Cryptographic device discovery method and computer device

Abstract

The invention provides a password device discovery method and a computer device, and relates to the technical field of password application. The method comprises the following steps: responding to an access event triggered by a software application on a current password device, obtaining device feature information of the current password device in multiple dimensions, generating device fingerprint information of the current password device according to the device feature information in multiple dimensions, and sending an access request to a server of the software application according to the device fingerprint information, the access request is used for enabling the server to detect the equipment fingerprint information by adopting an equipment fingerprint detection algorithm according to a preset equipment fingerprint database to obtain a fingerprint detection result of the current password equipment, receiving a first access response sent by the server, and sending the first access response to the server; the first access response is an access response triggered when the server determines that the current password device is the registered password device. Complicated and unique equipment fingerprint information is generated through multi-dimensional equipment feature information, and omnibearing and high-precision identification of the identity of the password equipment is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptographic application, and in particular to a cryptographic device discovery method and a computer device. Background Art

[0002] In the field of network security, as the application of cryptographic devices becomes more and more widespread, how to effectively manage and authenticate these cryptographic devices has become a key challenge. In order to improve the security and efficiency of authentication, detection technology based on device fingerprints has emerged. However, the current field of cryptographic device detection generally has problems such as insufficient recognition accuracy, vulnerability to security threats, and poor adaptability to device status changes. Summary of the invention

[0003] The purpose of the present invention is to provide a cryptographic device discovery method and computer device to address the deficiencies in the above-mentioned prior art, so as to generate a complex and unique device fingerprint information through device feature information of multiple dimensions, thereby realizing all-round and high-precision identification of the identity of the cryptographic device.

[0004] To achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows:

[0005] In a first aspect, an embodiment of the present application provides a cryptographic device discovery method, which is applied to a current cryptographic device, and the method includes:

[0006] In response to an access event triggered by a software application on the current password device, obtaining device feature information of the current password device in multiple dimensions;

[0007] Generate device fingerprint information of the current password device according to the device feature information of the multiple dimensions;

[0008] According to the device fingerprint information, an access request is sent to the server of the software application, wherein the access request is used to enable the server to detect the device fingerprint information according to a preset device fingerprint library and a device fingerprint detection algorithm to obtain a fingerprint detection result of the current password device, wherein the fingerprint detection result is used to indicate whether the current password device is a registered password device, wherein the preset device fingerprint library stores: device fingerprint information of multiple registered password devices;

[0009] A first access response sent by the server is received, where the first access response is an access response triggered when the server determines that the current password device is a registered password device, and the first access response is used to indicate that the current password device has resource access rights of the server.

[0010] In an optional implementation, the device feature information in multiple dimensions includes: hardware feature information, software feature information, and dynamic environment feature information, and the acquiring of the device feature information in multiple dimensions of the current password device includes:

[0011] Collecting hardware feature information of the current cryptographic device;

[0012] Performing feature scanning on the software application of the current cryptographic device to obtain software feature information of the current cryptographic device;

[0013] The network environment of the current cryptographic device is monitored to obtain the dynamic environment feature information.

[0014] In an optional implementation, generating device fingerprint information of the current password device according to the device feature information of the multiple dimensions includes:

[0015] Formatting the device characteristic information of the multiple dimensions respectively to obtain processed device characteristic data of the multiple dimensions required by a preset format;

[0016] Sorting the processed device feature data of the multiple dimensions to generate a device feature data string;

[0017] A preset secure hash algorithm is used to perform hash calculation on the device feature data string to obtain the device fingerprint information.

[0018] In an optional implementation manner, before sending the access request to the server of the software application, the method further includes:

[0019] The device fingerprint information is encrypted using a preset national secret algorithm to obtain a device fingerprint ciphertext; the access request includes: the device fingerprint ciphertext.

[0020] In an optional embodiment, the method further comprises:

[0021] receiving a second access response sent by the server, where the second access response is an access response triggered when the server determines that the current password device is an unregistered password device, and the second access response is used to indicate that the current password device does not have resource access rights of the server;

[0022] According to the device fingerprint information, a registration request is sent to the server, so that the server stores the device fingerprint information in the preset device fingerprint database.

[0023] In a second aspect, an embodiment of the present application further provides a cryptographic device discovery method, which is applied to a server of a software application, and the method includes:

[0024] receiving an access request sent by a current password device based on device fingerprint information of the current password device, wherein the device fingerprint information is a response of the current password device to an access event triggered by a software application on the current password device, obtaining device feature information of the current password device in multiple dimensions, and generating device fingerprint information according to the device feature information in the multiple dimensions;

[0025] According to the preset device fingerprint library, the device fingerprint information is detected by using the device fingerprint detection algorithm to obtain the fingerprint detection result of the current password device, and the fingerprint detection result is used to indicate whether the current password device is a registered password device, and the preset device fingerprint library stores: device fingerprint information of multiple registered password devices;

[0026] If the current password device is a registered password device, a first access response is sent to the current password device, where the first access response is used to indicate that the current password device has the resource access permission of the server.

