication information according to a pre-configured physical unclonable function; The terminal authentication information is transmitted to a server for identity authentication, wherein the server at least stores the authentication registration information of the terminal generated based on the physical unclonable function.

2. The method according to claim 1, characterized in that: The generating terminal authentication information according to the pre-configured physical unclonable function includes: Encapsulating the terminal identification and payload information of the terminal into an authentication information payload; Uploading the authentication information payload to the server, so that the server searches for matching authentication registration information according to the terminal identifier of the authentication information; Receiving authentication feedback information fed back by the server, wherein the authentication feedback information is generated based on the authentication registration information; The terminal authentication information is generated according to the authentication feedback information and the physical unclonable function.

3. The method according to claim 2, characterized in that: The generating the terminal authentication information according to the authentication feedback information and the physical unclonable function includes: Extracting the authentication input parameters included in the authentication feedback information; Calling the physical unclonable function to process the authentication output parameter to obtain a function output result and data verification information; The terminal identification, the function output result and the data verification information are encapsulated as the terminal authentication information.

4. The method according to claim 1, characterized in that: The transmitting the terminal authentication information to the server for identity authentication includes: The terminal authentication information is sent to the server, so that the server performs identity authentication through the authentication registration information and the terminal authentication information.

5. The method according to claim 1, characterized in that: Also includes: Authentication registration information is generated based on the physical unclonable function, and the authentication registration information is registered to the server.

6. The method according to claim 5, characterized in that: The authentication registration information generated based on the physical unclonable function includes: Perform signature certificate authentication with the server, obtain the authentication key assigned by the server and save it; The physical unclonable function is called to generate the authentication registration information.

7. The method according to claim 6, characterized in that: The performing signature certificate authentication with the server, obtaining and saving the authentication key assigned by the server, includes: Obtain a pre-configured terminal identification and a terminal signature certificate, and encapsulate the terminal identification into an authentication request; Transmitting the terminal identification and the terminal signature certificate to the server; Receive the authentication key and server signing certificate fed back by the server, and verify the server signing certificate, wherein the authentication key is generated by the server according to the terminal identifier after verifying the terminal signing certificate.

8. The method according to claim 6, characterized in that: The calling of the physical unclonable function to generate the authentication registration information includes: Randomly generate at least three sets of registration input information; Calling the physical unclonable function to generate function processing results of each group of the registration input information and registration verification information; The terminal identification of the terminal, each group of the registration input information, the function processing result of each group of the registration input information, and the registration verification information of each group of the registration input information are encapsulated as the authentication registration information.

9. A security authentication method, characterized in that: Applied to the server, the method includes: Get the terminal authentication information uploaded by the terminal; Determine the authentication registration information of the terminal, and perform identity authentication on the terminal according to the authentication registration information and the terminal authentication information, wherein the authentication registration information is generated by the terminal based on a physical unclonable function.

10. The method according to claim 9, characterized in that: The determining the authentication registration information of the terminal, and performing identity authentication on the terminal according to the authentication registration information and the terminal authentication information, includes: Extracting the terminal identification, the function output result and the data verification information from the terminal authentication information; Searching for the authentication registration information that matches the terminal identifier, and extracting the function processing result of the authentication registration information and the registration verification information; After verifying the registration verification information and the data verification information, the function output result is compared with the function processing result to obtain the authentication result of the identity authentication.

11. The method according to claim 9, characterized in that: Before obtaining the terminal authentication information uploaded by the terminal, the method further includes: Acquire the authentication information payload uploaded by the terminal, wherein the authentication information payload includes at least a terminal identifier and payload information; Searching for the authentication registration information corresponding to the terminal identifier, encrypting the authentication registration information, and obtaining authentication feedback information; Feedback the authentication feedback information to the terminal.

12. The method according to claim 9, characterized in that: Also includes: Performing signature certificate authentication with the terminal and sending an authentication key to the terminal, so that the terminal generates authentication registration information according to the physical unclonable function, wherein the authentication key is generated by a terminal identifier of the terminal; Acquire the authentication registration information uploaded by the terminal, and save the authentication registration information.

13. The method according to claim 12, characterized in that: The storing of the authentication registration information comprises: Extract the terminal identification, registration input information, function processing result and registration verification information of the authentication registration information; An authentication key corresponding to the terminal identifier is obtained, the authentication key is encrypting by using the function processing result as an encryption key, and the generated ciphertext is saved as the authentication registration information.

14. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the security authentication method according to any one of claims 1 to 13.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the security authentication method according to any one of claims 1 to 13 when executed.

Images