Equipment authentication method and device, electronic equipment and storage medium

Abstract

The invention relates to an equipment authentication method and device, electronic equipment and a storage medium. The method comprises the steps that the intelligent device sends first authentication information and a device public key to the server, the first authentication information comprises certificate information of the intelligent device, the server sends second authentication information and a server public key to the intelligent device under the condition that verification of the first authentication information is passed, the second authentication information at least comprises a server signature of the server, and the server signature of the server is sent to the intelligent device; the server signature is generated based on the equipment public key; the intelligent device receives second authentication information and a server public key sent by the server, when the second authentication information passes verification, a device signature is sent to the server, the device signature is generated based on the server public key, and the server verifies the device signature. The intelligent device and the server perform authentication based on the authentication information and the signature of the opposite side, and mutually confirm the legal identity of the opposite side, so that the attack of the external device can be avoided, and the security in the communication process is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a device authentication method, apparatus, electronic device and storage medium. Background Art

[0002] PLC (Power Line Communication) is a communication method that uses power lines to transmit data. PLC-IoT (Power Line Communication Internet of Things) is a power line carrier communication technology for IoT scenarios. PLC-IoT effectively solves the problems of power line signal interference and attenuation. In IoT scenarios, in order to ensure the security of communication, devices in the IoT system need to be authenticated. Summary of the invention

[0003] In order to overcome the problems existing in the related art, the present disclosure provides a device authentication method, apparatus, electronic device and storage medium.

[0004] According to a first aspect of an embodiment of the present disclosure, a device authentication method is provided, which is applied to a smart device, and the method includes:

[0005] Sending first authentication information and a device public key to a server, wherein the first authentication information includes certificate information of the smart device, and the server is configured to send second authentication information and a server public key to the smart device if the first authentication information is verified successfully, wherein the second authentication information includes at least a server signature of the server, and the server signature is generated based on the device public key;

[0006] Receiving the second authentication information and the server public key sent by the server;

[0007] When the second authentication information is verified, a device signature is sent to the server, where the device signature is generated based on the server public key, and the server is used to verify the device signature.

[0008] In some embodiments, when the second authentication information is verified, sending the device signature to the server includes:

[0009] Perform key negotiation based on the server public key to generate a shared key;

[0010] Verifying the server signature;

[0011] When the server signature verification passes, the shared key is signed to obtain the device signature, and the device signature is sent to the server.

[0012] In some embodiments, verifying the server signature includes:

[0013] The server signature is verified based on the server public key and the shared secret key.

[0014] In some embodiments, before sending the first authentication information and the device public key to the server, the method further includes:

[0015] Send device information to a gateway device, wherein the device information includes at least binding information of the smart device, wherein the binding information is used to indicate whether the smart device is in a binding state, wherein the binding state is used to indicate that the smart device has been bound to an account, and wherein the gateway device is used to send an acquisition request to the smart device when the smart device is in an unbound state, wherein the acquisition request is used to request to obtain the first authentication information and the device public key.

[0016] According to a second aspect of an embodiment of the present disclosure, a device authentication method is provided, which is applied to a server, and the method includes:

[0017] Receiving first authentication information and a device public key of a smart device, wherein the first authentication information includes certificate information of the smart device;

[0018] When the first authentication information is verified, second authentication information and a server public key are sent to the smart device, wherein the second authentication information at least includes a server signature of the server, and the server signature is generated based on the device public key; wherein the smart device is used to send a device signature to the server when the second authentication information is verified, and the device signature is generated based on the server public key;

[0019] The device signature is received and verified.

[0020] In some embodiments, when the first authentication information is verified, sending the second authentication information and the server public key to the smart device includes:

[0021] verifying the first authentication information;

[0022] When the first authentication information is verified, generating the server public key and the corresponding server private key;

[0023] Based on the device public key, generating the server signature;

[0024] The server signature and the server public key are sent to the smart device.

[0025] In some embodiments, generating the server signature based on the device public key includes:

[0026] Perform key negotiation based on the device public key to generate a shared key;

[0027] The shared key is signed to obtain the server signature.

[0028] In some embodiments, verifying the device signature includes:

[0029] The device signature is verified based on the device public key and the shared secret key.

[0030] In some embodiments, before receiving the first authentication information and the device public key of the smart device, the method further includes:

[0031] Receive a device authentication notification sent by a terminal device, wherein the device authentication notification is used to instruct the server and the smart device to perform mutual authentication, and the device authentication notification is sent by the terminal device when a binding operation is detected, and the binding operation is used to bind a target account logged in to the terminal device with the smart device.

[0032] In some embodiments, after receiving and verifying the device signature, the method further includes:

[0033] When the device signature verification passes, an authentication pass notification is sent to the terminal device, and the terminal device is used to bind the smart device to the target account in response to the authentication pass notification.

[0034] According to a third aspect of an embodiment of the present disclosure, a device authentication method is provided, which is applied to a gateway device, and the method includes:

[0035] Sending first authentication information and a device public key to a server, wherein the first authentication information includes certificate information of a smart device, the server is used to receive the first authentication information and the device public key, and when the first authentication information is verified, sending second authentication information and a server public key to the gateway device, wherein the second authentication information includes a server signature of the server, and the server signature is generated based on the device public key;

[0036] Sending the received second authentication information and the server public key to the smart device, the smart device is used to receive the second authentication information and the server public key, and when the second authentication information is verified, sending a device signature to the gateway device, the device signature is generated based on the server public key;

[0037] The received device signature is sent to the server, and the server is used to verify the device signature.

[0038] In some embodiments, before sending the first authentication information and the device public key to the server, the method further includes:

[0039] Receiving device information sent by the smart device, the device information at least including binding information of the smart device, the binding information is used to indicate whether the smart device is in a binding state, and the binding state is used to indicate that the smart device has been bound to an account;

[0040] When the smart device is in an unbound state, sending an acquisition request to the smart device, where the acquisition request is used to request to acquire the first authentication information and the device public key;

[0041] Receive the first authentication information and the device public key sent by the smart device.

[0042] According to a fourth aspect of an embodiment of the present disclosure, a device authentication method is provided, which is applied to a terminal device, and the method includes:

[0043] In response to detecting a binding operation, sending a device authentication notification to the server, wherein the binding operation is used to bind a target account for logging into the terminal device to a smart device, and the device authentication notification is used to instruct the server to perform mutual authentication with the smart device;

[0044] In response to receiving the authentication success notification sent by the server, the smart device is bound to the target account.