[0027] In an optional implementation manner, the access request includes: a device fingerprint ciphertext of the current password device, where the device fingerprint ciphertext is a ciphertext obtained by encrypting the device fingerprint information by the current password device using a preset national secret algorithm;

[0028] Before detecting the device fingerprint information according to the preset device fingerprint library and using the device fingerprint detection algorithm to obtain the fingerprint detection result of the current password device, the method further includes:

[0029] The preset national secret algorithm is used to decrypt the device fingerprint ciphertext to obtain the device fingerprint information.

[0030] In an optional implementation manner, the detecting the device fingerprint information using a device fingerprint detection algorithm according to a preset device fingerprint library to obtain a fingerprint detection result of the current password device includes:

[0031] The device fingerprint detection algorithm is used to analyze the device fingerprint information to obtain device fingerprint data;

[0032] The difference between the device fingerprint data and each device fingerprint data in the preset device fingerprint library is compared with a preset threshold to determine the fingerprint matching result of the current password device.

[0033] In an optional embodiment, the method further comprises:

[0034] If registration events of multiple password devices are monitored, based on the registration events, device fingerprint information of each password device is obtained, and the device fingerprint information of each password device is stored in the preset device fingerprint library;

[0035] If an elimination event of a registered target password device is monitored, the device fingerprint information of the registered target password device is deleted from the preset device fingerprint library.

[0036] In the third aspect, an embodiment of the present application also provides a computer device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores program instructions executable by the processor, and when the computer device is running, the processor communicates with the storage medium through the bus, and the processor executes the program instructions to perform the steps of the cryptographic device discovery method as described in any one of the first aspect and the second aspect.

[0037] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the cryptographic device discovery method as described in any one of the first and second aspects are executed.

[0038] The beneficial effects of this application are:

[0039] An embodiment of the present application provides a cryptographic device discovery method and a computer device, the method comprising: responding to an access event triggered by a software application on a current cryptographic device, obtaining device feature information of the current cryptographic device in multiple dimensions, generating device fingerprint information of the current cryptographic device based on the device feature information in multiple dimensions, and sending an access request to a server of the software application based on the device fingerprint information, the access request being used to enable the server to detect the device fingerprint information according to a preset device fingerprint library and a device fingerprint detection algorithm to obtain a fingerprint detection result of the current cryptographic device, the fingerprint detection result being used to indicate whether the current cryptographic device is a registered cryptographic device, the preset device fingerprint library storing: device fingerprint information of multiple registered cryptographic devices, receiving a first access response sent by the server, the first access response being an access response triggered when the server determines that the current cryptographic device is a registered cryptographic device, and the first access response being used to indicate that the current cryptographic device has resource access rights of the server.

[0040] The method of the present application generates a complex and unique device fingerprint information through device feature information of multiple dimensions, which exceeds the limitations of traditional hardware identifiers and realizes all-round and high-precision identification of the identity of the cryptographic device. Then, the server detects the device fingerprint information according to the preset device fingerprint library to determine whether the current cryptographic device is a registered cryptographic device, preventing unregistered cryptographic devices from directly accessing, thereby improving the overall network security level of the server and protecting user privacy and data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0042] Figure 1 One of the flowcharts of a cryptographic device discovery method provided in an embodiment of the present application;

[0043] Figure 2 A second flowchart of a cryptographic device discovery method provided in an embodiment of the present application;

[0044] Figure 3 A third flowchart of a cryptographic device discovery method provided in an embodiment of the present application;

[0045] Figure 4 A fourth flowchart of a cryptographic device discovery method provided in an embodiment of the present application;

[0046] Figure 5 A fifth flowchart of a cryptographic device discovery method provided in an embodiment of the present application;

[0047] Figure 6 A sixth flowchart of a cryptographic device discovery method provided in an embodiment of the present application;

[0048] Figure 7 A schematic diagram of the functional modules of a cryptographic device discovery device provided in an embodiment of the present application;

[0049] Figure 8 A schematic diagram of functional modules of another cryptographic device discovery device provided in an embodiment of the present application;

[0050] Fig. 9 A schematic diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0052] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0053] In the description of the present application, it should be noted that if the terms "upper", "lower", etc. appear, the orientation or position relationship indicated is based on the orientation or position relationship shown in the drawings, or is the orientation or position relationship in which the product of the application is usually placed when used. It is only for the convenience of describing the present application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present application.

[0054] In addition, the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0055] It should be noted that, in the absence of conflict, the features in the embodiments of the present application may be combined with each other.

[0056] The embodiment of the present application provides a method for discovering cryptographic devices, which can be applied to a variety of scenarios with high security requirements, such as the financial industry, enterprise-level applications, IoT security, military institutions, e-commerce and e-commerce platforms, and software development and digital copyright management and other industries with high security requirements. For example, in IoT security scenarios, the method can prevent unauthorized IoT devices, i.e., cryptographic devices, from accessing the home network through a device fingerprint detection algorithm to ensure home security. In enterprise-level application scenarios, when enterprise employees remotely access enterprise intranet resources, the method can verify the legitimacy of their cryptographic devices through a device fingerprint detection algorithm to prevent unauthorized cryptographic devices from accessing and protect enterprise data security.

