Equipment opening method, device and equipment

Abstract

The invention relates to the field of Internet, and discloses an equipment opening method, device and equipment, and the method comprises the steps: carrying out the broadcasting in a switch local area network according to a first encryption operation code generated based on a first equipment identifier; after the response device verifies the first encryption operation code, receiving a second encryption operation code sent by the response device; performing security verification on the response equipment according to the second encryption operation code; if the security verification of the response device is passed, establishing an encrypted communication channel with the response device; and performing device opening setting on the response device according to the encrypted communication channel. Through the implementation of the scheme, the unique operation code is generated according to the device identifier of the discovery device, the data content in the device discovery process is simplified, the device discovery efficiency is improved, in the device opening setting process, the discovery device and the response device need to be subjected to two-way verification and establish an encrypted communication channel, and the device discovery efficiency is improved. Therefore, the security of the equipment opening setting is improved.

Description

Technical Field

[0001] The present application relates to the field of Internet, and in particular to a method, apparatus and device for activating a device. Background Art

[0002] With the widespread use of switch products, the deployment of switches requires device activation and setting. Switches all have a default IP address, which is the same for all manufacturers. Therefore, there will be IP address conflicts and duplications during activation, and the IP addresses of devices need to be modified one by one. Secondly, the switch LAN plays an important role in modern networks, and it is found that there may be various network security issues between devices and switches during device activation and setting, which may threaten the stability of the entire network and the security of data.

[0003] Therefore, when a discovery device in a switch LAN performs device activation settings on a switch, it is particularly important to ensure the efficiency of device discovery while ensuring the security of device activation settings between the discovery device and the switch. Summary of the invention

[0004] The present application provides a device activation method, apparatus and device, which are used to solve the problem in the related art that efficiency and security cannot be guaranteed at the same time when performing device activation settings on a switch.

[0005] A first aspect of the present application provides a device activation method, which is applied to discovering a device. The device activation method includes: broadcasting in the switch local area network according to a first encryption operation code generated based on the first device identifier; After the responding device in the switch local area network verifies the first encryption operation code, receiving a second encryption operation code sent by the responding device; Performing security verification on the responding device according to the second encryption operation code; If the security verification of the responding device is passed, establishing an encrypted communication channel with the responding device; The responding device is set to be activated according to the encrypted communication channel.

[0006] Optionally, in a first implementation of the first aspect of the present application, the step of broadcasting the first encryption operation code generated based on the first device identifier in the switch local area network includes: generating a first operation code according to the first device identifier and a first target timestamp; Generate a first public key and a first private key by using a preset key generation algorithm; Encrypting the first operation code by using the first private key to generate the first encrypted operation code; The first encryption operation code and the first public key are broadcasted in the switch local area network.

[0007] Optionally, in a second implementation of the first aspect of the present application, the step of performing security verification on the responding device according to the second encryption operation code includes: receiving a second public key sent by the responding device; Decrypting the second encrypted operation code by using the second public key to obtain a second target timestamp corresponding to the second encrypted operation code; Detecting whether a deviation between the second target timestamp and the current time is less than a preset threshold; If the deviation is within the preset threshold, it is determined that the security verification of the responding device has passed.

[0008] Optionally, in a third implementation of the first aspect of the present application, if the security verification of the responding device passes, the step of establishing an encrypted communication channel with the responding device includes: Generate a shared key according to the first private key and the second public key; generating a session key according to the shared key and the first operation code; An encrypted communication channel is established with the responding device based on the session key.

[0009] Optionally, in a fourth implementation of the first aspect of the present application, the session key includes a new session key and an old session key, and the method further includes: generating the new session key according to a preset update period of the first operation code; Encrypting the new session key according to the old session key to generate an encrypted session key; The encrypted session key and encrypted data corresponding to the device activation setting are sent to the responding device.

[0010] A second aspect of the present application provides a device activation method, which is applied to a response device. The device activation method includes: Generate a second public key and a second private key by using a preset key generation algorithm; Receive a first encryption operation code and a first public key sent by a discovery device; Decrypting the first encrypted operation code according to the first public key to obtain a first target timestamp corresponding to the first operation code; Detecting whether the deviation between the first target timestamp and the current time is less than a preset threshold; If the deviation is within the preset threshold, it is determined that the security verification of the discovered device has passed; generating a second operation code according to the second device identifier and the second target timestamp; Encrypting the second operation code according to the second private key to generate a second encrypted operation code; The second encryption operation code and the second public key are sent to the discovery device.

