A device access method and apparatus, an authentication server, and a storage medium

Abstract

The application provides a device access method and device, an authentication server and a storage medium. The method comprises: obtaining device verification information corresponding to a device to be accessed; performing device identity verification on the device to be accessed based on the device verification information; receiving user authentication information sent by a user terminal after the device identity verification is passed, wherein the user authentication information is input based on an authentication request sent after the device to be accessed is verified; performing user identity verification based on the user authentication information; generating an authorization token and sending the authorization token to the device to be accessed after the user identity verification is passed, so that the device to be accessed accesses a network based on the authorization token. Through the application, the security of the authentication mechanism can be greatly improved by combining device identity verification and second factor authentication (i.e. user identity verification).

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) technology, and in particular to a device access method, apparatus, authentication server, and storage medium. Background Technology

[0002] The Internet of Things (IoT) originated in the media field. IoT refers to connecting any object to a network through information sensing devices and according to agreed-upon protocols. These objects exchange and communicate information through information transmission media to achieve functions such as intelligent identification, location, tracking, and monitoring.

[0003] With the widespread use of IoT devices, the security of these devices when connecting to the network has become increasingly important. To ensure network security after various devices connect to the network, devices typically need to be authenticated by an authentication server before being allowed to access the network.

[0004] However, most existing authentication processes are single-device authentications, which are relatively insecure and easily exploited by attackers to impersonate legitimate devices or gain network access, leading to data breaches and cybersecurity threats. Summary of the Invention

[0005] This application provides a device access method, apparatus, authentication server, and storage medium to address the problem that the authentication process in the prior art is mostly a single authentication of the device, which has low security and is easily exploited by attackers to access the network by spoofing a legitimate device or impersonating a device, causing data leakage and network security threats.

[0006] Firstly, this application provides a device access method applied to an authentication server, comprising:

[0007] Obtain the device verification information corresponding to the device to be connected;

[0008] The device to be connected is authenticated based on the device verification information.

[0009] After the device authentication is successful, the system receives user authentication information sent by the user terminal, wherein the user authentication information is input based on the authentication request sent after the device to be accessed has been successfully authenticated;

[0010] User authentication is performed based on the aforementioned user authentication information;

[0011] After successful user authentication, an authorization token is generated and sent to the device to be accessed, enabling the device to access the network based on the authorization token.

[0012] In one possible implementation, obtaining the device verification information corresponding to the device to be accessed includes:

[0013] Receive the device identifier sent by the device to be connected;

[0014] A challenge is randomly generated based on the device identifier;

[0015] The challenge is sent to the device to be connected, so that the device to be connected can generate the device verification information by responding to the challenge and feed back the device verification information to the authentication server.

[0016] In one possible implementation, the device verification information includes: encrypted information, a digital signature, and a response content corresponding to the challenge. The device authentication based on the device verification information includes:

[0017] Obtain the public key added by the device to be connected during registration;

[0018] Verify the validity of the encrypted information and the digital signature based on the public key;

[0019] If the encrypted information and the digital signature are found to be valid, determine whether the response content is consistent with the challenge;

[0020] If the response content matches the challenge, the device to be connected is deemed to have passed verification.

[0021] In one possible implementation, the user authentication information includes at least one type of sub-authentication information, and the user authentication based on the user authentication information includes:

[0022] The user feature information uploaded by the user terminal during the user binding process is obtained, wherein the user feature information includes at least one type of user feature;

[0023] If the sub-authentication information of each type is consistent with the user characteristics of the corresponding type, the user authentication is deemed successful.

[0024] In one possible implementation, the step of verifying device authentication further includes:

[0025] Generate a session key;

[0026] The session key is sent to the device to be accessed, so that the device to be accessed carries its own device identifier and the session key when sending the authentication request to the user terminal. After the user terminal verifies the device to be accessed based on the device identifier and the session key, it sends the user authentication information to the authentication server.

[0027] In one possible implementation, sending the session key to the device to be accessed includes:

[0028] Obtain the public key added by the device to be connected during registration;

[0029] The session key is encrypted using the public key;

[0030] The encrypted session key is sent to the device to be accessed. After the device to be accessed decrypts the session key, it sends an authentication request carrying the session key to the user terminal.

