A secure two-way authentication method and system

Abstract

The present application proposes a secure two-way authentication method and system, which is applied to the field of communication technology. In this method, the web front end sends a request to control the Android terminal to the SRS server through the MOTT protocol. When the request is received for the first time, the Android terminal generates a key pair and encrypts the public key and sends it to the SRS server. After receiving the request again and the user agrees, the SP security chip of the Android terminal generates a 32-bit random number as a control token and sends it to the SRS server. The server saves this random number and waits for the operation code. The web front end uses WebRTC to obtain the screen recording information of the Android terminal, and generates an operation code based on the operation and sends it to the SRS server. After the server receives the operation code, it combines the previously saved random number, encrypts it with the RSA public key, and then sends it to the Android terminal together with the operation code. The Android terminal uses the private key to decrypt the data, and executes the operation code after verifying that the random number matches. The entire process ensures the secure handover of control and the security of the operation, and effectively improves the security protection capability during the communication process.

Description

Technical Field

[0001] The present application relates to communication technology, and in particular to a secure two-way authentication method and system. Background Art

[0002] The remote control solution refers to the Android device obtaining screen information and transmitting the screen information to the SRS server in real time through the WebRtc video data stream. The Web front end uses the data stream to display the Android terminal screen in real time. The Web front end generates the corresponding command operation code and transmits it to the Android device terminal through the MQTT protocol. The Android terminal parses the plain text command operation code and performs movement and click operations according to the command operation code. Since the Android terminal subscribes to related topics through the MQTT protocol, once the topic is known to others, others can send related command operation codes through the topic, which may be unsafe.

[0003] Therefore, the operation code of the prior art remote control Android device is easily obtained by a third party and tampered with, which will fail to meet the security device requirements. Summary of the invention

[0004] The present application provides a secure two-way authentication method and system to solve the problem of control instructions being intercepted and tampered with by a third party.

[0005] On the one hand, the present application provides a secure two-way authentication method, comprising:

[0006] The Web front-end sends a control request to the SRS server through the MQTT protocol, requesting to establish control over the Android terminal;

[0007] When the Android terminal receives a control request for the first time, its SP security chip automatically generates an RSA3 public-private key pair, encrypts the RSA3 public key with the RSA2 private key, and sends it to the SRS server; the Android terminal has a built-in SP security chip, RSA2 public key, and RSA2 private key;

[0008] The SRS server decrypts the RSA3 public key data encrypted by the Android terminal using the RSA2 private key using the RSA2 public key, obtains the RSA3 public key, and waits for the user to confirm the connection request; the SRS server has built-in RSA1 private key and RSA1 public key;

[0009] After the user confirms the request, the SP security chip of the Android terminal generates a 32-bit random number, encrypts the random number using the RSA1 public key of the SRS server, and sends it to the SRS server;

[0010] The SRS server decrypts and saves the 32-bit random number as a verification token using the RSA1 private key;

[0011] The Android terminal obtains the screen recording permission and transmits the screen recording interface to the Web front-end of the SRS server in real time through WebRTC technology;

[0012] The Web front end generates an operation instruction code and sends it to the SRS server, which fills in the 32-bit random number, encrypts the operation instruction code and the random number using the RSA3 public key, and sends the encrypted data packet to the Android terminal;

[0013] The Android terminal uses the RSA3 private key in the SP security chip to decrypt the received data packet and verify whether the 32-bit random number is correct. If the verification is successful, the Android terminal will execute the operation in the operation instruction code.

[0014] On the other hand, the present application provides a secure two-way authentication system, comprising:

[0015] Web front end, SRS server and Android terminal, the Android terminal has built-in SP security chip, RSA2 public key and RSA2 private key; the SRS server has built-in RSA1 private key and RSA1 public key;

[0016] The Web front-end sends a control request to the SRS server through the MQTT protocol, requesting to establish control over the Android terminal;

[0017] When the Android terminal receives a control request for the first time, its SP security chip automatically generates an RSA3 public-private key pair, encrypts the RSA3 public key with the RSA2 private key, and sends it to the SRS server;

[0018] The SRS server uses the RSA2 public key to decrypt the RSA3 public key data encrypted by the Android terminal using the RSA2 private key, obtains the RSA3 public key, and waits for the user to confirm the connection request;

[0019] After the user confirms the request, the SP security chip of the Android terminal generates a 32-bit random number, encrypts the random number using the RSA1 public key of the SRS server, and sends it to the SRS server;

[0020] The SRS server decrypts and saves the 32-bit random number as a verification token using the RSA1 private key;

[0021] The Android terminal obtains the screen recording permission and transmits the screen recording interface to the Web front-end of the SRS server in real time through WebRTC technology;

[0022] The Web front end generates an operation instruction code and sends it to the SRS server, which fills in the 32-bit random number, encrypts the operation instruction code and the random number using the RSA3 public key, and sends the encrypted data packet to the Android terminal;

[0023] The Android terminal uses the RSA3 private key in the SP security chip to decrypt the received data packet and verify whether the 32-bit random number is correct. If the verification is successful, the Android terminal will execute the operation in the operation instruction code.

