Secure login method and device

Abstract

The invention provides a secure login method and device. According to the application, the start time point of the key negotiation is improved, the start time point of the key negotiation is executed before the submission instruction is received from the start time point of the key negotiation executed after the submission instruction is received, and the key negotiation is executed before the submission instruction is received due to the fact that the resource-constrained device and the network management device start key negotiation earlier. Therefore, the obtaining time point of the key negotiation result (encryption key) is earlier, equivalently, the resource-constrained device can obtain the encryption key in advance, so that after the user clicks the submission button, the time for the resource-constrained device to return the response is earlier, the time for the resource-constrained device to return the response is reduced, and the user experience is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a secure login method and device. Background Art

[0002] Resource-constrained devices are devices with limited resources such as central processing unit (CPU), memory or power. Resource-constrained devices are usually small devices.

[0003] At present, in the scenario where the administrator user manages the resource-constrained device through the network management device, at the first login, when the administrator user enters the identity credentials and clicks the submit button, the network management device uses an asymmetric encryption algorithm and an asymmetric encryption key to encrypt the input identity credentials to obtain the identity credentials ciphertext. The network management device transmits the identity credentials ciphertext to the resource-constrained device. The resource-constrained device uses an asymmetric encryption algorithm to decrypt the identity credentials ciphertext to obtain the identity credentials entered by the user, and the resource-constrained device encrypts and stores the identity credentials entered by the user and returns a response to the network device; when it is not the first login, when the administrator user enters the identity credentials and clicks the submit button, the network management device uses an asymmetric encryption algorithm to encrypt the identity credentials entered by the user to obtain the identity credentials ciphertext, and the network management device transmits the identity credentials ciphertext to the resource-constrained device, and the resource-constrained device uses an asymmetric encryption algorithm to decrypt the identity credentials ciphertext, and then verifies the identity credentials entered by the user and returns a response to the network device.

[0004] When the above method is used, the computing power of the resource-constrained device is weak. After the user clicks the submit button, it takes a long time to get a response from the resource-constrained device, resulting in a long response time and affecting the user experience. Summary of the invention

[0005] The present application provides a secure login method and device, which can reduce the time it takes for a resource-constrained device to return a response and improve user experience. The technical solution is as follows.

[0006] In a first aspect, a secure login method is provided, the method comprising: a network management device sends an access request to a resource-constrained device; the network management device receives an access response from the resource-constrained device for the access request, the access response being used to present a login page to the user; the network management device presents the login page to the user based on the access response, and starts key negotiation with the resource-constrained device in a target time period to obtain an encryption key, the start time point of the target time period being the time point when the network management device sends the access request, and the end time point of the target time period being the time point when the network management device receives a submission instruction on the login page, the submission instruction instructing to submit an identity credential to the resource-constrained device; the network management device, in response to receiving the identity credential and the submission instruction on the login page, encrypts the identity credential using the encryption key to obtain an identity credential ciphertext, the submission instruction including an operator; the network management device sends the identity credential ciphertext and an operator to the resource-constrained device, the operator being used to instruct to perform login-related operations based on the identity credential ciphertext.

[0007] In the method provided in the first aspect, the start time point of key negotiation (or the timing of starting key negotiation) is improved, and the start time point of key negotiation is advanced from being executed after receiving the submit instruction to being executed before receiving the submit instruction. Since the resource-constrained device and the network management device start key negotiation earlier, the time point of obtaining the result of the key negotiation (encryption key) will be earlier, which is equivalent to the resource-constrained device being able to obtain the encryption key in advance. Therefore, after the user clicks the submit button, the resource-constrained device will return a response earlier, thereby reducing the time it takes for the resource-constrained device to return a response and improving the user experience.

[0008] Furthermore, the network management device can make full use of the time period when the foreground waits for the user to input information such as identity credentials, for example, while the foreground waits for the identity credentials to be received, key negotiation is performed in parallel in the background. When the time consumed for key negotiation is less than or equal to the time consumed for inputting identity credentials, after the user clicks the submit button, there is no need to wait for the key negotiation between the resource-constrained device and the network management device to be completed, thereby further reducing the response time returned by the resource-constrained device.

[0009] In some implementations, the starting time point of the target time period is the time point when the network management device receives the access response or after the time point when the network management device receives the access response.

[0010] Since the start time of key negotiation is advanced to when the access response is received, the network management device does not need to wait for the parsing of the login page carried in the access response and the rendering of the login page before starting key negotiation. Instead, the network management device can perform key negotiation with the resource-constrained device in parallel while parsing the access response and rendering the login page. For example, key negotiation can be started before the login page is presented, thereby completing key negotiation as early as possible and further reducing the time it takes for the user to obtain a response after clicking to log in.

[0011] In some implementations, starting key negotiation with a resource-constrained device within a target time period includes: the network management device sending a negotiation request message to the resource-constrained device within the target time period; the network management device receiving a negotiation response message from the resource-constrained device, the negotiation response message including an encryption key.

[0012] In some implementations, the negotiation request message and the negotiation response message are both Hypertext Transfer Protocol HTTP messages; or, the negotiation request message and the negotiation response message are both Constrained Application Protocol COAP messages.

[0013] Considering that traditional secure channels (such as Transport Layer Security (TLS)) involve authentication, key negotiation, encrypted transmission, etc., and even involve adding message headers to introduce overhead of message fragmentation and reassembly, and resource-constrained devices are limited by insufficient processing resources, it is highly likely that it will be difficult to apply this secure channel to ensure communication security. In addition, the transport layer, network layer, and link layer of resource-constrained devices may not have available secure channels (such as TLS). Since key negotiation is performed at the application layer, the reliance on secure channels at the transport layer, network layer, or link layer is reduced, reducing additional overhead.

[0014] In some implementations, the encryption key includes a symmetric encryption key, and encrypting the identity credential using the encryption key includes: encrypting the identity credential using a symmetric encryption algorithm and the symmetric encryption key to obtain an identity credential ciphertext.

[0015] Considering that the speed of executing a symmetric encryption algorithm is faster than that of executing an asymmetric encryption algorithm, and generally the speed of executing a symmetric encryption algorithm is about 1000 times faster than that of executing an asymmetric encryption algorithm, the time spent on encrypting identity credentials can be significantly saved and the speed of encrypting identity credentials can be increased.

[0016] In some embodiments, the encryption key includes a symmetric encryption key. After the network management device sends the identity credential ciphertext and the operator to the resource-constrained device, the method also includes: the network management device receives the operation result corresponding to the operator from the resource-constrained device; in response to the operation result indicating that the login operation based on the identity credential ciphertext is successful, the network management device uses a symmetric encryption algorithm and a symmetric encryption key to encrypt the business data to obtain the ciphertext of the business data; the network management device sends the ciphertext of the business data to the resource-constrained device.

[0017] Since the service data is encrypted using the negotiated encryption key, the service data is transmitted in the form of ciphertext between the network management device and the resource-constrained device, thereby improving the transmission security of the service data.

[0018] In a second aspect, a secure login method is provided, the method comprising:

[0019] The resource-constrained device receives an access request from the network management device;

[0020] The resource-constrained device sends an access response to the access request to the network management device, where the access response is used to present a login page to the user;

[0021] The resource-constrained device starts to negotiate a key with the network management device in the target time period to obtain an encryption key. The starting time point of the target time period is the time point when the network management device sends an access request. The ending time point of the target time period is the time point when the network management device receives a submission instruction on the login page. The submission instruction indicates to log in to the resource-constrained device based on the identity credential. The submission instruction includes an operator.

[0022] The resource-constrained device receives an operator and an identity credential ciphertext from the network management device, where the operator is used to indicate a login operation to be performed based on the identity credential ciphertext;

[0023] The resource-constrained device performs the login operation indicated by the operator based on the identity credential ciphertext.

[0024] In some implementations, the resource-constrained device starts key negotiation with the network management device in the target time period, including:

[0025] In the target time period, the resource-constrained device receives a negotiation request message from the network management device, generates a negotiation response message corresponding to the negotiation request message, and sends the negotiation response message to the network management device, where the negotiation response message includes an encryption key.

[0026] In some implementations, the resource-constrained device performs a login operation indicated by an operator based on the identity credential ciphertext, including:

[0027] The resource-constrained device decrypts the identity credential ciphertext using a symmetric encryption algorithm and an encryption key to obtain a first identity credential;

[0028] In response to the login operation indicated by the operator being the first login, the resource-constrained device encrypts and stores the first identity credential locally on the resource-constrained device; or,

[0029] In response to the login operation indicated by the operator being a non-first login, the resource-constrained device performs consistency verification on the first identity credential and the second identity credential, where the second identity credential is the identity credential pre-stored locally on the resource-constrained device before the resource-constrained device receives the identity credential ciphertext.

[0030] In some implementations, after the resource-constrained device performs a login operation indicated by the operator based on the identity credential ciphertext, the method further includes:

[0031] The resource-constrained device sends the operation result corresponding to the operator to the network management device.

[0032] In some implementations, after the resource-constrained device sends the operation result corresponding to the operator to the network management device, the method further includes:

[0033] The resource-constrained device receives the ciphertext of the service data from the network management device;

[0034] The resource-constrained device uses a symmetric encryption algorithm and an encryption key to decrypt the ciphertext of the service data to obtain the service data.

