Secret key authentication method and device and electronic equipment

Abstract

The invention provides a key authentication method and device and electronic equipment, and relates to the technical field of network security. In the application, firstly, user information is determined in a key authentication request sent by a user side, whether the user information is bound with a pre-shared key is judged, then when it is determined that the user information is not bound with the pre-shared key, whether an initial key sent by the user side is matched with a first key is judged, and if yes, the pre-shared key is sent to the user side. If yes, registering the first pre-shared key for the user side, and binding the first pre-shared key with the user information, so that the pre-shared key can be registered and authenticated based on the same signal, and the efficiency of user identity authentication is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a key authentication method, device and electronic device. Background Art

[0002] Before a terminal device accesses the Internet, it is usually necessary to authenticate the user's identity to restrict unauthorized users from accessing the network and ensure the security of network operation.

[0003] There are two existing user identity authentication methods: 802.1x protocol authentication and Web authentication. However, some terminal devices with wireless network cards, such as cameras, game consoles, smart TVs, medical tablets, and printers, may not support either 802.1x protocol authentication or Web authentication. Therefore, in order to securely access the above terminal devices to the enterprise intranet according to unified authentication rules, the pre-shared key (English full name: Pre Shared Key, abbreviated: PSK) authentication method can be used.

[0004] PSK authentication is a security authentication method based on wireless networks. When using PSK for user authentication, the device administrator needs to create a unique PSK for each user terminal and assign the PSK to the user. When the user connects to the wireless network, the user identity is authenticated based on the PSK input by the user received by the user terminal.

[0005] However, before using the PSK authentication method for user authentication, the device administrator needs to collect the media access control address (English full name: Medium Access Control, abbreviated as: MAC address) information of each terminal device, register the PSK information of the terminal device running the user terminal, and then bind the MAC address information with the PSK information, and send the binding result to the terminal device.

[0006] If the above-mentioned PSK authentication method is used to authenticate the identities of multiple users, the user needs to enter a unique PSK on the terminal device that has been bound to the PSK information. This limits the use of the PSK, increases the difficulty for the device administrator to maintain the PSK configuration information of multiple sets of terminal devices, and reduces the efficiency of authenticating the user's identity. Summary of the invention

[0007] The present invention provides a key authentication method, device and electronic device to improve the efficiency of user identity authentication. The specific technical solution is as follows:

[0008] In a first aspect, the present application provides a key authentication method, comprising:

[0009] Determine user information in the key authentication request sent by the user terminal, and determine whether the user information has been bound to a pre-shared key;

[0010] When it is determined that the user information is not bound to a pre-shared key, determining whether the initial key sent by the user terminal matches a first key, wherein the first key is used to determine whether the user terminal has a registration requirement for a pre-shared key;

[0011] If so, register a first pre-shared key for the client, and bind the first pre-shared key to the user information.

[0012] Based on the above method, it is possible to avoid the service authentication end switching back and forth between the registration signal and the authentication signal when a new user pre-acquires Internet access permission, thereby realizing the function of pre-shared key registration and authentication based on the same signal; by setting a first pre-shared key registration approval mechanism, it is possible to prevent user terminals that do not meet the pre-shared key registration requirements from registering pre-shared keys, thereby improving the security of registering pre-shared keys for user terminals; by polling and comparing the initial key with each second key, it is possible to realize dynamic binding of the pre-shared key with the current user information, that is, the function of one code for multiple machines, and improve the efficiency of authenticating user identities.

[0013] In a possible implementation, if the initial key fails to match the first key, matching the initial key with the second key includes:

[0014] Determine whether the initial key matches the second key, wherein the second key is any pre-shared key required for the user terminal network authentication;

[0015] If yes, binding the second key to the user information and sending an authentication message associated with the second key to the user terminal;

[0016] If not, a first feedback message indicating that the initial key authentication failed is sent to the user terminal.

[0017] Based on the above method, it is possible to determine whether the initial key input by the current user terminal is taken from other user terminals that have registered pre-shared keys. The pre-shared key registration step required before pre-shared key authentication of the user terminal can be omitted, thereby improving the efficiency of identity authentication of the user terminal.

[0018] In a possible implementation, determining whether the initial key matches the second key includes:

[0019] Parsing the encryption parameter value in the key authentication request;

[0020] Encrypting the initial key according to the encryption parameter value to obtain a third encryption key;

[0021] Selecting any one of the pre-shared key candidates from the set pre-shared key set, and using the pre-shared key candidate as the second key;

[0022] encrypting the second key according to the encryption parameter value to obtain a fourth encryption key;

[0023] determining whether the third encryption key matches the fourth encryption key;

[0024] If yes, binding the second key to the user information, and sending the authentication message associated with the second key to the user terminal;

[0025] If not, select the next candidate pre-shared key in the pre-shared key set.

[0026] Based on the above method, the initial key is polled and compared with each candidate pre-shared key in the pre-shared key set to determine whether there is a second key that matches the initial key. The second key is bound to the current user information, which can realize the function of one code for multiple machines and improve the efficiency of user authentication.