[0011] Optionally, in a first implementation of the second aspect of the present application, the method further includes: Generate a shared key according to the second private key and the first public key; generating an old session key according to the shared key and the first operation code; After receiving the encrypted session key and the encrypted data corresponding to the device activation setting, decrypting the encrypted session key according to the old session key to obtain a new session key; The encrypted data is decrypted according to the new session key to determine the device activation settings.

[0012] A third aspect of the present application provides a device activation apparatus, which is applied to discover a device, and the device activation apparatus includes: A broadcast module, configured to broadcast in the switch local area network according to a first encryption operation code generated based on the first device identifier; A first receiving module, configured to receive a second encryption operation code sent by the responding device in the switch local area network after the responding device in the switch local area network verifies the first encryption operation code; a verification module, configured to perform security verification on the responding device according to the second encryption operation code; An establishing module, configured to establish an encrypted communication channel with the responding device if the security verification of the responding device is passed; A setting module is used to perform device activation settings on the response device according to the encrypted communication channel.

[0013] A fourth aspect of the present application provides a device activation apparatus, which is applied to a response device, and the device activation apparatus includes: A first generating module, used to generate a second public key and a second private key by using a preset key generation algorithm; A second receiving module, used to receive a first encryption operation code and a first public key sent by a discovery device; an acquisition module, configured to decrypt the first encryption operation code according to the first public key, and acquire a first target timestamp corresponding to the first operation code; A detection module, used to detect whether the deviation between the first target timestamp and the current time is less than a preset threshold; A determination module, configured to determine that the security verification of the discovered device has passed if the deviation is within the preset threshold; A second generating module, configured to generate a second operation code according to a second device identifier and a second target timestamp; A third generating module, used for encrypting the second operation code according to a second private key to generate a second encrypted operation code; A sending module is used to send the second encryption operation code and the second public key to the discovery device.

[0014] A fifth aspect of an embodiment of the present application provides an electronic device, comprising a memory and a processor, wherein the processor is used to execute a first computer program or a second computer program stored in the memory, and when the processor executes the first computer program, it implements the steps of the device activation method provided in the first aspect of the embodiment of the present application, and when the processor executes the second computer program, it implements the steps of the device activation method provided in the second aspect of the embodiment of the present application.

[0015] In summary, according to a device activation method, apparatus and device provided by the scheme of the present application, a first encrypted operation code generated based on a first device identifier is broadcast in a switch local area network; after the responding device in the switch local area network verifies the first encrypted operation code, a second encrypted operation code sent by the responding device is received; the responding device is security verified according to the second encrypted operation code; if the security verification of the responding device is passed, an encrypted communication channel is established with the responding device; and the responding device is set up for device activation according to the encrypted communication channel. Through the implementation of the scheme of the present application, a unique operation code is generated according to the device identifier of the discovered device, which simplifies the data content in the device discovery process and improves the efficiency of device discovery. In the device activation setting process, the discovered device and the responding device need to perform two-way verification and establish an encrypted communication channel, thereby improving the security of the device activation setting. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of a flow chart of a device activation method applied to a sending device provided in an embodiment of the present application; Figure 2 A schematic diagram of a flow chart of a device activation method applied to a responding device provided in an embodiment of the present application; Figure 3 A schematic diagram of a program module of a device activation apparatus applied to a sending device provided in an embodiment of the present application; Figure 4 A schematic diagram of a program module of a device activation apparatus for a response device provided in an embodiment of the present application; Figure 5A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to make the purpose, features, and advantages of the invention of this application more obvious and easy to understand, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0018] In order to solve the problem in the related art that it is impossible to ensure both efficiency and security when setting up a switch, the present application embodiment provides a device activation method, such as Figure 1 A schematic diagram of a flow chart of a device activation method for a device discovery method provided in this embodiment, the device activation method includes the following steps: Step 110: Broadcast the first encryption operation code generated based on the first device identifier in the switch local area network.