[0045] According to a fifth aspect of an embodiment of the present disclosure, a device authentication method is provided, which is applied to an Internet of Things system, wherein the Internet of Things system includes a smart device and a server, and the method includes:

[0046] The server receives first authentication information and a device public key of the smart device, and sends second authentication information and a server public key to the smart device when the first authentication information is verified, wherein the first authentication information includes the certificate information of the smart device, and the second authentication information of the server includes at least a server signature of the server, and the server signature is generated based on the device public key;

[0047] The smart device receives the second authentication information and the server public key, and sends a device signature to the server when the second authentication information is verified, where the device signature is generated based on the server public key;

[0048] The server receives and verifies the device signature.

[0049] In some embodiments, the Internet of Things system further includes a gateway device, the server receives the first authentication information and the device public key of the smart device, and sends the second authentication information and the server public key to the smart device when the first authentication information is verified, including:

[0050] The gateway device receives the first authentication information and the device public key sent by the smart device, and sends the first authentication information and the device public key to the server;

[0051] The server receives the first authentication information and the device public key, and when the first authentication information is verified, sends the second authentication information and the server public key to the gateway device;

[0052] The gateway device sends the second authentication information and the server public key to the smart device;

[0053] The smart device receives the second authentication information and the server public key, and sends a device signature to the server when the second authentication information is verified, including:

[0054] The smart device receives the second authentication information and the server public key, and sends the device signature to the gateway device when the second authentication information is verified;

[0055] The gateway device sends the device signature to the server.

[0056] In some embodiments, the Internet of Things system further includes a terminal device, and the method further includes:

[0057] In response to detecting a binding operation, the terminal device sends a device authentication notification to the server, wherein the binding operation is used to bind a target account for logging into the terminal device to the smart device, and the device authentication notification is used to instruct the server to perform mutual authentication with the smart device;

[0058] When the device signature verification is passed, the server sends an authentication pass notification to the terminal device;

[0059] The terminal device binds the smart device to the target account in response to the authentication success notification.

[0060] According to a sixth aspect of an embodiment of the present disclosure, there is provided a device authentication apparatus, which is configured in a smart device, and the apparatus includes:

[0061] a sending module, configured to send first authentication information and a device public key to a server, wherein the first authentication information includes certificate information of the smart device, and the server is used to send second authentication information and a server public key to the smart device when the first authentication information is verified, wherein the second authentication information at least includes a server signature of the server, and the server signature is generated based on the device public key;

[0062] A receiving module, configured to receive the second authentication information and the server public key sent by the server;

[0063] The sending module is further configured to send a device signature to the server when the second authentication information is verified, the device signature is generated based on the server public key, and the server is used to verify the device signature.

[0064] According to a seventh aspect of an embodiment of the present disclosure, there is provided a device authentication apparatus, which is configured on a server, and is characterized in that the apparatus comprises:

[0065] A receiving module is configured to receive first authentication information and a device public key of a smart device, wherein the first authentication information includes certificate information of the smart device;

[0066] a sending module, configured to send second authentication information and a server public key to the smart device when the first authentication information is verified, wherein the second authentication information at least includes a server signature of the server, and the server signature is generated based on the device public key; wherein the smart device is used to send a device signature to the server when the second authentication information is verified, and the device signature is generated based on the server public key;

[0067] The verification module is configured to receive and verify the device signature.

[0068] According to an eighth aspect of an embodiment of the present disclosure, there is provided a device authentication apparatus, which is configured in a gateway device, and is characterized in that the apparatus comprises:

[0069] A first sending module is configured to send first authentication information and a device public key to a server, wherein the first authentication information includes certificate information of a smart device, and the server is used to receive the first authentication information and the device public key, and send second authentication information and a server public key to the gateway device when the first authentication information is verified. The second authentication information includes a server signature of the server, and the server signature is generated based on the device public key;

[0070] A second sending module is configured to send the received second authentication information and the server public key to the smart device, the smart device is used to receive the second authentication information and the server public key, and when the second authentication information is verified, send a device signature to the gateway device, the device signature is generated based on the server public key;

[0071] The first sending module is further configured to send the received device signature to the server, and the server is used to verify the device signature.

[0072] According to a ninth aspect of an embodiment of the present disclosure, there is provided a device authentication apparatus, which is configured in a terminal device, and the apparatus includes:

[0073] a notification sending module, configured to send a device authentication notification to the server in response to detecting a binding operation, wherein the binding operation is used to bind a target account for logging into the terminal device to the smart device, and the device authentication notification is used to instruct the server to perform mutual authentication with the smart device;

[0074] The binding module is configured to bind the smart device to the target account in response to receiving the authentication success notification sent by the server.

[0075] According to a tenth aspect of an embodiment of the present disclosure, there is provided an electronic device, including:

[0076] processor;

[0077] a memory for storing processor-executable instructions;

[0078] In which, the processor is configured to execute the method as described in the first aspect of the embodiment of the present disclosure, or the processor is configured to execute the method as described in the second aspect of the embodiment of the present disclosure, or the processor is configured to execute the method as described in the third aspect of the embodiment of the present disclosure, or the processor is configured to execute the method as described in the fourth aspect of the embodiment of the present disclosure.

[0079] According to the eleventh aspect of the embodiments of the present disclosure, a non-temporary computer-readable storage medium is provided. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method as described in the first aspect of the embodiments of the present disclosure, or the electronic device is enabled to execute the method as described in the second aspect of the embodiments of the present disclosure, or the electronic device is enabled to execute the method as described in the third aspect of the embodiments of the present disclosure, or the electronic device is enabled to execute the method as described in the tenth aspect of the embodiments of the present disclosure.

[0080] The above method of the present disclosure has the following beneficial effects:

[0081] In the device authentication method provided by the embodiment of the present disclosure, the smart device sends first authentication information and a device public key to a server. When the first authentication information is verified, the server sends second authentication information and a server public key to the smart device. The second authentication information at least includes a server signature of the server, and the server signature is generated based on the device public key. The smart device receives the second authentication information and the server public key sent by the server, and when the second authentication information is verified, sends the device signature to the server, and the device signature is generated based on the server public key. The server verifies the device signature. The smart device and the server perform authentication based on each other's authentication information and signature respectively, and confirm each other's legitimate identity, thereby avoiding attacks from external devices and improving the security of the communication process.