[0024] The secure two-way authentication method and system provided in the present application achieves the guarantee of the integrity and security of data transmission by using two built-in sets of RSA public and private keys and a set of RSA public and private keys generated by the SP security chip for encryption and decryption.

[0025] During the first connection, this method uses two sets of built-in RSA public and private keys to encrypt and transmit the RSA public key generated by the SP security chip. Subsequently, the Web front end initiates a control request. After receiving the MQTT control request, the Android terminal agrees to the request, and the SP security chip generates a 32-bit random number, which is sent to the backend as part of the request result. The backend saves this 32-bit random number as the TOKEN for this control.

[0026] At the same time, the Web front end obtains the screen recording information of the Android terminal through WebRTC technology and displays it on the page. The user operates on the page, generates the corresponding operation code, and then sends the operation code to the background. After receiving the operation code, the background fills in the previously saved 32-bit random number, and uses the RSA public key of the SP security chip to encrypt the operation code and random number, and then sends the encrypted data to the Android terminal.

[0027] After receiving the encrypted data, the Android terminal uses the private key in the SP security chip to decrypt it and verify whether the 32-bit random number in the decrypted data matches the one sent previously. Only when the random number matches will the Android terminal execute the corresponding opcode.

[0028] In this way, the method provided by the present invention ensures the security of data transmission during the process of remote desktop controlling the Android device, and effectively prevents the risk of data being stolen or tampered with. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0030] Figure 1 A flowchart of a WEB terminal remotely controlling a terminal through an MQTT server provided in an embodiment of the present invention;

[0031] Figure 2 This is one of the screen recording interface diagrams of the Web terminal provided in an embodiment of the present invention;

[0032] Figure 3 This is one of the interface diagrams of the Android terminal provided by the embodiment of the present invention;

[0033] Figure 4 This is the second screen recording interface diagram of the Web terminal provided by the embodiment of the present invention;

[0034] Figure 5 This is the second interface diagram of the Android terminal provided by the embodiment of the present invention;

[0035] Figure 6 This is the third screen recording interface diagram of the Web terminal provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0036] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0037] First, the terms involved in the present invention are clearly defined and explained:

[0038] MQTT control request: Definition: Sent by the Web front end to establish control over the Android terminal, communicating through the MQTT protocol.

[0039] Android terminal: Definition: A device running the Android operating system that has the ability to receive and execute control instructions from the SRS server.

[0040] SP security chip: Definition: A security chip embedded in an Android terminal, used for security operations such as generating random numbers and storing keys.

[0041] 32-bit random number: Definition: A random number string generated by the SP security chip to ensure communication security, with a length of 32 bits.

[0042] SRS server: Definition: A server that provides services, responsible for receiving control requests sent by the Web front end, forwarding instructions to the Android terminal, and saving and verifying random numbers.

[0043] WebRTC: Definition: A technology that supports real-time audio and video communication in web browsers. The web front end uses it to obtain and display the screen recording information of the Android terminal.

[0044] Operation code: Definition: It is generated by the Web front end based on page operations, representing the instruction code of specific control actions, which is sent to the SRS server and executed by the Android terminal.

[0045] Token: Definition: In the scenario of the present invention, it refers to a 32-bit random number saved by the SRS server, which serves as the verification identifier of this MQTT control request.

[0046] RSA public key: Definition: The public key part of an asymmetric encryption algorithm, used to encrypt data and ensure the security of data transmission. In this scenario, the public key is provided by the SP security chip.

[0047] Command protocol: Definition: The communication protocol defined between the Android terminal and the SRS server, which is used to specify the format and parsing method of the command.