[0019] Specifically, it should be noted that the discovered device can be a main server for overall operation control in the switch local area network, or it can be a device discovery scanning software used by the administrator. In this embodiment, the device identifier (DeviceIdentifier) ​​is a character or number combination used to uniquely identify and distinguish a specific device. In networks and computer systems, device identifiers play a vital role, as they ensure the correct identification, management, and communication of devices. Device identifiers include but are not limited to MAC addresses, IP addresses, serial numbers, and UUIDs (Universally Unique Identifiers), etc. The operation code is the part of the instruction or field specified in the computer program to perform the operation, usually expressed in code. In actual applications, the first encrypted operation code is generated using a suitable first device identifier according to the device type of the discovered device and broadcasted in the switch local area network, which can effectively improve the efficiency of device discovery.

[0020] In an optional implementation of the present embodiment, the step of broadcasting the first encryption operation code generated based on the first device identifier in the switch local area network includes: generating the first operation code according to the first device identifier and the first target timestamp; generating the first public key and the first private key by a preset key generation algorithm; encrypting the first operation code by the first private key to generate the first encryption operation code; broadcasting the first encryption operation code and the first public key in the switch local area network.

[0021] Specifically, the first target timestamp represents the timestamp corresponding to when the discovery device generates the first operation code. In this embodiment, the unique identifier (Device ID) of the device is obtained. This identifier is used to uniquely identify the device in the network. The current timestamp is obtained to ensure the timeliness and uniqueness of the operation code. The device identifier and timestamp are combined, and a secure hash algorithm (such as SHA-256) is used to perform a hash operation on the combined data to generate the first operation code, where the current timestamp can be replaced by any random number. Whether it is a timestamp or a random number, its purpose is to generate a unique operation code. The operation code has an obvious identification function and effectively improves the efficiency of device discovery. Secondly, select a suitable asymmetric encryption algorithm, such as the elliptic curve encryption algorithm (ECC), and generate a public-private key pair (Public Key PK i , Private Key SK i ), set the elliptic curve parameters E and base point G, elliptic curve equation (a, b): y 2 =x 3 +ax+b(mod p), Where p is a large prime number, and the base point G is a point on the elliptic curve (G x , G y ).

[0022] Generate the private key of the discovered device based on elliptic curve encryption : ∈{1,2,…,n−1}, Calculate the public key of the discovered device : , A unique opcode is generated using a secure hash function based on the device identifier and timestamp, and the opcode is encrypted using a private key to obtain a first encrypted opcode. First, an opcode is generated using a secure hash function (such as SHA-256) OpCode : , in, T i is the current timestamp, H is the hash function, To discover the device identifier corresponding to the device, use the device private key to sign the operation code to obtain the first encrypted operation code EncOpCode : , Finally, the obtained first encryption operation code and the first public key of the discovered device are broadcasted in the switch local area network to start device discovery.

[0023] Step 120: After the responding device in the switch local area network verifies the first encryption operation code, a second encryption operation code sent by the responding device is received.

[0024] Specifically, in this embodiment, the responding device includes but is not limited to a switch in a switch local area network. The switch in the local area network uses the first public key contained in the broadcast to decrypt the received first encryption operation code, extracts the first operation code and the corresponding first target timestamp, and verifies the first operation code according to the current timestamp information. If the verification passes, a second encryption operation code and a second public key are generated according to an encryption method similar to that of the discovery device, and the second encryption operation code and the second public key are sent to the discovery device. At this time, the discovery device receives the second encryption operation code and the second public key sent by the responding device.

[0025] Step 130: Perform security verification on the responding device according to the second encryption operation code; Step 140: If the security verification of the responding device is passed, an encrypted communication channel is established with the responding device.

[0026] Specifically, in this embodiment, after receiving the second encryption operation code, the discovery device also needs to perform security verification on the response device according to the second encryption operation code and the second key. This process is mainly to verify whether the operation code has been tampered with during the transmission process and whether the device corresponding to the first encryption operation code or the second encryption operation code is a legal device. If the security verification of the response device is also passed, both the discovery device and the response device can determine that the other party is a legal device, that is, the discovery device determines that the response device is a switch to be set in the switch local area network, and the response device can determine that the discovery device is a discovery device that is setting itself, so the two parties establish an encrypted communication channel to ensure the security of data transmission during the subsequent setting process.