[0082] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0084] Figure 1 is a schematic diagram of an Internet of Things system according to an exemplary embodiment;

[0085] Figure 2 is a flow chart of a device authentication method according to an exemplary embodiment;

[0086] Figure 3 is a flow chart of another device authentication method according to an exemplary embodiment;

[0087] Figure 4 is a flow chart of another device authentication method according to an exemplary embodiment;

[0088] Figure 5 is a flow chart of another device authentication method according to an exemplary embodiment;

[0089] Figure 6 is a flow chart of another device authentication method according to an exemplary embodiment;

[0090] Figure 7 is a block diagram of a device authentication apparatus according to an exemplary embodiment;

[0091] Figure 8 is a block diagram of another device authentication apparatus according to an exemplary embodiment;

[0092] Fig. 9is a block diagram of another device authentication apparatus according to an exemplary embodiment;

[0093] Fig.10 is a block diagram of another device authentication apparatus according to an exemplary embodiment;

[0094] Fig.11 It is a block diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0095] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0096] In the related art, the PLC slave station and the PLC master station perform lightweight encryption and authentication through the command frames sent to ensure the security of information transmission. However, the method in the related art only focuses on encrypted communication between the PLC slave station and the PLC master station, and cannot solve the problem of external device imitation (i.e. external device attack) or the problem of mutual confirmation of legitimacy between the smart device and the server.

[0097] In view of these problems in the related art, the embodiments of the present disclosure provide a device authentication method, which is applied to an Internet of Things system, wherein the Internet of Things system includes a smart device and a server, and optionally, the Internet of Things system also includes a gateway device and a terminal device. The Internet of Things system may refer to an Internet of Things system in the fields of smart meter reading, smart home, smart energy, smart street lamp, smart transportation, etc.

[0098] The following uses the smart home field as an example to illustrate the Internet of Things system in the embodiments of the present disclosure.

[0099] See also Figure 1The schematic diagram of the Internet of Things system shown in the figure, the smart devices in the Internet of Things system include smart switches, smart lights, smart sockets and curtain motors. The smart devices are connected to the PLC smart gateway (gateway device) in the strong power box through the home power supply line. The PLC smart gateway is then connected to the home Ethernet power supply (Power Over Ethernet, POE) network port in the weak power box through the network to access the external network (i.e., access the operator base station). The PLC smart gateway and the PLC smart device are associated on the PLC link (i.e., a connection is established between the PLC smart gateway and the PLC smart device), and the relevant information of the smart device can also be pushed to the cloud platform (server). Finally, the control APP (Application) in the terminal device can discover the PLC smart device from the cloud platform (the terminal device interacts with the server through the routing device) and start the binding operation between the account logged in to the APP and the PLC smart device. After binding, the PLC smart device can be controlled through the APP, such as controlling the opening and closing of the PLC smart device.

[0100] In the embodiments of the present disclosure, Figure 1 In the scenario shown, after the binding operation is started, the device authentication method provided by the embodiment of the present disclosure is used to enable the smart device to authenticate each other with the server first, and after the authentication is completed, the account is bound to the PLV smart device.

[0101] The embodiments of the present disclosure relate to smart devices, servers, gateway devices and terminal devices in an Internet of Things system, wherein the smart devices may be electronic devices such as smart home devices, smart meter reading devices, smart street lamps, etc., the server may be a cloud server or a server cluster composed of multiple cloud servers, and the terminal devices may be devices such as mobile phones, laptops, tablet computers, car terminals, etc. on which application programs can be installed.

[0102] Next, pass Figure 2-Figure 5 The illustrated embodiment describes the operations performed by the smart device, the server, the gateway device, and the terminal device respectively:

[0103] Figure 2 is a flow chart of a device authentication method according to an exemplary embodiment, which is executed by a smart device, see Figure 2 , the method comprises the following steps:

[0104] Step S201, sending first authentication information and a device public key to the server, the first authentication information including the certificate information of the smart device, the server is used to send second authentication information and a server public key to the smart device when the first authentication information is verified, the second authentication information at least including a server signature of the server, and the server signature is generated based on the device public key.

[0105] Among them, the first authentication information is used to characterize the identity of the smart device, and the first authentication information includes the certificate information of the smart device. Optionally, the certificate information includes the production certificate and device certificate of the smart device. The production certificate is used to characterize the production line that produces the smart device, and the device certificate is used to characterize the smart device itself. The device certificate is the unique identity credential of the smart device. The production certificate and identity certificate can be issued by a certificate authority.

[0106] If the first authentication information is verified, it means that the certificate information of the smart device is correct. In this case, the authentication can continue, and the server sends the second authentication information and the server public key to the smart device. The second authentication information is used to represent the identity of the server, and the second authentication information at least includes the server signature, which is generated based on the device public key, and the server public key is used to encrypt the transmitted information.

[0107] Step S202: receiving second authentication information and a server public key sent by the server.

[0108] Step S203, when the second authentication information is verified, the device signature is sent to the server, the device signature is generated based on the server public key, and the server is used to verify the device signature.

[0109] After receiving the second authentication information and the server public key, the smart device can verify the second authentication information. When verifying the second authentication information, since the server signature is generated based on the device public key, the server signature is decrypted. If the device public key can be obtained, it can be determined that the server signature verification has passed.

[0110] If the second authentication information is verified, it means that the server signature is correct. In this case, authentication can continue. The smart device sends a device signature to the server. The device signature is generated based on the server public key. The server then verifies the device signature. When verifying the device signature, since the device signature is generated based on the server public key, the device signature is decrypted. If the server public key can be obtained, it can be determined that the device signature verification is successful, and the smart device and server complete mutual authentication.

[0111] According to the method provided by the embodiment of the present disclosure, the smart device sends first authentication information and a device public key to a server. When the first authentication information is verified, the server sends second authentication information and a server public key to the smart device. The second authentication information at least includes a server signature of the server, and the server signature is generated based on the device public key. The smart device receives the second authentication information and the server public key sent by the server, and when the second authentication information is verified, sends the device signature to the server, and the device signature is generated based on the server public key. The server verifies the device signature. The smart device and the server perform authentication based on each other's authentication information and signature respectively, and confirm each other's legitimate identity, thereby avoiding attacks from external devices and improving the security of the communication process.

[0112] Figure 3 is a flowchart of another device authentication method according to an exemplary embodiment, which is executed by a server, see Figure 3 , the method comprises the following steps:

[0113] Step S301: receiving first authentication information and a device public key of a smart device, wherein the first authentication information includes certificate information of the smart device.

[0114] Step S302, when the first authentication information is verified, the second authentication information and the server public key are sent to the smart device, the second authentication information at least includes the server signature of the server, and the server signature is generated based on the device public key; wherein the smart device is used to send the device signature to the server when the second authentication information is verified, and the device signature is generated based on the server public key.