[0057] The following is an example of the cryptographic device discovery method provided by the present application with multiple examples in combination with the accompanying drawings. A cryptographic device discovery method provided in an embodiment of the present application is applied to a current cryptographic device and can be implemented by a computer device pre-installed with: a cryptographic device discovery algorithm or detection software, by running the algorithm or software. The computer device can be, for example, a server or a terminal, and the terminal can be a user's computer. Figure 1 One of the flow charts of a cryptographic device discovery method provided in an embodiment of the present application; Figure 1 As shown, the method includes:

[0058] S101: Respond to an access event triggered by a software application on a current password device and obtain device feature information of the current password device in multiple dimensions.

[0059] In this embodiment, the current password device is pre-installed with a software application. When the software application needs to access the server of the software application, the software application triggers an access event, and the access event is used to indicate that the current password device needs to access the server. In response to the access event triggered by the software application on the current password device, device feature information of the current password device in multiple dimensions is obtained.

[0060] Optionally, the device feature information in multiple dimensions includes: hardware feature information, software feature information and dynamic environment feature information.

[0061] Among them, hardware feature information includes: the CPU serial number, motherboard serial number, built-in storage chip serial number, and any unique hardware identifier of the current cryptographic device; software feature information includes: the operating system version, browser type and firmware version, installed software list, etc. connected to the current cryptographic device; dynamic environment feature information includes: the network environment, timestamp and other dynamic information of the current cryptographic device.

[0062] S102: Generate device fingerprint information of the current password device based on device feature information of multiple dimensions.

[0063] Specifically, the device feature information of multiple dimensions is calculated and processed to generate the device fingerprint information of the current password device.

[0064] S103. Send an access request to the server of the software application according to the device fingerprint information. The access request is used to enable the server to detect the device fingerprint information according to a preset device fingerprint library and adopt a device fingerprint detection algorithm to obtain a fingerprint detection result of the current password device.

[0065] The fingerprint detection result is used to indicate whether the current password device is a registered password device, and the preset device fingerprint library stores: device fingerprint information of multiple registered password devices.

[0066] Specifically, when the current cryptographic device attempts to access the server, it sends an access request to the server of the software application and submits the device fingerprint information to the server. The server detects the device fingerprint information based on the preset device fingerprint library and the device fingerprint detection algorithm to obtain the fingerprint detection result of the current cryptographic device and determine whether the current cryptographic device is a cryptographic device that has been registered on the server.

[0067] S104: Receive a first access response sent by the server, where the first access response is an access response triggered when the server determines that the current password device is a registered password device.

[0068] The first access response is used to indicate that the current cryptographic device has resource access rights of the server.

[0069] Specifically, the current cryptographic device receives the first access response sent by the server, indicating that the current cryptographic device has the authority to access the server, can access network resources of the server, or perform related operations, and record access logs for subsequent auditing.

[0070] In summary, an embodiment of the present application provides a cryptographic device discovery method, which is applied to a current cryptographic device. The method includes: responding to an access event triggered by a software application on the current cryptographic device, obtaining device feature information of the current cryptographic device in multiple dimensions, generating device fingerprint information of the current cryptographic device based on the device feature information in multiple dimensions, and sending an access request to a server of the software application based on the device fingerprint information. The access request is used to enable the server to detect the device fingerprint information according to a preset device fingerprint library and a device fingerprint detection algorithm to obtain a fingerprint detection result of the current cryptographic device. The fingerprint detection result is used to indicate whether the current cryptographic device is a registered cryptographic device. The preset device fingerprint library stores: device fingerprint information of multiple registered cryptographic devices, and receives a first access response sent by the server. The first access response is an access response triggered when the server determines that the current cryptographic device is a registered cryptographic device. The first access response is used to indicate that the current cryptographic device has resource access rights of the server.

[0071] The method of the present application generates a complex and unique device fingerprint information through device feature information of multiple dimensions, which exceeds the limitations of traditional hardware identifiers and realizes all-round and high-precision identification of the identity of the cryptographic device. Then, the server detects the device fingerprint information according to the preset device fingerprint library to determine whether the current cryptographic device is a registered cryptographic device, preventing unregistered cryptographic devices from directly accessing, thereby improving the overall network security level of the server and protecting user privacy and data security.

[0072] The present application embodiment also provides another possible implementation of the cryptographic device discovery method. Figure 2 A second flowchart of a method for discovering a cryptographic device provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, obtain the device feature information of the current password device in multiple dimensions, including:

[0073] S201. Collect hardware feature information of the current cryptographic device.

[0074] In this embodiment, the current cryptographic device is taken as a hardware security module (HSM) cryptographic device as an example. The HSM cryptographic device is a secure network cryptographic device used to encrypt and decrypt data.

[0075] Access the underlying hardware information through the dedicated interface provided by the HSM cryptographic device, and collect the hardware feature information of the HSM cryptographic device, including: the CPU serial number, mainboard serial number, serial number of the built-in storage chip, and hardware identifier of the HSM cryptographic device. In the process of obtaining the hardware feature information, the privacy policy and relevant laws and regulations of the HSM cryptographic device are followed, and sensitive information is not disclosed.