[0027] In a possible implementation, if the initial key fails to match the first key, a second feedback message indicating that the initial key authentication fails is sent to the user terminal.

[0028] Based on the above method, the user end can resend the initial key to the service authentication end according to the received second feedback message, and apply for registration of the pre-shared key.

[0029] In a possible implementation, registering a first pre-shared key for the user terminal and binding the first pre-shared key with the user information includes:

[0030] Determining the registration information sent by the user terminal;

[0031] Determining whether to approve the registration information;

[0032] If so, determining whether the registration information satisfies a preset registration rule, and when it is determined that the registration information satisfies the registration rule, registering the first pre-shared key for the user terminal, sending the first pre-shared key to the user terminal, and binding the first pre-shared key to the user information;

[0033] If not, the first pre-shared key is automatically registered for the user terminal, the first pre-shared key is sent to the user terminal, and the first pre-shared key is bound to the user information.

[0034] Based on the above method, it is possible to prevent a user terminal that does not meet the pre-shared key registration requirements from registering a pre-shared key, thereby improving the security of registering a pre-shared key for a user terminal.

[0035] In a possible implementation, if the user information is bound to a pre-shared key, determining whether the initial key matches a second pre-shared key bound to the user information includes:

[0036] Parsing the encryption parameter value in the key authentication request and using the initial key as the target pre-shared key;

[0037] Encrypting the target pre-shared key according to the encryption parameter value to obtain a first encryption key;

[0038] Determining the second pre-shared key from the set pre-shared key set;

[0039] Encrypting the second pre-shared key according to the encryption parameter value to obtain a second encryption key;

[0040] determining whether the first encryption key matches the second encryption key;

[0041] If yes, sending an authentication message associated with the second pre-shared key to the user terminal;

[0042] If not, a feedback message indicating that the target pre-shared key authentication is wrong is sent to the user terminal.

[0043] Based on the above method, the pre-shared key can be directly authenticated for the user terminal that has been bound to the pre-shared key, thereby improving the efficiency of user identity authentication.

[0044] In a second aspect, the present application provides a key authentication device, including:

[0045] A key query module, used to determine user information in a key authentication request sent by a user terminal, and determine whether the user information has been bound to a pre-shared key;

[0046] A key authentication module, used for determining whether the initial key sent by the user terminal matches the first key when it is determined that the user information is not bound to the pre-shared key, wherein the first key is used to determine whether the user terminal has a registration requirement for the pre-shared key;

[0047] If so, register a first pre-shared key for the client, and bind the first pre-shared key to the user information.

[0048] In a possible implementation, the key authentication module is specifically used to:

[0049] Determine whether the initial key matches the second key, wherein the second key is any pre-shared key required for the user terminal network authentication;

[0050] If yes, binding the second key to the user information and sending an authentication message associated with the second key to the user terminal;

[0051] If not, a first feedback message indicating that the initial key authentication failed is sent to the user terminal.

[0052] In a possible implementation, the key authentication module is specifically used to:

[0053] Parsing the encryption parameter value in the key authentication request;

[0054] Encrypting the initial key according to the encryption parameter value to obtain a third encryption key;

[0055] Selecting any one of the pre-shared key candidates from the set pre-shared key set, and using the pre-shared key candidate as the second key;

[0056] encrypting the second key according to the encryption parameter value to obtain a fourth encryption key;

[0057] determining whether the third encryption key matches the fourth encryption key;

[0058] If yes, binding the second key to the user information, and sending the authentication message associated with the second key to the user terminal;

[0059] If not, then select the next candidate pre-shared key in the pre-shared key set.

[0060] In a possible implementation, if the initial key fails to match the first key, a second feedback message indicating that the initial key authentication fails is sent to the user terminal.

[0061] In a possible implementation, the key authentication module is specifically used to:

[0062] Determining the registration information sent by the user terminal;

[0063] Determining whether to approve the registration information;

[0064] If so, determining whether the registration information satisfies a preset registration rule, and when it is determined that the registration information satisfies the registration rule, registering the first pre-shared key for the user terminal, sending the first pre-shared key to the user terminal, and binding the first pre-shared key to the user information;

[0065] If not, the first pre-shared key is automatically registered for the user terminal, the first pre-shared key is sent to the user terminal, and the first pre-shared key is bound to the user information.

[0066] In a possible implementation, the key query module is further used to:

[0067] Parsing the encryption parameter value in the key authentication request and using the initial key as the target pre-shared key;

[0068] Encrypting the target pre-shared key according to the encryption parameter value to obtain a first encryption key;

[0069] Determining the second pre-shared key from the set pre-shared key set;

[0070] Encrypting the second pre-shared key according to the encryption parameter value to obtain a second encryption key;

[0071] determining whether the first encryption key matches the second encryption key;

[0072] If yes, sending an authentication message associated with the second pre-shared key to the user terminal;

[0073] If not, a feedback message indicating that the target pre-shared key authentication is wrong is sent to the user terminal.

[0074] In a third aspect, the present application provides an electronic device, including:

[0075] Memory, used to store computer programs;

[0076] The processor is used to implement the steps of the above-mentioned key authentication method when executing the computer program stored in the memory.