[0035] In a third aspect, a secure login device is provided, which is disposed in a network management device, and the device includes:

[0036] A sending unit, used for sending an access request to a resource-constrained device;

[0037] A receiving unit, configured to receive an access response from a resource-constrained device to an access request, wherein the access response is used to present a login page to a user;

[0038] A processing unit, configured to present a login page to the user based on the access response, and to perform key negotiation with the resource-constrained device at the beginning of a target time period to obtain an encryption key, wherein the start time point of the target time period is the time point when the network management device sends the access request, and the end time point of the target time period is the time point when the network management device receives a submission instruction on the login page, wherein the submission instruction indicates that the identity credential is to be submitted to the resource-constrained device; in response to receiving the identity credential and the submission instruction on the login page, encrypt the identity credential using the encryption key to obtain a ciphertext of the identity credential, wherein the submission instruction includes an operator;

[0039] The sending unit is further used to send the identity credential ciphertext and the operator to the resource-constrained device, where the operator is used to instruct to perform a login operation based on the identity credential ciphertext.

[0040] In some implementations, the starting time point of the target time period is the time point when the network management device receives the access response or after the time point when the network management device receives the access response.

[0041] In some implementations, the sending unit is further configured to send a negotiation request message to the resource-constrained device in a target time period; the receiving unit is further configured to receive a negotiation response message from the resource-constrained device, wherein the negotiation response message includes an encryption key.

[0042] In some implementations, the negotiation request message and the negotiation response message are both Hypertext Transfer Protocol HTTP messages; or,

[0043] Both the negotiation request message and the negotiation response message are restricted application protocol COAP messages.

[0044] In some embodiments, the encryption key includes a symmetric encryption key, and the processing unit is configured to encrypt the identity credential using the symmetric encryption algorithm and the symmetric encryption key to obtain the identity credential ciphertext.

[0045] In some embodiments, the encryption key includes a symmetric encryption key, and the receiving unit is further configured to receive an operation result corresponding to the operator from the resource-constrained device;

[0046] The processing unit is further configured to, in response to the operation result indicating that the login operation based on the identity credential ciphertext is successfully performed, encrypt the business data using a symmetric encryption algorithm and a symmetric encryption key to obtain a ciphertext of the business data;

[0047] The sending unit is also used to send the ciphertext of the business data to the resource-constrained device.

[0048] In a fourth aspect, a secure login device is provided, which is disposed on a resource-constrained device, and the device includes:

[0049] A receiving unit, used for receiving an access request from a network management device;

[0050] A sending unit, used to send an access response to the access request to the network management device, where the access response is used to present a login page to the user;

[0051] A processing unit, configured to perform key negotiation with the network management device at the beginning of a target time period to obtain an encryption key, wherein the start time point of the target time period is the time point when the network management device sends an access request, and the end time point of the target time period is the time point when the network management device receives a submission instruction on a login page, wherein the submission instruction indicates logging into the resource-constrained device based on the identity credential, and the submission instruction includes an operator;

[0052] The receiving unit is further used to receive an operator and an identity credential ciphertext from the network management device, wherein the operator is used to indicate a login operation performed based on the identity credential ciphertext;

[0053] The processing unit is further used to execute the login operation indicated by the operator based on the identity credential ciphertext.

[0054] In some implementations, the receiving unit is configured to receive a negotiation request message from a network management device within a target time period;

[0055] The processing unit is further used to generate a negotiation response message corresponding to the negotiation request message;

[0056] The sending unit is further used to send a negotiation response message to the network management device, where the negotiation response message includes an encryption key.

[0057] In some embodiments, the processing unit is used to decrypt the identity credential ciphertext using a symmetric encryption algorithm and an encryption key to obtain a first identity credential; in response to the login type operation indicated by the operator being the first login, the first identity credential is encrypted and saved locally on the resource-constrained device; or, in response to the login type operation indicated by the operator being not the first login, the first identity credential is checked for consistency with the second identity credential, the second identity credential being an identity credential that is pre-saved locally on the resource-constrained device before the resource-constrained device receives the identity credential ciphertext.

[0058] In some implementations, the sending unit is further configured to send an operation result corresponding to the operator to the network management device.

[0059] In some implementations, the receiving unit is further configured to receive ciphertext of service data from the network management device;

[0060] The processing unit is further used to decrypt the ciphertext of the business data using a symmetric encryption algorithm and an encryption key to obtain the business data.

[0061] In a fifth aspect, a network management device is provided, the network management device comprising a processor, the processor is coupled to a memory, at least one computer program instruction is stored in the memory, and the at least one computer program instruction is loaded and executed by the processor, so that the network management device implements the method provided by the first aspect or any optional manner of the first aspect. The specific details of the network management device provided by the fifth aspect can be found in the first aspect or any optional manner of the first aspect, and will not be repeated here.

[0062] In a sixth aspect, a resource-constrained device is provided, the resource-constrained device comprising a processor, the processor coupled to a memory, the memory storing at least one computer program instruction, the at least one computer program instruction being loaded and executed by the processor, so that the resource-constrained device implements the method provided by the first aspect or any optional manner of the first aspect. The specific details of the resource-constrained device provided in the sixth aspect may be referred to the first aspect or any optional manner of the first aspect, and will not be repeated here.

[0063] In a seventh aspect, a computer-readable storage medium is provided, wherein the storage medium stores at least one instruction, and when the instruction is executed on a computer, the computer executes the method provided in the first aspect or any optional manner of the first aspect.

[0064] In an eighth aspect, a computer-readable storage medium is provided, wherein the storage medium stores at least one instruction, and when the instruction is executed on a computer, the computer executes the method provided in the second aspect or any optional manner of the second aspect.

[0065] In the ninth aspect, a computer program product is provided, which includes one or more computer program instructions. When the computer program instructions are loaded and executed by a computer, the computer executes the method provided by the first aspect or any optional method of the first aspect.

[0066] In the tenth aspect, a computer program product is provided, which includes one or more computer program instructions. When the computer program instructions are loaded and executed by a computer, the computer executes the method provided by the second aspect or any optional method of the second aspect.

[0067] In the eleventh aspect, a chip is provided, comprising a memory and a processor, wherein the memory is used to store computer instructions, and the processor is used to call and run the computer instructions from the memory to execute the method in the above-mentioned first aspect and any possible implementation of the first aspect.

[0068] In the twelfth aspect, a chip is provided, comprising a memory and a processor, wherein the memory is used to store computer instructions, and the processor is used to call and run the computer instructions from the memory to execute the method in the above-mentioned first aspect and any possible implementation of the first aspect.

[0069] In a thirteenth aspect, a network system is provided, the network system comprising the secure login device of the third aspect or any optional method of the third aspect and the secure login device of the fourth aspect or any optional method of the fourth aspect. Alternatively, the network system comprises the network management device of the fifth aspect or any optional method of the fifth aspect and the resource-constrained device of the sixth aspect or any optional method of the sixth aspect.

[0070] Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 It is a schematic diagram of the architecture of a network system provided in an embodiment of the present application;

[0072] Figure 2 A schematic diagram of a process flow of a secure login method provided in an embodiment of the present application is shown;

[0073] Figure 3 This is a schematic diagram of a key negotiation process provided by an embodiment of the present application;

[0074] Figure 4 A schematic diagram of an application scenario provided by an embodiment of the present application is shown;

[0075] Figure 5 A schematic diagram of a process flow of a secure login method provided in an embodiment of the present application is shown;

[0076] Figure 6 A schematic diagram of a process flow of a secure login method provided in an embodiment of the present application is shown;

[0077] Figure 7 A schematic diagram of an application scenario provided by an embodiment of the present application is shown;

[0078] Figure 8 It is a structural schematic diagram of a secure login device provided in an embodiment of the present application;

[0079] Fig. 9 is a structural diagram of a secure login device 820 provided in an embodiment of the present application;

[0080] Fig.10 It is a structural schematic diagram of a device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0081] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0082] The following is an explanation of some terminology concepts involved in the embodiments of the present application.

[0083] (1) Resource-constrained devices

[0084] Resource-constrained devices refer to devices with limited resources in one or more aspects of processing power (such as central processing unit (CPU) computing power), memory, storage space, network bandwidth and battery life. Due to limited resources, resource-constrained devices usually perform tasks with large computational requirements (such as key negotiation) at a relatively slow speed. For example, resource-constrained devices are network devices, wearable devices, Internet of Things devices or smart home devices. Network devices are, for example, dedicated hardware devices used to connect various network nodes (such as servers or terminals) to each other to form a communication network. Network devices are, for example, communication network devices or network security devices. Typical network devices include switches, routers, firewalls, bridges, hubs, gateways, virtual private networks (VPN) servers, network interface cards (NIC), wireless access points (WAP), modems, base stations, optical terminals, optical transceivers or optical cables, etc. Wearable devices include smart watches, smart glasses or smart bracelets, etc. Internet of Things devices include smart door locks, smart cameras, smart temperature and humidity sensors or smart home appliances, etc.

[0085] (2) Network management equipment

[0086] The network management device may also be referred to as a network management device, and the network management device is used to manage resource-constrained devices. Ways to manage resource-constrained devices include configuring or adjusting parameters of resource-constrained devices, monitoring the status of resource-constrained devices, or troubleshooting resource-constrained devices. In some possible implementations, the network management device is a dedicated network management device, such as a dedicated network manager or network management tool. In other possible implementations, the network management device is a general-purpose computer device, which can establish a connection with the resource management device in a remote login manner, thereby realizing the function of managing resource-constrained devices. For example, a general-purpose computer device manages resource-constrained devices in a browser / server (BS) mode, runs browser software on the general-purpose computer device, and the resource-constrained device acts as a server. The general-purpose computer device interacts with the resource-constrained device as a server through the browser software to achieve management of resource-constrained devices. General-purpose computer devices are, for example, terminals, such as personal computers (PCs), mobile phones, servers, laptops, tablet computers, or wearable devices.

[0087] (3) Symmetric encryption

[0088] Symmetric encryption is an encryption method. The main feature of symmetric encryption is that the same key is used when encrypting and decrypting data. In symmetric encryption, the sender and the receiver share the same key. The sender uses the key to encrypt data, and the receiver uses the same key to decrypt data. Typical symmetric encryption algorithms include the Data Encryption Standard (DES) algorithm, the Advanced Encryption Standard (AES) algorithm or the Triple Data Encryption Standard (3DES) algorithm, ChaCha20, Blowfish, Rivest Cipher (RC5), etc. The advantages of symmetric encryption include faster encryption and decryption speed and less computing resources consumed.