[0027] In an optional implementation of this embodiment, the step of performing security verification on the responding device according to the second encryption operation code includes: receiving a second public key sent by the responding device; The second encryption operation code is decrypted by the second public key to obtain the second target timestamp corresponding to the second encryption operation code; whether the deviation between the second target timestamp and the current time is less than a preset threshold is detected; if the deviation is within the preset threshold, it is determined that the security verification of the responding device has passed.

[0028] Specifically, in this embodiment, when the discovery device receives the second encryption operation code, it also receives the second public key sent by the response device, and uses the second public key to decrypt the second encryption operation code: , in, PK j represents the second public key of the responding device, EncOpCode j The second encryption operation code of the response body, OpCoder j It is represented as the second operation code of the responding device, and D is the decryption algorithm corresponding to the elliptic curve encryption algorithm, such as ECDSA (Elliptic Curve Digital Signature Algorithm). It can be understood that the generation principle of the second encryption operation code of the responding device is consistent with the generation principle of the first operation code of the discovery device. Therefore, the second operation code also includes the second target timestamp corresponding to the generation of the second operation code. The second target timestamp is verified according to the timestamp corresponding to the reception of the second encryption operation code: , in, is the current time, is the received target timestamp, is a preset threshold of the timestamp deviation. If the deviation between the current time and the timestamp is within the preset threshold, it is determined that the security verification of the responding device has passed.

[0029] In an optional implementation of this embodiment, if the security verification of the responding device is passed, the step of establishing an encrypted communication channel with the responding device includes: generating a shared key based on the first private key and the second public key; generating a session key based on the shared key and the first operation code; and establishing an encrypted communication channel with the responding device based on the session key.

[0030] Specifically, in this embodiment, asymmetric encryption is used to negotiate the key of the encrypted communication channel. During the broadcast of the discovery device and the response of the responding device, the respective public keys have been exchanged during the identity authentication process, and the integrity and authenticity of the public keys are guaranteed by digital signatures. Therefore, during the key negotiation process, such as the elliptic curve key exchange algorithm, the discovery device can generate a shared key based on the first private key and the second public key corresponding to the responding device. Similarly, the responding device can generate a shared key based on the second private key and the first public key of the discovery device. The communicating parties can negotiate to generate a shared key without directly transmitting the key, thereby ensuring the security of communication. Afterwards, a session key is generated based on the shared key and the first operation code through a hash algorithm or a one-way hash function. The session key generated with the first operation code as the salt value can further enhance the randomness of the key. It can be understood that the first operation code used to generate the session key has been sent to the responding device during the broadcast. Therefore, the responding device can also generate a session key based on the first operation code and the shared key, and establish an encrypted communication channel between the two parties based on the session key.

[0031] In an optional implementation of the present embodiment, in order to further improve the security of the encrypted communication channel, the session key is continuously updated during the communication process of the encrypted communication channel. It can be understood that the shared key generated by the private key itself and the other party's public key is an asymmetric key. The asymmetric key itself is relatively long and has a large computational overhead, which is not convenient for frequent updates. However, the generated session key can be used as an initial symmetric key. Therefore, the session key can be updated within a preset update cycle, and the currently updated new session key is encrypted by the old session key to generate an encrypted session key. During the communication process between the discovery device and the response device, the encrypted session key and the encrypted data corresponding to the device activation setting are sent to the response device together. The response device can decrypt the encrypted session key by the previous old session key to obtain a new session key, and decrypt the encrypted data according to the new session key to obtain the data information corresponding to the device activation setting.

[0032] Step 150: Perform device activation settings on the responding device according to the encrypted communication channel.

[0033] Specifically, in this embodiment, the first encrypted operation code sent by the discovery device includes a search message for an unset switch. If feedback information is received from the responding device, it is determined that the responding device is a set switch. Therefore, after the encrypted communication channel is established, the discovery device sends a configuration message to the responding device. The message definition is as follows: | Opcode(1) | reserved(1) | requestID(1) | devaddr | ipaddr(1) | mask(1) | gateway(1) |, Opcode(1) is 0x02, indicating a configuration request message. Reserved(1) is 0x00. RequestID(1) is set by the client and increases from 0x0001. Devaddr is the MAC address of the switch to be configured. IPaddr(1), mask(1), and gateway(1) are the switch configurations to be set.

