Method and device for determining unique identifier of equipment and electronic equipment

Abstract

The invention discloses a method and device for determining a unique identifier of equipment and electronic equipment. The method comprises the following steps: acquiring a first device identifier of a first terminal device and a first client certificate of the first terminal device, wherein the first device identifier comprises a first MAC address and a first IP address; the first client certificate and the first device identifier are bound as a first binding record, and the first binding record is used for uniquely identifying the first terminal device; based on the first client certificate, identifying whether the first device identifier is changed into a second device identifier, the second device identifier comprising a second MAC address and a second IP address, the second MAC address being different from the first MAC address, and / or the second IP address being different from the first IP address; and if it is identified that the first device identifier is changed into the second device identifier, replacing the first device identifier in the first binding record with the second device identifier so as to update the first binding record. Based on the method, the accuracy and efficiency of equipment identification can be improved.

Description

Method, device and electronic device for determining unique identification of device Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, apparatus, and electronic device for determining a unique identifier of a device. Background Art

[0002] Device identification is crucial for certain business scenarios (e.g., asset management, network traffic analysis). In related technologies, the Internet Protocol (IP) address or Media Access Control (MAC) address of a device is typically used as a unique identifier for identifying a device. An IP address is a unique number used to identify a device connected to the Internet. A MAC address is used to identify a unique network interface in a device. The reason for using an IP address or MAC address as a unique identifier for a device is that it is easy to obtain from the network.

[0003] However, in complex network environments, devices cannot be accurately identified based on their IP or MAC addresses. For example, the IP address of the same device may change when it connects to the same network at different times. In another example, the same device may be connected to different networks at the same time through two or more network cards, resulting in the device being assigned multiple IP and MAC addresses. In these scenarios, the same device may be identified as different devices based on its IP or MAC address, resulting in inaccurate device identification.

[0004] Summary of the Invention

[0005] In view of this, the present invention provides a method, apparatus, and electronic device for determining a unique identifier of a device, which are used to at least partially solve the above technical problems.

[0006] In a first aspect, an embodiment of the present application provides a method for determining a unique identifier of a device, including:

[0007] Obtaining a first device identifier of a first terminal device and a first client certificate of the first terminal device, where the first device identifier includes a first MAC address and a first IP address;

[0008] Binding the first client certificate and the first device identifier as a first binding record, where the first binding record is used to uniquely identify the first terminal device;

[0009] identifying, based on the first client certificate, whether the first device identifier is changed to a second device identifier, wherein the second device identifier includes a second MAC address and a second IP address, the second MAC address being different from the first MAC address and / or the second IP address being different from the first IP address;

[0010] If it is identified that the first device identifier is changed to the second device identifier, the first device identifier in the first binding record is replaced with the second device identifier to update the first binding record.

[0011] In a possible implementation, identifying, based on the first client certificate, whether the first device identifier is changed to a second device identifier includes:

[0012] Obtaining the second device identifier of the second terminal device and a second client certificate of the second terminal device;

[0013] If the second client certificate is the same as the first client certificate, it is determined that the first terminal device and the second terminal device are the same terminal device, and the first device identifier is changed to the second device identifier.

[0014] In a possible implementation, obtaining the first device identifier of the first terminal device and the first client certificate of the first terminal device includes:

[0015] Obtaining, from interaction information between the first terminal device and the authentication server when the first terminal device accesses the network, a MAC address and a client certificate of the first terminal device as the first MAC address and the first client certificate, respectively;

[0016] The IP address of the first terminal device is obtained from the interaction information between the first terminal device and the DHCP server when the first terminal device requests an IP address, as the first IP address.

[0017] In one possible implementation, obtaining, from information exchanged between the first terminal device and the authentication server when the first terminal device accesses the network, the MAC address and the client certificate of the first terminal device as the first MAC address and the first client certificate, respectively, includes:

[0018] Obtaining an authentication access start request sent by the first terminal device when accessing the network;

[0019] Obtaining a MAC address of the first terminal device from the authentication access start request as the first MAC address;

[0020] Obtaining an access authentication request sent by the first terminal device to the authentication server when performing network authentication;

[0021] Obtain a client certificate of the first terminal device from the access authentication request as the first MAC address.

[0022] In a possible implementation, acquiring the IP address of the first terminal device as the first IP address from interaction information between the first terminal device and the DHCP server when requesting the IP address includes:

[0023] Obtaining a DHCP response sent by the DHCP server in response to the DHCP request of the first terminal device;

[0024] Acquire the IP address of the first terminal device from the DHCP response as the first IP address.