[0115] Step S303, receiving and verifying the device signature.

[0116] The implementation of steps S301 - S303 is the same as that of steps S201 - S203 , and will not be described in detail herein.

[0117] According to the method provided by the embodiment of the present disclosure, the smart device sends first authentication information and a device public key to a server. When the first authentication information is verified, the server sends second authentication information and a server public key to the smart device. The second authentication information at least includes a server signature of the server, and the server signature is generated based on the device public key. The smart device receives the second authentication information and the server public key sent by the server, and when the second authentication information is verified, sends the device signature to the server, and the device signature is generated based on the server public key. The server verifies the device signature. The smart device and the server perform authentication based on each other's authentication information and signature respectively, and confirm each other's legitimate identity, thereby avoiding attacks from external devices and improving the security of the communication process.

[0118] Figure 4is a flowchart of another device authentication method according to an exemplary embodiment, which is executed by a gateway device, see Figure 4 , the method comprises the following steps:

[0119] Step S401, sending first authentication information and a device public key to a server, the first authentication information including the certificate information of a smart device, the server is used to receive the first authentication information and the device public key, and when the first authentication information is verified, sending second authentication information and a server public key to a gateway device, the second authentication information including a server signature of the server, and the server signature is generated based on the device public key.

[0120] Step S402, sending the received second authentication information and server public key to the smart device, the smart device is used to receive the second authentication information and the server public key, and when the second authentication information is verified, sending the device signature to the gateway device, the device signature is generated based on the server public key.

[0121] Step S403: Send the received device signature to the server, which is used to verify the device signature.

[0122] The operations performed by the server and the smart device involved in steps S401-S403 refer to the implementation of the above-mentioned steps S201-S203, which will not be repeated here.

[0123] In the disclosed embodiment, considering that the communication protocols of the server and the smart device are inconsistent and the two cannot interact directly, the gateway device is used as an intermediate device between the smart device and the server. The gateway device forwards the information sent by the smart device to the server and forwards the information sent by the server to the smart device. In addition, in order to improve the authentication speed, the first authentication information and the device public key of the smart device are stored in the gateway device. When the server and the smart device need to perform device authentication, the gateway device directly sends the first authentication information and the device public key to the server without having to obtain them from the smart device.

[0124] Figure 5 is a flowchart of another device authentication method according to an exemplary embodiment, which is executed by a terminal device, see Figure 5 , the method comprises the following steps:

[0125] Step S501, in response to detecting a binding operation, sending a device authentication notification to the server, wherein the binding operation is used to bind a target account for logging into the terminal device to a smart device, and the device authentication notification is used to instruct the server to perform mutual authentication with the smart device.

[0126] In the embodiment of the present disclosure, when it is necessary to bind the target account of the terminal device to the smart device, the terminal device sends a device authentication notification to the server, and the device authentication notification is used to instruct the server and the smart device to perform mutual authentication. That is, when the server receives the device authentication notification, the server and the smart device start to execute the above Figure 1-3 The device authentication process shown.

[0127] Step S502: In response to receiving the authentication success notification sent by the server, binding the smart device to the target account.

[0128] When the server and the smart device have successfully authenticated each other, the server sends an authentication success notification to the terminal device, so that the terminal device can bind the smart device to the target account for subsequent operations.

[0129] According to the method provided by the embodiment of the present disclosure, before the target account of the terminal device is bound to the smart device, it is authenticated by sending a device, so that the smart device and the server authenticate each other. After the smart device and the server authenticate each other, the target account is bound to the smart device, thereby ensuring the security of the communication process after binding.

[0130] The device authentication method provided in the embodiment of the present disclosure is applied to the Internet of Things system. In the device authentication process, it involves the interaction between the smart device, the server, the network card device and the terminal device. Figure 6 The illustrated embodiment illustrates the interaction process.

[0131] Figure 6 is a flowchart of another device authentication method according to an exemplary embodiment, which is applied to an Internet of Things system, see Figure 6 , the method comprises the following steps:

[0132] Step S601: The gateway device periodically sends a preset frame according to a preset duration.

[0133] The preset frame is a beacon frame, which is used to indicate the existence of the gateway device. When other devices receive the preset frame, it indicates that they can communicate with the gateway device. The preset duration is a preset duration, for example, the preset duration is 100 milliseconds, 200 milliseconds or other durations.

[0134] Step S602: In response to receiving the preset frame, the smart device sends an association request to the gateway device.

[0135] When the smart device receives a preset frame after startup, it can send an association request to the gateway device, where the association request is used to request that the smart device be associated with the gateway device.

[0136] Step S603: In response to receiving the association request, the gateway device sends an association confirmation notification to the smart device.

[0137] After receiving the association request, the gateway device sends an association confirmation notification to the smart device when determining to associate with the smart device.

[0138] In some embodiments, when sending the association confirmation notification, the gateway device also sends a TEI (Terminal Equipment Identifier) ​​address to the smart device.

[0139] Step S604: the smart device sends device information to the gateway device.

[0140] The device information at least includes the binding information of the smart device, and the binding information is used to indicate whether the smart device is in a binding state. The binding state is used to indicate that the smart device has been bound to an account, and the unbound state is used to indicate that the smart device is not bound to an account.

[0141] In some embodiments, the device information also includes basic information of the device such as version number of the device, product ID (identity), device ID, MAC address, etc.

[0142] It should be noted that when the smart device is in a bound state, it means that the smart device has been bound to another account and cannot be bound to the target account, so the subsequent device authentication process is no longer performed. When the smart device is in an unbound state, step S605 is performed again.

[0143] Step S605: When the smart device is in an unbound state, the gateway device sends an acquisition request to the smart device.

[0144] In the disclosed embodiment, when the smart device is in an unbound state, it indicates that the subsequent smart device can be bound to the target account, and before binding, the smart device and the server need to authenticate each other. Therefore, the gateway device sends an acquisition request to the smart device, and the acquisition request is used to request the first authentication information and the device public key, and the first authentication information and the device public key are used for subsequent authentication.

[0145] Step S606: The smart device sends the first authentication information and the device public key to the gateway device in response to the acquisition request.

[0146] After receiving the first authentication information and the device public key, the gateway device saves the first authentication information and the device public key.

[0147] In some embodiments, after the smart device is associated with the gateway device, it generates a device public key and a corresponding device private key. For example, ECC (Elliptic Curve Cryptography) is used to randomly generate a device public key and a corresponding device private key. In the disclosed embodiment, there is no restriction on the method of generating a device public key and a corresponding device private key.