[0089] (4) Symmetric encryption key

[0090] Symmetric encryption keys are keys used when symmetric encryption is used. Symmetric encryption keys are usually shared between the sender and the receiver. Symmetric encryption keys are used for both encryption (converting data from plaintext to ciphertext) and decryption (converting data from ciphertext back to plaintext).

[0091] (5) Asymmetric encryption

[0092] Asymmetric encryption is an encryption method. The main feature of asymmetric encryption is that different keys are used when encrypting data and when decrypting data. Asymmetric encryption can also be called public key cryptography. Asymmetric encryption is relatively more secure, but the encryption and decryption speed is slower and consumes a large amount of computing resources. Typical asymmetric encryption algorithms include RSA (Rivest-Shamir-Adleman), Elliptic Curve Cryptography (ECC), Digital Signature Algorithm (DSA), ElGamal or Elliptic Curve Integrated Encryption Scheme (ECIES).

[0093] (6) Asymmetric encryption keys

[0094] An asymmetric encryption key usually consists of a pair of keys, including a public key and a private key. The public key is used to encrypt data and can be shared with others. The private key is used to decrypt data and is kept secret. When using an asymmetric encryption key for data transmission, the sender encrypts the data using the receiver's public key, and the receiver decrypts the data using the private key corresponding to the public key.

[0095] (7) Key Negotiation

[0096] Key negotiation refers to the process of generating and sharing encryption keys between communicating parties. The key obtained through key negotiation is used to encrypt and decrypt data. Key negotiation algorithms include Diffie-Hellman (DH), such as the Elliptic Curve Diffie–Hellman (ECDH) algorithm, ECIES algorithm, RSA encryption algorithm, or ElGamal key exchange.

[0097] The Diffie-Hellman algorithm allows the communicating parties to exchange information to generate a shared key. Taking the interaction between device A and device B as an example, when using the Diffie-Hellman algorithm for key negotiation, device A and device B agree on a prime number p and a generator g as public parameters. Then, device A selects a private key a and calculates the public key A = g^a modp. Device B selects a private key b and calculates the public key B = g^b mod p. Then, device A sends public key A to device B, and device B sends public key B to device A. Then, device A uses device B's public key B and device A's private key a to calculate the shared key Ka = (B^a) mod p. Device B uses device A's public key A and device B's private key b to calculate the shared key Kb = (A^b) mod p.

[0098] When using the RSA encryption algorithm for key negotiation, device A and device B each generate a pair of RSA keys, including a public key and a private key. Then, device A sends the public key of device A to device B. Device B uses the public key of device A to encrypt the randomly generated session key to obtain the ciphertext of the session key. Device B sends the ciphertext of the session key to device A. Device A uses the private key of device A to decrypt the received ciphertext to obtain the session key, which is the encryption key shared between device A and device B.

[0099] When using the elliptic curve DH algorithm for key negotiation, device A and device B select an elliptic curve as a public parameter and select a base point G on the elliptic curve. Then, device A selects a random number as device A's private key a, and device B selects a random number as device B's private key b. Then, device A sends device A's public key A to device B, and device B sends device B's public key B to device A. Then, device A and device B use each other's public key and their own private key to calculate a shared key. The shared key K calculated by device A = (private key a*public key B), and the shared key K calculated by device B = (private key b*public key A).

[0100] For implementation details of the key agreement algorithm, refer to relevant protocol standard drafts, such as ISO IEC 11770, RFC2631, RFC 4753, RFC 5246, RFC 5903, RFC 6090, RFC 7748, RFC 5114, or RFC 5280.

[0101] (8) Identity credentials

[0102] An identity credential is information used to verify the identity of a user. In one possible implementation, the identity credential is text (such as a string), for example, the identity credential includes at least one of an account number, a password (such as a password), or a token. Identity credentials usually need to meet certain complexity requirements, such as an identity credential having a certain length, or containing letters, numbers, or special characters. In another possible implementation, the identity credential is an image, for example, the identity credential is an image of the user's face. Usually when managing a device, the user needs to provide the correct identity credential to successfully log in to the device and obtain permission to manage the device.

[0103] (9) Login page

[0104] The login page is an interface for verifying the identity of the user. When the user wants to manage a resource-constrained device, he needs to enter the account and identity credentials on the login page to verify the identity. Exemplarily, the login page includes an account input control, an identity credential input control, and a submit button. The account input control is a form control for the user to enter the account. The account input control is usually a text box. The identity credential input control is a form control for the user to enter the account. The identity credential input control is usually a text box. The submit button is used to trigger the submission instruction. The login page is, for example, a web interface (web page). The login page includes a Hypertext Markup Language (HTML) file, a cascading style sheet (CSS) file, and a Javascript file. The login page is, for example, a portal page of a resource management device.

[0105] The following is an example of an application scenario of the embodiment of the present application.

[0106] The embodiments of the present application can be applied to a scenario where a user logs in to a resource-constrained device through a network management device to manage the resource-constrained device. Figure 1 , attached Figure 1 1 is a schematic diagram of the architecture of a network system 10 provided in an embodiment of the present application. Devices in the network system 10 can be connected and communicated through a local area network (or private network or intranet). Optionally, the local area network (or private network or intranet) is, for example, an enterprise intranet, a school intranet, a home network, etc. Figure 1 As shown, the network system 10 includes a network management device 101 and a resource-constrained device 102 .

[0107] Attached Figure 1 The network management device 101 shown is a personal computer (PC) with browser software installed, and the resource-constrained device 102 is a network device. In an exemplary scenario, the network management device 101 presents a login page through the browser software, and the user enters the identity credentials (such as account and password) on the login page and clicks the submit button on the login page to trigger a submission instruction. In response to the submission instruction, the network management device 101 sends the identity credentials received on the login page to the resource-constrained device 102. After receiving the identity credentials, the resource-constrained device 102 returns a response to the network management device 101.

[0108] In the above scenario, in order to improve the security of identity credentials (such as passwords) transmission, the network management device 101 uses an encryption key to encrypt the identity credentials, and transmits the identity credentials to the resource-constrained device 102 in the form of ciphertext, thereby reducing the risk of identity credentials being stolen when transmitted between the network management device 101 and the resource-constrained device 102. In order to obtain the encryption key, the network management device 101 and the resource-constrained device 102 need to negotiate a key. Since the key negotiation usually takes a long time, if the network management device 101 starts to negotiate a key with the resource-constrained device 102 after receiving the submission instruction (or after the user clicks the submit button), it will cause the user to wait for a long time for the key negotiation process between the network management device 101 and the resource-constrained device 102 to get the response returned by the resource-constrained device 102 after clicking the submit button, resulting in a slow response speed, affecting the user experience. In particular, since the resource-constrained device has weak computing power, and the key negotiation process involves the operation of the encryption algorithm, resulting in a large amount of calculation, the resource-constrained device completes the key negotiation later, making the problem of slow response more serious.

[0109] Based on this, some embodiments of the present application improve the start time point of key negotiation (or the timing of starting key negotiation), and advance the start time point of key negotiation from after receiving the submit instruction to before receiving the submit instruction. Since the resource-constrained device and the network management device start key negotiation earlier, the time point of obtaining the result of the key negotiation (encryption key) will be earlier, which is equivalent to the resource-constrained device being able to obtain the encryption key in advance. Therefore, after the user clicks the submit button, the resource-constrained device will return a response earlier, thereby reducing the response time and improving the user experience.

[0110] In particular, considering that the operation of users entering identity credentials is usually a time-consuming operation, for example, for security reasons, the length and complexity of the identity credentials must usually meet certain requirements, resulting in the time it takes for users to enter identity credentials is usually relatively long. Taking the identity credential as a password as an example, it usually takes about 6 seconds for users to enter the password before logging in. In addition, sometimes the user does not click the submit button immediately after entering the identity credentials, such as waiting for some time after entering the identity credentials, or further entering some other information other than the identity credentials on the login page, resulting in a certain amount of time between entering the identity credentials and triggering the submit command.

[0111] However, by the method provided by this embodiment, since key negotiation is started before receiving the submit instruction, the network management device can make full use of the time period when the foreground waits for the user to input information such as identity credentials, for example, key negotiation is performed in parallel in the background while the foreground waits for receiving the identity credentials. When the time consumed by key negotiation is less than or equal to the time consumed by inputting the identity credentials, after the user clicks the submit button, there is no need to wait for the key negotiation between the resource-constrained device and the network management device to be completed, thereby further reducing the response time returned by the resource-constrained device.

[0112] refer to Figure 2 , Figure 2 A flow chart of a secure login method provided in an embodiment of the present application is shown. Figure 2 The method shown can be applied to Figure 1 In the network system 10 shown in FIG. Figure 1 The network management device 101 and the resource-constrained device 102 shown interact with each other. Figure 2 The method shown includes the following steps S210 to S231.

[0113] S210: The network management device sends an access request to the resource-constrained device.

[0114] The access request is used to indicate access to a resource-constrained device in order to manage the resource-constrained device. The protocol type adopted by the access request includes a variety of situations. Optionally, the access request is a Hypertext Transfer Protocol (HTTP) message. For example, the access request is an HTTP get request for obtaining a login page. Alternatively, the access request is a Constrained Application Protocol (COAP) message. Alternatively, the access request is a Simple Network Management Protocol (SNMP) message. Alternatively, the access request is a Secure Shell (SSH) message. Alternatively, the access request is a Telnet protocol message. Alternatively, the access request is a web socket protocol message. This embodiment does not limit the protocol type adopted by the access request.