[0031] In one possible implementation, after the device to be accessed accesses the network based on the authorization token, it further includes:

[0032] Determine the device type corresponding to the device to be connected;

[0033] Determine the access task corresponding to the device to be accessed based on the device type;

[0034] Grant the access permission corresponding to the device to be accessed according to the access task, so that the device to be accessed can access the network based on the access scope corresponding to the access permission.

[0035] Secondly, this application provides a device access apparatus for use with an authentication server, comprising:

[0036] The information acquisition module is used to acquire device verification information corresponding to the device to be connected;

[0037] The device verification module is used to perform device authentication on the device to be accessed based on the device verification information;

[0038] The information receiving module is used to receive user authentication information sent by the user terminal after the device authentication is successful, wherein the user authentication information is input based on the authentication request sent after the device to be accessed is successfully authenticated;

[0039] The user verification module is used to verify user identity based on the user authentication information.

[0040] The device authorization module is used to generate an authorization token after the user's authentication is successful, and send the authorization token to the device to be accessed, so that the device to be accessed can access the network based on the authorization token.

[0041] In one possible implementation, the information acquisition module is specifically used for:

[0042] Receive the device identifier sent by the device to be connected;

[0043] A challenge is randomly generated based on the device identifier;

[0044] The challenge is sent to the device to be connected, so that the device to be connected can generate the device verification information by responding to the challenge and feed back the device verification information to the authentication server.

[0045] In one possible implementation, the device verification information includes: encrypted information, a digital signature, and a response content corresponding to the challenge; the device verification module is specifically used for:

[0046] Obtain the public key added by the device to be connected during registration;

[0047] Verify the validity of the encrypted information and the digital signature based on the public key;

[0048] If the encrypted information and the digital signature are found to be valid, determine whether the response content is consistent with the challenge;

[0049] If the response content matches the challenge, the device to be connected is deemed to have passed verification.

[0050] In one possible implementation, the user authentication information includes at least one type of sub-authentication information, and the user verification module is specifically used for:

[0051] The user feature information uploaded by the user terminal during the user binding process is obtained, wherein the user feature information includes at least one type of user feature;

[0052] If the sub-authentication information of each type is consistent with the user characteristics of the corresponding type, the user authentication is deemed successful.

[0053] In one possible implementation, the apparatus further includes a key generation module for:

[0054] Generate a session key;

[0055] The session key is sent to the device to be accessed, so that the device to be accessed carries its own device identifier and the session key when sending the authentication request to the user terminal. After the user terminal verifies the device to be accessed based on the device identifier and the session key, it sends the user authentication information to the authentication server.

[0056] In one possible implementation, the key generation module is further configured to:

[0057] Obtain the public key added by the device to be connected during registration;

[0058] The session key is encrypted using the public key;

[0059] The encrypted session key is sent to the device to be accessed. After the device to be accessed decrypts the session key, it sends an authentication request carrying the session key to the user terminal.

[0060] In one possible implementation, the apparatus further includes a permission granting module for:

[0061] Determine the device type corresponding to the device to be connected;

[0062] Determine the access task corresponding to the device to be accessed based on the device type;

[0063] Grant the access permission corresponding to the device to be accessed according to the access task, so that the device to be accessed can access the network based on the access scope corresponding to the access permission.

[0064] Thirdly, this application provides an authentication server, including a processor and a memory, wherein the processor is configured to execute a device access program stored in the memory to implement the device access method described in any one of the first aspects.

[0065] Fourthly, this application provides a storage medium storing one or more programs that can be executed by one or more processors to implement the device access method described in any one aspect of the first application.