[0077] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned key authentication method are implemented.

[0078] For each aspect from the second to the fourth aspect and the technical effects that may be achieved by each aspect, please refer to the above description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 A flowchart of a key authentication method provided for this application;

[0080] Figure 2 Schematic diagram of the key authentication system architecture provided for this application;

[0081] Figure 3 A flowchart of an initial key authentication provided for this application;

[0082] Figure 4 A flowchart of a first pre-shared key registration approval provided for this application;

[0083] Figure 5 A schematic diagram of the structure of a key authentication device provided in this application;

[0084] Figure 6 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0085] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A is connected to B, which can represent: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0086] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0087] Before a terminal device accesses the Internet, it is usually necessary to authenticate the user's identity to restrict unauthorized users from accessing the network and ensure the security of network operation.

[0088] There are two existing user identity authentication methods: 802.1x protocol authentication and Web authentication. However, some terminal devices with wireless network cards, such as cameras, game consoles, smart TVs, medical tablets, and printers, may not support either 802.1x protocol authentication or Web authentication. Therefore, in order to securely connect the above terminal devices to the enterprise intranet according to unified authentication rules, the pre-shared key authentication method can be used.

[0089] PSK authentication is a security authentication method based on wireless networks. When using PSK for user authentication, the device administrator needs to create a unique PSK for each user terminal and assign the PSK to the user. When the user connects to the wireless network, the user identity is authenticated based on the PSK input by the user received by the user terminal.

[0090] However, before using the PSK authentication method for user authentication, the device administrator needs to collect the media access control address (MAC address) information of each terminal device, register the PSK information of the terminal device running the user terminal, and then bind the MAC address information with the PSK information, and send the binding result to the terminal device.

[0091] If the above-mentioned PSK authentication method is used to authenticate the identities of multiple users, the user needs to enter a unique PSK on the terminal device that has been bound to the PSK information. This limits the use of the PSK, increases the difficulty for the device administrator to maintain the PSK configuration information of multiple sets of terminal devices, and reduces the efficiency of authenticating the user's identity.

[0092] In view of this, in order to improve the efficiency of authenticating user identities, the present application provides a key authentication method, which specifically includes: first determining the user information in the key authentication request sent by the user terminal, determining whether the user information has been bound to a pre-shared key, and then, when it is determined that the user information is not bound to the pre-shared key, determining whether the initial key sent by the user terminal matches the first key; if so, registering the first pre-shared key for the user terminal, and binding the first pre-shared key to the user information.

[0093] Through the method provided by the present application, the service authentication end can determine whether the current user end has been bound to a pre-shared key based on the user information of the user end, and then determine the first pre-shared key corresponding to the registered user information of the user end or directly authenticate the pre-shared key; the present application registers and authenticates the pre-shared key based on the same signal, which can avoid switching back and forth between the registration signal and the authentication signal, and improve the efficiency of authenticating the user identity.

[0094] Reference Figure 1 As shown, it is a flowchart of a key authentication method provided in an embodiment of the present application, the method comprising:

[0095] S1, determining user information in a key authentication request sent by a user terminal, and determining whether the user information has been bound to a pre-shared key.

[0096] First of all, the method provided in this application can be applied to Figure 2In the system architecture shown, the system architecture includes: a service authentication end, a terminal device, a user end, and an access device, and the method provided in the present application can be executed in the service authentication end.

[0097] The following is a brief introduction to the above devices and their respective functions:

[0098] The service authentication end may be an authentication server that performs network authentication on a user terminal or terminal device, and is used to connect to each user terminal and respond to authentication service requests sent by the user terminal. The service authentication end may be a network access server, an access point (AP), or an Ethernet switch, and this application does not impose specific restrictions on this.

[0099] The terminal device can be any type of terminal with a wireless network card, such as a camera, a game console, a smart TV, a medical monitor, a medical tablet, a printer, or any other type of IoT device. This application does not impose any specific restrictions on the type and quantity of the terminal device.

[0100] The user end (client) can run in the terminal device and can provide local services for users. After receiving the initial key entered by the user, it sends an authentication service request to the service authentication end to request network services.

[0101] Access devices are used to remotely access network resources, including routers, multiplexers, and modems, etc., and are used to forward authentication service requests sent by the user end to the service authentication end.