[0025] In a second aspect, an embodiment of the present application provides an apparatus for determining a unique identifier of a device, comprising:

[0026] an acquisition module, configured to acquire a first device identifier of the first terminal device and a first client certificate of the first terminal device, wherein the first device identifier includes a first MAC address and a first IP address;

[0027] a binding module, configured to bind the first client certificate and the first device identifier as a first binding record, wherein the first binding record is used to uniquely identify the first terminal device;

[0028] an identification module, configured to identify, based on the first client certificate, whether the first device identifier has been changed to a second device identifier, wherein the second device identifier includes a second MAC address and a second IP address, the second MAC address being different from the first MAC address and / or the second IP address being different from the first IP address;

[0029] The updating module is configured to replace the first device identifier in the first binding record with the second device identifier to update the first binding record into a first binding record if it is recognized that the first device identifier is changed to the second device identifier.

[0030] In a possible implementation, the identification module is specifically configured to:

[0031] Obtaining the second device identifier of the second terminal device and a second client certificate of the second terminal device;

[0032] If the second client certificate is the same as the first client certificate, it is determined that the first terminal device and the second terminal device are the same terminal device, and the first device identifier is changed to the second device identifier.

[0033] In a possible implementation, the acquisition module is specifically configured to:

[0034] Obtaining a first device identifier of a first terminal device and a first client certificate of the first terminal device includes:

[0035] Obtaining, from interaction information between the first terminal device and the authentication server when the first terminal device accesses the network, a MAC address and a client certificate of the first terminal device as the first MAC address and the first client certificate, respectively;

[0036] The IP address of the first terminal device is obtained from the interaction information between the first terminal device and the DHCP server when the first terminal device requests an IP address, as the first IP address.

[0037] In a possible implementation, the acquisition module is specifically configured to:

[0038] Obtaining an authentication access start request sent by the first terminal device when accessing the network;

[0039] Obtaining a MAC address of the first terminal device from the authentication access start request as the first MAC address;

[0040] Obtaining an access authentication request sent by the first terminal device to the authentication server when performing network authentication;

[0041] Obtain a client certificate of the first terminal device from the access authentication request as the first client certificate.

[0042] In a possible implementation, the acquisition module is specifically configured to:

[0043] Obtaining a DHCP response sent by the DHCP server in response to the DHCP request of the first terminal device;

[0044] Obtain the IP address of the first terminal device from the DHCP response.

[0045] In a third aspect, an electronic device is provided, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the method described in any one of the first aspects.

[0046] According to a fourth aspect, a computer-readable storage medium is provided, on which computer-executable instructions are stored, wherein when the computer-executable instructions are executed, the processor is caused to perform any one of the methods described in the first aspect.

[0047] The embodiments of the present application provide a method, apparatus, and electronic device for determining a unique device identifier. Due to the uniqueness of the first client certificate of the first terminal device, even when the first device identifier of the first terminal device is changed to the second device identifier, that is, when the MAC address of the first terminal device is changed from the first MAC address to the second MAC address and / or the IP address of the first terminal device is changed from the first IP address to the second MAC address, the first client certificate based on the first terminal device can immediately identify the above changes and make updates, thereby uniquely and accurately identifying the device and improving the accuracy of device identification. In addition, due to the uniqueness and persistence of the first client certificate, it is ensured that the first binding record always uniquely identifies the first terminal device. Therefore, when processing business logic such as device query, device update, device merger, and device binding, the complexity of business logic processing can be significantly reduced, and work efficiency can be improved. At the same time, due to the uniqueness and persistence of the first client certificate, it is ensured that the first binding record always uniquely identifies the first terminal device, avoiding the need to manually set other identity identifiers for the first terminal device to uniquely identify the first terminal device, saving labor costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] FIG1 is an architecture diagram of a system applicable to the method for determining a unique identifier of a device provided in an embodiment of the present application;

[0049] FIG2 is a schematic flow chart of a method for determining a unique identifier of a device provided in an embodiment of the present application;

[0050] 3 is a schematic diagram of a process for obtaining a MAC address and a client certificate of a first terminal device according to an embodiment of the present application;

[0051] FIG4 is a schematic diagram of a process for obtaining an IP address of a first terminal device according to an embodiment of the present application;

[0052] 5 is a signal flow diagram of a process for obtaining a MAC address, a client certificate, and an IP address of a first terminal device provided by an embodiment of the present application;

[0053] FIG6 is a schematic diagram of the structure of an apparatus for determining a unique identifier of a device provided in an embodiment of the present application;

[0054] FIG7 is a schematic structural diagram of an electronic device provided in an embodiment of the present application.

[0055] List of reference numerals:

[0056] 10: Terminal device 20: Access device 30: Authentication server

[0057] 40: DHCP server 30A: Radius server

[0058] S201: Obtaining a first device identifier of a first terminal device and a first client certificate of the first terminal device

[0059] S202: Bind the first client certificate and the first device identifier as a first binding record

[0060] S203: Based on the first client certificate, identify whether the first device identifier is changed to the second device identifier.

[0061] S204: If it is recognized that the first device identifier is changed to the second device identifier, the first device identifier in the first binding record is changed to the second device identifier.

[0062] The device identifier is replaced with the second device identifier to update the first binding record.