[0048] Figure 1 Flow chart of a secure two-party authentication method provided by an embodiment of the present invention; Figure 1 As shown, an embodiment of the present invention provides a secure two-way authentication method, including:

[0049] The Web front-end sends a control request to the SRS server through the MQTT protocol, requesting to establish control over the Android terminal;

[0050] When the Android terminal receives a control request for the first time, it generates a key pair consisting of a public key and a private key, and securely sends the public key to the SRS backend server after encryption;

[0051] After receiving the control request for the second time, the Android terminal agrees to the request in some way (such as user confirmation).

[0052] The SP security chip of the Android terminal generates a pair of public and private keys, generates a 32-bit random number for each control, and sends the result of approving the control request (with the random number) to the SRS server.

[0053] The SRS server saves the 32-bit random number as a token for this control and waits for further operation codes.

[0054] The Web front end obtains and displays the screen recording information of the Android terminal through WebRTC technology, generates an operation code according to the page operation, and sends the operation code to the SRS server.

[0055] The SRS server fills the previously saved 32-bit random number after the received operation code, encrypts the random number using the RSA public key provided by the SP security chip, and then sends the encrypted data and the operation code together to the Android terminal.

[0056] The Android terminal uses the private key in the SP security chip to decrypt the received data, verify whether the 32-bit random number matches, and execute the operation code if it matches.

[0057] Specifically, the present invention realizes secure remote desktop control between the SRS server (merchant management system) and the Android terminal. Each of them has a set of RSA public and private keys built in (the SRS server is the RSA1 public and private key pair, and the Android terminal is the RSA2 public and private key pair), and introduces a set of RSA3 public and private key pairs automatically generated by the Android terminal SP security chip.

[0058] The user initiates a control request for a specific Android terminal by pressing the Start button of the Remote Desktop function on the SRS server. When connected for the first time, after the Android terminal receives the MQTT message push, it will automatically generate an RSA3 public-private key pair through the SP security chip, encrypt the RSA3 public key with the RSA2 private key, and then send the encrypted RSA3 public key to the SRS server through the interface. The SRS server decrypts the received data using the RSA2 public key to obtain the RSA3 public key. After the user confirms the connection request on the SRS server (such as clicking yes in the pop-up box), the Android terminal will again use the SP security chip to generate a 32-bit random number, encrypt the random number with the RSA1 public key, and then send the encrypted random number to the SRS server. The SRS server decrypts and saves the random number using the RSA1 private key as a verification token for this control session.

[0059] After the connection is successful, the Android terminal will request the relevant permissions for screen recording. After the user clicks the "START NOW" button, the terminal's screen recording interface will be transmitted to the corresponding front-end interface of the SRS server in real time through WebRTC technology for the user to view and operate.

[0060] On the front-end interface, the user's operation will generate corresponding operation instruction codes, which are passed to the SRS server. After receiving the operation instruction code, the SRS server will fill in the previously saved 32-bit random number, encrypt the instruction code and random number using the RSA3 public key, and then send the encrypted data packet to the Android terminal. The Android terminal uses the RSA3 private key in the SP security chip to decrypt the received data packet and verify whether the 32-bit random number is correct. If the verification passes, the terminal will execute the operation in the instruction code.

[0061] In this way, the present invention ensures the security and integrity of data transmission during the remote desktop control process.

[0062] On the other hand, the present application also provides a secure two-way authentication system, comprising:

[0063] Web front end, SRS server and Android terminal, wherein the Android terminal has a built-in SP security chip;

[0064] The Web front end is used to send control requests to the SRS server through the MQTT protocol to request to establish control over the Android terminal;

[0065] The Android terminal is used to generate a key pair including a public key and a private key when receiving a control request for the first time, and to encrypt the public key and securely send it to the SRS backend server;

[0066] The Android terminal is also used for the user to confirm the request after receiving the control request for the second time;

[0067] The SP security chip of the Android terminal generates a pair of public and private keys and generates a 32-bit random number for each control. When approving the control request, it sends this random number as part of the result to the SRS server;

[0068] The SRS server is used to save the 32-bit random number as a token for this control and wait for further operation codes;

[0069] The Web front end is used to obtain and display the screen recording information of the Android terminal through WebRTC technology, generate operation codes according to page operations, and send the operation codes to the SRS server;

[0070] The SRS server is used to fill the previously saved 32-bit random number after the received operation code, encrypt the random number using the RSA public key provided by the SP security chip, and then send the encrypted data and the operation code together to the Android terminal;

[0071] The Android terminal is used to decrypt the received data using the private key in the SP security chip, verify whether the 32-bit random number matches, and execute the operation code if it matches.