[0066] Compared with the prior art, the technical solution provided in this application has the following advantages: The method provided in this application, applied to an authentication server, includes: first, obtaining device verification information corresponding to the device to be accessed, and performing device authentication on the device to be accessed based on the device verification information; after successful device authentication, receiving user authentication information sent by a user terminal, wherein the user authentication information is input based on an authentication request sent after successful authentication by the device to be accessed, and performing user authentication based on the user authentication information; after successful user authentication, generating an authorization token, and sending the authorization token to the device to be accessed, so that the device to be accessed can access the network based on the authorization token. Through this application, device authentication and second-factor authentication (i.e., user authentication) can be combined, significantly improving the security of the authentication mechanism. Even if the device identifier or password is leaked, attackers cannot pass the second-factor authentication, ensuring system security. Attached Figure Description

[0067] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0068] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0069] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0070] Figure 1 A flowchart illustrating an embodiment of a device access method provided in this application;

[0071] Figure 2 A flowchart illustrating another embodiment of the device access method provided in this application;

[0072] Figure 3 A flowchart illustrating another embodiment of the device access method provided in this application;

[0073] Figure 4 This is an overall flowchart of a device access method provided in an embodiment of this application;

[0074] Figure 5A block diagram illustrating an embodiment of a device access device provided in this application;

[0075] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0076] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0077] The following disclosure provides numerous different embodiments or examples for implementing various structures of this application. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of this application. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0078] To address the technical problem that existing authentication processes mostly involve single device authentication, which has relatively low security and is easily exploited by attackers to impersonate legitimate devices or gain network access, leading to data leaks and cybersecurity threats, this application provides a device access method that combines device authentication and second-factor authentication (i.e., user authentication). This significantly improves the security of the authentication mechanism. Even if the device identifier or password is leaked, attackers will still be unable to pass the second-factor authentication, ensuring system security.

[0079] Figure 1 This is a flowchart illustrating an embodiment of a device access method provided in this application. In one embodiment, the method is applied to an authentication server and is applicable to various smart device access scenarios in a smart home system, such as air conditioners, water heaters, and steam ovens. In this application, each smart device is equipped with a local storage unit, a data processing unit, and a communication unit. Figure 1 As shown, the method includes the following steps:

[0080] Step 101: Obtain the device verification information corresponding to the device to be connected.

[0081] The system of this application includes the following main components:

[0082] Device to be connected: IoT (Internet of Things) devices that need to connect to the network.

[0083] Authentication Server: A server responsible for device authentication and two-factor authentication (i.e., user authentication).

[0084] Network Gateway: The entry point for a device to connect to a network, responsible for initial communication encryption and security checks.

[0085] User terminal: A device, such as a smartphone or computer, used by a user to receive and input two-factor authentication information (i.e., user authentication information).

[0086] In practical applications, communication between devices and authentication servers, user terminals and authentication servers, and devices and network gateways is encrypted using TLS (Transport Layer Security) or DTLS (Datagram Transport Layer Security) to prevent data from being eavesdropped on or tampered with.

[0087] The aforementioned device verification information refers to the information uploaded by the user to verify the device's identity.

[0088] Specifically, step 101 may include the following steps:

[0089] Step A1: Receive the device identifier sent by the device to be connected;

[0090] Step A2: Randomly generate a challenge based on the device identifier;

[0091] Step A3: Send the challenge to the device to be connected, so that the device to be connected can generate the device verification information by responding to the challenge and then feed back the device verification information.

[0092] A challenge is a randomly generated string used in the authentication process to verify a user's identity without revealing their password.

[0093] In this implementation, the device to be connected generates a unique device ID and key pair (public and private keys) during manufacturing and registers its public key with the authentication server. After startup, the device sends its device ID to the authentication server. In the challenge-response mechanism, upon receiving the device ID, the authentication server randomly generates a challenge string and sends it to the device to be connected. Upon receiving this challenge, the device responds to the authentication server using a specific algorithm and its private key. This response process may include encrypting, signing, and other processing of the challenge to ensure the authenticity and security of the response. The authentication server verifies the identity of the device based on its response.

[0094] In this scheme, a challenge mechanism can be used to verify the devices to be accessed. In this way, the subsequent authentication server can verify the uniqueness and authenticity of the device identity based on the dual verification mechanism of device identifier and key pair, thus preventing device spoofing and identity impersonation.

[0095] Step 102: Perform device authentication on the device to be accessed based on the device authentication information.