[0148] Step S607: The gateway device sends device information to the server.

[0149] Step S608: The terminal device scans the device information in the server, determines a bindable smart device, and sends a device authentication notification to the server in response to detecting a binding operation.

[0150] In the disclosed embodiment, the gateway device sends the device information to the server, and the terminal device can scan the device information in the server. When the device information is scanned, it is determined that the smart device corresponding to the device information is a bindable smart device, and then the terminal device triggers the binding operation. After the binding operation is triggered, the device authentication notification is sent to the server. Among them, the binding operation is used to bind the target account logged in to the terminal device with the smart device, and the device authentication notification is used to instruct the server and the smart device to perform mutual authentication.

[0151] In some embodiments, a control application is installed in the terminal device, and a scanning interface is displayed through the control application. The scanning interface displays a scanning control. In response to a trigger operation on the scanning control, the terminal device scans the device information in the server. When the device information is scanned, a prompt interface is displayed through the control application. The prompt interface is used to prompt whether to bind the target account to the smart device. When a binding operation is detected, a device authentication notification is sent to the server. Optionally, a confirmation control is displayed on the prompt interface. In response to a trigger operation on the confirmation control, it is determined that a binding operation is detected.

[0152] Step S609: The server sends an authentication request to the gateway device in response to the device authentication notification.

[0153] The authentication request is used to request first authentication information and a device public key of the smart device.

[0154] Step S610: The gateway device sends first authentication information and a device public key to the server.

[0155] Step S611, the server receives the first authentication information and the device public key, verifies the first authentication information, generates a server public key and a corresponding server private key when the first authentication information is verified, generates a server signature based on the device public key, and sends the server certificate, server signature and server public key to the gateway device.

[0156] In the disclosed embodiment, it is first verified whether the first authentication information is correct. If it is correct, subsequent operations are performed. If it is incorrect, the smart device authentication is unsuccessful and subsequent operations are no longer performed.

[0157] In some embodiments, the certificate information includes the device certificate and production certificate of the smart device, and verifying the first authentication information includes: verifying the certificate chain of the device certificate and the production certificate, that is, first verifying whether the production certificate is correct based on the follow certificate, and when the production certificate is correct, verifying whether the device certificate is derived from the production certificate; if the device certificate is derived from the production certificate, determining that the device certificate is correct, and determining that the production certificate and device certificate are verified successfully.

[0158] In some embodiments, the server public key and the corresponding server private key may be generated by randomly generating the server public key and the corresponding server private key using ECC, or the server public key and the corresponding server private key may be generated by other methods.

[0159] In order for the smart device to verify the server, the server also generates a server signature based on the device public key. In some embodiments, a key negotiation is performed based on the device public key to generate a shared key; the shared key is signed to obtain a server signature. Optionally, a first summary information is derived based on the shared key, and the first summary information is signed to obtain a server signature. Optionally, a first hash algorithm is used to sign the shared key to obtain a server signature.

[0160] For example, perform ECDHE (Elliptic Curve Diffie–Hellman key Exchange) on the device public key to generate a sharekey (shared key), use HKDF (HMAC-based key derivation function) to derive LTMK (summary information) from the sharekey, sign the LTMK with ECDSA (Elliptic Curve Digital Signature Algorithm) to obtain the server signature.

[0161] Optionally, the summary information can be used as a device key. In subsequent communications, when configuration information and other information need to be transmitted, the device key is used for encryption.

[0162] It should be noted that in the embodiments of the present disclosure, there are no restrictions on the algorithm for generating a shared key, the algorithm for deriving summary information, and the signature algorithm.

[0163] The server sends a server certificate, a server signature, and a server public key to the gateway device. The server certificate is used to represent the server itself, and the server certificate may be issued by a certificate authority.

[0164] Step S612: The gateway device receives the server certificate, server signature and server public key, and sends the server certificate, server signature and server public key to the smart device.

[0165] In step S613, the smart device performs key negotiation based on the server public key, generates a shared key, verifies the server signature and server certificate, and when the server signature and server certificate verification pass, signs the shared key to obtain the device signature, and sends the device signature to the gateway device.

[0166] In the disclosed embodiment, the shared key generated by key negotiation based on the device public key is the same as the shared key generated by key negotiation based on the server public key.

[0167] In some embodiments, the server signature is verified based on the server public key and the shared secret key. Optionally, the server signature is decrypted based on the server public key to obtain digital summary information, and then the shared secret key is signed based on the same first hash algorithm to determine whether the signed information is consistent with the digital summary information. If they are consistent, it is determined that the server signature verification has passed.

[0168] The server certificate may be verified, optionally, by a certificate authority, or by other means, which is not limited in the embodiments of the present disclosure.

[0169] In order for the server to verify the smart device, the smart device also generates a device signature based on the server public key. In some embodiments, a key negotiation is performed based on the server public key to generate a shared key; the shared key is signed to obtain a device signature. Optionally, a second summary information is derived based on the shared key, and the second summary information is signed to obtain a device signature. Optionally, a second hash algorithm is used to sign the shared key to obtain a device signature.

[0170] For example, perform ECDHE (Elliptic Curve Diffie-Hellman keyExchange) on the server public key to generate a sharekey (shared key), use HKDF (HMAC-based key derivation function) to derive LTMK (summary information) from the sharekey, sign the LTMK with ECDSA (Elliptic Curve Digital Signature Algorithm) to obtain the device signature.

[0171] Optionally, the summary information can be used as a device key (devkey). In subsequent communication processes, when configuration information and other information need to be transmitted, the device key is used for encryption.

[0172] It should be noted that in the embodiments of the present disclosure, there are no restrictions on the algorithm for generating a shared key, the algorithm for deriving summary information, and the signature algorithm.

[0173] Step S614: The gateway device receives the device signature and sends the device signature to the server.

[0174] Step S615: the server verifies the device signature.

[0175] In some embodiments, the device signature is verified based on the device public key and the shared secret key. Optionally, the device signature is decrypted based on the device public key to obtain digital summary information, and then the shared secret key is signed based on the same second hash algorithm to determine whether the signed information is consistent with the digital summary information. If consistent, it is determined that the device signature verification has passed.

[0176] Step S616: When the device signature verification is successful, the server sends an authentication success notification to the terminal device.

[0177] The authentication success notification is used to indicate that the server and the smart device have completed mutual authentication and can be bound.

[0178] Step S617: The terminal device binds the smart device to the target account in response to the authentication success notification.