[0076] For example, the content of the collected hardware feature information is as follows: the CPU serial number of the HSM cryptographic device is: CPU-SN-ABCD1234, the mainboard serial number is: MB-SN-XYZW5678, the built-in storage chip serial number is: STORAGE-SN-9012UVWX, and other hardware identifiers are: HARDWARE-ID-QRST3456.

[0077] S202: Perform feature scanning on the software application of the current cryptographic device to obtain software feature information of the current cryptographic device.

[0078] Specifically, a preset software feature scanning tool is used to connect the HSM cryptographic device, perform feature scanning on the software application of the current cryptographic device, and collect software feature information through the application programming interface (Application Programming Interface, API) provided by the HSM cryptographic device to obtain the software feature information of the HSM cryptographic device, including: the firmware version of the HSM cryptographic device, the list of supported encryption algorithms, and the pre-selected installed software application or middleware information. It should be noted that sensitive information, such as encryption algorithm keys, is desensitized to avoid leakage.

[0079] For example, the content of the collected software feature information is as follows: the firmware version of the HSM cryptographic device is: v4.5.3, the list of supported encryption algorithms is: SM2, SM4, SM3, and the pre-installed application or middleware is: Key Management Service, Secure Socket Layer (SSL) Accelerator.

[0080] S203: Monitor the network environment of the current cryptographic device to obtain dynamic environment feature information.

[0081] Specifically, the network environment monitoring module is used to monitor the network environment when the HSM cryptographic device is connected, including network configuration information such as IP address, subnet mask, gateway address, etc., and record the timestamp and geographic location information when the HSM cryptographic device is connected.

[0082] For example, the content of the collected dynamic environment feature information is as follows: the IP address of the HSM cryptographic device is: 10.0.1.15, the subnet mask is: 255.255.255.0, the gateway address is: 10.0.1.1, the connection timestamp is: 1724136000782, and the geographic location information is: Room 305, Building B, Data Center DC1.

[0083] In the method provided in the embodiment of the present application, hardware feature information of the current cryptographic device is collected, feature scanning is performed on the software application of the current cryptographic device to obtain software feature information of the current cryptographic device, network environment monitoring is performed on the current cryptographic device to obtain dynamic environment feature information, and hardware feature information, software feature information and dynamic environment feature information are collected respectively through different feature information collection methods to obtain device feature information of the current cryptographic device in multiple dimensions. Based on the device feature information in multiple dimensions, a complex and difficult-to-copy device fingerprint information can be constructed, thereby increasing the complexity and unpredictability of the device fingerprint information.

[0084] The present application embodiment also provides another possible implementation of the cryptographic device discovery method. Figure 3 A flowchart of a method for discovering a cryptographic device provided in an embodiment of the present application is shown in FIG. Figure 3 As shown, based on the device feature information of multiple dimensions, the device fingerprint information of the current password device is generated, including:

[0085] S301 , formatting device characteristic information of multiple dimensions respectively to obtain processed device characteristic data of multiple dimensions required by a preset format.

[0086] In this embodiment, multiple dimensions of device feature information, namely hardware feature information, software feature information, and dynamic environment feature information, are cleaned and formatted respectively to remove invalid or redundant data, and ensure that the processed device feature data of multiple dimensions meet preset format requirements. The preset format requirements are to meet the requirements of a preset secure hash algorithm, including data type, length, etc.

[0087] S302 , sorting the processed device feature data of multiple dimensions to generate a device feature data string.

[0088] Continuing to refer to the above example, the processed mainboard serial number, firmware version, network configuration and other feature information are combined and sorted according to preset rules to generate a device feature data string. The preset rule can be a dictionary order, etc.

[0089] For example, the processed device feature data of multiple dimensions are sorted, and the generated device feature data string is represented as follows:

[0090] CPU-SN-ABCD1234MB-SN-XYZW5678STORAGE-SN-9012UVWXHA RDWARE-ID-QRST3456v4.5.3SM2,SM4,SM3,ECCKeyManagementService,SecureSocketLayer(SSL)Accelerator10.0.1.15255.255.255.010.0.1.11724136000782Room 305,Building B,DataCenter DC1.

[0091] S303: Use a preset secure hash algorithm to perform hash calculation on the device feature data string to obtain device fingerprint information.

[0092] The preset secure hash algorithm is the SM3 algorithm, which can be used to generate a unique identifier for a device fingerprint. Device fingerprint information refers to a fixed-length string obtained by collecting multiple dimensions of device feature information of the current password device and processing it with a hash algorithm. This string can be used as the unique identity of the device.

[0093] Specifically, a preset secure hash algorithm is used to perform hash calculation on the device feature data string to generate a 128-bit hash value as the unique device fingerprint information of the HSM cryptographic device. The device fingerprint information is highly unique and unpredictable.

[0094] The preset secure hash algorithm combines multiple feature values ​​in the device feature data string into a string or value, and converts it into an output of a fixed length through a hash function. Specifically, the preset secure hash algorithm is expressed as follows:

[0095] DeviceFingerprint=H(Feature1,Feature2,…,Featuren)

[0096] Among them, H represents the hash function, Feature i Represented as the i-th feature information collected from the HSM cryptographic device.