[0115] In a possible implementation of sending an access request, the network management device generates an access request in response to a user's access operation on a resource-constrained device, and sends the access request to the resource-constrained device. For example, the network management device displays a page through a browser software, and the user enters the management Internet Protocol (IP) address of the resource-constrained device in the address bar of the browser. The network management device generates an access request based on the received management IP address of the resource-constrained device, and sends the access request to the resource-constrained device, and the destination IP address field of the access request includes the management IP address of the resource-constrained device.

[0116] S220: The resource-constrained device receives the access request and sends an access response to the access request to the network management device.

[0117] An access response is a response message to an access request. In one possible implementation, the access response has the same protocol type as the access request. Optionally, the access request is an HTTP message. For example, the access request is an HTTP get request for obtaining a login page. Alternatively, the access request is a COAP message. Alternatively, the access request is an SNMP message. Alternatively, the access request is an SSH message. Alternatively, the access request is a Telnet protocol message. Alternatively, the access request is a web socket protocol message.

[0118] In a possible implementation of receiving the access request, the resource-constrained device 102 receives the access request through an interface corresponding to the management IP address.

[0119] The access response is used to present the login page to the user. In one possible implementation, the access response includes the login page. For example, the access response includes the HTML file of the login page, and the HTML file includes the program code of the account input control, the program code of the password input control, and the program code of the submit button. For example, the access response includes the Javascript file of the login page, and the Javascript file includes the program code of the account input control, the program code of the password input control, and the program code of the submit button. In another possible implementation, the access response includes the Uniform Resource Locator (URL) address of the login page and a redirection instruction, and the redirection instruction is used to indicate redirection to the login page based on the URL address of the login page.

[0120] S230: The network management device receives the access response and presents a login page to the user based on the access response.

[0121] In a possible implementation of presenting the login page, the network management device obtains the login page carried in the access response and displays the login page. For example, the network management device parses the access response to obtain a Javascript file or HTML file of the login page carried in the access response; the network management device parses the Javascript file or HTML file to obtain the program code of the account input control, the program code of the password input control, and the program code of the submit button. The network management device executes the program code of the account input control, the program code of the password input control, and the program code of the submit button, thereby rendering the account input control, the password input control, and the submit button in the login page, and then presenting the login page.

[0122] In another possible implementation of presenting the login page, the network management device parses the access response, obtains the URL address of the login page and the redirection instruction carried in the access response, executes the redirection instruction, obtains the login page based on the URL address of the login page, and displays the login page.

[0123] S231, the network management device and the resource-constrained device start key negotiation in the target time period to obtain an encryption key.

[0124] The target time period refers to the time period when key negotiation begins. The end time point of the target time period is the time point when the submit instruction is received on the login page. In other words, the network management device starts key negotiation with the resource-constrained device before receiving the submit instruction. Compared with performing key negotiation after receiving the submit instruction, since key negotiation is performed in advance, key negotiation can be completed as early as possible. In addition, by performing key negotiation in parallel in the background during the time period when the identity credentials are received in the foreground, the advantages of parallel processing are fully utilized, which can effectively reduce the time consumption of the overall login process and improve the efficiency of login.

[0125] In one possible implementation, the starting time point of the target time period is the time point when the network management device receives the access response. In other words, when the network management device receives the access response, it starts to negotiate the key with the resource-constrained device. Since the starting time point of the key negotiation is advanced to the time when the access response is received, the network management device does not need to wait for the parsing of the login page carried in the access response and the rendering of the login page to start the key negotiation. Instead, the network management device can perform key negotiation with the resource-constrained device in parallel while parsing the access response and rendering the login page. For example, key negotiation can be started before the login page is rendered, so as to complete the key negotiation as early as possible, further reducing the time it takes for the user to get a response after clicking to log in.

[0126] In a possible implementation, the starting time point of the target time period is after the time point when the network management device receives the access response. For example, the starting time point of the target time period is after the time point when the network management device receives the access response and a set time length has passed. For example, the time point when the network management device receives the access response is t1, the set time length is t2, and the network management device starts key negotiation at (t1+t2). The set time length is, for example, configured by a user on the network management device, or determined by the network management device according to demand.

[0127] In one possible implementation, the starting time point of the target time period is the time point when the network management device completes a specific action after receiving the access response. For example, the starting time point of the target time period is the time point when the network management device parses the login page from the access response. In other words, when the network management device parses the login page from the access response, it starts to negotiate keys with the resource-constrained device. Since the starting time point of the key negotiation is advanced to the time when the login page is parsed, the network management device does not need to wait for the rendering of the login page to be completed before starting the key negotiation. Instead, the network management device can perform key negotiation with the resource-constrained device in parallel while rendering the login page, thereby completing the key negotiation as early as possible, further reducing the time it takes for the user to obtain a response after clicking to log in. For another example, the starting time point of the target time period is the time point when the network management device completes rendering the login page.

[0128] In one possible implementation, the starting time point of the target time period is the time point when the network management device sends the access request. In other words, when the network management device sends the access request, it starts key negotiation with the resource-constrained device. In one possible implementation, the access request sent by the network management device includes the parameters required for key negotiation. For example, the access request includes the public key of the network management device. In this way, it is equivalent to achieving the purpose of requesting the login page and key negotiation at the same time through one message (access request), so that the communication overhead and number of communications between the network management device and the resource-constrained device during the login process can be saved while completing the key negotiation in advance. In another possible implementation, when the network management device sends an access request to the resource-constrained device, it sends a negotiation request message to the resource-constrained device to initiate key negotiation.

[0129] In one possible implementation, the starting time point of the target time period is the time point when the resource-constrained device sends an access response. In other words, when the resource-constrained device sends an access response, it starts key negotiation with the network management device. In one possible implementation, the access response sent by the resource-constrained device includes the parameters required for key negotiation. For example, the access response includes the public key of the resource-constrained device. In this way, it is equivalent to achieving the purpose of returning to the login page and key negotiation at the same time through one message (access response), so that the communication overhead and number of communications between the network management device and the resource-constrained device during the login process can be saved while completing the key negotiation in advance. In another possible implementation, when the resource-constrained device sends an access response to the network management device, it sends a negotiation request message to the network management device to initiate key negotiation.

[0130] The encryption key is used to encrypt and transmit identity credentials (such as passwords). In some possible implementations, the encryption key is also used to encrypt and transmit business data.

[0131] In some possible implementations, the encryption key is a symmetric encryption key, and the encryption key obtained by the network management device through key negotiation and the encryption key obtained by the resource-constrained device through key negotiation are the same. Exemplarily, the encryption key used by the network management device to encrypt the identity credential is the same as the encryption key used by the resource-constrained device to decrypt the ciphertext of the identity credential.

[0132] In some other possible implementations, the encryption key is an asymmetric encryption key. For example, the encryption key used by the network management device to encrypt the identity credential is different from the encryption key used by the resource-constrained device to decrypt the ciphertext of the identity credential.

[0133] In some possible implementations, the initiator of key negotiation is a network management device, and the responder of key negotiation is a resource-constrained device. For example, the key negotiation process includes the following steps a to c.

[0134] Step a: The network management device sends a negotiation request message to the resource-constrained device in a target time period.

[0135] Step b, the resource-constrained device receives a negotiation request message from the network management device. The resource-constrained device generates a negotiation response message corresponding to the negotiation request message. The resource-constrained device sends a negotiation response message to the network management device. The negotiation response message includes an encryption key. For example, the encryption key is a public key of the resource-constrained device.

[0136] Step c: The network management device receives the negotiation response message from the resource-constrained device and obtains the encryption key carried in the negotiation response message.

[0137] By executing steps a to c, the network management device and the resource-constrained device negotiate an encryption key that is the same at both ends.

[0138] In some other possible implementations, the initiator of the key negotiation is a resource-constrained device, and the responder of the key negotiation is a network management device. For example, the key negotiation process includes the following steps A to C.

[0139] Step A: The resource-constrained device sends a negotiation request message to the network management device in a target time period.

[0140] Step B: The network management device receives a negotiation request message from the resource-constrained device. The network management device generates a negotiation response message corresponding to the negotiation request message. The network management device sends a negotiation response message to the resource-constrained device. The negotiation response message includes an encryption key. For example, the encryption key is a public key of the network management device.

[0141] Step C: The resource-constrained device receives a negotiation response message from the network management device and obtains the encryption key carried in the negotiation response message.

[0142] By executing steps A to C, the network management device and the resource-constrained device negotiate an encryption key that is the same at both ends.

[0143] Taking the Diffie-Hellman algorithm for key negotiation as an example, in a possible implementation, the network management device calculates the public key A of the network management device = g^a mod p based on the private key a of the network management device, the prime number p and the generator g. The network management device sends a negotiation request message to the resource-constrained device, and the negotiation request message includes the public key A of the network management device. The resource-constrained device calculates the public key B of the resource-constrained device = g^b mod p based on the private key b of the resource-constrained device. The resource-constrained device sends a negotiation response message to the network management device, and the negotiation response message includes the public key B of the resource-constrained device. The network management device uses the public key B of the resource-constrained device and the private key a of the network management device to calculate the key Ka = (B^a) mod p, and the key is used for the network management device to encrypt the identity certificate or service data. The resource-constrained device uses the public key A of the network management device and the private key b of the resource-constrained device to calculate the shared key Kb = (A^b) mod p, and the key is used for the resource-constrained device to decrypt the ciphertext of the identity certificate or the ciphertext of the service data.

[0144] Taking the RSA encryption algorithm for key negotiation as an example, in a possible implementation, the network management device sends the public key of the network management device to the resource-constrained device. The resource-constrained device uses the public key of the network management device to encrypt the randomly generated session key to obtain the ciphertext of the session key. The resource-constrained device sends the ciphertext of the session key to the network management device. The network management device uses the private key of the network management device to decrypt the received ciphertext to obtain the session key, which is the encryption key shared between the network management device and the resource-constrained device.