[0063] 301, 401: MAC address 302: Client certificate 402: IP address

[0064] 1: The first terminal device sends an authentication access start message to the access device<EAPoL start>

[0065] 2: The access device can send an identification request to the first terminal device <eap-request identity>

[0066] 3: The first terminal device sends an identification response message to the access device <eap-respons identity>

[0067] 4: The access device will recognize the response message <eap-respons identity>Encapsulated into a Radius access request message<RADIUS AcessRequset / Identity> , sent to the Raduis server

[0068] 5: The Raduis server sends a TLS-Start request message to the first terminal device via the access device <eap-tls-request starttls>

[0069] 6: The first terminal device sends a client hello message to the Raduis server via the access device <eap-tls-request clienthello>

[0070] 7: The Raduis server sends a server hello message to the first terminal device via the access device<Radius Access-Challenge / ServerHello>

[0071] 8: The first terminal device sends a TLS response message to the Raduis server via the access device <eap-tls-response certificate>

[0072] 9: The Raduis server sends a handshake completion message to the first terminal device via the access device<EAP-TLS-Request / ChangeCipherSpec_Finished>

[0073] 10: The Raduis server sends an access acceptance response message to the access device<Radius AccessResponse / Accept>

[0074] 11: The access device sends an authentication success message to the first terminal device <eap-success>

[0075] 12: The first terminal device sends a DHCP request to the DHCP server via the access device<DHCP Request>

[0076] 13: The DHCP server sends a DHCP response to the first terminal device via the access device<DHCP ACK>

[0077] S501: Receive an authentication access start message from the first terminal device<EAPoL Start> Message, obtain the MAC address of the first terminal device

[0078] S502: Response message from TLS <eap-tls-response certificate>Obtain the client certificate of the first terminal device 1

[0079] S503: Obtaining the MAC address of the first terminal device from the DHCP request

[0080] S504: Obtain the IP address of the first terminal device from the DHCP response

[0081] 60: Method for determining the unique identifier of a device 601: Acquisition module

[0082] 602: Binding module 603: Identification module 604: Update module

[0083] 70: Electronic device 702: Processor 704: Communication interface

[0084] 706: Memory 708: Communication bus 710: Executable instructions DETAILED DESCRIPTION

[0085] To make the objectives, technical solutions, and advantages of this application more clearly understood, the present application is further described in detail below with reference to the accompanying drawings and examples. It is apparent that the described embodiments are only a portion of the embodiments of this application, rather than all of them. All other technical solutions derived by those of ordinary skill in the art based on the embodiments in this application fall within the scope of protection of this application.

[0086] Device identification is crucial for certain business scenarios, such as asset management and network traffic analysis. In related technologies, IP addresses and MAC addresses are often used as unique identifiers to identify devices connected to a network, given that they are easily obtained from the network.

[0087] However, as mentioned above, in some scenarios, the IP address of the same device may change when it connects to the same network at different times. For example, the device's IP address may switch from 172.xx2 to 172.xx3. Therefore, in such scenarios, the IP address cannot serve as a persistent and unique identifier for the device. Identifying devices based on IP addresses may result in the same device being identified as two different devices, leading to inaccurate device identification.

[0088] For example, in another scenario, a device has two different network cards and can be connected to different networks at the same time. Because the device has two different network cards, it is assigned two sets of IP addresses and MAC addresses, meaning that the device has a multi-valued unique identifier. In this scenario, the same device can be identified as two or more different devices based on its IP and MAC addresses, resulting in inaccurate device identification.

[0089] Furthermore, using MAC addresses as unique device identifiers presents other challenges in certain business scenarios. For example, when analyzing network traffic, it's often necessary to identify the source of a packet (i.e., the device that sent it). However, since a packet's MAC address changes after passing through a network device (e.g., a switch or router), it cannot be used to identify the source.

[0090] Based on the above problems, embodiments of the present application provide a method and apparatus for determining a unique identifier of a device, so as to at least partially solve the above technical problems.

[0091] The specific implementation of the embodiments of the present application is described in detail below with reference to the accompanying drawings.

[0092] For ease of understanding, the architecture diagram of a system applicable to the embodiments of the present application will first be described with reference to Figure 1. Figure 1 is an architecture diagram of a schematic system applicable to the method for determining a unique device identifier provided in the embodiments of the present application. As shown in Figure 1, the system includes: a terminal device 10, such as factory equipment that needs to access an IT network or an OT network; an access device 20, such as a switch or router; an authentication server 30, such as a Radius server, for authenticating the terminal device 10 when it accesses the network; and a DHCP server 40, for assigning dynamic IP addresses to the terminal devices 10 within the local area network. The terminal device 10 accesses the network through the access device 20. When accessing the network, the terminal device 10 interacts with the authentication server 30 through the access device 20 to complete access authentication. After successful access authentication, the terminal device 10 interacts with the DHCP server 40 through the access device 20 to request an IP address from the DHCP server 40. In response to the request from the terminal device 10, the DHCP server assigns an IP address to the terminal device 10.