[0097] For example, the device fingerprint information is represented as:

[0098] DeviceFingerprint=d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

[0099] In the method provided in the embodiment of the present application, device characteristic information of multiple dimensions are formatted respectively to obtain processed device characteristic data of multiple dimensions required by a preset format, the processed device characteristic data of multiple dimensions are sorted to generate a device characteristic data string, and a preset secure hash algorithm is used to perform hash calculation on the device characteristic data string to obtain device fingerprint information, and the high security and low collision rate characteristics of the preset secure hash SM3 algorithm are used to perform hash calculation on the device characteristic data string to generate a 128-bit hash value as the unique device fingerprint information of the current cryptographic device. The device fingerprint information is not only highly unique, but also can effectively resist forgery and tampering attacks.

[0100] The embodiment of the present application also provides another possible implementation of the cryptographic device discovery method. Before sending an access request to the server of the software application, the method further includes:

[0101] The device fingerprint information is encrypted using a preset national secret algorithm to obtain the device fingerprint ciphertext; the access request includes: the device fingerprint ciphertext.

[0102] In this embodiment, after the device fingerprint information of the current password device is generated, in order to ensure the storage security and transmission security of the device fingerprint information, the device fingerprint information is encrypted and stored. Specifically, the device fingerprint information can be encrypted using the preset national secret algorithm SM4 to obtain the device fingerprint ciphertext, and then an access request is sent to the server of the software application. The access request includes the device fingerprint ciphertext after the device fingerprint information is encrypted.

[0103] The present application embodiment also provides another possible implementation of the cryptographic device discovery method. Figure 4 A fourth flowchart of a method for discovering a cryptographic device provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, the method also includes:

[0104] S401. Receive a second access response sent by a server, where the second access response is an access response triggered when the server determines that a current password device is an unregistered password device.

[0105] The second access response is used to indicate that the current cryptographic device does not have the resource access authority of the server.

[0106] S402: Send a registration request to the server according to the device fingerprint information, so that the server stores the device fingerprint information in a preset device fingerprint database.

[0107] In this embodiment, if the current password device receives the second access response sent by the server, it means that the current password device is registered with the server, and the current password device cannot access the server at this time.

[0108] According to the device fingerprint information, a registration request is sent to the server so that the server stores the device fingerprint information in a preset device fingerprint database, wherein the registration request includes: the device fingerprint information of the current password device, the identifier of the current password device, the registration time of the current password device, etc.

[0109] In the method provided in the embodiment of the present application, a second access response sent by the server is received, the second access response is an access response triggered when the server determines that the current password device is an unregistered password device, and the second access response is used to indicate that the current password device does not have the resource access rights of the server; according to the device fingerprint information, a registration request is sent to the server, so that the server stores the device fingerprint information in a preset device fingerprint database, and after the current password device cannot access the server, a registration request is sent to the server, so that the server stores the device fingerprint information of the current password device in the preset device fingerprint database, and then, whether the current password device is a registered password device is detected here, and whether the current password device has the resource access rights of the server is determined.

[0110] The embodiment of the present application also provides another possible implementation of the cryptographic device discovery method, which is applied to a server of a software application. Figure 5 A fifth flow chart of a cryptographic device discovery method provided in an embodiment of the present application is as follows: Figure 5 As shown, the method includes:

[0111] S501: Receive an access request sent by a current cryptographic device based on device fingerprint information of the current cryptographic device.

[0112] Among them, the device fingerprint information is the device fingerprint information generated by the current password device in response to the access event triggered by the software application on the current password device, obtaining the device feature information of the current password device in multiple dimensions, and based on the device feature information in multiple dimensions.

[0113] In this embodiment, when the current password device attempts to access the server, the current password device will respond to the access event triggered by the software application on the current password device, obtain the device feature information of the current password device in multiple dimensions, generate device fingerprint information based on the device feature information in multiple dimensions, and then send an access request to the server. The access request may include the device fingerprint information of the current password device, so that the server receives the access request sent by the current password device based on the device fingerprint information of the current password device.

[0114] S502: According to a preset device fingerprint library, a device fingerprint detection algorithm is used to detect device fingerprint information to obtain a fingerprint detection result of the current password device.

[0115] The fingerprint detection result is used to indicate whether the current password device is a registered password device, and the preset device fingerprint library stores: device fingerprint information of multiple registered password devices.

[0116] S503: If the current password device is a registered password device, send a first access response to the current password device.

[0117] The first access response is used to indicate that the current cryptographic device has resource access rights of the server.

[0118] Specifically, the server uses a device fingerprint detection algorithm to detect the device fingerprint information, determine whether the device fingerprint information of the current password device is stored in the preset device fingerprint library, and obtain the fingerprint detection result of the current password device, thereby determining whether the current password device is a registered password device. If the current password device is a registered password device, a first access response is sent to the current password device, allowing the current password device to access the server or perform related operations, and recording the access log for subsequent audits.