[0096] Device verification information includes encrypted information (including encryption algorithm and key) used to encrypt the challenge, digital signature, and response content corresponding to the challenge.

[0097] In this embodiment of the application, step 102 may specifically include the following steps:

[0098] Step B1: Obtain the public key added by the device to be connected during registration;

[0099] Step B2: Verify the validity of the encrypted information and the digital signature based on the public key;

[0100] Step B3: If the encrypted information and the digital signature are found to be valid, determine whether the response content is consistent with the challenge.

[0101] Step B4: If the response content is consistent with the challenge, determine that the device to be accessed has passed verification.

[0102] In this implementation, after receiving the response (i.e., device verification information) from the device to be connected in response to the "challenge," the authentication server will locate the public key added by the device during registration based on the device identifier and perform verification. The verification includes: encryption verification: checking whether the device verification information uses the correct encryption algorithm and key using the public key; signature verification: using the public key to verify whether the device verification information contains a valid digital signature (i.e., whether it was generated by the private key of the device to be connected), to ensure that the response comes from a legitimate device; and consistency check: verifying whether the response content in the device verification information is consistent with the challenge and has not been tampered with.

[0103] In this scheme, the authentication server can verify the uniqueness and authenticity of the device identity based on a dual verification mechanism of device identifier and key pair, preventing device spoofing and identity impersonation.

[0104] Step 103: After the device authentication is successful, receive the user authentication information sent by the user terminal, wherein the user authentication information is input based on the authentication request sent after the device to be accessed is successfully authenticated.

[0105] Step 104: Perform user authentication based on the user authentication information.

[0106] For ease of understanding, steps 103 and 104 will be explained uniformly below:

[0107] In this embodiment, after successful authentication, the access device sends an authentication request to the user terminal. Upon receiving the authentication request, the user terminal prompts the user to enter pre-set user authentication information and sends the entered information to the authentication server for user authentication.

[0108] Specifically, step 104 may include the following steps: obtaining user feature information uploaded by the user terminal during the user binding process, wherein the user feature information includes at least one type of user feature; and determining that the user authentication is successful when each type of sub-authentication information is consistent with the corresponding type of user feature.

[0109] In this embodiment, user authentication information includes at least one type of sub-authentication information, such as password-type sub-authentication information: OTP (One-Time Password); and biometric-type sub-authentication information: fingerprint recognition information, facial recognition information, etc. Correspondingly, user feature information includes at least one type of user feature, such as password-type user features: OTP (One-Time Password); and biometric-type user features: fingerprint features, facial features, etc.

[0110] In the application, when a user first binds to the user terminal, the user's characteristic information has already been uploaded. Based on this, after receiving the user authentication information sent by the user terminal, the authentication server can compare whether each type of sub-authentication information is consistent with the corresponding type of user characteristics to verify the user's identity. If each type of sub-authentication information is consistent with the corresponding type of user characteristics, the user's identity verification is confirmed to be successful.

[0111] For example, if user authentication information includes a password and a fingerprint, then if the password is the same as the password pre-uploaded by the user terminal, and the fingerprint is the same as the fingerprint pre-uploaded by the user terminal, then the user authentication is confirmed to be successful.

[0112] Step 105: After the user authentication is successful, an authorization token is generated and sent to the device to be accessed, so that the device to be accessed can access the network based on the authorization token.

[0113] In this embodiment, after successful user authentication, the authentication server generates an authorization token and sends it to the device to be accessed. Upon receiving the authorization token, the device sends it to the network gateway to request network access. The network gateway verifies the token's validity (including checking if the token has expired, if it was issued by a legitimate authority, and if the information in the token is correct). If the token verification is successful, the network gateway allows the request, permitting the device to access the network; if verification fails, the network gateway rejects the request and returns an error message. The use of authorization tokens ensures the controllability and traceability of device permissions.

[0114] In the application, after a device connects to the network, it generates a unique fingerprint (a feature or identifier used to uniquely identify the device) each time it connects to the network. This fingerprint is then uploaded to the authentication server. The authentication server verifies the legitimacy of the device by recording and verifying this fingerprint information, thereby detecting and preventing device spoofing and improving network security.