[0034] After receiving the configuration message, the responding device will send a response message to the discovering device: | Opcode(2) | reserved(2) | requestID(2) | status | reserved2 |ipaddr(2) | mask(2) | gateway(2) |, Opcode(2) is 0x03, indicating a configuration response message. Reserved(2) is 0x00. requestID(2) corresponds to the request message value. Status is the status response: 0x00 indicates success. Reserved2 is 0x00. ipaddr(2), mask(2), and gateway(2) are the returned switch information.

[0035] In an optional implementation of this embodiment, in order to further ensure the security and reliability of the device discovery broadcast process, in this embodiment, an initial reflection sequence is generated based on the device identifier: , in, Expressed as the initial reflection polynomial, It is represented as the i-th bit of the device identifier, x is the reflection variable, and n is the polynomial order. That is, the initial reflection sequence can be understood as splitting the device identifier ID bit by bit into , perform polynomial calculations on each bit: , accumulate all items and take the modulus of the prime number p to obtain the final initial reflection polynomial. The initial reflection sequence can prevent the device identifier from being directly exposed and increase the complexity of the identification information.

[0036] Generate a dynamic reflection sequence by iteratively calculating the initial reflection sequence: , in, Represented as the reflection sequence of the n+1th iteration, It is represented as the reflection sequence of the nth iteration. It can be understood that when n is equal to 0, That is, it is identified as the initial reflection sequence, H represents the hash function, is the timestamp, It is an XOR operation.

[0037] Combine the reflected sequence to generate enhanced opcodes: , in, is a message authentication code based on the key K, G is a reflection sequence mapping function, and is determined by calculating the first encryption operation code and the reflection sequence The value is multiplied by the mapping value of the previous reflection sequence to obtain the enhanced operation code.

[0038] Reflection sequence obfuscation for enhanced opcodes: , Where M is the confusion matrix function, is the encryption function, is the random seed, For the tensor product operation, according to the reflection sequence Generate a confusion matrix M, perform a tensor product operation on the enhanced opcode and the confusion matrix, add an encrypted random seed for final obfuscation, increase the complexity of the opcode, and prevent the opcode from being reverse analyzed.

[0039] Broadcast the operation code in segments according to the reflection sequence characteristics: ), in, is the i-th broadcast segment, is the i-th segment of the operation code, is the i-th segment of the reflection sequence, For the timestamp, it can be understood that the final operation code is segmented according to specific rules, a corresponding reflection sequence part is assigned to each segment, and timestamp information is added to generate a segmented broadcast packet, thereby reducing the amount of data for a single broadcast and optimizing the broadcast transmission efficiency.

[0040] Figure 2 A schematic diagram of a flow chart of a device activation method applied to a responding device provided in this embodiment, wherein the device activation method comprises the following steps: Step 210: Generate a second public key and a second private key using a preset key generation algorithm; Step 220: Receive a first encryption operation code and a first public key sent by the discovery device; Step 230: decrypt the first encrypted operation code according to the first public key to obtain a first target timestamp corresponding to the first operation code; Step 240: Detect whether the deviation between the first target timestamp and the current time is less than a preset threshold; Step 250: If the deviation is within the preset threshold, it is determined that the security verification of the discovery device has passed; Step 260: Generate a second operation code according to the second device identifier and the second target timestamp; Step 270: Encrypt the second operation code according to the second private key to generate a second encrypted operation code; Step 280: Send the second encryption operation code and the second public key to the discovery device.

[0041] Specifically, in this embodiment, it should be noted that all switches in the switch LAN belong to the same type of product, so there are preset keys and operation code settings at the initial stage of the device, and the second public key and the second private key are generated by the same key generation algorithm as the discovery device. After receiving the first encrypted operation code and the first public key sent by the discovery device, the first encrypted operation code is decrypted in a decryption method consistent with the discovery device. The decryption formula is as follows: , After decryption is completed, the first target timestamp corresponding to the first operation code is extracted, and the timeliness of the first operation code is verified according to the current time when the first encrypted operation code is received, that is, if the deviation between the current time and the first target timestamp is less than the preset threshold, the first operation code is determined to be valid, that is, the security verification of the discovery device is passed, otherwise it is necessary to feedback invalid information to the discovery device, and notify the discovery device to send the first encrypted operation code again. After the security verification of the discovery device is passed, the second operation code is generated in the same way as the discovery device according to the second device identifier and the second target timestamp of the responding device itself, and the second operation code is further encrypted with the second private key to generate a second encrypted operation code, and the second encrypted operation code and the second public key are sent to the discovery device. At this point, the discovery response of the responding device to the discovery device is completed.