[0119] In summary, the embodiment of the present application also provides a method for discovering a password device, which is applied to a server of a software application, and the method includes: receiving an access request sent by a current password device based on the device fingerprint information of the current password device, the device fingerprint information is the current password device responding to the access event triggered by the software application on the current password device, obtaining the device feature information of the current password device in multiple dimensions, and generating device fingerprint information based on the device feature information of multiple dimensions; according to a preset device fingerprint library, using a device fingerprint detection algorithm, detecting the device fingerprint information, and obtaining a fingerprint detection result of the current password device, the fingerprint detection result is used to indicate whether the current password device is a registered password device, and the preset device fingerprint library stores: device fingerprint information of multiple registered password devices; if the current password device is a registered password device, sending a first access response to the current password device, the first access response is used to indicate that the current password device has the resource access rights of the server. In the method of the present application, the server detects the device fingerprint information by using a device fingerprint detection algorithm to obtain the fingerprint detection result of the current password device, which speeds up the parsing and comparison of the device fingerprint information and improves the recognition efficiency.

[0120] The embodiment of the present application also provides another possible implementation method of the cryptographic device discovery method, where the access request includes: a device fingerprint ciphertext of the current cryptographic device, where the device fingerprint ciphertext is the ciphertext obtained by encrypting the device fingerprint information of the current cryptographic device using a preset national secret algorithm.

[0121] According to the preset device fingerprint library, the device fingerprint detection algorithm is used to detect the device fingerprint information, and before obtaining the fingerprint detection result of the current password device, the method also includes:

[0122] Use the preset national secret algorithm to decrypt the device fingerprint ciphertext to obtain the device fingerprint information.

[0123] In this embodiment, if the server receives an access request including the device fingerprint ciphertext of the current password device, the server needs to use a preset national secret algorithm to decrypt the device fingerprint ciphertext to obtain the device fingerprint information, and then detect the device fingerprint information to determine the fingerprint detection result of the current password device. If the preset national secret algorithm used when encrypting the device fingerprint information is the SM4 algorithm, the preset national secret algorithm used by the server when decrypting the device fingerprint ciphertext is also the SM4 algorithm.

[0124] The present application embodiment also provides another possible implementation of the cryptographic device discovery method. Figure 6 A sixth flow chart of a method for discovering a cryptographic device provided in an embodiment of the present application is as follows: Figure 6 As shown, according to the preset device fingerprint library, the device fingerprint detection algorithm is used to detect the device fingerprint information to obtain the fingerprint detection result of the current password device, including:

[0125] S601: Use a device fingerprint detection algorithm to parse the device fingerprint information to obtain device fingerprint data.

[0126] S602: Compare the difference between the device fingerprint data and each device fingerprint data in the preset device fingerprint library with a preset threshold value to determine the fingerprint matching result of the current password device.

[0127] In this embodiment, the process of detecting the device fingerprint information by the device fingerprint detection algorithm DF is to parse the device fingerprint information to obtain the device fingerprint data R data , traverse each device fingerprint data in the preset device fingerprint library DB, where each device fingerprint data is represented by F hash,stored ∈DB, calculate R data and F hash,stored The difference T is calculated as follows:

[0128]

[0129] Wherein, D is a preset threshold value. If the difference value T<the preset threshold value D, the match is successful. If the difference value T≥the preset threshold value D, the match fails, thereby obtaining the fingerprint matching result of the current password device. If the match is successful, it is confirmed that the current password device is a registered password device. If the match fails, it is confirmed that the current password device is an unregistered password device.

[0130] In the method provided in the embodiment of the present application, a device fingerprint detection algorithm is used to parse the device fingerprint information to obtain device fingerprint data, and the difference between the device fingerprint data and each device fingerprint data in a preset device fingerprint library is compared with a preset threshold to determine the fingerprint matching result of the current cryptographic device. The device fingerprint detection algorithm is used to parse and compare the submitted device fingerprint information, thereby improving the efficiency and accuracy of device fingerprint comparison and quickly confirming the identity of the current cryptographic device.

[0131] The embodiment of the present application also provides another possible implementation of the cryptographic device discovery method, which further includes:

[0132] If registration events of multiple password devices are monitored, the device fingerprint information of each password device is obtained based on the registration event, and the device fingerprint information of each password device is stored in a preset device fingerprint library.

[0133] If an elimination event of a registered target password device is monitored, the device fingerprint information of the registered target password device is deleted from the preset device fingerprint library.

[0134] In this embodiment, the server pre-designs the structure of the preset device fingerprint library, including fields such as DeviceID (identifier of the cryptographic device), DeviceFingerprint (device fingerprint information of the cryptographic device), RegistrationTime (registration time), etc.

[0135] A monitoring mechanism is established to monitor the registration events and elimination events of cryptographic devices. When the registration events of multiple cryptographic devices are monitored, the device fingerprint information of each cryptographic device is obtained based on the registration event, and the device fingerprint information of each cryptographic device is stored in a preset device fingerprint library. When the elimination event of a registered target cryptographic device is monitored, such as employee resignation, cryptographic device damage, etc., the device fingerprint information of the registered target cryptographic device is deleted from the preset device fingerprint library, thereby realizing dynamic updating of the preset device fingerprint library and ensuring the timeliness and accuracy of the preset device fingerprint library.