[0179] After binding, the terminal device can control the smart device. Optionally, when the target account is bound to multiple smart devices, the server sends the devkey to the gateway device, and then the gateway device and the smart device can configure the network key (netkey) and grouping scenario information based on the devkey. Among them, the grouping scenario refers to dividing multiple smart devices into different groups. Each time the terminal device controls, it can control the smart devices in one group at the same time.

[0180] In the method provided by the embodiment of the present disclosure, the smart device and the server perform authentication based on each other's authentication information and signature, and mutually confirm each other's legitimate identity, thereby avoiding attacks from external devices and improving the security of the communication process. In addition, during the authentication process, the smart device and the server generate a shared key by performing key negotiation, and the use of shared key communication can prevent attacks from other devices.

[0181] In addition, when different devices transmit information, the server and the smart device do not transmit the private key. Therefore, for other devices, even if they intercept the transmitted encrypted information, they do not have the private key to decrypt it, which improves the security of the encrypted data.

[0182] In addition, the production certificate and device certificate of the smart device are stored in the OTP (One Time Programmable) flash partition, and the flash-lock mechanism is used to lock write, erase and other operations to prevent trash can attacks.

[0183] In addition, it should be noted that the above implementation only takes the process of binding a smart device to the target account as an example. In another embodiment, multiple smart devices can be bound to the target account, and different smart devices can be bound using the above implementation. Moreover, in the disclosed embodiment, after the smart device establishes a connection with the gateway device, the device information, first authentication information, device public key and other related information of the smart device can be sent to the gateway device. When the terminal device triggers the binding operation, the server can directly obtain the relevant information of the smart device from the gateway device without the need to interact with the smart device to obtain it. This can save the time of device authentication and binding and improve efficiency. In particular, when multiple smart devices need to be bound, the effect is more prominent. For example, it was found in actual measurements that it only takes 40 seconds for 32 smart devices to complete mutual authentication with the server.

[0184] Figure 7 is a block diagram of a device authentication apparatus according to an exemplary embodiment, which is configured in a smart device, see Figure 7 , the device comprises:

[0185] The sending module 701 is configured to send first authentication information and a device public key to the server, wherein the first authentication information includes the certificate information of the smart device, and the server is used to send second authentication information and a server public key to the smart device if the first authentication information is verified. The second authentication information includes at least a server signature of the server, and the server signature is generated based on the device public key;

[0186] The receiving module 702 is configured to receive the second authentication information and the server public key sent by the server;

[0187] The verification module 703 is further configured to send a device signature to the server when the second authentication information is verified, the device signature is generated based on the server public key, and the server is used to verify the device signature.

[0188] In some embodiments, the verification module 703 is further configured to:

[0189] Perform key negotiation based on the server public key to generate a shared key;

[0190] Verify the server signature;

[0191] When the server signature verification passes, the shared key is signed to obtain the device signature, and the device signature is sent to the server.

[0192] In some embodiments, the verification module 703 is further configured to

[0193] Verify the server signature based on the server public key and shared secret key.

[0194] In some embodiments, the sending module 701 is further configured to:

[0195] Send device information to the gateway device, the device information includes at least binding information of the smart device, the binding information is used to indicate whether the smart device is in a binding state, the binding state is used to indicate that the smart device has been bound to the account, and the gateway device is used to send an acquisition request to the smart device when the smart device is in an unbound state, the acquisition request is used to request to obtain the first authentication information and the device public key.

[0196] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0197] Figure 8 is a block diagram of another device authentication device according to an exemplary embodiment, which is configured on a server, see Figure 8 , the device comprises:

[0198] The receiving module 801 is configured to receive first authentication information and a device public key of a smart device, where the first authentication information includes certificate information of the smart device;

[0199] The sending module 802 is configured to send the second authentication information and the server public key to the smart device when the first authentication information is verified, the second authentication information at least includes the server signature of the server, and the server signature is generated based on the device public key; wherein the smart device is used to send the device signature to the server when the second authentication information is verified, and the device signature is generated based on the server public key;

[0200] The verification module 803 is configured to receive and verify the device signature.

[0201] In some embodiments, the sending module 802 is configured to:

[0202] Verifying the first authentication information;

[0203] When the first authentication information is verified, a server public key and a corresponding server private key are generated;

[0204] Generate a server signature based on the device public key;

[0205] Send the server signature and server public key to the smart device.

[0206] In some embodiments, the sending module 802 is configured to:

[0207] Perform key negotiation based on the device public key to generate a shared key;

[0208] Sign the shared key to obtain the server signature.

[0209] In some embodiments, the verification module 803 is configured to:

[0210] Verify the device signature based on the device public key and shared secret key.

[0211] In some embodiments, the receiving module 801 is further configured to:

[0212] Receive the device authentication notification sent by the terminal device. The device authentication notification is used to instruct the server and the smart device to perform mutual authentication. The device authentication notification is sent by the terminal device when a binding operation is detected. The binding operation is used to bind the target account logged in to the terminal device with the smart device.

[0213] In some embodiments, the sending module 802 is further configured to:

[0214] When the device signature verification passes, an authentication pass notification is sent to the terminal device, and the terminal device is used to bind the smart device to the target account in response to the authentication pass notification.

[0215] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0216] Fig. 9 is a block diagram of another device authentication device according to an exemplary embodiment, which is configured in a gateway device, see Fig. 9 , the device comprises:

[0217] The first sending module 901 is configured to send first authentication information and a device public key to the server, the first authentication information including the certificate information of the smart device, the server is used to receive the first authentication information and the device public key, and send second authentication information and the server public key to the gateway device when the first authentication information is verified. The second authentication information includes a server signature of the server, and the server signature is generated based on the device public key;

[0218] The second sending module 902 is configured to send the received second authentication information and the server public key to the smart device, and the smart device is used to receive the second authentication information and the server public key, and when the second authentication information is verified, send a device signature to the gateway device, and the device signature is generated based on the server public key;

[0219] The first sending module 901 is further configured to send the received device signature to the server, and the server is used to verify the device signature.

[0220] In some embodiments, the apparatus further comprises:

[0221] A receiving module is configured to receive device information sent by a smart device, wherein the device information includes at least binding information of the smart device, wherein the binding information is used to indicate whether the smart device is in a binding state, and the binding state is used to indicate that the smart device has been bound to the account;

[0222] The second sending module 902 is further configured to send an acquisition request to the smart device when the smart device is in an unbound state, where the acquisition request is used to request to obtain the first authentication information and the device public key;

[0223] The receiving module is configured to receive the first authentication information and the device public key sent by the smart device.