[0042] In an optional implementation of this embodiment, in the encrypted communication channel, at the responding device end, the responding device can generate a shared key based on the second private key and the first public key elliptic curve key exchange algorithm sent by the discovery device. It should be noted that, according to the properties of the elliptic curve, the shared keys generated by both parties are the same, and the responding device end has received the first operation code sent by the discovery device. Therefore, after the shared key is generated, the shared key can be further generated through a hash algorithm or a one-way hash function according to the first operation code. However, the session key at this time is outdated, and it is necessary to wait for the discovery device to send an encrypted session key, decrypt the encrypted session key according to the old session key, obtain a new session key, and then decrypt the encrypted data sent by the discovery device according to the new session key to determine its corresponding device activation settings. It should be noted that the old session key used to decrypt the encrypted session key is completely generated in the responding device, so even if the data sent by the discovery device in the encrypted communication channel is illegally intercepted, the data cannot be decrypted, thereby effectively protecting the security of data transmission.

[0043] In an optional implementation of this embodiment, when the responding device receives the segmented broadcast sent by the discovering device, it needs to verify the integrity of the received reflection sequence: , in, To verify the result, a hash value is calculated for each reflection sequence, and the cumulative product of the hash values ​​in each broadcast packet is calculated and compared with the hash value of the final reflection sequence to verify the integrity of the reflection sequence in the broadcast received by the responding device, thereby determining whether the data has been tampered with during the transmission process. If there is no problem with the final verification result, the second device identifier and the second operation code of the responding device are combined with the reflection sequence algorithm used when the discovery device is broadcast to respond to the discovered device. Similarly, the reflection sequence algorithm can be applied not only to the broadcast and response stages of device discovery, but also to the encrypted transmission stage of device activation settings to further protect the security of data transmission.

[0044] According to a device activation method provided by the scheme of the present application, a first encrypted operation code generated based on a first device identifier is broadcasted in a switch local area network; after the responding device in the switch local area network verifies the first encrypted operation code, a second encrypted operation code sent by the responding device is received; the responding device is security verified according to the second encrypted operation code; if the security verification of the responding device is passed, an encrypted communication channel is established with the responding device; and the responding device is set up for device activation according to the encrypted communication channel. Through the implementation of the scheme of the present application, a unique operation code is generated according to the device identifier of the discovered device, which simplifies the data content in the device discovery process and improves the efficiency of device discovery. In the device activation setting process, the discovered device and the responding device need to perform two-way verification and establish an encrypted communication channel, thereby improving the security of the device activation setting.

[0045] Figure 3 A device activation device provided in an embodiment of the present application is applied to discovering a device. The device activation device can be used to implement the device activation method applied to discovering a device in the above-mentioned embodiment. Figure 3 As shown, the device activation device mainly includes: A broadcast module 10, configured to broadcast in the switch local area network according to a first encryption operation code generated based on a first device identifier; The first receiving module 20 is used to receive the second encryption operation code sent by the responding device after the responding device of the switch local area network verifies the first encryption operation code; A verification module 30, configured to perform security verification on the responding device according to the second encryption operation code; Establishing module 40, for establishing an encrypted communication channel with the responding device if the security verification of the responding device is passed; The setting module 50 is used to perform device activation settings for the responding device according to the encrypted communication channel.

[0046] In an optional implementation of the present embodiment, the broadcast module is specifically used to: generate a first operation code according to a first device identifier and a first target timestamp; generate a first public key and a first private key by a preset key generation algorithm; encrypt the first operation code by the first private key to generate a first encrypted operation code; broadcast the first encrypted operation code and the first public key in the switch local area network.

[0047] In an optional implementation of the present embodiment, the verification module is specifically used to: receive a second public key sent by a responding device; decrypt a second encryption operation code by using the second public key to obtain a second target timestamp corresponding to the second encryption operation code; detect whether the deviation between the second target timestamp and the current time is less than a preset threshold; if the deviation is within the preset threshold, it is determined that the security verification of the responding device has passed.