[0145] Taking the key negotiation using the ECC encryption and decryption algorithm as an example, in a possible implementation, the network management device generates a private key a and a public key A based on the generator G of the elliptic curve and the prime number p, where A=G^a. The network management device sends a negotiation request message to the resource-constrained device, and the negotiation request message includes the public key A of the network management device. The resource-constrained device generates a private key b and a public key B based on the same elliptic curve parameters as the network management device. Where B=G^b. The resource-constrained device generates a random number r and a point K containing session key information. Point K can be generated by elliptic curve encoding or using a random number k^G. The resource-constrained device uses the public key A to encrypt the point K containing the session key information to obtain a ciphertext C=K+r^A, and the resource-constrained device sends the ciphertext C together with r^G to the network management device. The network management device uses the private key a to decrypt the ciphertext C to obtain K, where K=Ca^r^G (r^A and r^a^G in C can be eliminated).

[0146] In some possible implementations, the network management device and the resource-constrained device perform key negotiation at the application layer. Exemplarily, the network management device and the resource-constrained device negotiate the encryption key through the application layer protocol. For example, the negotiation request message and the negotiation response message are both HTTP messages. Exemplarily, the HTTP message sent by the resource-constrained device includes an HTTP header and a payload field encapsulated in the inner layer of the HTTP header, and the payload field includes an encryption key (for example, a public key of the resource-constrained device). For another example, the negotiation request message and the negotiation response message are both COAP messages. Exemplarily, the COAP message sent by the resource-constrained device includes a message header, an option, and a payload field, and the option or payload field includes an encryption key (for example, a public key of the resource-constrained device). Considering that traditional security channels (such as the Transport Layer Security (TLS)) involve authentication, key negotiation, encrypted transmission, etc., and even involve the overhead of message fragmentation and reassembly introduced by adding a message header, and the resource-constrained device is limited by insufficient processing resources, it is highly likely that it is difficult to apply the security channel to ensure communication security. In addition, resource-constrained devices may not have secure channels (such as TLS) available at the transport layer, network layer, and link layer. Since key negotiation is performed at the application layer, the reliance on secure channels at the transport layer, network layer, or link layer is reduced, reducing additional overhead.

[0147] S232, the network management device receives the identity certificate on the login page.

[0148] Regarding the method of receiving identity credentials, for example, the login page includes an account input control and a password input control. The user enters the account (such as the administrator account) in the account input control and the password in the password input control. The network management device receives the account and password based on the input operation. The received account and password are specific examples of identity credentials. For another example, the login page includes a shooting button. After the user clicks the shooting button, a shooting instruction is triggered. The network management device responds to the shooting instruction by calling the camera to shoot the user's face image. The shot face image is a specific example of identity credentials.

[0149] S240, in response to receiving a submission instruction on the login page, the network management device encrypts the identity credential using an encryption key to obtain a ciphertext of the identity credential.

[0150] The submit instruction instructs to submit the identity credentials to the resource-constrained device. The submit instruction includes an operator. Exemplarily, the submit instruction is triggered by operating a control such as a submit button in the login page. Alternatively, the user inputs an audio containing keywords such as login or registration in the form of voice, and the network management device recognizes the audio to obtain the submit instruction.

[0151] In the scenario of first login, the submission instruction is, for example, a registration instruction, which instructs submitting identity credentials to the resource-constrained device to register the identity credentials. The registration instruction includes an operator that identifies registration. For example, the login page includes a registration button, the user clicks the registration button, and the network management device generates a registration instruction based on the click operation of the registration button.

[0152] In a scenario where it is not the first login, the submission instruction is, for example, a login instruction, which instructs logging into the resource-constrained device based on the identity credentials, and the login instruction includes an operator that identifies the login. For example, the login page includes a login button, the user clicks the login button, and the network management device generates a registration instruction based on the click operation of the login button.

[0153] Since the network management device performs key negotiation in advance before receiving the identity credential, the network management device basically does not need to wait for key negotiation to obtain the encryption key after receiving the submission instruction. Therefore, the encryption key can be obtained in advance, thereby completing the encryption of the identity credential as early as possible.

[0154] In a possible implementation, the encryption key is a symmetric encryption key, and the network management device uses the symmetric encryption key and the symmetric encryption algorithm to encrypt the identity credential to obtain the identity credential ciphertext. Considering that the speed of executing a symmetric encryption algorithm is faster than that of executing an asymmetric encryption algorithm, and the speed of executing a symmetric encryption algorithm is generally about 1000 times faster than that of executing an asymmetric encryption algorithm, the identity credential is encrypted by using a symmetric encryption algorithm, thereby significantly saving time and improving the speed of encrypting the identity credential.

[0155] In some other possible implementations, the network management device encrypts the identity credential using an asymmetric encryption algorithm and an asymmetric encryption key to obtain a ciphertext of the identity credential.

[0156] S250, the network management device sends the identity credential ciphertext and the operator to the resource-constrained device.

[0157] The operator is used to indicate a login operation performed based on the ciphertext of the identity credentials. In one possible implementation, the network management device parses the submission instruction to obtain the operator carried in the submission instruction. The operator can be identified in the form of a string or a number. Login operations include at least one of the first login (for example, registration) and non-first login (for example, login). By sending an operator to the resource-constrained device, the network management device is equivalent to informing the resource-constrained device which operation to perform. Different values ​​of the operator can be used to represent different login operations. For example, when the value of the operator is 1, it indicates a registration operation, and when the value of the operator is 2, it indicates a login operation. Based on the different values ​​of the operator, the resource-constrained device can distinguish different login operations.

[0158] In some possible implementations, in the first login scenario, the network management device parses the registration instruction to obtain the operator that identifies the registration carried by the registration instruction, and the network management device sends the operator that identifies the registration to the resource-constrained device. In the non-first login scenario, the network management device parses the login instruction to obtain the operator that identifies the login carried by the login instruction, and the network management device sends the operator that identifies the login to the resource-constrained device.

[0159] In some possible implementations, the network management device sends a login request message to the resource-constrained device, and the login request message includes an identity credential ciphertext and an operator. Optionally, the login request message is an HTTP message. For example, the login request message is an HTTP post request for submitting an identity credential ciphertext. Alternatively, the login request message is a COAP message. Alternatively, the login request message is an SNMP message. Alternatively, the login request message is an SSH message. Alternatively, the login request message is a Telnet protocol message. Alternatively, the login request message is a web socket protocol message.

[0160] S260, the resource-constrained device receives the operator and the identity credential ciphertext from the network management device, and the resource-constrained device performs the login operation indicated by the operator based on the identity credential ciphertext.

[0161] In some possible implementations, the resource-constrained device receives a login request message from the network management device, and the resource-constrained device parses the login request message to obtain an operator and identity credential ciphertext carried in the login request message.

[0162] In some possible implementations, the resource-constrained device decrypts the identity credential ciphertext, and the resource-constrained device performs the login operation indicated by the operator based on the decrypted identity credential. For example, the resource-constrained device uses a symmetric encryption algorithm and a symmetric encryption key to decrypt the identity credential ciphertext to obtain the decrypted identity credential. For another example, the resource-constrained device uses an asymmetric encryption algorithm and an asymmetric encryption key to decrypt the identity credential ciphertext to obtain the decrypted identity credential.

[0163] In some possible implementations, in a first login scenario, in response to the login-type operation indicated by the operator being registration, the resource-constrained device encrypts and stores the decrypted identity credentials locally on the resource-constrained device.

[0164] In some possible implementations, in a non-first login scenario, in response to the login operation indicated by the operator being login, the resource-constrained device performs a consistency check based on the decrypted identity credentials and the identity credentials currently saved by the resource-constrained device.

[0165] The consistency check involves the comparison process between different identity credentials. In order to distinguish different identity credentials, the "first identity credential" is used to describe the identity credential obtained after decrypting the identity credential ciphertext received by the resource-constrained device from the network management device, and the "second identity credential" is used to describe the identity credential that the resource-constrained device pre-stored locally on the resource-constrained device before receiving the identity credential ciphertext. For example, the resource-constrained device performs a consistency check on the first identity credential and the second identity credential. If the first identity credential is consistent with the second identity credential, the resource-constrained device determines that the consistency check has passed, and therefore allows the network management device to log in to the resource-constrained device. If the first identity credential is inconsistent with the second identity credential, the resource-constrained device determines that the consistency check has failed, and therefore refuses the network management device to log in to the resource-constrained device.

[0166] In a possible implementation of a resource-constrained device performing consistency check on identity credentials, the resource-constrained device obtains a hash value of a first identity credential and a hash value of a second identity credential; the resource-constrained device determines whether the hash value of the first identity credential is consistent with the hash value of the second identity credential, and if the hash value of the first identity credential is consistent with the hash value of the second identity credential, it is determined that the first identity credential is consistent with the second identity credential. If the hash value of the first identity credential is inconsistent with the hash value of the second identity credential, it is determined that the first identity credential is inconsistent with the second identity credential.

[0167] In another possible implementation of the consistency check of the identity credential by the resource-constrained device, the resource-constrained device obtains a feature vector of the first identity credential and obtains a feature vector of the second identity credential; the resource-constrained device obtains the distance between the feature vector of the first identity credential and the feature vector of the second identity credential. If the distance between the feature vector of the first identity credential and the feature vector of the second identity credential is less than or equal to a threshold value, the resource-constrained device determines that the first identity credential is consistent with the second identity credential. If the distance between the feature vector of the first identity credential and the feature vector of the second identity credential is greater than the threshold value, the resource-constrained device determines that the first identity credential is inconsistent with the second identity credential.

[0168] Optionally, attach Figure 2 The method shown further includes the following S270.