[0102] In the embodiments of the present application, as shown in the attached Figure 3 As shown, first, the user determines the wireless network to be connected based on the SSID signal (the name of the wireless signal sent by the router). Here, it should be pointed out that the subsequent registration and authentication process of the pre-shared key in this application is based on the SSID signal. After the user determines the wireless network, he can connect to the wireless network, for example, a network access point or a WiFi hotspot, and enter the initial key in the authentication login interface of the user terminal. The initial key includes all pre-shared keys registered by the user terminal, the application key (first key) or non-application key for the user terminal to register the pre-shared key. After the user enters the initial key, the user terminal can automatically send a key authentication request to the service authentication terminal; in order to authenticate the user terminal, the service authentication terminal first needs to establish a communication connection between the user terminal and the access device before receiving the key authentication request sent by the user terminal, and forward the key authentication request to the service authentication terminal through the access device. This application adopts a four-way handshake method to establish a communication connection between the user terminal and the access device. The specific four-way handshake process is as follows:

[0103] (1) The user terminal initiates an encrypted communication request to the access device;

[0104] (2) After receiving the encrypted communication request, the access device sends a feedback message to the user end;

[0105] (3) After receiving the feedback message sent by the access device, the user terminal verifies the access device certificate to determine whether to establish a communication connection with the access device;

[0106] (4) After receiving the random number sent by the user, the access device calculates and generates a session key and sends key information to the user. The key information includes the encryption method (encryption rule), encryption field, random number, etc.

[0107] After the access device establishes a communication connection with the user end, it can receive the key authentication request sent by the user end, and then forward the key authentication request and key information to the service authentication end, which authenticates the user identity. The specific authentication process is as follows:

[0108] The service authentication end determines the user information from the key authentication request. The user information can be a unique identifier for identifying the user, such as a media access control address (MAC address). The service authentication end can also determine whether the current terminal device has been bound to a pre-shared key based on the terminal device information. This application will later describe the present invention in detail using the client as an example.

[0109] The service authentication end can determine whether the user information has been bound to a pre-shared key based on the user information. In an embodiment of the present application, it is possible to determine whether the user information has been bound to a pre-shared key by establishing a mapping relationship between the user information and the pre-shared key, and different user information can be bound to the same pre-shared key. The present application does not impose any specific restrictions on the amount of user information that can be bound to a pre-shared key.

[0110] When the service authentication end determines that the user information has been bound to the pre-shared key, it determines that the current user end does not need to register the pre-shared key again, and directly authenticates the pre-shared key for the current user end, that is, determines whether the initial key matches the second pre-shared key bound to the user information.

[0111] In the embodiment of the present application, the steps for authenticating the pre-shared key for the user end bound with the pre-shared key are as follows:

[0112] The service authentication end receives the key authentication request, parses the key information in the key authentication request, parses out encryption parameter values ​​such as encryption method (encryption rule), encryption field, random number, etc., and then uses the initial key sent by the received user end as the target pre-shared key, that is, the pre-shared key to be authenticated, encrypts the target pre-shared key according to the encryption parameter value, and obtains the first encryption key.

[0113] The service authentication end determines, based on the user information, a second pre-shared key that matches (is bound to) the user information in the set pre-shared key set. Each pre-shared key in the pre-shared key set records the corresponding user information. For example, pre-shared key 1 corresponds to user information 1, and pre-shared key 2 corresponds to user information 2. Details are not given here.

[0114] After determining the second pre-shared key that matches the user information, the second pre-shared key can be encrypted according to the same encryption parameter value as the target pre-shared key to obtain a second encryption key, and then it is determined whether the first encryption key matches the second encryption key. Whether the first encryption key matches the second encryption key can be determined according to the first value of the first encryption key and the second value of the second encryption key. When the first value is the same as the second value, it is determined that the first encryption key matches the second encryption key; otherwise, it is determined that the first encryption key does not match the second encryption key.

[0115] When the service authentication end determines that the first encryption key matches the second encryption key, it can send an authentication message related to the second pre-shared key to the access device, and the access device forwards the authentication message related to the second pre-shared key to the user end. The authentication message can be an Accept message. The Accept message includes authorization attributes such as the authorized virtual local area network (English full name: Virtual Local Area Network, abbreviated as: VLAN), quality of service (English full name: Quality Of Service, abbreviated as: QOS) after successful authentication of the second pre-shared key.

[0116] When the service authentication end determines that the first encryption key and the second encryption key fail to match, it can send a feedback message of the target pre-shared key authentication error to the access device, and the access device forwards the feedback message of the target pre-shared key authentication error to the user end. The feedback message can be a Reject message, and the user end can determine the error type of the key authentication error based on the Reject message, such as an incorrect initial key input, and prompt the user end to re-enter the initial key and authenticate the pre-shared key again.

[0117] Through the above method, the pre-shared key can be directly authenticated for the user terminal that has been bound to the pre-shared key, thereby improving the efficiency of user identity authentication.

[0118] S2: When it is determined that the user information is not bound to the pre-shared key, determine whether the initial key sent by the user terminal matches the first key.

[0119] In an embodiment of the present application, when the service authentication end determines that the user information is not bound to a pre-shared key, it can determine whether the initial key matches the first key based on the received initial key. The first key is the application key of the pre-shared key set by the service authentication end. The service authentication end can determine whether the current user end has a registration requirement for the pre-shared key based on the first key. The application key can be a character sequence (string) composed of letters and numbers, for example: x123456x. This application does not impose specific restrictions on the character combination method of the application key and the number of application keys set.

[0120] The steps for the service authentication end to determine whether the initial key matches the first key are as follows:

[0121] The encryption method (encryption rule), encryption field, random number and other encryption parameter values ​​are parsed out in the key authentication request.