[0136] The following is a corresponding explanation of the cryptographic device discovery device and computer device provided by any of the above embodiments of the present application. The specific implementation process and the technical effects produced are the same as those of the corresponding method embodiments mentioned above. For the sake of brief description, the parts not mentioned in this embodiment can refer to the corresponding contents in the method embodiments.

[0137] Figure 7 A functional module diagram of a cryptographic device discovery device provided in an embodiment of the present application. Applied to current cryptographic devices, such as Figure 7 As shown, the cryptographic device discovery apparatus 100 includes:

[0138] The acquisition module 110 is used to respond to the access event triggered by the software application on the current password device and acquire the device feature information of the current password device in multiple dimensions;

[0139] A generating module 120, configured to generate device fingerprint information of the current password device according to device feature information of multiple dimensions;

[0140] The first sending module 130 is used to send an access request to the server of the software application according to the device fingerprint information, and the access request is used to make the server detect the device fingerprint information according to the preset device fingerprint library and the device fingerprint detection algorithm to obtain the fingerprint detection result of the current password device, and the fingerprint detection result is used to indicate whether the current password device is a registered password device, and the preset device fingerprint library stores: device fingerprint information of multiple registered password devices;

[0141] The first receiving module 140 is used to receive a first access response sent by the server. The first access response is an access response triggered when the server determines that the current password device is a registered password device. The first access response is used to indicate that the current password device has resource access rights of the server.

[0142] Optionally, the device feature information of multiple dimensions includes: hardware feature information, software feature information and dynamic environment feature information. The acquisition module 110 is also used to collect the hardware feature information of the current cryptographic device; perform feature scanning on the software application of the current cryptographic device to obtain the software feature information of the current cryptographic device; and perform network environment monitoring on the current cryptographic device to obtain dynamic environment feature information.

[0143] Optionally, the generation module 120 is also used to format the device feature information of multiple dimensions respectively to obtain processed device feature data of multiple dimensions required by a preset format; sort the processed device feature data of multiple dimensions to generate a device feature data string; use a preset secure hash algorithm to perform hash calculation on the device feature data string to obtain device fingerprint information.

[0144] Optionally, the device 100 further includes:

[0145] The encryption module is used to encrypt the device fingerprint information using a preset national secret algorithm to obtain the device fingerprint ciphertext; the access request includes: the device fingerprint ciphertext.

[0146] Optionally, the first receiving module 140 is also used to receive a second access response sent by the server, where the second access response is an access response triggered when the server determines that the current password device is an unregistered password device, and the second access response is used to indicate that the current password device does not have resource access rights of the server; based on the device fingerprint information, a registration request is sent to the server so that the server stores the device fingerprint information in a preset device fingerprint database.

[0147] Figure 8 A functional module diagram of another cryptographic device discovery device provided in an embodiment of the present application. A server applied to a software application, such as Figure 8 As shown, the cryptographic device discovery apparatus 200 includes:

[0148] The second receiving module 210 is used to receive an access request sent by the current password device based on the device fingerprint information of the current password device, where the device fingerprint information is the current password device's response to an access event triggered by a software application on the current password device, obtain device feature information of the current password device in multiple dimensions, and generate device fingerprint information based on the device feature information in multiple dimensions;

[0149] The detection module 220 is used to detect the device fingerprint information according to the preset device fingerprint library and the device fingerprint detection algorithm to obtain the fingerprint detection result of the current password device, and the fingerprint detection result is used to indicate whether the current password device is a registered password device. The preset device fingerprint library stores: device fingerprint information of multiple registered password devices;

[0150] The second sending module 230 is used to send a first access response to the current password device if the current password device is a registered password device, where the first access response is used to indicate that the current password device has the resource access authority of the server.

[0151] Optionally, the access request includes: a device fingerprint ciphertext of the current password device, where the device fingerprint ciphertext is a ciphertext obtained by encrypting the device fingerprint information of the current password device using a preset national secret algorithm;

[0152] The device 200 further includes:

[0153] The decryption module is used to use a preset national secret algorithm to decrypt the device fingerprint ciphertext to obtain the device fingerprint information.

[0154] Optionally, the detection module 220 is further used to adopt a device fingerprint detection algorithm to parse the device fingerprint information to obtain device fingerprint data; compare the difference between the device fingerprint data and each device fingerprint data in a preset device fingerprint library with a preset threshold to determine the fingerprint matching result of the current password device.

[0155] Optionally, the device 200 further includes:

[0156] The monitoring module is used to obtain the device fingerprint information of each password device based on the registration event if it monitors the registration events of multiple password devices, and store the device fingerprint information of each password device in a preset device fingerprint library; if it monitors the elimination event of a registered target password device, the device fingerprint information of the registered target password device is deleted from the preset device fingerprint library.

[0157] The above-mentioned device is used to execute the method provided by the aforementioned embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0158] The above modules may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASICs), or one or more microprocessors, or one or more field programmable gate arrays (FPGAs). For another example, when a module is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0159] Fig. 9 A schematic diagram of a computer device provided in an embodiment of the present application, which can be used for cryptographic device discovery. Fig. 9 As shown, the computer device includes: a processor 310 , a storage medium 320 , and a bus 330 .