[0169] S270: The resource-constrained device sends the operation result corresponding to the operator to the network management device.

[0170] In some possible implementation manners, in the first login scenario, the operator indicates a registration operation, and the resource-constrained device sends a registration operation result to the network management device. For example, if the encryption and saving of the identity credentials are successful, the resource-constrained device generates a saving success message and sends the saving success message to the network management device. The saving success message is equivalent to a registration success message, and the saving success message indicates that the identity credentials have been successfully encrypted and saved locally on the resource-constrained device. Subsequently, the network management device can log in to the resource-constrained device based on the identity credentials. The saving failure message is equivalent to a registration failure message, and the saving failure message indicates that the encryption and saving of the identity credentials on the resource-constrained device locally fail. Subsequently, the network management device needs to initiate the registration process again.

[0171] In some possible implementation manners, in the non-first login scenario, the operator indicates a login operation, and the resource-constrained device sends a login operation result to the network management device. For example, if the consistency check of the identity credential ciphertext passes (the first identity credential is the same as the second identity credential), the resource-constrained device generates a login success message and sends the login success message to the network management device. The login success message is used to indicate that the login based on the account is successful and further management operations on the resource-constrained device are allowed. If the first identity credential is different from the second identity credential, the resource-constrained device generates a login failure message and sends the login failure message to the network management device. The login failure message is used to indicate that the login based on the account fails and further management operations on the resource-constrained device are refused.

[0172] In some possible implementation manners, after receiving the operation result from the resource-constrained device, the network management device presents the operation result to the user on the login page, thereby prompting the user whether the registration is successful or whether the login is successful.

[0173] Refer to the attached Figure 3 attachment, the attachment Figure 3 is a schematic flowchart of a key negotiation provided in an embodiment of the present application. In the attachment Figure 3 on the basis of which, the main time periods involved in the key negotiation process are marked in the form of curly brackets. The duration consumed by the key negotiation (for example, the duration occupied by S231 in the attachment Figure 2 ) is T1, the duration consumed by the user inputting the identity credentials (such as the account and password) and triggering the submission instruction (such as clicking the login button) is T2, and the total duration consumed by the three steps of S250, S260, and S270 is T3. If T2 >= T1, the waiting duration of the user is T3, which means that the user does not need to wait for the key negotiation after clicking the login button, reducing the user's waiting duration. If T2 < T1, the waiting duration of the user = T3 + (T1 - T2). This means that the waiting duration of the user for the key negotiation after clicking the login button is short (excluding the duration of inputting the identity credentials), and it also reduces the user's waiting duration. In addition, Figure 2 Figure 3 ​Shows the execution at the application layer Figure 2 The key negotiation process in the scenario. Figure 2 Each step in the method shown may be optionally performed at the application layer. For example, the access request in S210, the access response in S220, and the protocol messages involved in the key negotiation in S231 are all implemented by application programs such as browser software or service clients based on application layer protocols.

[0174] In some possible implementations, after successful login, the network management device and the resource-constrained device also use the encryption key obtained by key negotiation to protect data security. For example, in response to the operation result indicating that the login operation based on the identity credential ciphertext is successful (for example, successful registration or successful login), the network management device uses the encryption key to encrypt the business data to obtain the ciphertext of the business data; the network management device sends the ciphertext of the business data to the resource-constrained device. The resource-constrained device receives the ciphertext of the business data from the network management device; the resource-constrained device uses the encryption key to decrypt the ciphertext of the business data to obtain the business data. Since the business data is transmitted between the network management device and the resource-constrained device in the form of ciphertext, even if the business data is stolen by a malicious third party, the malicious third party will find it difficult to directly obtain the business data in plaintext due to the lack of the encryption key, thereby improving the security of the business data.

[0175] In some possible implementations, the network management device and the resource-constrained device transmit service data in a symmetric encryption manner. For example, the network management device uses a symmetric encryption algorithm and a symmetric encryption key to encrypt the service data to obtain the ciphertext of the service data; the resource-constrained device uses a symmetric encryption algorithm and a symmetric encryption key to decrypt the ciphertext of the service data to obtain the service data.

[0176] In some other possible implementations, the network management device and the resource-constrained device transmit the service data in an asymmetric encryption manner. For example, the network management device encrypts the service data using an asymmetric encryption algorithm and an asymmetric encryption key to obtain the ciphertext of the service data; the resource-constrained device decrypts the ciphertext of the service data using an asymmetric encryption algorithm and an asymmetric encryption key to obtain the service data.

[0177] The following is a specific application scenario. Figure 2 The examples illustrate.

[0178] Please refer to Figure 4 , Figure 4 A schematic diagram of an application scenario provided by an embodiment of the present application is shown. Figure 4 The following figure shows the scenario where an administrator manages network devices through a browser software based on the HTTP protocol. Figure 1 The network system 10 shown can be applied to Figure 4 The scenario shown, for example Figure 1 The network management device 101 is shown as running Figure 4 Computer equipment with browser software in Figure 1 The resource-constrained device 102 is shown as Figure 4 In the attached network equipment. Figure 4 In the scenario shown, you can apply the Figure 2 The method shown is to manage network devices. Figure 4 The browser software and the network device are connected through the HTTP channel, and the browser software and the network device can transmit access requests, login pages, password ciphertext and other data through the HTTP channel. Figure 5 The registration instruction in the method shown is attached Figure 2 Specific examples of submitting instructions in the embodiments. Figure 5 The registration button in the method shown is attached Figure 2 Specific examples of the submit button in the embodiment. Figure 6 The login instruction in the method shown is attached Figure 2 Specific examples of submitting instructions in the embodiments. Figure 5 The login button in the method shown is attached Figure 2 A specific example of a submit button in an embodiment.

[0179] The following describes specific implementation examples for the first login scenario and the non-first login scenario respectively.

[0180] Please refer to the attached Figure 5 , attached Figure 5 Combined with the first login scenario Figure 2 In the first login scenario, the network device does not save the password. When the administrator user logs in to the network device for the first time, the password needs to be securely transmitted to the network device and the password needs to be encrypted and stored in the network device. Figure 5 The method shown includes the following S310 to S360.

[0181] S310, the administrator user triggers an HTTP access request through the browser software. For example, the administrator user enters the IP address 192.168.0.1 / 24 of the management interface of the network device in the address bar of the browser software, and the browser software generates and sends an HTTP access request in response to the input operation, and the destination IP address of the HTTP access request is the IP address 192.168.0.1 / 24 of the management interface of the network device.

[0182] S320, the network device receives an HTTP access request from the browser software through the management interface. The network device returns an HTTP access response to the browser software. The HTTP access response includes a login page, and the login page includes a Javascript file.

[0183] S331, the browser software receives the HTTP access response. The browser software parses the HTTP access response and obtains the Javascript file carried in the HTTP access response. The browser software executes the Javascript file and performs key negotiation with the network device based on the HTTP protocol.

[0184] S332, after the browser software receives the HTTP access response, the browser software renders a login page, and the administrator user enters the account and password in the login page. After the administrator user enters the account and password, he clicks the register button to trigger the registration instruction.

[0185] S340, in response to receiving the registration instruction, the browser software uses the symmetric encryption key and the symmetric encryption algorithm to encrypt the password received on the login page to obtain the password ciphertext. The browser software parses the registration instruction to obtain the operator identifying the registration carried by the registration instruction. The browser software sends the account number, the password ciphertext and the operator identifying the registration to the network device based on the HTTP protocol.

[0186] S350, the network device receives the account number, the password ciphertext and the operator for identification registration. The network device decrypts the password ciphertext to obtain the password. The network device encrypts and stores the password based on the operator for identification registration.

[0187] For example, the network device stores the correspondence between the account and the encrypted password, thereby identifying which account each encrypted password belongs to through the correspondence. Optionally, the network device uses a key generated locally by the network device to encrypt and store the password, and the key based on which the password is encrypted and stored is different from the key negotiated with the browser software in S331, thereby further improving the security of the stored password.

[0188] S360, the network device returns the encrypted and saved operation result to the browser software based on the HTTP protocol, where the encrypted and saved operation result includes a saving success message or a saving failure message.

[0189] Please refer to the attached Figure 6 , attached Figure 6 Combined with non-first login scenarios Figure 2 The method shown is further explained. In the non-first login scenario, the network device has encrypted and saved the password. When the administrator user logs in to the network device, the network device needs to verify the consistency between the password entered by the administrator user and the password stored in the network device. If the password entered by the administrator user is consistent with the password stored in the network device, the administrator user is allowed to log in to the network device. If the password entered by the administrator user is inconsistent with the password stored in the network device, the administrator user is denied to log in to the network device. For example, the attached Figure 6The method shown includes the following S410 to S460.

[0190] S410, the administrator user sends an HTTP access request through the browser software.

[0191] S420, the network device receives an HTTP access request from the browser software. The network device returns an HTTP access response to the browser software. The HTTP access response includes a login page, and the login page includes a Javascript file.

[0192] S431, the browser software receives the HTTP access response. The browser software parses the HTTP access response and obtains the Javascript file carried in the HTTP access response. The browser software performs key negotiation with the network device by executing the Javascript file.

[0193] S432, after the browser software receives the HTTP access response, the browser software renders the login page, and the administrator user enters the account and password in the login page (it takes about 6 seconds). After the administrator user enters the account and password, he clicks the login button, thereby triggering the login instruction.

[0194] S440, in response to receiving the login instruction, the browser software uses the symmetric encryption key and the symmetric encryption algorithm to encrypt the password received on the login page to obtain the password ciphertext. The browser software parses the login instruction to obtain the operator identifying the login carried by the login instruction. The browser software transmits the account number, the password ciphertext and the operator identifying the login to the network device based on the HTTP protocol.