[0224] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0225] Fig.10 is a block diagram of another device authentication apparatus according to an exemplary embodiment, which is configured in a terminal device, see Fig.10 , the device comprises:

[0226] The notification sending module 1001 is configured to send a device authentication notification to the server in response to detecting a binding operation, wherein the binding operation is used to bind a target account for logging into the terminal device to the smart device, and the device authentication notification is used to instruct the server to perform mutual authentication with the smart device;

[0227] The binding module 1002 is configured to bind the smart device to the target account in response to receiving the authentication success notification sent by the server.

[0228] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0229] An embodiment of the present disclosure further provides an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the device authentication method in the above embodiment.

[0230] Fig.11 is a block diagram of an electronic device 1100 according to an exemplary embodiment.

[0231] Reference Fig.11 , the electronic device 1100 may include one or more of the following components: a processing component 1102 , a memory 1104 , a power component 1106 , a multimedia component 1108 , an audio component 1110 , an input / output (I / O) interface 1112 , a sensor component 1114 , and a communication component 1116 .

[0232] The processing component 1102 generally controls the overall operation of the electronic device 1100, such as operations associated with display, phone calls, data communications, camera operations, and recording operations. The processing component 1102 may include one or more processors 1120 to execute instructions to complete all or part of the steps of the above-mentioned method. In addition, the processing component 1102 may include one or more modules to facilitate the interaction between the processing component 1102 and other components. For example, the processing component 1102 may include a multimedia module to facilitate the interaction between the multimedia component 1108 and the processing component 1102.

[0233] The memory 1104 is configured to store various types of data to support operations on the electronic device 1100. Examples of such data include instructions for any application or method operating on the electronic device 1100, contact data, phone book data, messages, pictures, videos, etc. The memory 1104 may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0234] The power supply component 1106 provides power to various components of the electronic device 1100. The power supply component 1106 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 1100.

[0235] The multimedia component 1108 includes a screen that provides an output interface between the electronic device 1100 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundaries of the touch or slide action, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 1108 includes a front camera and / or a rear camera. When the electronic device 1100 is in an operating mode, such as a shooting mode or a video mode, the front camera and / or the rear camera may receive external multimedia data. Each front camera and the rear camera may be a fixed optical lens system or have a focal length and optical zoom capability.

[0236] The audio component 1110 is configured to output and / or input audio signals. For example, the audio component 1110 includes a microphone (MIC), and when the electronic device 1100 is in an operation mode, such as a call mode, a recording mode, and a voice recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in the memory 1104 or sent via the communication component 1116. In some embodiments, the audio component 1110 also includes a speaker for outputting audio signals.

[0237] I / O interface 1112 provides an interface between processing component 1102 and peripheral interface modules, which may be keyboards, click wheels, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0238] The sensor assembly 1114 includes one or more sensors for providing various aspects of status assessment for the electronic device 1100. For example, the sensor assembly 1114 can detect the open / closed state of the electronic device 1100, the relative positioning of components, such as the display and keypad of the electronic device 1100, and the sensor assembly 1114 can also detect the position change of the electronic device 1100 or a component of the electronic device 1100, the presence or absence of user contact with the electronic device 1100, the orientation or acceleration / deceleration of the electronic device 1100, and the temperature change of the electronic device 1100. The sensor assembly 1114 may include a proximity sensor configured to detect the presence of a nearby object without any physical contact. The sensor assembly 1114 may also include an optical sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 1114 may also include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0239] The communication component 1116 is configured to facilitate wired or wireless communication between the electronic device 1100 and other devices. The electronic device 1100 can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, or a combination thereof. In an exemplary embodiment, the communication component 1116 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 1116 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0240] In an exemplary embodiment, the electronic device 1100 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above methods.

[0241] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 1104 including instructions, and the instructions can be executed by a processor 1120 of the electronic device 1100 to perform the above method. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0242] The embodiments of the present disclosure also provide a non-temporary computer-readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the device authentication method in the above embodiment.

[0243] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed in this disclosure. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present invention are indicated by the following claims.

[0244] It should be understood that the present invention is not limited to the exact construction that has been described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A device authentication method, applied to a smart device, characterized in that: The method comprises: Sending first authentication information and a device public key to a server, wherein the first authentication information includes certificate information of the smart device, and the server is configured to send second authentication information and a server public key to the smart device if the first authentication information is verified successfully, wherein the second authentication information includes at least a server signature of the server, and the server signature is generated based on the device public key; Receiving the second authentication information and the server public key sent by the server; When the second authentication information is verified, a device signature is sent to the server, where the device signature is generated based on the server public key, and the server is used to verify the device signature.

2. The method according to claim 1, characterized in that When the second authentication information is verified, sending the device signature to the server includes: Perform key negotiation based on the server public key to generate a shared key; Verifying the server signature; When the server signature verification passes, the shared key is signed to obtain the device signature, and the device signature is sent to the server.

3. The method according to claim 2, characterized in that The verifying the server signature comprises: The server signature is verified based on the server public key and the shared secret key.

4. The method according to claim 1, characterized in that: Before sending the first authentication information and the device public key to the server, the method further includes: Send device information to a gateway device, wherein the device information includes at least binding information of the smart device, wherein the binding information is used to indicate whether the smart device is in a binding state, wherein the binding state is used to indicate that the smart device has been bound to an account, and wherein the gateway device is used to send an acquisition request to the smart device when the smart device is in an unbound state, wherein the acquisition request is used to request to obtain the first authentication information and the device public key.

5. A device authentication method, applied to a server, characterized in that: The method comprises: Receiving first authentication information and a device public key of a smart device, wherein the first authentication information includes certificate information of the smart device; When the first authentication information is verified, second authentication information and a server public key are sent to the smart device, wherein the second authentication information at least includes a server signature of the server, and the server signature is generated based on the device public key; wherein the smart device is used to send a device signature to the server when the second authentication information is verified, and the device signature is generated based on the server public key; The device signature is received and verified.

6. The method according to claim 5, characterized in that When the first authentication information is verified, sending the second authentication information and the server public key to the smart device includes: verifying the first authentication information; When the first authentication information is verified, generating the server public key and the corresponding server private key; Based on the device public key, generating the server signature; The server signature and the server public key are sent to the smart device.

7. The method according to claim 6, characterized in that The generating the server signature based on the device public key includes: Perform key negotiation based on the device public key to generate a shared key; The shared key is signed to obtain the server signature.

8. The method according to claim 7, characterized in that The verifying the device signature comprises: The device signature is verified based on the device public key and the shared secret key.