[0122] The initial key is encrypted according to the above encryption parameter value to obtain a first encryption value, and then a first key is selected from the first key set to determine whether the first key is equal to the first encryption value. If so, it is determined that the current user terminal has a registration requirement for a pre-shared key; if not, the next first key is selected from the first key set, and the above steps are repeated until each first key in the first key set is polled.

[0123] If there is a first key equal to the first encryption value in the first key set, that is, the initial key matches the first key, then the first pre-shared key is registered for the user terminal and the first pre-shared key is bound to the user information; if there is no first key equal to the first encryption value in the first key set, that is, the initial key fails to match the first key, then the initial key can be matched with the second key or a second feedback message indicating that the initial key authentication failed is sent to the user terminal.

[0124] Through the above manner, it is possible to determine to register a pre-shared key for a user terminal that has a pre-shared key registration requirement, thereby improving the efficiency of authenticating the user identity.

[0125] S3, registering a first pre-shared key for the user terminal, and binding the first pre-shared key with the user information.

[0126] In the embodiment of the present application, when the service authentication end determines that there is a first key matching the first encryption value in the first key set, the first pre-shared key can be registered for the current user end. The specific steps of registering the first pre-shared key are as follows:

[0127] The service authentication end returns an Accept message to the access device. The Accept message contains authorization attributes such as the registration role, the name of the registration role, the jump address, and the public key. The public key can be the same as the initial key entered by the user.

[0128] The access device can initiate a redirection to the terminal based on the registration role, name of the registration role, public key and other authorization attributes in the received Accept message, and jump the task to the configured portal registration page, waiting for the user to enter the registration information. The registration information can be the user's name, email address, and mobile phone number. This application does not impose any specific restrictions on this.

[0129] The service authentication end generates a first pre-shared key for the user based on the registration information input by the user and the set random generation algorithm. This application does not impose any specific restrictions on the number of registered first pre-shared keys.

[0130] In order to improve the security of registering the first pre-shared key, this application adds an approval mechanism for registering the first pre-shared key when registering the first pre-shared key for the user terminal. The registration approval process of the first pre-shared key can be found in the attached Figure 4 As shown:

[0131] The service authentication end first determines the registration information sent by the user end, and then determines whether the registration information needs to be approved according to the approval mode indication of the key authentication administrator. Specifically, whether the registration information needs to be approved can be determined by setting an approval mode flag, an approval field, or any other method on the service authentication end. The approval mode indication is used to modify the values ​​in the approval mode flag and the approval field. Exemplarily, assuming that the service authentication end is set with an approval mode flag, the value in the approval mode flag is 1, indicating that the registration information needs to be approved; the value in the approval mode flag is 0, indicating that the registration information does not need to be approved. This application does not impose specific restrictions on the value of the approval mode flag when the registration information needs to be approved.

[0132] When the service authentication end determines that the registration information needs to be approved, for example, when it is determined that the approval mode indication of the key authentication administrator is to set the approval mode flag position to 1, it is determined to start the registration approval mode, and firstly verify the identity of the user end. Specifically, it can be determined whether the registration information input by the user end meets the set registration rules. For example, if the user's suffix name in the registration information is .DS, and the set registration rules only allow users with suffix names of .DS; .QF; .AB to register a pre-shared key, then the first pre-shared key is registered for the current user end, the first pre-shared key is sent to the user end, and the first pre-shared key is bound to the user information.

[0133] If the registration information entered by the user terminal does not meet the preset registration rules or the user's suffix name cannot be extracted based on the registration information, manual review can be used to determine whether to register a pre-shared key for the current user terminal. If the registration information fails the manual review, a prompt message indicating that the pre-shared key registration failed is sent to the user terminal; if the registration information passes the manual review, a first pre-shared key is registered for the current user terminal, the first pre-shared key is sent to the user terminal, and the first pre-shared key is bound to the user information.

[0134] In an embodiment of the present application, when the service authentication end determines that there is no need to approve the registration information, for example, the approval mode indication of the key authentication administrator is to set the approval mode flag to 0, it is determined that there is no need to verify the identity of the current user end, and the first pre-shared key can be automatically registered for the user end, the first pre-shared key can be sent to the user end, and the first pre-shared key can be bound to the current user information.

[0135] After the service authentication end reviews the pre-shared key registration corresponding to the user end, it can send a request for the current user end to go offline to the access device, requesting the current user end to disconnect the pre-shared key registration connection with the service authentication end and release system resources to ensure the efficiency of the pre-shared key registration or authentication for the next user end.

[0136] Through the above manner, it is possible to prevent a user terminal that does not meet the pre-shared key registration requirements from registering a pre-shared key, thereby improving the security of registering a pre-shared key for the user terminal.

[0137] In an embodiment of the present application, if the initial key fails to match the first key, the service authentication end can forward a second feedback message of the failure of the initial key authentication to the user end through the access device. Based on the received second feedback message, the user end can resend the initial key to the service authentication end and apply for registration of the pre-shared key.

[0138] In the embodiment of the present application, if the initial key fails to match the first key, the service authentication end may also match the initial key with the second key.