[0195] S450: The network device receives the account number, password ciphertext, and the operator for identifying the login based on the HTTP protocol. The network device decrypts the password ciphertext. The network device uses the operator for identifying the login to process the decrypted password and the operator for identifying the login. Figure 5 In the method shown, the encrypted and saved password is checked for consistency at S350. For example, the network device searches for the corresponding relationship between the account number and the encrypted password saved in S350 based on the received account number, thereby obtaining the encrypted password corresponding to the received account number. The network device performs a consistency check based on the found encrypted password and the received password ciphertext.

[0196] S460: The network device returns the result of the consistency check to the browser software based on the HTTP protocol. Figure 5 In the method shown, the password encrypted and saved in S350 is consistent, and the operation result returned by the network device is a login success message. Figure 5In the method shown, the password encrypted and saved in S350 is inconsistent, and the operation result returned by the network device is a login failure message.

[0197] Please refer to Figure 7 , Figure 7 A schematic diagram of an application scenario provided by an embodiment of the present application is shown. Figure 7 The diagram shows a scenario where an administrator manages network devices through a dedicated network management device based on the COAP protocol. Figure 1 The network system 10 shown can be applied to Figure 7 The scenario shown, for example Figure 1 The network management device 101 is shown as Figure 7 Dedicated network management equipment in Figure 1 The resource-constrained device 102 is shown as Figure 7 In the attached network equipment. Figure 7 In the scenario shown, you can apply the Figure 2 The method shown is to manage network devices. Figure 7 The dedicated network management device and the network device are connected through the COAP channel, and the dedicated network management device and the network device can transmit data such as access requests, login pages, and password ciphertext through the COAP channel.

[0198] Below Figure 7 Method and method for managing network devices in the scenario shown Figure 4 Describes the main differences in the methods of managing network devices in the scenarios shown. Figure 7 In the scenario shown, Figure 5 The method shown and the attached Figure 6 The browser software in the method shown is replaced by a dedicated network management device, attached Figure 5 The method shown and the attached Figure 6 In the method shown, sending data based on HTTP protocol is replaced by sending data based on COAP protocol, for example, Figure 5 The method shown and the attached Figure 6 The steps of transmitting data based on the HTTP protocol in the method shown are replaced by transmitting data based on the COAP protocol. Figure 5 The method shown and the attached Figure 6 In the method shown, the HTTP access request and HTTP access response are replaced by the COAP access request and COAP access response respectively, and the key negotiation based on the HTTP protocol is replaced by the key negotiation based on the COAP protocol. The corresponding processing flow can be referred to in the attached Figure 5 The method shown and the attached Figure 6 The method shown will not be described in detail here.

[0199] Figure 8 It is a structural diagram of a secure login device provided in an embodiment of the present application. Figure 8The device 810 shown is optionally provided at Figure 1 The network management device 101 is shown. The device 810 is used to execute Figure 2 The steps in the method shown are performed by the network management device, or Figure 5 The steps of the method shown are performed by the browser software, or Figure 6 The steps in the method shown are performed by the browser software. The device 810 includes a sending unit 811, a receiving unit 812 and a processing unit 813. The sending unit 811 is used to perform Figure 2 S210 and S250, or Figure 5 S310 and S340, or Figure 6 S310 and S340. Receiving unit 812, for receiving access response. Processing unit 813, for executing Figure 2 S230, S231, S232 and S240, or Figure 5 S331 or Figure 6 Medium S331.

[0200] In a possible implementation, the sending unit 811 is further configured to send a negotiation request message to the resource-constrained device in a target time period; the receiving unit 812 is further configured to receive a negotiation response message from the resource-constrained device, wherein the negotiation response message includes an encryption key.

[0201] In a possible implementation, the receiving unit 812 is further configured to receive an operation result corresponding to the operator.

[0202] In one possible implementation, the processing unit 813 is also used to encrypt the business data using a symmetric encryption algorithm and a symmetric encryption key in response to an operation result indicating that a login operation based on the identity credential ciphertext is successful, so as to obtain the ciphertext of the business data; the sending unit 811 is also used to send the ciphertext of the business data to the resource-constrained device.

[0203] The following is combined with Fig.10 The device 900 in the figure describes some possible implementations of various functional units in the apparatus 810 using hardware or software.

[0204] In the case of software implementation, for example, the processing unit 813 is provided by an attached Fig.10 At least one processor 901 in the memory 902 reads the program code stored in the memory 902, and then generates a software function unit to implement the software function unit. In the case of hardware implementation, Figure 8 The above units are attached Fig.10 Different hardware in the device 900 is implemented separately, for example, the processing unit 813 is implemented by the attached Fig.10The receiving unit 812 and the sending unit 811 are implemented by a part of the processing resources of at least one processor 901 (for example, one core or two cores of a multi-core processor), or by a programmable device such as a field-programmable gate array (FPGA) or a coprocessor. Fig.10 The network interface 903 is implemented in.

[0205] Fig. 9 It is a structural diagram of a secure login device 820 provided in an embodiment of the present application. Fig. 9 The device 820 shown is optionally provided at Figure 1 The resource-constrained device 102 is shown. The device 820 is used to execute Figure 2 The steps of the method shown are performed by a resource-constrained device, or Figure 5 The steps of the method shown are performed by the network device, or Figure 6 The steps in the method shown are performed by the network device. The apparatus 820 includes a receiving unit 821 , a sending unit 822 and a processing unit 823 .

[0206] The receiving unit 821 is used to receive the access request; the sending unit 822 is used to execute S220; the processing unit 823 is used to execute S231 and S260;

[0207] In a possible implementation, the receiving unit 821 is further configured to receive an operator and an identity credential ciphertext.

[0208] In a possible implementation, the receiving unit 821 is used to receive a negotiation request message from a network management device within a target time period; the processing unit 823 is also used to generate a negotiation response message corresponding to the negotiation request message; the sending unit 822 is also used to send a negotiation response message to the network management device, and the negotiation response message includes an encryption key.

[0209] In a possible implementation, the processing unit 823 is configured to execute S350.

[0210] In a possible implementation, the sending unit 822 is further configured to send the operation result corresponding to the operator to the network management device.

[0211] In a possible implementation, the receiving unit 821 is further configured to receive ciphertext of service data from the network management device;

[0212] The processing unit 823 is further configured to decrypt the ciphertext of the business data using a symmetric encryption algorithm and an encryption key to obtain the business data.

[0213] The following is combined with Fig.10In the device 900, some possible implementations of each functional unit in the apparatus 820 using hardware or software are described.

[0214] In the case of software implementation, for example, the processing unit 823 is provided by an attached Fig.10 At least one processor 901 in the processor 901 reads the program code stored in the memory 902 and generates a software function unit to implement it.

[0215] In the case of hardware implementation, for example, Fig. 9 The above units are attached Fig.10 Different hardware in the device 900 are implemented separately, for example, the processing unit 823 is implemented by the attached Fig.10 The receiving unit 821 and the sending unit 822 are implemented by a part of the processing resources of at least one processor 901 (for example, one core or two cores of a multi-core processor), or by a programmable device such as a field-programmable gate array (FPGA) or a coprocessor. Fig.10 The network interface 903 is implemented in.

[0216] Attached Fig.10 900 is a schematic diagram of a structure of a device 900 provided in an embodiment of the present application. The device 900 is, for example, Figure 1 The network management device 101 or the resource-constrained device 102. The device 900 is used to execute Figure 2 The steps in the method shown are performed by the network management device, or Figure 5 The steps of the method shown are performed by the browser software, or Figure 6 The steps in the method shown are performed by the browser software. The device 900 is used to perform Figure 2 The steps of the method shown are performed by a resource-constrained device, or Figure 5 The steps of the method shown are performed by the network device, or Figure 6 The steps in the method shown are performed by the network device.

[0217] The device 900 includes at least one processor 901 , a memory 902 , and at least one network interface 903 .

[0218] The processor 901 is, for example, a general-purpose central processing unit (CPU), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the solution of the present application. For example, the processor 901 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0219] The memory 902 is, for example, a read-only memory (ROM) or other static storage device that can store static information and instructions, a random access memory (RAM) or other dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. Optionally, the memory 902 exists independently and is connected to the processor 901 through the internal connection 904. Alternatively, the memory 902 and the processor 901 are optionally integrated together.

[0220] The network interface 903 uses any transceiver-like device for communicating with other devices or communication networks. The network interface 903 includes, for example, at least one of a wired network interface or a wireless network interface. The wired network interface is, for example, an Ethernet interface. The Ethernet interface is, for example, an optical interface, an electrical interface, or a combination thereof. The wireless network interface is, for example, a wireless local area network (WLAN) interface, a cellular network interface, or a combination thereof.

[0221] In some embodiments, the processor 901 includes one or more CPUs, such as Fig.10 CPU0 and CPU1 are shown in the figure.

[0222] In some embodiments, the device 900 optionally includes multiple processors, such as the attached Fig.10 901 and processor 905 are shown in FIG. Each of these processors is, for example, a single-core processor (single-CPU), or a multi-core processor (multi-CPU). The processor here optionally refers to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0223] In some embodiments, the device 900 further includes an internal connection 904. The processor 901, the memory 902, and the at least one network interface 903 are connected via the internal connection 904. The internal connection 904 includes a path to transmit information between the above components. Optionally, the internal connection 904 is a single board or a bus. Optionally, the internal connection 904 is divided into an address bus, a data bus, a control bus, etc.

[0224] In some embodiments, the device 900 further includes an input-output interface 906. The input-output interface 906 is connected to the internal connection 904.

[0225] Optionally, the processor 901 implements the method in the above embodiment by reading the program code stored in the memory 902, or the processor 901 implements the method in the above embodiment by the program code stored internally. In the case where the processor 901 implements the method in the above embodiment by reading the program code stored in the memory 902, the memory 902 stores the program code 910 that implements the method provided in the embodiment of the present application.