[0093] The method for determining a device unique identifier provided in the embodiment of the present application can be executed by the access device 20, or by another device in communication with the access device 20. The method for determining a device unique identifier provided in the embodiment of the present application is described in detail below based on the system of FIG1 .

[0094] FIG2 is a flowchart of a method for determining a unique device identifier provided by an embodiment of the present application. The method can be performed by the access device 20 in FIG1 or by another device in communication with the access device 20. As shown in FIG2 , the method includes:

[0095] S201: Obtain a first device identifier of a first terminal device 10 and a first client certificate of the first terminal device 10.

[0096] The first device identifier includes a first MAC address and a first IP address.

[0097] The first terminal device 10 corresponds to the terminal equipment shown in FIG1 , which may include factory equipment or other similar equipment connected to an OT network or an IT network.

[0098] The first client certificate is a digital certificate used to verify the legal identity of the first terminal device 10 during network communication. For the first terminal device 10, the first client certificate is unique and permanent.

[0099] In one implementation of the present application, step S201 may include:

[0100] Step A: Acquire the MAC address and client certificate of the first terminal device 10 from the interaction information between the first terminal device 10 and the authentication server 30 when the first terminal device 10 accesses the network, as the first MAC address and the first client certificate respectively.

[0101] Specifically, as shown in Figure 3, when the first terminal device 10 connects to the network, it first needs to interact with the authentication server 30 through the access device 20 to complete access authentication. During this interaction, the first terminal device 10 first provides its MAC address to the access device 20. The access device 20 then interacts with the first terminal device 10 based on the MAC address sent by the first terminal device 10, requesting information such as the first terminal device 10's username and client certificate to be provided to the authentication server 30, thereby completing authentication between the first terminal device 10 and the authentication server 30.

[0102] During the above interaction process, the access device 20 can obtain the MAC address and client certificate of the first terminal device 10 from the interaction information between the first terminal device 10 and the authentication server 30, as the first MAC address and the first client certificate, respectively. In one possible implementation, the access device 20 obtains the authentication access start request sent by the first terminal device 10 when accessing the network; obtains the MAC address 301 of the first terminal device 10 from the authentication access start request as the first MAC address; obtains the access authentication request sent by the first terminal device 10 to the authentication server 30 via the access device 20 when performing network authentication; and obtains the client certificate 302 of the first terminal device 10 from the access authentication request as the first client certificate.

[0103] To facilitate understanding of the above process, the above process is described in detail below with reference to the example of Figure 5. Figure 5 is a signal flow diagram of a process for obtaining the MAC address, client certificate, and IP address of the first terminal device 10, provided in an embodiment of the present application. In Figure 5, the Raduis server 30A is used as the authentication server, and the EAP-TLS protocol is used between the first terminal device 10 and the Raduis server for access authentication as an example. It should be understood that Figure 5 is only an example. In other embodiments, the first terminal device 10 and the authentication server 30 may use other suitable protocols for access authentication, and this embodiment does not limit this.

[0104] As shown in FIG5 , in information flow 1, the first terminal device 10 sends an authentication access start message to the access device 20<EAPoL start> (i.e., authentication access start request), indicating that access authentication has started.<EAPoL start> The MAC address of the first terminal device 10 is carried in it.

[0105] According to the authentication access start message, the access device 20 can obtain the MAC address of the first terminal device 10 from the authentication access start message (i.e., S501). Specifically, according to the authentication access start message, the MAC address of the first terminal device 10 is obtained from the data link layer as the first MAC address. In addition, in response to receiving the authentication access start message, in information flow 2, the access device 20 can send an identification request to the first terminal device 10. <eap-request identity>, requiring the first terminal device 10 to provide an identity.

[0106] In response to receiving an identification request message <eap-request identity>In information flow 3, the first terminal device 10 sends an identification response message to the access device 20 <eap-respons identity>, whose content is the user's identity.

[0107] In information flow 4, the access device 20 will identify the response message <eap-respons identity>Encapsulated into a Radius access request message<RADIUS AcessRequset / Identity> , transmitted to the Raduis server 30A.

[0108] The Raduis server 30A receives the Radius access request message<RADIUS AccessRequset / Identity> After obtaining the identity of the first terminal device 10, in information flow 5, a TLS-Start request message is sent to the first terminal device 10 via the access device 20. <eap-tls-request starttls>It should be understood that, to simplify the diagram, Figure 5 omits the message encapsulation and decapsulation processes performed by access device 20 to forward messages between first terminal device 10 and Raduis server 30A. In practice, the communication process between first terminal device 10 and Raduis server 30A is always conducted via access device 20 and will not be further described below.

[0109] The first terminal device 10 receives a TLS-Start request message <eap-tls-request stattls>Afterwards, in signal flow 6, a client hello message is sent to the Raduis server 30A via the access device 20. <eap-tls-request clienthello>The message includes the supported TLS protocol version, supported encryption algorithm, supported compression method, etc.