[0115] The technical solution provided in this application embodiment is applied to an authentication server, including: first, obtaining device verification information corresponding to the device to be accessed, and performing device authentication on the device to be accessed based on the device verification information; after successful device authentication, receiving user authentication information sent by a user terminal, wherein the user authentication information is input based on an authentication request sent after successful authentication by the device to be accessed, and performing user authentication based on the user authentication information; after successful user authentication, generating an authorization token, and sending the authorization token to the device to be accessed, so that the device to be accessed can access the network based on the authorization token. Through this application, the security of the authentication mechanism can be significantly improved by combining device authentication and second-factor authentication (i.e., user authentication). Even if the device identifier or password is leaked, attackers still cannot pass the second-factor authentication, ensuring the security of the system.

[0116] Figure 2 A flowchart illustrating another embodiment of the device access method provided in this application. Figure 2 The process shown is in Figure 1 Based on the illustrated process, the following steps are included:

[0117] Step 201: Generate a session key;

[0118] Step 202: Send the session key to the device to be accessed, so that the device to be accessed carries its own device identifier and the session key when sending the authentication request to the user terminal. After the user terminal verifies the device to be accessed based on the device identifier and the session key, it sends the user authentication information to the authentication server.

[0119] For ease of understanding, steps 201 and 202 will be explained uniformly below:

[0120] In this embodiment of the application, after the device authentication is successful, the authentication server can generate a random number as a session key and send the session key to the device to be accessed. This session key is used by the user terminal to verify the uniqueness and authenticity of the device's identity during communication between the device to be accessed and the user terminal.

[0121] Specifically, when the device to be accessed sends an authentication request to the user terminal, it includes its own device identifier and session key. Upon receiving the authentication request, the user terminal requests the device identifier and session key of the verified device from the authentication server. Based on the device identifier and session key returned by the authentication server, the user terminal verifies the device to be accessed. After successful verification, the user terminal prompts the user to enter user authentication information and sends this information to the authentication server. This ensures the uniqueness and authenticity of the device's identity, preventing device spoofing and identity impersonation.

[0122] Furthermore, step 202 may include the following steps:

[0123] Step C1: Obtain the public key added by the device to be connected during registration;

[0124] Step C2: Encrypt the session key using the public key;

[0125] Step C3: Send the encrypted session key to the device to be accessed. After decrypting the session key, the device to be accessed sends an authentication request carrying the session key to the user terminal.

[0126] As described above, in this embodiment, the session key can be encrypted using the public key added by the device to be connected during registration, and the encrypted session key can be sent to the device to be connected. After receiving the encrypted session key, the device to be connected can decrypt it to obtain the session key. This further improves the security of session key transmission.

[0127] Figure 2 In the process shown, the confidentiality and integrity of the communication data between the device and the authentication server can be ensured by using public key encryption and session key encryption mechanisms.

[0128] In another embodiment, when the user terminal sends user authentication information to the authentication server, it can also encrypt the user authentication information, so that the communication data between the user terminal and the authentication server is also protected by encryption, preventing the leakage of sensitive information.

[0129] Figure 3 A flowchart illustrating another embodiment of the device access method provided in this application. Figure 3 The process shown is in Figure 1 Based on the illustrated process, the following steps are included:

[0130] Step 301: Determine the device type corresponding to the device to be connected;

[0131] Step 302: Determine the access task corresponding to the device to be accessed based on the device type;

[0132] Step 303: Grant the access permission corresponding to the device to be accessed according to the access task, so that the device to be accessed can access the network based on the access scope corresponding to the access permission.

[0133] For ease of understanding, steps 301 to 303 will be explained uniformly below:

[0134] Device type is used to characterize the type of device to be connected, such as refrigerator, television, air conditioner, etc.

[0135] In the application, the authentication server pre-configures the access tasks corresponding to each device type, as well as the minimum access permissions for each access task. For example, if the access task for an air conditioner is to adjust the temperature, then the access permissions for the air conditioner are related to adjusting the temperature.