[0226] For more details on how the processor 901 implements the above functions, please refer to the descriptions in the previous method embodiments, which will not be repeated here.

[0227] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0228] A refers to B, which means that A is the same as B or A is a simple variant of B.

[0229] The terms "first" and "second" in the description and claims of the embodiments of the present application are used to distinguish different objects, rather than to describe the specific order of objects, and cannot be understood as indicating or implying relative importance. For example, the first identity credential and the second identity credential are used to distinguish different identity credentials, rather than to describe the specific order of identity credentials, and cannot be understood as the first identity credential being more important than the second identity credential.

[0230] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer program instructions on a computer, the process or function described in accordance with the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrations. Available media can be magnetic media, (e.g., floppy disk, hard disk, tape), optical media (e.g., DVD), or semiconductor media (e.g., solid-state hard disk Solid State Disk (SSD)), etc.

[0231] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A secure login method, characterized in that: The method comprises: The network management device sends an access request to the resource-constrained device; The network management device receives an access response from the resource-constrained device to the access request, where the access response is used to present a login page to the user; The network management device presents the login page to the user based on the access response, and performs key negotiation with the resource-constrained device at the beginning of a target time period to obtain an encryption key, wherein the starting time point of the target time period is the time point when the network management device sends the access request, and the ending time point of the target time period is the time point when the network management device receives a submission instruction on the login page, wherein the submission instruction instructs submission of identity credentials to the resource-constrained device; In response to receiving the identity credential and the submission instruction on the login page, the network management device encrypts the identity credential using the encryption key to obtain an identity credential ciphertext, wherein the submission instruction includes the operator; The network management device sends the identity credential ciphertext and the operator to the resource-constrained device, where the operator is used to instruct to perform the login operation based on the identity credential ciphertext.

2. The method according to claim 1, characterized in that The starting time point of the target time period is the time point when the network management device receives the access response or after the time point when the network management device receives the access response.

3. The method according to claim 1, characterized in that The starting of key negotiation with the resource-constrained device within a target time period includes: The network management device sends a negotiation request message to the resource-constrained device in the target time period; The network management device receives a negotiation response message from the resource-constrained device, where the negotiation response message includes the encryption key.

4. The method according to claim 3, characterized in that The negotiation request message and the negotiation response message are both Hypertext Transfer Protocol HTTP messages; or, The negotiation request message and the negotiation response message are both Constrained Application Protocol COAP messages.

5. The method according to claim 1, characterized in that The encryption key includes a symmetric encryption key, and the using the encryption key to encrypt the identity credential includes: The identity credential is encrypted using a symmetric encryption algorithm and the symmetric encryption key to obtain the identity credential ciphertext.

6. The method according to claim 5, characterized in that The encryption key includes a symmetric encryption key. After the network management device sends the identity credential ciphertext and the operator to the resource-constrained device, the method further includes: The network management device receives an operation result corresponding to the operator from the resource-constrained device; In response to the operation result indicating that the login operation is successfully performed based on the identity credential ciphertext, the network management device encrypts the service data using the symmetric encryption algorithm and the symmetric encryption key to obtain the ciphertext of the service data; The network management device sends the ciphertext of the service data to the resource-constrained device.

7. A secure login method, characterized in that: The method comprises: The resource-constrained device receives an access request from the network management device; The resource-constrained device sends an access response to the access request to the network management device, where the access response is used to present a login page to the user; The resource-constrained device starts to perform key negotiation with the network management device in a target time period to obtain an encryption key, the starting time point of the target time period is the time point when the network management device sends the access request, and the ending time point of the target time period is the time point when the network management device receives a submission instruction on the login page, the submission instruction indicates to log in to the resource-constrained device based on the identity credential, and the submission instruction includes an operator; The resource-constrained device receives the operator and the identity credential ciphertext from the network management device, wherein the operator is used to indicate a login operation performed based on the identity credential ciphertext; The resource-constrained device performs a login operation indicated by the operator based on the identity credential ciphertext.

8. The method according to claim 7, characterized in that The resource-constrained device starts to perform key negotiation with the network management device in the target time period, including: In the target time period, the resource-constrained device receives a negotiation request message from the network management device, generates a negotiation response message corresponding to the negotiation request message, and sends the negotiation response message to the network management device, where the negotiation response message includes the encryption key.

9. The method according to claim 7, characterized in that: The resource-constrained device performs a login operation indicated by the operator based on the identity credential ciphertext, including: The resource-constrained device decrypts the identity credential ciphertext using a symmetric encryption algorithm and the encryption key to obtain a first identity credential; In response to the login operation indicated by the operator being the first login, the resource-constrained device encrypts and stores the first identity credential locally in the resource-constrained device; or, In response to the login operation indicated by the operator being a non-first login, the resource-constrained device performs a consistency check on the first identity credential and the second identity credential, where the second identity credential is an identity credential that the resource-constrained device pre-stored locally on the resource-constrained device before receiving the identity credential ciphertext.

10. The method according to claim 7, characterized in that After the resource-constrained device performs the login operation indicated by the operator based on the identity credential ciphertext, the method further includes: The resource-constrained device sends the operation result corresponding to the operator to the network management device.

11. The method according to claim 10, characterized in that After the resource-constrained device sends the operation result corresponding to the operator to the network management device, the method further includes: The resource-constrained device receives the ciphertext of the service data from the network management device; The resource-constrained device uses the symmetric encryption algorithm and the encryption key to decrypt the ciphertext of the service data to obtain the service data.

12. A secure login device, characterized in that: The device is provided in a network management device and comprises: A sending unit, used for sending an access request to a resource-constrained device; A receiving unit, configured to receive an access response from the resource-constrained device to the access request, wherein the access response is used to present a login page to the user; a processing unit, configured to present the login page to the user based on the access response, and to perform key negotiation with the resource-constrained device at the beginning of a target time period to obtain an encryption key, wherein the starting time point of the target time period is the time point when the network management device sends the access request, and the ending time point of the target time period is the time point when the network management device receives a submission instruction on the login page, wherein the submission instruction indicates to submit an identity credential to the resource-constrained device; in response to receiving the identity credential and the submission instruction on the login page, encrypt the identity credential using the encryption key to obtain an identity credential ciphertext, wherein the submission instruction includes the operator; The sending unit is further used to send the identity credential ciphertext and the operator to the resource-constrained device, where the operator is used to instruct to perform the login operation based on the identity credential ciphertext.

13. The device according to claim 12, characterized in that The encryption key includes a symmetric encryption key, and the processing unit is used to encrypt the identity credential using a symmetric encryption algorithm and the symmetric encryption key to obtain the identity credential ciphertext.

14. The device according to claim 13, characterized in that The encryption key includes a symmetric encryption key, and the receiving unit is further used to receive an operation result corresponding to the operator from the resource-constrained device; The processing unit is further configured to, in response to the operation result indicating that the login operation is successfully performed based on the identity credential ciphertext, encrypt the business data using the symmetric encryption algorithm and the symmetric encryption key to obtain the ciphertext of the business data; The sending unit is further configured to send the ciphertext of the service data to the resource-constrained device.

15. A secure login device, characterized in that: Provided on a resource-constrained device, the apparatus comprises: A receiving unit, used for receiving an access request from a network management device; A sending unit, configured to send an access response to the access request to the network management device, wherein the access response is used to present a login page to the user; a processing unit, configured to perform key negotiation with the network management device at the beginning of a target time period to obtain an encryption key, wherein the starting time point of the target time period is the time point when the network management device sends the access request, and the ending time point of the target time period is the time point when the network management device receives a submission instruction on the login page, wherein the submission instruction indicates to log in to the resource-constrained device based on the identity credential, and the submission instruction includes an operator; The receiving unit is further configured to receive the operator and the identity credential ciphertext from the network management device, wherein the operator is used to indicate a login operation performed based on the identity credential ciphertext; The processing unit is further configured to execute a login operation indicated by the operator based on the identity credential ciphertext.

16. The device according to claim 15, characterized in that The processing unit is configured to decrypt the identity credential ciphertext using a symmetric encryption algorithm and the encryption key to obtain a first identity credential; in response to the login operation indicated by the operator being a first login, encrypt and store the first identity credential locally on the resource-constrained device; Alternatively, in response to the login operation indicated by the operator being a non-first login, a consistency check is performed on the first identity credential and the second identity credential, where the second identity credential is an identity credential that is pre-saved locally on the resource-constrained device before the resource-constrained device receives the identity credential ciphertext.

17. The device according to claim 15, characterized in that The receiving unit is further used to receive the ciphertext of the service data from the network management device; The processing unit is further used to decrypt the ciphertext of the business data using the symmetric encryption algorithm and the encryption key to obtain the business data.

18. A network management device, characterized in that: The network management device includes: a processor, the processor is coupled to a memory, the memory stores at least one computer program instruction, and the at least one computer program instruction is loaded and executed by the processor, so that the network management device implements the method described in any one of claims 1-6.

19. A resource-constrained device, characterized in that: The resource-constrained device comprises: a processor, the processor is coupled to a memory, the memory stores at least one computer program instruction, and the at least one computer program instruction is loaded and executed by the processor so that the resource-constrained device implements the method described in any one of claims 7-11.

20. A network system, characterized in that: The system includes the apparatus according to any one of claims 12 to 14 and the apparatus according to any one of claims 15 to 17; or, the system includes the network management device according to claim 18 and the resource-constrained device according to claim 19.

21. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, and when the instruction is executed on a computer, the computer executes the method according to any one of claims 1 to 11.

22. A computer program product, characterized in that The computer program product comprises one or more computer program instructions, and when the computer program instructions are loaded and executed by a computer, the computer is caused to execute the method according to any one of claims 1 to 11.

Images