[0110] In response to receiving a client hello message <eap-tls-request clienthello>In signal flow 7, the Raduis server 30A sends a server hello message to the first terminal device 10 via the access device 20.<Radius Access-Challenge / ServerHello> The message contains information such as the TLS protocol version to be used, the encryption algorithm to be used, the server certificate, and the request for the client to provide a certificate.

[0111] The first terminal device 10 receives the server hello message <eap-tls-request serverhello>Then, in signal flow 8, a TLS response message is sent to the Raduis server 30A via the access device 20. <eap-tls-response certificate>, the message includes the client certificate of the first terminal device 10. At this time, the access device 20 can also receive the TLS response message <eap-tls-response certificate>The client certificate of the first terminal device 10 is obtained from the transport layer (ie, S502). Specifically, according to the message, the client certificate of the first terminal device 10 is obtained from the transport layer as the first client certificate.

[0112] In response to receiving a TLS response message <eap-tls-response certificate>In signal flow 9, the Raduis server 30A sends a handshake completion message to the first terminal device 10 via the access device 20.<EAP-TLS-Request / ChangeCipherSpec_Finished> , indicating that the handshake is over, and in signal flow 10, the Raduis server 30A sends an access acceptance response message to the access device 20<Radius AccessResponse / Accept> , indicating that the authentication is completed. After the access device 20 decapsulates the message, it sends an authentication success message to the first terminal device 10 in the signal flow 11. <eap-success>, the authentication is now complete.

[0113] As described above, during the interaction between the first terminal device 10 and the Raduis server 30A via the access device 20, the access device 20 may execute step S501, according to the authentication access start message received from the first terminal device 10 in the signal flow 1.<EAPoL Start> Message, obtain the MAC address of the first terminal device. Specifically, according to the message, the MAC address of the first terminal device 10 is obtained from the data link layer as the first MAC address. In addition, the access device 20 can also perform step S502 according to the TLS response message received from the first terminal device 10 in the signal flow 8 <eap-tls-response certificate>The client certificate of the first terminal device 10 is obtained from the transport layer. Specifically, according to the message, the client certificate of the first terminal device 10 is obtained from the transport layer as the first client certificate.

[0114] Step B: Acquire the IP address of the first terminal device 10 from the interaction information between the first terminal device 10 and the DHCP server 40 when the first terminal device 10 requests an IP address, as the first IP address.

[0115] Specifically, after the first terminal device 10 completes access authentication, the first terminal device 10 interacts with the DHCP server via the access device 20 to obtain the dynamic IP address assigned to it by the DHCP server. For example, as shown in Figure 4, the first terminal device 10 can send its MAC address 401 to the access device 20, and the access device 20 forwards the MAC address 401 to the DHCP server. After the DHCP server determines the IP address based on the MAC address, it sends the IP address 402 to the access device 20, which is forwarded to the first terminal device 10 by the access device 20. In this way, the first terminal device 10 obtains the IP address dynamically assigned to it by the access device 20. During the interaction between the DHCP server and the first terminal device 10, the access device 20 can obtain the MAC address sent by the first terminal device 10 to the DHCP server and the IP address assigned to the first terminal device 10 by the DHCP server, and use the IP address as the first IP address.

[0116] 5, when the first terminal device 10 requests an IP address, the first terminal device 10 sends a DHCP request to the DHCP server via the access device 20 in the signal flow 12.<DHCP Request> The DHCP request includes the MAC address of the first terminal device 10. In response to receiving the DHCP request, in signal flow 13, the DHCP server 40 sends a DHCP response to the first terminal device 10 via the access device 20.<DHCP ACK> , the DHCP response includes the IP address assigned by the DHCP server 40 to the first terminal device 10. It should be understood that, in order to simplify the view, the process of the access device 20 forwarding the DHCP request and the DHCP response is omitted in Figure 5. It should be understood that, in actual application, the communication between the first terminal device 10 and the DHCP server 40 is carried out via the access device 20. When the access device 20 receives the DHCP request sent by the first terminal device 10 to the DHCP server 40, the access device 20 executes step S503 to obtain the MAC address of the first terminal device 10 from the DHCP request. In addition, when the access device 20 receives the DHCP response sent by the DHCP server 40 to the first terminal device 10, it executes step S504 to obtain the IP address of the first terminal device 10 from the DHCP response.

[0117] Returning to FIG. 2 , according to S202 in FIG. 2 , the first client certificate and the first device identifier are bound as a first binding record;

[0118] The first binding record is used to uniquely identify the first terminal device 10 .

[0119] Specifically, after the access device 20 obtains the MAC address and client certificate of the first terminal device 10, it binds the MAC address and client certificate, that is, binds the first MAC address and the first client certificate. Thereafter, after receiving the MAC address and IP address of the first terminal device 10, it can bind the MAC address and the IP address, thereby binding the MAC address, client certificate, and IP address of the first terminal device 10 as a first binding record to uniquely identify the first terminal device 10.