[0136] Based on this, in this embodiment of the application, the access task corresponding to the device to be accessed can be determined according to the device type, and the access permission corresponding to the device to be accessed can be granted according to the access task. In this way, after the device to be accessed accesses the network, it can access the network based on the access range corresponding to the minimum access permission required to complete the task, thereby reducing potential attack surface and security risks.

[0137] Figure 4 This is an overall flowchart of a device access method provided in an embodiment of this application. Figure 4 As shown, the overall process for device access includes the following steps:

[0138] 1. Work Process

[0139] 1.1 Device authentication

[0140] Device registration: During manufacturing, a unique device ID and key pair (public key and private key) are generated for the device, and its public key is registered with the authentication server.

[0141] Device startup: After the device starts up, it sends its device identifier to the authentication server. The authentication server then sends a random challenge to the device, which responds to the challenge.

[0142] Authentication: The authentication server finds the corresponding public key based on the device identifier and uses the public key to verify the response returned by the device.

[0143] After successful verification, the authentication server generates a random number as the session key and encrypts the session key using the device's public key before sending it to the device.

[0144] 1.2 Two-Factor Authentication (2FA)

[0145] User authentication: After successful authentication, the device sends an authentication request to the user terminal, including the device identifier and session key.

[0146] User Confirmation: After receiving the authentication request, the user terminal requires the user to enter pre-set second-factor authentication information (such as a one-time password (OTP) or biometric information).

[0147] Two-factor authentication: The user terminal sends the authentication information entered by the user to the authentication server for verification. After successful verification, the authentication server generates an authorization token and sends it to the device.

[0148] Device access: After receiving the authorization token, the device sends the token to the network gateway. The network gateway verifies the validity of the token and, if successful, allows the device to access the network.

[0149] To facilitate understanding, the device access process is described below through two specific examples:

[0150] Implementation Case 1: Smart Home Device Integration

[0151] Device registration: Smart home devices generate a device identifier and key pair when they leave the factory, and register the public key with the cloud authentication server.

[0152] Device startup: After startup, the device sends its device identifier to the authentication server. The authentication server sends a random challenge to the device, which responds to. After verifying the device's identity, the authentication server generates a session key and sends it to the device.

[0153] User authentication: The device sends an authentication request to the user via a smartphone, and the user enters a one-time password (OTP) for two-factor authentication.

[0154] Device access: After user authentication is successful, the device receives the authorization token, sends the token to the smart home gateway, and accesses the network.

[0155] Implementation Case 2: Industrial IoT Device Access

[0156] Device registration: When industrial equipment leaves the factory, a device identifier and key pair are generated, and the public key is registered with the enterprise's internal authentication server.

[0157] Device startup: After startup, the device sends its device identifier to the authentication server. The authentication server sends a random challenge to the device, which responds to. After verifying the device's identity, the authentication server generates a session key and sends it to the device.

[0158] User authentication: The device sends an authentication request to the user terminal through the enterprise network, and the user performs two-factor authentication through a smart card or biometrics.

[0159] Device access: After user authentication is successful, the device receives the authorization token, sends the token to the enterprise network gateway, and accesses the network.

[0160] This application combines device authentication and second-factor authentication (i.e., user authentication) to significantly improve the security of the authentication mechanism. Even if the device identifier or password is leaked, attackers will still be unable to pass the second-factor authentication, thus ensuring the security of the system.

[0161] Figure 5 This is a block diagram illustrating an embodiment of a device access device provided in this application. (See diagram below.) Figure 5 As shown, the device includes:

[0162] Information acquisition module 51 is used to acquire device verification information corresponding to the device to be connected;

[0163] Device verification module 52 is used to perform device authentication on the device to be accessed based on the device verification information;

[0164] The information receiving module 53 is used to receive user authentication information sent by the user terminal after the device authentication is successful, wherein the user authentication information is input based on the authentication request sent after the device to be accessed is successfully authenticated;

[0165] User verification module 54 is used to verify user identity based on the user authentication information;

[0166] The device authorization module 55 is used to generate an authorization token after the user authentication is successful, and send the authorization token to the device to be accessed, so that the device to be accessed can access the network based on the authorization token.