[0048] In an optional implementation of this embodiment, the establishment module is specifically used to: generate a shared key based on the first private key and the second public key; generate a session key based on the shared key and the first operation code; and establish an encrypted communication channel with the responding device based on the session key.

[0049] In an optional implementation of this embodiment, the device activation apparatus further includes: a fourth generation module and a second sending module. The fourth generation module is used to: generate a new session key according to a preset update period of the first operation code; encrypt the new session key according to the old session key to generate an encrypted session key. The second sending module is used to: send the encrypted session key and encrypted data corresponding to the device activation setting to the responding device.

[0050] Figure 4 A device activation device provided in an embodiment of the present application is applied to a response device. The device activation device can be used to implement the device activation method applied to the response device in the above embodiment. Figure 4 As shown, the device activation device mainly includes: A first generating module 60, configured to generate a second public key and a second private key by using a preset key generating algorithm; The second receiving module 70 is used to receive a first encryption operation code and a first public key sent by the discovery device; An acquisition module 80, configured to decrypt the first encrypted operation code according to the first public key, and acquire a first target timestamp corresponding to the first operation code; A detection module 90, configured to detect whether a deviation between the first target timestamp and the current time is less than a preset threshold; A determination module 100, configured to determine that the security verification of the discovery device has passed if the deviation is within a preset threshold; A second generating module 110, configured to generate a second operation code according to a second device identifier and a second target timestamp; A third generating module 120, configured to encrypt the second operation code according to the second private key to generate a second encrypted operation code; The sending module 130 is configured to send the second encryption operation code and the second public key to the discovery device.

[0051] In an optional implementation of this embodiment, the generating module is further used to: generate a shared key according to the second private key and the first public key; and generate an old session key according to the shared key and the first operation code. The acquiring module is further used to: after receiving the encrypted session key and the encrypted data corresponding to the device activation setting, decrypt the encrypted session key according to the old session key to obtain a new session key. The determining module is further used to: decrypt the encrypted data according to the new session key to determine the device activation setting.

[0052] According to a device activation device provided by the scheme of the present application, a first encrypted operation code generated based on a first device identifier is broadcasted in the switch local area network; after the responding device in the switch local area network verifies the first encrypted operation code, a second encrypted operation code sent by the responding device is received; the responding device is security verified according to the second encrypted operation code; if the security verification of the responding device is passed, an encrypted communication channel is established with the responding device; and the responding device is set up for device activation according to the encrypted communication channel. Through the implementation of the scheme of the present application, a unique operation code is generated according to the device identifier of the discovered device, which simplifies the data content in the device discovery process and improves the efficiency of device discovery. In the device activation setting process, the discovered device and the responding device need to perform two-way verification and establish an encrypted communication channel, thereby improving the security of the device activation setting.

[0053] According to the application plan provided Figure 5 An electronic device is provided in an embodiment of the present application. The electronic device can be used to implement the device activation method in the above embodiment, mainly including: A memory 501, a processor 502, and a computer program 503 stored in the memory 501 and executable on the processor 502, the memory 501 and the processor 502 are connected via communication. When the processor 502 executes the computer program 503, the device activation method in the aforementioned embodiment is implemented. The number of processors may be one or more.

[0054] The memory 501 may be a high-speed random access memory (RAM) memory, or a non-volatile memory (non-volatile memory), such as a disk memory. The memory 501 is used to store executable program codes, and the processor 502 is coupled to the memory 501 .

[0055] Furthermore, the present application also provides a computer-readable storage medium, which may be provided in the electronic device in the above embodiments. Figure 5 Memory in the illustrated embodiment.

[0056] The computer readable storage medium stores a computer program, and when the program is executed by the processor, the device activation method in the aforementioned embodiment is implemented. Furthermore, the computer storable medium can also be a U disk, a mobile hard disk, a read-only memory (ROM), a RAM, a magnetic disk or an optical disk, and other media that can store program codes.

[0057] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0058] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0059] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A device activation method, applied to discovering a device, characterized in that: include: broadcasting in the switch local area network according to a first encryption operation code generated based on the first device identifier; After the responding device in the switch local area network verifies the first encryption operation code, receiving a second encryption operation code sent by the responding device; Performing security verification on the responding device according to the second encryption operation code; If the security verification of the responding device is passed, establishing an encrypted communication channel with the responding device; The responding device is set to be activated according to the encrypted communication channel.