[0120] It should be understood that when the first terminal device 10 accesses the network, the access device 20 can always obtain a triple consisting of the MAC address, client certificate, and IP address of the first terminal device 10 to identify the first terminal device 10 .

[0121] S203: Based on the first client certificate, identify whether the first device identifier is changed to the second device identifier.

[0122] The second device identifier includes a second MAC address and a second IP address, the second MAC address is different from the first MAC address, and / or the second IP address is different from the first IP address;

[0123] As mentioned above, in complex application scenarios, the same terminal device may have two MAC addresses or the MAC address of the same terminal device obtained by the access device 20 may change due to various other reasons. Due to the uniqueness of the client certificate, the same terminal device only has a unique and persistent client certificate. When the MAC address of the same terminal device changes, during the authentication access process, it is easy to identify such a change based on the client certificate of the terminal device. Therefore, when the first MAC address of the first terminal device 10 changes from the first MAC address to the second MAC address, the access device 20 can easily identify such a change based on the client certificate, which is conducive to the subsequent timely update of the MAC address and ensures the unique identification of the first terminal device 10.

[0124] Similarly, as mentioned above, since the DHCP server 40 dynamically assigns IP addresses, after the first terminal device 10 completes authentication access, its IP address will also change when accessing the network at different times. Due to the uniqueness and persistence of the first client certificate, such changes can be identified based on the first client certificate. In addition, since the MAC address of the first terminal device 10 is identified based on the first client certificate during the authentication access process and the MAC address is updated in a timely manner when the MAC address changes, in the subsequent stage, it is also possible to directly identify whether the IP address of the first terminal device 10 has changed from the first IP address to the second IP address based on the MAC address of the first terminal device 10.

[0125] In a specific implementation of the present application, based on the first client certificate, identifying whether the first device identifier has changed to the second device identifier includes: obtaining the second device identifier of the second terminal device and the second client certificate of the second terminal device; if the second client certificate is the same as the first client certificate, determining that the first terminal device 10 and the second terminal device are the same terminal device, and the first device identifier is changed to the second device identifier.

[0126] The second terminal device and the first terminal device 10 can be the same device or different devices. The access device 20 can obtain the second device identifier of the second terminal device in the same manner as the first device identifier of the first terminal device 10. Due to the uniqueness and persistence of client certificates, the access device 20 can determine whether the second terminal device and the first terminal device 10 are the same terminal device based on whether the second client certificate in the second device identifier of the second terminal device is the same as the first client certificate. If, during the authentication access process, the first client certificate is the same as the first client certificate, but the first MAC address is different from the second MAC address, it can be determined that the first terminal device 10 and the second terminal device are the same terminal device and the MAC address of the first terminal device 10 has changed. Similarly, if, after access authentication is completed, the first terminal device 10 and the second terminal device, which have the same MAC address, respectively have a first IP address and a second IP address, and the first IP address and the second IP address are different, it can be determined that the first terminal device 10 and the second terminal device are the same terminal device and the IP address of the first terminal device 10 has changed from the first IP address to the second IP address.

[0127] S204: If it is identified that the first device identifier is changed to the second device identifier, the first device identifier in the first binding record is replaced with the second device identifier to update the first binding record.

[0128] Specifically, in the case where it is identified that the MAC address of the first terminal device 10 has changed from the first MAC address to the second MAC address, the first MAC address in the first binding record can be updated to the second MAC address to update the first binding record, thereby ensuring the unique identification of the first terminal device 10. Similarly, in the case where the IP address of the first terminal device 10 has changed from the first IP address to the second IP address, the first IP address in the first binding record can be updated to the second IP address to update the first binding record. In the case where it is identified that the MAC address of the first terminal device 10 has changed from the first MAC address to the second MAC address, and the IP address of the terminal device has changed from the first IP address to the second IP address, the first MAC address in the first binding record can be updated to the second MAC address, and the first IP address can be updated to the second IP address to update the first binding record, thereby ensuring the unique identification of the first terminal device 10.

[0129] In an embodiment of the present application, due to the uniqueness of the first client certificate of the first terminal device, even when the first device identifier of the first terminal device is changed to the second device identifier, that is, when the MAC address of the first terminal device is changed from the first MAC address to the second MAC address and / or the IP address of the first terminal device is changed from the first IP address to the second MAC address, the first client certificate based on the first terminal device can immediately identify the above changes and make updates, thereby uniquely and accurately identifying the device and improving the accuracy of device identification. In addition, due to the uniqueness and persistence of the first client certificate, it is ensured that the first binding record always uniquely identifies the first terminal device. Therefore, when processing business logic such as device query, device update, device merger and device binding, the complexity of business logic processing can be significantly reduced, and work efficiency can be improved. At the same time, due to the uniqueness and persistence of the first client certificate, it is ensured that the first binding record always uniquely identifies the first terminal device, avoiding the need to manually set other identity identifiers for the first terminal device to uniquely identify the first terminal device, saving labor costs.