[0167] In one possible implementation, the information acquisition module is specifically used for:

[0168] Receive the device identifier sent by the device to be connected;

[0169] A challenge is randomly generated based on the device identifier;

[0170] The challenge is sent to the device to be connected, so that the device to be connected can generate the device verification information by responding to the challenge and feed back the device verification information to the authentication server.

[0171] In one possible implementation, the device verification information includes: encrypted information, a digital signature, and a response content corresponding to the challenge; the device verification module is specifically used for:

[0172] Obtain the public key added by the device to be connected during registration;

[0173] Verify the validity of the encrypted information and the digital signature based on the public key;

[0174] If the encrypted information and the digital signature are found to be valid, determine whether the response content is consistent with the challenge;

[0175] If the response content matches the challenge, the device to be connected is deemed to have passed verification.

[0176] In one possible implementation, the user authentication information includes at least one type of sub-authentication information, and the user verification module is specifically used for:

[0177] The user feature information uploaded by the user terminal during the user binding process is obtained, wherein the user feature information includes at least one type of user feature;

[0178] If the sub-authentication information of each type is consistent with the user characteristics of the corresponding type, the user authentication is deemed successful.

[0179] In one possible implementation, the apparatus further includes a key generation module for:

[0180] Generate a session key;

[0181] The session key is sent to the device to be accessed, so that the device to be accessed carries its own device identifier and the session key when sending the authentication request to the user terminal. After the user terminal verifies the device to be accessed based on the device identifier and the session key, it sends the user authentication information to the authentication server.

[0182] In one possible implementation, the key generation module is further configured to:

[0183] Obtain the public key added by the device to be connected during registration;

[0184] The session key is encrypted using the public key;

[0185] The encrypted session key is sent to the device to be accessed. After the device to be accessed decrypts the session key, it sends an authentication request carrying the session key to the user terminal.

[0186] In one possible implementation, the apparatus further includes a permission granting module for:

[0187] Determine the device type corresponding to the device to be connected;

[0188] Determine the access task corresponding to the device to be accessed based on the device type;

[0189] Grant the access permission corresponding to the device to be accessed according to the access task, so that the device to be accessed can access the network based on the access scope corresponding to the access permission.

[0190] The technical solution provided in this application embodiment is applied to an authentication server, including: first, obtaining device verification information corresponding to the device to be accessed, and performing device authentication on the device to be accessed based on the device verification information; after successful device authentication, receiving user authentication information sent by a user terminal, wherein the user authentication information is input based on an authentication request sent after successful authentication by the device to be accessed, and performing user authentication based on the user authentication information; after successful user authentication, generating an authorization token, and sending the authorization token to the device to be accessed, so that the device to be accessed can access the network based on the authorization token. Through this application, the security of the authentication mechanism can be significantly improved by combining device authentication and second-factor authentication (i.e., user authentication). Even if the device identifier or password is leaked, attackers still cannot pass the second-factor authentication, ensuring the security of the system.

[0191] like Figure 6 As shown in the figure, this application provides a device including a processor 111, a communication interface 112, a memory 113, and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114.

[0192] Memory 113 is used to store computer programs;

[0193] In one embodiment of this application, when the processor 111 executes the program stored in the memory 113, it implements the device access method provided in any of the foregoing method embodiments, including:

[0194] Obtain the device verification information corresponding to the device to be connected;

[0195] The device to be connected is authenticated based on the device verification information.

[0196] After the device authentication is successful, the system receives user authentication information sent by the user terminal, wherein the user authentication information is input based on the authentication request sent after the device to be accessed has been successfully authenticated;

[0197] User authentication is performed based on the aforementioned user authentication information;

[0198] After successful user authentication, an authorization token is generated and sent to the device to be accessed, enabling the device to access the network based on the authorization token.

[0199] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the device access method provided in any of the foregoing method embodiments.