[0160] The storage medium 320 stores machine-readable instructions executable by the processor 310. When the computer device is running, the processor 310 communicates with the storage medium 320 via the bus 330, and the processor 310 executes the machine-readable instructions to perform the steps of the above method embodiment. The specific implementation method and technical effect are similar and will not be repeated here.

[0161] Optionally, the present application further provides a storage medium 320, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above method embodiment are executed. The specific implementation method and technical effect are similar and will not be repeated here.

[0162] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0163] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0164] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0165] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (English: Read-Only Memory, abbreviated: ROM), random access memory (English: Random Access Memory, abbreviated: RAM), disk or optical disk and other media that can store program codes.

[0166] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A cryptographic device discovery method, characterized in that: Applied to current cryptographic devices, the method includes: In response to an access event triggered by a software application on the current password device, obtaining device feature information of the current password device in multiple dimensions; Generate device fingerprint information of the current password device according to the device feature information of the multiple dimensions; According to the device fingerprint information, an access request is sent to the server of the software application, wherein the access request is used to enable the server to detect the device fingerprint information according to a preset device fingerprint library and a device fingerprint detection algorithm to obtain a fingerprint detection result of the current password device, wherein the fingerprint detection result is used to indicate whether the current password device is a registered password device, wherein the preset device fingerprint library stores: device fingerprint information of multiple registered password devices; A first access response sent by the server is received, where the first access response is an access response triggered when the server determines that the current password device is a registered password device, and the first access response is used to indicate that the current password device has resource access rights of the server.

2. The method according to claim 1, characterized in that The device feature information in multiple dimensions includes: hardware feature information, software feature information and dynamic environment feature information, and the acquiring of the device feature information in multiple dimensions of the current password device includes: Collecting hardware feature information of the current cryptographic device; Performing feature scanning on the software application of the current cryptographic device to obtain software feature information of the current cryptographic device; The network environment of the current cryptographic device is monitored to obtain the dynamic environment feature information.

3. The method according to claim 1, characterized in that The generating device fingerprint information of the current password device according to the device feature information of the multiple dimensions includes: Formatting the device characteristic information of the multiple dimensions respectively to obtain processed device characteristic data of the multiple dimensions required by a preset format; Sorting the processed device feature data of the multiple dimensions to generate a device feature data string; Use a preset secure hash algorithm to perform hash calculation on the device feature data string to obtain The device fingerprint information.

4. The method according to claim 1, characterized in that Before sending the access request to the server of the software application, the method further includes: The device fingerprint information is encrypted using a preset national secret algorithm to obtain a device fingerprint ciphertext; the access request includes: the device fingerprint ciphertext.

5. The method according to claim 1, characterized in that The method further comprises: receiving a second access response sent by the server, where the second access response is an access response triggered when the server determines that the current password device is an unregistered password device, and the second access response is used to indicate that the current password device does not have resource access rights of the server; According to the device fingerprint information, a registration request is sent to the server, so that the server stores the device fingerprint information in the preset device fingerprint database.

6. A cryptographic device discovery method, characterized in that: Applied to a server of a software application, the method comprises: receiving an access request sent by a current password device based on device fingerprint information of the current password device, wherein the device fingerprint information is a response of the current password device to an access event triggered by a software application on the current password device, obtaining device feature information of the current password device in multiple dimensions, and generating device fingerprint information according to the device feature information in the multiple dimensions; According to the preset device fingerprint library, the device fingerprint information is detected by using the device fingerprint detection algorithm to obtain the fingerprint detection result of the current password device, and the fingerprint detection result is used to indicate whether the current password device is a registered password device, and the preset device fingerprint library stores: device fingerprint information of multiple registered password devices; If the current password device is a registered password device, a first access response is sent to the current password device, where the first access response is used to indicate that the current password device has the resource access permission of the server.

7. The method according to claim 6, characterized in that The access request includes: a device fingerprint ciphertext of the current password device, where the device fingerprint ciphertext is a ciphertext obtained by encrypting the device fingerprint information of the current password device using a preset national secret algorithm; Before detecting the device fingerprint information according to the preset device fingerprint library and using the device fingerprint detection algorithm to obtain the fingerprint detection result of the current password device, the method further includes: The preset national secret algorithm is used to decrypt the device fingerprint ciphertext to obtain the device fingerprint information.

8. The method according to claim 6, characterized in that The device fingerprint information is detected by using a device fingerprint detection algorithm according to a preset device fingerprint library to obtain a fingerprint detection result of the current password device, including: The device fingerprint detection algorithm is used to analyze the device fingerprint information to obtain device fingerprint data; The difference between the device fingerprint data and each device fingerprint data in the preset device fingerprint library is compared with a preset threshold to determine the fingerprint matching result of the current password device.

9. The method according to claim 6, characterized in that The method further comprises: If registration events of multiple password devices are monitored, based on the registration events, device fingerprint information of each password device is obtained, and the device fingerprint information of each password device is stored in the preset device fingerprint library; If an elimination event of a registered target password device is monitored, the device fingerprint information of the registered target password device is deleted from the preset device fingerprint library.

10. A computer device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores program instructions executable by the processor, and when the computer device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to perform the steps of the cryptographic device discovery method as described in any one of claims 1 to 9.

Images