[0130] FIG6 is a schematic diagram of the structure of an apparatus for determining a unique device identifier according to an embodiment of the present application. The apparatus 60 may be the access device shown in FIG1 , or may be integrated into the access device, or may be in communication with the access device to execute the method for determining a unique device identifier according to the aforementioned method embodiment. As shown in FIG5 , the apparatus includes:

[0131] An acquisition module 601 is configured to acquire a first device identifier of a first terminal device and a first client certificate of the first terminal device, where the first device identifier includes a first MAC address and a first IP address;

[0132] A binding module 602 is configured to bind a first client certificate to a first device identifier as a first binding record, where the first binding record is used to uniquely identify the first terminal device;

[0133] an identification module 603, configured to identify, based on the first client certificate, whether the first device identifier is changed to a second device identifier, where the second device identifier includes a second MAC address and a second IP address, where the second MAC address is different from the first MAC address and / or the second IP address is different from the first IP address;

[0134] The updating module 604 is configured to replace the first device identifier in the first binding record with the second device identifier to update the first binding record into a first binding record if it is recognized that the first device identifier is changed to the second device identifier.

[0135] In a possible implementation, the identification module is specifically configured to:

[0136] Obtain a second device identifier of the second terminal device and a second client certificate of the second terminal device;

[0137] If the second client certificate is the same as the first client certificate, it is determined that the first terminal device and the second terminal device are the same terminal device, and the first device identifier is changed to the second device identifier.

[0138] In a possible implementation, the acquisition module is specifically configured to:

[0139] Obtaining a first device identifier of a first terminal device and a first client certificate of the first terminal device includes:

[0140] Obtaining, from interaction information between the first terminal device and the access authentication server when the first terminal device accesses the network, a MAC address and a client certificate of the first terminal device as the first MAC address and the first client certificate, respectively;

[0141] The IP address of the first terminal device is obtained from the interaction information between the first terminal device and the DHCP server when the first terminal device requests an IP address, as the first IP address.

[0142] In a possible implementation, the acquisition module is specifically configured to:

[0143] Obtaining an authentication access start request sent by the first terminal device when accessing the network;

[0144] Obtaining the MAC address of the first terminal device from the authentication access start request;

[0145] Obtaining an access authentication request sent by the first terminal device to the authentication server when performing network authentication;

[0146] Obtain a client certificate of the first terminal device from the access authentication request.

[0147] In a possible implementation, the acquisition module is specifically configured to:

[0148] Obtaining a DHCP response sent by the DHCP server in response to the DHCP request of the first terminal device;

[0149] Obtain the IP address of the first terminal device from the DHCP response.

[0150] The apparatus for determining a unique device identifier provided in this embodiment is used to implement the corresponding methods for determining a unique device identifier in the aforementioned multiple method embodiments, and has the beneficial effects of the corresponding method embodiments, which are not further described here. In addition, the functional implementation of each module in the apparatus for determining a unique device identifier in this embodiment can be referred to the description of the corresponding parts in the aforementioned method embodiments, and is not further described here.

[0151] Figure 7 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device 70 may be the access device 20 in Figure 1, or may be integrated in the access device 20, or may be communicatively connected to the access device 20 to execute the method for determining the unique identification of the device provided in the aforementioned method embodiment. As shown in Figure 7, the electronic device may include: a processor 702, a communication interface 704, a memory 706 storing a program (at least one executable instruction 710), and a communication bus 708.

[0152] The processor, the communication interface, and the memory communicate with each other via a communication bus.

[0153] Communication interface, used to communicate with other electronic devices or servers.

[0154] The processor is used to execute the program, and specifically can execute the relevant steps in the above method embodiment.

[0155] Specifically, the program may include program codes including computer operation instructions.

[0156] The processor may be a CPU, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs, or may be processors of different types, such as one or more CPUs and one or more ASICs.

[0157] Memory is used to store programs. The memory may include high-speed RAM memory, and may also include non-volatile memory (non-volatile memory), such as at least one disk storage.

[0158] The program can be specifically used to enable the processor to execute the method for determining the unique identifier of a device provided in the aforementioned method embodiment.

[0159] In addition, the specific implementation of each step in the program can refer to the corresponding description of the corresponding steps and units in the above method embodiments, and will not be repeated here. Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working process of the above-described devices and modules can refer to the corresponding process description in the above method embodiments, and will not be repeated here.

[0160] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present application.

[0161] The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or can be implemented as software or computer code that can be stored in a recording medium (such as CD ROM, RAM, floppy disk, hard disk or magneto-optical disk), or can be implemented as computer code that is originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded via a network and will be stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a special-purpose processor or programmable or special-purpose hardware (such as ASIC or FPGA). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, the method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the method shown here, the execution of the code converts the general-purpose computer into a special-purpose computer for executing the method shown here.