[0200] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0201] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software plus a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0202] It should be understood that the terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “described” as used herein may also include the plural forms. The terms “comprising,” “including,” “containing,” and “having” are inclusive and therefore indicate the presence of the stated features, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, elements, components, and / or combinations thereof. The method steps, processes, and operations described herein are not construed as requiring them to be performed in a particular order described or illustrated unless the order of performance is explicitly indicated. It should also be understood that additional or alternative steps may be used.

[0203] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A device access method, characterized by, Applied to an authentication server, the method comprises: obtaining device verification information corresponding to a device to be accessed; performing device identity verification on the device to be accessed based on the device verification information; after the device identity verification is passed, receiving user authentication information sent by a user terminal, wherein the user authentication information is input based on an authentication request sent after the device to be accessed is verified; performing user identity verification based on the user authentication information; after the user identity verification is passed, generating an authorization token and sending the authorization token to the device to be accessed, so that the device to be accessed accesses a network based on the authorization token; wherein, after the device identity verification is passed, it further comprises: generating a session key; sending the session key to the device to be accessed, so that the device to be accessed carries its own device identifier and the session key when sending the authentication request to the user terminal, and the user terminal sends the user authentication information to the authentication server based on the device identifier and the session key after verifying the device to be accessed.

2. The method of claim 1, wherein, The obtaining of the device verification information corresponding to the device to be accessed comprises: receiving a device identifier sent by the device to be accessed; randomly generating a challenge based on the device identifier; sending the challenge to the device to be accessed, so that the device to be accessed generates the device verification information by responding to the challenge and feeds back the device verification information to the authentication server.

3. The method of claim 2, wherein, The device verification information comprises encrypted information, digital signature and response content corresponding to the challenge, and the device identity verification based on the device verification information comprises: obtaining a public key added by the device to be accessed when registering; verifying whether the encrypted information and the digital signature are legal based on the public key; determining whether the response content is consistent with the challenge in the case that the encrypted information and the digital signature are determined to be legal; determining that the device to be accessed is verified in the case that the response content is consistent with the challenge.

4. The method of claim 1, wherein, The user authentication information comprises at least one type of sub-authentication information, and the user identity verification based on the user authentication information comprises: obtaining user feature information uploaded by the user terminal in a user binding process, wherein the user feature information comprises at least one type of user feature; determining that the user identity verification is passed in the case that each type of sub-authentication information is consistent with the corresponding type of user feature.

5. The method of claim 1, wherein, The sending of the session key to the device to be accessed comprises: obtaining a public key added by the device to be accessed when registering; encrypting the session key using the public key; sending the encrypted session key to the device to be accessed, and the device to be accessed sends an authentication request carrying the session key to the user terminal after decrypting the session key.

6. The method of claim 1, wherein, After the device to be accessed accesses the network based on the authorization token, it further comprises: determining a device type corresponding to the device to be accessed; determining an access task corresponding to the device to be accessed according to the device type; According to the access task, the device to be accessed is granted corresponding access permission, so that the device to be accessed accesses the network based on the corresponding access range of the access permission.

7. A device access apparatus, comprising: The application is applied to an authentication server, and the device comprises: An information obtaining module is configured to obtain device verification information corresponding to a device to be accessed; A device verification module is configured to perform device identity verification on the device to be accessed based on the device verification information; An information receiving module is configured to receive user authentication information sent by a user terminal after the device identity verification is passed, wherein the user authentication information is input based on an authentication request sent after the device to be accessed is verified; A user verification module is configured to perform user identity verification based on the user authentication information; A device authorization module is configured to generate an authorization token and send the authorization token to the device to be accessed after the user identity verification is passed, so that the device to be accessed accesses the network based on the authorization token; The device further comprises a key generation module configured to: Generate a session key; Send the session key to the device to be accessed, so that the device to be accessed carries its own device identifier and the session key when sending the authentication request to the user terminal, and the user terminal sends the user authentication information to the authentication server after verifying the device to be accessed based on the device identifier and the session key.

8. An authentication server, characterized by Comprise: A processor and a memory, the processor is used for executing the device access program stored in the memory, to realize the device access method in any one of claims 1-6.

9. A storage medium, characterized by The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to realize the device access method in any one of claims 1-6.

Images