[0139] The steps to match the initial key with the secondary key are as follows:

[0140] The service authentication end determines whether the initial key matches the second key, where the second key is any pre-shared key required for the user terminal network authentication; when it is determined that the initial key matches the second key, the service authentication end can bind the second key to the user information and send an authentication message associated with the second key to the user terminal; when it is determined that the initial key fails to match the second key, the service authentication end can forward a first feedback message of the failure of the initial key authentication to the user terminal through the access device.

[0141] The specific process of determining whether the initial key matches the second key is as follows:

[0142] The service authentication end first parses the encryption parameter value in the key authentication request sent by the user end, and then encrypts the initial key according to the encryption parameter value to obtain a third encryption key. The third encryption key can be the same as the first encryption key, and this application does not impose any specific restrictions on this.

[0143] The service authentication end selects any one of the pre-shared key candidates from the set pre-shared key set, uses the pre-shared key candidate as the second key, and then encrypts the second key according to the encryption parameter value to obtain a fourth encryption key.

[0144] Determine whether the third encryption key matches the fourth encryption key. If the third encryption key matches the fourth encryption key, bind the second key to the user information and send an authentication message associated with the second key to the user end, that is, send an Accept message associated with the second key to the user end. No further details will be given here.

[0145] If the third encryption key fails to match the fourth encryption key, the next candidate pre-shared key in the pre-shared key is selected and the selected pre-shared key is used as the second key; the second key is then encrypted according to the encryption parameter value to obtain the fifth encryption key, and it is determined whether the fifth encryption key matches the third encryption key. If the fifth encryption key matches the third encryption key, the second key is bound to the user information, and an authentication message associated with the second key is sent to the user terminal; if the fifth encryption key fails to match the third encryption key, the next candidate pre-shared key in the pre-shared key set is continued to be selected.

[0146] By polling and comparing the initial key with each candidate pre-shared key in the pre-shared key set, it can be determined whether there is a second key that matches the initial key, that is, although the current user information is not bound to the pre-shared key, the initial key may be obtained from other user terminals that have registered for the pre-shared key. Therefore, when the service authentication end determines that the initial key matches the second key, it can bind the second key to the current user information, thereby realizing dynamic binding of the user terminal and the pre-shared key during the pre-shared key authentication process, that is, realizing the function of using one pre-shared key for multiple user terminals (one code for multiple machines).

[0147] If there is no second key matching the initial key in the pre-shared key set, that is, when the initial key fails to match the second key, the service authentication end can send a first feedback message of initial key authentication failure to the access device (a feedback message prompting the user that the initial key entered neither matches the application key used to register the pre-shared key nor matches the pre-shared key registered by other user terminals), and the access device forwards the first feedback message to the user terminal. The first feedback message can also be a Reject message; and the user terminal can re-enter the initial key according to the Reject message, determine to submit a registration request for the pre-shared key to the service authentication end or determine to obtain a registered pre-shared key from other user terminals, and use the registered pre-shared key to authenticate the pre-shared key, so as to obtain Internet access permission from the service authentication end.

[0148] In a possible embodiment, when the service authentication end receives the initial key, it can also first determine whether the initial key matches the second key. If the initial key matches the second key, the initial key is used as a registered pre-shared key to authenticate the initial key as a pre-shared key; if the initial key fails to match the second key, it is further determined whether the initial key matches the first key.

[0149] If the initial key matches the first key, the first pre-shared key is registered for the current user terminal; if the initial key fails to match the first key, a feedback message of initial key authentication failure is sent to the access device. This application does not impose any specific restrictions on the order of determining whether the initial key matches the first key or the second key.

[0150] In an embodiment of the present application, for the pre-shared key authentication process of first determining whether the initial key matches the second key and then determining whether the initial key matches the first key, reference can be made to the above-mentioned steps of first determining whether the initial key matches the first key and then determining whether the initial key matches the second key, and adaptively adjusting according to actual application requirements, which will not be repeated here.

[0151] To sum up, the method provided by the present application can realize the registration and authentication of the pre-shared key based on the same signal, thereby avoiding the service authentication end switching back and forth between the registration signal and the authentication signal when the new user pre-acquires the Internet access permission; by adding an approval mechanism for registering the first pre-shared key, it can prevent the user terminal that does not meet the pre-shared key registration requirements from registering the pre-shared key, thereby improving the security of registering the pre-shared key for the user terminal; by matching the initial key with each candidate pre-shared key in the pre-shared key set, it can realize the dynamic binding function of the pre-shared key and the current user information during the pre-shared key authentication process, thereby increasing the number of user terminals to which a pre-shared key can be applied and improving the efficiency of authenticating the user identity.

[0152] Based on the method provided in the above embodiment, the embodiment of the present application also provides a key authentication device, such as Figure 5 The figure is a schematic diagram of the structure of a key authentication device in an embodiment of the present application, the device comprising:

[0153] The key query module 501 is used to determine the user information in the key authentication request sent by the user end, and determine whether the user information has been bound to the pre-shared key;

[0154] A key authentication module 502, configured to determine whether the initial key sent by the user terminal matches a first key when it is determined that the user information is not bound to a pre-shared key, wherein the first key is used to determine whether the user terminal has a registration requirement for a pre-shared key;

[0155] If so, register a first pre-shared key for the client, and bind the first pre-shared key to the user information.