[0162] The present application also provides a computer-readable storage medium having computer-executable instructions stored thereon. When executed, the computer-executable instructions cause the processor to perform any of the methods described in the aforementioned method embodiments. This medium has the same operating principles and technical effects as the aforementioned method embodiments. To avoid redundancy, the details are not repeated here.

[0163] The present invention has been shown and described in detail above through the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art can know that the code review methods in the above different embodiments can be combined to obtain more embodiments of the present invention, and these embodiments are also within the scope of protection of the present invention.

Claims

1. A method for determining a unique identifier of a device, comprising: Obtaining a first device identifier of a first terminal device and a first client certificate of the first terminal device (S201), wherein the first device identifier includes a first MAC address and a first IP address; Binding the first client certificate and the first device identifier as a first binding record (S202), wherein the first binding record is used to uniquely identify the first terminal device; Based on the first client certificate, identifying whether the first device identification is changed to a second device identification (S203), wherein the second device identification includes a second MAC address and a second IP address, the second MAC address being different from the first MAC address and / or the second IP address being different from the first IP address; If it is identified that the first device identifier is changed to the second device identifier, the first device identifier in the first binding record is replaced with the second device identifier to update the first binding record (S204).

2. The method according to claim 1, characterized in that The identifying, based on the first client certificate, whether the first device identifier is changed to a second device identifier (S203) includes: Obtaining the second device identifier of the second terminal device and a second client certificate of the second terminal device; If the second client certificate is the same as the first client certificate, it is determined that the first terminal device and the second terminal device are the same terminal device, and the first device identifier is changed to the second device identifier.

3. The method according to claim 1 or 2, characterized in that The obtaining of the first device identifier of the first terminal device and the first client certificate of the first terminal device includes: Obtaining, from interaction information between the first terminal device and the authentication server when the first terminal device accesses the network, a MAC address and a client certificate of the first terminal device as the first MAC address and the first client certificate, respectively; The IP address of the first terminal device is obtained from the interaction information between the first terminal device and the DHCP server when the first terminal device requests an IP address, as the first IP address.

4. The method according to claim 3, characterized in that The acquiring, from interaction information between the first terminal device and the authentication server when the first terminal device accesses the network, the MAC address and the client certificate of the first terminal device as the first MAC address and the first client certificate, respectively, includes: Obtaining an authentication access start request sent by the first terminal device when accessing the network; Obtaining a MAC address of the first terminal device from the authentication access start request as the first MAC address; Obtaining an access authentication request sent by the first terminal device to the authentication server when performing network authentication; Obtain a client certificate of the first terminal device from the access authentication request as the first client certificate.

5. The method according to claim 3, characterized in that The acquiring, from interaction information between the first terminal device and the DHCP server when the first terminal device requests an IP address, the IP address of the first terminal device as the first IP address includes: Obtaining a DHCP response sent by the DHCP server in response to the DHCP request of the first terminal device; Acquire the IP address of the first terminal device from the DHCP response as the first IP address.

6. An apparatus for determining a unique identifier of a device, comprising: An acquisition module (601) is configured to acquire a first device identifier of the first terminal device and a first client certificate of the first terminal device, wherein the first device identifier includes a first MAC address and a first IP address; A binding module (602) is configured to bind the first client certificate and the first device identifier as a first binding record, wherein the first binding record is used to uniquely identify the first terminal device; an identification module (603) for identifying, based on the first client certificate, whether the first device identification is changed to a second device identification, wherein the second device identification includes a second MAC address and a second IP address, the second MAC address being different from the first MAC address, and / or the second IP address being different from the first IP address; The updating module (604) is configured to replace the first device identifier in the first binding record with the second device identifier to update the first binding record if it is recognized that the first device identifier is changed to the second device identifier.

7. The device according to claim 6, characterized in that The identification module (603) is specifically used for: Obtaining the second device identifier of the second terminal device and a second client certificate of the second terminal device; If the second client certificate is the same as the first client certificate, it is determined that the first terminal device and the second terminal device are the same terminal device, and the first device identifier is changed to the second device identifier.

8. The device according to claim 7, characterized in that The acquisition module (602) is specifically used for: Obtaining a first device identifier of a first terminal device and a first client certificate of the first terminal device includes: Obtaining, from interaction information between the first terminal device and the authentication server when the first terminal device accesses the network, a MAC address and a client certificate of the first terminal device as the first MAC address and the first client certificate, respectively; The IP address of the first terminal device is obtained from the interaction information between the first terminal device and the DHCP server when the first terminal device requests an IP address, as the first IP address.

9. An electronic device comprising: A processor (702), a memory (706), a communication interface (704), and a communication bus (708), wherein the processor, the memory, and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction (710), and the executable instruction enables the processor to perform operations corresponding to the method according to any one of claims 1 to 5.

10. A computer-readable storage medium having computer-executable instructions stored thereon, wherein: The computer executable instructions, when executed, cause the processor to perform the method according to any one of claims 1 to 5.

Images