9. The method according to claim 5, characterized in that Before receiving the first authentication information and the device public key of the smart device, the method further includes: Receive a device authentication notification sent by a terminal device, wherein the device authentication notification is used to instruct the server and the smart device to perform mutual authentication, and the device authentication notification is sent by the terminal device when a binding operation is detected, and the binding operation is used to bind a target account logged in to the terminal device with the smart device.

10. The method according to claim 9, characterized in that After receiving and verifying the device signature, the method further includes: When the device signature verification passes, an authentication pass notification is sent to the terminal device, and the terminal device is used to bind the smart device to the target account in response to the authentication pass notification.

11. A device authentication method, applied to a gateway device, characterized in that: The method comprises: Sending first authentication information and a device public key to a server, wherein the first authentication information includes certificate information of a smart device, the server is used to receive the first authentication information and the device public key, and when the first authentication information is verified, sending second authentication information and a server public key to the gateway device, wherein the second authentication information includes a server signature of the server, and the server signature is generated based on the device public key; Sending the received second authentication information and the server public key to the smart device, the smart device is used to receive the second authentication information and the server public key, and when the second authentication information is verified, sending a device signature to the gateway device, the device signature is generated based on the server public key; The received device signature is sent to the server, and the server is used to verify the device signature.

12. The method according to claim 11, characterized in that Before sending the first authentication information and the device public key to the server, the method further includes: Receiving device information sent by the smart device, the device information at least including binding information of the smart device, the binding information is used to indicate whether the smart device is in a binding state, and the binding state is used to indicate that the smart device has been bound to an account; When the smart device is in an unbound state, sending an acquisition request to the smart device, where the acquisition request is used to request to acquire the first authentication information and the device public key; Receive the first authentication information and the device public key sent by the smart device.

13. A device authentication method, applied to a terminal device, characterized in that: The method comprises: In response to detecting a binding operation, sending a device authentication notification to the server, wherein the binding operation is used to bind a target account for logging into the terminal device to the smart device, and the device authentication notification is used to instruct the server to perform mutual authentication with the smart device; In response to receiving the authentication success notification sent by the server, the smart device is bound to the target account.

14. A device authentication method, characterized in that: Applied to an Internet of Things system, the Internet of Things system includes a smart device and a server, and the method includes: The server receives first authentication information and a device public key of the smart device, and sends second authentication information and a server public key to the smart device when the first authentication information is verified, wherein the first authentication information includes the certificate information of the smart device, and the second authentication information of the server includes at least a server signature of the server, and the server signature is generated based on the device public key; The smart device receives the second authentication information and the server public key, and sends a device signature to the server when the second authentication information is verified, where the device signature is generated based on the server public key; The server receives and verifies the device signature.

15. The method according to claim 14, characterized in that The Internet of Things system further includes a gateway device, the server receives the first authentication information and the device public key of the smart device, and sends the second authentication information and the server public key to the smart device when the first authentication information is verified, including: The gateway device receives the first authentication information and the device public key sent by the smart device, and sends the first authentication information and the device public key to the server; The server receives the first authentication information and the device public key, and when the first authentication information is verified, sends the second authentication information and the server public key to the gateway device; The gateway device sends the second authentication information and the server public key to the smart device; The smart device receives the second authentication information and the server public key, and sends a device signature to the server when the second authentication information is verified, including: The smart device receives the second authentication information and the server public key, and sends the device signature to the gateway device when the second authentication information is verified; The gateway device sends the device signature to the server.

16. The method according to claim 14, characterized in that The Internet of Things system also includes a terminal device, and the method also includes: In response to detecting a binding operation, the terminal device sends a device authentication notification to the server, wherein the binding operation is used to bind a target account for logging into the terminal device to the smart device, and the device authentication notification is used to instruct the server to perform mutual authentication with the smart device; When the device signature verification is passed, the server sends an authentication pass notification to the terminal device; The terminal device binds the smart device to the target account in response to the authentication success notification.

17. A device authentication apparatus, configured in a smart device, characterized in that: The device comprises: a sending module, configured to send first authentication information and a device public key to a server, wherein the first authentication information includes certificate information of the smart device, and the server is used to send second authentication information and a server public key to the smart device when the first authentication information is verified, wherein the second authentication information at least includes a server signature of the server, and the server signature is generated based on the device public key; A receiving module, configured to receive the second authentication information and the server public key sent by the server; The sending module is further configured to send a device signature to the server when the second authentication information is verified, the device signature is generated based on the server public key, and the server is used to verify the device signature.

18. A device authentication apparatus, configured on a server, characterized in that: The device comprises: A receiving module is configured to receive first authentication information and a device public key of a smart device, wherein the first authentication information includes certificate information of the smart device; a sending module, configured to send second authentication information and a server public key to the smart device when the first authentication information is verified, wherein the second authentication information at least includes a server signature of the server, and the server signature is generated based on the device public key; wherein the smart device is used to send a device signature to the server when the second authentication information is verified, and the device signature is generated based on the server public key; The verification module is configured to receive and verify the device signature.

19. A device authentication apparatus, configured in a gateway device, characterized in that: The device comprises: A first sending module is configured to send first authentication information and a device public key to a server, wherein the first authentication information includes certificate information of a smart device, and the server is used to receive the first authentication information and the device public key, and send second authentication information and a server public key to the gateway device when the first authentication information is verified. The second authentication information includes a server signature of the server, and the server signature is generated based on the device public key; A second sending module is configured to send the received second authentication information and the server public key to the smart device, the smart device is used to receive the second authentication information and the server public key, and when the second authentication information is verified, send a device signature to the gateway device, the device signature is generated based on the server public key; The first sending module is further configured to send the received device signature to the server, and the server is used to verify the device signature.

20. A device authentication apparatus, configured in a terminal device, characterized in that: The device comprises: a notification sending module, configured to send a device authentication notification to the server in response to detecting a binding operation, wherein the binding operation is used to bind a target account for logging into the terminal device to the smart device, and the device authentication notification is used to instruct the server to perform mutual authentication with the smart device; The binding module is configured to bind the smart device to the target account in response to receiving the authentication success notification sent by the server.

21. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method as described in any one of claims 1-4, or the processor is configured to execute the method as described in any one of claims 5-10, or the processor is configured to execute the method as described in any one of claims 11-12, or the processor is configured to execute the method as described in claim 13.

22. A non-transitory computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method as described in any one of claims 1 to 4, or the electronic device is enabled to execute the method as described in any one of claims 5 to 10, or the electronic device is enabled to execute the method as described in any one of claims 11 to 12, or the electronic device is enabled to execute the method as described in claim 13.

Images