[0156] In a possible implementation, the key authentication module 502 is specifically used to:

[0157] Determine whether the initial key matches the second key, wherein the second key is any pre-shared key required for the user terminal network authentication;

[0158] If yes, binding the second key to the user information and sending an authentication message associated with the second key to the user terminal;

[0159] If not, a first feedback message indicating that the initial key authentication failed is sent to the user terminal.

[0160] In a possible implementation, the key authentication module 502 is specifically used to:

[0161] Parsing the encryption parameter value in the key authentication request;

[0162] Encrypting the initial key according to the encryption parameter value to obtain a third encryption key;

[0163] Selecting any one of the pre-shared key candidates from the set pre-shared key set, and using the pre-shared key candidate as the second key;

[0164] encrypting the second key according to the encryption parameter value to obtain a fourth encryption key;

[0165] determining whether the third encryption key matches the fourth encryption key;

[0166] If yes, binding the second key to the user information, and sending the authentication message associated with the second key to the user terminal;

[0167] If not, then select the next candidate pre-shared key in the pre-shared key set.

[0168] In a possible implementation, if the initial key fails to match the first key, a second feedback message indicating that the initial key authentication fails is sent to the user terminal.

[0169] In a possible implementation, the key authentication module 502 is specifically used to:

[0170] Determining the registration information sent by the user terminal;

[0171] Determining whether to approve the registration information;

[0172] If so, determining whether the registration information satisfies a preset registration rule, and when it is determined that the registration information satisfies the registration rule, registering the first pre-shared key for the user terminal, sending the first pre-shared key to the user terminal, and binding the first pre-shared key to the user information;

[0173] If not, the first pre-shared key is automatically registered for the user terminal, the first pre-shared key is sent to the user terminal, and the first pre-shared key is bound to the user information.

[0174] In a possible implementation, the key query module 501 is further used for:

[0175] Parsing the encryption parameter value in the key authentication request and using the initial key as the target pre-shared key;

[0176] Encrypting the target pre-shared key according to the encryption parameter value to obtain a first encryption key;

[0177] Determining the second pre-shared key from the set pre-shared key set;

[0178] Encrypting the second pre-shared key according to the encryption parameter value to obtain a second encryption key;

[0179] determining whether the first encryption key matches the second encryption key;

[0180] If yes, sending an authentication message associated with the second pre-shared key to the user terminal;

[0181] If not, a feedback message indicating that the target pre-shared key authentication is wrong is sent to the user terminal.

[0182] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application, and the electronic device can realize the function of the aforementioned key authentication device, referring to Figure 6 , the electronic device comprises:

[0183] At least one processor 601, and a memory 602 connected to the at least one processor 601. The specific connection medium between the processor 601 and the memory 602 is not limited in the embodiment of the present application. Figure 6 In the example, the processor 601 and the memory 602 are connected via a bus 600. Figure 6 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 600 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 601 can also be called a controller, and there is no limitation on the name.

[0184] In the embodiment of the present application, the memory 602 stores instructions that can be executed by at least one processor 601. The at least one processor 601 can execute the key authentication method discussed above by executing the instructions stored in the memory 602. The processor 601 can implement Figure 5 The functions of each module in the device shown.

[0185] Among them, the processor 601 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 602 and calling the data stored in the memory 602, the various functions of the device and processing data, the device can be monitored as a whole.

[0186] In one possible design, the processor 601 may include one or more processing units, and the processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0187] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the key authentication method disclosed in the embodiments of the present application can be directly embodied as a hardware processor to be executed, or a combination of hardware and software modules in the processor can be executed.

[0188] The memory 602 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 602 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 602 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 602 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0189] By programming the processor 601, the code corresponding to the key authentication method described in the above embodiment can be fixed into the chip, so that the chip can execute the key authentication method when running. Figure 1 The steps of the key authentication method of the embodiment shown are as follows: How to design and program the processor 601 is a technique known to those skilled in the art and will not be described in detail here.

[0190] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the key authentication method discussed above.

[0191] In some possible implementations, various aspects of the address generation method provided in the present application can also be implemented in the form of a program product, which includes a program code. When the program product is run on the device, the program code is used to enable the control device to execute the steps of the key authentication method according to various exemplary embodiments of the present application described above in this specification.

[0192] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0193] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0194] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0195] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0196] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A key authentication method, characterized in that: include: Determine user information in the key authentication request sent by the user terminal, and determine whether the user information has been bound to a pre-shared key; When it is determined that the user information is not bound to a pre-shared key, determining whether the initial key sent by the user terminal matches a first key, wherein the first key is used to determine whether the user terminal has a registration requirement for a pre-shared key; If so, register a first pre-shared key for the client, and bind the first pre-shared key to the user information.