[0072] The secure two-way authentication method and system provided in the present application achieves the guarantee of the integrity and security of data transmission by using two built-in sets of RSA public and private keys and a set of RSA public and private keys generated by the SP security chip for encryption and decryption.

[0073] During the first connection, this method uses two sets of built-in RSA public and private keys to encrypt and transmit the RSA public key generated by the SP security chip. Subsequently, the Web front end initiates a control request. After receiving the MQTT control request, the Android terminal agrees to the request, and the SP security chip generates a 32-bit random number, which is sent to the backend as part of the request result. The backend saves this 32-bit random number as the TOKEN for this control.

[0074] At the same time, the Web front end obtains the screen recording information of the Android terminal through WebRTC technology and displays it on the page. The user operates on the page, generates the corresponding operation code, and then sends the operation code to the background. After receiving the operation code, the background fills in the previously saved 32-bit random number, and uses the RSA public key of the SP security chip to encrypt the operation code and random number, and then sends the encrypted data to the Android terminal.

[0075] After receiving the encrypted data, the Android terminal uses the private key in the SP security chip to decrypt it and verify whether the 32-bit random number in the decrypted data matches the one sent previously. Only when the random number matches will the Android terminal execute the corresponding opcode.

[0076] In this way, the method provided by the present invention ensures the security of data transmission during the process of remote desktop controlling the Android device, and effectively prevents the risk of data being stolen or tampered with.

[0077] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A secure two-way authentication method, characterized in that: include: The Web front-end sends a control request to the SRS server through the MQTT protocol, requesting to establish control over the Android terminal; When the Android terminal receives a control request for the first time, its SP security chip automatically generates an RSA3 public-private key pair, encrypts the RSA3 public key with the RSA2 private key, and sends it to the SRS server; the Android terminal has a built-in SP security chip, RSA2 public key, and RSA2 private key; The SRS server decrypts the RSA3 public key data encrypted by the Android terminal using the RSA2 private key using the RSA2 public key, obtains the RSA3 public key, and waits for the user to confirm the connection request; the SRS server has built-in RSA1 private key and RSA1 public key; After the user confirms the request, the SP security chip of the Android terminal generates a 32-bit random number, encrypts the 32-bit random number using the RSA1 public key of the SRS server, and sends it to the SRS server; The SRS server decrypts and saves the 32-bit random number as a verification token using the RSA1 private key; The Android terminal obtains the screen recording permission and transmits the screen recording interface to the Web front-end of the SRS server in real time through WebRTC technology; The Web front end generates an operation instruction code and sends it to the SRS server, the SRS server fills in the 32-bit random number, encrypts the operation instruction code and the 32-bit random number using the RSA3 public key, and sends the encrypted data packet to the Android terminal; The Android terminal uses the RSA3 private key in the SP security chip to decrypt the received data packet and verify whether the 32-bit random number therein is correct. If the verification passes, the Android terminal will execute the operation in the operation instruction code.

2. A system for controlling an Android device through a remote desktop based on security control, characterized in that: include: Web front end, SRS server and Android terminal, wherein the Android terminal has built-in SP security chip, RSA2 public key and RSA2 private key; The SRS server has built-in RSA1 private key and RSA1 public key; The Web front-end sends a control request to the SRS server through the MQTT protocol, requesting to establish control over the Android terminal; When the Android terminal receives a control request for the first time, its SP security chip automatically generates an RSA3 public-private key pair, encrypts the RSA3 public key with the RSA2 private key, and sends it to the SRS server; The SRS server uses the RSA2 public key to decrypt the RSA3 public key data encrypted by the Android terminal using the RSA2 private key, obtains the RSA3 public key, and waits for the user to confirm the connection request; After the user confirms the request, the SP security chip of the Android terminal generates a 32-bit random number, encrypts the 32-bit random number using the RSA1 public key of the SRS server, and sends it to the SRS server; The SRS server decrypts and saves the 32-bit random number as a verification token using the RSA1 private key; The Android terminal obtains the screen recording permission and transmits the screen recording interface to the Web front-end of the SRS server in real time through WebRTC technology; The Web front end generates an operation instruction code and sends it to the SRS server, the SRS server fills in the 32-bit random number, encrypts the operation instruction code and the 32-bit random number using the RSA3 public key, and sends the encrypted data packet to the Android terminal; The Android terminal uses the RSA3 private key in the SP security chip to decrypt the received data packet and verify whether the 32-bit random number therein is correct. If the verification passes, the Android terminal will execute the operation in the operation instruction code.

Images