2. The device activation method according to claim 1, characterized in that: The step of broadcasting the first encryption operation code generated based on the first device identifier in the switch local area network includes: generating a first operation code according to the first device identifier and a first target timestamp; Generate a first public key and a first private key by using a preset key generation algorithm; Encrypting the first operation code by using the first private key to generate the first encrypted operation code; The first encryption operation code and the first public key are broadcasted in the switch local area network.

3. The device activation method according to claim 2, characterized in that: The step of performing security verification on the responding device according to the second encryption operation code comprises: receiving a second public key sent by the responding device; Decrypting the second encrypted operation code by using the second public key to obtain a second target timestamp corresponding to the second encrypted operation code; Detecting whether a deviation between the second target timestamp and the current time is less than a preset threshold; If the deviation is within the preset threshold, it is determined that the security verification of the responding device has passed.

4. The device activation method according to claim 3, characterized in that: If the security verification of the responding device is passed, the step of establishing an encrypted communication channel with the responding device comprises: Generate a shared key according to the first private key and the second public key; generating a session key according to the shared key and the first operation code; An encrypted communication channel is established with the responding device based on the session key.

5. The device activation method according to claim 4, characterized in that: The session key includes a new session key and an old session key, and the method further includes: generating the new session key according to a preset update period of the first operation code; Encrypting the new session key according to the old session key to generate an encrypted session key; The encrypted session key and encrypted data corresponding to the device activation setting are sent to the responding device.

6. A device activation method, applied to a response device, characterized in that: include: Generate a second public key and a second private key by using a preset key generation algorithm; Receive a first encryption operation code and a first public key sent by a discovery device; Decrypting the first encrypted operation code according to the first public key to obtain a first target timestamp corresponding to the first operation code; Detecting whether the deviation between the first target timestamp and the current time is less than a preset threshold; If the deviation is within the preset threshold, it is determined that the security verification of the discovered device has passed; generating a second operation code according to the second device identifier and the second target timestamp; Encrypting the second operation code according to the second private key to generate a second encrypted operation code; The second encryption operation code and the second public key are sent to the discovery device.

7. The device activation method according to claim 6, characterized in that: The method further comprises: Generate a shared key according to the second private key and the first public key; generating an old session key according to the shared key and the first operation code; After receiving the encrypted session key and the encrypted data corresponding to the device activation setting, decrypting the encrypted session key according to the old session key to obtain a new session key; The encrypted data is decrypted according to the new session key to determine the device activation settings.

8. A device activation device, used for discovering a device, characterized in that: The equipment activation device comprises: A broadcast module, configured to broadcast in the switch local area network according to a first encryption operation code generated based on the first device identifier; A first receiving module, configured to receive a second encryption operation code sent by the responding device in the switch local area network after the responding device in the switch local area network verifies the first encryption operation code; a verification module, configured to perform security verification on the responding device according to the second encryption operation code; An establishing module, configured to establish an encrypted communication channel with the responding device if the security verification of the responding device is passed; A setting module is used to perform device activation settings on the response device according to the encrypted communication channel.

9. A device activation device, applied to a response device, characterized in that: The equipment activation device comprises: A first generating module, used to generate a second public key and a second private key by using a preset key generation algorithm; A second receiving module, used to receive a first encryption operation code and a first public key sent by a discovery device; an acquisition module, configured to decrypt the first encrypted operation code according to the first public key, and acquire a first target timestamp corresponding to the first operation code; A detection module, used to detect whether the deviation between the first target timestamp and the current time is less than a preset threshold; A determination module, configured to determine that the security verification of the discovered device has passed if the deviation is within the preset threshold; A second generating module, configured to generate a second operation code according to a second device identifier and a second target timestamp; A third generating module, used for encrypting the second operation code according to a second private key to generate a second encrypted operation code; A sending module is used to send the second encryption operation code and the second public key to the discovery device.

10. An electronic device, characterized in that: The device comprises a memory and a processor, wherein: The processor is configured to execute a first computer program or a second computer program stored on the memory; When the processor executes the computer program, the steps in the device activation method described in any one of claims 1 to 5 are implemented; when the processor executes the computer program, the steps in the device activation method described in any one of claims 6 to 7 are implemented.

Images