2. The method according to claim 1, characterized in that If the initial key fails to match the first key, matching the initial key with the second key includes: Determine whether the initial key matches the second key, wherein the second key is any pre-shared key required for the user terminal network authentication; If yes, binding the second key to the user information and sending an authentication message associated with the second key to the user terminal; If not, a first feedback message indicating that the initial key authentication failed is sent to the user terminal.

3. The method according to claim 2, characterized in that The determining whether the initial key matches the second key includes: Parsing the encryption parameter value in the key authentication request; Encrypting the initial key according to the encryption parameter value to obtain a third encryption key; Selecting any one of the pre-shared key candidates from the set pre-shared key set, and using the pre-shared key candidate as the second key; encrypting the second key according to the encryption parameter value to obtain a fourth encryption key; determining whether the third encryption key matches the fourth encryption key; If yes, binding the second key to the user information, and sending the authentication message associated with the second key to the user terminal; If not, then select the next candidate pre-shared key in the pre-shared key set.

4. The method according to claim 1, characterized in that If the initial key fails to match the first key, a second feedback message indicating that the initial key authentication fails is sent to the user terminal.

5. The method according to claim 1, characterized in that The registering a first pre-shared key for the user terminal and binding the first pre-shared key with the user information includes: Determining the registration information sent by the user terminal; Determining whether to approve the registration information; If so, determining whether the registration information satisfies a preset registration rule, and when it is determined that the registration information satisfies the registration rule, registering the first pre-shared key for the user terminal, sending the first pre-shared key to the user terminal, and binding the first pre-shared key to the user information; If not, the first pre-shared key is automatically registered for the user terminal, the first pre-shared key is sent to the user terminal, and the first pre-shared key is bound to the user information.

6. The method according to claim 1, characterized in that If the user information is bound to a pre-shared key, determining whether the initial key matches a second pre-shared key bound to the user information includes: Parsing the encryption parameter value in the key authentication request and using the initial key as the target pre-shared key; Encrypting the target pre-shared key according to the encryption parameter value to obtain a first encryption key; Determining the second pre-shared key from the set pre-shared key set; Encrypting the second pre-shared key according to the encryption parameter value to obtain a second encryption key; determining whether the first encryption key matches the second encryption key; If yes, sending an authentication message associated with the second pre-shared key to the user terminal; If not, a feedback message indicating that the target pre-shared key authentication is wrong is sent to the user terminal.

7. A key authentication device, characterized in that: include: A key query module, used to determine user information in a key authentication request sent by a user terminal, and determine whether the user information has been bound to a pre-shared key; A key authentication module, used for determining whether the initial key sent by the user terminal matches the first key when it is determined that the user information is not bound to the pre-shared key, wherein the first key is used to determine whether the user terminal has a registration requirement for the pre-shared key; If so, register a first pre-shared key for the client, and bind the first pre-shared key to the user information.

8. The device according to claim 7, characterized in that The key authentication module is specifically used for: Determine whether the initial key matches the second key, wherein the second key is any pre-shared key required for the user terminal network authentication; If yes, binding the second key to the user information and sending an authentication message associated with the second key to the user terminal; If not, a first feedback message indicating that the initial key authentication failed is sent to the user terminal.

9. The device according to claim 8, characterized in that The key authentication module is specifically used for: Parsing the encryption parameter value in the key authentication request; Encrypting the initial key according to the encryption parameter value to obtain a third encryption key; Selecting any one of the pre-shared key candidates from the set pre-shared key set, and using the pre-shared key candidate as the second key; encrypting the second key according to the encryption parameter value to obtain a fourth encryption key; determining whether the third encryption key matches the fourth encryption key; If yes, binding the second key to the user information, and sending the authentication message associated with the second key to the user terminal; If not, then select the next candidate pre-shared key in the pre-shared key set.

10. The device according to claim 7, characterized in that If the initial key fails to match the first key, a second feedback message indicating that the initial key authentication fails is sent to the user terminal.

11. The device according to claim 7, characterized in that The key authentication module is specifically used for: Determining the registration information sent by the user terminal; Determining whether to approve the registration information; If so, determining whether the registration information satisfies a preset registration rule, and when it is determined that the registration information satisfies the registration rule, registering the first pre-shared key for the user terminal, sending the first pre-shared key to the user terminal, and binding the first pre-shared key to the user information; If not, the first pre-shared key is automatically registered for the user terminal, the first pre-shared key is sent to the user terminal, and the first pre-shared key is bound to the user information.

12. The device according to claim 7, characterized in that The key query module is also used for: Parsing the encryption parameter value in the key authentication request and using the initial key as the target pre-shared key; Encrypting the target pre-shared key according to the encryption parameter value to obtain a first encryption key; Determining the second pre-shared key from the set pre-shared key set; Encrypting the second pre-shared key according to the encryption parameter value to obtain a second encryption key; determining whether the first encryption key matches the second encryption key; If yes, sending an authentication message associated with the second pre-shared key to the user terminal; If not, a feedback message indicating that the target pre-shared key authentication is wrong is sent to the user terminal.

13. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 6 when executing the computer program stored in the memory.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 6 are implemented.

Images